Fixes two user-visible problems with --dynamic-sbom-inference, both stemming from where the flag was filed rather than from what it does. See REA-712.

Problem 1 — rejected without --reach

socket scan create . --dynamic-sbom-inference failed with:

✖ Reachability analysis flags require --reach to be enabled (add --reach flag to use --reach-* options)

The flag lived in reachabilityFlags. #1493 replaced that guard's hand-maintained list with a derivation over every boolean in that object, exempting only reachDisableAnalysisSplitting — so this flag got swept up incidentally. It is not a --reach-* modifier, #1493's description never names it, and no test asserted the new behaviour.

Rather than add a second exemption, this moves the flag into generalFlags. That fixes the guard, stops it printing under "Reachability Options (when --reach is used)", and keeps the next change to the derived guard from re-breaking it. reachabilityFlags now contains only reach* flags, which is what the derivation assumes.

Problem 2 — implying --auto-manifest generated Conda and Bazel manifests

The flag forced autoManifest = true to get its per-build-root facts generated, and handleCreateNewScan then suppressed only the JVM entries of the detection result before calling generateAutoManifest. detected.conda and detected.bazel survived, so a repository containing a Conda environment or a Bazel workspace had those manifests generated as a side effect of asking for JVM dynamic SBOM inference.

Clearing those two booleans as well would have broken the legitimate --auto-manifest --dynamic-sbom-inference combination, where they should be generated. The forcing is the real defect: it destroys the information about whether the user asked for auto-manifest at all. So the one if (autoManifest) block is split into two independent halves under if (autoManifest || reach.dynamicSbomInference):

• the recursive Gradle/sbt/Maven generation, gated on reach.dynamicSbomInference
• detectManifestActions + generateAutoManifest, gated on autoManifest

The existing JVM zeroing stays inside the second half, so the combined case still doesn't resolve cwd's own build root twice and race on the same .socket.facts.json. The sidecar merge, scanTargets union, and excludePaths anchoring are unchanged — they already handled either path contributing or not.

Net effect: --dynamic-sbom-inference generates Gradle, sbt, and Maven and nothing else; the two flags are additive instead of one silently forcing the other.

Other changes

• Rewrote the flag description, whose two halves ("Reachability analysis only; implies --auto-manifest") both became wrong.
• Added !dynamicSbomInference to the "Detected N manifest targets…" hint, which was previously suppressed only as a side effect of the forced autoManifest.
• Removed the reachabilityFlagsForReach wrapper in cmd-scan-reach.mts. It existed only to re-hide the flag and read reachabilityFlags['dynamicSbomInference']!.description, which would now throw on undefined. socket scan reach still hardcodes dynamicSbomInference: false and is otherwise untouched — it stays an internal debugging command.

Also drops the side effect where the forced auto-manifest overrode an explicit autoManifest: false in socket.json.

Tests

There were none for this flag outside the --help snapshot, which is why the regression shipped. Added:

• --dynamic-sbom-inference without --reach in cmd-scan-create.test.mts — asserts exit 0 and that the guard message is absent.
• a handle-create-new-scan.test.mts case asserting generateAutoManifest is never called when the flag is used alone. That is the actual Conda/Bazel invariant, and there is no buildable Conda or Bazel fixture to assert it end-to-end.

Retitled the existing combined-flags test to say so explicitly, and switched the four standalone-path tests from autoManifest: true to false now that the CLI no longer forces the pairing. Help snapshot regenerated: the flag moved from Reachability Options into Options.

pnpm run check passes. Full unit suite green (1728 passed, 2 skipped).

Docs impact

Once this ships, the baseline-scan step in the Gradle reachability guide in SocketDev/docs can collapse from two commands to a single socket scan create . --dynamic-sbom-inference.

Related: #1484 (introduced the flag), #1493 (introduced the regression), #1486 (fail-closed when no JVM build root is found).