fix: abort scan on recursive manifest failure and keep sbt tmpDir alive

Under --dynamic-sbom-inference, scan-create now fails closed when any
recursive build root reports failed status, matching the standalone
dynamic-sbom-inference handler. Also pass the caller-owned
socket-auto-manifest tmpDir into generateRecursiveManifests so sbt's
shared global base (and withFiles artifactPaths under boot) survives
until reachability finishes.

Author: cursoragent

src/commands/manifest/generate-recursive-manifests.mts

@@ -217,6 +217,7 @@ export async function generateRecursiveManifests({
   cwd,
   excludePaths,
   sidecarAcc,
+  tmpDir,
   verbose,
   withFiles,
 }: {
@@ -225,6 +226,12 @@ export async function generateRecursiveManifests({
   // Reachability path only: run build tools with files and fold resolved
   // artifact paths into sidecarAcc, keyed by each root's own factsPath.
   sidecarAcc?: SidecarAccumulator | undefined
+  // Caller-owned sbt global base; see ManifestScriptOptions.tmpDir. When
+  // supplied (e.g. scan-create, which needs the Scala toolchain to outlive
+  // this call for reachability's withFiles artifactPaths), reused as the
+  // shared base across every sbt root. Unset ⇒ allocated ephemerally and
+  // cleaned up before this function returns (standalone CLI path).
+  tmpDir?: string | undefined
   verbose: boolean
   withFiles?: boolean | undefined
 }): Promise<RecursiveManifestOutcome[]> {
@@ -259,9 +266,13 @@ export async function generateRecursiveManifests({
   // instead of being reprovisioned per root (the plugin file is rewritten and
   // records.tsv is fully overwritten - not appended - on every invocation, so
   // reuse is safe). Skipped entirely when there's no sbt root to benefit.
-  const outcomes = candidatesByTool.get('sbt')?.length
-    ? await withTmpDir('socket-sbt-facts-shared-', runAll)
-    : await runAll(undefined)
+  // Prefer a caller-owned tmpDir so reachability can keep withFiles paths
+  // under <global.base>/boot alive after this function returns.
+  const outcomes = !candidatesByTool.get('sbt')?.length
+    ? await runAll(undefined)
+    : tmpDir
+      ? await runAll(tmpDir)
+      : await withTmpDir('socket-sbt-facts-shared-', runAll)
 
   if (verbose) {
     logger.info(`Discovered ${outcomes.length} build-tool candidate(s).`)

src/commands/manifest/generate-recursive-manifests.test.mts

@@ -577,6 +577,43 @@ describe('generateRecursiveManifests', () => {
     }
   })
 
+  it('reuses a caller-supplied tmpDir as the shared sbt global base instead of allocating one', async () => {
+    const outer = await fs.mkdtemp(path.join(tmpdir(), 'sbt-caller-tmpdir-'))
+    const callerTmp = path.join(outer, 'caller-owned-sbt-base')
+    const sbtA = path.join(outer, 'sbt-a')
+    const sbtB = path.join(outer, 'sbt-b')
+    try {
+      await fs.mkdir(callerTmp, { recursive: true })
+      await fs.mkdir(sbtA, { recursive: true })
+      await fs.mkdir(sbtB, { recursive: true })
+      await fs.writeFile(path.join(sbtA, 'build.sbt'), '')
+      await fs.writeFile(path.join(sbtB, 'build.sbt'), '')
+
+      const sbtTmpDirs: Array<string | undefined> = []
+      vi.mocked(runManifestFacts).mockImplementation(
+        async ({ cwd, tmpDir }) => {
+          sbtTmpDirs.push(tmpDir)
+          return {
+            factsPath: path.join(cwd, '.socket.facts.json'),
+            projects: [],
+          }
+        },
+      )
+
+      await generateRecursiveManifests({
+        cwd: outer,
+        tmpDir: callerTmp,
+        verbose: false,
+      })
+
+      expect(sbtTmpDirs).toEqual([callerTmp, callerTmp])
+      // Caller owns the directory; it must still exist after generation returns.
+      await expect(fs.stat(callerTmp)).resolves.toBeDefined()
+    } finally {
+      await fs.rm(outer, { recursive: true, force: true })
+    }
+  })
+
   it('does not allocate a shared tmpDir at all when no sbt root is discovered', async () => {
     const outer = await fs.mkdtemp(path.join(tmpdir(), 'no-sbt-tmpdir-'))
     try {

src/commands/scan/handle-create-new-scan.mts

@@ -18,6 +18,7 @@ import constants from '../../constants.mts'
 import { checkCommandInput } from '../../utils/check-input.mts'
 import { compressSocketFactsForUpload } from '../../utils/coana.mts'
 import { findSocketYmlSync } from '../../utils/config.mts'
+import { InputError } from '../../utils/errors.mts'
 import { withTmpDir } from '../../utils/fs.mts'
 import { getPackageFilesForScan } from '../../utils/path-resolve.mts'
 import { readOrDefaultSocketJson } from '../../utils/socket-json.mts'
@@ -177,9 +178,20 @@ export async function handleCreateNewScan({
           cwd,
           excludePaths: reach.excludePaths,
           sidecarAcc,
+          // Keep the shared sbt global base alive until reachability below
+          // consumes withFiles artifactPaths under <global.base>/boot.
+          tmpDir: manifestTmpDir,
           verbose: false,
           withFiles: reach.runReachabilityAnalysis,
         })
+        // Fail closed like handleManifestDynamicSbomInference /
+        // abortManifestRunIfFailed: a partial multi-root run must not upload
+        // or run reachability as if every build root succeeded.
+        if (outcomes.some(o => o.status === 'failed')) {
+          throw new InputError(
+            'One or more build roots failed to generate Socket facts; aborting (see the errors above).',
+          )
+        }
         const generatedFactsPaths = outcomes
           .filter(o => o.status === 'generated')
           .map(o => o.factsPath!)

src/commands/scan/handle-create-new-scan.test.mts

@@ -201,7 +201,11 @@ describe('handleCreateNewScan excludePaths', () => {
     await handleCreateNewScan(config)
 
     expect(mockGenerateRecursiveManifests).toHaveBeenCalledWith(
-      expect.objectContaining({ cwd: '/repo', withFiles: false }),
+      expect.objectContaining({
+        cwd: '/repo',
+        tmpDir: expect.any(String),
+        withFiles: false,
+      }),
     )
     expect(mockGenerateAutoManifest).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -227,6 +231,28 @@ describe('handleCreateNewScan excludePaths', () => {
     )
   })
 
+  it('aborts the scan when recursive manifest generation reports a failed root under --dynamic-sbom-inference', async () => {
+    mockGenerateRecursiveManifests.mockResolvedValueOnce([
+      {
+        dir: '/repo/service-a',
+        ecosystem: 'maven',
+        factsPath: '/repo/service-a/.socket.facts.json',
+        status: 'generated',
+      },
+      { dir: '/repo/service-b', ecosystem: 'maven', status: 'failed' },
+      { dir: '/repo/service-c', ecosystem: 'maven', status: 'aborted' },
+    ])
+
+    const config = createConfig({ autoManifest: true, targets: ['/repo'] })
+    config.reach.dynamicSbomInference = true
+
+    await expect(handleCreateNewScan(config)).rejects.toThrow(
+      'One or more build roots failed to generate Socket facts',
+    )
+    expect(mockGetPackageFilesForScan).not.toHaveBeenCalled()
+    expect(mockFetchCreateOrgFullScan).not.toHaveBeenCalled()
+  })
+
   it('accumulates a sidecar across recursively discovered build roots and forwards it to reachability analysis', async () => {
     mockGenerateRecursiveManifests.mockImplementationOnce(
       async ({ sidecarAcc }) => {