[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

Adds --dynamic-sbom-inference-ecosystems to socket scan create, socket scan reach and socket fix, so a repo can use Socket facts for some ecosystems and keep the manifest files of others as they are.

• Values are purl types, comma-separated or repeated: maven (Gradle, sbt and Maven) and nuget (.NET). Without the flag, both are used, as before.
• Per ecosystem rather than per build tool, because Coana's facts-only filter works by purl type.
• Build roots of unselected ecosystems are not discovered at all, so Coana does not treat their ecosystem as facts-only and reads their manifests as usual. With --auto-manifest, auto-generation still runs for them at the scan root.
• The flag requires --dynamic-sbom-inference, accepts any case, and rejects other ecosystems. Errors for "no build root found" and "no facts produced" suggest choosing other ecosystems when the selection was narrowed.

Stacked on #1696.

Tested: unit tests for discovery filtering, the selection passed through scan create, scan reach and fix, the auto-manifest interplay, and flag validation; manual runs of the built CLI on a Maven + .NET directory (maven selected generates Maven facts and leaves .NET alone; nuget selected on a Maven-only dir fails with the narrowed message).

🤖 Generated with Claude Code

---

Note

Low Risk
New opt-in CLI flag with backward-compatible defaults; changes scan/fix/reach manifest discovery behavior only when users narrow ecosystems alongside --dynamic-sbom-inference.

Overview
Adds --dynamic-sbom-inference-ecosystems to socket scan create, socket scan reach, and socket fix so --dynamic-sbom-inference can generate Socket facts for only maven (Gradle, sbt, Maven) and/or nuget (.NET). Unselected ecosystems are not treated as facts-only and keep their existing manifest files; with --auto-manifest, auto-generation still runs for those build tools at the scan root.

The selection is parsed and validated (requires --dynamic-sbom-inference, case-insensitive maven/nuget, rejects other ecosystems), defaults to both when omitted, and flows through build-root discovery, recursive manifest generation, fix-time facts generation, and Coana “facts-only” flags. Error text when no matching build roots or no facts are produced now mentions trying other ecosystems when the list was narrowed.

^{Reviewed by Cursor Bugbot for commit 767c973. Configure here.}