feat(fix): add --dynamic-sbom-inference

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

Summary

• socket fix --dynamic-sbom-inference generates Socket facts for every Gradle, sbt and Maven build root, uploads them, and has Coana attribute Maven artifacts only through them. A fix then lands only in the modules that actually resolve the vulnerable dependency, instead of everywhere depscan's coordinate-merged SBOM points.
• The facts files merge components by version across a build, so their sidecar's per-project classpaths (collected without resolving artifact paths) are passed along for exact attribution.
• The generated files are restored after each PR-mode reset and removed when the fix is done. Facts files already in the repo are still refused.
• PR mode now commits the files Coana reports writing, so edits to build files that are not uploaded manifests (for example gradle.properties, sbt project/*.scala) and files the fix creates are no longer dropped from fix PRs.

---

Note

Medium Risk
Opt-in flag runs real JVM builds and changes Coana inputs and PR commit contents; incorrect attribution or missing files would affect automated fix PRs.

Overview
Adds socket fix --dynamic-sbom-inference, wiring the fix flow through the same per-build-root Socket facts generation used for scans. For Gradle, sbt, and Maven it generates .socket.facts.json per independent build root, uploads them with the manifest tar, and passes --maven-use-only-socket-facts plus a --compute-artifacts-sidecar classpath sidecar into Coana so fixes land only in modules that actually resolve the vulnerable dependency. Generated facts are backed up and restored after each PR-mode branch reset, then removed when the run finishes; pre-existing facts files in the repo are still rejected.

PR-mode fix commits no longer filter changes to uploaded manifest basenames only. When Coana reports modifiedFiles, the CLI commits exactly those paths from unstaged and untracked git listings (via new gitUntrackedFiles), so edits like gradle.properties, sbt project/*.scala, and newly created override files are included in fix PRs.

Supporting changes: generateSocketFactsForFix, optional sidecar collection in runDynamicSbomInference / accumulateSidecar without resolving artifact paths, bundled @coana-tech/cli 15.11.0, and unit tests for the new fix path.

^{Reviewed by Cursor Bugbot for commit b9e5dfc. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b9e5dfc. Configure here.}

[Martin Torp (mtorp)]

[agent] Reviewed Socket Fix PR compatibility at c2061d7. The dashboard worker uses its own pinned Coana version and independently collects changed files, so this CLI change does not alter that path. Fourteen relevant worker tests passed, and the generated sidecar was accepted by Coana 15.11.0.

The CLI PR-mode regression that can omit package.json changes to npm overrides and pnpm.overrides is tracked separately in REA-840. That issue remains open. Approving as requested with this follow-up recorded.