fix(scan): scope --reach-use-only-pregenerated-sboms to analysis input only

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.150](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.147) - 2026-07-29
+
+### Fixed
+- `--reach-use-only-pregenerated-sboms` now only controls what reachability analysis uses as input. Previously it also narrowed the manifest files uploaded as part of the scan.
+
 ## [1.1.149](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.149) - 2026-07-29
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.149",
+  "version": "1.1.150",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT",

src/commands/scan/handle-create-new-scan.mts

@@ -1,8 +1,6 @@
 import { unlink } from 'node:fs/promises'
 import path from 'node:path'
 
-import micromatch from 'micromatch'
-
 import { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'
 import { logger } from '@socketsecurity/registry/lib/logger'
 import { pluralize } from '@socketsecurity/registry/lib/words'
@@ -29,40 +27,6 @@ import type { REPORT_LEVEL } from './types.mts'
 import type { OutputKind } from '../../types.mts'
 import type { ResolvedPathsSidecar } from '../manifest/scripts/sidecar.mts'
 import type { Remap } from '@socketsecurity/registry/lib/objects'
-import type { SocketSdkSuccessResult } from '@socketsecurity/sdk'
-
-// Supported-files response keys whose files count as pre-generated SBOMs:
-// CycloneDX, SPDX, and Socket facts (`.socket.facts.json`, under `socket`).
-// Kept in sync with Coana's `--use-only-pregenerated-sboms` selection
-// (extractPregeneratedSbomPatterns), which matches the same three keys.
-const PREGENERATED_SBOM_KEYS = ['cdx', 'socket', 'spdx']
-
-function getPregeneratedSbomPatterns(
-  supportedFiles: SocketSdkSuccessResult<'getReportSupportedFiles'>['data'],
-): string[] {
-  const patterns: string[] = []
-  for (const key of PREGENERATED_SBOM_KEYS) {
-    const supported = supportedFiles[key]
-    if (supported) {
-      for (const entry of Object.values(supported)) {
-        patterns.push(`**/${entry.pattern}`)
-      }
-    }
-  }
-  return patterns
-}
-
-function filterToPregeneratedSboms(
-  filepaths: string[],
-  supportedFiles: SocketSdkSuccessResult<'getReportSupportedFiles'>['data'],
-): string[] {
-  const patterns = getPregeneratedSbomPatterns(supportedFiles)
-  // `dot: true` lets `*`-prefixed patterns match leading-dot filenames such as
-  // `.socket.facts.json` (advertised as `*.socket.facts.json`).
-  return filepaths.filter(filepath =>
-    micromatch.some(filepath, patterns, { dot: true, nocase: true }),
-  )
-}
 
 export type HandleCreateNewScanConfig = {
   autoManifest: boolean
@@ -269,16 +233,13 @@ export async function handleCreateNewScan({
 
     reachabilityReport = reachResult.data?.reachabilityReport
 
-    // When using only pre-generated SBOMs, build the scan from those inputs —
-    // CycloneDX, SPDX, and Socket facts (`.socket.facts.json`) — matching
-    // Coana's `--use-only-pregenerated-sboms` selection. Otherwise drop any
-    // stray `.socket.facts.json`; coana's fresh reachability report (appended
-    // below) is the authoritative facts file for the scan.
-    const pathsForScan = reach.reachUseOnlyPregeneratedSboms
-      ? filterToPregeneratedSboms(packagePaths, supportedFiles)
-      : packagePaths.filter(
-          p => path.basename(p) !== constants.DOT_SOCKET_DOT_FACTS_JSON,
-        )
+    // Drop any stray `.socket.facts.json`; coana's fresh reachability report
+    // (appended below) is the authoritative facts file for the scan.
+    // `reachUseOnlyPregeneratedSboms` only controls what coana analyzes
+    // (forwarded in performReachabilityAnalysis), not what gets uploaded here.
+    const pathsForScan = packagePaths.filter(
+      p => path.basename(p) !== constants.DOT_SOCKET_DOT_FACTS_JSON,
+    )
 
     // Append coana's reachability report, but not twice: a pre-generated facts
     // input can resolve to the same path coana wrote its report to.

src/commands/scan/reachability-flags.mts

@@ -120,7 +120,7 @@ export const reachabilityFlags: MeowFlags = {
     type: 'boolean',
     default: false,
     description:
-      'When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.',
+      'When using this option, reachability analysis is performed using only pre-generated CDX, SPDX, and Socket facts files in your project instead of resolving dependencies itself.',
   },
 }