socket-cli: multi-root support for --dynamic-sbom-inference

CHANGELOG.md

@@ -4,19 +4,24 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [1.1.154](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.154) - 2026-08-06
-
-### Changed
-- Updated the Coana CLI to v `15.10.4`.
-
 ## [Unreleased]
 
+### Added
+- `socket scan create --reach --dynamic-sbom-inference` splits full application reachability analysis per project/module for Gradle, sbt, and Maven monorepos, using a Socket facts SBOM generated directly by each package manager for every build root, instead of one synthetic root.
+- `socket manifest setup --dynamic-sbom-inference` extends the interactive `socket.json` configurator to walk every independent Gradle, sbt, and Maven build root in your project.
+- `socket manifest dynamic-sbom-inference`: generate a Socket facts SBOM for every independent Gradle, sbt, and Maven build root directly, without creating a scan.
+
 ### Changed
-- Updated the Coana CLI to v `15.10.3`.
+- Updated the Coana CLI to v `15.10.8`.
 
 ### Fixed
 - Declared `form-data` as a dependency, so a fresh install no longer throws `Cannot find module 'form-data'` on its first upload.
 
+## [1.1.154](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.154) - 2026-08-06
+
+### Changed
+- Updated the Coana CLI to v `15.10.4`.
+
 ## [1.1.153](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.153) - 2026-08-04
 
 ### Changed

package.json

@@ -102,7 +102,7 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "15.10.4",
+    "@coana-tech/cli": "15.10.8",
     "@cyclonedx/cdxgen": "12.1.2",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",

src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts

@@ -22,10 +22,7 @@ const config: CliCommandConfig = {
   commandName: 'dynamic-sbom-inference',
   description:
     'Recursively discover gradle/sbt/maven build roots and generate a Socket facts SBOM for each',
-  // Hidden: `--dynamic-sbom-inference` already names an unrelated, root-only
-  // scan create/reach flag (see reachability-flags.mts). Keep this hidden
-  // until the naming collision between the two is resolved.
-  hidden: true,
+  hidden: false,
   flags: {
     ...commonFlags,
     ...outputFlags,

src/commands/manifest/cmd-manifest-setup.mts

@@ -22,11 +22,10 @@ const config: CliCommandConfig = {
   hidden: false,
   flags: {
     ...commonFlags,
-    // Only meaningful alongside the hidden --dynamic-sbom-inference below; kept hidden too.
+    // Only meaningful alongside --dynamic-sbom-inference below.
     excludePaths: {
       type: 'string',
       isMultiple: true,
-      hidden: true,
       description:
         'Build roots matching these glob patterns (and everything beneath them) are marked disabled. Patterns are anchored micromatch globs matched relative to CWD: `legacy` matches only `<cwd>/legacy`; use `**/legacy` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.',
     },
@@ -36,9 +35,8 @@ const config: CliCommandConfig = {
     },
     dynamicSbomInference: {
       type: 'boolean',
-      hidden: true,
       description:
-        'Recursively scans for every gradle/sbt/maven build root beneath CWD first, so the CWD config step only asks about ecosystems actually found somewhere in the tree. A build root matching --exclude-paths is bulk-disabled with no prompt, applied unconditionally; eligible build roots found afterward can be configured individually',
+        'Generates dynamic SBOMs via the Gradle/sbt/Maven package manager tools for more accurate results than static resolution. Scans every build root under CWD first, so the configurator only asks about ecosystems actually found; --exclude-paths matches are bulk-disabled, others configured individually.',
     },
   },
   help: (command, config) => `

src/commands/manifest/cmd-manifest-setup.test.mts

@@ -24,6 +24,8 @@ describe('socket manifest setup', async () => {
 
           Options
             --default-on-read-error  If reading the socket.json fails, just use a default config? Warning: This might override the existing json file!
+            --dynamic-sbom-inference  Generates dynamic SBOMs via the Gradle/sbt/Maven package manager tools for more accurate results than static resolution. Scans every build root under CWD first, so the configurator only asks about ecosystems actually found; --exclude-paths matches are bulk-disabled, others configured individually.
+            --exclude-paths     Build roots matching these glob patterns (and everything beneath them) are marked disabled. Patterns are anchored micromatch globs matched relative to CWD: \`legacy\` matches only \`<cwd>/legacy\`; use \`**/legacy\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
 
           This command will try to detect all supported ecosystems in given CWD. Then
           it starts a configurator where you can setup default values for certain flags

src/commands/manifest/cmd-manifest.test.mts

@@ -27,6 +27,7 @@ describe('socket manifest', async () => {
             bazel                       [beta] Bazel SBOM support \\u2014 generate manifest files for a Bazel project (Maven, PyPI)
             cdxgen                      Run cdxgen for SBOM generation
             conda                       [beta] Convert a Conda environment.yml file to a python requirements.txt
+            dynamic-sbom-inference      Recursively discover gradle/sbt/maven build roots and generate a Socket facts SBOM for each
             gradle                      [beta] Generate a Socket facts file (or \`pom.xml\` with --pom) for a Gradle/Java/Kotlin/etc project
             kotlin                      [beta] Generate a Socket facts file (or \`pom.xml\` with --pom) for a Kotlin project
             maven                       [beta] Generate a Socket facts file from a Maven \`pom.xml\` project

src/commands/manifest/discover-manifest-roots.mts

@@ -1,6 +1,6 @@
-import { promises as fs } from 'node:fs'
 import path from 'node:path'
 
+import { realpathOrResolved } from '../../utils/fs.mts'
 import { globWithGitIgnore } from '../../utils/glob.mts'
 import { excludePathToScanIgnores } from '../scan/exclude-paths.mts'
 
@@ -55,13 +55,7 @@ export function withoutDisabledFlags(sockJson: SocketJson): SocketJson {
   } as SocketJson
 }
 
-export async function realpathOrResolved(dir: string): Promise<string> {
-  try {
-    return await fs.realpath(dir)
-  } catch {
-    return path.resolve(dir)
-  }
-}
+export { realpathOrResolved }
 
 function sortByDepthThenPath(dirs: readonly string[], cwd: string): string[] {
   return [...dirs].sort((a, b) => {