Add socket manifest dynamic-sbom-inference (#1467)

* Add socket manifest dynamic-sbom-inference

Recursively discovers independent gradle/sbt/maven build roots and
generates a Socket facts SBOM for each, without re-invoking the manifest
script on subproject/reactor-module directories a parent build root
already covers. Maven reactors in particular have a pom.xml per module,
so naive marker-file discovery would over-invoke; coverage is tracked
per ecosystem using the facts SBOM's own projects[].subprojectDir, which
every build-tool producer already reports.

This is a standalone command rather than an --auto-manifest extension,
so it can force stricter behavior later without touching auto's
existing contract. Scoped narrowly for this first PR: discovery plus
generation only, one global socket.json config applied to every
discovered root (no per-build-root cascade), no new CLI flags beyond
--exclude-paths/--verbose.

Refs REA-685, REA-553

* Fix misleading --exclude-paths description on manifest commands

--exclude-paths on socket manifest auto/gradle/kotlin/maven/scala/
dynamic-sbom-inference reused the flag description from the scan/reach
flag definitions verbatim, which talks about "the scan" and full
application reachability analysis. None of these commands scan or run
reachability analysis themselves, so the wording was confusing when
viewed via --help on any of them standalone.

Adds a manifest-scoped excludePathsFlag with wording specific to
manifest/facts generation and switches all six commands to it.

* Add per-ecosystem javaHome config for gradle/maven/sbt manifest generation

Different projects in a repo may need different JDKs for their build
tool. Adds a javaHome field to defaults.manifest.{gradle,maven,sbt} in
socket.json, configurable via the socket manifest setup wizard, and
threads it through to the actual build-tool invocation (overrides
JAVA_HOME for that spawn only, everything else about the environment is
left untouched).

Applies to socket manifest gradle/kotlin/maven/scala, socket manifest
auto, and socket manifest dynamic-sbom-inference. Scoped to the Socket
facts generation path only, not the legacy --pom conversion path. No
new CLI flag - socket.json/the setup wizard is the only configuration
surface for now.

* Resolve socket.json per build root, and support env var refs in javaHome

socket manifest dynamic-sbom-inference previously read socket.json once
at the overall recursion root and applied that single config to every
discovered build root. It now resolves each build root's own nearest
socket.json (walking up from that root, bounded at the recursion root,
nearest wins - no merging), so different projects in the same repo can
carry their own settings instead of being forced onto one shared config.

Also adds $VAR/${VAR} expansion for javaHome, resolved against the CLI
process's own environment. A hardcoded absolute JDK path only works on
whoever's machine wrote it; referencing an env var each developer sets
themselves (e.g. $JAVA11_HOME) makes a shared socket.json portable
across machines. Fails closed with a clear message if the referenced
variable isn't set, rather than silently passing a broken path to the
build tool.

* Deep-merge the socket.json cascade instead of nearest-wins

readSocketJsonCascade (renamed from readOrDefaultSocketJsonUpTo) now
merges defaults.manifest.<ecosystem> field-by-field across every
ancestor between a build root and the recursion root, nearest winning
per field, instead of one file replacing the root config wholesale. A
subproject can now override just javaHome while still inheriting the
root's excludeConfigs/bin/etc., rather than having to restate the whole
config. Ecosystems the override doesn't mention are left untouched.

Verified against the sandbox tree: a root socket.json setting
excludeConfigs plus a nested one setting only javaHome both applied
together for that build root.

* Warn (but proceed) when a resolved config sets facts: false

dynamic-sbom-inference always generates Socket facts SBOMs, never
pom.xml. If a build root's cascaded socket.json sets facts: false
(the pom-mode opt-out other manifest commands honor), that's ignored
here rather than skipping the project or silently doing nothing -
but it's a real, deliberate setting the user made, so it's surfaced
as a warning rather than silently overridden.

* Revert facts:false to skip, add a dedicated ignored config

dynamic-sbom-inference previously forced Socket facts generation over
an explicit defaults.manifest.<ecosystem>.facts: false (pom mode),
just warning about it. Reverted: facts: false now skips the project
again, same as before that change, since this command has no pom-mode
equivalent to fall back to.

Also adds a separate ignored: true field (gradle/maven/sbt) scoped
specifically to dynamic-sbom-inference, for projects that should be
skipped during recursive generation regardless of their facts/pom
preference for other commands. Kept as its own boolean rather than
folding into facts, since facts already means something specific to
other manifest commands and overloading it would require touching
every consumer for a value only this command understands.

New skippedIgnored outcome status covers both reasons, distinguished
via the warning message.

* Consolidate ignored into disabled instead of a separate field

A cascaded (not just root-level) disabled: true produces identical
per-root behavior to the ignored field just added, so keeping both
was redundant. Removed ignored; disabled now does double duty:
root-only ecosystem-wide gating for auto/gradle/etc. (unchanged), plus
a cascaded per-build-root skip specifically for dynamic-sbom-inference.

Renamed the skippedIgnored outcome status to skippedDisabled to match.

* Add explicit clear sentinel, lightweight workspace discovery, and recursive setup for dynamic-sbom-inference

- socket.json manifest fields now accept `null` as an explicit "clear the
  inherited value" sentinel, distinct from leaving a field unset; the setup
  wizard writes it when a previously-set value is cleared instead of just
  deleting the key.
- Add a lightweight per-ecosystem workspace enumeration path for
  gradle/sbt/maven (new standalone scripts, kept fully separate from the
  existing facts-generation scripts) that discovers a build's subprojects
  without running dependency resolution.
- Add a hidden `socket manifest setup --dynamic-sbom-inference` mode:
  configures root-level defaults per ecosystem, then recursively marks
  `disabled: true` on build roots matching `--exclude-paths`, leaving
  everything else untouched.
- Speed up `dynamic-sbom-inference`'s handling of a disabled build root with
  many nested candidates by reusing the nearest already-resolved disabled
  ancestor instead of re-walking the whole config cascade for each one, and
  only logging the root cause instead of once per nested candidate.

* Write --exclude-paths disable at the exclusion root, not per project

Previously each excluded build root got its own disabled:true write,
relying on cascade to skip descendants already covered by an ancestor
write. That only worked when the excluded ancestor happened to be a
build root itself; a non-project directory containing multiple sibling
projects would leave later siblings enabled.

Instead, group excluded projects by the shallowest directory that
actually matches --exclude-paths and write disabled:true there once,
covering every ecosystem and sibling/nested project beneath it
regardless of whether that directory is a build root of its own.

* Abort recursive facts generation when a build root's workspace layout is unknown

A build root whose facts generation fails (a build-tool crash or a
blocking resolution failure) never produces its projects[] list, so
there's no way to tell whether a later candidate underneath it is
already covered by that root or a genuinely independent project.
Continuing to process further candidates in that state risked
misclassifying subprojects and piling on doomed attempts against a
build already known to be broken.

Fail closed instead: abort the entire recursive walk as soon as one
build root's workspace layout can't be determined, rather than
continuing to sibling and nested candidates.

* Make recursive setup actually configure discovered build roots

The recursive wizard (`socket manifest setup --dynamic-sbom-inference`)
previously only ever disabled build roots matching --exclude-paths;
every other discovered root was left completely untouched, with no
way to set its bin/JDK/opts short of running the plain single-project
wizard on it directly. Every non-excluded candidate now gets an
interactive configure-or-inherit-defaults prompt (in discovery order,
parent before child), seeded with its cascaded effective value so
accepting every prompt unchanged preserves whatever it already
inherits. Disabling a specific candidate is intentionally not offered
here - that stays --exclude-paths' job, so a whole excluded subtree
still collapses into a single write.

Also fixes a real bug surfaced along the way: askForBin pre-filled the
hardcoded tool fallback (mvn/./gradlew/sbt) as the prompt's shown
value, so accepting the default was indistinguishable from explicitly
typing it and got written to socket.json for no reason. The shown
default is now only ever a prior explicit value; the fallback is
mentioned as a hint instead. A matching guard drops any ecosystem
section that ends up empty so it doesn't count as configured or
trigger a write.

Finally, the root step now detects which ecosystems are actually
present at cwd (reusing the same check the plain wizard uses) and
asks about detected ecosystems first, phrased accordingly, before
offering to configure undetected ones "anyway" for subprojects that
might need them.

* Fix null-clear and exclude-paths bugs in the recursive setup wizard

Fixes two correctness bugs found in an audit pass: leaving a config prompt
blank when the field was already explicitly cleared (null) deleted the key
instead of preserving the clear, silently reverting it to inheriting an
ancestor's value; and --exclude-paths never reached the wizard's workspace
enumeration, so excluding a broken reactor member didn't stop the wizard
from still trying to resolve it and aborting the whole walk.

Also tightens several UX rough edges in the recursive wizard: drops a
redundant write confirmation inconsistent with the rest of the flow, fixes
a tally line that double-counted re-enabled candidates and never reported
disabled ones, and softens wording that overclaimed knowledge the wizard
doesn't actually have yet (a build root at cwd, a fixed --exclude-paths
prompt count). Trims the surrounding comments down to non-obvious rationale
only, per repo comment-style guidelines.

* Trim verbose comments across the dynamic-sbom-inference feature

Cuts several multi-line comment blocks down to their non-obvious why,
matching the repo's comment-style guidelines.

* Address code review findings on the dynamic-sbom-inference PR

- A root-disabled ecosystem was dropped from the build-tool scan entirely,
  so a nested socket.json could never re-enable it. Moved the strip-before-
  scan helper (previously wizard-only) to discover-manifest-roots.mts and
  applied it in generateRecursiveManifests too, letting the existing
  per-directory cascade check be the sole arbiter of skip vs. include.
- runManifestFacts's progress line used logger.log (stdout), polluting
  --json output with non-JSON lines ahead of the payload. Switched to
  logger.info (stderr), matching every other status line in that function.
- `socket manifest setup --dynamic-sbom-inference` forwarded --exclude-paths
  without validation, unlike every sibling manifest command. Added the same
  assertValidExcludePaths call.
- Recursive generation inferred a build-root failure from whether
  process.exitCode changed during a call, which misclassifies a real
  failure as empty if the exit code was already non-zero beforehand. Gave
  runManifestFacts an explicit null (failure) vs. undefined (empty)
  return so callers don't have to infer it from global state.
- Verbose error logging in enumerate-workspaces/run-manifest-facts
  string-coerced the caught error directly; switched to the existing
  getErrorMessageOr helper.

* Refresh CLI banner snapshots after merging v1.x's version bump

The merge brought package.json's version from 1.1.150-prerelease to a
clean release version, so these inline snapshots no longer matched.

* Use 1.1.153-prerelease pending the stuck 1.1.152 release

1.1.152 never actually published (still 404s on the registry, staged
dist-tag is still 1.1.151), so bump to the next-version-hint convention
used elsewhere in this repo's release history and refresh the CLI banner
snapshots to match.

* Simplify dynamic-sbom-inference's summary output

Drop reactor-member "skippedCovered" lines from the per-line table -
they're implied by their parent's line already showing up, and the
aggregate count in the summary still reports them. Also drop the
"across N build root(s)" total from the summary line: it counted every
candidate directory visited, including reactor members that aren't
independent build roots, which overstated how many actually exist.

* Reduce the summary line to just the generated count

Drop failed/skipped/empty from the tally: a failure aborts the whole
walk immediately rather than accumulating (and is already reported via
its own fail message), and the disabled/covered/empty buckets count
candidate directories rather than independent build roots, so a total
there is just as misleading as the "N build root(s)" figure already
removed.

* Trim verbose comment in output-manifest-dynamic-sbom-inference

* Make the CLI-banner-version test normalization suffix-aware

Root cause of the flaky snapshot mismatches on this PR: whether the CLI
itself redacts its version banner (VITEST baked in at build time) or
prints the real one and leaves redaction to this test helper depends on
env propagation into the build step, not just the test run - so the same
source can produce either "<redacted>" or the real "vX.Y.Z-prerelease"
depending on how it was built. normalizeBanner's regex only stripped a
bare "vX.Y.Z", leaving a trailing prerelease suffix dangling in one case
but not the other. Broadened it to match a trailing prerelease/build
suffix and to be idempotent on an already-redacted value, so both cases
normalize identically. Refreshed the now-correct snapshots.

* Fix realpath/boundary mismatch and a silent-zero-projects gap

generateRecursiveManifests read candidate dirs realpath-resolved
(findBuildToolCandidates already does this) but passed the raw cwd as
the socket.json cascade boundary and as the anchor for re-anchoring
--exclude-paths. Whenever cwd contains a symlink (macOS /tmp ->
/private/tmp, several CI layouts), the boundary comparison never
matched: the cascade walked all the way to the filesystem root instead
of stopping at cwd, and --exclude-paths silently stopped reaching the
build tool invocation. Resolve cwd once and use it consistently for
both. Also realpath-resolve a project's subprojectDir before adding it
to the covered set, in both generate-recursive-manifests.mts and
setup-recursive-manifest-config.mts, so a symlinked reactor member is
correctly recognized as covered instead of escaping and being
reinvoked as an independent root.

enumerateWorkspaces treated a clean exit with zero projects as success,
but every real enumeration reports at least the build's own root
project, so zero projects always means the task never ran (e.g. an
extension jar built before the workspace-enumeration participant
existed). Drop the exit-code condition so this is always a failure.

* Address remaining non-blocking review findings

- Hide `socket manifest dynamic-sbom-inference` - its name collides with
  the unrelated, root-only --dynamic-sbom-inference flag on scan
  create/reach (different semantics: this one is recursive per-root).
  Keep it internal until that naming collision is resolved.
- --json --verbose emitted invalid JSON: the verbose debug preamble and
  run-manifest-facts' verbose resolution-detail logging both wrote to
  stdout ahead of the JSON payload. This is the only manifest command
  with --json, so the combination was newly reachable. Gated the
  preamble on !json and switched the detail logging to stderr.
- Fixed two stale "socket manifest setup --recursive" comments left over
  from an earlier flag name.
- renderTable no longer prints a bare blank line when there are no
  non-covered outcomes to show.

* Make configureCandidate write a minimal diff instead of snapshotting the cascade

Every field shown to the sub-wizard (including ones inherited from an
ancestor, never touched by the user) was written verbatim into the
candidate's own file, permanently pinning that value against future
changes to the ancestor - converting inheritance into a one-time
snapshot despite the field-level cascade being the point. Now diffs the
final seed against an ancestor-only baseline (the cascade computed from
dir's parent, excluding dir's own file) and only writes fields that
actually differ, so an untouched field keeps inheriting live.

* Add compat-matrix coverage for the workspace-enumeration producers

socket-workspaces.init.gradle, socket-workspaces.plugin.scala, and
CoanaWorkspacesLifecycleParticipant/SocketWorkspacesRecordsEngine had no
automated coverage at all - the local compat matrix only exercised the
facts scripts, so a registration or compile error in the workspaces
siblings would surface only as silent degradation (the setup wizard's
reactor-coverage pruning treating a real reactor as if it had no
members). Adds a smoke-test-workspaces.sh per ecosystem, wired into the
same per-version matrix run-compat.sh already runs for the facts
scripts, asserting each variant emits exactly a meta record plus the
expected project record(s) and nothing else (no node/root/file records,
confirming no dependency resolution happens). Verified locally against
the currently installed gradle/maven/sbt.

* Scope the fail-closed abort to the failing ecosystem, not the whole walk

Coverage (`covered`/`disabledRoots`) is tracked per ecosystem, so a
gradle failure carries no information about maven or sbt's own
classification - yet aborting all remaining ecosystems meant an
unrelated one could be blocked from ever starting, with nothing in the
output explaining why. Narrowed the abort to the failing ecosystem's
own loop, and added an 'aborted' status for that ecosystem's
still-untried candidates so they show up explicitly instead of being
silently absent from the output.

* expandEnvVarRefs: report every missing var and add a $$ escape

Only the first missing variable was ever reported, so a value
referencing two unset vars needed two runs to discover both. Also had
no way to represent a literal $WORD - $$ now expands to a literal $, so
whatever follows it is left untouched. Added a dedicated test file;
this function had none.

* Centralize --exclude-paths glob compilation into one TypeScript module

The six JVM producers (gradle/maven/sbt × facts/workspaces) each carried
their own NIO PathMatcher-based exclude-glob implementation, including a
"zero-depth variant expansion" workaround for a semantics mismatch between
NIO's `**` and the CLI's micromatch. Following the same pattern already
used for --include-configs/--exclude-configs (PR #1404), the glob is now
compiled to a portable regex pattern source once in
exclude-paths-glob.mts, transported via the existing -D/-P property
mechanism, and each producer just Pattern.compile()s what it receives.
Gradle/sbt/maven all share java.util.regex, so one dialect covers every
producer.

Verified end-to-end against real gradle, maven, and sbt invocations
(facts and workspaces variants) with an actual --exclude-paths value.

Author: jfblaa

.config/rollup.dist.config.mjs

@@ -98,6 +98,14 @@ async function copyManifestScripts() {
       path.join(srcDir, 'socket-facts.plugin.scala'),
       path.join(destDir, 'socket-facts.plugin.scala'),
     ),
+    fs.copyFile(
+      path.join(srcDir, 'socket-workspaces.init.gradle'),
+      path.join(destDir, 'socket-workspaces.init.gradle'),
+    ),
+    fs.copyFile(
+      path.join(srcDir, 'socket-workspaces.plugin.scala'),
+      path.join(destDir, 'socket-workspaces.plugin.scala'),
+    ),
   ])
   const jarPath = path.join(
     srcDir,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.152",
+  "version": "1.1.153-prerelease",
   "description": "CLI for Socket.dev",
   "contentPolicy": {
     "class": "dual-use"

src/commands/manifest/cmd-manifest-auto.mts

@@ -5,6 +5,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { detectManifestActions } from './detect-manifest-actions.mts'
 import { generateAutoManifest } from './generate_auto_manifest.mts'
+import { excludePathsFlag } from './manifest-flags.mts'
 import constants from '../../constants.mts'
 import { commonFlags } from '../../flags.mts'
 import { cmdFlagValueToArray } from '../../utils/cmd.mts'
@@ -14,7 +15,6 @@ import { meowOrExit } from '../../utils/meow-with-subcommands.mts'
 import { getFlagListOutput } from '../../utils/output-formatting.mts'
 import { readOrDefaultSocketJson } from '../../utils/socket-json.mts'
 import { assertValidExcludePaths } from '../scan/exclude-paths.mts'
-import { excludePathsFlag } from '../scan/reachability-flags.mts'
 
 import type {
   CliCommandConfig,

src/commands/manifest/cmd-manifest-auto.test.mts

@@ -23,7 +23,7 @@ describe('socket manifest auto', async () => {
             $ socket manifest auto [options] [CWD=.]
 
           Options
-            --exclude-paths     List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
+            --exclude-paths     List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
             --verbose           Enable debug output (only for auto itself; sub-steps need to have it pre-configured), may help when running into errors
 
           Tries to figure out what language your target repo uses. If it finds a

src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts

@@ -0,0 +1,139 @@
+import path from 'node:path'
+
+import { logger } from '@socketsecurity/registry/lib/logger'
+
+import { handleManifestDynamicSbomInference } from './handle-manifest-dynamic-sbom-inference.mts'
+import { excludePathsFlag } from './manifest-flags.mts'
+import constants, { FLAG_JSON, FLAG_MARKDOWN } from '../../constants.mts'
+import { commonFlags, outputFlags } from '../../flags.mts'
+import { checkCommandInput } from '../../utils/check-input.mts'
+import { cmdFlagValueToArray } from '../../utils/cmd.mts'
+import { getOutputKind } from '../../utils/get-output-kind.mts'
+import { meowOrExit } from '../../utils/meow-with-subcommands.mts'
+import { getFlagListOutput } from '../../utils/output-formatting.mts'
+import { assertValidExcludePaths } from '../scan/exclude-paths.mts'
+
+import type {
+  CliCommandConfig,
+  CliCommandContext,
+} from '../../utils/meow-with-subcommands.mts'
+
+const config: CliCommandConfig = {
+  commandName: 'dynamic-sbom-inference',
+  description:
+    'Recursively discover gradle/sbt/maven build roots and generate a Socket facts SBOM for each',
+  // Hidden: `--dynamic-sbom-inference` already names an unrelated, root-only
+  // scan create/reach flag (see reachability-flags.mts). Keep this hidden
+  // until the naming collision between the two is resolved.
+  hidden: true,
+  flags: {
+    ...commonFlags,
+    ...outputFlags,
+    ...excludePathsFlag,
+    verbose: {
+      type: 'boolean',
+      default: false,
+      description: 'Print debug messages',
+    },
+  },
+  help: (command, config) => `
+    Usage
+      $ ${command} [options] [CWD=.]
+
+    Recursively walks CWD, discovers independent gradle, sbt, and maven build
+    roots, and generates a Socket facts SBOM (.socket.facts.json) for each,
+    skipping subproject/reactor-module directories a parent build root already
+    covers. Unlike \`socket manifest auto\`, this looks beyond CWD itself.
+
+    Options
+      ${getFlagListOutput(config.flags)}
+
+    Examples
+
+      $ ${command}
+      $ ${command} ./monorepo
+  `,
+}
+
+export const cmdManifestDynamicSbomInference = {
+  description: config.description,
+  hidden: config.hidden,
+  run,
+}
+
+async function run(
+  argv: string[] | readonly string[],
+  importMeta: ImportMeta,
+  { parentName }: CliCommandContext,
+): Promise<void> {
+  const cli = meowOrExit({
+    argv,
+    config,
+    importMeta,
+    parentName,
+  })
+
+  const {
+    dryRun,
+    json,
+    markdown,
+    verbose: verboseFlag,
+  } = cli.flags as {
+    dryRun: boolean
+    json: boolean
+    markdown: boolean
+    verbose: boolean | undefined
+  }
+  const verbose = !!verboseFlag
+
+  let [cwd = '.'] = cli.input
+  // Note: path.resolve vs .join:
+  // If given path is absolute then cwd should not affect it.
+  cwd = path.resolve(process.cwd(), cwd)
+
+  // This debug block prints to stdout; --json's payload does too, so skip it
+  // here (unlike the other manifest commands, this one supports --json).
+  if (verbose && !json) {
+    logger.group('- ', parentName, config.commandName, ':')
+    logger.group('- flags:', cli.flags)
+    logger.groupEnd()
+    logger.log('- target:', cwd)
+    logger.groupEnd()
+  }
+
+  const outputKind = getOutputKind(json, markdown)
+
+  const wasValidInput = checkCommandInput(
+    outputKind,
+    {
+      nook: true,
+      test: cli.input.length <= 1,
+      message: 'Can only accept one DIR (make sure to escape spaces!)',
+      fail: `received ${cli.input.length}`,
+    },
+    {
+      nook: true,
+      test: !json || !markdown,
+      message: `The \`${FLAG_JSON}\` and \`${FLAG_MARKDOWN}\` flags can not be used at the same time`,
+      fail: 'bad',
+    },
+  )
+  if (!wasValidInput) {
+    return
+  }
+
+  const excludePaths = cmdFlagValueToArray(cli.flags['excludePaths'])
+  assertValidExcludePaths(excludePaths)
+
+  if (dryRun) {
+    logger.log(constants.DRY_RUN_BAILING_NOW)
+    return
+  }
+
+  await handleManifestDynamicSbomInference({
+    cwd,
+    excludePaths,
+    outputKind,
+    verbose,
+  })
+}

src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts

@@ -0,0 +1,76 @@
+import { describe, expect } from 'vitest'
+
+import constants, {
+  FLAG_CONFIG,
+  FLAG_DRY_RUN,
+  FLAG_HELP,
+} from '../../../src/constants.mts'
+import { cmdit, spawnSocketCli, testPath } from '../../../test/utils.mts'
+
+describe('socket manifest dynamic-sbom-inference', async () => {
+  const { binCliPath } = constants
+
+  cmdit(
+    ['manifest', 'dynamic-sbom-inference', FLAG_HELP, FLAG_CONFIG, '{}'],
+    `should support ${FLAG_HELP}`,
+    async cmd => {
+      const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd, {
+        cwd: testPath,
+      })
+      expect(stdout).toMatchInlineSnapshot(`
+        "Recursively discover gradle/sbt/maven build roots and generate a Socket facts SBOM for each
+
+          Usage
+            $ socket manifest dynamic-sbom-inference [options] [CWD=.]
+
+          Recursively walks CWD, discovers independent gradle, sbt, and maven build
+          roots, and generates a Socket facts SBOM (.socket.facts.json) for each,
+          skipping subproject/reactor-module directories a parent build root already
+          covers. Unlike \`socket manifest auto\`, this looks beyond CWD itself.
+
+          Options
+            --exclude-paths     List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
+            --json              Output as JSON
+            --markdown          Output as Markdown
+            --verbose           Print debug messages
+
+          Examples
+
+            $ socket manifest dynamic-sbom-inference
+            $ socket manifest dynamic-sbom-inference ./monorepo"
+      `)
+      expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
+        "
+           _____         _       _        /---------------
+          |   __|___ ___| |_ ___| |_      | CLI: <redacted>
+          |__   | * |  _| '_| -_|  _|     | token: <redacted>, org: <redacted>
+          |_____|___|___|_,_|___|_|.dev   | Command: \`socket manifest dynamic-sbom-inference\`, cwd: <redacted>"
+      `)
+
+      expect(code, 'explicit help should exit with code 0').toBe(0)
+      expect(stderr, 'banner includes base command').toContain(
+        '`socket manifest dynamic-sbom-inference`',
+      )
+    },
+  )
+
+  cmdit(
+    ['manifest', 'dynamic-sbom-inference', FLAG_DRY_RUN, FLAG_CONFIG, '{}'],
+    'should exit with dry-run message before touching disk',
+    async cmd => {
+      const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd, {
+        cwd: testPath,
+      })
+      expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Bailing now"`)
+      expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
+        "
+           _____         _       _        /---------------
+          |   __|___ ___| |_ ___| |_      | CLI: <redacted>
+          |__   | * |  _| '_| -_|  _|     | token: <redacted>, org: <redacted>
+          |_____|___|___|_,_|___|_|.dev   | Command: \`socket manifest dynamic-sbom-inference\`, cwd: <redacted>"
+      `)
+
+      expect(code, 'dry-run should exit with code 0 if input ok').toBe(0)
+    },
+  )
+})

src/commands/manifest/cmd-manifest-gradle.mts

@@ -5,6 +5,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { convertGradleToFacts } from './convert-gradle-to-facts.mts'
 import { convertGradleToMaven } from './convert_gradle_to_maven.mts'
+import { excludePathsFlag } from './manifest-flags.mts'
 import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
 import { resolveBuildToolBin } from './scripts/build-tool.mts'
 import constants, { REQUIREMENTS_TXT, SOCKET_JSON } from '../../constants.mts'
@@ -16,7 +17,6 @@ import { meowOrExit } from '../../utils/meow-with-subcommands.mts'
 import { getFlagListOutput } from '../../utils/output-formatting.mts'
 import { readOrDefaultSocketJson } from '../../utils/socket-json.mts'
 import { assertValidExcludePaths } from '../scan/exclude-paths.mts'
-import { excludePathsFlag } from '../scan/reachability-flags.mts'
 
 import type {
   CliCommandConfig,
@@ -206,8 +206,8 @@ async function run(
     }
   }
   if (includeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.includeConfigs !== undefined) {
-      includeConfigs = sockJson.defaults?.manifest?.gradle?.includeConfigs
+    if (sockJson.defaults?.manifest?.gradle?.includeConfigs) {
+      includeConfigs = sockJson.defaults.manifest.gradle.includeConfigs
       logger.info(
         `Using default --include-configs from ${SOCKET_JSON}:`,
         includeConfigs,
@@ -217,8 +217,8 @@ async function run(
     }
   }
   if (excludeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.excludeConfigs !== undefined) {
-      excludeConfigs = sockJson.defaults?.manifest?.gradle?.excludeConfigs
+    if (sockJson.defaults?.manifest?.gradle?.excludeConfigs) {
+      excludeConfigs = sockJson.defaults.manifest.gradle.excludeConfigs
       logger.info(
         `Using default --exclude-configs from ${SOCKET_JSON}:`,
         excludeConfigs,
@@ -276,10 +276,13 @@ async function run(
     return
   }
 
+  const javaHome = sockJson.defaults?.manifest?.gradle?.javaHome ?? undefined
+
   if (verbose) {
     logger.group()
     logger.info('- cwd:', cwd)
     logger.info('- gradle bin:', bin)
+    logger.info('- java home:', javaHome || '(inherited)')
     logger.groupEnd()
   }
 
@@ -302,6 +305,7 @@ async function run(
       gradleOpts: parsedGradleOpts,
       ignoreUnresolved: Boolean(ignoreUnresolved),
       includeConfigs: String(includeConfigs || ''),
+      javaHome,
       verbose: Boolean(verbose),
     })
     return

src/commands/manifest/cmd-manifest-gradle.test.mts

@@ -25,7 +25,7 @@ describe('socket manifest gradle', async () => {
           Options
             --bin               Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH
             --exclude-configs   When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)
-            --exclude-paths     List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
+            --exclude-paths     List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
             --facts             Emit a Socket facts JSON file (\`.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead
             --gradle-opts       Additional options to pass on to ./gradlew, see \`./gradlew --help\`
             --ignore-unresolved  When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)

src/commands/manifest/cmd-manifest-kotlin.mts

@@ -5,6 +5,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { convertGradleToFacts } from './convert-gradle-to-facts.mts'
 import { convertGradleToMaven } from './convert_gradle_to_maven.mts'
+import { excludePathsFlag } from './manifest-flags.mts'
 import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
 import { resolveBuildToolBin } from './scripts/build-tool.mts'
 import constants, { REQUIREMENTS_TXT, SOCKET_JSON } from '../../constants.mts'
@@ -16,7 +17,6 @@ import { meowOrExit } from '../../utils/meow-with-subcommands.mts'
 import { getFlagListOutput } from '../../utils/output-formatting.mts'
 import { readOrDefaultSocketJson } from '../../utils/socket-json.mts'
 import { assertValidExcludePaths } from '../scan/exclude-paths.mts'
-import { excludePathsFlag } from '../scan/reachability-flags.mts'
 
 import type {
   CliCommandConfig,
@@ -211,8 +211,8 @@ async function run(
     }
   }
   if (includeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.includeConfigs !== undefined) {
-      includeConfigs = sockJson.defaults?.manifest?.gradle?.includeConfigs
+    if (sockJson.defaults?.manifest?.gradle?.includeConfigs) {
+      includeConfigs = sockJson.defaults.manifest.gradle.includeConfigs
       logger.info(
         `Using default --include-configs from ${SOCKET_JSON}:`,
         includeConfigs,
@@ -222,8 +222,8 @@ async function run(
     }
   }
   if (excludeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.excludeConfigs !== undefined) {
-      excludeConfigs = sockJson.defaults?.manifest?.gradle?.excludeConfigs
+    if (sockJson.defaults?.manifest?.gradle?.excludeConfigs) {
+      excludeConfigs = sockJson.defaults.manifest.gradle.excludeConfigs
       logger.info(
         `Using default --exclude-configs from ${SOCKET_JSON}:`,
         excludeConfigs,
@@ -279,10 +279,13 @@ async function run(
     return
   }
 
+  const javaHome = sockJson.defaults?.manifest?.gradle?.javaHome ?? undefined
+
   if (verbose) {
     logger.group()
     logger.info('- cwd:', cwd)
     logger.info('- gradle bin:', bin)
+    logger.info('- java home:', javaHome || '(inherited)')
     logger.groupEnd()
   }
 
@@ -305,6 +308,7 @@ async function run(
       gradleOpts: parsedGradleOpts,
       ignoreUnresolved: Boolean(ignoreUnresolved),
       includeConfigs: String(includeConfigs || ''),
+      javaHome,
       verbose: Boolean(verbose),
     })
     return