[Oskar Haarklou Veileborg (BarrensZeppelin)]

Coana runs with its working directory set to --target-path, so a relative --reach-output-file (default .socket.facts.json) is written inside the target directory. output.py and alert_selection.py already join the target path when they read it, but three places resolved it against the CLI's own working directory instead. Whenever the two differ, as they usually do in the Docker image (--target-path /scan, working directory /app):

• reading the reachability scan ID logged a spurious Facts file not found: .socket.facts.json warning, and Results written to: named the wrong path;
• --only-facts-file submitted os.path.abspath(".socket.facts.json"), a file that doesn't exist;
• --reach-use-only-pregenerated-sboms failed its os.path.exists check and silently left the facts file out of the upload.

run_reachability_analysis now resolves the path once with os.path.join(target_directory, output_path), the same rule output.py uses, so an absolute path passes through unchanged. It returns the result as report_path, which socketcli.py now uses for both submission modes. The Coana command line is unchanged.

The fake Coana in tests/unit/test_reachability.py now writes the facts file to its --socket-mode path, as the real one does. A new test runs the analysis from a working directory other than the target and checks both report_path and the scan ID, for relative and absolute output paths; the relative case fails without the fix. The two socketcli.py call-site changes have no dedicated tests, because that logic sits inside main_code() and nothing drives it today.

I found the warning while running a reachability full scan in the Docker image for #419. I have not rerun that scan with this fix.

Expected reviewer effort: Full code review

---

Note

Medium Risk
Changes which file path is submitted and logged for reachability runs; fixes broken Docker flows but incorrect paths could still affect scan uploads if join semantics were wrong.

Overview
Fixes reachability facts file path handling when the CLI’s working directory differs from --target-path (e.g. Docker: /app vs /scan). Coana already writes relative --reach-output-file paths under the target directory; this PR makes the Python CLI resolve that location consistently before reading the scan ID and submitting files.

run_reachability_analysis now joins target_directory with output_path (absolute paths unchanged), uses that for _extract_scan_id, and returns it as report_path. socketcli.py uses result['report_path'] for --only-facts-file and --reach-use-only-pregenerated-sboms instead of resolving against the CLI cwd.

Unit tests update the fake Coana wrapper to write the facts file like production and add coverage for relative and absolute output paths when cwd ≠ target.

^{Reviewed by Cursor Bugbot for commit e98b263. Configure here.}

[Martin Torp (mtorp)]

Good catch ✅