@socketsecurity/cli-with-sentry 1.6.1 → 1.7.0

package/dist/cli.js

@@ -1814,28 +1814,9 @@ function reachMemoryLimitToMb(value) {
   return match[2]?.toLowerCase() === 'gb' ? amount * 1024 : amount;
 }
 
-// No sources/targets here: those are local absolute paths, returned in-memory
-// as ResolvedArtifactPaths, never serialized into the SBOM.
-
-// Relative to the facts file's directory.
-
-// Resolved on-disk paths for a --with-files run, keyed by coordinate. `targets`
-// = classpath entries (jars / module output dirs); `sources` = module source
-// roots.
-
-function projectClasspathKey(project) {
-  return `${project.subprojectDir} ${project.namespace ?? ''}:${project.name}`;
-}
-
-// Coordinate-based (not `id`-based) so it also matches foreign SBOMs like
-// CycloneDX. Empty segments dropped.
-function mavenCoordinateKey(groupId, artifactId, type, classifier, version) {
-  return [groupId, artifactId, type, classifier, version].filter(Boolean).join(':');
-}
-
 // Frozen contract with `coana run --compute-artifacts-sidecar`; change only
 // in sync with the coana consumer. Keyed by the absolute path of the
-// `.socket.facts.json` file whose own projects[]/components[] these entries
+// `*.socket.facts.json` file whose own projects[]/components[] these entries
 // describe - the key IS the scope, so two independent reactors that happen to
 // emit the same purl identity (e.g. a shared internal module name) can never
 // collide: each is only ever looked up within its own key. No cross-reactor
@@ -1843,24 +1824,13 @@ function mavenCoordinateKey(groupId, artifactId, type, classifier, version) {
 // independent reactors is intentionally duplicated across all of their
 // components[].
 
-// `targets`/`sources` present (possibly `[]`) means resolution was attempted
-// for this coordinate - an empty array is a successful resolve that found
-// nothing (e.g. a pom/BOM with no artifact), not a failure. Both fields
-// omitted (undefined) means resolution couldn't even be attempted - the only
-// case here is a degenerate entry with no computable coordinate at all, since
-// every entry reaching this function already came from a resolved graph node
-// (an unresolved dependency lives in the resolution report, not here).
+// `[]` means resolved and found nothing (e.g. a pom/BOM with no artifact).
 function attachPaths(entry, artifactPaths) {
-  const coordKey = mavenCoordinateKey(entry.namespace, entry.name, entry.qualifiers?.['ext'], entry.qualifiers?.['classifier'], entry.version);
-  if (!coordKey) {
-    return {
-      ...entry
-    };
-  }
+  const paths = artifactPaths.pathsById.get(entry.id);
   return {
     ...entry,
-    targets: [...(artifactPaths.targetsByCoord.get(coordKey) ?? [])].sort(),
-    sources: [...(artifactPaths.sourcesByCoord.get(coordKey) ?? [])].sort()
+    targets: [...(paths?.targets ?? [])],
+    sources: [...(paths?.sources ?? [])]
   };
 }
 function purlSortKey(entry) {
@@ -1877,9 +1847,8 @@ function sortByPurl(entries) {
 // Emit an entry for every SBOM component AND every first-party project: a
 // top-level module is a project, not a dependency component, yet its source
 // roots are where reachability starts, so the sidecar must carry them.
-// A second call for the same factsFile (a dual-marker directory where two
-// build tools both target it) overwrites rather than merges, matching the
-// existing last-writer-wins convention for that case.
+// Every build writes its own facts file, so a key is accumulated once; a
+// repeated call for the same factsFile (the same build run again) overwrites.
 function accumulateSidecar(acc, facts, artifactPaths, factsFile,
 // Off when artifact paths were not resolved; entries then omit `targets` and `sources`.
 withPaths = true) {
@@ -1890,7 +1859,7 @@ withPaths = true) {
     components: facts.components.map(paths),
     projects: (facts.projects ?? []).map(proj => ({
       ...paths(proj),
-      classpath: [...(artifactPaths.classpathByProject.get(projectClasspathKey(proj)) ?? [])]
+      classpath: [...(artifactPaths.classpathByProject.get(proj.id) ?? [])]
     }))
   });
 }
@@ -1986,15 +1955,13 @@ async function performReachabilityAnalysis(options) {
   }
   const sockSdk = sockSdkCResult.data;
   spinner?.start('Uploading manifests for reachability analysis...');
+  const outputFilePath = outputPath || constants.default.DOT_SOCKET_DOT_FACTS_JSON;
 
   // Ensure uploaded manifest files are relative to analysis target as coana resolves SBOM manifest files relative to this path
-  // NOTE: previously stripped any `.socket.facts.json` from packagePaths
-  // here to avoid uploading leftover post-reachability output. With the
-  // producer flow (`socket manifest gradle --facts`) those files are
-  // legitimate INPUT to compute-artifacts, so we now upload them. Stale
-  // facts files are cleaned up downstream — see the post-success
-  // deletion in handle-create-new-scan.mts.
-  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths, {
+  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths.filter(p => !utils.isReachabilityReportPath(p, {
+    cwd,
+    outputPath: outputFilePath
+  })), {
     pathsRelativeTo: path.resolve(cwd, analysisTarget)
   }), {
     description: 'upload manifests',
@@ -2022,7 +1989,6 @@ async function performReachabilityAnalysis(options) {
   spinner?.success(`Manifests uploaded successfully. Tar hash: ${tarHash}`);
   spinner?.start();
   spinner?.infoAndStop('Running reachability analysis with Coana...');
-  const outputFilePath = outputPath || constants.default.DOT_SOCKET_DOT_FACTS_JSON;
 
   // Temp file for --compute-artifacts-sidecar, removed in the finally below.
   // Written even when empty under dynamicSbomInference, since the
@@ -2313,6 +2279,15 @@ const BUILD_TOOL_WRAPPER = {
   maven: 'mvnw'
 };
 
+// Gradle (8+) and sbt hold one build per directory; Maven builds are addressed
+// by POM file, so `mvn -f other-pom.xml` puts a second build in the directory.
+const ADDRESSED_BY_FILE = {
+  __proto__: null,
+  gradle: false,
+  maven: true,
+  sbt: false
+};
+
 // sbt happily runs in any directory, synthesizing a default project from its
 // name, so an sbt run outside a build yields a plausible but bogus SBOM. Maven
 // and Gradle refuse such a directory themselves.
@@ -2330,6 +2305,14 @@ function resolveBuildToolBin(tool, projectDir, bin) {
   return DEFAULT_BUILD_TOOL_BIN[tool];
 }
 
+// Distinct for every build sharing a directory.
+function socketFactsFileName(tool, entryFile) {
+  if (!ADDRESSED_BY_FILE[tool]) {
+    return `${tool}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}`;
+  }
+  return entryFile ? `${path.basename(entryFile)}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}` : undefined;
+}
+
 // Gradle's variant-aware resolver: distinct exceptions give mutually-exclusive
 // phrasing, so most-specific-first substring checks classify reliably.
 function classifyGradleFailure(detail) {
@@ -2687,19 +2670,15 @@ function renderResolutionErrorReport(failures, scannedConfigs = [], tool = 'grad
 }
 
 const PURL_TYPE_MAVEN = 'maven';
-function assembleFacts(parsed, opts = {}) {
+function assembleFacts(parsed, opts) {
   const fileExists = opts.fileExists ?? fs$1.existsSync;
   const perRoot = buildPerRoot(parsed);
   const {
     directByRoot,
     finalNodes
-  } = mergeByCoordinate(perRoot);
+  } = mergeById(perRoot);
   const tool = parsed.tool || 'gradle';
-  const projectsByGav = new Map();
-  for (const p of parsed.projects.values()) {
-    projectsByGav.set(gav(p.group, p.name, p.version), p);
-  }
-  const components = buildComponents(finalNodes, projectsByGav, buildManifestFilesByCoord(parsed, directByRoot, perRoot));
+  const components = buildComponents(finalNodes, buildManifestFilesById(parsed, directByRoot, perRoot, opts.factsFileName));
   const projects = opts.emitProjects === false ? [] : buildProjects(parsed, directByRoot, perRoot);
   const metadata = {
     format: 'socket-facts-sbom',
@@ -2720,35 +2699,50 @@ function assembleFacts(parsed, opts = {}) {
   return {
     facts,
     report: buildReport(parsed),
-    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], projectsByGav, perRoot, fileExists)
+    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], perRoot, fileExists)
   };
 }
-function gav(group, name, version) {
-  return `${group}:${name}:${version}`;
+
+// A node resolving to a build project takes that project's id, so projects
+// sharing a coordinate stay apart and the project's variants collapse into it.
+function componentId(coordId, project) {
+  return project || coordId;
 }
 function buildPerRoot(parsed) {
   const out = new Map();
   for (const [rootId, r] of parsed.roots) {
-    const childrenByParent = new Map();
+    const idOf = coordId => componentId(coordId, r.nodes.get(coordId)?.project ?? '');
+    const nodes = new Map();
+    for (const [coordId, n] of r.nodes) {
+      const id = idOf(coordId);
+      let node = nodes.get(id);
+      if (!node) {
+        node = {
+          coord: n.project ? {
+            ...n.coord,
+            classifier: '',
+            ext: ''
+          } : n.coord,
+          children: [],
+          direct: false,
+          project: n.project,
+          targets: []
+        };
+        nodes.set(id, node);
+      }
+      node.direct ||= n.direct;
+      node.targets.push(...n.targets);
+    }
     for (const [p, c] of r.edges) {
       if (!r.nodes.has(p) || !r.nodes.has(c)) {
         continue;
       }
-      let set = childrenByParent.get(p);
-      if (!set) {
-        set = new Set();
-        childrenByParent.set(p, set);
+      const parentId = idOf(p);
+      const childId = idOf(c);
+      const parent = nodes.get(parentId);
+      if (childId !== parentId && !parent.children.includes(childId)) {
+        parent.children.push(childId);
       }
-      set.add(c);
-    }
-    const nodes = new Map();
-    for (const [coordId, n] of r.nodes) {
-      nodes.set(coordId, {
-        coord: n.coord,
-        children: [...(childrenByParent.get(coordId) ?? [])],
-        direct: n.direct,
-        targets: n.targets
-      });
     }
     out.set(rootId, {
       projectKey: r.projectKey,
@@ -2759,10 +2753,10 @@ function buildPerRoot(parsed) {
   return out;
 }
 
-// Components are merged by coordinate across every resolution root; which
-// coordinates belong to which subproject is kept separately (classpathByProject)
-// for reachability, which needs each subproject's exact classpath.
-function mergeByCoordinate(perRoot) {
+// Components are merged by id across every resolution root; which ids belong
+// to which subproject is kept separately (classpathByProject) for
+// reachability, which needs each subproject's exact classpath.
+function mergeById(perRoot) {
   const finalNodes = new Map();
   const directByRoot = new Map();
   for (const [rootId, {
@@ -2777,6 +2771,7 @@ function mergeByCoordinate(perRoot) {
           children: new Set(),
           prod: false,
           direct: false,
+          project: node.project,
           targets: new Set()
         };
         finalNodes.set(coordId, fn);
@@ -2808,18 +2803,23 @@ function mergeByCoordinate(perRoot) {
     directByRoot
   };
 }
-function buildManifestFilesByCoord(parsed, directByRoot, perRoot) {
+function buildManifestFilesById(parsed, directByRoot, perRoot, factsFileName) {
   const buildFilesByCoord = new Map();
   for (const [rootId, ids] of directByRoot) {
-    const projectKey = perRoot.get(rootId)?.projectKey ?? '';
-    const buildFiles = parsed.projects.get(projectKey)?.buildFiles ?? [];
+    const root = perRoot.get(rootId);
+    const project = parsed.projects.get(root?.projectKey ?? '');
     for (const id of ids) {
       let set = buildFilesByCoord.get(id);
       if (!set) {
         set = new Set();
         buildFilesByCoord.set(id, set);
       }
-      for (const f of buildFiles) {
+      const coord = root?.nodes.get(id)?.coord;
+      // Without a known declaring script, the project's build file, even one
+      // absent on disk: its presence marks the dependency direct here.
+      const declared = coord && project?.declaredIn.get(`${coord.group}:${coord.name}`);
+      const files = declared ?? [...(project?.buildFiles ?? []), ...(project?.missingBuildFiles ?? [])];
+      for (const f of files) {
         set.add(f);
       }
     }
@@ -2827,11 +2827,11 @@ function buildManifestFilesByCoord(parsed, directByRoot, perRoot) {
   return new Map([...buildFilesByCoord].map(({
     0: id,
     1: buildFiles
-  }) => [id, [constants.default.DOT_SOCKET_DOT_FACTS_JSON, ...[...buildFiles].sort()].map(file => ({
+  }) => [id, [...(factsFileName ? [factsFileName] : []), ...[...buildFiles].sort()].map(file => ({
     file
   }))]));
 }
-function buildComponents(finalNodes, projectsByGav, manifestFilesByCoord) {
+function buildComponents(finalNodes, manifestFilesById) {
   return [...finalNodes.keys()].sort().map(id => {
     const fn = finalNodes.get(id);
     const c = fn.coord;
@@ -2862,13 +2862,13 @@ function buildComponents(finalNodes, projectsByGav, manifestFilesByCoord) {
     if (!fn.prod) {
       comp.dev = true;
     }
-    if (projectsByGav.has(gav(c.group, c.name, c.version ?? ''))) {
+    if (fn.project) {
       comp.firstParty = true;
     }
     if (fn.children.size) {
       comp.dependencies = [...fn.children].sort();
     }
-    const manifestFiles = manifestFilesByCoord.get(id);
+    const manifestFiles = manifestFilesById.get(id);
     if (manifestFiles) {
       comp.manifestFiles = manifestFiles;
     }
@@ -2890,6 +2890,7 @@ function buildProjects(parsed, directByRoot, perRoot) {
   }
   const projects = [...parsed.projects.values()].map(p => {
     const entry = {
+      id: p.projectKey,
       type: PURL_TYPE_MAVEN,
       namespace: p.group,
       name: p.name,
@@ -2899,6 +2900,15 @@ function buildProjects(parsed, directByRoot, perRoot) {
       subprojectDir: p.dir,
       dependencies: [...(directByProject.get(p.projectKey) ?? [])].sort()
     };
+    // A project without a build file of its own is defined by the scripts
+    // declaring its dependencies, e.g. the root build script.
+    const declared = [...new Set([...p.declaredIn.values()].flat())];
+    const files = p.buildFiles.length ? p.buildFiles : declared.length ? declared : p.missingBuildFiles;
+    if (files.length) {
+      entry.manifestFiles = [...files].sort().map(file => ({
+        file
+      }));
+    }
     return entry;
   });
   projects.sort((a, b) => {
@@ -2908,21 +2918,6 @@ function buildProjects(parsed, directByRoot, perRoot) {
   });
   return projects;
 }
-function unionInto(map, key, add) {
-  if (!add.length) {
-    return;
-  }
-  const acc = map.get(key);
-  if (acc) {
-    for (const f of add) {
-      if (!acc.includes(f)) {
-        acc.push(f);
-      }
-    }
-  } else {
-    map.set(key, [...add]);
-  }
-}
 function buildClasspathByProject(projects, perRoot) {
   const idsByProjectKey = new Map();
   for (const {
@@ -2940,11 +2935,7 @@ function buildClasspathByProject(projects, perRoot) {
   }
   const classpathByProject = new Map();
   for (const p of projects) {
-    const key = projectClasspathKey({
-      name: p.name,
-      namespace: p.group,
-      subprojectDir: p.dir
-    });
+    const key = p.projectKey;
     let set = classpathByProject.get(key);
     if (!set) {
       set = new Set();
@@ -2959,61 +2950,26 @@ function buildClasspathByProject(projects, perRoot) {
     1: ids
   }) => [key, [...ids].sort()]));
 }
-function buildArtifactPaths(finalNodes, projects, projectsByGav, perRoot, fileExists) {
-  const targetsByCoord = new Map();
-  const targetsByGav = new Map();
-  const sourcesByCoord = new Map();
-  const coords = new Set();
-  for (const fn of finalNodes.values()) {
-    const c = fn.coord;
-    const coordKey = mavenCoordinateKey(c.group, c.name, c.ext, c.classifier, c.version);
-    if (!coordKey) {
-      continue;
-    }
-    coords.add(coordKey);
-    const pi = projectsByGav.get(gav(c.group, c.name, c.version ?? ''));
-    const sources = (pi?.sources ?? []).filter(fileExists).sort();
-    const targets = [...new Set(pi ? pi.targets : fn.targets)].filter(fileExists).sort();
-    if (sources.length) {
-      sourcesByCoord.set(coordKey, sources);
-    }
-    if (!targets.length) {
-      continue;
-    }
-    targetsByCoord.set(coordKey, targets);
-    const gavKey = mavenCoordinateKey(c.group, c.name, undefined, undefined, c.version);
-    if (gavKey) {
-      const acc = targetsByGav.get(gavKey);
-      if (acc) {
-        for (const f of targets) {
-          if (!acc.includes(f)) {
-            acc.push(f);
-          }
-        }
-      } else {
-        targetsByGav.set(gavKey, [...targets]);
-      }
+function buildArtifactPaths(finalNodes, projects, perRoot, fileExists) {
+  const pathsById = new Map();
+  for (const [id, fn] of finalNodes) {
+    if (!fn.project) {
+      pathsById.set(id, {
+        sources: [],
+        targets: [...fn.targets].filter(fileExists).sort()
+      });
     }
   }
-  // A top-level module is a `project` but usually not a dependency node, so its
-  // source roots (where reachability starts) are missed by the node loop above;
-  // emit first-party module paths here.
+  // A project's own component shares its id, so this also covers dependency
+  // edges onto a sibling project.
   for (const p of projects) {
-    const coordKey = mavenCoordinateKey(p.group, p.name, undefined, undefined, p.version);
-    if (!coordKey) {
-      continue;
-    }
-    coords.add(coordKey);
-    unionInto(sourcesByCoord, coordKey, p.sources.filter(fileExists));
-    const targets = p.targets.filter(fileExists);
-    unionInto(targetsByCoord, coordKey, targets);
-    unionInto(targetsByGav, coordKey, targets);
+    pathsById.set(p.projectKey, {
+      sources: [...new Set(p.sources)].filter(fileExists).sort(),
+      targets: [...new Set(p.targets)].filter(fileExists).sort()
+    });
   }
   return {
-    targetsByCoord,
-    targetsByGav,
-    sourcesByCoord,
-    coords,
+    pathsById,
     classpathByProject: buildClasspathByProject(projects, perRoot)
   };
 }
@@ -3185,18 +3141,24 @@ function serializeExcludePathPatterns(paths) {
 //   <tag>\t<field>\t<field>...
 //
 //   meta        tool  toolVersion  javaVersion
+//   buildRoot   path                                     (absolute; the facts file's directory)
+//   entry       path                                     (file-addressed builds; build-root-relative)
 //   project     projectKey  group  name  version  dir
 //   projectSrc  projectKey  path                         (--with-files only)
 //   projectTgt  projectKey  path                         (--with-files only)
-//   projectBuild  projectKey  path                       (build-root-relative)
+//   projectBuild  projectKey  path  [missing]            (build-root-relative; `missing`: configured, absent on disk)
+//   declared    projectKey  group  name  path            (script declaring the dependency; build-root-relative)
 //   root        rootId  projectKey  config  prod(0|1)
-//   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)
+//   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)  project
 //   edge        rootId  parentCoordId  childCoordId
 //   file        rootId  coordId  path                    (--with-files only)
 //   scanned     config
 //   failure     coord  detail  config
 //   unscannable config  detail
 //
+// `projectKey` is the tool's unique project identity (Maven: GAV; Gradle:
+// project path; sbt: project id), emitted as the project id; a `node` whose
+// `project` names one resolves to that build project.
 // A `root` is one (subproject, configuration) resolution root; `coordId` is the
 // coordinate key (`group:name:ext:classifier:version`, empty segments dropped),
 // used opaquely as the per-root node key. Unknown tags are ignored.
@@ -3225,6 +3187,8 @@ function parseRecords(text) {
     tool: '',
     toolVersion: '',
     javaVersion: '',
+    buildRoot: '',
+    entry: '',
     projects: new Map(),
     roots: new Map(),
     scannedConfigs: [],
@@ -3258,7 +3222,9 @@ function parseRecords(text) {
         dir: '',
         sources: [],
         targets: [],
-        buildFiles: []
+        buildFiles: [],
+        missingBuildFiles: [],
+        declaredIn: new Map()
       };
       result.projects.set(key, p);
     }
@@ -3275,6 +3241,12 @@ function parseRecords(text) {
         result.toolVersion = f[2] ?? '';
         result.javaVersion = f[3] ?? '';
         break;
+      case 'buildRoot':
+        result.buildRoot = f[1] ?? '';
+        break;
+      case 'entry':
+        result.entry = f[1] ?? '';
+        break;
       case 'project':
         {
           const p = project(f[1] ?? '');
@@ -3296,7 +3268,17 @@ function parseRecords(text) {
         break;
       case 'projectBuild':
         if (f[2]) {
-          project(f[1] ?? '').buildFiles.push(f[2]);
+          const p = project(f[1] ?? '');
+          (f[3] === 'missing' ? p.missingBuildFiles : p.buildFiles).push(f[2]);
+        }
+        break;
+      case 'declared':
+        if (f[4]) {
+          const {
+            declaredIn
+          } = project(f[1] ?? '');
+          const ga = `${f[2] ?? ''}:${f[3] ?? ''}`;
+          declaredIn.set(ga, [...(declaredIn.get(ga) ?? []), f[4]]);
         }
         break;
       case 'root':
@@ -3321,6 +3303,7 @@ function parseRecords(text) {
               classifier: f[7] ?? ''
             },
             direct: bool(f[8]),
+            project: f[9] ?? '',
             targets: []
           });
           break;
@@ -3428,16 +3411,22 @@ async function writeSbtPlugin(globalBase, sourceFilename, destFilename) {
   });
   await fs$1.promises.writeFile(path.join(pluginsDir, destFilename), src);
 }
-async function assembleFromRecords(out, recordsFile) {
+async function assembleFromRecords(tool, out, recordsFile) {
   const text = fs$1.existsSync(recordsFile) ? await fs$1.promises.readFile(recordsFile, 'utf8') : '';
+  const parsed = parseRecords(text);
+  const factsFileName = socketFactsFileName(tool, parsed.entry || undefined);
   const {
     artifactPaths,
     facts,
     report
-  } = assembleFacts(parseRecords(text));
+  } = assembleFacts(parsed, {
+    factsFileName
+  });
   return {
+    buildRoot: parsed.buildRoot || undefined,
     code: out.code,
     facts,
+    factsFileName,
     report,
     artifactPaths,
     stderr: out.stderr,
@@ -3510,7 +3499,7 @@ async function invokeGradle(opts, initScriptFilename, task, tmpDirPrefix) {
     // resolvedConfiguration API and shared accumulator aren't cache-safe.
     const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), task, '--no-daemon', '--console=plain'];
     const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out, recordsFile);
+    return await assembleFromRecords('gradle', out, recordsFile);
   });
 }
 async function runGradle(opts) {
@@ -3536,7 +3525,7 @@ async function invokeSbtIn(globalBase, opts, pluginSourceFilename, pluginDestFil
   const javaHomeOpt = javaHome && !(opts.toolOpts ?? []).includes('--java-home') ? ['--java-home', javaHome] : [];
   const args = [...javaHomeOpt, ...props, ...(opts.toolOpts ?? []), '--batch', task];
   const out = await runNeverThrow(bin, args, opts);
-  return await assembleFromRecords(out, recordsFile);
+  return await assembleFromRecords('sbt', out, recordsFile);
 }
 async function runSbt(opts) {
   const run = globalBase => invokeSbtIn(globalBase, opts, 'socket-facts.plugin.scala', SBT_FACTS_PLUGIN_FILENAME, FACTS_TASK);
@@ -3563,7 +3552,7 @@ async function invokeMaven(opts, coanaTask, tmpDirPrefix) {
     const props = [`-Dmaven.ext.class.path=${jarPath}`, `-Dcoana.task=${coanaTask}`, `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
     const args = [...props, ...(opts.toolOpts ?? []), '--batch-mode', 'validate'];
     const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out, recordsFile);
+    return await assembleFromRecords('maven', out, recordsFile);
   });
 }
 async function runMaven(opts) {
@@ -3586,8 +3575,9 @@ function tailBuildOutput(stdout, stderr) {
 // `process.exitCode`, which can already be non-zero for an unrelated reason.
 
 // Runs the bundled build-tool resolution script for a JVM project and writes
-// `.socket.facts.json`. `withFiles` (reachability only) additionally folds
-// resolved artifact paths into `sidecarAcc`. A blocking resolution failure sets
+// its `<entry>.socket.facts.json` (see socketFactsFileName). `withFiles`
+// (reachability only) additionally folds resolved artifact paths into
+// `sidecarAcc`. A blocking resolution failure sets
 // a non-zero exit code and returns (matching the `--pom` generator) unless
 // `ignoreUnresolved`; a crashed build — a process failure, not an unresolved
 // dependency — always fails.
@@ -3606,7 +3596,6 @@ async function runManifestFacts({
   verbose,
   withFiles
 }) {
-  const factsPath = path.join(cwd, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
   let resolvedJavaHome;
   if (javaHome) {
     const expanded = expandEnvVarRefs(javaHome);
@@ -3671,8 +3660,10 @@ async function runManifestFacts({
   }
   const {
     artifactPaths,
+    buildRoot,
     code,
     facts,
+    factsFileName,
     report,
     stderr,
     stdout
@@ -3731,6 +3722,20 @@ async function runManifestFacts({
     logger.logger.warn(`No resolvable ${ecosystem} dependencies found; nothing to upload.`);
     return;
   }
+  if (!buildRoot || !factsFileName) {
+    process.exitCode = 1;
+    logger.logger.fail(`The ${ecosystem} build did not report its ${buildRoot ? 'entry build file' : 'root directory'}, so its Socket facts file cannot be placed.`);
+    return null;
+  }
+  // Every path in the facts is relative to the build root, which `-f`/`-p`
+  // can move away from cwd.
+  const factsPath = path.join(buildRoot, factsFileName);
+  // Not a name producers write, so a copy here is stale and would be uploaded
+  // alongside the new file.
+  const legacyFactsPath = path.join(buildRoot, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+  if (fs$1.existsSync(legacyFactsPath)) {
+    logger.logger.warn(`Found \`${legacyFactsPath}\`, which is uploaded alongside \`${factsFileName}\`. Delete it if an earlier \`socket manifest\` run left it behind.`);
+  }
   const socketCliVersion = constants.default.ENV.INLINED_SOCKET_CLI_VERSION;
   if (facts.metadata && socketCliVersion) {
     facts.metadata.socketCliVersion = socketCliVersion;
@@ -3876,8 +3881,11 @@ async function runEcosystemCandidates({
         continue;
       }
       covered.add(dir);
+      // `-f`/`-p` can root the reactor away from `dir`.
+      // eslint-disable-next-line no-await-in-loop
+      const buildRoot = await utils.realpathOrResolved(path.dirname(result.factsPath));
       // eslint-disable-next-line no-await-in-loop
-      const resolvedSubprojectDirs = await Promise.all(result.projects.map(project => utils.realpathOrResolved(path.resolve(dir, project.subprojectDir))));
+      const resolvedSubprojectDirs = await Promise.all(result.projects.map(project => utils.realpathOrResolved(path.resolve(buildRoot, project.subprojectDir))));
       for (const subprojectDir of resolvedSubprojectDirs) {
         // Only a genuinely nested member (a descendant of this reactor's own
         // directory) has no independent existence worth its own standalone
@@ -3890,7 +3898,7 @@ async function runEcosystemCandidates({
         // meaningful data point, not a redundant one. Never suppress its own
         // build-root invocation, regardless of which reactor(s) also
         // incorporate it or the order candidates happen to be discovered in.
-        if (subprojectDir.startsWith(`${dir}${path.sep}`)) {
+        if (subprojectDir === buildRoot || subprojectDir.startsWith(`${buildRoot}${path.sep}`)) {
           covered.add(subprojectDir);
         }
       }
@@ -3905,7 +3913,7 @@ async function runEcosystemCandidates({
   return outcomes;
 }
 
-// Generates one .socket.facts.json per independent gradle/sbt/maven build
+// Generates one Socket facts file per independent gradle/sbt/maven build
 // root under `cwd`. Coverage is tracked per ecosystem via the facts SBOM's
 // own projects[].subprojectDir, not by pruning the whole discovered subtree,
 // so an unrelated nested project a reactor doesn't declare still gets its
@@ -6408,7 +6416,8 @@ async function extractBazelToMaven(opts) {
   }
 }
 
-// Generates `.socket.facts.json` for a Gradle project via the bundled init script.
+// Generates `gradle.socket.facts.json` for a Gradle project via the bundled
+// init script.
 async function convertGradleToFacts({
   bin,
   cwd,
@@ -6438,7 +6447,8 @@ async function convertGradleToFacts({
   });
 }
 
-// Generates `.socket.facts.json` for a Maven project via the bundled extension.
+// Generates `pom.xml.socket.facts.json` (named after the POM Maven runs on)
+// for a Maven project via the bundled extension.
 async function convertMavenToFacts({
   bin,
   cwd,
@@ -6468,7 +6478,7 @@ async function convertMavenToFacts({
   });
 }
 
-// Generates `.socket.facts.json` for an sbt project via the bundled sbt plugin.
+// Generates `sbt.socket.facts.json` for an sbt project via the bundled sbt plugin.
 // sbt 0.13/early 1.x can't run on modern JDKs — pass a compatible JDK via
 // `--sbt-opts "--java-home <path>"` or `JAVA_HOME`.
 async function convertSbtToFacts({
@@ -7231,7 +7241,7 @@ async function createNewScan({
         });
         if (reach.dynamicSbomInference) {
           // Already generated recursively above; resolving cwd's own build
-          // root a second time would race on the same .socket.facts.json.
+          // root a second time would race on the same facts file.
           detected.gradle = false;
           detected.sbt = false;
           detected.maven = false;
@@ -7365,12 +7375,12 @@ async function createNewScan({
         logger.logger.success('Reachability analysis completed successfully');
         reachabilityReport = reachResult.data?.reachabilityReport;
 
-        // When using only pre-generated SBOMs, build the scan from those inputs —
-        // CycloneDX, SPDX, and Socket facts (`.socket.facts.json`) — matching
-        // Coana's `--use-only-pregenerated-sboms` selection. Otherwise drop any
-        // stray `.socket.facts.json`; coana's fresh reachability report (appended
-        // below) is the authoritative facts file for the scan.
-        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => path.basename(p) !== constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+        // Mirror the SBOM inputs Coana analyzed; otherwise its fresh report
+        // (appended below) supersedes every facts file.
+        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles).filter(p => !utils.isReachabilityReportPath(p, {
+          cwd,
+          outputPath: constants.default.DOT_SOCKET_DOT_FACTS_JSON
+        })) : packagePaths.filter(p => !utils.isSocketFactsFile(p));
 
         // Append coana's reachability report, but not twice: a pre-generated facts
         // input can resolve to the same path coana wrote its report to.
@@ -7419,17 +7429,8 @@ async function createNewScan({
       logger.logger.warn('Reachability analysis ran but no full application reachability scan ID was found; skipping reachability finalize. The scan was created but its reachability report was not linked.');
     }
 
-    // On a successful scan, clean up the `.socket.facts.json` coana wrote at
-    // the path we instructed it to write to (via `--socket-mode`). Failed
-    // scans leave the file in place for debugging. Producer-written files
-    // (e.g. from `socket manifest gradle --facts`) are NOT touched here —
-    // those are user-owned input that the user can clean up themselves; in
-    // the --reach path coana overwrites that file with its enriched output
-    // anyway, so it's the same path that gets removed. `--reach-retain-facts-file`
-    // opts out of this cleanup so the report can be inspected; the user is then
-    // responsible for deleting it before the next full application reachability
-    // scan (a stale file is picked up as pre-generated input and would make those
-    // results unreliable).
+    // A scan without --reach would upload a leftover report as an SBOM with
+    // stale reachability results; a failed scan keeps it for debugging.
     if (fullScanCResult.ok && scanId && reachabilityReport && !reach.reachRetainFactsFile) {
       try {
         await fs.unlink(path.resolve(cwd, reachabilityReport));
@@ -9006,9 +9007,6 @@ async function discoverGhsaIds(orgSlug, tarHash, options) {
     }).catch(() => {});
   }
 }
-function isFactsFile(filepath) {
-  return path.basename(filepath).toLowerCase() === constants.DOT_SOCKET_DOT_FACTS_JSON;
-}
 async function gitWorkingTreeChanges(cwd) {
   const {
     0: modifiedCResult,
@@ -9129,16 +9127,15 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
     cwd
   });
   const scanFilepaths = await findScanFilepaths();
-  // Fail if any .socket.facts.json files are present in the scan folder.
-  // These are analysis artifacts and must be removed before re-running fix.
-  const factsFiles = scanFilepaths.filter(isFactsFile);
+  // Facts files are analysis artifacts and must be removed before re-running fix.
+  const factsFiles = scanFilepaths.filter(utils.isSocketFactsFile);
   if (factsFiles.length) {
     if (!silence) {
       spinner?.stop();
     }
     return {
       ok: false,
-      message: `Found ${constants.DOT_SOCKET_DOT_FACTS_JSON} in manifest files`,
+      message: 'Found Socket facts files in manifest files',
       cause: `Delete the following ${words.pluralize('file', factsFiles.length)} before running socket fix again:\n` + factsFiles.map(p => `  - ${p}`).join('\n')
     };
   }
@@ -9155,7 +9152,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       });
     } catch (e) {
       // A failed build root aborts inference after others wrote their facts.
-      const partial = (await findScanFilepaths()).filter(isFactsFile);
+      const partial = (await findScanFilepaths()).filter(utils.isSocketFactsFile);
       await Promise.all(partial.map(p => fs$1.promises.rm(p, {
         force: true
       })));
@@ -9924,7 +9921,7 @@ const reachabilityFlags = {
   reachRetainFactsFile: {
     type: 'boolean',
     default: false,
-    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh full application reachability scan. A stale `.socket.facts.json` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.'
+    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. Delete it once inspected: later reachability scans ignore it, but a scan without --reach uploads it as an SBOM carrying stale reachability results.'
   },
   reachSkipCache: {
     type: 'boolean',
@@ -12931,7 +12928,10 @@ const config$d = {
       $ ${command} [options] [CWD=.]
 
     Recursively walks CWD, discovers independent gradle, sbt, and maven build
-    roots, and generates a Socket facts SBOM (.socket.facts.json) for each,
+    roots, and generates a Socket facts SBOM for each
+    (pom.xml.socket.facts.json, gradle.socket.facts.json, or
+    sbt.socket.facts.json, so builds sharing a directory never overwrite each
+    other),
     skipping subproject/reactor-module directories a parent build root already
     covers. Unlike \`socket manifest auto\`, this looks beyond CWD itself.
 
@@ -13020,11 +13020,11 @@ const config$c = {
     },
     facts: {
       type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+      description: 'Emit a Socket facts JSON file (`gradle.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
     },
     pom: {
       type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`gradle.socket.facts.json`)'
     },
     includeConfigs: {
       type: 'string',
@@ -13055,9 +13055,9 @@ const config$c = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build, using gradle (preferably your local
-    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+    By default, emits a single \`gradle.socket.facts.json\` describing the
+    resolved dependency graph of the whole build, using gradle (preferably your
+    local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
     --include-configs / --exclude-configs (comma-separated glob patterns) to
     control which configurations are resolved (e.g.
     --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and
@@ -13274,11 +13274,11 @@ const config$b = {
     },
     facts: {
       type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+      description: 'Emit a Socket facts JSON file (`gradle.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
     },
     pom: {
       type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`gradle.socket.facts.json`)'
     },
     includeConfigs: {
       type: 'string',
@@ -13309,9 +13309,9 @@ const config$b = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build, using gradle (preferably your local
-    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+    By default, emits a single \`gradle.socket.facts.json\` describing the
+    resolved dependency graph of the whole build, using gradle (preferably your
+    local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
     --include-configs / --exclude-configs (comma-separated glob patterns) to
     control which configurations are resolved (e.g.
     --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and
@@ -13548,8 +13548,8 @@ const config$a = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    Emits a single \`.socket.facts.json\` describing the resolved dependency
-    graph of your Maven project, using maven (\`mvn\` on PATH by default). It
+    Emits a single \`pom.xml.socket.facts.json\` (named after the POM Maven
+    runs on) describing the resolved dependency graph of your Maven project, using maven (\`mvn\` on PATH by default). It
     reads dependency metadata only and never downloads artifacts; an unresolved
     dependency is a fatal error. You can pass --include-configs /
     --exclude-configs (comma-separated glob patterns) to control which Maven
@@ -13712,11 +13712,11 @@ const config$9 = {
     },
     facts: {
       type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+      description: 'Emit a Socket facts JSON file (`sbt.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
     },
     pom: {
       type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`sbt.socket.facts.json`)'
     },
     includeConfigs: {
       type: 'string',
@@ -13733,7 +13733,7 @@ const config$9 = {
     },
     out: {
       type: 'string',
-      description: 'Only with --pom: path of the output `pom.xml`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as `.socket.facts.json`)'
+      description: 'Only with --pom: path of the output `pom.xml`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as `sbt.socket.facts.json`)'
     },
     stdout: {
       type: 'boolean',
@@ -13755,8 +13755,8 @@ const config$9 = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build. It reads dependency metadata only and
+    By default, emits a single \`sbt.socket.facts.json\` describing the
+    resolved dependency graph of the whole build. It reads dependency metadata only and
     never downloads artifacts; an unresolved dependency is a fatal error. You
     can pass --include-configs / --exclude-configs (comma-separated glob
     patterns) to control which sbt configurations are resolved (e.g.
@@ -13937,7 +13937,7 @@ async function run$A(argv, importMeta, {
   //       would the file name be?
 
   // --out / --stdout only affect the pom path. Socket facts are always written
-  // to the project root as `.socket.facts.json` so that `socket scan create`
+  // to the project root as `sbt.socket.facts.json` so that `socket scan create`
   // picks them up, so reject these flags in facts mode rather than silently
   // ignoring an explicitly-passed output location.
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -13948,7 +13948,7 @@ async function run$A(argv, importMeta, {
   }, {
     nook: true,
     test: !(facts && (cli.flags['out'] !== undefined || cli.flags['stdout'] !== undefined)),
-    message: 'The `--out` and `--stdout` options only apply with `--pom`; Socket facts are always written to the project root as `.socket.facts.json`',
+    message: 'The `--out` and `--stdout` options only apply with `--pom`; Socket facts are always written to the project root as `sbt.socket.facts.json`',
     fail: 'remove --out/--stdout, or pass --pom'
   });
   if (!wasValidInput) {
@@ -14541,7 +14541,7 @@ async function askForFactsFlag(current) {
     choices: [{
       name: 'Socket facts (default)',
       value: 'yes',
-      description: 'Generate a .socket.facts.json file describing the resolved dependency graph'
+      description: 'Generate a Socket facts file (*.socket.facts.json) describing the resolved dependency graph'
     }, {
       name: 'pom.xml',
       value: 'no',
@@ -19953,6 +19953,13 @@ const generalFlags$1 = {
     description: 'Scan each TARGET directory as a uv project, using the versions pinned in its uv.lock or its workspace root uv.lock. Uploads a CycloneDX dependency graph per TARGET in place of manifest discovery, including all extras and dependency groups. Requires uv on PATH.'
   }
 };
+function hasSocketFactsFileIn(dir) {
+  try {
+    return fs$1.readdirSync(dir).some(utils.isSocketFactsFile);
+  } catch {
+    return false;
+  }
+}
 const cmdScanCreate = {
   description: description$c,
   hidden: hidden$a,
@@ -20174,12 +20181,12 @@ async function run$d(argv, importMeta, {
     }
   }
   const detected = await detectManifestActions(sockJson, cwd);
-  // Suppress the --auto-manifest suggestion when a `.socket.facts.json` is
+  // Suppress the --auto-manifest suggestion when a Socket facts file is
   // already present at cwd. That file is the output of `socket manifest auto`
   // (and `--facts` mode of the per-ecosystem manifest commands), so suggesting
   // to regenerate it would be misleading; the manifest data is already there
   // and will be picked up by the scan.
-  const hasFactsFile = fs$1.existsSync(path.join(cwd, constants.default.DOT_SOCKET_DOT_FACTS_JSON));
+  const hasFactsFile = hasSocketFactsFileIn(cwd);
   if (detected.count > 0 && !autoManifest && !dynamicSbomInference && !uvMembers && !hasFactsFile) {
     logger.logger.info(`Detected ${detected.count} manifest targets we could try to generate. Please set the --auto-manifest flag if you want to include languages covered by \`socket manifest auto\` in the Scan.`);
   }
@@ -24498,5 +24505,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=e70a53df-f766-401c-8399-eee0c4d48cc7
+//# debugId=679b39e8-2ace-4602-9ad0-c5cf11bec9e3
 //# sourceMappingURL=cli.js.map