fix(scan): upload the analyzed facts files next to the reachability report

CHANGELOG.md

@@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 - With `--dynamic-sbom-inference`, an sbt build that fails before writing its results is reported as failed instead of reusing another build's results.
+- `socket scan create --reach` keeps the private libraries and build modules of Socket facts files in the stored SBOM, with their dependencies under them.
 
 ## [1.10.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.10.0) - 2026-10-22
 

src/commands/scan/handle-create-new-scan.mts

@@ -20,7 +20,6 @@ import { checkCommandInput } from '../../utils/check-input.mts'
 import {
   compressSocketFactsForUpload,
   isReachabilityReportPath,
-  isSocketFactsFile,
   snapshotSocketFacts,
 } from '../../utils/coana.mts'
 import { findSocketYmlSync } from '../../utils/config.mts'
@@ -360,25 +359,22 @@ async function createNewScan(
 
         reachabilityReport = reachResult.data?.reachabilityReport
 
-        // Mirror the SBOM inputs Coana analyzed; otherwise its fresh report
-        // (appended below) supersedes every facts file.
-        const pathsForScan = reach.reachUseOnlyPregeneratedSboms
-          ? filterToPregeneratedSboms(packagePaths, supportedFiles).filter(
-              p =>
-                !isReachabilityReportPath(p, {
-                  cwd,
-                  outputPath: constants.DOT_SOCKET_DOT_FACTS_JSON,
-                }),
-            )
-          : packagePaths.filter(p => !isSocketFactsFile(p))
-
-        // Append coana's reachability report, but not twice: a pre-generated facts
-        // input can resolve to the same path coana wrote its report to.
-        const reportPath = reachabilityReport
-          ? path.resolve(cwd, reachabilityReport)
-          : undefined
+        // Upload Coana's inputs next to its report: depscan drops the report's
+        // components without public metadata, such as private libraries.
+        const pathsForScan = (
+          reach.reachUseOnlyPregeneratedSboms
+            ? filterToPregeneratedSboms(packagePaths, supportedFiles)
+            : packagePaths
+        ).filter(
+          p =>
+            !isReachabilityReportPath(p, {
+              cwd,
+              outputPath: constants.DOT_SOCKET_DOT_FACTS_JSON,
+            }),
+        )
+
         scanPaths = [
-          ...pathsForScan.filter(p => path.resolve(cwd, p) !== reportPath),
+          ...pathsForScan,
           ...(reachabilityReport ? [reachabilityReport] : []),
         ]
 

src/commands/scan/handle-create-new-scan.test.mts

@@ -263,7 +263,7 @@ describe('handleCreateNewScan excludePaths', () => {
     expect(cleanup).toHaveBeenCalledOnce()
   })
 
-  it('replaces every facts file input with the reachability report', async () => {
+  it('keeps build facts but not earlier reports next to the reachability report', async () => {
     const cleanup = vi.fn()
     const files = [
       '/repo/pom.xml.socket.facts.json',
@@ -284,7 +284,12 @@ describe('handleCreateNewScan excludePaths', () => {
     })
     await handleCreateNewScan(config)
     expect(mockFetchCreateOrgFullScan).toHaveBeenCalledWith(
-      ['/repo/package-lock.json', '.socket.facts.json'],
+      [
+        '/repo/pom.xml.socket.facts.json',
+        '/repo/gradle.socket.facts.json',
+        '/repo/package-lock.json',
+        '.socket.facts.json',
+      ],
       'fakeOrg',
       expect.anything(),
       expect.anything(),