refactor(scan): drop local reach unit validation, defer to Coana

Coana (@coana-tech/cli) is now the sole validator/parser of the
--reach-analysis-timeout and --reach-analysis-memory-limit values, matching the
Python CLI. Removes the local grammar mirror (isValid* regex fast-fail) that had
already drifted from Coana twice (unit case-sensitivity, and a whitespace gap
where Coana trims but the mirror did not). An invalid unit now surfaces as
Coana's error instead of a fast local one.

Kept the non-validation helpers, which Coana does not model: isOmittedReachValue
(empty/zero -> omit the flag so Coana applies its default) and reachMemoryLimitToMb
(unit-agnostic default-equivalence for the "requires --reach" guard). The raw
string is still forwarded to Coana verbatim.

Author: mtorp

src/commands/scan/cmd-scan-create.mts

@@ -9,11 +9,7 @@ import { handleCreateNewScan } from './handle-create-new-scan.mts'
 import { outputCreateNewScan } from './output-create-new-scan.mts'
 import { excludePathsFlag, reachabilityFlags } from './reachability-flags.mts'
 import {
-  REACH_ANALYSIS_MEMORY_LIMIT_HELP,
-  REACH_ANALYSIS_TIMEOUT_HELP,
   isOmittedReachValue,
-  isValidReachAnalysisMemoryLimit,
-  isValidReachAnalysisTimeout,
   reachMemoryLimitToMb,
 } from './reachability-units.mts'
 import { suggestOrgSlug } from './suggest-org-slug.mts'
@@ -587,18 +583,6 @@ async function run(
       message: 'Reachability analysis flags require --reach to be enabled',
       fail: 'add --reach flag to use --reach-* options',
     },
-    {
-      nook: true,
-      test: !reach || isValidReachAnalysisTimeout(reachAnalysisTimeout),
-      message: `The --reach-analysis-timeout must be ${REACH_ANALYSIS_TIMEOUT_HELP}`,
-      fail: `invalid value "${reachAnalysisTimeout}"`,
-    },
-    {
-      nook: true,
-      test: !reach || isValidReachAnalysisMemoryLimit(reachAnalysisMemoryLimit),
-      message: `The --reach-analysis-memory-limit must be ${REACH_ANALYSIS_MEMORY_LIMIT_HELP}`,
-      fail: `invalid value "${reachAnalysisMemoryLimit}"`,
-    },
     {
       nook: true,
       test: !reach || reachTargetValidation.isValid,

src/commands/scan/cmd-scan-reach.mts

@@ -6,12 +6,6 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 import { assertValidExcludePaths } from './exclude-paths.mts'
 import { handleScanReach } from './handle-scan-reach.mts'
 import { excludePathsFlag, reachabilityFlags } from './reachability-flags.mts'
-import {
-  REACH_ANALYSIS_MEMORY_LIMIT_HELP,
-  REACH_ANALYSIS_TIMEOUT_HELP,
-  isValidReachAnalysisMemoryLimit,
-  isValidReachAnalysisTimeout,
-} from './reachability-units.mts'
 import { suggestTarget } from './suggest_target.mts'
 import { validateReachabilityTarget } from './validate-reachability-target.mts'
 import constants from '../../constants.mts'
@@ -265,18 +259,6 @@ async function run(
       message: 'Target directory must be inside the current working directory',
       fail: 'provide a path inside the working directory',
     },
-    {
-      nook: true,
-      test: isValidReachAnalysisTimeout(reachAnalysisTimeout),
-      message: `The --reach-analysis-timeout must be ${REACH_ANALYSIS_TIMEOUT_HELP}`,
-      fail: `invalid value "${reachAnalysisTimeout}"`,
-    },
-    {
-      nook: true,
-      test: isValidReachAnalysisMemoryLimit(reachAnalysisMemoryLimit),
-      message: `The --reach-analysis-memory-limit must be ${REACH_ANALYSIS_MEMORY_LIMIT_HELP}`,
-      fail: `invalid value "${reachAnalysisMemoryLimit}"`,
-    },
   )
   if (!wasValidInput) {
     return

src/commands/scan/cmd-scan-reach.test.mts

@@ -1050,14 +1050,12 @@ describe('socket scan reach', async () => {
         FLAG_CONFIG,
         '{"apiToken":"fake-token"}',
       ],
-      'should show clear error for invalid memory limit',
+      'should forward an unrecognized memory value to Coana without locally rejecting it',
       async cmd => {
         const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd)
         const output = stdout + stderr
-        expect(output).toContain(
-          'The --reach-analysis-memory-limit must be a whole number optionally followed by MB or GB',
-        )
-        expect(code).not.toBe(0)
+        expect(output).toContain('[DryRun]: Bailing now')
+        expect(code).toBe(0)
       },
     )
 
@@ -1073,14 +1071,12 @@ describe('socket scan reach', async () => {
         FLAG_CONFIG,
         '{"apiToken":"fake-token"}',
       ],
-      'should show clear error for unsupported memory unit',
+      'should forward an unsupported memory unit to Coana without locally rejecting it',
       async cmd => {
         const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd)
         const output = stdout + stderr
-        expect(output).toContain(
-          'The --reach-analysis-memory-limit must be a whole number optionally followed by MB or GB',
-        )
-        expect(code).not.toBe(0)
+        expect(output).toContain('[DryRun]: Bailing now')
+        expect(code).toBe(0)
       },
     )
 
@@ -1096,14 +1092,12 @@ describe('socket scan reach', async () => {
         FLAG_CONFIG,
         '{"apiToken":"fake-token"}',
       ],
-      'should show clear error for invalid timeout value',
+      'should forward an unrecognized timeout value to Coana without locally rejecting it',
       async cmd => {
         const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd)
         const output = stdout + stderr
-        expect(output).toContain(
-          'The --reach-analysis-timeout must be a whole number optionally followed by s, m or h',
-        )
-        expect(code).not.toBe(0)
+        expect(output).toContain('[DryRun]: Bailing now')
+        expect(code).toBe(0)
       },
     )
 

src/commands/scan/reachability-units.mts

@@ -1,24 +1,8 @@
-// Thin local mirror of the reachability unit grammar. Coana (@coana-tech/cli)
-// is the canonical parser for these values; the Socket CLI forwards the raw
-// string through verbatim and only performs this lightweight check so obvious
-// mistakes fail fast before the Coana binary is spawned. Keep the patterns and
-// help text in sync with Coana's grammar.
-
-// --reach-analysis-timeout: a whole number optionally followed by s, m or h.
-// Units are case-insensitive (matching Coana). A bare number is treated as
-// seconds (back-compat, no longer documented).
-const REACH_ANALYSIS_TIMEOUT_PATTERN = /^\d+(?:s|m|h)?$/i
-
-// --reach-analysis-memory-limit: a whole number optionally followed by MB or GB.
-// Units are case-insensitive (matching Coana). A bare number is treated as MB
-// (back-compat, no longer documented).
-const REACH_ANALYSIS_MEMORY_LIMIT_PATTERN = /^\d+(?:mb|gb)?$/i
-
-export const REACH_ANALYSIS_MEMORY_LIMIT_HELP =
-  'a whole number optionally followed by MB or GB (e.g. 512MB, 8GB)'
-
-export const REACH_ANALYSIS_TIMEOUT_HELP =
-  'a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h)'
+// Helpers for the reachability unit values. Coana (@coana-tech/cli) is the sole
+// validator/parser of these values; the Socket CLI forwards the raw string
+// through verbatim. These helpers do NOT validate grammar (that would duplicate
+// Coana's and drift): they only handle the meow-default sentinel and detect
+// whether a value differs from the default, neither of which Coana models.
 
 // A zero-magnitude or empty value (e.g. "", "0", "0s", "0gb") means "use the
 // default": the flag is omitted when forwarding and Coana applies its own
@@ -29,18 +13,12 @@ export function isOmittedReachValue(value: string): boolean {
   return !match || Number(match[0]) === 0
 }
 
-export function isValidReachAnalysisMemoryLimit(value: string): boolean {
-  return value === '' || REACH_ANALYSIS_MEMORY_LIMIT_PATTERN.test(value)
-}
-
-export function isValidReachAnalysisTimeout(value: string): boolean {
-  return value === '' || REACH_ANALYSIS_TIMEOUT_PATTERN.test(value)
-}
-
 // Resolve a memory-limit value to its magnitude in MB (the unit Coana uses), or
 // null when the value is omitted/zero (Coana then applies its own default).
-// Lets callers compare a value against the default regardless of how the unit
-// is written: 8192, 8192MB and 8GB all resolve to 8192.
+// Used only to compare a value against the default regardless of how the unit
+// is written: 8192, 8192MB and 8GB all resolve to 8192. This is default
+// detection, not validation, so an unrecognized value resolves to null and is
+// simply treated as "not a non-default value".
 export function reachMemoryLimitToMb(value: string): number | null {
   if (isOmittedReachValue(value)) {
     return null

src/commands/scan/reachability-units.test.mts

@@ -2,45 +2,9 @@ import { describe, expect, it } from 'vitest'
 
 import {
   isOmittedReachValue,
-  isValidReachAnalysisMemoryLimit,
-  isValidReachAnalysisTimeout,
   reachMemoryLimitToMb,
 } from './reachability-units.mts'
 
-describe('isValidReachAnalysisTimeout', () => {
-  // Units are case-insensitive, matching Coana.
-  it.each(['', '0', '90', '90s', '10m', '1h', '600', '10M', '1H', '30S'])(
-    'accepts %j',
-    value => {
-      expect(isValidReachAnalysisTimeout(value)).toBe(true)
-    },
-  )
-
-  it.each(['90ms', '1.5h', '10 m', 'm', '-1', 'invalid', '10mb'])(
-    'rejects %j',
-    value => {
-      expect(isValidReachAnalysisTimeout(value)).toBe(false)
-    },
-  )
-})
-
-describe('isValidReachAnalysisMemoryLimit', () => {
-  // Units are case-insensitive, matching Coana.
-  it.each(['', '0', '8192', '512MB', '512mb', '8GB', '8gb', '8Gb'])(
-    'accepts %j',
-    value => {
-      expect(isValidReachAnalysisMemoryLimit(value)).toBe(true)
-    },
-  )
-
-  it.each(['512kb', '1TB', '1.5GB', '8 GB', 'GB', '-1', 'invalid'])(
-    'rejects %j',
-    value => {
-      expect(isValidReachAnalysisMemoryLimit(value)).toBe(false)
-    },
-  )
-})
-
 describe('isOmittedReachValue', () => {
   // Empty or any zero-magnitude value means "use the default" (flag omitted).
   it.each(['', '0', '00', '0s', '0m', '0h', '0mb', '0gb'])(