feat(scan): allow --exclude-paths without --reach

Lift the --reach gate on --exclude-paths so the flag can filter SCA/SBOM
manifest discovery on its own. The Coana --exclude-dirs merge happens
unconditionally; consumers (handle-create-new-scan) only run reachability
when --reach is set, so the merged options are simply unused otherwise.

Move excludePaths out of reachabilityFlags into its own excludePathsFlag
export so scan create lists it under the main Options block instead of
the reach-only section. scan reach keeps it under Reachability Options
since the command is reach-only by definition.

Author: simonhj

src/commands/scan/cmd-scan-create.mts

@@ -6,7 +6,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 import { assertNoNegationPatterns } from './exclude-paths.mts'
 import { handleCreateNewScan } from './handle-create-new-scan.mts'
 import { outputCreateNewScan } from './output-create-new-scan.mts'
-import { reachabilityFlags } from './reachability-flags.mts'
+import { excludePathsFlag, reachabilityFlags } from './reachability-flags.mts'
 import { suggestOrgSlug } from './suggest-org-slug.mts'
 import { suggestTarget } from './suggest_target.mts'
 import { validateReachabilityTarget } from './validate-reachability-target.mts'
@@ -172,6 +172,7 @@ async function run(
     hidden,
     flags: {
       ...generalFlags,
+      ...excludePathsFlag,
       ...reachabilityFlags,
     },
     help: command => `
@@ -182,7 +183,7 @@ async function run(
       ${getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME}`)}
 
     Options
-      ${getFlagListOutput(generalFlags)}
+      ${getFlagListOutput({ ...generalFlags, ...excludePathsFlag })}
 
     Reachability Options (when --reach is used)
       ${getFlagListOutput(reachabilityFlags)}
@@ -471,8 +472,6 @@ async function run(
   const reachExcludePaths = cmdFlagValueToArray(cli.flags['reachExcludePaths'])
 
   // Validation helpers for better readability.
-  const hasExcludePaths = excludePaths.length > 0
-
   const hasReachEcosystems = reachEcosystems.length > 0
 
   const hasReachExcludePaths = reachExcludePaths.length > 0
@@ -495,7 +494,6 @@ async function run(
     reachVersion !== reachabilityFlags['reachVersion']?.default
 
   const isUsingAnyReachabilityFlags =
-    hasExcludePaths ||
     hasReachEcosystems ||
     hasReachExcludePaths ||
     isUsingNonDefaultAnalytics ||

src/commands/scan/cmd-scan-create.test.mts

@@ -40,6 +40,7 @@ describe('socket scan create', async () => {
             --committers        Committers
             --cwd               working directory, defaults to process.cwd()
             --default-branch    Set the default branch of the repository to the branch of this full-scan. Should only need to be done once, for example for the "main" or "master" branch.
+            --exclude-paths     List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) Tier 1 reachability analysis. Patterns are matched relative to the project root. Bare directory names are auto-extended to recursive globs (e.g. \`tests\` becomes \`tests/**\`). Trailing slashes are stripped. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
             --interactive       Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.
             --json              Output as JSON
             --markdown          Output as Markdown
@@ -55,7 +56,6 @@ describe('socket scan create', async () => {
             --workspace         The workspace in the Socket Organization that the repository is in to associate with the full scan.
 
           Reachability Options (when --reach is used)
-            --exclude-paths     List of glob patterns to exclude from the entire Tier 1 scan, including SCA/SBOM manifest discovery. Patterns are matched relative to the project root. Bare directory names are auto-extended to recursive globs (e.g. \`tests\` becomes \`tests/**\`). Trailing slashes are stripped. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
             --reach-analysis-memory-limit  The maximum memory in MB to use for the reachability analysis. The default is 8192MB.
             --reach-analysis-timeout  Set timeout for the reachability analysis. Split analysis runs may cause the total scan time to exceed this timeout significantly.
             --reach-concurrency  Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available. NPM reachability analysis does not support concurrent execution, so the concurrency level is ignored for NPM.
@@ -203,18 +203,14 @@ describe('socket scan create', async () => {
       FLAG_CONFIG,
       '{"apiToken":"fakeToken"}',
     ],
-    'should fail when --exclude-paths is used without --reach',
+    'should succeed when --exclude-paths is used without --reach',
     async cmd => {
-      const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd)
-      const output = stdout + stderr
-      expect(output).toContain(
-        'Reachability analysis flags require --reach to be enabled',
-      )
-      expect(output).toContain('add --reach flag to use --reach-* options')
+      const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
+      expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Bailing now"`)
       expect(
         code,
-        'should exit with non-zero code when validation fails',
-      ).not.toBe(0)
+        'should exit with code 0 when --exclude-paths is used standalone',
+      ).toBe(0)
     },
   )
 

src/commands/scan/cmd-scan-reach.mts

@@ -5,7 +5,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { assertNoNegationPatterns } from './exclude-paths.mts'
 import { handleScanReach } from './handle-scan-reach.mts'
-import { reachabilityFlags } from './reachability-flags.mts'
+import { excludePathsFlag, reachabilityFlags } from './reachability-flags.mts'
 import { suggestTarget } from './suggest_target.mts'
 import { validateReachabilityTarget } from './validate-reachability-target.mts'
 import constants from '../../constants.mts'
@@ -75,6 +75,7 @@ async function run(
     hidden,
     flags: {
       ...generalFlags,
+      ...excludePathsFlag,
       ...reachabilityFlags,
     },
     help: command =>
@@ -89,7 +90,7 @@ async function run(
       ${getFlagListOutput(generalFlags)}
 
     Reachability Options
-      ${getFlagListOutput(reachabilityFlags)}
+      ${getFlagListOutput({ ...excludePathsFlag, ...reachabilityFlags })}
 
     Runs the Socket reachability analysis without creating a scan in Socket.
     The output is written to .socket.facts.json in the current working directory

src/commands/scan/cmd-scan-reach.test.mts

@@ -37,7 +37,7 @@ describe('socket scan reach', async () => {
             --output            Path to write the reachability report to (must end with .json). Defaults to .socket.facts.json in the current working directory.
 
           Reachability Options
-            --exclude-paths     List of glob patterns to exclude from the entire Tier 1 scan, including SCA/SBOM manifest discovery. Patterns are matched relative to the project root. Bare directory names are auto-extended to recursive globs (e.g. \`tests\` becomes \`tests/**\`). Trailing slashes are stripped. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
+            --exclude-paths     List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) Tier 1 reachability analysis. Patterns are matched relative to the project root. Bare directory names are auto-extended to recursive globs (e.g. \`tests\` becomes \`tests/**\`). Trailing slashes are stripped. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
             --reach-analysis-memory-limit  The maximum memory in MB to use for the reachability analysis. The default is 8192MB.
             --reach-analysis-timeout  Set timeout for the reachability analysis. Split analysis runs may cause the total scan time to exceed this timeout significantly.
             --reach-concurrency  Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available. NPM reachability analysis does not support concurrent execution, so the concurrency level is ignored for NPM.

src/commands/scan/exclude-paths.mts

@@ -7,7 +7,6 @@ import type { SocketYml } from '@socketsecurity/config'
 
 type ApplyFullExcludePathsOptions = {
   cwd: string
-  enabled?: boolean | undefined
   reachabilityOptions: ReachabilityOptions
   socketConfig: SocketYml | undefined
   target: string
@@ -54,15 +53,17 @@ export function normalizeExcludePath(path: string): string {
 
 /**
  * Applies --exclude-paths consistently to SCA manifest discovery and Coana.
+ * SCA exclusion always applies when paths are provided. The reachability
+ * options are merged unconditionally; callers decide whether to actually run
+ * reachability and consume them.
  */
 export function applyFullExcludePaths({
   cwd,
-  enabled = true,
   reachabilityOptions,
   socketConfig,
   target,
 }: ApplyFullExcludePathsOptions): ApplyFullExcludePathsResult {
-  const excludePaths = enabled ? reachabilityOptions.excludePaths : []
+  const { excludePaths } = reachabilityOptions
   const scaExcludeGlobs = excludePaths.map(excludePathToProjectIgnorePath)
   const coanaExcludeGlobs = projectIgnorePathsToReachExcludePaths(
     scaExcludeGlobs,

src/commands/scan/handle-create-new-scan.mts

@@ -176,7 +176,6 @@ export async function handleCreateNewScan({
   const { effectiveSocketConfig, mergedReachabilityOptions } =
     applyFullExcludePaths({
       cwd,
-      enabled: reach.runReachabilityAnalysis,
       reachabilityOptions: reach,
       socketConfig,
       target: targets[0]!,

src/commands/scan/handle-create-new-scan.test.mts

@@ -160,7 +160,7 @@ describe('handleCreateNewScan excludePaths', () => {
     )
   })
 
-  it('does not apply excludePaths when reachability is disabled', async () => {
+  it('applies excludePaths to SCA discovery even when reachability is disabled', async () => {
     await handleCreateNewScan({
       autoManifest: false,
       branchName: 'main',
@@ -208,7 +208,12 @@ describe('handleCreateNewScan excludePaths', () => {
       ['/repo'],
       { size: 1 },
       {
-        config: { projectIgnorePaths: ['fixtures/**'] },
+        config: {
+          version: 2,
+          issueRules: {},
+          githubApp: {},
+          projectIgnorePaths: ['fixtures/**', 'tests/**'],
+        },
         cwd: '/repo',
       },
     )

src/commands/scan/reachability-flags.mts

@@ -2,13 +2,16 @@ import constants from '../../constants.mts'
 
 import type { MeowFlags } from '../../flags.mts'
 
-export const reachabilityFlags: MeowFlags = {
+export const excludePathsFlag: MeowFlags = {
   excludePaths: {
     type: 'string',
     isMultiple: true,
     description:
-      'List of glob patterns to exclude from the entire Tier 1 scan, including SCA/SBOM manifest discovery. Patterns are matched relative to the project root. Bare directory names are auto-extended to recursive globs (e.g. `tests` becomes `tests/**`). Trailing slashes are stripped. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.',
+      'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) Tier 1 reachability analysis. Patterns are matched relative to the project root. Bare directory names are auto-extended to recursive globs (e.g. `tests` becomes `tests/**`). Trailing slashes are stripped. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.',
   },
+}
+
+export const reachabilityFlags: MeowFlags = {
   reachAnalysisMemoryLimit: {
     type: 'number',
     default: 8192,