fix: address qodo review findings for batch analysis

- Make generateOneSbom async and await provider.provideStack() to support
  async providers (e.g. python_pip)
- Propagate workspaceDir as cwd for package manager commands so npm/pnpm/yarn
  run from workspace root in monorepos
- Fix CLI --html --metadata printing wrapper object instead of HTML string

Implements TC-3862

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

src/cli.js

@@ -280,7 +280,12 @@ const stackBatch = {
 				res = summaries
 			}
 		}
-		console.log(html ? res : JSON.stringify(res, null, 2))
+		if (html) {
+			const htmlContent = res && typeof res === 'object' && 'analysis' in res ? res.analysis : res
+			console.log(htmlContent)
+		} else {
+			console.log(JSON.stringify(res, null, 2))
+		}
 	}
 }
 

src/index.js

@@ -281,12 +281,12 @@ function buildBatchAnalysisMetadata(root, ecosystem, totalSbomAttempts, successf
  *
  * @param {string} manifestPath
  * @param {Options} workspaceOpts - opts with `workspaceDir` set
- * @returns {SbomResult}
+ * @returns {Promise<SbomResult>}
  * @private
  */
-function generateOneSbom(manifestPath, workspaceOpts) {
+async function generateOneSbom(manifestPath, workspaceOpts) {
 	const provider = match(manifestPath, availableProviders, workspaceOpts)
-	const provided = provider.provideStack(manifestPath, workspaceOpts)
+	const provided = await provider.provideStack(manifestPath, workspaceOpts)
 	const sbom = JSON.parse(provided.content)
 	const purl = sbom?.metadata?.component?.purl || sbom?.metadata?.component?.['bom-ref']
 	if (!purl) {
@@ -373,7 +373,7 @@ async function generateSboms(manifestPaths, workspaceOpts, continueOnError, conc
 
 	if (!continueOnError) {
 		for (const manifestPath of manifestPaths) {
-			const result = generateOneSbom(manifestPath, workspaceOpts)
+			const result = await generateOneSbom(manifestPath, workspaceOpts)
 			if (!result.ok) {
 				collectedErrors.push({ manifestPath: result.manifestPath, phase: 'sbom', reason: result.reason })
 				throw new Error(`${result.manifestPath}: ${result.reason}`)
@@ -383,9 +383,9 @@ async function generateSboms(manifestPaths, workspaceOpts, continueOnError, conc
 	} else {
 		const limit = pLimit(concurrency)
 		const settled = await Promise.all(
-			manifestPaths.map(manifestPath => limit(() => {
+			manifestPaths.map(manifestPath => limit(async () => {
 				try {
-					return generateOneSbom(manifestPath, workspaceOpts)
+					return await generateOneSbom(manifestPath, workspaceOpts)
 				} catch (err) {
 					const msg = err instanceof Error ? err.message : String(err)
 					if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {

src/providers/base_javascript.js

@@ -181,15 +181,18 @@ export default class Base_javascript {
 	/**
    * Builds the dependency tree for the project
    * @param {boolean} includeTransitive - Whether to include transitive dependencies
+   * @param {Object} [opts={}] - Configuration options; when `workspaceDir` is set, commands run from workspace root
    * @returns {Object} The dependency tree
    * @protected
    */
-	_buildDependencyTree(includeTransitive) {
+	_buildDependencyTree(includeTransitive, opts = {}) {
 		this._version();
-		let manifestDir = path.dirname(this.#manifest.manifestPath);
-		this.#createLockFile(manifestDir);
+		const manifestDir = path.dirname(this.#manifest.manifestPath);
+		const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts) ?? opts.workspaceDir
+		const cmdDir = workspaceDir ? path.resolve(workspaceDir) : manifestDir;
+		this.#createLockFile(cmdDir);
 
-		let output = this.#executeListCmd(includeTransitive, manifestDir);
+		let output = this.#executeListCmd(includeTransitive, cmdDir);
 		output = this._parseDepTreeOutput(output);
 		return JSON.parse(output);
 	}
@@ -201,7 +204,7 @@ export default class Base_javascript {
    * @private
    */
 	#getSBOM(opts = {}) {
-		const depsObject = this._buildDependencyTree(true);
+		const depsObject = this._buildDependencyTree(true, opts);
 
 		let mainComponent = toPurl(purlType, this.#manifest.name, this.#manifest.version);
 		const license = this.readLicenseFromManifest(this.#manifest.manifestPath);
@@ -260,7 +263,7 @@ export default class Base_javascript {
    * @private
    */
 	#getDirectDependencySbom(opts = {}) {
-		const depTree = this._buildDependencyTree(false);
+		const depTree = this._buildDependencyTree(false, opts);
 		let mainComponent = toPurl(purlType, this.#manifest.name, this.#manifest.version);
 		const license = this.readLicenseFromManifest(this.#manifest.manifestPath);
 

src/providers/javascript_pnpm.js

@@ -18,8 +18,8 @@ export default class Javascript_pnpm extends Base_javascript {
 		return ['install', '--frozen-lockfile'];
 	}
 
-	_buildDependencyTree(includeTransitive, manifest) {
-		const tree = super._buildDependencyTree(includeTransitive, manifest);
+	_buildDependencyTree(includeTransitive, opts = {}) {
+		const tree = super._buildDependencyTree(includeTransitive, opts);
 		if (Array.isArray(tree) && tree.length > 0) {
 			return tree[0];
 		}