From 9efd7c029d78ea401db29fa375468e41ee9160b1 Mon Sep 17 00:00:00 2001
From: Peter van der Zee <github-public@qfox.nl>
Date: Wed, 26 Feb 2025 15:18:35 +0100
Subject: [PATCH 1/6] Add command header and dry-run flag

---
 src/commands/action/cmd-action.ts             |   6 +-
 src/commands/analytics/cmd-analytics.ts       |  14 +-
 src/commands/audit-log/cmd-audit-log.ts       |   4 +-
 src/commands/cdxgen/cmd-cdxgen.ts             |  26 +-
 src/commands/dependencies/cmd-dependencies.ts |   2 +
 src/commands/diff-scan/cmd-diff-scan-get.ts   |   4 +-
 src/commands/fix/cmd-fix.ts                   |   9 +-
 src/commands/info/cmd-info.ts                 |  24 +-
 src/commands/login/cmd-login.ts               |   8 +-
 src/commands/logout/cmd-logout.ts             |   9 +-
 src/commands/manifest/cmd-manifest-auto.ts    |  15 +-
 src/commands/manifest/cmd-manifest-gradle.ts  |  57 +-
 src/commands/manifest/cmd-manifest-kotlin.ts  |  45 +-
 src/commands/manifest/cmd-manifest-scala.ts   |  47 +-
 src/commands/npm/cmd-npm.ts                   |   4 +-
 src/commands/npx/cmd-npx.ts                   |   4 +-
 src/commands/oops/cmd-oops.ts                 |  17 +-
 src/commands/optimize/cmd-optimize.ts         |   4 +-
 .../organizations/cmd-organizations.ts        |   4 +-
 src/commands/raw-npm/cmd-raw-npm.ts           |   4 +-
 src/commands/raw-npx/cmd-raw-npx.ts           |   4 +-
 src/commands/report/cmd-report-create.ts      |   4 +-
 src/commands/report/cmd-report-view.ts        |   4 +-
 src/commands/repos/cmd-repos-create.ts        |   4 +-
 .../{cmd-repos-delete.ts => cmd-repos-del.ts} |  19 +-
 src/commands/repos/cmd-repos-list.ts          |   4 +-
 src/commands/repos/cmd-repos-update.ts        |   6 +-
 src/commands/repos/cmd-repos-view.ts          |   4 +-
 src/commands/repos/cmd-repos.ts               |  14 +-
 src/commands/scan/cmd-scan-create.ts          |   9 +-
 .../{cmd-scan-delete.ts => cmd-scan-del.ts}   |  14 +-
 src/commands/scan/cmd-scan-list.ts            |  12 +-
 src/commands/scan/cmd-scan-metadata.ts        |  12 +-
 src/commands/scan/cmd-scan-stream.ts          |  12 +-
 src/commands/scan/cmd-scan.ts                 |   4 +-
 src/commands/threat-feed/cmd-threat-feed.ts   |   2 +
 src/commands/wrapper/cmd-wrapper.ts           |  13 +-
 src/flags.ts                                  |   5 +
 src/utils/meow-with-subcommands.ts            |  50 +-
 test/dry-run.test.ts                          | 915 ++++++++++++++++++
 test/socket-cdxgen.test.ts                    |   7 +-
 41 files changed, 1233 insertions(+), 192 deletions(-)
 rename src/commands/repos/{cmd-repos-delete.ts => cmd-repos-del.ts} (80%)
 rename src/commands/scan/{cmd-scan-delete.ts => cmd-scan-del.ts} (87%)
 create mode 100644 test/dry-run.test.ts

diff --git a/src/commands/action/cmd-action.ts b/src/commands/action/cmd-action.ts
index b8e7db161..99144dce3 100644
--- a/src/commands/action/cmd-action.ts
+++ b/src/commands/action/cmd-action.ts
@@ -28,9 +28,9 @@ const config: CliCommandConfig = {
       description: 'After marker'
     }
   },
-  help: (parentName, { commandName, flags }) => `
+  help: (command, { flags }) => `
     Usage
-      $ ${parentName} ${commandName} [options]
+      $ ${command} [options]
 
     Options
       ${getFlagListOutput(flags, 6)}
@@ -58,5 +58,7 @@ async function run(
   const githubEventBefore = String(cli.flags['githubEventBefore'] || '')
   const githubEventAfter = String(cli.flags['githubEventAfter'] || '')
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await runAction(githubEventBefore, githubEventAfter)
 }
diff --git a/src/commands/analytics/cmd-analytics.ts b/src/commands/analytics/cmd-analytics.ts
index b993bfb31..7e618cb0a 100644
--- a/src/commands/analytics/cmd-analytics.ts
+++ b/src/commands/analytics/cmd-analytics.ts
@@ -42,9 +42,9 @@ const config: CliCommandConfig = {
       description: 'Path to a local file to save the output'
     }
   },
-  help: (parentName, { commandName, flags }) => `
+  help: (command, { flags }) => `
     Usage
-      $ ${parentName} ${commandName} --scope=<scope> --time=<time filter>
+      $ ${command} --scope=<scope> --time=<time filter>
 
     Default parameters are set to show the organization-level analytics over the
     last 7 days.
@@ -53,9 +53,9 @@ const config: CliCommandConfig = {
       ${getFlagListOutput(flags, 6)}
 
     Examples
-      $ ${parentName} ${commandName} --scope=org --time=7
-      $ ${parentName} ${commandName} --scope=org --time=30
-      $ ${parentName} ${commandName} --scope=repo --repo=test-repo --time=30
+      $ ${command} --scope=org --time=7
+      $ ${command} --scope=org --time=30
+      $ ${command} --scope=repo --repo=test-repo --time=30
   `
 }
 
@@ -89,7 +89,7 @@ async function run(
       - The time filter must either be 7, 30 or 90 ${badTime ? colors.red('(bad!)') : colors.green('(ok)')}\n
       - Repository name using --repo when scope is "repo" ${badRepo ? colors.red('(bad!)') : colors.green('(ok)')}\n
     `)
-    cli.showHelp()
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -100,6 +100,8 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   return await displayAnalytics({
     apiToken,
     scope,
diff --git a/src/commands/audit-log/cmd-audit-log.ts b/src/commands/audit-log/cmd-audit-log.ts
index 53cd9e247..a8228110a 100644
--- a/src/commands/audit-log/cmd-audit-log.ts
+++ b/src/commands/audit-log/cmd-audit-log.ts
@@ -72,7 +72,7 @@ async function run(
     console.error(`${colors.bgRed(colors.white('Input error'))}: Please provide the required fields:\n
     - Org name as the first argument ${!orgSlug ? colors.red('(missing!)') : colors.green('(ok)')}\n
     `)
-    config.help(parentName, config)
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -83,6 +83,8 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await getAuditLog({
     apiToken,
     orgSlug,
diff --git a/src/commands/cdxgen/cmd-cdxgen.ts b/src/commands/cdxgen/cmd-cdxgen.ts
index 191e0d6ba..0c9cee035 100644
--- a/src/commands/cdxgen/cmd-cdxgen.ts
+++ b/src/commands/cdxgen/cmd-cdxgen.ts
@@ -6,9 +6,11 @@ import yargsParse from 'yargs-parser'
 import { pluralize } from '@socketsecurity/registry/lib/words'
 
 import { runCycloneDX } from './run-cyclonedx.ts'
-import { CliCommandConfig } from '../../utils/meow-with-subcommands.ts'
+import { meowOrExit } from '../../utils/meow-with-subcommands.ts'
 import { getFlagListOutput } from '../../utils/output-formatting.ts'
 
+import type { CliCommandConfig } from '../../utils/meow-with-subcommands.ts'
+
 // TODO: convert yargs to meow. Or convert all the other things to yargs.
 const toLower = (arg: string) => arg.toLowerCase()
 const arrayToLower = (arg: string[]) => arg.map(toLower)
@@ -126,16 +128,16 @@ export const cmdCdxgen = {
 
 async function run(
   argv: readonly string[],
-  _importMeta: ImportMeta,
-  { parentName: _parentName }: { parentName: string }
+  importMeta: ImportMeta,
+  { parentName }: { parentName: string }
 ): Promise<void> {
-  // const cli = meowOrExit({
-  //   allowUnknownFlags: true,
-  //   argv,
-  //   config,
-  //   importMeta,
-  //   parentName,
-  // })
+  const cli = meowOrExit({
+    allowUnknownFlags: true,
+    argv: argv.filter(s => s !== '--help' && s !== '-h'), // Don't let meow take over --help
+    config,
+    importMeta,
+    parentName
+  })
   //
   //
   // if (cli.input.length)
@@ -154,10 +156,10 @@ async function run(
   const unknown: Array<string> = yargv._
   const { length: unknownLength } = unknown
   if (unknownLength) {
-    process.exitCode = 1
     console.error(
       `Unknown ${pluralize('argument', unknownLength)}: ${yargv._.join(', ')}`
     )
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -165,5 +167,7 @@ async function run(
     yargv.output = 'socket-cdx.json'
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await runCycloneDX(yargv)
 }
diff --git a/src/commands/dependencies/cmd-dependencies.ts b/src/commands/dependencies/cmd-dependencies.ts
index c3a599cea..72aa5f868 100644
--- a/src/commands/dependencies/cmd-dependencies.ts
+++ b/src/commands/dependencies/cmd-dependencies.ts
@@ -56,6 +56,8 @@ async function run(
     parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   // TODO: markdown flag is ignored
   await findDependencies({
     limit: Number(cli.flags['limit'] || 0) || 0,
diff --git a/src/commands/diff-scan/cmd-diff-scan-get.ts b/src/commands/diff-scan/cmd-diff-scan-get.ts
index 99b620275..4e32bb6e4 100644
--- a/src/commands/diff-scan/cmd-diff-scan-get.ts
+++ b/src/commands/diff-scan/cmd-diff-scan-get.ts
@@ -81,7 +81,7 @@ async function run(
           - To get full scans IDs, you can run the command "socket scan list <your org slug>".
       - Org name as the first argument ${!orgSlug ? colors.red('(missing!)') : colors.green('(ok)')}\n}
     `)
-    config.help(parentName, config)
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -92,6 +92,8 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await getDiffScan(
     {
       outputJson: Boolean(cli.flags['json']),
diff --git a/src/commands/fix/cmd-fix.ts b/src/commands/fix/cmd-fix.ts
index 0d1d23194..d664a9967 100644
--- a/src/commands/fix/cmd-fix.ts
+++ b/src/commands/fix/cmd-fix.ts
@@ -1,4 +1,5 @@
 import { runFix } from './run-fix.ts'
+import { commonFlags } from '../../flags.ts'
 import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting.ts'
 
@@ -8,7 +9,9 @@ const config: CliCommandConfig = {
   commandName: 'fix',
   description: 'Fix "fixable" Socket alerts',
   hidden: true,
-  flags: {},
+  flags: {
+    ...commonFlags
+  },
   help: (command, config) => `
     Usage
       $ ${command}
@@ -29,12 +32,14 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  meowOrExit({
+  const cli = meowOrExit({
     argv,
     config,
     importMeta,
     parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await runFix()
 }
diff --git a/src/commands/info/cmd-info.ts b/src/commands/info/cmd-info.ts
index f79b9bd7c..fe09d7aa8 100644
--- a/src/commands/info/cmd-info.ts
+++ b/src/commands/info/cmd-info.ts
@@ -1,6 +1,7 @@
+import colors from 'yoctocolors-cjs'
+
 import { getPackageInfo } from './get-package-info.ts'
 import { commonFlags, outputFlags, validationFlags } from '../../flags'
-import { InputError } from '../../utils/errors'
 import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting'
 
@@ -46,24 +47,25 @@ async function run(
     parentName
   })
 
-  if (cli.input.length > 1) {
-    throw new InputError('Only one package lookup supported at once')
-  }
-  const { 0: rawPkgName = '' } = cli.input
-  let showHelp = cli.flags['help']
-  if (!rawPkgName) {
-    showHelp = true
-  }
-  if (showHelp) {
-    cli.showHelp()
+  const [rawPkgName = ''] = cli.input
+
+  if (!rawPkgName || cli.input.length > 1) {
+    console.error(`${colors.bgRed(colors.white('Input error'))}: Please provide the required fields:\n
+      - Expecting a package name ${!rawPkgName ? colors.red('(missing!)') : colors.green('(ok)')}\n
+      - Can only accept one package at a time ${cli.input.length > 1 ? colors.red('(got ' + cli.input.length + '!)') : colors.green('(ok)')}\n
+    `)
+    process.exitCode = 2 // bad input
     return
   }
+
   const versionSeparator = rawPkgName.lastIndexOf('@')
   const pkgName =
     versionSeparator < 1 ? rawPkgName : rawPkgName.slice(0, versionSeparator)
   const pkgVersion =
     versionSeparator < 1 ? 'latest' : rawPkgName.slice(versionSeparator + 1)
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await getPackageInfo({
     commandName: `${parentName} ${config.commandName}`,
     includeAllIssues: Boolean(cli.flags['all']),
diff --git a/src/commands/login/cmd-login.ts b/src/commands/login/cmd-login.ts
index e1f1d5b07..16ccd6bc0 100644
--- a/src/commands/login/cmd-login.ts
+++ b/src/commands/login/cmd-login.ts
@@ -1,6 +1,7 @@
 import isInteractive from '@socketregistry/is-interactive/index.cjs'
 
 import { attemptLogin } from './attempt-login.ts'
+import { commonFlags } from '../../flags.ts'
 import { InputError } from '../../utils/errors'
 import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting'
@@ -12,6 +13,7 @@ const config: CliCommandConfig = {
   description: 'Socket API login',
   hidden: false,
   flags: {
+    ...commonFlags,
     apiBaseUrl: {
       type: 'string',
       description: 'API server to connect to for login'
@@ -54,7 +56,9 @@ async function run(
     parentName
   })
 
-  if (!isInteractive()) {
+  const isDryRun = cli.flags['dryRun']
+
+  if (!isInteractive() && !isDryRun) {
     throw new InputError(
       'Cannot prompt for credentials in a non-interactive shell'
     )
@@ -63,5 +67,7 @@ async function run(
   let apiBaseUrl = cli.flags['apiBaseUrl'] as string | undefined
   let apiProxy = cli.flags['apiProxy'] as string | undefined
 
+  if (isDryRun) return console.log('[DryRun] Bailing now')
+
   await attemptLogin(apiBaseUrl, apiProxy)
 }
diff --git a/src/commands/logout/cmd-logout.ts b/src/commands/logout/cmd-logout.ts
index fbc43d49e..5199c7f9d 100644
--- a/src/commands/logout/cmd-logout.ts
+++ b/src/commands/logout/cmd-logout.ts
@@ -1,4 +1,5 @@
 import { attemptLogout } from './attempt-logout.ts'
+import { commonFlags } from '../../flags.ts'
 import { meowOrExit } from '../../utils/meow-with-subcommands'
 
 import type { CliCommandConfig } from '../../utils/meow-with-subcommands.ts'
@@ -7,7 +8,9 @@ const config: CliCommandConfig = {
   commandName: 'logout',
   description: 'Socket API logout',
   hidden: false,
-  flags: {},
+  flags: {
+    ...commonFlags
+  },
   help: (command, _config) => `
     Usage
       $ ${command}
@@ -27,12 +30,14 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  meowOrExit({
+  const cli = meowOrExit({
     argv,
     config,
     importMeta,
     parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   attemptLogout()
 }
diff --git a/src/commands/manifest/cmd-manifest-auto.ts b/src/commands/manifest/cmd-manifest-auto.ts
index 126402b55..007295dd0 100644
--- a/src/commands/manifest/cmd-manifest-auto.ts
+++ b/src/commands/manifest/cmd-manifest-auto.ts
@@ -6,6 +6,7 @@ import meow from 'meow'
 import { cmdManifestGradle } from './cmd-manifest-gradle.ts'
 import { cmdManifestScala } from './cmd-manifest-scala.ts'
 import { commonFlags } from '../../flags.ts'
+import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting.ts'
 
 import type { CliCommandConfig } from '../../utils/meow-with-subcommands'
@@ -51,13 +52,13 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  const cli = meow(config.help(parentName, config), {
+  const cli = meowOrExit({
     argv,
-    description: config.description,
+    config,
     importMeta,
-    flags: config.flags,
-    allowUnknownFlags: false
+    parentName
   })
+
   const verbose = !!cli.flags['verbose']
   const cwd = <string>cli.flags['cwd'] ?? process.cwd()
   if (verbose) {
@@ -81,6 +82,9 @@ async function run(
       subArgs.push('--cwd', cwd)
     }
     subArgs.push(dir)
+
+    if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
     await cmdManifestScala.run(subArgs, importMeta, { parentName })
     return
   }
@@ -90,6 +94,9 @@ async function run(
       // This command takes the cwd as first arg.
       subArgs.push(cwd)
     }
+
+    if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
     await cmdManifestGradle.run(subArgs, importMeta, { parentName })
     return
   }
diff --git a/src/commands/manifest/cmd-manifest-gradle.ts b/src/commands/manifest/cmd-manifest-gradle.ts
index 1422de6a0..5d367c45f 100644
--- a/src/commands/manifest/cmd-manifest-gradle.ts
+++ b/src/commands/manifest/cmd-manifest-gradle.ts
@@ -1,11 +1,10 @@
 import path from 'node:path'
 
-import meow from 'meow'
-
-import { Spinner } from '@socketsecurity/registry/lib/spinner'
+import colors from 'yoctocolors-cjs'
 
 import { convertGradleToMaven } from './convert_gradle_to_maven.ts'
 import { commonFlags } from '../../flags.ts'
+import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting.ts'
 
 import type { CliCommandConfig } from '../../utils/meow-with-subcommands'
@@ -96,13 +95,11 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  // note: meow will exit if it prints the --help screen
-  const cli = meow(config.help(parentName, config), {
-    flags: config.flags,
-    argv: argv.length === 0 ? ['--help'] : argv,
-    description: config.description,
-    allowUnknownFlags: false,
-    importMeta
+  const cli = meowOrExit({
+    argv,
+    config,
+    importMeta,
+    parentName
   })
 
   const verbose = Boolean(cli.flags['verbose'])
@@ -116,24 +113,18 @@ async function run(
   }
 
   const target = cli.input[0]
-  if (!target) {
-    // will exit.
-    new Spinner()
-      .start('Parsing...')
-      .error(
-        `Failure: Missing DIR argument. See \`${parentName} ${config.commandName} --help\` for details.`
-      )
-    process.exit(1)
-  }
 
-  if (cli.input.length > 1) {
-    // will exit.
-    new Spinner()
-      .start('Parsing...')
-      .error(
-        `Failure: Can only accept one FILE or DIR, received ${cli.input.length} (make sure to escape spaces!). See \`${parentName} ${config.commandName} --help\` for details.`
-      )
-    process.exit(1)
+  // TODO: I'm not sure it's feasible to parse source file from stdin. We could try, store contents in a file in some folder, target that folder... what would the file name be?
+
+  if (!target || target === '-' || cli.input.length > 1) {
+    console.error(
+      `${colors.bgRed(colors.white('Input error'))}: Please provide the required fields:\n
+      - The DIR arg is required ${!target ? colors.red('(missing!)') : target === '-' ? colors.red('(stdin is not supported)') : colors.green('(ok)')}\n
+      - Can only accept one DIR (make sure to escape spaces!) ${cli.input.length > 1 ? colors.red(`(received ${cli.input.length}!)`) : colors.green('(ok)')}\n
+    `
+    )
+    process.exitCode = 2 // bad input
+    return
   }
 
   let bin: string
@@ -151,16 +142,6 @@ async function run(
     out = '-'
   }
 
-  // TODO: I'm not sure it's feasible to parse source file from stdin. We could try, store contents in a file in some folder, target that folder... what would the file name be?
-  if (target === '-') {
-    new Spinner()
-      .start('Parsing...')
-      .error(
-        `Failure: Currently source code from stdin is not supported. See \`${parentName} ${config.commandName} --help\` for details.`
-      )
-    process.exit(1)
-  }
-
   if (verbose) {
     console.group()
     console.log('- target:', target)
@@ -177,5 +158,7 @@ async function run(
       .filter(Boolean)
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await convertGradleToMaven(target, bin, out, verbose, gradleOpts)
 }
diff --git a/src/commands/manifest/cmd-manifest-kotlin.ts b/src/commands/manifest/cmd-manifest-kotlin.ts
index 583bdfaec..0375209a9 100644
--- a/src/commands/manifest/cmd-manifest-kotlin.ts
+++ b/src/commands/manifest/cmd-manifest-kotlin.ts
@@ -1,11 +1,12 @@
 import path from 'node:path'
 
-import meow from 'meow'
+import colors from 'yoctocolors-cjs'
 
 import { Spinner } from '@socketsecurity/registry/lib/spinner'
 
 import { convertGradleToMaven } from './convert_gradle_to_maven.ts'
 import { commonFlags } from '../../flags.ts'
+import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting.ts'
 
 import type { CliCommandConfig } from '../../utils/meow-with-subcommands'
@@ -101,13 +102,11 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  // note: meow will exit if it prints the --help screen
-  const cli = meow(config.help(parentName, config), {
-    flags: config.flags,
-    argv: argv.length === 0 ? ['--help'] : argv,
-    description: config.description,
-    allowUnknownFlags: false,
-    importMeta
+  const cli = meowOrExit({
+    argv,
+    config,
+    importMeta,
+    parentName
   })
 
   const verbose = Boolean(cli.flags['verbose'])
@@ -121,24 +120,18 @@ async function run(
   }
 
   const target = cli.input[0]
-  if (!target) {
-    // will exit.
-    new Spinner()
-      .start('Parsing...')
-      .error(
-        `Failure: Missing DIR argument. See \`${parentName} ${config.commandName} --help\` for details.`
-      )
-    process.exit(1)
-  }
 
-  if (cli.input.length > 1) {
-    // will exit.
-    new Spinner()
-      .start('Parsing...')
-      .error(
-        `Failure: Can only accept one FILE or DIR, received ${cli.input.length} (make sure to escape spaces!). See \`${parentName} ${config.commandName} --help\` for details.`
-      )
-    process.exit(1)
+  // TODO: I'm not sure it's feasible to parse source file from stdin. We could try, store contents in a file in some folder, target that folder... what would the file name be?
+
+  if (!target || target === '-' || cli.input.length > 1) {
+    console.error(
+      `${colors.bgRed(colors.white('Input error'))}: Please provide the required fields:\n
+      - The DIR arg is required ${!target ? colors.red('(missing!)') : target === '-' ? colors.red('(stdin is not supported)') : colors.green('(ok)')}\n
+      - Can only accept one DIR (make sure to escape spaces!) ${cli.input.length > 1 ? colors.red(`(received ${cli.input.length}!)`) : colors.green('(ok)')}\n
+    `
+    )
+    process.exitCode = 2 // bad input
+    return
   }
 
   let bin: string
@@ -182,5 +175,7 @@ async function run(
       .filter(Boolean)
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await convertGradleToMaven(target, bin, out, verbose, gradleOpts)
 }
diff --git a/src/commands/manifest/cmd-manifest-scala.ts b/src/commands/manifest/cmd-manifest-scala.ts
index 3aca30a2f..240431da8 100644
--- a/src/commands/manifest/cmd-manifest-scala.ts
+++ b/src/commands/manifest/cmd-manifest-scala.ts
@@ -1,15 +1,16 @@
-import meow from 'meow'
+import colors from 'yoctocolors-cjs'
 
 import { Spinner } from '@socketsecurity/registry/lib/spinner'
 
 import { convertSbtToMaven } from './convert_sbt_to_maven.ts'
 import { commonFlags } from '../../flags.ts'
+import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting.ts'
 
 import type { CliCommandConfig } from '../../utils/meow-with-subcommands'
 
 const config: CliCommandConfig = {
-  commandName: 'kotlin',
+  commandName: 'scala',
   description:
     "[beta] Generate a manifest file (`pom.xml`) from Scala's `build.sbt` file",
   hidden: false,
@@ -92,13 +93,11 @@ async function run(
   { parentName }: { parentName: string }
 ): Promise<void> {
   // console.log('scala', argv, parentName)
-  // note: meow will exit if it prints the --help screen
-  const cli = meow(config.help(parentName, config), {
-    flags: config.flags,
-    argv: argv.length === 0 ? ['--help'] : argv,
-    description: config.description,
-    allowUnknownFlags: false,
-    importMeta
+  const cli = meowOrExit({
+    argv,
+    config,
+    importMeta,
+    parentName
   })
 
   const verbose = Boolean(cli.flags['verbose'])
@@ -112,24 +111,18 @@ async function run(
   }
 
   const target = cli.input[0]
-  if (!target) {
-    // will exit.
-    new Spinner()
-      .start('Parsing...')
-      .error(
-        `Failure: Missing FILE|DIR argument. See \`${parentName} ${config.commandName} --help\` for details.`
-      )
-    process.exit(1)
-  }
 
-  if (cli.input.length > 1) {
-    // will exit.
-    new Spinner()
-      .start('Parsing...')
-      .error(
-        `Failure: Can only accept one FILE or DIR, received ${cli.input.length} (make sure to escape spaces!). See \`${parentName} ${config.commandName} --help\` for details.`
-      )
-    process.exit(1)
+  // TODO: I'm not sure it's feasible to parse source file from stdin. We could try, store contents in a file in some folder, target that folder... what would the file name be?
+
+  if (!target || target === '-' || cli.input.length > 1) {
+    console.error(
+      `${colors.bgRed(colors.white('Input error'))}: Please provide the required fields:\n
+      - The DIR or FILE arg is required ${!target ? colors.red('(missing!)') : target === '-' ? colors.red('(stdin is not supported)') : colors.green('(ok)')}\n
+      - Can only accept one DIR or FILE (make sure to escape spaces!) ${cli.input.length > 1 ? colors.red(`(received ${cli.input.length}!)`) : colors.green('(ok)')}\n
+    `
+    )
+    process.exitCode = 2 // bad input
+    return
   }
 
   let bin: string = 'sbt'
@@ -171,5 +164,7 @@ async function run(
       .filter(Boolean)
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await convertSbtToMaven(target, bin, out, verbose, sbtOpts)
 }
diff --git a/src/commands/npm/cmd-npm.ts b/src/commands/npm/cmd-npm.ts
index 4614a37b2..e9afc770a 100644
--- a/src/commands/npm/cmd-npm.ts
+++ b/src/commands/npm/cmd-npm.ts
@@ -28,7 +28,7 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  meowOrExit({
+  const cli = meowOrExit({
     allowUnknownFlags: true,
     argv,
     config,
@@ -36,5 +36,7 @@ async function run(
     parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await wrapNpm(argv)
 }
diff --git a/src/commands/npx/cmd-npx.ts b/src/commands/npx/cmd-npx.ts
index 572e1a6dc..251abd568 100644
--- a/src/commands/npx/cmd-npx.ts
+++ b/src/commands/npx/cmd-npx.ts
@@ -28,7 +28,7 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  meowOrExit({
+  const cli = meowOrExit({
     allowUnknownFlags: true,
     argv,
     config,
@@ -36,5 +36,7 @@ async function run(
     parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await wrapNpx(argv)
 }
diff --git a/src/commands/oops/cmd-oops.ts b/src/commands/oops/cmd-oops.ts
index 51a991f56..fcaa091bb 100644
--- a/src/commands/oops/cmd-oops.ts
+++ b/src/commands/oops/cmd-oops.ts
@@ -1,12 +1,15 @@
-import meowOrExit from 'meow'
+import { commonFlags } from '../../flags.ts'
+import { meowOrExit } from '../../utils/meow-with-subcommands.ts'
 
-import { CliCommandConfig } from '../../utils/meow-with-subcommands.ts'
+import type { CliCommandConfig } from '../../utils/meow-with-subcommands.ts'
 
 const config: CliCommandConfig = {
   commandName: 'oops',
   description: 'Trigger an intentional error (for development)',
   hidden: true,
-  flags: {},
+  flags: {
+    ...commonFlags
+  },
   help: (parentName, config) => `
     Usage
       $ ${parentName} ${config.commandName}
@@ -26,12 +29,14 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  meowOrExit(config.help(parentName, config), {
+  const cli = meowOrExit({
     argv,
-    description: config.description,
+    config,
     importMeta,
-    flags: config.flags
+    parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   throw new Error('This error was intentionally left blank')
 }
diff --git a/src/commands/optimize/cmd-optimize.ts b/src/commands/optimize/cmd-optimize.ts
index 7df5446c0..6930e30f2 100644
--- a/src/commands/optimize/cmd-optimize.ts
+++ b/src/commands/optimize/cmd-optimize.ts
@@ -8,7 +8,7 @@ import { getFlagListOutput } from '../../utils/output-formatting'
 import type { CliCommandConfig } from '../../utils/meow-with-subcommands.ts'
 
 const config: CliCommandConfig = {
-  commandName: 'create',
+  commandName: 'optimize',
   description: 'Optimize dependencies with @socketregistry overrides',
   hidden: false,
   flags: {
@@ -57,6 +57,8 @@ async function run(
 
   const cwd = process.cwd()
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await applyOptimization(
     cwd,
     Boolean(cli.flags['pin']),
diff --git a/src/commands/organizations/cmd-organizations.ts b/src/commands/organizations/cmd-organizations.ts
index 0a67683c6..ce2dd8b2c 100644
--- a/src/commands/organizations/cmd-organizations.ts
+++ b/src/commands/organizations/cmd-organizations.ts
@@ -25,12 +25,14 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  meowOrExit({
+  const cli = meowOrExit({
     argv,
     config,
     importMeta,
     parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await getOrganizations()
 }
diff --git a/src/commands/raw-npm/cmd-raw-npm.ts b/src/commands/raw-npm/cmd-raw-npm.ts
index 40cecce9b..664fe3c67 100644
--- a/src/commands/raw-npm/cmd-raw-npm.ts
+++ b/src/commands/raw-npm/cmd-raw-npm.ts
@@ -35,7 +35,7 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  meowOrExit({
+  const cli = meowOrExit({
     allowUnknownFlags: true,
     argv,
     config,
@@ -43,5 +43,7 @@ async function run(
     parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await runRawNpm(argv)
 }
diff --git a/src/commands/raw-npx/cmd-raw-npx.ts b/src/commands/raw-npx/cmd-raw-npx.ts
index 0e0156b63..d6058381b 100644
--- a/src/commands/raw-npx/cmd-raw-npx.ts
+++ b/src/commands/raw-npx/cmd-raw-npx.ts
@@ -35,7 +35,7 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  meowOrExit({
+  const cli = meowOrExit({
     allowUnknownFlags: true,
     argv,
     config,
@@ -43,5 +43,7 @@ async function run(
     parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await runRawNpx(argv)
 }
diff --git a/src/commands/report/cmd-report-create.ts b/src/commands/report/cmd-report-create.ts
index 3c66b94a1..4ec367616 100644
--- a/src/commands/report/cmd-report-create.ts
+++ b/src/commands/report/cmd-report-create.ts
@@ -92,9 +92,11 @@ async function run(
 
   if (dryRun && view) {
     console.log(
-      '[dryrun] Ignoring view flag since no report was actually generated'
+      '[DryRun] Ignoring view flag since no report was actually generated'
     )
   }
+  if (dryRun) return console.log('[DryRun] Bailing now')
+
   if (result?.success) {
     if (view) {
       const reportId = result.data.id
diff --git a/src/commands/report/cmd-report-view.ts b/src/commands/report/cmd-report-view.ts
index 17c0b6a58..01c7eff4a 100644
--- a/src/commands/report/cmd-report-view.ts
+++ b/src/commands/report/cmd-report-view.ts
@@ -54,10 +54,12 @@ async function run(
       - Need at least one report ID ${!reportId ? colors.red('(missing!)') : colors.green('(ok)')}\n
       - Can only handle a single report ID ${extraInput.length < 2 ? colors.red(`(received ${extraInput.length}!)`) : colors.green('(ok)')}\n
     `)
-    cli.showHelp()
+    process.exitCode = 2 // bad input
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await viewReport(reportId, {
     all: Boolean(cli.flags['all']),
     commandName: `${parentName} ${config.commandName}`,
diff --git a/src/commands/repos/cmd-repos-create.ts b/src/commands/repos/cmd-repos-create.ts
index dfcbe40bf..e80fb6a76 100644
--- a/src/commands/repos/cmd-repos-create.ts
+++ b/src/commands/repos/cmd-repos-create.ts
@@ -85,7 +85,7 @@ async function run(
       - Org name as the first argument ${!orgSlug ? colors.red('(missing!)') : colors.green('(ok)')}\n
       - Repository name using --repoName ${!repoName ? colors.red('(missing!)') : typeof repoName !== 'string' ? colors.red('(invalid!)') : colors.green('(ok)')}\n
     `)
-    cli.showHelp()
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -96,6 +96,8 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await createRepo({
     outputJson: Boolean(cli.flags['json']),
     outputMarkdown: Boolean(cli.flags['markdown']),
diff --git a/src/commands/repos/cmd-repos-delete.ts b/src/commands/repos/cmd-repos-del.ts
similarity index 80%
rename from src/commands/repos/cmd-repos-delete.ts
rename to src/commands/repos/cmd-repos-del.ts
index d4f4b32f5..7a01f0673 100644
--- a/src/commands/repos/cmd-repos-delete.ts
+++ b/src/commands/repos/cmd-repos-del.ts
@@ -1,27 +1,34 @@
 import colors from 'yoctocolors-cjs'
 
 import { deleteRepo } from './delete-repo.ts'
+import { commonFlags } from '../../flags.ts'
 import { AuthError } from '../../utils/errors'
 import { meowOrExit } from '../../utils/meow-with-subcommands'
+import { getFlagListOutput } from '../../utils/output-formatting'
 import { getDefaultToken } from '../../utils/sdk'
 
 import type { CliCommandConfig } from '../../utils/meow-with-subcommands'
 
 const config: CliCommandConfig = {
-  commandName: 'delete',
+  commandName: 'del',
   description: 'Delete a repository in an organization',
   hidden: false,
-  flags: {},
-  help: (command, _config) => `
+  flags: {
+    ...commonFlags
+  },
+  help: (command, config) => `
     Usage
       $ ${command} <org slug> <repo slug>
 
+    Options
+      ${getFlagListOutput(config.flags, 6)}
+
     Examples
       $ ${command} FakeOrg test-repo
   `
 }
 
-export const cmdReposDelete = {
+export const cmdReposDel = {
   description: config.description,
   hidden: config.hidden,
   run
@@ -47,7 +54,7 @@ async function run(
       - Repository name as the second argument ${!repoName ? colors.red('(missing!)') : typeof repoName !== 'string' ? colors.red('(invalid!)') : colors.green('(ok)')}\n
       - At least one TARGET (e.g. \`.\` or \`./package.json\`
     `)
-    cli.showHelp()
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -58,5 +65,7 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await deleteRepo(orgSlug, repoName, apiToken)
 }
diff --git a/src/commands/repos/cmd-repos-list.ts b/src/commands/repos/cmd-repos-list.ts
index 4f12d8210..501254597 100644
--- a/src/commands/repos/cmd-repos-list.ts
+++ b/src/commands/repos/cmd-repos-list.ts
@@ -77,7 +77,7 @@ async function run(
       - Org name as the first argument ${!orgSlug ? colors.red('(missing!)') : colors.green('(ok)')}\n
       - At least one TARGET (e.g. \`.\` or \`./package.json\`
     `)
-    cli.showHelp()
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -88,6 +88,8 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await listRepos({
     apiToken,
     outputJson: Boolean(cli.flags['json']),
diff --git a/src/commands/repos/cmd-repos-update.ts b/src/commands/repos/cmd-repos-update.ts
index e1ab6849d..c56738e6c 100644
--- a/src/commands/repos/cmd-repos-update.ts
+++ b/src/commands/repos/cmd-repos-update.ts
@@ -10,7 +10,7 @@ import { getDefaultToken } from '../../utils/sdk'
 import type { CliCommandConfig } from '../../utils/meow-with-subcommands'
 
 const config: CliCommandConfig = {
-  commandName: 'create',
+  commandName: 'update',
   description: 'Update a repository in an organization',
   hidden: false,
   flags: {
@@ -86,7 +86,7 @@ async function run(
       - Repository name using --repoName ${!repoName ? colors.red('(missing!)') : typeof repoName !== 'string' ? colors.red('(invalid!)') : colors.green('(ok)')}\n
       - At least one TARGET (e.g. \`.\` or \`./package.json\`
     `)
-    cli.showHelp()
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -97,6 +97,8 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await updateRepo({
     apiToken,
     outputJson: Boolean(cli.flags['json']),
diff --git a/src/commands/repos/cmd-repos-view.ts b/src/commands/repos/cmd-repos-view.ts
index 448fa9359..f342ec4f0 100644
--- a/src/commands/repos/cmd-repos-view.ts
+++ b/src/commands/repos/cmd-repos-view.ts
@@ -55,7 +55,7 @@ async function run(
       - Org name as the first argument ${!orgSlug ? colors.red('(missing!)') : colors.green('(ok)')}\n
       - Repository name using --repoName ${!repoName ? colors.red('(missing!)') : typeof repoName !== 'string' ? colors.red('(invalid!)') : colors.green('(ok)')}\n
     `)
-    cli.showHelp()
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -66,5 +66,7 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await viewRepo(orgSlug, repoName, apiToken)
 }
diff --git a/src/commands/repos/cmd-repos.ts b/src/commands/repos/cmd-repos.ts
index 9dd890222..9106e227c 100644
--- a/src/commands/repos/cmd-repos.ts
+++ b/src/commands/repos/cmd-repos.ts
@@ -1,5 +1,5 @@
 import { cmdReposCreate } from './cmd-repos-create.ts'
-import { cmdReposDelete } from './cmd-repos-delete.ts'
+import { cmdReposDel } from './cmd-repos-del.ts'
 import { cmdReposList } from './cmd-repos-list.ts'
 import { cmdReposUpdate } from './cmd-repos-update.ts'
 import { cmdReposView } from './cmd-repos-view.ts'
@@ -14,17 +14,17 @@ export const cmdRepos: CliSubcommand = {
   async run(argv, importMeta, { parentName }) {
     await meowWithSubcommands(
       {
-        cmdReposCreate,
-        cmdReposView,
-        cmdReposList,
-        cmdReposDelete,
-        cmdReposUpdate
+        create: cmdReposCreate,
+        view: cmdReposView,
+        list: cmdReposList,
+        del: cmdReposDel,
+        update: cmdReposUpdate
       },
       {
         argv,
         description,
         importMeta,
-        name: `${parentName} repo`
+        name: `${parentName} repos`
       }
     )
   }
diff --git a/src/commands/scan/cmd-scan-create.ts b/src/commands/scan/cmd-scan-create.ts
index 19d41a644..44cbf1e5a 100644
--- a/src/commands/scan/cmd-scan-create.ts
+++ b/src/commands/scan/cmd-scan-create.ts
@@ -47,6 +47,11 @@ const config: CliCommandConfig = {
       type: 'string',
       description: 'working directory, defaults to process.cwd()'
     },
+    dryRun: {
+      type: 'boolean',
+      description:
+        'run input validation part of command without any concrete side effects'
+    },
     pullRequest: {
       type: 'number',
       shortFlag: 'pr',
@@ -161,7 +166,7 @@ async function run(
           )
         : colors.green('(ok)')
     }`)
-    config.help(parentName, config)
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -172,6 +177,8 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await createFullScan({
     apiToken,
     orgSlug,
diff --git a/src/commands/scan/cmd-scan-delete.ts b/src/commands/scan/cmd-scan-del.ts
similarity index 87%
rename from src/commands/scan/cmd-scan-delete.ts
rename to src/commands/scan/cmd-scan-del.ts
index e9a9f65b3..de52eec65 100644
--- a/src/commands/scan/cmd-scan-delete.ts
+++ b/src/commands/scan/cmd-scan-del.ts
@@ -1,9 +1,9 @@
-import meow from 'meow'
 import colors from 'yoctocolors-cjs'
 
 import { deleteOrgFullScan } from './delete-full-scan.ts'
 import { commonFlags, outputFlags } from '../../flags'
 import { AuthError } from '../../utils/errors'
+import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting'
 import { getDefaultToken } from '../../utils/sdk'
 
@@ -29,7 +29,7 @@ const config: CliCommandConfig = {
   `
 }
 
-export const cmdScanDelete = {
+export const cmdScanDel = {
   description: config.description,
   hidden: config.hidden,
   run
@@ -40,11 +40,11 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  const cli = meow(config.help(parentName, config), {
+  const cli = meowOrExit({
     argv,
-    description: config.description,
+    config,
     importMeta,
-    flags: config.flags
+    parentName
   })
 
   const [orgSlug = '', fullScanId = ''] = cli.input
@@ -56,7 +56,7 @@ async function run(
       - Full Scan ID to delete as second argument ${!fullScanId ? colors.red('(missing!)') : colors.green('(ok)')}
     `
     )
-    config.help(parentName, config)
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -67,5 +67,7 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await deleteOrgFullScan(orgSlug, fullScanId, apiToken)
 }
diff --git a/src/commands/scan/cmd-scan-list.ts b/src/commands/scan/cmd-scan-list.ts
index 5bd713e9a..08c4d9dc6 100644
--- a/src/commands/scan/cmd-scan-list.ts
+++ b/src/commands/scan/cmd-scan-list.ts
@@ -1,9 +1,9 @@
-import meow from 'meow'
 import colors from 'yoctocolors-cjs'
 
 import { listFullScans } from './list-full-scans.ts'
 import { commonFlags, outputFlags } from '../../flags'
 import { AuthError } from '../../utils/errors'
+import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting'
 import { getDefaultToken } from '../../utils/sdk'
 
@@ -80,11 +80,11 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ) {
-  const cli = meow(config.help(parentName, config), {
+  const cli = meowOrExit({
     argv,
-    description: config.description,
+    config,
     importMeta,
-    flags: config.flags
+    parentName
   })
 
   const orgSlug = cli.input[0]
@@ -92,7 +92,7 @@ async function run(
   if (!orgSlug) {
     console.error(`${colors.bgRed(colors.white('Input error'))}: Please provide the required fields:\n
     - Org name as the argument ${!orgSlug ? colors.red('(missing!)') : colors.green('(ok)')}`)
-    config.help(parentName, config)
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -103,6 +103,8 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await listFullScans(
     orgSlug,
     // TODO: refine this object to what we need
diff --git a/src/commands/scan/cmd-scan-metadata.ts b/src/commands/scan/cmd-scan-metadata.ts
index aaacd87f6..05fa37507 100644
--- a/src/commands/scan/cmd-scan-metadata.ts
+++ b/src/commands/scan/cmd-scan-metadata.ts
@@ -1,9 +1,9 @@
-import meow from 'meow'
 import colors from 'yoctocolors-cjs'
 
 import { getOrgScanMetadata } from './get-full-scan-metadata.ts'
 import { commonFlags, outputFlags } from '../../flags'
 import { AuthError } from '../../utils/errors'
+import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting'
 import { getDefaultToken } from '../../utils/sdk'
 
@@ -43,11 +43,11 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  const cli = meow(config.help(parentName, config), {
+  const cli = meowOrExit({
     argv,
-    description: config.description,
+    config,
     importMeta,
-    flags: config.flags
+    parentName
   })
 
   const [orgSlug = '', fullScanId = ''] = cli.input
@@ -59,7 +59,7 @@ async function run(
       - Full Scan ID to inspect as second argument ${!fullScanId ? colors.red('(missing!)') : colors.green('(ok)')}
     `
     )
-    config.help(parentName, config)
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -70,5 +70,7 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await getOrgScanMetadata(orgSlug, fullScanId, apiToken)
 }
diff --git a/src/commands/scan/cmd-scan-stream.ts b/src/commands/scan/cmd-scan-stream.ts
index 09cd127b0..e18fcea81 100644
--- a/src/commands/scan/cmd-scan-stream.ts
+++ b/src/commands/scan/cmd-scan-stream.ts
@@ -1,9 +1,9 @@
-import meow from 'meow'
 import colors from 'yoctocolors-cjs'
 
 import { getFullScan } from './get-full-scan.ts'
 import { commonFlags, outputFlags } from '../../flags'
 import { AuthError } from '../../utils/errors'
+import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting'
 import { getDefaultToken } from '../../utils/sdk'
 
@@ -45,11 +45,11 @@ async function run(
   importMeta: ImportMeta,
   { parentName }: { parentName: string }
 ): Promise<void> {
-  const cli = meow(config.help(parentName, config), {
+  const cli = meowOrExit({
     argv,
-    description: config.description,
+    config,
     importMeta,
-    flags: config.flags
+    parentName
   })
 
   const [orgSlug = '', fullScanId = '', file = '-'] = cli.input
@@ -61,7 +61,7 @@ async function run(
       - Full Scan ID to fetch as second argument ${!fullScanId ? colors.red('(missing!)') : colors.green('(ok)')}
     `
     )
-    config.help(parentName, config)
+    process.exitCode = 2 // bad input
     return
   }
 
@@ -72,5 +72,7 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await getFullScan(orgSlug, fullScanId, file, apiToken)
 }
diff --git a/src/commands/scan/cmd-scan.ts b/src/commands/scan/cmd-scan.ts
index 5262f510b..b30848e64 100644
--- a/src/commands/scan/cmd-scan.ts
+++ b/src/commands/scan/cmd-scan.ts
@@ -1,5 +1,5 @@
 import { cmdScanCreate } from './cmd-scan-create.ts'
-import { cmdScanDelete } from './cmd-scan-delete.ts'
+import { cmdScanDel } from './cmd-scan-del.ts'
 import { cmdScanList } from './cmd-scan-list.ts'
 import { cmdScanMetadata } from './cmd-scan-metadata.ts'
 import { cmdScanStream } from './cmd-scan-stream.ts'
@@ -17,7 +17,7 @@ export const cmdScan: CliSubcommand = {
         create: cmdScanCreate,
         stream: cmdScanStream,
         list: cmdScanList,
-        del: cmdScanDelete,
+        del: cmdScanDel,
         metadata: cmdScanMetadata
       },
       {
diff --git a/src/commands/threat-feed/cmd-threat-feed.ts b/src/commands/threat-feed/cmd-threat-feed.ts
index c3d7c4b28..9360e37b4 100644
--- a/src/commands/threat-feed/cmd-threat-feed.ts
+++ b/src/commands/threat-feed/cmd-threat-feed.ts
@@ -77,6 +77,8 @@ async function run(
     )
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   await getThreatFeed({
     apiToken,
     direction: String(cli.flags['direction'] || 'desc'),
diff --git a/src/commands/wrapper/cmd-wrapper.ts b/src/commands/wrapper/cmd-wrapper.ts
index fbb489061..9be4677e6 100644
--- a/src/commands/wrapper/cmd-wrapper.ts
+++ b/src/commands/wrapper/cmd-wrapper.ts
@@ -1,10 +1,13 @@
 import fs from 'node:fs'
 import os from 'node:os'
 
+import colors from 'yoctocolors-cjs'
+
 import { addSocketWrapper } from './add-socket-wrapper.ts'
 import { checkSocketWrapperSetup } from './check-socket-wrapper-setup.ts'
 import { postinstallWrapper } from './postinstall-wrapper.ts'
 import { removeSocketWrapper } from './remove-socket-wrapper.ts'
+import { commonFlags } from '../../flags.ts'
 import { meowOrExit } from '../../utils/meow-with-subcommands'
 import { getFlagListOutput } from '../../utils/output-formatting'
 
@@ -19,6 +22,7 @@ const config: CliCommandConfig = {
   description: 'Enable or disable the Socket npm/npx wrapper',
   hidden: false,
   flags: {
+    ...commonFlags,
     enable: {
       type: 'boolean',
       default: false,
@@ -67,12 +71,19 @@ async function run(
     parentName
   })
 
+  const isDryRun = cli.flags['dryRun']
+
   const { disable, enable } = cli.flags
   if (!enable && !disable) {
-    cli.showHelp()
+    console.error(`${colors.bgRed(colors.white('Input error'))}: Please provide the required flags:\n
+      - Must use --enabled or --disabled
+    `)
+    process.exitCode = 2 // bad input
     return
   }
 
+  if (isDryRun) return console.log('[DryRun] Bailing now')
+
   if (enable) {
     if (fs.existsSync(BASH_FILE)) {
       const socketWrapperEnabled = checkSocketWrapperSetup(BASH_FILE)
diff --git a/src/flags.ts b/src/flags.ts
index e07874548..33e3be831 100644
--- a/src/flags.ts
+++ b/src/flags.ts
@@ -15,6 +15,11 @@ export const commonFlags: MeowFlags = {
     default: false,
     shortFlag: 'h',
     description: 'Print this help.'
+  },
+  dryRun: {
+    type: 'boolean',
+    default: false,
+    description: 'Do input validation for a command and exit 0 when input is ok'
   }
 }
 
diff --git a/src/utils/meow-with-subcommands.ts b/src/utils/meow-with-subcommands.ts
index 4c38889e0..45556eac1 100644
--- a/src/utils/meow-with-subcommands.ts
+++ b/src/utils/meow-with-subcommands.ts
@@ -3,6 +3,7 @@ import meow from 'meow'
 import { toSortedObject } from '@socketsecurity/registry/lib/objects'
 
 import { getFlagListOutput, getHelpListOutput } from './output-formatting'
+import { getSetting } from './settings.ts'
 import { MeowFlags, commonFlags } from '../flags'
 
 import type { Options } from 'meow'
@@ -44,6 +45,14 @@ interface MeowOptions extends Options<any> {
   name: string
 }
 
+// For debugging. Whenever you call meowOrExit it will store the command here
+// This module exports a getter that returns the current value.
+let lastSeenCommand = ''
+
+export function getLastSeenCommand(): string {
+  return lastSeenCommand
+}
+
 export async function meowWithSubcommands(
   subcommands: Record<string, CliSubcommand>,
   options: MeowOptions
@@ -77,6 +86,9 @@ export async function meowWithSubcommands(
     ...additionalOptions.flags
   }
   // ...else we provide basic instructions and help
+
+  console.log(getAsciiHeader(name))
+
   const cli = meow(
     `
     Usage
@@ -116,9 +128,14 @@ export async function meowWithSubcommands(
       argv,
       importMeta,
       ...additionalOptions,
-      flags
+      flags,
+      autoHelp: false // otherwise we can't exit(0)
     }
   )
+  if (!cli.flags['help'] && cli.flags['dryRun']) {
+    console.log('[DryRun]: noop, call a sub-command; ok')
+    process.exit(0)
+  }
   cli.showHelp()
 }
 
@@ -132,16 +149,19 @@ export function meowOrExit({
   importMeta,
   parentName
 }: {
+  allowUnknownFlags?: boolean
   argv: ReadonlyArray<string>
   config: CliCommandConfig
   parentName: string
   importMeta: ImportMeta
-  allowUnknownFlags?: boolean
 }) {
   const command = `${parentName} ${config.commandName}`
+  lastSeenCommand = command
 
   const help = config.help(command, config)
 
+  console.log(getAsciiHeader(command))
+
   // This exits if .printHelp() is called either by meow itself or by us.
   const cli = meow({
     argv,
@@ -149,8 +169,32 @@ export function meowOrExit({
     help,
     importMeta,
     flags: config.flags,
-    allowUnknownFlags: Boolean(allowUnknownFlags)
+    allowUnknownFlags: Boolean(allowUnknownFlags),
+    autoHelp: false // otherwise we can't exit(0)
   })
 
+  if (cli.flags['help']) cli.showHelp()
+
   return cli
 }
+
+function getAsciiHeader(command: string) {
+  // Note: in tests we return <redacted> because otherwise snapshots will fail
+  return (
+    '   ' +
+    `
+   _____         _       _        /---------------
+  |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver ${process.env['VITEST'] ? '<redacted>' : process.env['SOCKET_CLI_VERSION']}
+  |__   | . |  _| '_| -_|  _|     | Node: ${process.env['VITEST'] ? '<redacted>' : process.version}, API token set: ${process.env['VITEST'] ? '<redacted>' : getSetting('apiToken')?.slice(-9, -4) || 'no'}
+  |_____|___|___|_,_|___|_|.dev   | Command: \`${command}\`, cwd: ${
+    process.env['VITEST']
+      ? '<redacted>'
+      : process
+          .cwd()
+          .trim()
+          .replace(/^\/home\/[a-z0-9_-]+\//i, '~/')
+  }
+  `.trim() +
+    '\n'
+  )
+}
diff --git a/test/dry-run.test.ts b/test/dry-run.test.ts
new file mode 100644
index 000000000..259db649b
--- /dev/null
+++ b/test/dry-run.test.ts
@@ -0,0 +1,915 @@
+// This calls all the CLI commands with --dry-run and asserts the result
+// Create one section for every (sub)command with the same pattern.
+// Can't do this in a loop due to inline snapshots but that's ok
+// Each test covers
+// - the stdout/stderr output (should be consistent and repeatable)
+// - the exit code (0 for dry-run, 2 for input error)
+// - whether the flag-less command name appears in the header in full
+// The only exception currently is `cdxgen`
+// Regenerate: `npm run build ; npm run test:unit -- test/dry-run.test.ts -u`
+
+import path from 'node:path'
+
+import spawn from '@npmcli/promise-spawn'
+import { describe, expect, it } from 'vitest'
+
+import constants from '../dist/constants.js'
+
+type PromiseSpawnOptions = Exclude<Parameters<typeof spawn>[2], undefined> & {
+  encoding?: BufferEncoding | undefined
+}
+
+const { CLI, abortSignal } = constants
+
+const testPath = __dirname
+const npmFixturesPath = path.join(testPath, 'socket-npm-fixtures')
+
+const spawnOpts: PromiseSpawnOptions = {
+  cwd: npmFixturesPath,
+  signal: abortSignal
+}
+
+/**
+ * This is a simple template wrapper for this pattern:
+ * `it('should do: socket scan', (['socket', 'scan']) => {})`
+ */
+function cmdit(
+  cmd: Array<string>,
+  title: string,
+  cb: (cmd: Array<string>) => Promise<void>,
+  ...opts: any
+) {
+  it(`${title}: \`${cmd.join(' ')}\``, cb.bind(null, cmd), ...opts)
+}
+
+describe('dry-run on all commands', async () => {
+  // Lazily access constants.rootBinPath.
+  const entryPath = path.join(constants.rootBinPath, `${CLI}.js`)
+
+  async function invoke(...args: Array<string>): Promise<{
+    status: boolean
+    code: number
+    stdout: Buffer
+    stderr: Buffer
+  }> {
+    try {
+      const thing = await spawn(
+        // Lazily access constants.execPath.
+        constants.execPath,
+        [entryPath, ...args],
+        spawnOpts
+      )
+      return {
+        status: true,
+        code: 0,
+        stdout: toAsciiSafeString(thing.stdout),
+        stderr: toAsciiSafeString(thing.stderr)
+      }
+    } catch (e) {
+      return {
+        status: false,
+        code: e.code,
+        stdout: toAsciiSafeString(e.stdout),
+        stderr: toAsciiSafeString(e.stderr)
+      }
+    }
+  }
+
+  cmdit(['--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket\`, cwd: <redacted>
+
+      [DryRun]: noop, call a sub-command; ok"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['analytics', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket analytics\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['audit-log', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket audit-log\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+          - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['cdxgen', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket cdxgen\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`"Unknown argument: --dry-run"`)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['dependencies', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket dependencies\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['diff-scan', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket diff-scan\`, cwd: <redacted>
+
+      [DryRun]: noop, call a sub-command; ok"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['diff-scan', 'get', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket diff-scan get\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Specify a before and after full scan ID \\x1b[31m(missing before and after!)\\x1b[39m
+
+                - To get full scans IDs, you can run the command "socket scan list <your org slug>".
+            - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+      }"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['fix', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket fix\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['info', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket info\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Expecting a package name \\x1b[31m(missing!)\\x1b[39m
+
+            - Can only accept one package at a time \\x1b[32m(ok)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['login', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket login\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['logout', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket logout\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['manifest', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket manifest\`, cwd: <redacted>
+
+      [DryRun]: noop, call a sub-command; ok"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['manifest', 'auto', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket manifest auto\`, cwd: <redacted>
+
+
+        Auto-detect build and attempt to generate manifest file
+
+        $ socket manifest auto
+
+        Unfortunately this script did not discover a supported language in the
+        current folder.
+
+        - Make sure this script would work with your target build
+        - Make sure to run it from the correct folder
+        - Make sure the necessary build tools are available (\`PATH\`)
+
+        If that doesn't work, see \`socket manifest <lang> --help\` for config details for
+        your target language."
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['manifest', 'gradle', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket manifest gradle\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - The DIR arg is required \\x1b[31m(missing!)\\x1b[39m
+
+            - Can only accept one DIR (make sure to escape spaces!) \\x1b[32m(ok)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['manifest', 'kotlin', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket manifest kotlin\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - The DIR arg is required \\x1b[31m(missing!)\\x1b[39m
+
+            - Can only accept one DIR (make sure to escape spaces!) \\x1b[32m(ok)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['manifest', 'scala', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket manifest scala\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - The DIR or FILE arg is required \\x1b[31m(missing!)\\x1b[39m
+
+            - Can only accept one DIR or FILE (make sure to escape spaces!) \\x1b[32m(ok)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['npm', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket npm\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['npx', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket npx\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['oops', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket oops\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['optimize', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket optimize\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['raw-npm', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket raw-npm\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['raw-npx', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket raw-npx\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['report', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket report\`, cwd: <redacted>
+
+      [DryRun]: noop, call a sub-command; ok"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['report', 'create', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket report create\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['report', 'view', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket report view\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Need at least one report ID \\x1b[31m(missing!)\\x1b[39m
+
+            - Can only handle a single report ID \\x1b[31m(received 0!)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['repos', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket repos\`, cwd: <redacted>
+
+      [DryRun]: noop, call a sub-command; ok"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['repos', 'create', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket repos create\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+
+            - Repository name using --repoName \\x1b[31m(missing!)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['repos', 'del', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket repos del\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+
+            - Repository name as the second argument \\x1b[31m(missing!)\\x1b[39m
+
+            - At least one TARGET (e.g. \`.\` or \`./package.json\`"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['repos', 'list', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket repos list\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+
+            - At least one TARGET (e.g. \`.\` or \`./package.json\`"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['repos', 'update', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket repos update\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+
+            - Repository name using --repoName \\x1b[31m(missing!)\\x1b[39m
+
+            - At least one TARGET (e.g. \`.\` or \`./package.json\`"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['repos', 'view', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket repos view\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+
+            - Repository name using --repoName \\x1b[31m(missing!)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['scan', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket scan\`, cwd: <redacted>
+
+      [DryRun]: noop, call a sub-command; ok"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['scan', 'create', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket scan create\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+          - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+
+          - Repository name using --repo \\x1b[31m(missing!)\\x1b[39m
+
+          - Branch name using --branch \\x1b[31m(missing!)\\x1b[39m
+
+          - At least one TARGET (e.g. \`.\` or \`./package.json\`) \\x1b[31m(missing)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['scan', 'del', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket scan del\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+
+            - Full Scan ID to delete as second argument \\x1b[31m(missing!)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['scan', 'list', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket scan list\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+          - Org name as the argument \\x1b[31m(missing!)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['scan', 'metadata', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket scan metadata\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+
+            - Full Scan ID to inspect as second argument \\x1b[31m(missing!)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['scan', 'stream', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket scan stream\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
+
+            - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
+
+            - Full Scan ID to fetch as second argument \\x1b[31m(missing!)\\x1b[39m"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['threat-feed', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket threat-feed\`, cwd: <redacted>
+
+      [DryRun] Bailing now"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
+
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+
+  cmdit(['wrapper', '--dry-run'], 'should support', async cmd => {
+    const { code, status, stderr, stdout } = await invoke(...cmd)
+    expect(`\n   ${stdout}`).toMatchInlineSnapshot(`
+      "
+         _____         _       _        /---------------
+        |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
+        |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket wrapper\`, cwd: <redacted>"
+    `)
+    expect(stderr).toMatchInlineSnapshot(`
+      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required flags:
+
+            - Must use --enabled or --disabled"
+    `)
+
+    expect(code).toBe(2)
+    expect(stdout, 'header should include command (without params)').toContain(
+      cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
+    )
+  })
+})
+
+function toAsciiSafeString(str) {
+  /* eslint-disable-next-line */
+  const asciiSafeRegex = /[\u0000-\u0007\u0009\u000b-\u001f\u0080-\uffff]/g
+  return str.replace(asciiSafeRegex, m => {
+    const code = m.charCodeAt(0)
+    if (code < 255) return '\\x' + code.toString(16).padStart(2, '0')
+    return '\\u' + code.toString(16).padStart(4, '0')
+  })
+}
diff --git a/test/socket-cdxgen.test.ts b/test/socket-cdxgen.test.ts
index 4b62d9dd3..593d00d95 100644
--- a/test/socket-cdxgen.test.ts
+++ b/test/socket-cdxgen.test.ts
@@ -32,10 +32,9 @@ describe('Socket cdxgen command', async () => {
         [entryPath, 'cdxgen', command],
         spawnOpts
       )
-      expect(
-        ret.stdout.startsWith('cdxgen'),
-        'forwards commands to cdxgen'
-      ).toBe(true)
+      expect(ret.stdout.includes('cdxgen'), 'forwards commands to cdxgen').toBe(
+        true
+      )
     }
     // Takes ~10s in CI
   }, 20_000)

From 655d2a4be90510121d2ee0c28db01cfc074140d4 Mon Sep 17 00:00:00 2001
From: Peter van der Zee <github-public@qfox.nl>
Date: Wed, 26 Feb 2025 15:28:48 +0100
Subject: [PATCH 2/6] Disable banner by default, for now

---
 src/utils/meow-with-subcommands.ts | 11 +++++++++--
 test/dry-run.test.ts               | 19 ++++++++++++++++++-
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/src/utils/meow-with-subcommands.ts b/src/utils/meow-with-subcommands.ts
index 45556eac1..2241a5e6e 100644
--- a/src/utils/meow-with-subcommands.ts
+++ b/src/utils/meow-with-subcommands.ts
@@ -7,6 +7,7 @@ import { getSetting } from './settings.ts'
 import { MeowFlags, commonFlags } from '../flags'
 
 import type { Options } from 'meow'
+import { envAsBoolean } from '@socketsecurity/registry/lib/env'
 
 interface CliAlias {
   description: string
@@ -87,7 +88,10 @@ export async function meowWithSubcommands(
   }
   // ...else we provide basic instructions and help
 
-  console.log(getAsciiHeader(name))
+  // Temp disable until we clear the --json and --markdown usage
+  if (envAsBoolean(process.env['SOCKET_CLI_SHOW_BANNER'])) {
+    console.log(getAsciiHeader(name))
+  }
 
   const cli = meow(
     `
@@ -160,7 +164,10 @@ export function meowOrExit({
 
   const help = config.help(command, config)
 
-  console.log(getAsciiHeader(command))
+  // Temp disable until we clear the --json and --markdown usage
+  if (envAsBoolean(process.env['SOCKET_CLI_SHOW_BANNER'])) {
+    console.log(getAsciiHeader(command))
+  }
 
   // This exits if .printHelp() is called either by meow itself or by us.
   const cli = meow({
diff --git a/test/dry-run.test.ts b/test/dry-run.test.ts
index 259db649b..483388cdc 100644
--- a/test/dry-run.test.ts
+++ b/test/dry-run.test.ts
@@ -11,9 +11,10 @@
 import path from 'node:path'
 
 import spawn from '@npmcli/promise-spawn'
-import { describe, expect, it } from 'vitest'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 
 import constants from '../dist/constants.js'
+import { envAsBoolean } from '@socketsecurity/registry/lib/env'
 
 type PromiseSpawnOptions = Exclude<Parameters<typeof spawn>[2], undefined> & {
   encoding?: BufferEncoding | undefined
@@ -43,6 +44,22 @@ function cmdit(
 }
 
 describe('dry-run on all commands', async () => {
+  let was: unknown
+
+  beforeAll(() => {
+    // Temp: we have to disable the banner by default until we make it work
+    //       properly with --json and --markdown, since otherwise the output
+    //       would be invalid.
+    was = process.env['SOCKET_CLI_SHOW_BANNER']
+    process.env['SOCKET_CLI_SHOW_BANNER'] = '1'
+  })
+
+  afterAll(() => {
+    if (was) {
+      process.env['SOCKET_CLI_SHOW_BANNER'] = was as any
+    }
+  })
+
   // Lazily access constants.rootBinPath.
   const entryPath = path.join(constants.rootBinPath, `${CLI}.js`)
 

From c7803c552d0be44fb81ae00f09bb67d9e30eadd5 Mon Sep 17 00:00:00 2001
From: Peter van der Zee <github-public@qfox.nl>
Date: Wed, 26 Feb 2025 15:55:09 +0100
Subject: [PATCH 3/6] Move dryRun check to before login check

---
 src/commands/analytics/cmd-analytics.ts      |  4 ++--
 src/commands/audit-log/cmd-audit-log.ts      |  4 ++--
 src/commands/diff-scan/cmd-diff-scan-get.ts  |  4 ++--
 src/commands/login/cmd-login.ts              | 12 +++++-------
 src/commands/manifest/cmd-manifest-auto.ts   |  4 ++++
 src/commands/manifest/cmd-manifest-kotlin.ts | 12 ------------
 src/commands/manifest/cmd-manifest-scala.ts  | 12 ------------
 src/commands/repos/cmd-repos-create.ts       |  4 ++--
 src/commands/repos/cmd-repos-del.ts          |  4 ++--
 src/commands/repos/cmd-repos-list.ts         |  4 ++--
 src/commands/repos/cmd-repos-update.ts       |  4 ++--
 src/commands/repos/cmd-repos-view.ts         |  4 ++--
 src/commands/scan/cmd-scan-create.ts         |  4 ++--
 src/commands/scan/cmd-scan-del.ts            |  4 ++--
 src/commands/scan/cmd-scan-list.ts           |  4 ++--
 src/commands/scan/cmd-scan-metadata.ts       |  4 ++--
 src/commands/scan/cmd-scan-stream.ts         |  4 ++--
 src/commands/threat-feed/cmd-threat-feed.ts  |  4 ++--
 src/utils/meow-with-subcommands.ts           |  2 +-
 test/dry-run.test.ts                         |  3 ++-
 20 files changed, 40 insertions(+), 61 deletions(-)

diff --git a/src/commands/analytics/cmd-analytics.ts b/src/commands/analytics/cmd-analytics.ts
index 7e618cb0a..586baa5d8 100644
--- a/src/commands/analytics/cmd-analytics.ts
+++ b/src/commands/analytics/cmd-analytics.ts
@@ -93,6 +93,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -100,8 +102,6 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   return await displayAnalytics({
     apiToken,
     scope,
diff --git a/src/commands/audit-log/cmd-audit-log.ts b/src/commands/audit-log/cmd-audit-log.ts
index a8228110a..c6908778b 100644
--- a/src/commands/audit-log/cmd-audit-log.ts
+++ b/src/commands/audit-log/cmd-audit-log.ts
@@ -76,6 +76,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -83,8 +85,6 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await getAuditLog({
     apiToken,
     orgSlug,
diff --git a/src/commands/diff-scan/cmd-diff-scan-get.ts b/src/commands/diff-scan/cmd-diff-scan-get.ts
index 4e32bb6e4..17eb04d04 100644
--- a/src/commands/diff-scan/cmd-diff-scan-get.ts
+++ b/src/commands/diff-scan/cmd-diff-scan-get.ts
@@ -85,6 +85,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -92,8 +94,6 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await getDiffScan(
     {
       outputJson: Boolean(cli.flags['json']),
diff --git a/src/commands/login/cmd-login.ts b/src/commands/login/cmd-login.ts
index 16ccd6bc0..a2d22ea43 100644
--- a/src/commands/login/cmd-login.ts
+++ b/src/commands/login/cmd-login.ts
@@ -56,18 +56,16 @@ async function run(
     parentName
   })
 
-  const isDryRun = cli.flags['dryRun']
+  let apiBaseUrl = cli.flags['apiBaseUrl'] as string | undefined
+  let apiProxy = cli.flags['apiProxy'] as string | undefined
 
-  if (!isInteractive() && !isDryRun) {
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
+  if (!isInteractive()) {
     throw new InputError(
       'Cannot prompt for credentials in a non-interactive shell'
     )
   }
 
-  let apiBaseUrl = cli.flags['apiBaseUrl'] as string | undefined
-  let apiProxy = cli.flags['apiProxy'] as string | undefined
-
-  if (isDryRun) return console.log('[DryRun] Bailing now')
-
   await attemptLogin(apiBaseUrl, apiProxy)
 }
diff --git a/src/commands/manifest/cmd-manifest-auto.ts b/src/commands/manifest/cmd-manifest-auto.ts
index 007295dd0..004ab158a 100644
--- a/src/commands/manifest/cmd-manifest-auto.ts
+++ b/src/commands/manifest/cmd-manifest-auto.ts
@@ -73,7 +73,9 @@ async function run(
   if (verbose) {
     subArgs.push('--verbose')
   }
+
   const dir = cwd
+
   if (existsSync(path.join(dir, 'build.sbt'))) {
     console.log(
       'Detected a Scala sbt build, running default Scala generator...'
@@ -88,6 +90,7 @@ async function run(
     await cmdManifestScala.run(subArgs, importMeta, { parentName })
     return
   }
+
   if (existsSync(path.join(dir, 'gradlew'))) {
     console.log('Detected a gradle build, running default gradle generator...')
     if (cwd) {
@@ -100,6 +103,7 @@ async function run(
     await cmdManifestGradle.run(subArgs, importMeta, { parentName })
     return
   }
+
   // Show new help screen and exit.
   meow(
     `
diff --git a/src/commands/manifest/cmd-manifest-kotlin.ts b/src/commands/manifest/cmd-manifest-kotlin.ts
index 0375209a9..0aac2e8d8 100644
--- a/src/commands/manifest/cmd-manifest-kotlin.ts
+++ b/src/commands/manifest/cmd-manifest-kotlin.ts
@@ -2,8 +2,6 @@ import path from 'node:path'
 
 import colors from 'yoctocolors-cjs'
 
-import { Spinner } from '@socketsecurity/registry/lib/spinner'
-
 import { convertGradleToMaven } from './convert_gradle_to_maven.ts'
 import { commonFlags } from '../../flags.ts'
 import { meowOrExit } from '../../utils/meow-with-subcommands'
@@ -149,16 +147,6 @@ async function run(
     out = '-'
   }
 
-  // TODO: I'm not sure it's feasible to parse source file from stdin. We could try, store contents in a file in some folder, target that folder... what would the file name be?
-  if (target === '-') {
-    new Spinner()
-      .start('Parsing...')
-      .error(
-        `Failure: Currently source code from stdin is not supported. See \`${parentName} ${config.commandName} --help\` for details.`
-      )
-    process.exit(1)
-  }
-
   if (verbose) {
     console.group()
     console.log('- target:', target)
diff --git a/src/commands/manifest/cmd-manifest-scala.ts b/src/commands/manifest/cmd-manifest-scala.ts
index 240431da8..fad542daf 100644
--- a/src/commands/manifest/cmd-manifest-scala.ts
+++ b/src/commands/manifest/cmd-manifest-scala.ts
@@ -1,7 +1,5 @@
 import colors from 'yoctocolors-cjs'
 
-import { Spinner } from '@socketsecurity/registry/lib/spinner'
-
 import { convertSbtToMaven } from './convert_sbt_to_maven.ts'
 import { commonFlags } from '../../flags.ts'
 import { meowOrExit } from '../../utils/meow-with-subcommands'
@@ -146,16 +144,6 @@ async function run(
     console.groupEnd()
   }
 
-  // TODO: we can make `-` (accept from stdin) work by storing it into /tmp
-  if (target === '-') {
-    new Spinner()
-      .start('Parsing...')
-      .error(
-        `Failure: Currently source code from stdin is not supported. See \`${parentName} ${config.commandName} --help\` for details.`
-      )
-    process.exit(1)
-  }
-
   let sbtOpts: Array<string> = []
   if (cli.flags['sbtOpts']) {
     sbtOpts = (cli.flags['sbtOpts'] as string)
diff --git a/src/commands/repos/cmd-repos-create.ts b/src/commands/repos/cmd-repos-create.ts
index e80fb6a76..90f681ba8 100644
--- a/src/commands/repos/cmd-repos-create.ts
+++ b/src/commands/repos/cmd-repos-create.ts
@@ -89,6 +89,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -96,8 +98,6 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await createRepo({
     outputJson: Boolean(cli.flags['json']),
     outputMarkdown: Boolean(cli.flags['markdown']),
diff --git a/src/commands/repos/cmd-repos-del.ts b/src/commands/repos/cmd-repos-del.ts
index 7a01f0673..9c7bb7cb8 100644
--- a/src/commands/repos/cmd-repos-del.ts
+++ b/src/commands/repos/cmd-repos-del.ts
@@ -58,6 +58,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -65,7 +67,5 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await deleteRepo(orgSlug, repoName, apiToken)
 }
diff --git a/src/commands/repos/cmd-repos-list.ts b/src/commands/repos/cmd-repos-list.ts
index 501254597..2c7cadb14 100644
--- a/src/commands/repos/cmd-repos-list.ts
+++ b/src/commands/repos/cmd-repos-list.ts
@@ -81,6 +81,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -88,8 +90,6 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await listRepos({
     apiToken,
     outputJson: Boolean(cli.flags['json']),
diff --git a/src/commands/repos/cmd-repos-update.ts b/src/commands/repos/cmd-repos-update.ts
index c56738e6c..897ee5e6c 100644
--- a/src/commands/repos/cmd-repos-update.ts
+++ b/src/commands/repos/cmd-repos-update.ts
@@ -90,6 +90,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -97,8 +99,6 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await updateRepo({
     apiToken,
     outputJson: Boolean(cli.flags['json']),
diff --git a/src/commands/repos/cmd-repos-view.ts b/src/commands/repos/cmd-repos-view.ts
index f342ec4f0..a1bc5e6d6 100644
--- a/src/commands/repos/cmd-repos-view.ts
+++ b/src/commands/repos/cmd-repos-view.ts
@@ -59,6 +59,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -66,7 +68,5 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await viewRepo(orgSlug, repoName, apiToken)
 }
diff --git a/src/commands/scan/cmd-scan-create.ts b/src/commands/scan/cmd-scan-create.ts
index 44cbf1e5a..21756aa58 100644
--- a/src/commands/scan/cmd-scan-create.ts
+++ b/src/commands/scan/cmd-scan-create.ts
@@ -170,6 +170,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -177,8 +179,6 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await createFullScan({
     apiToken,
     orgSlug,
diff --git a/src/commands/scan/cmd-scan-del.ts b/src/commands/scan/cmd-scan-del.ts
index de52eec65..780b8c612 100644
--- a/src/commands/scan/cmd-scan-del.ts
+++ b/src/commands/scan/cmd-scan-del.ts
@@ -60,6 +60,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -67,7 +69,5 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await deleteOrgFullScan(orgSlug, fullScanId, apiToken)
 }
diff --git a/src/commands/scan/cmd-scan-list.ts b/src/commands/scan/cmd-scan-list.ts
index 08c4d9dc6..94fd5c767 100644
--- a/src/commands/scan/cmd-scan-list.ts
+++ b/src/commands/scan/cmd-scan-list.ts
@@ -96,6 +96,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -103,8 +105,6 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await listFullScans(
     orgSlug,
     // TODO: refine this object to what we need
diff --git a/src/commands/scan/cmd-scan-metadata.ts b/src/commands/scan/cmd-scan-metadata.ts
index 05fa37507..72f7566be 100644
--- a/src/commands/scan/cmd-scan-metadata.ts
+++ b/src/commands/scan/cmd-scan-metadata.ts
@@ -63,6 +63,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -70,7 +72,5 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await getOrgScanMetadata(orgSlug, fullScanId, apiToken)
 }
diff --git a/src/commands/scan/cmd-scan-stream.ts b/src/commands/scan/cmd-scan-stream.ts
index e18fcea81..89ce1db13 100644
--- a/src/commands/scan/cmd-scan-stream.ts
+++ b/src/commands/scan/cmd-scan-stream.ts
@@ -65,6 +65,8 @@ async function run(
     return
   }
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -72,7 +74,5 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await getFullScan(orgSlug, fullScanId, file, apiToken)
 }
diff --git a/src/commands/threat-feed/cmd-threat-feed.ts b/src/commands/threat-feed/cmd-threat-feed.ts
index 9360e37b4..c6a49ba14 100644
--- a/src/commands/threat-feed/cmd-threat-feed.ts
+++ b/src/commands/threat-feed/cmd-threat-feed.ts
@@ -70,6 +70,8 @@ async function run(
     parentName
   })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
@@ -77,8 +79,6 @@ async function run(
     )
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   await getThreatFeed({
     apiToken,
     direction: String(cli.flags['direction'] || 'desc'),
diff --git a/src/utils/meow-with-subcommands.ts b/src/utils/meow-with-subcommands.ts
index 2241a5e6e..3ae9808db 100644
--- a/src/utils/meow-with-subcommands.ts
+++ b/src/utils/meow-with-subcommands.ts
@@ -1,5 +1,6 @@
 import meow from 'meow'
 
+import { envAsBoolean } from '@socketsecurity/registry/lib/env'
 import { toSortedObject } from '@socketsecurity/registry/lib/objects'
 
 import { getFlagListOutput, getHelpListOutput } from './output-formatting'
@@ -7,7 +8,6 @@ import { getSetting } from './settings.ts'
 import { MeowFlags, commonFlags } from '../flags'
 
 import type { Options } from 'meow'
-import { envAsBoolean } from '@socketsecurity/registry/lib/env'
 
 interface CliAlias {
   description: string
diff --git a/test/dry-run.test.ts b/test/dry-run.test.ts
index 483388cdc..fa7b1a427 100644
--- a/test/dry-run.test.ts
+++ b/test/dry-run.test.ts
@@ -13,9 +13,10 @@ import path from 'node:path'
 import spawn from '@npmcli/promise-spawn'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 
-import constants from '../dist/constants.js'
 import { envAsBoolean } from '@socketsecurity/registry/lib/env'
 
+import constants from '../dist/constants.js'
+
 type PromiseSpawnOptions = Exclude<Parameters<typeof spawn>[2], undefined> & {
   encoding?: BufferEncoding | undefined
 }

From f580be98b6c643172918a4dd8b3d7ed399e2ecce Mon Sep 17 00:00:00 2001
From: Peter van der Zee <github-public@qfox.nl>
Date: Wed, 26 Feb 2025 16:13:38 +0100
Subject: [PATCH 4/6] fix report create test

---
 src/commands/report/cmd-report-create.ts | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/src/commands/report/cmd-report-create.ts b/src/commands/report/cmd-report-create.ts
index 4ec367616..3e3393d02 100644
--- a/src/commands/report/cmd-report-create.ts
+++ b/src/commands/report/cmd-report-create.ts
@@ -84,19 +84,14 @@ async function run(
   const includeAllIssues = Boolean(cli.flags['all'])
   const view = Boolean(cli.flags['view'])
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const socketConfig = await getSocketConfig(absoluteConfigPath)
 
   const result = await createReport(socketConfig, cli.input, { cwd, dryRun })
 
   const commandName = `${parentName} ${config.commandName}`
 
-  if (dryRun && view) {
-    console.log(
-      '[DryRun] Ignoring view flag since no report was actually generated'
-    )
-  }
-  if (dryRun) return console.log('[DryRun] Bailing now')
-
   if (result?.success) {
     if (view) {
       const reportId = result.data.id

From 1ef80536ef435f1b1571b4a1a106b20e24087234 Mon Sep 17 00:00:00 2001
From: Peter van der Zee <github-public@qfox.nl>
Date: Wed, 26 Feb 2025 16:19:25 +0100
Subject: [PATCH 5/6] Work around auth issue for other test

---
 src/commands/scan/cmd-scan-create.ts |  4 ++--
 test/dry-run.test.ts                 | 16 ++++------------
 2 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/src/commands/scan/cmd-scan-create.ts b/src/commands/scan/cmd-scan-create.ts
index 21756aa58..a0d35da5c 100644
--- a/src/commands/scan/cmd-scan-create.ts
+++ b/src/commands/scan/cmd-scan-create.ts
@@ -142,6 +142,8 @@ async function run(
       throw new Error('Failed getting supported files for report', { cause })
     })
 
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const packagePaths = await getPackageFilesFullScans(
     cwd,
     targets,
@@ -170,8 +172,6 @@ async function run(
     return
   }
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   const apiToken = getDefaultToken()
   if (!apiToken) {
     throw new AuthError(
diff --git a/test/dry-run.test.ts b/test/dry-run.test.ts
index fa7b1a427..51b3ac3d1 100644
--- a/test/dry-run.test.ts
+++ b/test/dry-run.test.ts
@@ -771,21 +771,13 @@ describe('dry-run on all commands', async () => {
          _____         _       _        /---------------
         |   __|___ ___| |_ ___| |_      | Socket.dev CLI ver <redacted>
         |__   | . |  _| '_| -_|  _|     | Node: <redacted>, API token set: <redacted>
-        |_____|___|___|_,_|___|_|.dev   | Command: \`socket scan create\`, cwd: <redacted>"
-    `)
-    expect(stderr).toMatchInlineSnapshot(`
-      "\\x1b[41m\\x1b[37mInput error\\x1b[39m\\x1b[49m: Please provide the required fields:
-
-          - Org name as the first argument \\x1b[31m(missing!)\\x1b[39m
-
-          - Repository name using --repo \\x1b[31m(missing!)\\x1b[39m
+        |_____|___|___|_,_|___|_|.dev   | Command: \`socket scan create\`, cwd: <redacted>
 
-          - Branch name using --branch \\x1b[31m(missing!)\\x1b[39m
-
-          - At least one TARGET (e.g. \`.\` or \`./package.json\`) \\x1b[31m(missing)\\x1b[39m"
+      [DryRun] Bailing now"
     `)
+    expect(stderr).toMatchInlineSnapshot(`""`)
 
-    expect(code).toBe(2)
+    expect(code, 'dry-run should exit with code 0 if input is ok').toBe(0)
     expect(stdout, 'header should include command (without params)').toContain(
       cmd.slice(0, cmd.indexOf('--dry-run')).join(' ')
     )

From d77ee44952106641fb6e03a19e4d377fd4288ba8 Mon Sep 17 00:00:00 2001
From: Peter van der Zee <github-public@qfox.nl>
Date: Wed, 26 Feb 2025 16:23:50 +0100
Subject: [PATCH 6/6] One more

---
 src/commands/report/cmd-report-create.ts | 1 +
 src/commands/scan/cmd-scan-create.ts     | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/commands/report/cmd-report-create.ts b/src/commands/report/cmd-report-create.ts
index 3e3393d02..69618848d 100644
--- a/src/commands/report/cmd-report-create.ts
+++ b/src/commands/report/cmd-report-create.ts
@@ -84,6 +84,7 @@ async function run(
   const includeAllIssues = Boolean(cli.flags['all'])
   const view = Boolean(cli.flags['view'])
 
+  // Note exiting earlier to skirt a hidden auth requirement
   if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
 
   const socketConfig = await getSocketConfig(absoluteConfigPath)
diff --git a/src/commands/scan/cmd-scan-create.ts b/src/commands/scan/cmd-scan-create.ts
index a0d35da5c..457fc2546 100644
--- a/src/commands/scan/cmd-scan-create.ts
+++ b/src/commands/scan/cmd-scan-create.ts
@@ -125,6 +125,9 @@ async function run(
       ? String(cli.flags['cwd'])
       : process.cwd()
 
+  // Note exiting earlier to skirt a hidden auth requirement
+  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
+
   const socketSdk = await setupSdk()
   const supportedFiles = await socketSdk
     .getReportSupportedFiles()
@@ -142,8 +145,6 @@ async function run(
       throw new Error('Failed getting supported files for report', { cause })
     })
 
-  if (cli.flags['dryRun']) return console.log('[DryRun] Bailing now')
-
   const packagePaths = await getPackageFilesFullScans(
     cwd,
     targets,