@socketsecurity/cli 1.1.179 → 1.2.0

package/dist/cli.js

@@ -1878,11 +1878,16 @@ function sortByPurl(entries) {
 // A second call for the same factsFile (a dual-marker directory where two
 // build tools both target it) overwrites rather than merges, matching the
 // existing last-writer-wins convention for that case.
-function accumulateSidecar(acc, facts, artifactPaths, factsFile) {
+function accumulateSidecar(acc, facts, artifactPaths, factsFile,
+// Off when artifact paths were not resolved; entries then omit `targets` and `sources`.
+withPaths = true) {
+  const paths = entry => withPaths ? attachPaths(entry, artifactPaths) : {
+    ...entry
+  };
   acc.set(factsFile, {
-    components: facts.components.map(comp => attachPaths(comp, artifactPaths)),
+    components: facts.components.map(paths),
     projects: (facts.projects ?? []).map(proj => ({
-      ...attachPaths(proj, artifactPaths),
+      ...paths(proj),
       classpath: [...(artifactPaths.classpathByProject.get(projectClasspathKey(proj)) ?? [])]
     }))
   });
@@ -3695,12 +3700,12 @@ async function runManifestFacts({
     facts.metadata.socketCliVersion = socketCliVersion;
   }
   await fs$1.promises.writeFile(factsPath, JSON.stringify(facts), 'utf8');
-  if (withFiles && sidecarAcc) {
+  if (sidecarAcc) {
     // Key by the symlink-resolved path so the sidecar's keys are comparable
     // regardless of which caller's cwd it was joined against (the recursive
     // discovery path already resolves symlinks before this point; the plain
     // single-root path does not).
-    accumulateSidecar(sidecarAcc, facts, artifactPaths, await utils.realpathOrResolved(factsPath));
+    accumulateSidecar(sidecarAcc, facts, artifactPaths, await utils.realpathOrResolved(factsPath), !!withFiles);
   }
   logger.logger.success('Generated Socket facts');
   return {
@@ -3971,9 +3976,10 @@ async function runDynamicSbomInference({
   cwd,
   excludePaths,
   sbtTmpDir,
+  sidecar,
   withFiles
 }) {
-  const sidecarAcc = withFiles ? new Map() : undefined;
+  const sidecarAcc = sidecar ?? withFiles ? new Map() : undefined;
   const outcomes = await generateRecursiveManifests({
     cwd,
     excludePaths,
@@ -4002,6 +4008,16 @@ async function runDynamicSbomInference({
 // The point here is to attempt to detect the various supported manifest files
 // the CLI can generate. This would be environments that we can't do server side
 
+// Conda reads both spellings of the environment file.
+function findCondaFile(cwd) {
+  if (fs$1.existsSync(path.join(cwd, constants.ENVIRONMENT_YML))) {
+    return constants.ENVIRONMENT_YML;
+  }
+  if (fs$1.existsSync(path.join(cwd, constants.ENVIRONMENT_YAML))) {
+    return constants.ENVIRONMENT_YAML;
+  }
+  return '';
+}
 async function detectManifestActions(
 // Passing in null means we attempt detection for every supported language
 // regardless of local socket.json status. Sometimes we want that.
@@ -4012,6 +4028,7 @@ sockJson, cwd = process.cwd()) {
     // TODO
     count: 0,
     conda: false,
+    condaFile: '',
     gradle: false,
     maven: false,
     sbt: false
@@ -4049,13 +4066,11 @@ sockJson, cwd = process.cwd()) {
   if (sockJson?.defaults?.manifest?.conda?.disabled) {
     debug.debugLog('notice', `[DEBUG] - conda auto-detection is disabled in ${constants.SOCKET_JSON}`);
   } else {
-    const envyml = path.join(cwd, constants.ENVIRONMENT_YML);
-    const hasEnvyml = fs$1.existsSync(envyml);
-    const envyaml = path.join(cwd, constants.ENVIRONMENT_YAML);
-    const hasEnvyaml = !hasEnvyml && fs$1.existsSync(envyaml);
-    if (hasEnvyml || hasEnvyaml) {
-      debug.debugLog('notice', '[DEBUG] - Detected an environment.yml Conda file');
+    const condaFile = findCondaFile(cwd);
+    if (condaFile) {
+      debug.debugLog('notice', `[DEBUG] - Detected the Conda file ${condaFile}`);
       output.conda = true;
+      output.condaFile = condaFile;
       output.count += 1;
     }
   }
@@ -6898,7 +6913,10 @@ async function handleManifestConda({
   verbose
 }) {
   const data = await convertCondaToRequirements(filename, cwd, verbose);
-  await outputRequirements(data, outputKind, out);
+
+  // --auto-manifest only collects the generated file when it lands inside
+  // the dir being scanned.
+  await outputRequirements(data, outputKind, out === '-' ? out : path.resolve(cwd, out));
 }
 
 // Under --auto-manifest, a manifest generator that failed — raising the exit
@@ -7018,14 +7036,17 @@ async function generateAutoManifest({
     abortManifestRunIfFailed('maven', beforeExitCode);
   }
   if (!sockJson?.defaults?.manifest?.conda?.disabled && detected.conda) {
-    logger.logger.log('Detected an environment.yml file, running default Conda generator...');
+    const condaFile = sockJson.defaults?.manifest?.conda?.infile || detected.condaFile || constants.ENVIRONMENT_YML;
+    logger.logger.log(`Detected ${condaFile}, running default Conda generator...`);
+    const beforeExitCode = process.exitCode;
     await handleManifestConda({
       cwd,
-      filename: sockJson.defaults?.manifest?.conda?.infile ?? 'environment.yml',
+      filename: condaFile,
       outputKind,
       out: sockJson.defaults?.manifest?.conda?.outfile ?? constants.REQUIREMENTS_TXT,
       verbose: Boolean(sockJson.defaults?.manifest?.conda?.verbose)
     });
+    abortManifestRunIfFailed('conda', beforeExitCode);
   }
   if (!sockJson?.defaults?.manifest?.bazel?.disabled && detected.bazel) {
     const bazelConfig = sockJson?.defaults?.manifest?.bazel;
@@ -8802,6 +8823,52 @@ async function getFixEnv() {
   };
 }
 
+// Backed up so each fix attempt sees the pre-fix build after `git clean`.
+async function generateSocketFactsForFix({
+  cwd,
+  excludePaths,
+  tmpDir
+}) {
+  const {
+    factsPaths,
+    resolvedPathsSidecar
+  } = await runDynamicSbomInference({
+    cwd,
+    excludePaths,
+    sbtTmpDir: undefined,
+    sidecar: true,
+    withFiles: false
+  });
+  const sidecarFile = resolvedPathsSidecar ? path.join(tmpDir, 'sidecar.json') : undefined;
+  if (sidecarFile) {
+    await fs.writeFile(sidecarFile, JSON.stringify(resolvedPathsSidecar));
+  }
+  const paths = factsPaths.map(p => path.resolve(cwd, p));
+  const backups = await Promise.all(paths.map(async (source, index) => {
+    const backup = path.join(tmpDir, `${index}.json`);
+    await fs.copyFile(source, backup);
+    return {
+      backup,
+      source
+    };
+  }));
+  return {
+    paths,
+    sidecarFile,
+    async remove() {
+      await Promise.all(paths.map(p => fs.rm(p, {
+        force: true
+      })));
+    },
+    async restore() {
+      await Promise.all(backups.map(({
+        backup,
+        source
+      }) => fs.copyFile(backup, source)));
+    }
+  };
+}
+
 async function readStructuredDiscoveryResult(outputFile, silence) {
   let raw;
   try {
@@ -8861,6 +8928,7 @@ async function discoverGhsaIds(orgSlug, tarHash, options) {
   const {
     cwd = process.cwd(),
     ecosystems,
+    factsFlags = [],
     packageManagers,
     silence = false,
     spinner
@@ -8873,7 +8941,7 @@ async function discoverGhsaIds(orgSlug, tarHash, options) {
   // filteredArtifactCount }) via --output-file (available since coana 15.9.7,
   // older than the pinned @coana-tech/cli version).
   const outputFile = path.join(os.tmpdir(), `socket-fix-discovery-${Date.now()}.json`);
-  const foundCResult = await utils.spawnCoanaDlx(['find-vulnerabilities', cwd, '--manifests-tar-hash', tarHash, '--output-file', outputFile, ...(ecosystems?.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers?.length ? ['--package-managers', ...packageManagers] : [])], orgSlug, {
+  const foundCResult = await utils.spawnCoanaDlx(['find-vulnerabilities', cwd, '--manifests-tar-hash', tarHash, '--output-file', outputFile, ...(ecosystems?.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers?.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags], orgSlug, {
     cwd,
     spinner: silence ? undefined : spinner,
     coanaVersion: options?.coanaVersion
@@ -8894,7 +8962,32 @@ async function discoverGhsaIds(orgSlug, tarHash, options) {
     }).catch(() => {});
   }
 }
+function isFactsFile(filepath) {
+  return path.basename(filepath).toLowerCase() === constants.DOT_SOCKET_DOT_FACTS_JSON;
+}
+function readWrittenFiles(outputFile) {
+  const result = fs$2.readJsonSync(outputFile, {
+    throws: false
+  });
+  const files = result?.modifiedFiles;
+  return Array.isArray(files) && files.every(f => typeof f === 'string') ? new Set(files) : undefined;
+}
 async function coanaFix(fixConfig) {
+  if (!fixConfig.dynamicSbomInference) {
+    return await coanaFixWithFacts(fixConfig, undefined);
+  }
+  return await utils.withTmpDir('socket-fix-facts-', async tmpDir => {
+    const slot = {
+      tmpDir
+    };
+    try {
+      return await coanaFixWithFacts(fixConfig, slot);
+    } finally {
+      await slot.generated?.remove();
+    }
+  });
+}
+async function coanaFixWithFacts(fixConfig, factsSlot) {
   const {
     all,
     applyFixes,
@@ -8955,14 +9048,15 @@ async function coanaFix(fixConfig) {
   // sibling manifest's references). --exclude stays separate as a hidden
   // legacy escape hatch for the narrower "fix-application only" semantic.
   const coanaExcludePatterns = [...exclude, ...excludePaths];
-  const scanFilepaths = await utils.getPackageFilesForScan(['.'], supportedFiles, {
+  const findScanFilepaths = () => utils.getPackageFilesForScan(['.'], supportedFiles, {
     additionalIgnores,
     config: socketConfig,
     cwd
   });
+  const scanFilepaths = await findScanFilepaths();
   // Fail if any .socket.facts.json files are present in the scan folder.
   // These are analysis artifacts and must be removed before re-running fix.
-  const factsFiles = scanFilepaths.filter(p => path.basename(p).toLowerCase() === constants.DOT_SOCKET_DOT_FACTS_JSON);
+  const factsFiles = scanFilepaths.filter(isFactsFile);
   if (factsFiles.length) {
     if (!silence) {
       spinner?.stop();
@@ -8973,6 +9067,35 @@ async function coanaFix(fixConfig) {
       cause: `Delete the following ${words.pluralize('file', factsFiles.length)} before running socket fix again:\n` + factsFiles.map(p => `  - ${p}`).join('\n')
     };
   }
+  if (factsSlot) {
+    if (!silence) {
+      spinner?.stop();
+      logger.logger.info('Generating Socket facts for Gradle, sbt and Maven builds ...');
+    }
+    try {
+      factsSlot.generated = await generateSocketFactsForFix({
+        cwd,
+        excludePaths,
+        tmpDir: factsSlot.tmpDir
+      });
+    } catch (e) {
+      // A failed build root aborts inference after others wrote their facts.
+      const partial = (await findScanFilepaths()).filter(isFactsFile);
+      await Promise.all(partial.map(p => fs$1.promises.rm(p, {
+        force: true
+      })));
+      throw e;
+    }
+    scanFilepaths.push(...factsSlot.generated.paths);
+    if (!silence) {
+      spinner?.start();
+    }
+  }
+  const sidecarFile = factsSlot?.generated?.sidecarFile;
+  // Discovery only needs which artifacts the facts files resolve; applying
+  // fixes also needs each project's exact classpath from the sidecar.
+  const discoveryFlags = factsSlot ? ['--maven-use-only-socket-facts'] : [];
+  const factsFlags = [...discoveryFlags, ...(sidecarFile ? ['--compute-artifacts-sidecar', sidecarFile] : [])];
   const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, scanFilepaths, {
     pathsRelativeTo: cwd
   }), {
@@ -9023,6 +9146,7 @@ async function coanaFix(fixConfig) {
         coanaVersion,
         cwd,
         ecosystems,
+        factsFlags: discoveryFlags,
         packageManagers,
         silence,
         spinner
@@ -9054,7 +9178,7 @@ async function coanaFix(fixConfig) {
     const tmpDir = os.tmpdir();
     const tmpFile = path.join(tmpDir, `socket-fix-${Date.now()}.json`);
     try {
-      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
         coanaVersion,
         cwd,
         spinner: silence ? undefined : spinner,
@@ -9123,6 +9247,7 @@ async function coanaFix(fixConfig) {
         coanaVersion,
         cwd,
         ecosystems,
+        factsFlags: discoveryFlags,
         packageManagers,
         silence,
         spinner
@@ -9171,13 +9296,17 @@ async function coanaFix(fixConfig) {
     const ghsaId = ids[i];
     debug.debugFn('notice', `check: ${ghsaId}`);
 
+    // Resetting to the base branch cleans the untracked facts files away.
+    // eslint-disable-next-line no-await-in-loop
+    await factsSlot?.generated?.restore();
+
     // Create a temporary file for Coana output.
     const tmpDir = os.tmpdir();
     const tmpFile = path.join(tmpDir, `socket-fix-${ghsaId}-${Date.now()}.json`);
 
     // Apply fix for single GHSA ID.
     // eslint-disable-next-line no-await-in-loop
-    const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ghsaId, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), '--output-file', tmpFile, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+    const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ghsaId, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), '--output-file', tmpFile, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
       coanaVersion,
       cwd,
       spinner: silence ? undefined : spinner,
@@ -9200,7 +9329,12 @@ async function coanaFix(fixConfig) {
     // Check for modified files after applying the fix.
     // eslint-disable-next-line no-await-in-loop
     const unstagedCResult = await utils.gitUnstagedModifiedFiles(cwd);
-    const modifiedFiles = unstagedCResult.ok ? unstagedCResult.data.filter(relPath => scanBaseNames.has(path.basename(relPath))) : [];
+    // Build scripts the fix edits need not be manifests the scan uploads,
+    // and files it creates are untracked.
+    const writtenFiles = readWrittenFiles(tmpFile);
+    // eslint-disable-next-line no-await-in-loop
+    const untrackedCResult = await utils.gitUntrackedFiles(cwd);
+    const modifiedFiles = writtenFiles ? [...(unstagedCResult.ok ? unstagedCResult.data : []), ...(untrackedCResult.ok ? untrackedCResult.data : [])].filter(relPath => writtenFiles.has(relPath)) : unstagedCResult.ok ? unstagedCResult.data.filter(relPath => scanBaseNames.has(path.basename(relPath))) : [];
     if (!modifiedFiles.length) {
       debug.debugFn('notice', `skip: no changes for ${ghsaId}`);
       // Clean up temp file before continuing.
@@ -9516,6 +9650,7 @@ async function handleFix({
   debug: debug$1,
   disableExternalToolChecks,
   disableMajorUpdates,
+  dynamicSbomInference,
   ecosystems,
   exclude,
   excludePaths,
@@ -9545,6 +9680,7 @@ async function handleFix({
     debug: debug$1,
     disableExternalToolChecks,
     disableMajorUpdates,
+    dynamicSbomInference,
     ecosystems,
     exclude,
     excludePaths,
@@ -9571,6 +9707,7 @@ async function handleFix({
     debug: debug$1,
     disableExternalToolChecks,
     disableMajorUpdates,
+    dynamicSbomInference,
     ecosystems,
     exclude,
     excludePaths,
@@ -9594,6 +9731,127 @@ async function handleFix({
   }), outputKind);
 }
 
+// Shared prefix so each command can append what the SBOMs are used for, which
+// differs: reachability is optional on `scan create` and always on for
+// `scan reach`.
+const DYNAMIC_SBOM_INFERENCE_DESCRIPTION = 'For Gradle, sbt, and Maven: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root.';
+const reachabilityFlags = {
+  reachVersion: {
+    type: 'string',
+    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
+  },
+  reachAnalysisMemoryLimit: {
+    type: 'string',
+    default: '8192',
+    description: 'The maximum memory for the reachability analysis as a whole number optionally followed by MB or GB (e.g. 512MB, 8GB). The default is 8GB.'
+  },
+  reachAnalysisTimeout: {
+    type: 'string',
+    default: '',
+    description: 'Set the timeout for the reachability analysis as a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h). Defaults to 10m. Split analysis runs may cause the total scan time to exceed this timeout significantly.'
+  },
+  reachConcurrency: {
+    type: 'number',
+    default: 1,
+    description: 'Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available.'
+  },
+  reachContinueOnAnalysisErrors: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when errors occur (timeouts, OOM, parse errors, etc.), falling back to precomputed reachability results. By default, the CLI halts on analysis errors.'
+  },
+  reachContinueOnInstallErrors: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when package installation fails, falling back to precomputed reachability results. By default, the CLI halts on installation errors.'
+  },
+  reachContinueOnMissingLockFiles: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when a Gradle or SBT project is missing its lock file (or version catalog / pre-generated SBOM). By default, the CLI halts.'
+  },
+  reachContinueOnNoSourceFiles: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when a workspace contains no source files for its ecosystem. By default, the CLI halts.'
+  },
+  reachDisableExternalToolChecks: {
+    type: 'boolean',
+    default: false,
+    description: 'Disable external tool checks during reachability analysis.'
+  },
+  reachDebug: {
+    type: 'boolean',
+    default: false,
+    description: 'Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.'
+  },
+  reachDetailedAnalysisLogFile: {
+    type: 'boolean',
+    default: false,
+    description: 'A log file with detailed analysis logs is written to root of each analyzed workspace.'
+  },
+  reachDisableAnalytics: {
+    type: 'boolean',
+    default: false,
+    description: 'Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.'
+  },
+  reachDisableAnalysisSplitting: {
+    type: 'boolean',
+    default: false,
+    hidden: true,
+    description: 'Deprecated: Analysis splitting is now disabled by default. This flag is a no-op.'
+  },
+  reachEnableAnalysisSplitting: {
+    type: 'boolean',
+    default: false,
+    description: 'Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.'
+  },
+  reachEcosystems: {
+    type: 'string',
+    isMultiple: true,
+    description: `List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Supported: ${utils.getReachabilityEcosystemChoices().join(', ')}. Defaults to all supported ecosystems.`
+  },
+  reachExcludePaths: {
+    type: 'string',
+    isMultiple: true,
+    hidden: true,
+    description: 'Deprecated: use --exclude-paths instead. List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.'
+  },
+  reachFallbackToRegularScan: {
+    type: 'boolean',
+    default: false,
+    description: 'If reachability analysis fails, continue with a regular SCA scan (without reachability results) instead of halting. By default, the CLI halts on reachability errors.'
+  },
+  reachLazyMode: {
+    type: 'boolean',
+    default: false,
+    hidden: true,
+    description: 'Deprecated: lazy mode is no longer supported. This flag is a no-op.'
+  },
+  reachRetainFactsFile: {
+    type: 'boolean',
+    default: false,
+    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh full application reachability scan. A stale `.socket.facts.json` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.'
+  },
+  reachSkipCache: {
+    type: 'boolean',
+    default: false,
+    description: 'Skip caching-based optimizations. By default, the reachability analysis will use cached configurations from previous runs to speed up the analysis.'
+  },
+  reachUseOnlyPregeneratedSboms: {
+    type: 'boolean',
+    default: false,
+    description: 'When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.'
+  }
+};
+const excludePathsFlag$1 = {
+  excludePaths: {
+    type: 'string',
+    isMultiple: true,
+    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
+  }
+};
+
 const CMD_NAME$s = 'fix';
 const DEFAULT_LIMIT = 10;
 const description$z = 'Fix CVEs in dependencies';
@@ -9705,6 +9963,11 @@ Available styles:
     default: false,
     description: 'Disable external tool checks during fix analysis.'
   },
+  dynamicSbomInference: {
+    type: 'boolean',
+    default: false,
+    description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Fixes are then attributed to the projects/modules that actually resolve each vulnerable dependency. The generated files are removed afterwards.`
+  },
   ecosystems: {
     type: 'string',
     default: [],
@@ -9838,6 +10101,7 @@ async function run$N(argv, importMeta, {
     autopilot,
     debug,
     disableExternalToolChecks,
+    dynamicSbomInference,
     ecosystems,
     exclude,
     excludePaths,
@@ -9970,6 +10234,7 @@ async function run$N(argv, importMeta, {
     debug,
     disableExternalToolChecks,
     disableMajorUpdates,
+    dynamicSbomInference,
     ecosystems: validatedEcosystems,
     exclude: excludePatterns,
     excludePaths: excludePathsPatterns,
@@ -12217,7 +12482,7 @@ async function run$H(argv, importMeta, {
 // Manifest-scoped variant of `../scan/reachability-flags.mts`'s
 // `excludePathsFlag`: description avoids "scan"/reachability wording since
 // these commands only ever generate a manifest/facts file.
-const excludePathsFlag$1 = {
+const excludePathsFlag = {
   excludePaths: {
     type: 'string',
     isMultiple: true,
@@ -12231,7 +12496,7 @@ const config$f = {
   hidden: false,
   flags: {
     ...flags.commonFlags,
-    ...excludePathsFlag$1,
+    ...excludePathsFlag,
     verbose: {
       type: 'boolean',
       default: false,
@@ -12420,7 +12685,7 @@ async function run$F(argv, importMeta, {
       filename = sockJson.defaults?.manifest?.conda?.infile;
       logger.logger.info(`Using default --file from ${constants.SOCKET_JSON}:`, filename);
     } else {
-      filename = constants.ENVIRONMENT_YML;
+      filename = findCondaFile(cwd) || constants.ENVIRONMENT_YML;
     }
   }
   if (stdout === undefined && sockJson.defaults?.manifest?.conda?.stdout !== undefined) {
@@ -12554,7 +12819,7 @@ const config$d = {
   flags: {
     ...flags.commonFlags,
     ...flags.outputFlags,
-    ...excludePathsFlag$1,
+    ...excludePathsFlag,
     verbose: {
       type: 'boolean',
       default: false,
@@ -12669,7 +12934,7 @@ const config$c = {
       type: 'string',
       description: 'When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)'
     },
-    ...excludePathsFlag$1,
+    ...excludePathsFlag,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -12923,7 +13188,7 @@ const config$b = {
       type: 'string',
       description: 'When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)'
     },
-    ...excludePathsFlag$1,
+    ...excludePathsFlag,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -13162,7 +13427,7 @@ const config$a = {
       type: 'string',
       description: 'Comma-separated glob patterns; Maven scopes matching any pattern are skipped (applied after --include-configs)'
     },
-    ...excludePathsFlag$1,
+    ...excludePathsFlag,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -13361,7 +13626,7 @@ const config$9 = {
       type: 'string',
       description: 'When generating facts: comma-separated glob patterns; sbt configurations matching any pattern are skipped (applied after --include-configs)'
     },
-    ...excludePathsFlag$1,
+    ...excludePathsFlag,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -19310,127 +19575,6 @@ const cmdRepository = {
   }
 };
 
-// Shared prefix so each command can append what the SBOMs are used for, which
-// differs: reachability is optional on `scan create` and always on for
-// `scan reach`.
-const DYNAMIC_SBOM_INFERENCE_DESCRIPTION = 'For Gradle, sbt, and Maven: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root.';
-const reachabilityFlags = {
-  reachVersion: {
-    type: 'string',
-    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
-  },
-  reachAnalysisMemoryLimit: {
-    type: 'string',
-    default: '8192',
-    description: 'The maximum memory for the reachability analysis as a whole number optionally followed by MB or GB (e.g. 512MB, 8GB). The default is 8GB.'
-  },
-  reachAnalysisTimeout: {
-    type: 'string',
-    default: '',
-    description: 'Set the timeout for the reachability analysis as a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h). Defaults to 10m. Split analysis runs may cause the total scan time to exceed this timeout significantly.'
-  },
-  reachConcurrency: {
-    type: 'number',
-    default: 1,
-    description: 'Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available.'
-  },
-  reachContinueOnAnalysisErrors: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when errors occur (timeouts, OOM, parse errors, etc.), falling back to precomputed reachability results. By default, the CLI halts on analysis errors.'
-  },
-  reachContinueOnInstallErrors: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when package installation fails, falling back to precomputed reachability results. By default, the CLI halts on installation errors.'
-  },
-  reachContinueOnMissingLockFiles: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when a Gradle or SBT project is missing its lock file (or version catalog / pre-generated SBOM). By default, the CLI halts.'
-  },
-  reachContinueOnNoSourceFiles: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when a workspace contains no source files for its ecosystem. By default, the CLI halts.'
-  },
-  reachDisableExternalToolChecks: {
-    type: 'boolean',
-    default: false,
-    description: 'Disable external tool checks during reachability analysis.'
-  },
-  reachDebug: {
-    type: 'boolean',
-    default: false,
-    description: 'Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.'
-  },
-  reachDetailedAnalysisLogFile: {
-    type: 'boolean',
-    default: false,
-    description: 'A log file with detailed analysis logs is written to root of each analyzed workspace.'
-  },
-  reachDisableAnalytics: {
-    type: 'boolean',
-    default: false,
-    description: 'Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.'
-  },
-  reachDisableAnalysisSplitting: {
-    type: 'boolean',
-    default: false,
-    hidden: true,
-    description: 'Deprecated: Analysis splitting is now disabled by default. This flag is a no-op.'
-  },
-  reachEnableAnalysisSplitting: {
-    type: 'boolean',
-    default: false,
-    description: 'Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.'
-  },
-  reachEcosystems: {
-    type: 'string',
-    isMultiple: true,
-    description: `List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Supported: ${utils.getReachabilityEcosystemChoices().join(', ')}. Defaults to all supported ecosystems.`
-  },
-  reachExcludePaths: {
-    type: 'string',
-    isMultiple: true,
-    hidden: true,
-    description: 'Deprecated: use --exclude-paths instead. List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.'
-  },
-  reachFallbackToRegularScan: {
-    type: 'boolean',
-    default: false,
-    description: 'If reachability analysis fails, continue with a regular SCA scan (without reachability results) instead of halting. By default, the CLI halts on reachability errors.'
-  },
-  reachLazyMode: {
-    type: 'boolean',
-    default: false,
-    hidden: true,
-    description: 'Deprecated: lazy mode is no longer supported. This flag is a no-op.'
-  },
-  reachRetainFactsFile: {
-    type: 'boolean',
-    default: false,
-    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh full application reachability scan. A stale `.socket.facts.json` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.'
-  },
-  reachSkipCache: {
-    type: 'boolean',
-    default: false,
-    description: 'Skip caching-based optimizations. By default, the reachability analysis will use cached configurations from previous runs to speed up the analysis.'
-  },
-  reachUseOnlyPregeneratedSboms: {
-    type: 'boolean',
-    default: false,
-    description: 'When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.'
-  }
-};
-const excludePathsFlag = {
-  excludePaths: {
-    type: 'string',
-    isMultiple: true,
-    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
-  }
-};
-
 async function suggestTarget() {
   // We could prefill this with sub-dirs of the current
   // dir ... but is that going to be useful?
@@ -19609,7 +19753,7 @@ async function run$d(argv, importMeta, {
     hidden: hidden$a,
     flags: {
       ...generalFlags$1,
-      ...excludePathsFlag,
+      ...excludePathsFlag$1,
       ...reachabilityFlags
     },
     help: command => `
@@ -19622,7 +19766,7 @@ async function run$d(argv, importMeta, {
     Options
       ${utils.getFlagListOutput({
       ...generalFlags$1,
-      ...excludePathsFlag
+      ...excludePathsFlag$1
     })}
 
     Reachability Options (when --reach is used)
@@ -22013,7 +22157,7 @@ async function run$7(argv, importMeta, {
     hidden: hidden$4,
     flags: {
       ...generalFlags,
-      ...excludePathsFlag,
+      ...excludePathsFlag$1,
       ...reachabilityFlagsForReach
     },
     help: command => `
@@ -22028,7 +22172,7 @@ async function run$7(argv, importMeta, {
 
     Reachability Options
       ${utils.getFlagListOutput({
-      ...excludePathsFlag,
+      ...excludePathsFlag$1,
       ...reachabilityFlagsForReach
     })}
 
@@ -24131,5 +24275,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=3a134c7c-6936-4bbb-befc-4c0c7084f488
+//# debugId=45e6f932-d7fe-49d0-91f3-6a45a49eecd3
 //# sourceMappingURL=cli.js.map