@socketsecurity/cli-with-sentry 1.6.2 → 1.8.0

package/dist/cli.js

@@ -1857,8 +1857,12 @@ withPaths = true) {
   };
   acc.set(factsFile, {
     components: facts.components.map(paths),
-    projects: (facts.projects ?? []).map(proj => ({
+    projects: (facts.projects ?? []).map(({
+      children: _children,
+      ...proj
+    }) => ({
       ...paths(proj),
+      dependencies: [...(artifactPaths.directDependenciesByProject.get(proj.id) ?? [])],
       classpath: [...(artifactPaths.classpathByProject.get(proj.id) ?? [])]
     }))
   });
@@ -1955,15 +1959,13 @@ async function performReachabilityAnalysis(options) {
   }
   const sockSdk = sockSdkCResult.data;
   spinner?.start('Uploading manifests for reachability analysis...');
+  const outputFilePath = outputPath || constants.default.DOT_SOCKET_DOT_FACTS_JSON;
 
   // Ensure uploaded manifest files are relative to analysis target as coana resolves SBOM manifest files relative to this path
-  // NOTE: previously stripped any `.socket.facts.json` from packagePaths
-  // here to avoid uploading leftover post-reachability output. With the
-  // producer flow (`socket manifest gradle --facts`) those files are
-  // legitimate INPUT to compute-artifacts, so we now upload them. Stale
-  // facts files are cleaned up downstream — see the post-success
-  // deletion in handle-create-new-scan.mts.
-  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths, {
+  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths.filter(p => !utils.isReachabilityReportPath(p, {
+    cwd,
+    outputPath: outputFilePath
+  })), {
     pathsRelativeTo: path.resolve(cwd, analysisTarget)
   }), {
     description: 'upload manifests',
@@ -1991,7 +1993,6 @@ async function performReachabilityAnalysis(options) {
   spinner?.success(`Manifests uploaded successfully. Tar hash: ${tarHash}`);
   spinner?.start();
   spinner?.infoAndStop('Running reachability analysis with Coana...');
-  const outputFilePath = outputPath || constants.default.DOT_SOCKET_DOT_FACTS_JSON;
 
   // Temp file for --compute-artifacts-sidecar, removed in the finally below.
   // Written even when empty under dynamicSbomInference, since the
@@ -2282,6 +2283,15 @@ const BUILD_TOOL_WRAPPER = {
   maven: 'mvnw'
 };
 
+// Gradle (8+) and sbt hold one build per directory; Maven builds are addressed
+// by POM file, so `mvn -f other-pom.xml` puts a second build in the directory.
+const ADDRESSED_BY_FILE = {
+  __proto__: null,
+  gradle: false,
+  maven: true,
+  sbt: false
+};
+
 // sbt happily runs in any directory, synthesizing a default project from its
 // name, so an sbt run outside a build yields a plausible but bogus SBOM. Maven
 // and Gradle refuse such a directory themselves.
@@ -2299,6 +2309,14 @@ function resolveBuildToolBin(tool, projectDir, bin) {
   return DEFAULT_BUILD_TOOL_BIN[tool];
 }
 
+// Distinct for every build sharing a directory.
+function socketFactsFileName(tool, entryFile) {
+  if (!ADDRESSED_BY_FILE[tool]) {
+    return `${tool}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}`;
+  }
+  return entryFile ? `${path.basename(entryFile)}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}` : undefined;
+}
+
 // Gradle's variant-aware resolver: distinct exceptions give mutually-exclusive
 // phrasing, so most-specific-first substring checks classify reliably.
 function classifyGradleFailure(detail) {
@@ -2659,13 +2677,14 @@ const PURL_TYPE_MAVEN = 'maven';
 function assembleFacts(parsed, opts = {}) {
   const fileExists = opts.fileExists ?? fs$1.existsSync;
   const perRoot = buildPerRoot(parsed);
-  const {
-    directByRoot,
-    finalNodes
-  } = mergeById(perRoot);
+  const finalNodes = mergeById(perRoot);
+  const graphs = buildSubprojectGraphs(perRoot);
   const tool = parsed.tool || 'gradle';
-  const components = buildComponents(finalNodes, buildManifestFilesById(parsed, directByRoot, perRoot));
-  const projects = opts.emitProjects === false ? [] : buildProjects(parsed, directByRoot, perRoot);
+  const components = buildComponents(finalNodes);
+  const {
+    dependencies,
+    projects
+  } = buildDependencyGraph(parsed, graphs, components);
   const metadata = {
     format: 'socket-facts-sbom',
     tool,
@@ -2677,7 +2696,8 @@ function assembleFacts(parsed, opts = {}) {
   const facts = projects.length ? {
     metadata,
     projects,
-    components
+    components,
+    dependencies
   } : {
     metadata,
     components
@@ -2685,7 +2705,7 @@ function assembleFacts(parsed, opts = {}) {
   return {
     facts,
     report: buildReport(parsed),
-    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], perRoot, fileExists)
+    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], graphs, fileExists)
   };
 }
 
@@ -2744,17 +2764,15 @@ function buildPerRoot(parsed) {
 // reachability, which needs each subproject's exact classpath.
 function mergeById(perRoot) {
   const finalNodes = new Map();
-  const directByRoot = new Map();
-  for (const [rootId, {
+  for (const {
     nodes,
     prod
-  }] of perRoot) {
+  } of perRoot.values()) {
     for (const [coordId, node] of nodes) {
       let fn = finalNodes.get(coordId);
       if (!fn) {
         fn = {
           coord: node.coord,
-          children: new Set(),
           prod: false,
           direct: false,
           project: node.project,
@@ -2768,56 +2786,14 @@ function mergeById(perRoot) {
       if (node.direct) {
         fn.direct = true;
       }
-      for (const c of node.children) {
-        fn.children.add(c);
-      }
       for (const t of node.targets) {
         fn.targets.add(t);
       }
-      if (node.direct) {
-        let d = directByRoot.get(rootId);
-        if (!d) {
-          d = new Set();
-          directByRoot.set(rootId, d);
-        }
-        d.add(coordId);
-      }
     }
   }
-  return {
-    finalNodes,
-    directByRoot
-  };
-}
-function buildManifestFilesById(parsed, directByRoot, perRoot) {
-  const buildFilesByCoord = new Map();
-  for (const [rootId, ids] of directByRoot) {
-    const root = perRoot.get(rootId);
-    const project = parsed.projects.get(root?.projectKey ?? '');
-    for (const id of ids) {
-      let set = buildFilesByCoord.get(id);
-      if (!set) {
-        set = new Set();
-        buildFilesByCoord.set(id, set);
-      }
-      const coord = root?.nodes.get(id)?.coord;
-      // Without a known declaring script, the project's build file, even one
-      // absent on disk: its presence marks the dependency direct here.
-      const declared = coord && project?.declaredIn.get(`${coord.group}:${coord.name}`);
-      const files = declared ?? [...(project?.buildFiles ?? []), ...(project?.missingBuildFiles ?? [])];
-      for (const f of files) {
-        set.add(f);
-      }
-    }
-  }
-  return new Map([...buildFilesByCoord].map(({
-    0: id,
-    1: buildFiles
-  }) => [id, [constants.default.DOT_SOCKET_DOT_FACTS_JSON, ...[...buildFiles].sort()].map(file => ({
-    file
-  }))]));
+  return finalNodes;
 }
-function buildComponents(finalNodes, manifestFilesById) {
+function buildComponents(finalNodes) {
   return [...finalNodes.keys()].sort().map(id => {
     const fn = finalNodes.get(id);
     const c = fn.coord;
@@ -2851,92 +2827,188 @@ function buildComponents(finalNodes, manifestFilesById) {
     if (fn.project) {
       comp.firstParty = true;
     }
-    if (fn.children.size) {
-      comp.dependencies = [...fn.children].sort();
-    }
-    const manifestFiles = manifestFilesById.get(id);
-    if (manifestFiles) {
-      comp.manifestFiles = manifestFiles;
-    }
     return comp;
   });
 }
-function buildProjects(parsed, directByRoot, perRoot) {
-  const directByProject = new Map();
-  for (const [rootId, ids] of directByRoot) {
-    const pk = perRoot.get(rootId)?.projectKey ?? '';
-    let set = directByProject.get(pk);
-    if (!set) {
-      set = new Set();
-      directByProject.set(pk, set);
+
+// One graph per subproject, its configurations merged.
+function buildSubprojectGraphs(perRoot) {
+  const graphs = new Map();
+  for (const {
+    nodes,
+    projectKey
+  } of perRoot.values()) {
+    let g = graphs.get(projectKey);
+    if (!g) {
+      g = {
+        children: new Map(),
+        direct: new Set()
+      };
+      graphs.set(projectKey, g);
     }
-    for (const id of ids) {
-      set.add(id);
+    for (const [coordId, node] of nodes) {
+      let set = g.children.get(coordId);
+      if (!set) {
+        set = new Set();
+        g.children.set(coordId, set);
+      }
+      for (const c of node.children) {
+        set.add(c);
+      }
+      if (node.direct) {
+        g.direct.add(coordId);
+      }
     }
   }
-  const projects = [...parsed.projects.values()].map(p => {
-    const entry = {
-      id: p.projectKey,
-      type: PURL_TYPE_MAVEN,
-      namespace: p.group,
-      name: p.name,
-      ...(p.version ? {
-        version: p.version
-      } : {}),
-      subprojectDir: p.dir,
-      dependencies: [...(directByProject.get(p.projectKey) ?? [])].sort()
-    };
-    // A project without a build file of its own is defined by the scripts
-    // declaring its dependencies, e.g. the root build script.
-    const declared = [...new Set([...p.declaredIn.values()].flat())];
-    const files = p.buildFiles.length ? p.buildFiles : declared.length ? declared : p.missingBuildFiles;
-    if (files.length) {
-      entry.manifestFiles = [...files].sort().map(file => ({
-        file
-      }));
+  return graphs;
+}
+
+// Equal subtrees share an entry; partition refinement (coarsest bisimulation)
+// keeps that exact on cycles too.
+function buildDependencyGraph(parsed, graphs, components) {
+  const componentIndex = new Map(components.map((c, i) => [c.id, i]));
+  const vertexIds = new Map();
+  const labels = [];
+  const edges = [];
+  const vertex = (projectKey, coordId) => {
+    const key = `${projectKey}\t${coordId}`;
+    let v = vertexIds.get(key);
+    if (v === undefined) {
+      v = labels.length;
+      vertexIds.set(key, v);
+      labels.push(componentIndex.get(coordId));
+      edges.push([]);
+    }
+    return v;
+  };
+  for (const [projectKey, {
+    children
+  }] of graphs) {
+    for (const [coordId, kids] of children) {
+      const v = vertex(projectKey, coordId);
+      for (const c of kids) {
+        edges[v].push(vertex(projectKey, c));
+      }
     }
-    return entry;
-  });
-  projects.sort((a, b) => {
-    const ka = `${a.subprojectDir} ${a.namespace}:${a.name}`;
-    const kb = `${b.subprojectDir} ${b.namespace}:${b.name}`;
+  }
+
+  // Each round splits blocks by their children's blocks; a round that splits
+  // nothing is stable.
+  let block = [...labels];
+  let blockCount = new Set(block).size;
+  for (;;) {
+    const ids = new Map();
+    block = block.map((b, v) => {
+      const childBlocks = [...new Set(edges[v].map(c => block[c]))].sort((x, y) => x - y);
+      const sig = `${b}:${childBlocks.join(',')}`;
+      let id = ids.get(sig);
+      if (id === undefined) {
+        id = ids.size;
+        ids.set(sig, id);
+      }
+      return id;
+    });
+    if (ids.size === blockCount) {
+      break;
+    }
+    blockCount = ids.size;
+  }
+  const byComponent = (a, b) => componentIndex.get(a) - componentIndex.get(b);
+  const projects = [...parsed.projects.values()].map(p => ({
+    p,
+    roots: treeRoots(p.projectKey, graphs.get(p.projectKey), byComponent)
+  })).sort((a, b) => {
+    const ka = `${a.p.dir} ${a.p.group}:${a.p.name}`;
+    const kb = `${b.p.dir} ${b.p.group}:${b.p.name}`;
     return ka < kb ? -1 : ka > kb ? 1 : 0;
   });
-  return projects;
-}
-function buildClasspathByProject(projects, perRoot) {
-  const idsByProjectKey = new Map();
-  for (const {
-    nodes,
-    projectKey
-  } of perRoot.values()) {
-    let set = idsByProjectKey.get(projectKey);
-    if (!set) {
-      set = new Set();
-      idsByProjectKey.set(projectKey, set);
+
+  // Post-order over the sorted projects, so the numbering is stable.
+  const indexOfBlock = new Map();
+  const vertexOfBlock = new Map();
+  const dependencies = [];
+  const visit = v => {
+    const b = block[v];
+    if (vertexOfBlock.has(b)) {
+      return;
     }
-    for (const coordId of nodes.keys()) {
-      set.add(coordId);
+    vertexOfBlock.set(b, v);
+    for (const c of [...edges[v]].sort((x, y) => labels[x] - labels[y])) {
+      visit(c);
+    }
+    indexOfBlock.set(b, dependencies.length);
+    dependencies.push({
+      component: labels[v]
+    });
+  };
+  const indexOf = v => indexOfBlock.get(block[v]);
+  for (const {
+    p,
+    roots
+  } of projects) {
+    for (const coordId of roots) {
+      visit(vertex(p.projectKey, coordId));
     }
   }
-  const classpathByProject = new Map();
-  for (const p of projects) {
-    const key = p.projectKey;
-    let set = classpathByProject.get(key);
-    if (!set) {
-      set = new Set();
-      classpathByProject.set(key, set);
+  for (const [b, v] of vertexOfBlock) {
+    const children = [...new Set(edges[v].map(indexOf))].sort((x, y) => x - y);
+    if (children.length) {
+      dependencies[indexOfBlock.get(b)].children = children;
     }
-    for (const id of idsByProjectKey.get(p.projectKey) ?? []) {
-      set.add(id);
+  }
+  return {
+    dependencies,
+    projects: projects.map(({
+      p,
+      roots
+    }) => {
+      const entry = {
+        id: p.projectKey,
+        type: PURL_TYPE_MAVEN,
+        namespace: p.group,
+        name: p.name,
+        ...(p.version ? {
+          version: p.version
+        } : {}),
+        subprojectDir: p.dir,
+        children: roots.map(coordId => indexOf(vertex(p.projectKey, coordId))).sort((x, y) => x - y)
+      };
+      if (p.buildFiles.length) {
+        entry.manifestFiles = [...new Set(p.buildFiles)].sort().map(file => ({
+          file
+        }));
+      }
+      return entry;
+    })
+  };
+}
+function treeRoots(projectKey, graph, byComponent) {
+  if (!graph) {
+    return [];
+  }
+  const roots = [...graph.direct].sort(byComponent);
+  const reached = new Set();
+  const stack = [...roots];
+  while (stack.length) {
+    const id = stack.pop();
+    if (!reached.has(id)) {
+      reached.add(id);
+      stack.push(...graph.children.get(id));
     }
   }
-  return new Map([...classpathByProject].map(({
-    0: key,
-    1: ids
-  }) => [key, [...ids].sort()]));
+  const unreached = [...graph.children.keys()].filter(id => !reached.has(id));
+  if (unreached.length) {
+    throw new Error(`Resolved dependencies of ${projectKey} are not reachable from its direct dependencies: ${unreached.sort(byComponent).join(', ')}`);
+  }
+  return roots;
+}
+function byProject(projects, graphs, ids) {
+  return new Map(projects.map(p => {
+    const g = graphs.get(p.projectKey);
+    return [p.projectKey, g ? [...ids(g)].sort() : []];
+  }));
 }
-function buildArtifactPaths(finalNodes, projects, perRoot, fileExists) {
+function buildArtifactPaths(finalNodes, projects, graphs, fileExists) {
   const pathsById = new Map();
   for (const [id, fn] of finalNodes) {
     if (!fn.project) {
@@ -2956,7 +3028,8 @@ function buildArtifactPaths(finalNodes, projects, perRoot, fileExists) {
   }
   return {
     pathsById,
-    classpathByProject: buildClasspathByProject(projects, perRoot)
+    classpathByProject: byProject(projects, graphs, g => g.children.keys()),
+    directDependenciesByProject: byProject(projects, graphs, g => g.direct)
   };
 }
 function buildReport(parsed) {
@@ -3128,11 +3201,11 @@ function serializeExcludePathPatterns(paths) {
 //
 //   meta        tool  toolVersion  javaVersion
 //   buildRoot   path                                     (absolute; the facts file's directory)
+//   entry       path                                     (file-addressed builds; build-root-relative)
 //   project     projectKey  group  name  version  dir
 //   projectSrc  projectKey  path                         (--with-files only)
 //   projectTgt  projectKey  path                         (--with-files only)
-//   projectBuild  projectKey  path  [missing]            (build-root-relative; `missing`: configured, absent on disk)
-//   declared    projectKey  group  name  path            (script declaring the dependency; build-root-relative)
+//   projectBuild  projectKey  path                     (build-root-relative; may be absent on disk)
 //   root        rootId  projectKey  config  prod(0|1)
 //   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)  project
 //   edge        rootId  parentCoordId  childCoordId
@@ -3173,6 +3246,7 @@ function parseRecords(text) {
     toolVersion: '',
     javaVersion: '',
     buildRoot: '',
+    entry: '',
     projects: new Map(),
     roots: new Map(),
     scannedConfigs: [],
@@ -3206,9 +3280,7 @@ function parseRecords(text) {
         dir: '',
         sources: [],
         targets: [],
-        buildFiles: [],
-        missingBuildFiles: [],
-        declaredIn: new Map()
+        buildFiles: []
       };
       result.projects.set(key, p);
     }
@@ -3228,6 +3300,9 @@ function parseRecords(text) {
       case 'buildRoot':
         result.buildRoot = f[1] ?? '';
         break;
+      case 'entry':
+        result.entry = f[1] ?? '';
+        break;
       case 'project':
         {
           const p = project(f[1] ?? '');
@@ -3249,17 +3324,7 @@ function parseRecords(text) {
         break;
       case 'projectBuild':
         if (f[2]) {
-          const p = project(f[1] ?? '');
-          (f[3] === 'missing' ? p.missingBuildFiles : p.buildFiles).push(f[2]);
-        }
-        break;
-      case 'declared':
-        if (f[4]) {
-          const {
-            declaredIn
-          } = project(f[1] ?? '');
-          const ga = `${f[2] ?? ''}:${f[3] ?? ''}`;
-          declaredIn.set(ga, [...(declaredIn.get(ga) ?? []), f[4]]);
+          project(f[1] ?? '').buildFiles.push(f[2]);
         }
         break;
       case 'root':
@@ -3392,9 +3457,10 @@ async function writeSbtPlugin(globalBase, sourceFilename, destFilename) {
   });
   await fs$1.promises.writeFile(path.join(pluginsDir, destFilename), src);
 }
-async function assembleFromRecords(out, recordsFile) {
+async function assembleFromRecords(tool, out, recordsFile) {
   const text = fs$1.existsSync(recordsFile) ? await fs$1.promises.readFile(recordsFile, 'utf8') : '';
   const parsed = parseRecords(text);
+  const factsFileName = socketFactsFileName(tool, parsed.entry || undefined);
   const {
     artifactPaths,
     facts,
@@ -3404,6 +3470,7 @@ async function assembleFromRecords(out, recordsFile) {
     buildRoot: parsed.buildRoot || undefined,
     code: out.code,
     facts,
+    factsFileName,
     report,
     artifactPaths,
     stderr: out.stderr,
@@ -3476,7 +3543,7 @@ async function invokeGradle(opts, initScriptFilename, task, tmpDirPrefix) {
     // resolvedConfiguration API and shared accumulator aren't cache-safe.
     const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), task, '--no-daemon', '--console=plain'];
     const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out, recordsFile);
+    return await assembleFromRecords('gradle', out, recordsFile);
   });
 }
 async function runGradle(opts) {
@@ -3502,7 +3569,7 @@ async function invokeSbtIn(globalBase, opts, pluginSourceFilename, pluginDestFil
   const javaHomeOpt = javaHome && !(opts.toolOpts ?? []).includes('--java-home') ? ['--java-home', javaHome] : [];
   const args = [...javaHomeOpt, ...props, ...(opts.toolOpts ?? []), '--batch', task];
   const out = await runNeverThrow(bin, args, opts);
-  return await assembleFromRecords(out, recordsFile);
+  return await assembleFromRecords('sbt', out, recordsFile);
 }
 async function runSbt(opts) {
   const run = globalBase => invokeSbtIn(globalBase, opts, 'socket-facts.plugin.scala', SBT_FACTS_PLUGIN_FILENAME, FACTS_TASK);
@@ -3529,7 +3596,7 @@ async function invokeMaven(opts, coanaTask, tmpDirPrefix) {
     const props = [`-Dmaven.ext.class.path=${jarPath}`, `-Dcoana.task=${coanaTask}`, `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
     const args = [...props, ...(opts.toolOpts ?? []), '--batch-mode', 'validate'];
     const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out, recordsFile);
+    return await assembleFromRecords('maven', out, recordsFile);
   });
 }
 async function runMaven(opts) {
@@ -3552,8 +3619,9 @@ function tailBuildOutput(stdout, stderr) {
 // `process.exitCode`, which can already be non-zero for an unrelated reason.
 
 // Runs the bundled build-tool resolution script for a JVM project and writes
-// `.socket.facts.json`. `withFiles` (reachability only) additionally folds
-// resolved artifact paths into `sidecarAcc`. A blocking resolution failure sets
+// its `<entry>.socket.facts.json` (see socketFactsFileName). `withFiles`
+// (reachability only) additionally folds resolved artifact paths into
+// `sidecarAcc`. A blocking resolution failure sets
 // a non-zero exit code and returns (matching the `--pom` generator) unless
 // `ignoreUnresolved`; a crashed build — a process failure, not an unresolved
 // dependency — always fails.
@@ -3639,6 +3707,7 @@ async function runManifestFacts({
     buildRoot,
     code,
     facts,
+    factsFileName,
     report,
     stderr,
     stdout
@@ -3697,14 +3766,20 @@ async function runManifestFacts({
     logger.logger.warn(`No resolvable ${ecosystem} dependencies found; nothing to upload.`);
     return;
   }
-  if (!buildRoot) {
+  if (!buildRoot || !factsFileName) {
     process.exitCode = 1;
-    logger.logger.fail(`The ${ecosystem} build did not report its root directory, so its Socket facts file cannot be placed.`);
+    logger.logger.fail(`The ${ecosystem} build did not report its ${buildRoot ? 'entry build file' : 'root directory'}, so its Socket facts file cannot be placed.`);
     return null;
   }
   // Every path in the facts is relative to the build root, which `-f`/`-p`
   // can move away from cwd.
-  const factsPath = path.join(buildRoot, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+  const factsPath = path.join(buildRoot, factsFileName);
+  // Not a name producers write, so a copy here is stale and would be uploaded
+  // alongside the new file.
+  const legacyFactsPath = path.join(buildRoot, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+  if (fs$1.existsSync(legacyFactsPath)) {
+    logger.logger.warn(`Found \`${legacyFactsPath}\`, which is uploaded alongside \`${factsFileName}\`. Delete it if an earlier \`socket manifest\` run left it behind.`);
+  }
   const socketCliVersion = constants.default.ENV.INLINED_SOCKET_CLI_VERSION;
   if (facts.metadata && socketCliVersion) {
     facts.metadata.socketCliVersion = socketCliVersion;
@@ -6385,7 +6460,8 @@ async function extractBazelToMaven(opts) {
   }
 }
 
-// Generates `.socket.facts.json` for a Gradle project via the bundled init script.
+// Generates `gradle.socket.facts.json` for a Gradle project via the bundled
+// init script.
 async function convertGradleToFacts({
   bin,
   cwd,
@@ -6415,7 +6491,8 @@ async function convertGradleToFacts({
   });
 }
 
-// Generates `.socket.facts.json` for a Maven project via the bundled extension.
+// Generates `pom.xml.socket.facts.json` (named after the POM Maven runs on)
+// for a Maven project via the bundled extension.
 async function convertMavenToFacts({
   bin,
   cwd,
@@ -6445,7 +6522,7 @@ async function convertMavenToFacts({
   });
 }
 
-// Generates `.socket.facts.json` for an sbt project via the bundled sbt plugin.
+// Generates `sbt.socket.facts.json` for an sbt project via the bundled sbt plugin.
 // sbt 0.13/early 1.x can't run on modern JDKs — pass a compatible JDK via
 // `--sbt-opts "--java-home <path>"` or `JAVA_HOME`.
 async function convertSbtToFacts({
@@ -7342,12 +7419,12 @@ async function createNewScan({
         logger.logger.success('Reachability analysis completed successfully');
         reachabilityReport = reachResult.data?.reachabilityReport;
 
-        // When using only pre-generated SBOMs, build the scan from those inputs —
-        // CycloneDX, SPDX, and Socket facts — matching Coana's
-        // `--use-only-pregenerated-sboms` selection. Otherwise drop every facts
-        // file; coana's fresh reachability report (appended below) is the
-        // authoritative facts file for the scan.
-        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => !utils.isSocketFactsFile(p));
+        // Mirror the SBOM inputs Coana analyzed; otherwise its fresh report
+        // (appended below) supersedes every facts file.
+        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles).filter(p => !utils.isReachabilityReportPath(p, {
+          cwd,
+          outputPath: constants.default.DOT_SOCKET_DOT_FACTS_JSON
+        })) : packagePaths.filter(p => !utils.isSocketFactsFile(p));
 
         // Append coana's reachability report, but not twice: a pre-generated facts
         // input can resolve to the same path coana wrote its report to.
@@ -7396,17 +7473,8 @@ async function createNewScan({
       logger.logger.warn('Reachability analysis ran but no full application reachability scan ID was found; skipping reachability finalize. The scan was created but its reachability report was not linked.');
     }
 
-    // On a successful scan, clean up the `.socket.facts.json` coana wrote at
-    // the path we instructed it to write to (via `--socket-mode`). Failed
-    // scans leave the file in place for debugging. Producer-written files
-    // (e.g. from `socket manifest gradle --facts`) are NOT touched here —
-    // those are user-owned input that the user can clean up themselves; in
-    // the --reach path coana overwrites that file with its enriched output
-    // anyway, so it's the same path that gets removed. `--reach-retain-facts-file`
-    // opts out of this cleanup so the report can be inspected; the user is then
-    // responsible for deleting it before the next full application reachability
-    // scan (a stale file is picked up as pre-generated input and would make those
-    // results unreliable).
+    // A scan without --reach would upload a leftover report as an SBOM with
+    // stale reachability results; a failed scan keeps it for debugging.
     if (fullScanCResult.ok && scanId && reachabilityReport && !reach.reachRetainFactsFile) {
       try {
         await fs.unlink(path.resolve(cwd, reachabilityReport));
@@ -8844,49 +8912,75 @@ async function getFixEnv() {
   };
 }
 
-// Backed up so each fix attempt sees the pre-fix build after `git clean`.
-async function generateSocketFactsForFix({
-  cwd,
-  excludePaths,
-  tmpDir
-}) {
-  const {
-    factsPaths,
-    resolvedPathsSidecar
-  } = await runDynamicSbomInference({
-    cwd,
-    excludePaths,
-    sbtTmpDir: undefined,
-    sidecar: true,
-    withFiles: false
+async function backUp(sources, dir) {
+  await fs.mkdir(dir, {
+    recursive: true
   });
-  const sidecarFile = resolvedPathsSidecar ? path.join(tmpDir, 'sidecar.json') : undefined;
-  if (sidecarFile) {
-    await fs.writeFile(sidecarFile, JSON.stringify(resolvedPathsSidecar));
-  }
-  const paths = factsPaths.map(p => path.resolve(cwd, p));
-  const backups = await Promise.all(paths.map(async (source, index) => {
-    const backup = path.join(tmpDir, `${index}.json`);
+  return await Promise.all(sources.map(async (source, index) => {
+    const backup = path.join(dir, `${index}.json`);
     await fs.copyFile(source, backup);
     return {
       backup,
       source
     };
   }));
+}
+async function restoreAll(backups) {
+  await Promise.all(backups.map(({
+    backup,
+    source
+  }) => fs.copyFile(backup, source)));
+}
+
+// Backed up so each fix attempt sees the pre-fix build after `git clean`, and
+// facts files already present are left as they were found.
+async function generateSocketFactsForFix({
+  cwd,
+  excludePaths,
+  findFactsPaths,
+  tmpDir
+}) {
+  const existingPaths = await findFactsPaths();
+  const originals = await backUp(existingPaths, path.join(tmpDir, 'existing'));
+  const existing = new Set(existingPaths);
+  const reset = async written => {
+    await Promise.all(written.filter(p => !existing.has(p)).map(p => fs.rm(p, {
+      force: true
+    })));
+    await restoreAll(originals);
+  };
+  let paths;
+  let sidecarFile;
+  try {
+    const {
+      factsPaths,
+      resolvedPathsSidecar
+    } = await runDynamicSbomInference({
+      cwd,
+      excludePaths,
+      sbtTmpDir: undefined,
+      sidecar: true,
+      withFiles: false
+    });
+    paths = factsPaths.map(p => path.resolve(cwd, p));
+    if (resolvedPathsSidecar) {
+      sidecarFile = path.join(tmpDir, 'sidecar.json');
+      await fs.writeFile(sidecarFile, JSON.stringify(resolvedPathsSidecar));
+    }
+  } catch (e) {
+    // A failed build root aborts inference after others wrote their facts.
+    await reset(await findFactsPaths());
+    throw e;
+  }
+  const generated = new Set(paths);
+  const backups = [...originals.filter(({
+    source
+  }) => !generated.has(source)), ...(await backUp(paths, path.join(tmpDir, 'generated')))];
   return {
     paths,
     sidecarFile,
-    async remove() {
-      await Promise.all(paths.map(p => fs.rm(p, {
-        force: true
-      })));
-    },
-    async restore() {
-      await Promise.all(backups.map(({
-        backup,
-        source
-      }) => fs.copyFile(backup, source)));
-    }
+    remove: () => reset(paths),
+    restore: () => restoreAll(backups)
   };
 }
 
@@ -9097,51 +9191,36 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
   // sibling manifest's references). --exclude stays separate as a hidden
   // legacy escape hatch for the narrower "fix-application only" semantic.
   const coanaExcludePatterns = [...exclude, ...excludePaths];
-  const findScanFilepaths = () => utils.getPackageFilesForScan(['.'], supportedFiles, {
+  const findScanFilepaths = async () => (await utils.getPackageFilesForScan(['.'], supportedFiles, {
     additionalIgnores,
     config: socketConfig,
     cwd
-  });
+  })).filter(p => !utils.isReachabilityReportPath(p, {
+    cwd,
+    outputPath: constants.DOT_SOCKET_DOT_FACTS_JSON
+  }));
   const scanFilepaths = await findScanFilepaths();
-  // Facts files are analysis artifacts and must be removed before re-running fix.
-  const factsFiles = scanFilepaths.filter(utils.isSocketFactsFile);
-  if (factsFiles.length) {
-    if (!silence) {
-      spinner?.stop();
-    }
-    return {
-      ok: false,
-      message: 'Found Socket facts files in manifest files',
-      cause: `Delete the following ${words.pluralize('file', factsFiles.length)} before running socket fix again:\n` + factsFiles.map(p => `  - ${p}`).join('\n')
-    };
-  }
   if (factsSlot) {
     if (!silence) {
       spinner?.stop();
       logger.logger.info('Generating Socket facts for Gradle, sbt and Maven builds ...');
     }
-    try {
-      factsSlot.generated = await generateSocketFactsForFix({
-        cwd,
-        excludePaths,
-        tmpDir: factsSlot.tmpDir
-      });
-    } catch (e) {
-      // A failed build root aborts inference after others wrote their facts.
-      const partial = (await findScanFilepaths()).filter(utils.isSocketFactsFile);
-      await Promise.all(partial.map(p => fs$1.promises.rm(p, {
-        force: true
-      })));
-      throw e;
-    }
-    scanFilepaths.push(...factsSlot.generated.paths);
+    factsSlot.generated = await generateSocketFactsForFix({
+      cwd,
+      excludePaths,
+      findFactsPaths: async () => (await findScanFilepaths()).filter(utils.isSocketFactsFile),
+      tmpDir: factsSlot.tmpDir
+    });
+    const known = new Set(scanFilepaths);
+    scanFilepaths.push(...factsSlot.generated.paths.filter(p => !known.has(p)));
     if (!silence) {
       spinner?.start();
     }
   }
   const sidecarFile = factsSlot?.generated?.sidecarFile;
-  // Discovery only needs which artifacts the facts files resolve; applying
-  // fixes also needs each project's exact classpath from the sidecar.
+  // Discovery only needs which artifacts the facts files resolve. Applying
+  // fixes reads each project's tree; a Coana predating facts trees can only
+  // tell from the sidecar's classpaths which projects resolve an artifact.
   const discoveryFlags = factsSlot ? ['--maven-use-only-socket-facts'] : [];
   const factsFlags = [...discoveryFlags, ...(sidecarFile ? ['--compute-artifacts-sidecar', sidecarFile] : [])];
   const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, scanFilepaths, {
@@ -9897,7 +9976,7 @@ const reachabilityFlags = {
   reachRetainFactsFile: {
     type: 'boolean',
     default: false,
-    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh full application reachability scan. A stale `.socket.facts.json` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.'
+    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. Delete it once inspected: later reachability scans ignore it, but a scan without --reach uploads it as an SBOM carrying stale reachability results.'
   },
   reachSkipCache: {
     type: 'boolean',
@@ -12904,7 +12983,10 @@ const config$d = {
       $ ${command} [options] [CWD=.]
 
     Recursively walks CWD, discovers independent gradle, sbt, and maven build
-    roots, and generates a Socket facts SBOM (.socket.facts.json) for each,
+    roots, and generates a Socket facts SBOM for each
+    (pom.xml.socket.facts.json, gradle.socket.facts.json, or
+    sbt.socket.facts.json, so builds sharing a directory never overwrite each
+    other),
     skipping subproject/reactor-module directories a parent build root already
     covers. Unlike \`socket manifest auto\`, this looks beyond CWD itself.
 
@@ -12993,11 +13075,11 @@ const config$c = {
     },
     facts: {
       type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+      description: 'Emit a Socket facts JSON file (`gradle.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
     },
     pom: {
       type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`gradle.socket.facts.json`)'
     },
     includeConfigs: {
       type: 'string',
@@ -13028,9 +13110,9 @@ const config$c = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build, using gradle (preferably your local
-    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+    By default, emits a single \`gradle.socket.facts.json\` describing the
+    resolved dependency graph of the whole build, using gradle (preferably your
+    local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
     --include-configs / --exclude-configs (comma-separated glob patterns) to
     control which configurations are resolved (e.g.
     --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and
@@ -13247,11 +13329,11 @@ const config$b = {
     },
     facts: {
       type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+      description: 'Emit a Socket facts JSON file (`gradle.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
     },
     pom: {
       type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`gradle.socket.facts.json`)'
     },
     includeConfigs: {
       type: 'string',
@@ -13282,9 +13364,9 @@ const config$b = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build, using gradle (preferably your local
-    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+    By default, emits a single \`gradle.socket.facts.json\` describing the
+    resolved dependency graph of the whole build, using gradle (preferably your
+    local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
     --include-configs / --exclude-configs (comma-separated glob patterns) to
     control which configurations are resolved (e.g.
     --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and
@@ -13521,8 +13603,8 @@ const config$a = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    Emits a single \`.socket.facts.json\` describing the resolved dependency
-    graph of your Maven project, using maven (\`mvn\` on PATH by default). It
+    Emits a single \`pom.xml.socket.facts.json\` (named after the POM Maven
+    runs on) describing the resolved dependency graph of your Maven project, using maven (\`mvn\` on PATH by default). It
     reads dependency metadata only and never downloads artifacts; an unresolved
     dependency is a fatal error. You can pass --include-configs /
     --exclude-configs (comma-separated glob patterns) to control which Maven
@@ -13685,11 +13767,11 @@ const config$9 = {
     },
     facts: {
       type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+      description: 'Emit a Socket facts JSON file (`sbt.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
     },
     pom: {
       type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`sbt.socket.facts.json`)'
     },
     includeConfigs: {
       type: 'string',
@@ -13706,7 +13788,7 @@ const config$9 = {
     },
     out: {
       type: 'string',
-      description: 'Only with --pom: path of the output `pom.xml`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as `.socket.facts.json`)'
+      description: 'Only with --pom: path of the output `pom.xml`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as `sbt.socket.facts.json`)'
     },
     stdout: {
       type: 'boolean',
@@ -13728,8 +13810,8 @@ const config$9 = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build. It reads dependency metadata only and
+    By default, emits a single \`sbt.socket.facts.json\` describing the
+    resolved dependency graph of the whole build. It reads dependency metadata only and
     never downloads artifacts; an unresolved dependency is a fatal error. You
     can pass --include-configs / --exclude-configs (comma-separated glob
     patterns) to control which sbt configurations are resolved (e.g.
@@ -13910,7 +13992,7 @@ async function run$A(argv, importMeta, {
   //       would the file name be?
 
   // --out / --stdout only affect the pom path. Socket facts are always written
-  // to the project root as `.socket.facts.json` so that `socket scan create`
+  // to the project root as `sbt.socket.facts.json` so that `socket scan create`
   // picks them up, so reject these flags in facts mode rather than silently
   // ignoring an explicitly-passed output location.
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -13921,7 +14003,7 @@ async function run$A(argv, importMeta, {
   }, {
     nook: true,
     test: !(facts && (cli.flags['out'] !== undefined || cli.flags['stdout'] !== undefined)),
-    message: 'The `--out` and `--stdout` options only apply with `--pom`; Socket facts are always written to the project root as `.socket.facts.json`',
+    message: 'The `--out` and `--stdout` options only apply with `--pom`; Socket facts are always written to the project root as `sbt.socket.facts.json`',
     fail: 'remove --out/--stdout, or pass --pom'
   });
   if (!wasValidInput) {
@@ -14514,7 +14596,7 @@ async function askForFactsFlag(current) {
     choices: [{
       name: 'Socket facts (default)',
       value: 'yes',
-      description: 'Generate a .socket.facts.json file describing the resolved dependency graph'
+      description: 'Generate a Socket facts file (*.socket.facts.json) describing the resolved dependency graph'
     }, {
       name: 'pom.xml',
       value: 'no',
@@ -24478,5 +24560,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=40113ed0-ae58-43eb-a197-d1810801160e
+//# debugId=e5b43908-d002-4c63-b2f7-4c7336aacdb4
 //# sourceMappingURL=cli.js.map