make --dynamic-sbom-inference a standalone flag

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

Fixes two user-visible problems with --dynamic-sbom-inference, both stemming from where the flag was filed rather than from what it does. See REA-712.

Problem 1 — rejected without --reach

socket scan create . --dynamic-sbom-inference failed with:

✖ Reachability analysis flags require --reach to be enabled (add --reach flag to use --reach-* options)

The flag lived in reachabilityFlags. #1493 replaced that guard's hand-maintained list with a derivation over every boolean in that object, exempting only reachDisableAnalysisSplitting — so this flag got swept up incidentally. It is not a --reach-* modifier, #1493's description never names it, and no test asserted the new behaviour.

Rather than add a second exemption, this moves the flag into generalFlags. That fixes the guard, stops it printing under "Reachability Options (when --reach is used)", and keeps the next change to the derived guard from re-breaking it. reachabilityFlags now contains only reach* flags, which is what the derivation assumes.

Problem 2 — implying --auto-manifest generated Conda and Bazel manifests

The flag forced autoManifest = true to get its per-build-root facts generated, and handleCreateNewScan then suppressed only the JVM entries of the detection result before calling generateAutoManifest. detected.conda and detected.bazel survived, so a repository containing a Conda environment or a Bazel workspace had those manifests generated as a side effect of asking for JVM dynamic SBOM inference.

Clearing those two booleans as well would have broken the legitimate --auto-manifest --dynamic-sbom-inference combination, where they should be generated. The forcing is the real defect: it destroys the information about whether the user asked for auto-manifest at all. So the one if (autoManifest) block is split into two independent halves under if (autoManifest || reach.dynamicSbomInference):

• the recursive Gradle/sbt/Maven generation, gated on reach.dynamicSbomInference
• detectManifestActions + generateAutoManifest, gated on autoManifest

The existing JVM zeroing stays inside the second half, so the combined case still doesn't resolve cwd's own build root twice and race on the same .socket.facts.json. The sidecar merge, scanTargets union, and excludePaths anchoring are unchanged — they already handled either path contributing or not.

Net effect: --dynamic-sbom-inference generates Gradle, sbt, and Maven and nothing else; the two flags are additive instead of one silently forcing the other.

Other changes

• Rewrote the flag description, whose two halves ("Reachability analysis only; implies --auto-manifest") both became wrong.
• Added !dynamicSbomInference to the "Detected N manifest targets…" hint, which was previously suppressed only as a side effect of the forced autoManifest.
• Removed the reachabilityFlagsForReach wrapper in cmd-scan-reach.mts. It existed only to re-hide the flag and read reachabilityFlags['dynamicSbomInference']!.description, which would now throw on undefined. socket scan reach still hardcodes dynamicSbomInference: false and is otherwise untouched — it stays an internal debugging command.

Also drops the side effect where the forced auto-manifest overrode an explicit autoManifest: false in socket.json.

Tests

There were none for this flag outside the --help snapshot, which is why the regression shipped. Added:

• --dynamic-sbom-inference without --reach in cmd-scan-create.test.mts — asserts exit 0 and that the guard message is absent.
• a handle-create-new-scan.test.mts case asserting generateAutoManifest is never called when the flag is used alone. That is the actual Conda/Bazel invariant, and there is no buildable Conda or Bazel fixture to assert it end-to-end.

Retitled the existing combined-flags test to say so explicitly, and switched the four standalone-path tests from autoManifest: true to false now that the CLI no longer forces the pairing. Help snapshot regenerated: the flag moved from Reachability Options into Options.

pnpm run check passes. Full unit suite green (1728 passed, 2 skipped).

Docs impact

Once this ships, the baseline-scan step in the Gradle reachability guide in SocketDev/docs can collapse from two commands to a single socket scan create . --dynamic-sbom-inference.

Related: #1484 (introduced the flag), #1493 (introduced the regression), #1486 (fail-closed when no JVM build root is found).

---

Note

Medium Risk
Changes scan-create manifest orchestration and flag validation; behavior shifts for users who relied on implicit --auto-manifest with --dynamic-sbom-inference, but scope is limited to CLI scan/manifest paths with added regression tests.

Overview
--dynamic-sbom-inference is a general socket scan create option again, not a reach-only flag. It no longer trips the “Reachability analysis flags require --reach” guard or appears under reachability help.

Manifest generation is split by intent: recursive Gradle/sbt/Maven facts run when this flag is set; generateAutoManifest (Conda, Bazel, etc.) runs only when --auto-manifest is set. The old behavior that forced autoManifest = true and could pull in non-JVM ecosystems is removed. With both flags, JVM roots are still generated recursively first and duplicate cwd JVM work in auto-manifest is skipped.

socket scan reach drops the wrapper that hid the flag; it still hardcodes dynamicSbomInference: false.

Tests and CHANGELOG document standalone use and the Conda/Bazel side-effect fix.

^{Reviewed by Cursor Bugbot for commit 9165955. Configure here.}