@socketsecurity/cli-with-sentry 1.7.0 → 1.8.1

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.8.1](https://github.com/SocketDev/socket-cli/releases/tag/v1.8.1) - 2026-10-12
+
+### Changed
+- Updated the Coana CLI to v `15.12.7`.
+
+## [1.8.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.8.0) - 2026-10-12
+
+### Changed
+- Socket facts for Maven, Gradle and sbt builds now record each subproject's own dependency tree, so a package is attributed only to the subprojects that actually pull it in.
+- `socket fix` now accepts existing Socket facts files instead of asking you to delete them first.
+- Updated the Coana CLI to v `15.12.5`.
+
+### Fixed
+- Socket facts for sbt builds now match sbt's own classpaths: dependencies pulled in by a version-conflict winner are no longer dropped, and sibling subprojects appear only in the configurations that actually depend on them.
+
 ## [1.7.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.7.0) - 2026-10-09
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.1/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.1/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -171,8 +171,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.1/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.1/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.1/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -1857,8 +1857,12 @@ withPaths = true) {
   };
   acc.set(factsFile, {
     components: facts.components.map(paths),
-    projects: (facts.projects ?? []).map(proj => ({
+    projects: (facts.projects ?? []).map(({
+      children: _children,
+      ...proj
+    }) => ({
       ...paths(proj),
+      dependencies: [...(artifactPaths.directDependenciesByProject.get(proj.id) ?? [])],
       classpath: [...(artifactPaths.classpathByProject.get(proj.id) ?? [])]
     }))
   });
@@ -2670,16 +2674,17 @@ function renderResolutionErrorReport(failures, scannedConfigs = [], tool = 'grad
 }
 
 const PURL_TYPE_MAVEN = 'maven';
-function assembleFacts(parsed, opts) {
+function assembleFacts(parsed, opts = {}) {
   const fileExists = opts.fileExists ?? fs$1.existsSync;
   const perRoot = buildPerRoot(parsed);
-  const {
-    directByRoot,
-    finalNodes
-  } = mergeById(perRoot);
+  const finalNodes = mergeById(perRoot);
+  const graphs = buildSubprojectGraphs(perRoot);
   const tool = parsed.tool || 'gradle';
-  const components = buildComponents(finalNodes, buildManifestFilesById(parsed, directByRoot, perRoot, opts.factsFileName));
-  const projects = opts.emitProjects === false ? [] : buildProjects(parsed, directByRoot, perRoot);
+  const components = buildComponents(finalNodes);
+  const {
+    dependencies,
+    projects
+  } = buildDependencyGraph(parsed, graphs, components);
   const metadata = {
     format: 'socket-facts-sbom',
     tool,
@@ -2691,7 +2696,8 @@ function assembleFacts(parsed, opts) {
   const facts = projects.length ? {
     metadata,
     projects,
-    components
+    components,
+    dependencies
   } : {
     metadata,
     components
@@ -2699,7 +2705,7 @@ function assembleFacts(parsed, opts) {
   return {
     facts,
     report: buildReport(parsed),
-    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], perRoot, fileExists)
+    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], graphs, fileExists)
   };
 }
 
@@ -2758,17 +2764,15 @@ function buildPerRoot(parsed) {
 // reachability, which needs each subproject's exact classpath.
 function mergeById(perRoot) {
   const finalNodes = new Map();
-  const directByRoot = new Map();
-  for (const [rootId, {
+  for (const {
     nodes,
     prod
-  }] of perRoot) {
+  } of perRoot.values()) {
     for (const [coordId, node] of nodes) {
       let fn = finalNodes.get(coordId);
       if (!fn) {
         fn = {
           coord: node.coord,
-          children: new Set(),
           prod: false,
           direct: false,
           project: node.project,
@@ -2782,56 +2786,14 @@ function mergeById(perRoot) {
       if (node.direct) {
         fn.direct = true;
       }
-      for (const c of node.children) {
-        fn.children.add(c);
-      }
       for (const t of node.targets) {
         fn.targets.add(t);
       }
-      if (node.direct) {
-        let d = directByRoot.get(rootId);
-        if (!d) {
-          d = new Set();
-          directByRoot.set(rootId, d);
-        }
-        d.add(coordId);
-      }
-    }
-  }
-  return {
-    finalNodes,
-    directByRoot
-  };
-}
-function buildManifestFilesById(parsed, directByRoot, perRoot, factsFileName) {
-  const buildFilesByCoord = new Map();
-  for (const [rootId, ids] of directByRoot) {
-    const root = perRoot.get(rootId);
-    const project = parsed.projects.get(root?.projectKey ?? '');
-    for (const id of ids) {
-      let set = buildFilesByCoord.get(id);
-      if (!set) {
-        set = new Set();
-        buildFilesByCoord.set(id, set);
-      }
-      const coord = root?.nodes.get(id)?.coord;
-      // Without a known declaring script, the project's build file, even one
-      // absent on disk: its presence marks the dependency direct here.
-      const declared = coord && project?.declaredIn.get(`${coord.group}:${coord.name}`);
-      const files = declared ?? [...(project?.buildFiles ?? []), ...(project?.missingBuildFiles ?? [])];
-      for (const f of files) {
-        set.add(f);
-      }
     }
   }
-  return new Map([...buildFilesByCoord].map(({
-    0: id,
-    1: buildFiles
-  }) => [id, [...(factsFileName ? [factsFileName] : []), ...[...buildFiles].sort()].map(file => ({
-    file
-  }))]));
+  return finalNodes;
 }
-function buildComponents(finalNodes, manifestFilesById) {
+function buildComponents(finalNodes) {
   return [...finalNodes.keys()].sort().map(id => {
     const fn = finalNodes.get(id);
     const c = fn.coord;
@@ -2865,92 +2827,188 @@ function buildComponents(finalNodes, manifestFilesById) {
     if (fn.project) {
       comp.firstParty = true;
     }
-    if (fn.children.size) {
-      comp.dependencies = [...fn.children].sort();
-    }
-    const manifestFiles = manifestFilesById.get(id);
-    if (manifestFiles) {
-      comp.manifestFiles = manifestFiles;
-    }
     return comp;
   });
 }
-function buildProjects(parsed, directByRoot, perRoot) {
-  const directByProject = new Map();
-  for (const [rootId, ids] of directByRoot) {
-    const pk = perRoot.get(rootId)?.projectKey ?? '';
-    let set = directByProject.get(pk);
-    if (!set) {
-      set = new Set();
-      directByProject.set(pk, set);
+
+// One graph per subproject, its configurations merged.
+function buildSubprojectGraphs(perRoot) {
+  const graphs = new Map();
+  for (const {
+    nodes,
+    projectKey
+  } of perRoot.values()) {
+    let g = graphs.get(projectKey);
+    if (!g) {
+      g = {
+        children: new Map(),
+        direct: new Set()
+      };
+      graphs.set(projectKey, g);
     }
-    for (const id of ids) {
-      set.add(id);
+    for (const [coordId, node] of nodes) {
+      let set = g.children.get(coordId);
+      if (!set) {
+        set = new Set();
+        g.children.set(coordId, set);
+      }
+      for (const c of node.children) {
+        set.add(c);
+      }
+      if (node.direct) {
+        g.direct.add(coordId);
+      }
     }
   }
-  const projects = [...parsed.projects.values()].map(p => {
-    const entry = {
-      id: p.projectKey,
-      type: PURL_TYPE_MAVEN,
-      namespace: p.group,
-      name: p.name,
-      ...(p.version ? {
-        version: p.version
-      } : {}),
-      subprojectDir: p.dir,
-      dependencies: [...(directByProject.get(p.projectKey) ?? [])].sort()
-    };
-    // A project without a build file of its own is defined by the scripts
-    // declaring its dependencies, e.g. the root build script.
-    const declared = [...new Set([...p.declaredIn.values()].flat())];
-    const files = p.buildFiles.length ? p.buildFiles : declared.length ? declared : p.missingBuildFiles;
-    if (files.length) {
-      entry.manifestFiles = [...files].sort().map(file => ({
-        file
-      }));
+  return graphs;
+}
+
+// Equal subtrees share an entry; partition refinement (coarsest bisimulation)
+// keeps that exact on cycles too.
+function buildDependencyGraph(parsed, graphs, components) {
+  const componentIndex = new Map(components.map((c, i) => [c.id, i]));
+  const vertexIds = new Map();
+  const labels = [];
+  const edges = [];
+  const vertex = (projectKey, coordId) => {
+    const key = `${projectKey}\t${coordId}`;
+    let v = vertexIds.get(key);
+    if (v === undefined) {
+      v = labels.length;
+      vertexIds.set(key, v);
+      labels.push(componentIndex.get(coordId));
+      edges.push([]);
+    }
+    return v;
+  };
+  for (const [projectKey, {
+    children
+  }] of graphs) {
+    for (const [coordId, kids] of children) {
+      const v = vertex(projectKey, coordId);
+      for (const c of kids) {
+        edges[v].push(vertex(projectKey, c));
+      }
     }
-    return entry;
-  });
-  projects.sort((a, b) => {
-    const ka = `${a.subprojectDir} ${a.namespace}:${a.name}`;
-    const kb = `${b.subprojectDir} ${b.namespace}:${b.name}`;
+  }
+
+  // Each round splits blocks by their children's blocks; a round that splits
+  // nothing is stable.
+  let block = [...labels];
+  let blockCount = new Set(block).size;
+  for (;;) {
+    const ids = new Map();
+    block = block.map((b, v) => {
+      const childBlocks = [...new Set(edges[v].map(c => block[c]))].sort((x, y) => x - y);
+      const sig = `${b}:${childBlocks.join(',')}`;
+      let id = ids.get(sig);
+      if (id === undefined) {
+        id = ids.size;
+        ids.set(sig, id);
+      }
+      return id;
+    });
+    if (ids.size === blockCount) {
+      break;
+    }
+    blockCount = ids.size;
+  }
+  const byComponent = (a, b) => componentIndex.get(a) - componentIndex.get(b);
+  const projects = [...parsed.projects.values()].map(p => ({
+    p,
+    roots: treeRoots(p.projectKey, graphs.get(p.projectKey), byComponent)
+  })).sort((a, b) => {
+    const ka = `${a.p.dir} ${a.p.group}:${a.p.name}`;
+    const kb = `${b.p.dir} ${b.p.group}:${b.p.name}`;
     return ka < kb ? -1 : ka > kb ? 1 : 0;
   });
-  return projects;
-}
-function buildClasspathByProject(projects, perRoot) {
-  const idsByProjectKey = new Map();
-  for (const {
-    nodes,
-    projectKey
-  } of perRoot.values()) {
-    let set = idsByProjectKey.get(projectKey);
-    if (!set) {
-      set = new Set();
-      idsByProjectKey.set(projectKey, set);
+
+  // Post-order over the sorted projects, so the numbering is stable.
+  const indexOfBlock = new Map();
+  const vertexOfBlock = new Map();
+  const dependencies = [];
+  const visit = v => {
+    const b = block[v];
+    if (vertexOfBlock.has(b)) {
+      return;
     }
-    for (const coordId of nodes.keys()) {
-      set.add(coordId);
+    vertexOfBlock.set(b, v);
+    for (const c of [...edges[v]].sort((x, y) => labels[x] - labels[y])) {
+      visit(c);
+    }
+    indexOfBlock.set(b, dependencies.length);
+    dependencies.push({
+      component: labels[v]
+    });
+  };
+  const indexOf = v => indexOfBlock.get(block[v]);
+  for (const {
+    p,
+    roots
+  } of projects) {
+    for (const coordId of roots) {
+      visit(vertex(p.projectKey, coordId));
     }
   }
-  const classpathByProject = new Map();
-  for (const p of projects) {
-    const key = p.projectKey;
-    let set = classpathByProject.get(key);
-    if (!set) {
-      set = new Set();
-      classpathByProject.set(key, set);
+  for (const [b, v] of vertexOfBlock) {
+    const children = [...new Set(edges[v].map(indexOf))].sort((x, y) => x - y);
+    if (children.length) {
+      dependencies[indexOfBlock.get(b)].children = children;
     }
-    for (const id of idsByProjectKey.get(p.projectKey) ?? []) {
-      set.add(id);
+  }
+  return {
+    dependencies,
+    projects: projects.map(({
+      p,
+      roots
+    }) => {
+      const entry = {
+        id: p.projectKey,
+        type: PURL_TYPE_MAVEN,
+        namespace: p.group,
+        name: p.name,
+        ...(p.version ? {
+          version: p.version
+        } : {}),
+        subprojectDir: p.dir,
+        children: roots.map(coordId => indexOf(vertex(p.projectKey, coordId))).sort((x, y) => x - y)
+      };
+      if (p.buildFiles.length) {
+        entry.manifestFiles = [...new Set(p.buildFiles)].sort().map(file => ({
+          file
+        }));
+      }
+      return entry;
+    })
+  };
+}
+function treeRoots(projectKey, graph, byComponent) {
+  if (!graph) {
+    return [];
+  }
+  const roots = [...graph.direct].sort(byComponent);
+  const reached = new Set();
+  const stack = [...roots];
+  while (stack.length) {
+    const id = stack.pop();
+    if (!reached.has(id)) {
+      reached.add(id);
+      stack.push(...graph.children.get(id));
     }
   }
-  return new Map([...classpathByProject].map(({
-    0: key,
-    1: ids
-  }) => [key, [...ids].sort()]));
+  const unreached = [...graph.children.keys()].filter(id => !reached.has(id));
+  if (unreached.length) {
+    throw new Error(`Resolved dependencies of ${projectKey} are not reachable from its direct dependencies: ${unreached.sort(byComponent).join(', ')}`);
+  }
+  return roots;
+}
+function byProject(projects, graphs, ids) {
+  return new Map(projects.map(p => {
+    const g = graphs.get(p.projectKey);
+    return [p.projectKey, g ? [...ids(g)].sort() : []];
+  }));
 }
-function buildArtifactPaths(finalNodes, projects, perRoot, fileExists) {
+function buildArtifactPaths(finalNodes, projects, graphs, fileExists) {
   const pathsById = new Map();
   for (const [id, fn] of finalNodes) {
     if (!fn.project) {
@@ -2970,7 +3028,8 @@ function buildArtifactPaths(finalNodes, projects, perRoot, fileExists) {
   }
   return {
     pathsById,
-    classpathByProject: buildClasspathByProject(projects, perRoot)
+    classpathByProject: byProject(projects, graphs, g => g.children.keys()),
+    directDependenciesByProject: byProject(projects, graphs, g => g.direct)
   };
 }
 function buildReport(parsed) {
@@ -3146,8 +3205,7 @@ function serializeExcludePathPatterns(paths) {
 //   project     projectKey  group  name  version  dir
 //   projectSrc  projectKey  path                         (--with-files only)
 //   projectTgt  projectKey  path                         (--with-files only)
-//   projectBuild  projectKey  path  [missing]            (build-root-relative; `missing`: configured, absent on disk)
-//   declared    projectKey  group  name  path            (script declaring the dependency; build-root-relative)
+//   projectBuild  projectKey  path                     (build-root-relative; may be absent on disk)
 //   root        rootId  projectKey  config  prod(0|1)
 //   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)  project
 //   edge        rootId  parentCoordId  childCoordId
@@ -3222,9 +3280,7 @@ function parseRecords(text) {
         dir: '',
         sources: [],
         targets: [],
-        buildFiles: [],
-        missingBuildFiles: [],
-        declaredIn: new Map()
+        buildFiles: []
       };
       result.projects.set(key, p);
     }
@@ -3268,17 +3324,7 @@ function parseRecords(text) {
         break;
       case 'projectBuild':
         if (f[2]) {
-          const p = project(f[1] ?? '');
-          (f[3] === 'missing' ? p.missingBuildFiles : p.buildFiles).push(f[2]);
-        }
-        break;
-      case 'declared':
-        if (f[4]) {
-          const {
-            declaredIn
-          } = project(f[1] ?? '');
-          const ga = `${f[2] ?? ''}:${f[3] ?? ''}`;
-          declaredIn.set(ga, [...(declaredIn.get(ga) ?? []), f[4]]);
+          project(f[1] ?? '').buildFiles.push(f[2]);
         }
         break;
       case 'root':
@@ -3419,9 +3465,7 @@ async function assembleFromRecords(tool, out, recordsFile) {
     artifactPaths,
     facts,
     report
-  } = assembleFacts(parsed, {
-    factsFileName
-  });
+  } = assembleFacts(parsed);
   return {
     buildRoot: parsed.buildRoot || undefined,
     code: out.code,
@@ -8868,49 +8912,75 @@ async function getFixEnv() {
   };
 }
 
-// Backed up so each fix attempt sees the pre-fix build after `git clean`.
-async function generateSocketFactsForFix({
-  cwd,
-  excludePaths,
-  tmpDir
-}) {
-  const {
-    factsPaths,
-    resolvedPathsSidecar
-  } = await runDynamicSbomInference({
-    cwd,
-    excludePaths,
-    sbtTmpDir: undefined,
-    sidecar: true,
-    withFiles: false
+async function backUp(sources, dir) {
+  await fs.mkdir(dir, {
+    recursive: true
   });
-  const sidecarFile = resolvedPathsSidecar ? path.join(tmpDir, 'sidecar.json') : undefined;
-  if (sidecarFile) {
-    await fs.writeFile(sidecarFile, JSON.stringify(resolvedPathsSidecar));
-  }
-  const paths = factsPaths.map(p => path.resolve(cwd, p));
-  const backups = await Promise.all(paths.map(async (source, index) => {
-    const backup = path.join(tmpDir, `${index}.json`);
+  return await Promise.all(sources.map(async (source, index) => {
+    const backup = path.join(dir, `${index}.json`);
     await fs.copyFile(source, backup);
     return {
       backup,
       source
     };
   }));
+}
+async function restoreAll(backups) {
+  await Promise.all(backups.map(({
+    backup,
+    source
+  }) => fs.copyFile(backup, source)));
+}
+
+// Backed up so each fix attempt sees the pre-fix build after `git clean`, and
+// facts files already present are left as they were found.
+async function generateSocketFactsForFix({
+  cwd,
+  excludePaths,
+  findFactsPaths,
+  tmpDir
+}) {
+  const existingPaths = await findFactsPaths();
+  const originals = await backUp(existingPaths, path.join(tmpDir, 'existing'));
+  const existing = new Set(existingPaths);
+  const reset = async written => {
+    await Promise.all(written.filter(p => !existing.has(p)).map(p => fs.rm(p, {
+      force: true
+    })));
+    await restoreAll(originals);
+  };
+  let paths;
+  let sidecarFile;
+  try {
+    const {
+      factsPaths,
+      resolvedPathsSidecar
+    } = await runDynamicSbomInference({
+      cwd,
+      excludePaths,
+      sbtTmpDir: undefined,
+      sidecar: true,
+      withFiles: false
+    });
+    paths = factsPaths.map(p => path.resolve(cwd, p));
+    if (resolvedPathsSidecar) {
+      sidecarFile = path.join(tmpDir, 'sidecar.json');
+      await fs.writeFile(sidecarFile, JSON.stringify(resolvedPathsSidecar));
+    }
+  } catch (e) {
+    // A failed build root aborts inference after others wrote their facts.
+    await reset(await findFactsPaths());
+    throw e;
+  }
+  const generated = new Set(paths);
+  const backups = [...originals.filter(({
+    source
+  }) => !generated.has(source)), ...(await backUp(paths, path.join(tmpDir, 'generated')))];
   return {
     paths,
     sidecarFile,
-    async remove() {
-      await Promise.all(paths.map(p => fs.rm(p, {
-        force: true
-      })));
-    },
-    async restore() {
-      await Promise.all(backups.map(({
-        backup,
-        source
-      }) => fs.copyFile(backup, source)));
-    }
+    remove: () => reset(paths),
+    restore: () => restoreAll(backups)
   };
 }
 
@@ -9121,51 +9191,36 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
   // sibling manifest's references). --exclude stays separate as a hidden
   // legacy escape hatch for the narrower "fix-application only" semantic.
   const coanaExcludePatterns = [...exclude, ...excludePaths];
-  const findScanFilepaths = () => utils.getPackageFilesForScan(['.'], supportedFiles, {
+  const findScanFilepaths = async () => (await utils.getPackageFilesForScan(['.'], supportedFiles, {
     additionalIgnores,
     config: socketConfig,
     cwd
-  });
+  })).filter(p => !utils.isReachabilityReportPath(p, {
+    cwd,
+    outputPath: constants.DOT_SOCKET_DOT_FACTS_JSON
+  }));
   const scanFilepaths = await findScanFilepaths();
-  // Facts files are analysis artifacts and must be removed before re-running fix.
-  const factsFiles = scanFilepaths.filter(utils.isSocketFactsFile);
-  if (factsFiles.length) {
-    if (!silence) {
-      spinner?.stop();
-    }
-    return {
-      ok: false,
-      message: 'Found Socket facts files in manifest files',
-      cause: `Delete the following ${words.pluralize('file', factsFiles.length)} before running socket fix again:\n` + factsFiles.map(p => `  - ${p}`).join('\n')
-    };
-  }
   if (factsSlot) {
     if (!silence) {
       spinner?.stop();
       logger.logger.info('Generating Socket facts for Gradle, sbt and Maven builds ...');
     }
-    try {
-      factsSlot.generated = await generateSocketFactsForFix({
-        cwd,
-        excludePaths,
-        tmpDir: factsSlot.tmpDir
-      });
-    } catch (e) {
-      // A failed build root aborts inference after others wrote their facts.
-      const partial = (await findScanFilepaths()).filter(utils.isSocketFactsFile);
-      await Promise.all(partial.map(p => fs$1.promises.rm(p, {
-        force: true
-      })));
-      throw e;
-    }
-    scanFilepaths.push(...factsSlot.generated.paths);
+    factsSlot.generated = await generateSocketFactsForFix({
+      cwd,
+      excludePaths,
+      findFactsPaths: async () => (await findScanFilepaths()).filter(utils.isSocketFactsFile),
+      tmpDir: factsSlot.tmpDir
+    });
+    const known = new Set(scanFilepaths);
+    scanFilepaths.push(...factsSlot.generated.paths.filter(p => !known.has(p)));
     if (!silence) {
       spinner?.start();
     }
   }
   const sidecarFile = factsSlot?.generated?.sidecarFile;
-  // Discovery only needs which artifacts the facts files resolve; applying
-  // fixes also needs each project's exact classpath from the sidecar.
+  // Discovery only needs which artifacts the facts files resolve. Applying
+  // fixes reads each project's tree; a Coana predating facts trees can only
+  // tell from the sidecar's classpaths which projects resolve an artifact.
   const discoveryFlags = factsSlot ? ['--maven-use-only-socket-facts'] : [];
   const factsFlags = [...discoveryFlags, ...(sidecarFile ? ['--compute-artifacts-sidecar', sidecarFile] : [])];
   const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, scanFilepaths, {
@@ -24505,5 +24560,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=679b39e8-2ace-4602-9ad0-c5cf11bec9e3
+//# debugId=e5b43908-d002-4c63-b2f7-4c7336aacdb4
 //# sourceMappingURL=cli.js.map