@socketsecurity/cli-with-sentry 1.10.1 → 1.11.1

package/dist/cli.js

@@ -19,8 +19,9 @@ var prompts = require('../external/@socketsecurity/registry/lib/prompts');
 var require$$0 = require('node:crypto');
 var os = require('node:os');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
-var bin = require('../external/@socketsecurity/registry/lib/bin');
 var childProcess = require('node:child_process');
+var bin = require('../external/@socketsecurity/registry/lib/bin');
+var require$$7 = require('node:timers/promises');
 var fs$1 = require('../external/@socketsecurity/registry/lib/fs');
 var strings = require('../external/@socketsecurity/registry/lib/strings');
 var path$1 = require('../external/@socketsecurity/registry/lib/path');
@@ -2010,7 +2011,7 @@ async function performReachabilityAnalysis(options) {
   // Build Coana arguments.
   const coanaArgs = ['run', analysisTarget, '--output-dir', path.dirname(outputFilePath), '--socket-mode', outputFilePath, '--disable-report-submission', ...(isOmittedReachValue(reachabilityOptions.reachAnalysisTimeout) ? [] : ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout]), ...(isOmittedReachValue(reachabilityOptions.reachAnalysisMemoryLimit) ? [] : ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit]), ...(reachabilityOptions.reachConcurrency ? ['--concurrency', `${reachabilityOptions.reachConcurrency}`] : []), ...(reachabilityOptions.reachContinueOnAnalysisErrors ? ['--reach-continue-on-analysis-errors'] : []), ...(reachabilityOptions.reachContinueOnInstallErrors ? ['--reach-continue-on-install-errors'] : []), ...(reachabilityOptions.reachContinueOnMissingLockFiles ? ['--reach-continue-on-missing-lock-files'] : []), ...(reachabilityOptions.reachContinueOnNoSourceFiles ? ['--reach-continue-on-no-source-files'] : []), ...(reachabilityOptions.reachDebug ? ['--debug'] : []), ...(reachabilityOptions.reachDetailedAnalysisLogFile ? ['--print-analysis-log-file'] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachDisableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(reachabilityOptions.reachEnableAnalysisSplitting ? [] : ['--disable-analysis-splitting']), '--run-without-docker', '--manifests-tar-hash', tarHash,
   // Empty reachEcosystems implies scanning all ecosystems.
-  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []),
+  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachAdvisories.length ? ['--ghsas', ...reachabilityOptions.reachAdvisories] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []),
   // sidecarPath is always set above when this is true - Coana rejects this
   // flag without one.
   ...(reachabilityOptions.dynamicSbomInference ? ['--maven-use-only-socket-facts'] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
@@ -2081,23 +2082,87 @@ async function performReachabilityAnalysis(options) {
   }
 }
 
-const BUILD_TOOLS = ['gradle', 'maven', 'sbt'];
+// PATH fallback when no `bin` and no project wrapper.
+const DEFAULT_BUILD_TOOL_BIN = {
+  __proto__: null,
+  gradle: 'gradle',
+  maven: 'mvn',
+  sbt: 'sbt'
+};
 
-// One glob-suffix set per ecosystem's build-descriptor marker(s); `settings.gradle(.kts)`
-// covers Kotlin-DSL roots that have no root `build.gradle`.
-const MARKERS_BY_TOOL = {
+// Project-local wrapper, preferred because it pins the expected build-tool
+// version. sbt has no wrapper convention. POSIX names only (no win32 target).
+const BUILD_TOOL_WRAPPER = {
   __proto__: null,
-  gradle: ['build.gradle', 'build.gradle.kts', 'settings.gradle', 'settings.gradle.kts'],
-  maven: ['pom.xml'],
-  sbt: ['build.sbt']
+  gradle: 'gradlew',
+  maven: 'mvnw'
 };
-const TOOL_BY_MARKER = {
-  __proto__: null
+
+// Maven builds by file (`mvn --file`), so a directory can hold several: the
+// POMs a scan uploads, matched case-insensitively. `walkGlob` is a
+// case-sensitive superset of `nocaseGlob`, for the walk.
+
+// `settings.gradle(.kts)` covers Kotlin-DSL roots that have no root
+// `build.gradle`.
+const BUILD_FILES = {
+  __proto__: null,
+  gradle: {
+    byFile: false,
+    names: ['build.gradle', 'build.gradle.kts', 'settings.gradle', 'settings.gradle.kts']
+  },
+  maven: {
+    byFile: true,
+    nocaseGlob: '{*-*.,}pom{.xml,}',
+    walkGlob: '*[pP][oO][mM]*'
+  },
+  sbt: {
+    byFile: false,
+    names: ['build.sbt']
+  }
 };
-for (const tool of BUILD_TOOLS) {
-  for (const marker of MARKERS_BY_TOOL[tool]) {
-    TOOL_BY_MARKER[marker] = tool;
+
+// sbt happily runs in any directory, synthesizing a default project from its
+// name, so an sbt run outside a build yields a plausible but bogus SBOM. Maven
+// and Gradle refuse such a directory themselves.
+function looksLikeSbtBuild(projectDir) {
+  return u.existsSync(path.resolve(projectDir, 'build.sbt')) || u.existsSync(path.resolve(projectDir, 'project'));
+}
+function resolveBuildToolBin(tool, projectDir, bin) {
+  if (bin) {
+    return bin;
+  }
+  const wrapperName = BUILD_TOOL_WRAPPER[tool];
+  if (wrapperName && u.existsSync(path.resolve(projectDir, wrapperName))) {
+    return `./${wrapperName}`;
+  }
+  return DEFAULT_BUILD_TOOL_BIN[tool];
+}
+
+// Distinct for every build sharing a directory.
+function socketFactsFileName(tool, entryFile) {
+  if (!BUILD_FILES[tool].byFile) {
+    return `${tool}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}`;
   }
+  return entryFile ? `${path.basename(entryFile)}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}` : undefined;
+}
+
+const BUILD_TOOLS = ['gradle', 'maven', 'sbt'];
+const BUILD_FILE_MATCHERS = new Map(BUILD_TOOLS.map(tool => {
+  const files = BUILD_FILES[tool];
+  return [tool, files.byFile ? vendor.micromatchExports.matcher(files.nocaseGlob, {
+    dot: true,
+    nocase: true
+  }) : basename => files.names.includes(basename)];
+}));
+
+// `entryFile` (a basename in `dir`) is set only for a tool that addresses its
+// builds by file, where one directory can hold several builds.
+
+function buildRootPath(root) {
+  return path.join(root.dir, root.entryFile ?? '');
+}
+function buildFileTool(tools, basename) {
+  return tools.find(tool => BUILD_FILE_MATCHERS.get(tool)?.(basename));
 }
 
 // A disabled ecosystem is skipped entirely by the glob scan below, so a
@@ -2148,20 +2213,24 @@ async function addCoveredBuildFiles(covered, buildRoot, projects) {
   }
 }
 
-// `dir` must be realpath-resolved, as findBuildToolCandidates returns it.
-function isBuildRootCovered(covered, tool, dir) {
-  return MARKERS_BY_TOOL[tool].some(marker => covered.has(path.join(dir, marker)));
+// `root.dir` must be realpath-resolved, as findBuildToolCandidates returns it.
+function isBuildRootCovered(covered, tool, root) {
+  const files = BUILD_FILES[tool];
+  if (files.byFile) {
+    return !!root.entryFile && covered.has(buildRootPath(root));
+  }
+  return files.names.some(name => covered.has(path.join(root.dir, name)));
 }
-function sortByDepthThenPath(dirs, cwd) {
-  return [...dirs].sort((a, b) => {
-    const relA = path.relative(cwd, a);
-    const relB = path.relative(cwd, b);
+function compareStrings(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function sortByDepthThenPath(roots, cwd) {
+  return [...roots].sort((a, b) => {
+    const relA = path.relative(cwd, a.dir);
+    const relB = path.relative(cwd, b.dir);
     const depthA = relA === '' ? 0 : relA.split(path.sep).length;
     const depthB = relB === '' ? 0 : relB.split(path.sep).length;
-    if (depthA !== depthB) {
-      return depthA - depthB;
-    }
-    return relA < relB ? -1 : relA > relB ? 1 : 0;
+    return depthA - depthB || compareStrings(relA, relB) || compareStrings(a.entryFile ?? '', b.entryFile ?? '');
   });
 }
 
@@ -2170,36 +2239,56 @@ function sortByDepthThenPath(dirs, cwd) {
 async function findBuildToolCandidates({
   cwd,
   excludePaths,
-  sockJson
+  sockJson,
+  socketConfig
 }) {
   const enabledTools = BUILD_TOOLS.filter(tool => !sockJson.defaults?.manifest?.[tool]?.disabled);
   const result = new Map();
   if (!enabledTools.length) {
     return result;
   }
-  const patterns = enabledTools.flatMap(tool => MARKERS_BY_TOOL[tool].map(marker => `**/${marker}`));
   const additionalIgnores = (excludePaths ?? []).flatMap(excludePathToScanIgnores);
-  const hits = await utils.globWithGitIgnore(patterns, {
+  // Build files are matched after the walk, as a scan matches them after its
+  // ignores, so --exclude-paths and .gitignore stay case-sensitive.
+  const hits = await utils.globWithGitIgnore(enabledTools.flatMap(tool => {
+    const files = BUILD_FILES[tool];
+    return (files.byFile ? [files.walkGlob] : files.names).map(glob => `**/${glob}`);
+  }), {
     absolute: true,
     additionalIgnores,
-    cwd
-  });
-  const dirSetsByTool = new Map(enabledTools.map(tool => [tool, new Set()]));
-  const resolvedHits = await Promise.all(hits.map(async hit => ({
-    dir: await utils.realpathOrResolved(path.dirname(hit)),
-    tool: TOOL_BY_MARKER[path.basename(hit)]
+    cwd,
+    socketConfig
+  });
+  const rootsByTool = new Map(enabledTools.map(tool => [tool, new Map()]));
+  const matched = hits.flatMap(hit => {
+    const basename = path.basename(hit);
+    const tool = buildFileTool(enabledTools, basename);
+    return tool ? [{
+      basename,
+      hit,
+      tool
+    }] : [];
+  });
+  const roots = await Promise.all(matched.map(async ({
+    basename,
+    hit,
+    tool
+  }) => ({
+    root: {
+      dir: await utils.realpathOrResolved(path.dirname(hit)),
+      entryFile: BUILD_FILES[tool].byFile ? basename : undefined
+    },
+    tool
   })));
   for (const {
-    dir,
+    root,
     tool
-  } of resolvedHits) {
-    if (tool) {
-      dirSetsByTool.get(tool)?.add(dir);
-    }
+  } of roots) {
+    rootsByTool.get(tool)?.set(buildRootPath(root), root);
   }
   const realCwd = await utils.realpathOrResolved(cwd);
   for (const tool of enabledTools) {
-    result.set(tool, sortByDepthThenPath([...(dirSetsByTool.get(tool) ?? [])], realCwd));
+    result.set(tool, sortByDepthThenPath([...(rootsByTool.get(tool)?.values() ?? [])], realCwd));
   }
   return result;
 }
@@ -2292,56 +2381,6 @@ function formatMissingEnvVarRefs(missing) {
   return `references ${names}, which ${verb} not set in this environment`;
 }
 
-// PATH fallback when no `bin` and no project wrapper.
-const DEFAULT_BUILD_TOOL_BIN = {
-  __proto__: null,
-  gradle: 'gradle',
-  maven: 'mvn',
-  sbt: 'sbt'
-};
-
-// Project-local wrapper, preferred because it pins the expected build-tool
-// version. sbt has no wrapper convention. POSIX names only (no win32 target).
-const BUILD_TOOL_WRAPPER = {
-  __proto__: null,
-  gradle: 'gradlew',
-  maven: 'mvnw'
-};
-
-// Gradle (8+) and sbt hold one build per directory; Maven builds are addressed
-// by POM file, so `mvn -f other-pom.xml` puts a second build in the directory.
-const ADDRESSED_BY_FILE = {
-  __proto__: null,
-  gradle: false,
-  maven: true,
-  sbt: false
-};
-
-// sbt happily runs in any directory, synthesizing a default project from its
-// name, so an sbt run outside a build yields a plausible but bogus SBOM. Maven
-// and Gradle refuse such a directory themselves.
-function looksLikeSbtBuild(projectDir) {
-  return u.existsSync(path.resolve(projectDir, 'build.sbt')) || u.existsSync(path.resolve(projectDir, 'project'));
-}
-function resolveBuildToolBin(tool, projectDir, bin) {
-  if (bin) {
-    return bin;
-  }
-  const wrapperName = BUILD_TOOL_WRAPPER[tool];
-  if (wrapperName && u.existsSync(path.resolve(projectDir, wrapperName))) {
-    return `./${wrapperName}`;
-  }
-  return DEFAULT_BUILD_TOOL_BIN[tool];
-}
-
-// Distinct for every build sharing a directory.
-function socketFactsFileName(tool, entryFile) {
-  if (!ADDRESSED_BY_FILE[tool]) {
-    return `${tool}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}`;
-  }
-  return entryFile ? `${path.basename(entryFile)}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}` : undefined;
-}
-
 // Gradle's variant-aware resolver: distinct exceptions give mutually-exclusive
 // phrasing, so most-specific-first substring checks classify reliably.
 function classifyGradleFailure(detail) {
@@ -3805,7 +3844,8 @@ async function invokeMaven(opts, coanaTask, tmpDirPrefix) {
     // `validate` is the cheapest phase that triggers the extension; no compile
     // needed (analysis uses configured paths, not classes).
     const props = [`-Dmaven.ext.class.path=${jarPath}`, `-Dcoana.task=${coanaTask}`, `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
-    const args = [...props, ...(opts.toolOpts ?? []), '--batch-mode', 'validate'];
+    const fileOpts = opts.entryFile ? ['--file', opts.entryFile] : [];
+    const args = [...props, ...fileOpts, ...(opts.toolOpts ?? []), '--batch-mode', 'validate'];
     const out = await runNeverThrow(bin, args, opts);
     return await assembleFromRecords('maven', out, recordsFile);
   });
@@ -3841,6 +3881,7 @@ async function runManifestFacts({
   buildOpts,
   cwd,
   ecosystem,
+  entryFile,
   excludeConfigs,
   excludePaths,
   hints = FLAG_HINTS,
@@ -3867,9 +3908,14 @@ async function runManifestFacts({
     logger.logger.fail(`No sbt build found at \`${cwd}\` (expected a build.sbt file or a project directory).`);
     return null;
   }
-  logger.logger.info(`Generating Socket facts for the ${ecosystem} project at \`${cwd}\` ...`);
+  const location = buildRootPath({
+    dir: cwd,
+    entryFile
+  });
+  logger.logger.info(`Generating Socket facts for the ${ecosystem} project at \`${location}\` ...`);
   const scriptOpts = {
     bin: bin || undefined,
+    entryFile,
     excludeConfigs: excludeConfigs || undefined,
     excludePaths: excludePaths?.length ? excludePaths : undefined,
     // `env` replaces the spawned process's whole environment, not just JAVA_HOME.
@@ -3969,7 +4015,7 @@ async function runManifestFacts({
     // regardless of `ignoreUnresolved` — that flag only tolerates dependencies a
     // successful run couldn't resolve.
     process.exitCode = 1;
-    logger.logger.fail(`The ${ecosystem} build failed (exit code ${code}) before producing any Socket facts.`);
+    logger.logger.fail(`The ${ecosystem} build at \`${location}\` failed (exit code ${code}) before producing any Socket facts.`);
     return null;
   }
 
@@ -4032,13 +4078,40 @@ function getSkipReason(ecosystem, disabled, facts) {
   }
   return undefined;
 }
-// Nearest already-confirmed-disabled ancestor of `dir`, if any - lets the
+// Maven 3's options starting with `f`; its GnuParser takes a long name after
+// one dash too, and splits `-fX` and `-f=X` into `-f X`.
+const MAVEN_FILE_OPTS = new Set(['f', 'file']);
+const MAVEN_OTHER_F_OPTS = new Set(['fae', 'fail-at-end', 'fail-fast', 'fail-never', 'ff', 'fn']);
+
+// Each POM is built by its own `--file`, so a user one is dropped.
+function withoutMavenFileOpts(dir, opts) {
+  const kept = [];
+  for (let i = 0, {
+      length
+    } = opts; i < length; i += 1) {
+    const opt = opts[i];
+    const name = opt.replace(/^--?/, '');
+    if (opt === name || MAVEN_OTHER_F_OPTS.has(name)) {
+      kept.push(opt);
+    } else if (MAVEN_FILE_OPTS.has(name)) {
+      i += 1;
+    } else if (!MAVEN_FILE_OPTS.has(name.split('=')[0]) && !(opt.startsWith('-f') && !opt.startsWith('--'))) {
+      kept.push(opt);
+    }
+  }
+  if (kept.length !== opts.length) {
+    logger.logger.warn(`Ignoring --file in mavenOpts for ${dir}: each POM there is built by its own file.`);
+  }
+  return kept;
+}
+
+// Nearest already-confirmed-disabled `dir` or ancestor of it, if any - lets the
 // caller shorten `readSocketJsonCascade`'s walk to start there instead of
 // all the way back at `cwd`, without skipping any nested override.
 function nearestDisabledRoot(dir, disabledRoots) {
   let nearest;
   for (const root of disabledRoots) {
-    if (dir.startsWith(`${root.dir}${path.sep}`) && (!nearest || root.dir.length > nearest.dir.length)) {
+    if ((dir === root.dir || dir.startsWith(`${root.dir}${path.sep}`)) && (!nearest || root.dir.length > nearest.dir.length)) {
       nearest = root;
     }
   }
@@ -4058,54 +4131,71 @@ async function runEcosystemCandidates({
 }) {
   const outcomes = [];
   const covered = new Set();
-  for (const [ecosystem, dirs] of candidatesByTool) {
+  for (const [ecosystem, roots] of candidatesByTool) {
     const disabledRoots = [];
-    for (let dirIndex = 0; dirIndex < dirs.length; dirIndex += 1) {
-      const dir = dirs[dirIndex];
-      if (isBuildRootCovered(covered, ecosystem, dir)) {
+    const configByDir = new Map();
+    for (const {
+      0: rootIndex,
+      1: root
+    } of roots.entries()) {
+      const {
+        dir,
+        entryFile
+      } = root;
+      if (isBuildRootCovered(covered, ecosystem, root)) {
         outcomes.push({
-          dir,
+          ...root,
           ecosystem,
           status: 'skippedCovered'
         });
         continue;
       }
-      const nearestRoot = nearestDisabledRoot(dir, disabledRoots);
-      const sockJson = nearestRoot ? utils.readSocketJsonCascade(dir, nearestRoot.dir, nearestRoot.sockJson) : utils.readSocketJsonCascade(dir, realCwd, rootSockJson);
+      let dirConfig = configByDir.get(dir);
+      if (!dirConfig) {
+        const nearestRoot = nearestDisabledRoot(dir, disabledRoots);
+        const sockJson = nearestRoot ? utils.readSocketJsonCascade(dir, nearestRoot.dir, nearestRoot.sockJson) : utils.readSocketJsonCascade(dir, realCwd, rootSockJson);
+        dirConfig = {
+          ...resolveEcosystemConfig(ecosystem, dir, sockJson),
+          excludePaths: projectIgnorePathsToReachExcludePaths(excludePaths, {
+            cwd: realCwd,
+            target: dir
+          })
+        };
+        configByDir.set(dir, dirConfig);
+        if (dirConfig.skipReason) {
+          // Only warn for a genuinely new disabled root, not one already
+          // covered by an ancestor's warning above - otherwise a big disabled
+          // reactor with hundreds of nested poms would spam one warning line
+          // per pom for what's really a single root cause. The aggregate
+          // count still shows up in the final summary either way.
+          if (!nearestRoot) {
+            logger.logger.warn(`Skipping ${dir} (${ecosystem}): ${dirConfig.skipReason}.`);
+          }
+          disabledRoots.push({
+            dir,
+            sockJson
+          });
+        }
+      }
       const {
         bin,
         buildOpts,
         excludeConfigs,
+        excludePaths: excludePathsForRoot,
         ignoreUnresolved,
         includeConfigs,
         javaHome,
         skipReason,
         verbose: configVerbose
-      } = resolveEcosystemConfig(ecosystem, dir, sockJson);
+      } = dirConfig;
       if (skipReason) {
-        // Only warn for a genuinely new disabled root, not one already
-        // covered by an ancestor's warning above - otherwise a big disabled
-        // reactor with hundreds of nested poms would spam one warning line
-        // per pom for what's really a single root cause. The aggregate
-        // count still shows up in the final summary either way.
-        if (!nearestRoot) {
-          logger.logger.warn(`Skipping ${dir} (${ecosystem}): ${skipReason}.`);
-        }
         outcomes.push({
-          dir,
+          ...root,
           ecosystem,
           status: 'skippedDisabled'
         });
-        disabledRoots.push({
-          dir,
-          sockJson
-        });
         continue;
       }
-      const excludePathsForRoot = projectIgnorePathsToReachExcludePaths(excludePaths, {
-        cwd: realCwd,
-        target: dir
-      });
 
       // eslint-disable-next-line no-await-in-loop
       const result = await runManifestFacts({
@@ -4113,6 +4203,7 @@ async function runEcosystemCandidates({
         buildOpts,
         cwd: dir,
         ecosystem,
+        entryFile,
         excludeConfigs,
         excludePaths: excludePathsForRoot,
         hints: {
@@ -4131,17 +4222,17 @@ async function runEcosystemCandidates({
       });
       if (result === null) {
         outcomes.push({
-          dir,
+          ...root,
           ecosystem,
           status: 'failed'
         });
-        const abortedDirs = dirs.slice(dirIndex + 1);
-        if (abortedDirs.length) {
-          logger.logger.warn(`Aborting ${ecosystem} discovery: ${dir} failed to generate Socket facts, and without them the remaining build roots cannot be safely classified as covered or independent.`);
+        const abortedRoots = roots.slice(rootIndex + 1);
+        if (abortedRoots.length) {
+          logger.logger.warn(`Aborting ${ecosystem} discovery: ${buildRootPath(root)} failed to generate Socket facts, and without them the remaining build roots cannot be safely classified as covered or independent.`);
         }
-        for (const abortedDir of abortedDirs) {
+        for (const aborted of abortedRoots) {
           outcomes.push({
-            dir: abortedDir,
+            ...aborted,
             ecosystem,
             status: 'aborted'
           });
@@ -4150,18 +4241,18 @@ async function runEcosystemCandidates({
       }
       if (!result) {
         outcomes.push({
-          dir,
+          ...root,
           ecosystem,
           status: 'empty'
         });
         continue;
       }
 
-      // `-f`/`-p` can root the reactor away from `dir`.
+      // Gradle's `-p` can root the build away from `dir`.
       // eslint-disable-next-line no-await-in-loop
       await addCoveredBuildFiles(covered, path.dirname(result.factsPath), result.projects);
       outcomes.push({
-        dir,
+        ...root,
         ecosystem,
         factsPath: result.factsPath,
         status: 'generated'
@@ -4194,6 +4285,7 @@ async function generateRecursiveManifests({
   const candidatesByTool = await findBuildToolCandidates({
     cwd,
     excludePaths,
+    socketConfig: utils.loadSocketConfig(cwd),
     sockJson: withoutDisabledFlags(rootSockJson)
   });
   const runAll = resolvedSbtTmpDir => runEcosystemCandidates({
@@ -4259,7 +4351,7 @@ function resolveEcosystemConfig(ecosystem, dir, sockJson) {
   const bin = config?.bin ?? undefined;
   return {
     bin: bin ?? resolveBuildToolBin('maven', dir),
-    buildOpts: parseBuildToolOpts(config?.mavenOpts ?? undefined),
+    buildOpts: withoutMavenFileOpts(dir, parseBuildToolOpts(config?.mavenOpts ?? undefined)),
     excludeConfigs: config?.excludeConfigs ?? '',
     ignoreUnresolved: Boolean(config?.ignoreUnresolved),
     includeConfigs: config?.includeConfigs ?? '',
@@ -4377,6 +4469,234 @@ sockJson, cwd = process.cwd()) {
   return output;
 }
 
+function findEnvironmentKey(env, name, platform = process.platform) {
+  if (platform !== 'win32') {
+    return name;
+  }
+  const lower = name.toLowerCase();
+  return Object.keys(env).find(key => key.toLowerCase() === lower) ?? name;
+}
+function getBazelEnvironment(overrides = {}, platform = process.platform) {
+  const env = {
+    ...process.env
+  };
+  for (const [key, value] of Object.entries(overrides)) {
+    env[findEnvironmentKey(env, key, platform)] = value;
+  }
+  return env;
+}
+function getBazelEnvironmentValue(env, name) {
+  return env[findEnvironmentKey(env, name)];
+}
+function prependBazelPath(env, dir) {
+  const key = findEnvironmentKey(env, 'PATH');
+  return {
+    ...env,
+    [key]: `${dir}${path.delimiter}${env[key] ?? ''}`
+  };
+}
+async function findBazelExecutable(name, env, cwd) {
+  const searchPath = (getBazelEnvironmentValue(env, 'PATH') ?? '').split(path.delimiter).map(entry => path.resolve(cwd, entry.replace(/^"(.*)"$/, '$1'))).join(path.delimiter);
+  const found = await vendor.libExports$1(name, {
+    nothrow: true,
+    path: searchPath,
+    pathExt: getBazelEnvironmentValue(env, 'PATHEXT')
+  });
+  return found ? resolveBazelExecutable(found) : undefined;
+}
+function resolveBazelExecutable(file) {
+  const resolved = u.realpathSync(file);
+  const extension = path.extname(resolved).toLowerCase();
+  if (process.platform !== 'win32' || !['', '.cmd', '.ps1'].includes(extension)) {
+    return resolved;
+  }
+  try {
+    return bin.resolveBinPathSync(resolved);
+  } catch (e) {
+    if (extension === '.ps1') {
+      throw new utils.InputError('This PowerShell Bazel launcher could not be resolved to a Node entry point. Pass a native .exe, a .cmd or .bat wrapper, or a JavaScript entry point with --bazel.');
+    }
+    if (utils.isErrnoException(e) && e.code === 'ENOENT') {
+      return resolved;
+    }
+    throw e;
+  }
+}
+function isNodeScript(bin) {
+  if (/\.[cm]?js$/i.test(bin)) {
+    return true;
+  }
+  if (path.extname(bin) || process.platform !== 'win32' || !u.existsSync(bin)) {
+    return false;
+  }
+  const fd = u.openSync(bin, 'r');
+  try {
+    const header = Buffer.alloc(256);
+    const length = u.readSync(fd, header);
+    return /^#![^\r\n]*\bnode(?:\s|$)/.test(header.toString('utf8', 0, length));
+  } finally {
+    u.closeSync(fd);
+  }
+}
+const BATCH_METACHARACTERS = /[ !%^&()<>|"]/g;
+function escapeBatchMetacharacters(value) {
+  return value.replace(BATCH_METACHARACTERS, '^$&');
+}
+function escapeBatchArgument(value) {
+  if (/[\r\n\0]/.test(value)) {
+    throw new utils.InputError('Bazel batch launchers cannot accept arguments containing newlines or NUL characters. Use a native .exe launcher.');
+  }
+  const quoted = `"${value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1')}"`;
+  // Batch forwarding parses arguments twice, so protect each shell metacharacter twice.
+  return escapeBatchMetacharacters(escapeBatchMetacharacters(quoted));
+}
+function buildBazelProcessInvocation(bin, args, env) {
+  if (isNodeScript(bin)) {
+    return {
+      command: process.execPath,
+      args: [bin, ...args],
+      windowsVerbatimArguments: false
+    };
+  }
+  if (process.platform === 'win32' && /\.(?:cmd|bat)$/i.test(bin)) {
+    const script = [escapeBatchMetacharacters(bin), ...args.map(escapeBatchArgument)].join(' ');
+    return {
+      command: getBazelEnvironmentValue(env, 'ComSpec') ?? 'cmd.exe',
+      args: ['/d', '/v:off', '/s', '/c', `"${script}"`],
+      windowsVerbatimArguments: true
+    };
+  }
+  return {
+    command: bin,
+    args,
+    windowsVerbatimArguments: false
+  };
+}
+class BazelTimeoutError extends Error {
+  constructor(timeout, cause) {
+    super(`Bazel did not finish within ${timeout}ms`, {
+      cause
+    });
+    this.stdout = readOutput(cause, 'stdout');
+    this.stderr = readOutput(cause, 'stderr');
+  }
+}
+function readOutput(error, key) {
+  if (error && typeof error === 'object' && key in error) {
+    const value = Reflect.get(error, key);
+    return typeof value === 'string' ? value : '';
+  }
+  return '';
+}
+function makeAbortError(reason) {
+  const error = new Error('The operation was aborted', {
+    cause: reason
+  });
+  error.name = 'AbortError';
+  return error;
+}
+
+// Launchers can leave Bazel holding the output pipes after the launcher is killed.
+const PIPE_RELEASE_GRACE_MS = 5_000;
+async function killProcessTree(child) {
+  const {
+    pid
+  } = child;
+  if (pid === undefined) {
+    return;
+  }
+  if (process.platform === 'win32') {
+    await new Promise(resolve => {
+      childProcess.execFile('taskkill', ['/pid', String(pid), '/t', '/f'], () => resolve());
+    });
+    return;
+  }
+  try {
+    process.kill(-pid, 'SIGTERM');
+  } catch (e) {
+    if (!utils.isErrnoException(e) || e.code !== 'ESRCH') {
+      throw e;
+    }
+  }
+}
+async function spawnBazel(bin, args, {
+  signal = constants.default.abortSignal,
+  timeout,
+  ...options
+}) {
+  const env = getBazelEnvironment(options.env);
+  const invocation = buildBazelProcessInvocation(bin, args, env);
+  const controller = new AbortController();
+  const pending = spawn.spawn(invocation.command, invocation.args, {
+    ...options,
+    // A process group of its own lets a timeout or abort reach everything the launcher started.
+    detached: process.platform !== 'win32',
+    env,
+    shell: false,
+    signal: controller.signal,
+    windowsVerbatimArguments: invocation.windowsVerbatimArguments
+  });
+  let timedOut = false;
+  let releaseTimer;
+  const stop = () => {
+    releaseTimer ??= setTimeout(() => {
+      pending.process.stdout?.destroy();
+      pending.process.stderr?.destroy();
+    }, PIPE_RELEASE_GRACE_MS);
+    return killProcessTree(pending.process);
+  };
+  const onAbort = () => {
+    // taskkill finds descendants through the launcher, so the launcher must outlive the tree kill.
+    void stop().finally(() => controller.abort(signal.reason));
+  };
+  if (signal.aborted) {
+    onAbort();
+  } else {
+    signal.addEventListener('abort', onAbort, {
+      once: true
+    });
+  }
+  const timer = timeout ? setTimeout(() => {
+    timedOut = true;
+    void stop();
+  }, timeout) : undefined;
+  let result;
+  try {
+    result = await pending;
+  } catch (e) {
+    if (timedOut && timeout) {
+      throw new BazelTimeoutError(timeout, e);
+    }
+    // On Windows the tree kill ends the launcher first, so the spawn rejects with its exit code.
+    if (signal.aborted && !(e instanceof Error && e.name === 'AbortError')) {
+      throw makeAbortError(signal.reason);
+    }
+    throw e;
+  } finally {
+    clearTimeout(timer);
+    clearTimeout(releaseTimer);
+    signal.removeEventListener('abort', onAbort);
+  }
+  // Output is incomplete when the pipes were released after a timeout.
+  if (timedOut && timeout) {
+    throw new BazelTimeoutError(timeout, result);
+  }
+  return result;
+}
+function buildBazelStartupFlags(opts) {
+  const startup = [];
+  if (opts.bazelRc) {
+    startup.push(`--bazelrc=${opts.bazelRc}`);
+  }
+  if (opts.outputUserRoot) {
+    startup.push(`--output_user_root=${opts.outputUserRoot}`);
+  }
+  if (opts.bazelOutputBase) {
+    startup.push(`--output_base=${opts.bazelOutputBase}`);
+  }
+  return startup;
+}
+
 /**
  * Resolve the bazel binary to invoke for `socket manifest bazel`.
  *
@@ -4386,70 +4706,285 @@ sockJson, cwd = process.cwd()) {
  *   3. Fall back to `bazel` on PATH.
  *   4. If neither is found, throw InputError with install instructions.
  */
-async function resolveBazelBinary(explicit) {
+async function resolveBazelBinary(explicit, env, cwd) {
   if (explicit) {
-    if (!u.existsSync(explicit)) {
-      throw new utils.InputError(`--bazel path does not exist: ${explicit}. Install bazelisk or bazel, or pass an existing path via --bazel.`);
+    const resolved = path.resolve(cwd, explicit);
+    if (!u.existsSync(resolved)) {
+      throw new utils.InputError(`--bazel path does not exist: ${resolved}. Install bazelisk or bazel, or pass an existing path via --bazel.`);
     }
-    return explicit;
+    return resolveBazelExecutable(resolved);
   }
   // Prefer bazelisk: respects .bazelversion in the workspace.
-  const bazelisk = await bin.whichBin('bazelisk', {
-    nothrow: true
-  });
+  const bazelisk = await findBazelExecutable('bazelisk', env, cwd);
   if (bazelisk) {
     return bazelisk;
   }
-  const bazel = await bin.whichBin('bazel', {
-    nothrow: true
-  });
+  const bazel = await findBazelExecutable('bazel', env, cwd);
   if (bazel) {
     return bazel;
   }
   throw new utils.InputError('Could not find bazelisk or bazel on PATH. ' + 'Install bazelisk (recommended; https://github.com/bazelbuild/bazelisk) ' + 'or bazel, or pass --bazel <path>.');
 }
 
+const BAZEL_OUTPUT_ROOT_PREFIX = 'socket-bazel-';
+function makeBazelOutputUserRoot(env, cwd) {
+  const parent = getBazelEnvironmentValue(env, 'SOCKET_BAZEL_OUTPUT_ROOT');
+  const resolved = parent ? path.resolve(cwd, parent) : os.tmpdir();
+  u.mkdirSync(resolved, {
+    recursive: true
+  });
+  return u.mkdtempSync(path.join(resolved, BAZEL_OUTPUT_ROOT_PREFIX));
+}
+const RM_OPTIONS = {
+  recursive: true,
+  force: true,
+  maxRetries: 5,
+  retryDelay: 200
+};
+async function removeBazelTempdir(dir) {
+  try {
+    try {
+      await u.promises.rm(dir, RM_OPTIONS);
+    } catch (e) {
+      if (!utils.isErrnoException(e) || !['EACCES', 'EPERM'].includes(e.code ?? '')) {
+        throw e;
+      }
+      await makeDirectoriesWritable(dir);
+      await u.promises.rm(dir, RM_OPTIONS);
+    }
+    return true;
+  } catch (error) {
+    logger.logger.warn(`Bazel temporary directory could not be removed: ${dir}. ${utils.getErrorCause(error)}`);
+    return false;
+  }
+}
+async function makeDirectoriesWritable(root) {
+  const pending = [root];
+  while (pending.length) {
+    const directory = pending.pop();
+    if (!directory) {
+      continue;
+    }
+    try {
+      // Repository rules can unpack read-only directories. Keep links to user files untouched.
+      // eslint-disable-next-line no-await-in-loop
+      const stat = await u.promises.lstat(directory);
+      if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        continue;
+      }
+      // eslint-disable-next-line no-await-in-loop
+      await u.promises.chmod(directory, 0o700);
+      // eslint-disable-next-line no-await-in-loop
+      const entries = await u.promises.readdir(directory, {
+        withFileTypes: true
+      });
+      for (const entry of entries) {
+        if (entry.isDirectory() && !entry.isSymbolicLink()) {
+          pending.push(path.join(directory, entry.name));
+        }
+      }
+    } catch (e) {
+      if (!utils.isErrnoException(e) || e.code !== 'ENOENT') {
+        throw e;
+      }
+    }
+  }
+}
+const SHUTDOWN_TIMEOUT_MS = 10_000;
+const SERVER_EXIT_TIMEOUT_MS = 5_000;
+async function cleanUpBazelOutputRoot(root, contexts) {
+  // Ctrl-C aborts the scan's signal while the CLI keeps running, and cleanup must still run.
+  const signal = AbortSignal.timeout(3 * SHUTDOWN_TIMEOUT_MS);
+  let listed;
+  try {
+    listed = findServerPids(root);
+  } catch (e) {
+    logger.logger.warn(`Bazel output root kept because its servers could not be checked: ${root}. ${utils.getErrorCause(e)}`);
+  }
+  const servers = new Set(listed);
+  const shutDown = await Promise.all(Array.from(contexts.values(), opts => shutDownBazelServer(opts, signal)));
+  for (const pid of shutDown) {
+    if (pid !== undefined) {
+      servers.add(pid);
+    }
+  }
+  const stopped = await Promise.all(Array.from(servers, stopBazelServer));
+  if (!stopped.every(Boolean)) {
+    logger.logger.warn(`Bazel output root kept because its server is still running: ${root}`);
+    return false;
+  }
+  if (!listed) {
+    return false;
+  }
+  return await removeBazelTempdir(root);
+}
+
+// Returns the pid of a server this scan owns, read before shutdown removes its pid file.
+async function shutDownBazelServer(opts, signal) {
+  const root = opts.outputUserRoot;
+  if (!root) {
+    return undefined;
+  }
+  const startupFlags = buildBazelStartupFlags(opts);
+  const spawnOptions = {
+    cwd: opts.cwd,
+    ...(opts.env ? {
+      env: opts.env
+    } : {}),
+    signal,
+    timeout: SHUTDOWN_TIMEOUT_MS
+  };
+  let pid;
+  try {
+    // Only this scan can have started a server whose install or output base is in its fresh root.
+    // An rc file can point the scan at a caller's install and output base.
+    const info = await spawnBazel(opts.bin, [...startupFlags, 'info', 'install_base', 'output_base'], spawnOptions);
+    const bases = parseBazelInfo(info.stdout);
+    const outputBase = bases.get('output_base');
+    if (!outputBase || ![bases.get('install_base'), outputBase].some(dir => dir && isPathInside(dir, root))) {
+      return undefined;
+    }
+    pid = readServerPid(outputBase);
+    await spawnBazel(opts.bin, [...startupFlags, 'shutdown'], spawnOptions);
+  } catch (error) {
+    logger.logger.warn(`Bazel shutdown failed in ${opts.cwd}. ${utils.getErrorCause(error)}`);
+  }
+  return pid;
+}
+function findServerPids(root) {
+  if (!u.existsSync(root)) {
+    return [];
+  }
+  const pids = [];
+  for (const entry of u.readdirSync(root, {
+    withFileTypes: true
+  })) {
+    const pid = entry.isDirectory() ? readServerPid(path.join(root, entry.name)) : undefined;
+    if (pid !== undefined) {
+      pids.push(pid);
+    }
+  }
+  return pids;
+}
+function readServerPid(outputBase) {
+  let contents;
+  try {
+    contents = u.readFileSync(path.join(outputBase, 'server', 'server.pid.txt'), 'utf8');
+  } catch (e) {
+    if (utils.isErrnoException(e) && e.code === 'ENOENT') {
+      return undefined;
+    }
+    throw e;
+  }
+  const pid = Number(contents.trim());
+  return Number.isSafeInteger(pid) && pid > 0 && isProcessAlive(pid) ? pid : undefined;
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return utils.isErrnoException(e) && e.code === 'EPERM';
+  }
+}
+async function waitForProcessExit(pid) {
+  const deadline = Date.now() + SERVER_EXIT_TIMEOUT_MS;
+  while (isProcessAlive(pid)) {
+    if (Date.now() >= deadline) {
+      return false;
+    }
+    // eslint-disable-next-line no-await-in-loop
+    await require$$7.setTimeout(100);
+  }
+  return true;
+}
+
+// A shutdown that exits successfully can still leave the server running, for example with
+// `shutdown --iff_heap_size_greater_than` in an rc file.
+async function stopBazelServer(pid) {
+  if (await waitForProcessExit(pid)) {
+    return true;
+  }
+  try {
+    process.kill(pid, 'SIGKILL');
+  } catch (e) {
+    if (!utils.isErrnoException(e) || e.code !== 'ESRCH') {
+      logger.logger.warn(`Bazel server ${pid} could not be stopped. ${utils.getErrorCause(e)}`);
+      return false;
+    }
+  }
+  return await waitForProcessExit(pid);
+}
+function parseBazelInfo(stdout) {
+  const values = new Map();
+  for (const line of stdout.split(/\r?\n/)) {
+    const separator = line.indexOf(': ');
+    if (separator > 0) {
+      values.set(line.slice(0, separator), line.slice(separator + 2).trim());
+    }
+  }
+  return values;
+}
+function isPathInside(child, parent) {
+  const relative = path.relative(u.realpathSync.native(parent), u.realpathSync.native(child));
+  return relative !== '' && relative.split(path.sep)[0] !== '..' && !path.isAbsolute(relative);
+}
+
 // Default per-invocation timeout for bazel queries. Bazel cold-cache starts
 // can take several minutes; 10 minutes is generous while still bounding CI hangs.
 const BAZEL_QUERY_TIMEOUT_MS = 600_000;
 const STDERR_TAIL_BYTES = 4_096;
 const STDOUT_EXCERPT_BYTES = 1_024;
-
-// Splits the user-supplied --bazel-flags string on whitespace.
-// Empty / undefined returns []. No shell parsing — quoted args with embedded
-// whitespace are not supported (documented limitation; same trust model as
-// gradleOpts).
 function splitBazelFlags(flags) {
   if (!flags) {
     return [];
   }
-  return flags.split(/\s+/).filter(Boolean);
-}
-
-// Build the shared startup-flag prefix for any bazel invocation. Centralised
-// so `--output_user_root` propagates to every spawn — principle 7 of the
-// Maven design requires per-invocation server isolation across query,
-// cquery, and `bazel mod` commands alike.
-function buildStartupFlags(opts) {
-  const startup = [];
-  if (opts.bazelRc) {
-    startup.push(`--bazelrc=${opts.bazelRc}`);
+  const args = [];
+  let argument = '';
+  let quote;
+  let started = false;
+  for (let index = 0; index < flags.length; index += 1) {
+    const character = flags.charAt(index);
+    if (quote) {
+      if (character === quote) {
+        if (flags.charAt(index + 1) === quote) {
+          argument += quote;
+          index += 1;
+        } else {
+          quote = undefined;
+        }
+      } else {
+        argument += character;
+      }
+    } else if ((character === '"' || character === "'") && (!started || argument.endsWith('='))) {
+      quote = character;
+      started = true;
+    } else if (/\s/.test(character)) {
+      if (started) {
+        args.push(argument);
+        argument = '';
+        started = false;
+      }
+    } else {
+      argument += character;
+      started = true;
+    }
   }
-  if (opts.outputUserRoot) {
-    startup.push(`--output_user_root=${opts.outputUserRoot}`);
+  if (quote) {
+    throw new utils.InputError('--bazel-flags contains an unterminated quote. Close each quoted value. Backslashes are preserved literally.');
   }
-  if (opts.bazelOutputBase) {
-    startup.push(`--output_base=${opts.bazelOutputBase}`);
+  if (started) {
+    args.push(argument);
   }
-  return startup;
+  return args;
 }
 function buildBazelModShowVisibleReposArgv(opts) {
   const userFlags = splitBazelFlags(opts.bazelFlags);
-  return [...buildStartupFlags(opts), 'mod', 'dump_repo_mapping', '', '--output=json', ...userFlags];
+  return [...buildBazelStartupFlags(opts), 'mod', 'dump_repo_mapping', '', '--output=json', ...userFlags];
 }
 function buildBazelModShowMavenExtensionArgv(opts) {
   const userFlags = splitBazelFlags(opts.bazelFlags);
-  return [...buildStartupFlags(opts), 'mod', 'show_extension', '@rules_jvm_external//:extensions.bzl%maven',
+  return [...buildBazelStartupFlags(opts), 'mod', 'show_extension', '@rules_jvm_external//:extensions.bzl%maven',
   // A read-only scan must never rewrite the user's MODULE.bazel.lock; pin
   // the lockfile read-only before user flags, mirroring the query/cquery
   // argv builders.
@@ -4462,7 +4997,7 @@ function buildBazelModShowMavenExtensionArgv(opts) {
 }
 function buildBazelModShowPipExtensionArgv(opts) {
   const userFlags = splitBazelFlags(opts.bazelFlags);
-  return [...buildStartupFlags(opts), 'mod', 'show_extension', '@rules_python//python/extensions:pip.bzl%pip',
+  return [...buildBazelStartupFlags(opts), 'mod', 'show_extension', '@rules_python//python/extensions:pip.bzl%pip',
   // A read-only scan must never rewrite the user's MODULE.bazel.lock; pin
   // the lockfile read-only before user flags, mirroring the query/cquery
   // argv builders.
@@ -4474,7 +5009,7 @@ function buildBazelArgv(queryStr, opts, output = 'build') {
   // Keep query output stable and avoid updating Bazel lockfiles while extracting.
   const queryFlags = ['--lockfile_mode=off', '--noshow_progress'];
   const userFlags = splitBazelFlags(opts.bazelFlags);
-  return [...buildStartupFlags(opts), 'query', ...queryFlags, ...opts.invocationFlags, queryStr, `--output=${output}`, ...userFlags];
+  return [...buildBazelStartupFlags(opts), 'query', ...queryFlags, ...opts.invocationFlags, queryStr, `--output=${output}`, ...userFlags];
 }
 
 // Lightweight presence-check cquery used by the tri-state probe classifier.
@@ -4484,7 +5019,7 @@ function buildBazelArgv(queryStr, opts, output = 'build') {
 // `bazel-cquery.mts` needs but the probe does not).
 function buildBazelProbeCqueryArgv(repoName, opts) {
   const userFlags = splitBazelFlags(opts.bazelFlags);
-  return [...buildStartupFlags(opts), 'cquery', '--lockfile_mode=off', '--noshow_progress', ...opts.invocationFlags, `@${repoName}//...`, '--output=label', '--keep_going', ...userFlags];
+  return [...buildBazelStartupFlags(opts), 'cquery', '--lockfile_mode=off', '--noshow_progress', ...opts.invocationFlags, `@${repoName}//...`, '--output=label', '--keep_going', ...userFlags];
 }
 function stringField(value) {
   return typeof value === 'string' ? value : '';
@@ -4559,7 +5094,7 @@ async function runBazelQuery(queryStr, opts, output) {
   let result;
   try {
     spinner.start(`Running bazel query (${queryStr.slice(0, 80)})...`);
-    const output = await spawn.spawn(opts.bin, argv, {
+    const output = await spawnBazel(opts.bin, argv, {
       cwd: opts.cwd,
       timeout: BAZEL_QUERY_TIMEOUT_MS,
       ...(opts.env ? {
@@ -4605,7 +5140,7 @@ async function runBazelOneShot(argv, opts, step) {
   const startedAt = Date.now();
   let result;
   try {
-    const output = await spawn.spawn(opts.bin, argv, {
+    const output = await spawnBazel(opts.bin, argv, {
       cwd: opts.cwd,
       timeout: BAZEL_QUERY_TIMEOUT_MS,
       ...(opts.env ? {
@@ -4770,16 +5305,7 @@ function buildMetadataCqueryExpr(repoName) {
 // Build the full cquery argv for a per-repo metadata cquery. Exposed for
 // argv-shape unit tests without touching `spawn`.
 function buildMetadataCqueryArgv(repoName, opts) {
-  const startup = [];
-  if (opts.bazelRc) {
-    startup.push(`--bazelrc=${opts.bazelRc}`);
-  }
-  if (opts.outputUserRoot) {
-    startup.push(`--output_user_root=${opts.outputUserRoot}`);
-  }
-  if (opts.bazelOutputBase) {
-    startup.push(`--output_base=${opts.bazelOutputBase}`);
-  }
+  const startup = buildBazelStartupFlags(opts);
   const userFlags = splitBazelFlags(opts.bazelFlags);
   return [...startup, 'cquery', '--lockfile_mode=off', '--noshow_progress', ...opts.invocationFlags, buildMetadataCqueryExpr(repoName), '--output=jsonproto', '--proto:output_rule_attrs=tags,maven_coordinates,deps,exports,runtime_deps', '--keep_going', ...userFlags];
 }
@@ -5117,7 +5643,7 @@ async function runMetadataCqueryForRepo(args) {
   const argv = buildMetadataCqueryArgv(repoName, opts);
   const startedAt = Date.now();
   try {
-    const result = await spawn.spawn(opts.bin, argv, {
+    const result = await spawnBazel(opts.bin, argv, {
       cwd: workspaceRoot,
       timeout: timeoutMs,
       ...(opts.env ? {
@@ -5146,10 +5672,7 @@ async function runMetadataCqueryForRepo(args) {
     const err = e;
     const stdout = typeof err.stdout === 'string' ? err.stdout : '';
     const stderr = typeof err.stderr === 'string' ? err.stderr : '';
-    // On a `timeout`, the registry spawn kills the child, so Node sets
-    // `killed: true` and `signal: 'SIGTERM'` (or `SIGKILL`). There is no
-    // `timedOut` flag on the real rejection, so do not test for one.
-    const timedOut = err.killed === true || err.signal === 'SIGTERM' || err.signal === 'SIGKILL';
+    const timedOut = e instanceof BazelTimeoutError;
     const {
       artifacts,
       unresolvedLabels
@@ -5176,25 +5699,19 @@ async function runMetadataCqueryForRepo(args) {
   }
 }
 
-let probed = false;
-
-// Verifies `java` is functional in the current execution environment. Bazel
-// JVM manifest extraction (rules_jvm_external → Coursier) requires a real
-// JDK; the CLI does not attempt to discover Homebrew installs or mutate the
-// caller's PATH/JAVA_HOME. If `java -version` fails we throw with an
-// actionable message so the surfaced error names the prerequisite directly
-// instead of relying on Bazel's downstream diagnostic.
-function ensureJavaOnPath() {
-  if (probed) {
-    return;
-  }
+function ensureJavaOnPath(env, cwd) {
+  const javaHome = getBazelEnvironmentValue(env, 'JAVA_HOME');
+  const executable = process.platform === 'win32' ? 'java.exe' : 'java';
+  const java = javaHome ? path.resolve(cwd, javaHome, 'bin', executable) : executable;
   try {
-    childProcess.execSync('java -version', {
-      stdio: 'ignore'
+    childProcess.execFileSync(java, ['-version'], {
+      cwd,
+      env,
+      stdio: 'ignore',
+      timeout: 10_000
     });
-    probed = true;
   } catch {
-    throw new Error('Java is required for Bazel JVM manifest extraction ' + '(rules_jvm_external invokes Coursier, which needs a JDK). ' + 'Install a JDK (e.g. Temurin or OpenJDK) and ensure `java` is on PATH.');
+    throw new utils.InputError('Java is required for Bazel JVM manifest extraction. Install a JDK and ensure JAVA_HOME points to it or java is on PATH.');
   }
 }
 
@@ -5233,75 +5750,55 @@ function validateOutputBase(outputBase, cwd) {
   }
 }
 
-// Stable shim dir name — same process will get the same dir; concurrent
-// socket-cli invocations on the same machine share it. The symlink target
-// is whatever python3 resolves to NOW; if PATH changes between invocations
-// we replace the symlink.
-const SHIM_SUBDIR = 'socket-cli-bazel-python-shim';
-
-// Cache the result for the lifetime of this process.
-let cached = null;
-
-// Safe wrapper around whichBin that returns null instead of throwing when
-// nothrow semantics are broken in older registry versions (realpath 'null' bug).
-async function safeWhichBin(name) {
+function isPython3(executable, env, cwd) {
   try {
-    return (await bin.whichBin(name, {
-      nothrow: true
-    })) ?? null;
+    const version = childProcess.execFileSync(executable, ['-c', 'import sys\nprint(sys.version_info.major)'], {
+      cwd,
+      env,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 10_000
+    });
+    return version.trim() === '3';
   } catch {
-    return null;
+    // Windows application aliases can resolve without a working interpreter.
+    return false;
   }
 }
-async function provisionPythonShim() {
-  if (cached) {
-    return cached;
-  }
-  const pythonOnPath = await safeWhichBin('python');
-  if (pythonOnPath) {
-    cached = {
-      augmentedEnv: undefined,
-      shimDir: undefined
-    };
-    return cached;
-  }
-  const python3OnPath = await safeWhichBin('python3');
-  if (!python3OnPath) {
-    throw new utils.InputError('Neither `python` nor `python3` found on PATH. Older versions of ' + 'rules_jvm_external require a `python` interpreter for repository ' + 'rules. Install Python 3 and ensure it is on PATH, then retry.');
-  }
-  const shimDir = path.join(os.tmpdir(), SHIM_SUBDIR);
-  u.mkdirSync(shimDir, {
-    recursive: true
-  });
-  const linkPath = path.join(shimDir, 'python');
-  // Replace the symlink defensively in case python3's resolved path moved.
-  if (u.existsSync(linkPath)) {
-    try {
-      u.unlinkSync(linkPath);
-    } catch {
-      // Tolerate races; the next symlinkSync may still succeed.
+function notPython3Error(executable) {
+  return new utils.InputError(`Python 3 is required for Bazel manifest extraction. ${executable} did not run as Python 3. Install Python 3 and ensure python${process.platform === 'win32' ? '.exe' : ''} is on PATH.`);
+}
+async function provisionPythonShim(env, cwd) {
+  const python = await findBazelExecutable('python', env, cwd);
+  if (python) {
+    if (process.platform === 'win32' && path.extname(python).toLowerCase() !== '.exe') {
+      throw new utils.InputError('Bazel on Windows requires a working Python 3 python.exe on PATH. Python batch launchers are not supported.');
     }
-  }
-  // The shim dir is process-shared (os.tmpdir()/socket-cli-bazel-python-shim),
-  // so a concurrent socket-cli invocation may re-create the link between our
-  // unlinkSync and symlinkSync. Tolerate EEXIST when the link is back: the
-  // other process won the race and left a usable shim in place.
-  try {
-    u.symlinkSync(python3OnPath, linkPath);
-  } catch (e) {
-    if (e.code === 'EEXIST' && u.existsSync(linkPath)) ; else {
-      throw e;
+    if (isPython3(python, env, cwd)) {
+      return {
+        env,
+        shimDir: undefined
+      };
+    }
+    if (process.platform === 'win32') {
+      throw notPython3Error(python);
     }
+  } else if (process.platform === 'win32') {
+    throw new utils.InputError('Bazel on Windows requires a working Python 3 python.exe on PATH. Install Python 3 with the PATH option enabled, then retry.');
   }
-  const augmentedEnv = {
-    ...process.env,
-    PATH: `${shimDir}${path.delimiter}${process.env['PATH'] ?? ''}`
-  };
-  cached = {
-    augmentedEnv,
+  const python3 = await findBazelExecutable('python3', env, cwd);
+  if (!python3) {
+    throw python ? notPython3Error(python) : new utils.InputError('Neither python nor python3 was found on PATH. Install Python 3 and ensure it is on PATH, then retry.');
+  }
+  if (!isPython3(python3, env, cwd)) {
+    throw notPython3Error(python3);
+  }
+  const shimDir = u.mkdtempSync(path.join(os.tmpdir(), 'socket-bazel-python-'));
+  u.symlinkSync(python3, path.join(shimDir, 'python'));
+  return {
+    env: prependBazelPath(env, shimDir),
     shimDir
   };
-  return cached;
 }
 
 /**
@@ -5761,7 +6258,6 @@ function findWorkspaceRoots(opts) {
 // hard failure when nothing else was analyzable, and to a partial otherwise.
 
 const DEFAULT_PER_REPO_TIMEOUT_MS = 60_000;
-const REAP_TIMEOUT_MS = 10_000;
 
 // Machine-readable completeness signal emitted alongside the synthetic
 // manifests. A `complete: false` summary tells a downstream consumer (e.g.
@@ -6156,39 +6652,6 @@ async function discoverCandidatesForWorkspace(workspaceRoot, mode, queryOpts, ve
   };
 }
 
-// Best-effort reap of a Bazel server. Spawned with a short timeout so
-// a wedged server can't itself hang the cleanup; failures are swallowed
-// because the caller will `rm -rf` the output_user_root regardless.
-async function reapBazelServer(bin, outputUserRoot, verbose) {
-  try {
-    await spawn.spawn(bin, [`--output_user_root=${outputUserRoot}`, 'shutdown'], {
-      timeout: REAP_TIMEOUT_MS
-    });
-  } catch (e) {
-    // Server may already be dead, or shutdown itself timed out — the
-    // tempdir removal below is sufficient cleanup.
-    if (verbose) {
-      logger.logger.log(`[VERBOSE] reapBazelServer: shutdown failed for ${outputUserRoot} (${utils.getErrorCause(e)}); tempdir removal will still run`);
-    }
-  }
-}
-async function removeTempdir(dir, verbose) {
-  try {
-    await u.promises.rm(dir, {
-      recursive: true,
-      force: true
-    });
-  } catch (e) {
-    // Best effort. The next CLI invocation lands a fresh tempdir.
-    if (verbose) {
-      logger.logger.log(`[VERBOSE] removeTempdir: ${dir} not fully removed (${utils.getErrorCause(e)}); a stale dir may linger until the next OS tempdir sweep`);
-    }
-  }
-}
-function makeOutputUserRoot() {
-  return u.mkdtempSync(path.join(os.tmpdir(), 'socket-bazel-'));
-}
-
 // Construct the BazelQueryOptions shape used for a single workspace's
 // queries. Lifted to module scope (out of the per-workspace loop) so
 // ESLint's consistent-function-scoping is happy; takes everything it
@@ -6209,17 +6672,15 @@ function buildQueryOpts(args) {
     invocationFlags,
     outputUserRoot,
     ...(opts.bazelRc ? {
-      bazelRc: opts.bazelRc
+      bazelRc: path.resolve(opts.cwd, opts.bazelRc)
     } : {}),
     ...(opts.bazelFlags ? {
       bazelFlags: opts.bazelFlags
     } : {}),
     ...(opts.bazelOutputBase ? {
-      bazelOutputBase: opts.bazelOutputBase
-    } : {}),
-    ...(baseEnv ? {
-      env: baseEnv
+      bazelOutputBase: path.resolve(opts.cwd, opts.bazelOutputBase)
     } : {}),
+    env: baseEnv,
     verbose
   };
 }
@@ -6240,16 +6701,23 @@ async function extractBazelToMaven(opts) {
 
   // Validate config + ensure toolchains BEFORE we mint a tempdir.
   let bin;
-  let baseEnv;
+  let baseEnv = getBazelEnvironment(opts.env);
+  let pythonShimDir;
+  let outputUserRoot;
   try {
     if (opts.bazelOutputBase) {
       validateOutputBase(opts.bazelOutputBase, opts.cwd);
     }
-    ensureJavaOnPath();
-    const shim = await provisionPythonShim();
-    baseEnv = shim.augmentedEnv ?? opts.env;
-    bin = await resolveBazelBinary(opts.bin);
+    ensureJavaOnPath(baseEnv, cwd);
+    bin = await resolveBazelBinary(opts.bin, baseEnv, cwd);
+    const shim = await provisionPythonShim(baseEnv, cwd);
+    pythonShimDir = shim.shimDir;
+    baseEnv = shim.env;
+    outputUserRoot = makeBazelOutputUserRoot(baseEnv, cwd);
   } catch (e) {
+    if (pythonShimDir) {
+      await removeBazelTempdir(pythonShimDir);
+    }
     logger.logger.fail(`Unexpected error in bazel2maven: ${utils.getErrorCause(e)}`);
     if (verbose) {
       logger.logger.group('[VERBOSE] error:');
@@ -6268,8 +6736,7 @@ async function extractBazelToMaven(opts) {
 
   // Track every output_user_root we mint so we can reap them all in
   // the cleanup pass, even if a per-repo timeout forced a re-mint.
-  let outputUserRoot = makeOutputUserRoot();
-  const mintedRoots = [outputUserRoot];
+  const mintedRoots = new Map([[outputUserRoot, new Map()]]);
   if (verbose) {
     logger.logger.log(`[VERBOSE] initial --output_user_root=${outputUserRoot} (will be reaped on completion)`);
   }
@@ -6296,7 +6763,7 @@ async function extractBazelToMaven(opts) {
     // Always apply the default prune policy so no caller can forget it;
     // callers EXTEND it via ignoreDirNames/ignoreDirPrefixes.
     const ignoreDirNames = new Set([...DEFAULT_BAZEL_WALKER_IGNORE_DIR_NAMES, ...(opts.ignoreDirNames ?? [])]);
-    const ignoreDirPrefixes = [...DEFAULT_BAZEL_WALKER_IGNORE_DIR_PREFIXES, ...(opts.ignoreDirPrefixes ?? [])];
+    const ignoreDirPrefixes = [...DEFAULT_BAZEL_WALKER_IGNORE_DIR_PREFIXES, BAZEL_OUTPUT_ROOT_PREFIX, ...(opts.ignoreDirPrefixes ?? [])];
     const workspaceRoots = findWorkspaceRoots({
       cwd,
       ignoreDirNames,
@@ -6343,15 +6810,19 @@ async function extractBazelToMaven(opts) {
       }
       logger.logger.info(`Workspace ${relPath || '.'}: bzlmod=${mode.bzlmod} workspace=${mode.workspace}`);
       const invocationFlags = getBazelInvocationFlags(mode);
-      const queryOptsFor = userRoot => buildQueryOpts({
-        baseEnv,
-        bin,
-        invocationFlags,
-        opts,
-        outputUserRoot: userRoot,
-        spawnCwd: workspaceRoot,
-        verbose
-      });
+      const queryOptsFor = userRoot => {
+        const queryOpts = buildQueryOpts({
+          baseEnv,
+          bin,
+          invocationFlags,
+          opts,
+          outputUserRoot: userRoot,
+          spawnCwd: workspaceRoot,
+          verbose
+        });
+        mintedRoots.get(userRoot)?.set(workspaceRoot, queryOpts);
+        return queryOpts;
+      };
       const {
         candidates,
         discoveryIndeterminate,
@@ -6430,11 +6901,12 @@ async function extractBazelToMaven(opts) {
             state: 'failed'
           });
           // eslint-disable-next-line no-await-in-loop
-          await reapBazelServer(bin, outputUserRoot, verbose);
-          // eslint-disable-next-line no-await-in-loop
-          await removeTempdir(outputUserRoot, verbose);
-          outputUserRoot = makeOutputUserRoot();
-          mintedRoots.push(outputUserRoot);
+          const cleaned = await cleanUpBazelOutputRoot(outputUserRoot, mintedRoots.get(outputUserRoot) ?? new Map());
+          if (cleaned) {
+            mintedRoots.delete(outputUserRoot);
+          }
+          outputUserRoot = makeBazelOutputUserRoot(baseEnv, cwd);
+          mintedRoots.set(outputUserRoot, new Map());
           if (verbose) {
             logger.logger.log(`[VERBOSE] minted fresh --output_user_root=${outputUserRoot} after timeout`);
           }
@@ -6663,11 +7135,9 @@ async function extractBazelToMaven(opts) {
       workspaceOutcomes
     };
   } finally {
-    for (const dir of mintedRoots) {
-      // eslint-disable-next-line no-await-in-loop
-      await reapBazelServer(bin, dir, verbose);
-      // eslint-disable-next-line no-await-in-loop
-      await removeTempdir(dir, verbose);
+    await Promise.all(Array.from(mintedRoots, ([root, contexts]) => cleanUpBazelOutputRoot(root, contexts)));
+    if (pythonShimDir) {
+      await removeBazelTempdir(pythonShimDir);
     }
   }
 }
@@ -7806,6 +8276,7 @@ async function handleCi(autoManifest) {
     reach: {
       dynamicSbomInference: false,
       excludePaths: [],
+      reachAdvisories: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',
       reachConcurrency: 1,
@@ -9934,8 +10405,6 @@ async function outputFixResult(result, outputKind) {
   logger.logger.success('Finished!');
 }
 
-const GHSA_FORMAT_REGEXP = /^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/;
-const CVE_FORMAT_REGEXP = /^CVE-\d{4}-\d{4,}$/;
 /**
  * Converts mixed CVE/GHSA/PURL IDs to GHSA IDs only.
  * Filters out invalid IDs and logs conversion results.
@@ -9951,51 +10420,12 @@ async function convertIdsToGhsas(ids, options) {
   debug.debugDir('inspect', {
     ids
   });
-  const validGhsas = [];
-  const errors = [];
-  for (const id of ids) {
-    const trimmedId = id.trim();
-    if (trimmedId.startsWith('GHSA-')) {
-      // Already a GHSA ID, validate format
-      if (GHSA_FORMAT_REGEXP.test(trimmedId)) {
-        validGhsas.push(trimmedId);
-      } else {
-        errors.push(`Invalid GHSA format: ${trimmedId}`);
-      }
-    } else if (trimmedId.startsWith('CVE-')) {
-      // Convert CVE to GHSA
-      if (!CVE_FORMAT_REGEXP.test(trimmedId)) {
-        errors.push(`Invalid CVE format: ${trimmedId}`);
-        continue;
-      }
-
-      // eslint-disable-next-line no-await-in-loop
-      const conversionResult = await utils.convertCveToGhsa(trimmedId);
-      if (conversionResult.ok) {
-        validGhsas.push(conversionResult.data);
-        if (!silence) {
-          logger.logger.info(`Converted ${trimmedId} to ${conversionResult.data}`);
-        }
-      } else {
-        errors.push(`${trimmedId}: ${conversionResult.message}`);
-      }
-    } else if (trimmedId.startsWith('pkg:')) {
-      // Convert PURL to GHSAs.
-      // eslint-disable-next-line no-await-in-loop
-      const conversionResult = await utils.convertPurlToGhsas(trimmedId);
-      if (conversionResult.ok && conversionResult.data.length) {
-        validGhsas.push(...conversionResult.data);
-        if (!silence) {
-          logger.logger.info(`Converted ${trimmedId} to ${conversionResult.data.length} GHSA(s): ${arrays.joinAnd(conversionResult.data)}`);
-        }
-      } else {
-        errors.push(`${trimmedId}: ${conversionResult.message || 'No GHSAs found'}`);
-      }
-    } else {
-      // Neither CVE, GHSA, nor PURL, skip
-      errors.push(`Unsupported ID format (expected CVE, GHSA, or PURL): ${trimmedId}`);
-    }
-  }
+  const {
+    errors,
+    ghsas: validGhsas
+  } = await utils.resolveAdvisoryIds(ids, {
+    silence
+  });
   if (errors.length) {
     if (!silence) {
       logger.logger.warn(`Skipped ${errors.length} invalid IDs:\n${errors.map(e => `  - ${e}`).join('\n')}`);
@@ -10112,6 +10542,11 @@ const reachabilityFlags = {
     type: 'string',
     description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.COANA_CLI_VERSION}.`
   },
+  reachAdvisories: {
+    type: 'string',
+    isMultiple: true,
+    description: 'List of advisories to run reachability analysis for, as GHSA or CVE IDs, either as a comma separated value or as multiple flags. CVE IDs are converted to GHSA IDs through the GitHub API. Vulnerabilities from other advisories get unknown reachability. Defaults to all advisories.'
+  },
   reachAnalysisMemoryLimit: {
     type: 'string',
     default: '8192',
@@ -12262,14 +12697,20 @@ async function extractBazelToPypi(opts) {
     logger.logger.warn(`Warning: cwd does not exist: ${cwd}`);
   }
   logger.logger.groupEnd();
+  let pythonShimDir;
   try {
+    if (process.platform === 'win32') {
+      throw new utils.InputError('Bazel PyPI extraction on Windows is not supported yet. Platform-specific dependency selection still needs verification. Use --ecosystem maven for Windows SCA scans.');
+    }
     // Validate caller-provided Bazel filesystem settings before invoking Bazel.
     if (opts.bazelOutputBase) {
       validateOutputBase(opts.bazelOutputBase, opts.cwd);
     }
     // Python shim (for rules_python workspace discovery).
-    const shim = await provisionPythonShim();
-    const baseEnv = shim.augmentedEnv ?? opts.env;
+    const env = getBazelEnvironment(opts.env);
+    const shim = await provisionPythonShim(env, cwd);
+    pythonShimDir = shim.shimDir;
+    const baseEnv = shim.env;
 
     // Step 1: workspace detection.
     const mode = detectWorkspaceMode(cwd);
@@ -12277,7 +12718,7 @@ async function extractBazelToPypi(opts) {
     const invocationFlags = getBazelInvocationFlags(mode);
 
     // Step 2: bazel binary resolution.
-    const bin = await resolveBazelBinary(opts.bin);
+    const bin = await resolveBazelBinary(opts.bin, baseEnv, cwd);
     logger.logger.info(`Using bazel: ${bin}`);
     if (verbose) {
       logger.logger.log('[VERBOSE] resolved options:', {
@@ -12303,9 +12744,7 @@ async function extractBazelToPypi(opts) {
       ...(opts.bazelOutputBase ? {
         bazelOutputBase: opts.bazelOutputBase
       } : {}),
-      ...(baseEnv ? {
-        env: baseEnv
-      } : {}),
+      env: baseEnv,
       verbose
     };
 
@@ -12445,6 +12884,10 @@ async function extractBazelToPypi(opts) {
       artifactCount: 0,
       ok: false
     };
+  } finally {
+    if (pythonShimDir) {
+      await removeBazelTempdir(pythonShimDir);
+    }
   }
 }
 
@@ -12530,7 +12973,7 @@ const config$g = {
     },
     bazelFlags: {
       type: 'string',
-      description: 'Flags forwarded to every bazel invocation (single quoted string)'
+      description: 'Bazel command flags, with quoted values and literal backslashes'
     },
     bazelOutputBase: {
       type: 'string',
@@ -12577,6 +13020,20 @@ const config$g = {
     Note: this command generates dependency manifests for Bazel workspaces.
     It does not run reachability analysis.
 
+    Native Windows support currently covers Maven. Use PowerShell or
+    Command Prompt with a working Python 3 python.exe and a JDK on PATH.
+    PyPI extraction on Windows is not supported yet.
+
+    Set SOCKET_BAZEL_OUTPUT_ROOT to a short, writable parent directory,
+    such as C:/sb, to shorten connector-owned Bazel output paths. Each
+    invocation gets a separate directory. An explicit --bazel-output-base
+    takes precedence for Bazel's cache and is kept after the scan. The
+    scan only stops Bazel servers it started.
+
+    In --bazel-flags, single or double quotes at the start of a value or
+    after = group values containing spaces. Backslashes stay literal. Double a matching quote to include
+    it within a quoted value. Shell variables are not expanded.
+
     Maven hub discovery: under Bzlmod, hubs are enumerated from
     \`bazel mod show_extension\` and filtered to the root module's own hubs.
     Under legacy WORKSPACE mode (no \`show_extension\`), only conventionally
@@ -12725,7 +13182,9 @@ async function run$H(argv, importMeta, {
   let perRepoTimeout = cli.flags['perRepoTimeout'];
 
   // Set defaults for any flag/arg that is not given. Check socket.json first.
-  if (!bazel) {
+  if (bazel) {
+    bazel = path.resolve(process.cwd(), String(bazel));
+  } else {
     const defaultBazel = sockJson.defaults?.manifest?.bazel?.bazel ?? sockJson.defaults?.manifest?.bazel?.bin;
     if (defaultBazel) {
       bazel = defaultBazel;
@@ -12804,7 +13263,7 @@ async function run$H(argv, importMeta, {
     logger.logger.groupEnd();
   }
   if (dryRun) {
-    logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
+    logger.logger.log(constants.DRY_RUN_BAILING_NOW);
     return;
   }
 
@@ -13126,7 +13585,7 @@ async function run$F(argv, importMeta, {
 
 function renderTable(outcomes) {
   // A covered reactor member is implied by its parent's line above it.
-  return outcomes.filter(o => o.status !== 'skippedCovered').map(o => `- ${o.dir} (${o.ecosystem}): ${o.status}${o.factsPath ? ` -> ${o.factsPath}` : ''}`).join('\n');
+  return outcomes.filter(o => o.status !== 'skippedCovered').map(o => `- ${buildRootPath(o)} (${o.ecosystem}): ${o.status}${o.factsPath ? ` -> ${o.factsPath}` : ''}`).join('\n');
 }
 function summarize(outcomes) {
   const generated = outcomes.filter(o => o.status === 'generated').length;
@@ -14940,6 +15399,7 @@ async function enumerateWorkspaces({
   buildOpts,
   cwd,
   ecosystem,
+  entryFile,
   excludePaths,
   javaHome,
   verbose
@@ -14956,6 +15416,7 @@ async function enumerateWorkspaces({
   }
   const scriptOpts = {
     bin: bin || undefined,
+    entryFile,
     excludePaths: excludePaths?.length ? excludePaths : undefined,
     // `env` replaces the spawned process's whole environment, not just JAVA_HOME.
     env: resolvedJavaHome ? {
@@ -14990,8 +15451,8 @@ async function enumerateWorkspaces({
   };
 }
 
-// A single discovered build root - a directory with its own gradle/sbt/maven
-// marker file.
+// One prompt per directory, as settings are per directory; Maven may have
+// several POMs, so several roots, there.
 
 const ROOT_ECOSYSTEMS = ['maven', 'gradle', 'sbt'];
 const ECOSYSTEM_LABELS = {
@@ -15026,23 +15487,6 @@ function notCanceled$1() {
 function getEcosystemSection(sockJson, ecosystem) {
   return sockJson.defaults?.manifest?.[ecosystem] ?? {};
 }
-
-// Depth-then-path sort: for exclusion roots it's just stable log ordering;
-// for candidates it's load-bearing, since a parent must be prompted before
-// its children so a child's shown default reflects a parent's just-written
-// cascade instead of its pre-run value.
-function sortCandidatesForDisplay(candidates, cwd) {
-  return [...candidates].sort((a, b) => {
-    const relA = path.relative(cwd, a.dir);
-    const relB = path.relative(cwd, b.dir);
-    const depthA = relA.split(path.sep).length;
-    const depthB = relB.split(path.sep).length;
-    if (depthA !== depthB) {
-      return depthA - depthB;
-    }
-    return relA < relB ? -1 : relA > relB ? 1 : 0;
-  });
-}
 function toPosixRelative(cwd, dir) {
   return path.relative(cwd, dir).split(path.sep).join('/');
 }
@@ -15070,12 +15514,15 @@ async function scanBuildRoots({
   excludePaths,
   sockJson
 }) {
+  const socketConfig = utils.loadSocketConfig(cwd);
   const [fullByTool, includedByTool] = await Promise.all([findBuildToolCandidates({
     cwd,
+    socketConfig,
     sockJson
   }), findBuildToolCandidates({
     cwd,
     excludePaths,
+    socketConfig,
     sockJson
   })]);
   return {
@@ -15098,20 +15545,47 @@ async function discoverBuildRoots({
   const included = [];
   const ignorePatterns = (excludePaths ?? []).flatMap(excludePathToScanIgnores);
   const ecosystemsByRoot = new Map();
-  for (const [ecosystem, fullDirs] of fullByTool) {
-    const includedDirs = new Set(includedByTool.get(ecosystem) ?? []);
-    for (const dir of fullDirs) {
-      if (dir === realCwd) {
+  for (const [ecosystem, fullRoots] of fullByTool) {
+    const includedPaths = new Set((includedByTool.get(ecosystem) ?? []).map(buildRootPath));
+    const rootsByDir = new Map();
+    for (const root of fullRoots) {
+      if (root.dir === realCwd) {
         continue;
       }
-      if (includedDirs.has(dir)) {
+      const roots = rootsByDir.get(root.dir);
+      if (roots) {
+        roots.push(root);
+      } else {
+        rootsByDir.set(root.dir, [root]);
+      }
+    }
+    for (const {
+      0: dir,
+      1: roots
+    } of rootsByDir) {
+      const relDir = toPosixRelative(realCwd, dir);
+      const includedRoots = [];
+      const excludedRoots = [];
+      for (const root of roots) {
+        if (includedPaths.has(buildRootPath(root))) {
+          includedRoots.push(root);
+        } else {
+          excludedRoots.push(root);
+        }
+      }
+      if (includedRoots.length) {
         included.push({
           dir,
-          ecosystem
+          ecosystem,
+          roots: includedRoots
         });
+        // `disabled` is per directory, so it cannot exclude one build file
+        // without its included siblings.
+        for (const root of excludedRoots) {
+          logger.logger.warn(`Not disabling ${ecosystem} in ${relDir}: --exclude-paths matches ${buildRootPath(root)} but not the other build files there. Pass the same --exclude-paths to the scan instead.`);
+        }
         continue;
       }
-      const relDir = toPosixRelative(realCwd, dir);
       const rootRelDir = findExclusionRoot(relDir, ignorePatterns);
       const rootDir = path.join(realCwd, rootRelDir);
       const ecosystems = ecosystemsByRoot.get(rootDir) ?? new Set();
@@ -15129,48 +15603,65 @@ async function discoverBuildRoots({
 }
 
 // Fails closed: without the members' build files, covered and independent
-// candidates can't be told apart.
+// candidates can't be told apart. In order, as a root's enumeration can cover
+// the roots after it.
 async function markWorkspaceCoverage({
-  candidate,
   covered,
   cwd,
+  dir,
+  ecosystem,
   excludePaths,
-  rootSockJson
+  rootSockJson,
+  roots
 }) {
-  const cascade = utils.readSocketJsonCascade(candidate.dir, cwd, rootSockJson);
+  if (roots.every(root => isBuildRootCovered(covered, ecosystem, root))) {
+    return {
+      ok: true,
+      data: undefined
+    };
+  }
+  const cascade = utils.readSocketJsonCascade(dir, cwd, rootSockJson);
   const {
     bin,
     buildOpts,
     javaHome,
     skipReason
-  } = resolveEcosystemConfig(candidate.ecosystem, candidate.dir, cascade);
+  } = resolveEcosystemConfig(ecosystem, dir, cascade);
   if (skipReason) {
     return {
       ok: true,
       data: undefined
     };
   }
-  const excludePathsForCandidate = projectIgnorePathsToReachExcludePaths(excludePaths, {
+  const excludePathsForDir = projectIgnorePathsToReachExcludePaths(excludePaths, {
     cwd,
-    target: candidate.dir
+    target: dir
   });
-  const enumResult = await enumerateWorkspaces({
-    bin,
-    buildOpts,
-    cwd: candidate.dir,
-    ecosystem: candidate.ecosystem,
-    excludePaths: excludePathsForCandidate,
-    javaHome,
-    verbose: false
-  });
-  if (!enumResult) {
-    const relDir = path.relative(cwd, candidate.dir) || '.';
-    return {
-      ok: false,
-      message: `Could not determine ${candidate.ecosystem} workspace layout for ${relDir}; aborting rather than risk misclassifying its members.`
-    };
+  for (const root of roots) {
+    if (isBuildRootCovered(covered, ecosystem, root)) {
+      continue;
+    }
+    // eslint-disable-next-line no-await-in-loop
+    const enumResult = await enumerateWorkspaces({
+      bin,
+      buildOpts,
+      cwd: dir,
+      ecosystem,
+      entryFile: root.entryFile,
+      excludePaths: excludePathsForDir,
+      javaHome,
+      verbose: false
+    });
+    if (!enumResult) {
+      const relRoot = path.relative(cwd, buildRootPath(root)) || '.';
+      return {
+        ok: false,
+        message: `Could not determine ${ecosystem} workspace layout for ${relRoot}; aborting rather than risk misclassifying its members.`
+      };
+    }
+    // eslint-disable-next-line no-await-in-loop
+    await addCoveredBuildFiles(covered, enumResult.buildRoot, enumResult.projects);
   }
-  await addCoveredBuildFiles(covered, enumResult.buildRoot, enumResult.projects);
   return {
     ok: true,
     data: undefined
@@ -15580,7 +16071,7 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
   logger.logger.log('');
   logger.logger.log(`Configuring ${cwd} ...`);
   const initialSockJson = utils.readOrDefaultSocketJson(cwd);
-  // Resolved once here for sortCandidatesForDisplay/disableExclusionRoot's
+  // Resolved once here for sortByDepthThenPath/disableExclusionRoot's
   // relative-path math, consistent with discoverBuildRoots' own internal
   // resolution (see its comment for why this matters).
   const realCwd = await utils.realpathOrResolved(cwd);
@@ -15619,7 +16110,7 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
 
   // Which detected ecosystems cwd is itself a build root for - see
   // setupRecursiveRootDefaults' wording split.
-  const ecosystemsAtCwd = ROOT_ECOSYSTEMS.filter(ecosystem => (fullByTool.get(ecosystem) ?? []).includes(realCwd));
+  const ecosystemsAtCwd = ROOT_ECOSYSTEMS.filter(ecosystem => (fullByTool.get(ecosystem) ?? []).some(root => root.dir === realCwd));
   const rootResult = await setupRecursiveRootDefaults(cwd, defaultOnReadError, detectedEcosystems, ecosystemsAtCwd);
   if (!rootResult.ok) {
     return rootResult;
@@ -15646,7 +16137,7 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
     if (!excluded.length) {
       logger.logger.log('None matched --exclude-paths; nothing disabled.');
     } else {
-      const orderedExcluded = sortCandidatesForDisplay(excluded, realCwd);
+      const orderedExcluded = sortByDepthThenPath(excluded, realCwd);
       for (const candidate of orderedExcluded) {
         // eslint-disable-next-line no-await-in-loop
         const result = await disableExclusionRoot({
@@ -15684,17 +16175,16 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
   // cwd never appears in `included`, but a reactor root often sits exactly
   // at cwd - seed coverage from it first so its declared members still get
   // recognized.
-  for (const ecosystem of ecosystemsAtCwd) {
+  for (const ecosystem of ROOT_ECOSYSTEMS) {
     // eslint-disable-next-line no-await-in-loop
     const coverageResult = await markWorkspaceCoverage({
-      candidate: {
-        dir: realCwd,
-        ecosystem
-      },
       covered,
       cwd: realCwd,
+      dir: realCwd,
+      ecosystem,
       excludePaths,
-      rootSockJson
+      rootSockJson,
+      roots: (includedByTool.get(ecosystem) ?? []).filter(root => root.dir === realCwd)
     });
     if (!coverageResult.ok) {
       return coverageResult;
@@ -15707,9 +16197,14 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
     reenabled: 0,
     skipped: 0
   };
-  const orderedIncluded = sortCandidatesForDisplay(included, realCwd);
+  // A parent is prompted before its children, so a child's shown default
+  // reflects the parent's just-written cascade.
+  const orderedIncluded = sortByDepthThenPath(included, realCwd);
   for (const candidate of orderedIncluded) {
-    if (isBuildRootCovered(covered, candidate.ecosystem, candidate.dir)) {
+    const {
+      ecosystem
+    } = candidate;
+    if (candidate.roots.every(root => isBuildRootCovered(covered, ecosystem, root))) {
       counts.covered += 1;
       continue;
     }
@@ -15718,7 +16213,7 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
     const result = await processCandidate({
       cwd: realCwd,
       dir: candidate.dir,
-      ecosystem: candidate.ecosystem,
+      ecosystem,
       rootSockJson
     });
     if (!result.ok) {
@@ -15745,11 +16240,13 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
     // build-tool invocation only runs for a project already prompted about.
     // eslint-disable-next-line no-await-in-loop
     const coverageResult = await markWorkspaceCoverage({
-      candidate,
       covered,
       cwd: realCwd,
+      dir: candidate.dir,
+      ecosystem,
       excludePaths,
-      rootSockJson
+      rootSockJson,
+      roots: candidate.roots
     });
     if (!coverageResult.ok) {
       return coverageResult;
@@ -20058,6 +20555,37 @@ function resolveUvMemberDirs(targets, cwd) {
   return Array.from(memberDirs);
 }
 
+// GitHub publishes GHSA IDs with a lowercase body and CVE IDs uppercase.
+function normalizeAdvisoryId(id) {
+  const trimmed = id.trim();
+  return /^ghsa-/i.test(trimmed) ? `GHSA-${trimmed.slice(5).toLowerCase()}` : trimmed.toUpperCase();
+}
+
+/**
+ * Resolves the --reach-advisories IDs to GHSA IDs, converting CVE IDs through
+ * the GitHub API. Any ID that cannot be resolved fails the command, since
+ * dropping it would leave that advisory without reachability analysis.
+ */
+async function resolveReachAdvisories(ids) {
+  const normalizedIds = arrays.arrayUnique(ids.map(normalizeAdvisoryId));
+  // Checked up front so PURLs never reach resolveAdvisoryIds and a typo fails
+  // before any GitHub lookup.
+  const invalidIds = normalizedIds.filter(id => !utils.GHSA_FORMAT_REGEXP.test(id) && !utils.CVE_FORMAT_REGEXP.test(id));
+  if (invalidIds.length) {
+    throw new utils.InputError(`Invalid --reach-advisories IDs: ${invalidIds.join(', ')}. Use GHSA IDs (GHSA-xxxx-xxxx-xxxx) or CVE IDs (CVE-YYYY-NNNN).`);
+  }
+  const {
+    errors,
+    ghsas
+  } = await utils.resolveAdvisoryIds(normalizedIds, {
+    silence: true
+  });
+  if (errors.length) {
+    throw new utils.InputError(`Could not resolve --reach-advisories IDs to GHSA IDs:\n${errors.map(e => `  - ${e}`).join('\n')}`);
+  }
+  return arrays.arrayUnique(ghsas);
+}
+
 async function suggestTarget() {
   // We could prefill this with sub-dirs of the current
   // dir ... but is that going to be useful?
@@ -20487,8 +21015,10 @@ async function run$d(argv, importMeta, {
   const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
   assertValidExcludePaths(excludePaths);
   const reachExcludePaths = utils.cmdFlagValueToArray(cli.flags['reachExcludePaths']);
+  const reachAdvisoriesRaw = utils.cmdFlagValueToArray(cli.flags['reachAdvisories']);
 
   // Validation helpers for better readability.
+  const hasReachAdvisories = reachAdvisoriesRaw.length > 0;
   const hasReachEcosystems = reachEcosystems.length > 0;
   const hasReachExcludePaths = reachExcludePaths.length > 0;
 
@@ -20506,7 +21036,7 @@ async function run$d(argv, importMeta, {
   // added flags require --reach automatically instead of relying on a
   // hand-maintained list. Deprecated no-ops are excluded on purpose.
   const isUsingAnyBooleanReachFlag = Object.entries(reachabilityFlags).some(([name, flag]) => flag.type === 'boolean' && !DEPRECATED_NO_OP_REACH_FLAGS.has(name) && cli.flags[name] !== flag.default);
-  const isUsingAnyReachabilityFlags = hasReachEcosystems || hasReachExcludePaths || isUsingAnyBooleanReachFlag || isUsingNonDefaultConcurrency || isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultVersion;
+  const isUsingAnyReachabilityFlags = hasReachAdvisories || hasReachEcosystems || hasReachExcludePaths || isUsingAnyBooleanReachFlag || isUsingNonDefaultConcurrency || isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultVersion;
 
   // Validate target constraints when --reach is enabled.
   const reachTargetValidation = reach ? await validateReachabilityTarget(targets, cwd) : {
@@ -20583,6 +21113,7 @@ async function run$d(argv, importMeta, {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
+  const reachAdvisories = await resolveReachAdvisories(reachAdvisoriesRaw);
   await handleCreateNewScan({
     autoManifest: Boolean(autoManifest),
     branchName: branchName,
@@ -20600,6 +21131,7 @@ async function run$d(argv, importMeta, {
     reach: {
       dynamicSbomInference: Boolean(dynamicSbomInference),
       excludePaths,
+      reachAdvisories,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
       reachConcurrency: Number(reachConcurrency),
@@ -21318,6 +21850,7 @@ async function scanOneRepo(repoSlug, {
     reach: {
       dynamicSbomInference: false,
       excludePaths: [],
+      reachAdvisories: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',
       reachConcurrency: 1,
@@ -22746,6 +23279,7 @@ async function run$7(argv, importMeta, {
 
   // Process comma-separated values for isMultiple flags.
   const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  const reachAdvisoriesRaw = utils.cmdFlagValueToArray(cli.flags['reachAdvisories']);
   const reachEcosystemsRaw = utils.cmdFlagValueToArray(cli.flags['reachEcosystems']);
   const reachExcludePaths = utils.cmdFlagValueToArray(cli.flags['reachExcludePaths']);
   assertValidExcludePaths(excludePaths);
@@ -22818,6 +23352,7 @@ async function run$7(argv, importMeta, {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
+  const reachAdvisories = await resolveReachAdvisories(reachAdvisoriesRaw);
   await handleScanReach({
     cwd,
     interactive,
@@ -22827,6 +23362,7 @@ async function run$7(argv, importMeta, {
     reachabilityOptions: {
       dynamicSbomInference: Boolean(dynamicSbomInference),
       excludePaths,
+      reachAdvisories,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
       reachConcurrency: Number(reachConcurrency),
@@ -24791,5 +25327,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=3195b2a9-2bce-44ed-8eea-bd5e763d40fa
+//# debugId=b77ced41-382f-4a5e-a03f-154a33fa6ec
 //# sourceMappingURL=cli.js.map