[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

What

--exclude-paths could not exclude a module that a build reaches outside its own directory when Socket facts are generated per build root (dynamic SBOM inference, --reach with it, socket fix):

• Each build root got its patterns re-anchored onto its own directory, and patterns outside it were dropped.
• A Maven <module>../shared</module> or a Gradle project relocated with projectDir = file('../shared') was then resolved and uploaded even with --exclude-paths shared. Discovery had already dropped its standalone root, so the exclusion looked like it worked.

Now:

• Every build root gets the scan-root-relative patterns and the absolute scan root (socket.excludeBase, the build root by default).
• The Maven extension, both Gradle init scripts and both sbt plugins relativize each module's canonical directory against it before matching.
• A module outside the scan root never matches. This also holds when -f/-p in the build options moves the build root.

sbt refuses projects outside its build root, so for sbt only the anchoring changes.

Testing

• Unit tests for the socket.excludeBase property, the scan-root patterns given to every build root, and the setup wizard's coverage pass.
• New compat smoke tests (run-compat.sh):
  • Maven: a ../shared module, excluded by its scan-root path.
  • Gradle: a project relocated outside the build root.
  • sbt: a nested subproject.
  • Each also checks that a nested module is excluded by the build root's path in the scan root.
• The full JVM matrix passes: Gradle 1.12 to 9.2.1, Maven 3.2.5 to 4.0.0-rc-6, sbt 0.13.18 to 1.9.9.
• The Gradle test fails against the previous init script.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches exclusion logic across recursive manifest orchestration and all three JVM fact producers; wrong anchoring could skip or include the wrong modules, but behavior is heavily tested including cross-version smoke runs.

Overview
Fixes --exclude-paths so it applies consistently when Socket facts run per build root (dynamic SBOM inference, recursive manifest flows). Previously each root got patterns re-anchored to its own directory, so globs meant for the scan root could not skip modules the build pulls in outside that directory (Maven <module>../shared</module>, Gradle projectDir = file('../shared')).

The CLI now passes every build root the same scan-root-relative patterns plus an excludeBase (the scan root; projectDir when unset). run.mts forwards this as socket.excludeBase to Maven, Gradle, and sbt. Each ecosystem matches exclusions by relativizing a module’s canonical directory against that base (not only against the build root), and modules outside the scan root never match.

Recursive manifest generation and workspace enumeration stop computing per-root exclude paths; setup coverage uses the same anchoring. Tests cover property wiring, recursive calls, and new Maven/Gradle/sbt compat smoke fixtures.

^{Reviewed by Cursor Bugbot for commit 04d20d1. Configure here.}

[Martin Torp (mtorp)]

Looks good. The fix does what it says, and the new Gradle smoke test fails against the old init script. I left a few small comments, mostly about the CHANGELOG and the tests. None of them block.