feat(scan): add --exclude-paths flag for full Tier 1 exclusion

[Simon (simonhj)]

Summary

Adds --exclude-paths to socket scan create and socket scan reach so users can exclude paths from SCA/SBOM manifest discovery and, when reachability runs, from Coana analysis.

The semantics of the flag are scan-root-anchored minimatch-style glob matching, not gitignore-style matching. Each entry is expanded to exclude the matched path itself and its subtree, so --exclude-paths dist excludes <cwd>/dist and <cwd>/dist/**, but not <cwd>/test/dist. Folks can use --exclude-paths '**/dist' when they want to match dist directories at any depth.

SCA already supports gitignore-style ignores from .gitignore and socket.yml projectIgnorePaths, so this PR incurs some extra complexity, contained in exclude-paths.mts, to accommodate the difference in semantics. The SCA side receives anchored minimatch ignores, while reachability receives Coana --exclude-dirs values re-anchored from the Socket scan root to the current Coana analysis target.

From the UX POV, I think most folks would expect a command-line flag like this to behave as “exclude this path from the scan root, including its contents,” with explicit glob syntax available for broader matching. Not strongly held, so if folks disagree, I’m happy to change it to gitignore-style semantics. We would still need to teach coana how to intepret those,

---

Note

Medium Risk
Changes scan file discovery and reachability exclusion behavior, which can materially alter what gets uploaded/analyzed and may unintentionally omit manifests or analysis paths if patterns are misused.

Overview
Adds a new --exclude-paths flag to socket scan create and socket scan reach to exclude scan-root anchored glob paths from both manifest discovery (SCA/SBOM) and, when tier-1 reachability runs, Coana analysis.

Introduces exclude-paths.mts to validate patterns (no negation/absolute/../match-everything) and to translate the exclusions into (1) fast-glob ignore patterns for manifest collection and (2) target-relative reachExcludePaths entries for Coana, including handling nested targets.

Plumbs these excludes through handle-create-new-scan/handle-scan-reach and updates globbing utilities (globWithGitIgnore, getPackageFilesForScan) to accept anchored CLI ignores consistently (including when .gitignore negations force the streaming path), with expanded unit/CLI tests and shell completion updates.

^{Reviewed by Cursor Bugbot for commit 869c848. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 869c848. Configure here.}

[cursor]

Glob patterns with ** silently dropped for nested targets

Medium Severity

pathRelativeToTarget uses literal string prefix matching (normalized.startsWith(targetPrefix)), so **-prefixed glob patterns like **/dist are silently dropped when the Coana analysis target is a nested directory (e.g. apps/api). The pattern **/dist doesn't start with apps/api/, so it returns undefined and is excluded from Coana's --exclude-dirs. The SCA side correctly handles **/dist via excludePathToScanIgnores, creating an inconsistency where the same --exclude-paths '**/dist' excludes from manifest discovery but not from reachability analysis. The flag description explicitly documents **/tests as the way to "match at any depth," so this is a user-visible gap.

Additional Locations (1)

• src/commands/scan/exclude-paths.mts#L165-L179

 

^{Reviewed by Cursor Bugbot for commit 869c848. Configure here.}