fix(manifest): report a facts build that fails before writing its records

A facts generator signals failure by returning null, which the
auto-manifest abort missed when the exit code was already set. sbt roots
share one global base, so a build that died before writing could be read
as the previous root's records; records.tsv is now removed before each
invocation.

Author: jfblaa

CHANGELOG.md

@@ -9,6 +9,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Changed
 - Updated the Coana CLI to v `15.12.12`.
 
+### Fixed
+- With `--dynamic-sbom-inference`, an sbt build that fails before writing its results is reported as failed instead of reusing another build's results.
+
 ## [1.10.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.10.0) - 2026-10-22
 
 ### Added

src/commands/manifest/convert-gradle-to-facts.mts

@@ -1,5 +1,6 @@
 import { runManifestFacts } from './run-manifest-facts.mts'
 
+import type { RunManifestFactsOutcome } from './run-manifest-facts.mts'
 import type { BuildOptionHints } from './scripts/resolution-report-render.mts'
 import type { SidecarAccumulator } from './scripts/sidecar.mts'
 
@@ -31,8 +32,8 @@ export async function convertGradleToFacts({
   sidecarAcc?: SidecarAccumulator | undefined
   verbose: boolean
   withFiles?: boolean | undefined
-}): Promise<void> {
-  await runManifestFacts({
+}): Promise<RunManifestFactsOutcome> {
+  return await runManifestFacts({
     bin,
     buildOpts: gradleOpts,
     cwd,

src/commands/manifest/convert-maven-to-facts.mts

@@ -1,5 +1,6 @@
 import { runManifestFacts } from './run-manifest-facts.mts'
 
+import type { RunManifestFactsOutcome } from './run-manifest-facts.mts'
 import type { BuildOptionHints } from './scripts/resolution-report-render.mts'
 import type { SidecarAccumulator } from './scripts/sidecar.mts'
 
@@ -31,8 +32,8 @@ export async function convertMavenToFacts({
   sidecarAcc?: SidecarAccumulator | undefined
   verbose: boolean
   withFiles?: boolean | undefined
-}): Promise<void> {
-  await runManifestFacts({
+}): Promise<RunManifestFactsOutcome> {
+  return await runManifestFacts({
     bin,
     buildOpts: mavenOpts,
     cwd,

src/commands/manifest/convert-sbt-to-facts.mts

@@ -1,5 +1,6 @@
 import { runManifestFacts } from './run-manifest-facts.mts'
 
+import type { RunManifestFactsOutcome } from './run-manifest-facts.mts'
 import type { BuildOptionHints } from './scripts/resolution-report-render.mts'
 import type { SidecarAccumulator } from './scripts/sidecar.mts'
 
@@ -35,8 +36,8 @@ export async function convertSbtToFacts({
   tmpDir: string
   verbose: boolean
   withFiles?: boolean | undefined
-}): Promise<void> {
-  await runManifestFacts({
+}): Promise<RunManifestFactsOutcome> {
+  return await runManifestFacts({
     bin,
     buildOpts: sbtOpts,
     cwd,

src/commands/manifest/generate-recursive-manifests.mts

@@ -294,10 +294,10 @@ export async function generateRecursiveManifests({
   // A shared global base across every sbt root in this run lets sbt's own
   // Scala-toolchain cache under <base>/boot survive between invocations
   // instead of being reprovisioned per root (the plugin file is rewritten and
-  // records.tsv is fully overwritten - not appended - on every invocation, so
-  // reuse is safe). A caller-supplied sbtTmpDir is reused as-is (the caller
-  // owns its lifetime); otherwise one is allocated and cleaned up here, but
-  // only when there's an sbt root to benefit from sharing it at all.
+  // records.tsv is removed before every invocation, so reuse is safe). A
+  // caller-supplied sbtTmpDir is reused as-is (the caller owns its lifetime);
+  // otherwise one is allocated and cleaned up here, but only when there's an
+  // sbt root to benefit from sharing it at all.
   const outcomes = sbtTmpDir
     ? await runAll(sbtTmpDir)
     : candidatesByTool.get('sbt')?.length

src/commands/manifest/generate_auto_manifest.mts

@@ -21,6 +21,7 @@ import { InputError } from '../../utils/errors.mts'
 import { readOrDefaultSocketJson } from '../../utils/socket-json.mts'
 
 import type { GeneratableManifests } from './detect-manifest-actions.mts'
+import type { RunManifestFactsOutcome } from './run-manifest-facts.mts'
 import type { BuildOptionHints } from './scripts/resolution-report-render.mts'
 import type {
   ResolvedPathsSidecar,
@@ -41,12 +42,20 @@ export type GenerateAutoManifestResult = {
   resolvedPathsSidecar?: ResolvedPathsSidecar | undefined
 }
 
-// Under --auto-manifest, a manifest generator that failed — raising the exit
-// code above the value captured before it ran — aborts the whole run: a partial
-// or empty SBOM silently under-reports dependencies. The generator has already
-// logged the specifics. A tolerated resolution failure (ignoreUnresolved) warns
-// without touching the exit code, so it passes through here and the run
-// continues.
+// A failed generator aborts --auto-manifest: a partial SBOM silently
+// under-reports dependencies. Facts generators return null on failure; the
+// others only change the exit code.
+function abortFactsRunIfFailed(
+  ecosystem: string,
+  outcome: RunManifestFactsOutcome,
+): void {
+  if (outcome === null) {
+    throw new InputError(
+      `Auto-manifest generation failed for the ${ecosystem} project; aborting (see the errors above).`,
+    )
+  }
+}
+
 function abortManifestRunIfFailed(
   ecosystem: string,
   beforeExitCode: string | number | undefined,
@@ -109,8 +118,7 @@ export async function generateAutoManifest({
     // `defaults.manifest.sbt.facts: false` in socket.json.
     if (sockJson.defaults?.manifest?.sbt?.facts !== false) {
       logger.log('Detected a Scala sbt build, generating Socket facts...')
-      const beforeExitCode = process.exitCode
-      await convertSbtToFacts({
+      const outcome = await convertSbtToFacts({
         ...sbtArgs,
         excludeConfigs: sockJson.defaults?.manifest?.sbt?.excludeConfigs ?? '',
         excludePaths,
@@ -124,7 +132,7 @@ export async function generateAutoManifest({
         tmpDir,
         withFiles: computeArtifactsSidecar,
       })
-      abortManifestRunIfFailed('sbt', beforeExitCode)
+      abortFactsRunIfFailed('sbt', outcome)
     } else {
       logger.log('Detected a Scala sbt build, generating pom files with sbt...')
       const beforeExitCode = process.exitCode
@@ -154,8 +162,7 @@ export async function generateAutoManifest({
       logger.log(
         'Detected a gradle build (Gradle, Kotlin, Scala), generating Socket facts...',
       )
-      const beforeExitCode = process.exitCode
-      await convertGradleToFacts({
+      const outcome = await convertGradleToFacts({
         ...gradleArgs,
         excludeConfigs:
           sockJson.defaults?.manifest?.gradle?.excludeConfigs ?? '',
@@ -170,7 +177,7 @@ export async function generateAutoManifest({
         sidecarAcc,
         withFiles: computeArtifactsSidecar,
       })
-      abortManifestRunIfFailed('gradle', beforeExitCode)
+      abortFactsRunIfFailed('gradle', outcome)
     } else {
       logger.log(
         'Detected a gradle build (Gradle, Kotlin, Scala), running default gradle generator...',
@@ -183,8 +190,7 @@ export async function generateAutoManifest({
 
   if (!sockJson?.defaults?.manifest?.maven?.disabled && detected.maven) {
     logger.log('Detected a Maven pom.xml build, generating Socket facts...')
-    const beforeExitCode = process.exitCode
-    await convertMavenToFacts({
+    const outcome = await convertMavenToFacts({
       // Configured bin wins; else prefer ./mvnw, else mvn on PATH.
       bin:
         sockJson.defaults?.manifest?.maven?.bin ??
@@ -205,7 +211,7 @@ export async function generateAutoManifest({
       verbose: Boolean(sockJson.defaults?.manifest?.maven?.verbose),
       withFiles: computeArtifactsSidecar,
     })
-    abortManifestRunIfFailed('maven', beforeExitCode)
+    abortFactsRunIfFailed('maven', outcome)
   }
 
   if (!sockJson?.defaults?.manifest?.conda?.disabled && detected.conda) {

src/commands/manifest/generate_auto_manifest.test.mts

@@ -386,4 +386,18 @@ describe('generateAutoManifest — conda branch', () => {
     ).rejects.toThrow(/Auto-manifest generation failed for the conda project/)
     process.exitCode = undefined
   })
+
+  it('aborts on a failed facts generator even when the exit code was already set', async () => {
+    process.exitCode = 1
+    vi.mocked(convertGradleToFacts).mockResolvedValueOnce(null)
+    await expect(
+      generateAutoManifest({
+        cwd: '/tmp/repo',
+        detected: { ...baseDetected, gradle: true, count: 1 },
+        outputKind: 'text',
+        verbose: false,
+      }),
+    ).rejects.toThrow(/Auto-manifest generation failed for the gradle project/)
+    process.exitCode = undefined
+  })
 })

src/commands/manifest/scripts/run.mts

@@ -299,6 +299,9 @@ async function invokeSbtIn(
 ): Promise<ManifestRunResult> {
   await writeSbtPlugin(globalBase, pluginSourceFilename, pluginDestFilename)
   const recordsFile = path.join(globalBase, 'records.tsv')
+  // The global base is shared across sbt roots: a build that dies before
+  // writing must not be read as the previous root's records.
+  await fs.rm(recordsFile, { force: true })
   const bin = resolveBuildToolBin('sbt', opts.projectDir, opts.bin)
   // Fresh per-run global base (not ~/.sbt): sbt executes everything under
   // plugins/, so a shared path is a code-injection surface. BSP off for this

src/commands/manifest/scripts/run.test.mts

@@ -1,8 +1,12 @@
+import { promises as fs } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
 import { describe, expect, it, vi } from 'vitest'
 
 import { spawn } from '@socketsecurity/registry/lib/spawn'
 
-import { enumerateWorkspaces } from './run.mts'
+import { enumerateWorkspaces, runManifestScript } from './run.mts'
 
 vi.mock('@socketsecurity/registry/lib/spawn', () => ({
   spawn: vi.fn(async () => ({ code: 0, stderr: '', stdout: '' })),
@@ -25,3 +29,39 @@ describe('build tool output', () => {
     },
   )
 })
+
+describe('shared sbt global base', () => {
+  it("does not read the previous root's records when a build dies before writing", async () => {
+    const base = await fs.mkdtemp(path.join(os.tmpdir(), 'sbt-shared-base-'))
+    try {
+      const recordsArg = (args: readonly string[]) =>
+        args
+          .find(a => a.startsWith('-Dsocket.recordsFile='))!
+          .slice('-Dsocket.recordsFile='.length)
+      vi.mocked(spawn).mockImplementationOnce((async (
+        _bin: string,
+        args: readonly string[],
+      ) => {
+        await fs.writeFile(
+          recordsArg(args),
+          'buildRoot\t/a\nroot\t0\troot\tcompile\t1\nnode\t0\tx:y:jar:1\tx\ty\t1\tjar\t\t1\t\n',
+        )
+        return { code: 0, stderr: '', stdout: '' }
+      }) as any)
+      vi.mocked(spawn).mockImplementationOnce((async () => ({
+        code: 1,
+        stderr: 'error: not found: value broken',
+        stdout: '',
+      })) as any)
+      const opts = { bin: 'sbt', stdio: 'pipe' as const, tmpDir: base }
+      const a = await runManifestScript('sbt', { ...opts, projectDir: base })
+      const b = await runManifestScript('sbt', { ...opts, projectDir: base })
+      expect(a.facts.components).toHaveLength(1)
+      expect(b.code).toBe(1)
+      expect(b.buildRoot).toBeUndefined()
+      expect(b.facts.components).toHaveLength(0)
+    } finally {
+      await fs.rm(base, { force: true, recursive: true })
+    }
+  })
+})