fix(scan): scope --reach-ecosystems to reachability-supported ecosystems

[Martin Torp (mtorp)]

Problem

socket scan create --reach --reach-ecosystems <values> (and socket scan reach) validated the --reach-ecosystems values against the full purl-type list (ALL_ECOSYSTEMS, 32 entries), which is far broader than what the Coana reachability engine accepts. As a result, ecosystems the engine cannot analyze — e.g. conda — passed CLI validation and only failed partway through the scan with an opaque engine-level error:

Invalid purl type: conda. Supported purl types are: npm, maven, pypi, golang, composer, nuget

The CLI's validation list and the engine's accepted list disagreed, so bad input surfaced late and confusingly instead of failing fast at the CLI.

Fix

Scope --reach-ecosystems validation to the set the Coana engine's --purl-types gate actually accepts, and share it between both commands:

• New REACHABILITY_SUPPORTED_ECOSYSTEMS constant + getReachabilityEcosystemChoices() in src/utils/ecosystem.mts: cargo, composer, gem, golang, maven, npm, nuget, pypi.
• New shared parseReachEcosystems() validator (throws InputError) replaces the two duplicated inline validation loops in cmd-scan-create.mts and cmd-scan-reach.mts.
• ALL_ECOSYSTEMS / getEcosystemChoicesForMeow() are left untouched — the fix command still validates its --ecosystems against the full purl-type list.
• The --reach-ecosystems help text now lists the supported ecosystems, generated from the constant so it cannot drift.

Why this set

The set was verified against the bundled @coana-tech/cli 15.8.8 source. Its --purl-types validation gate (getAdvisoryEcosystemFromPurlType) accepts exactly these 8 purl types, and each one maps to a dedicated reachability analyzer that ships in the engine:

purl type	Coana reachability analyzer
npm	JS Reachability Analyzer
maven	Java Reachability Analyzer
pypi	Python Reachability Analyzer
nuget	.NET Reachability Analyzer
golang	Go Reachability Analyzer
composer	PHP Reachability Analyzer
cargo	Rust Reachability Analyzer
gem	Ruby Reachability Analyzer

So all 8 are genuinely reachability-supported: validating against them means the CLI accepts everything the engine can analyze and fails fast on everything else.

Release

This PR bumps the patch version 1.1.143 → 1.1.144 and adds the dated 1.1.144 CHANGELOG entry, so merging it stages a new patch release. The actual npm publish is the manual Publish to npm registry workflow (.github/workflows/provenance.yml, workflow_dispatch), which publishes the package.json version at HEAD and tags v1.1.144.

Testing

• pnpm check (lint + tsc) passes.
• cmd-scan-create.test.mts and cmd-scan-reach.test.mts pass, including a new regression test asserting a valid-but-unsupported purl type (conda) is rejected.
• Manual e2e (dry run): --reach-ecosystems maven,pypi,conda now errors immediately at the CLI; maven,pypi and cargo,gem pass validation.

Out of scope / follow-ups

• Coana's own runtime error message under-reports its supported set: it lists only 6 purl types (npm, maven, pypi, golang, composer, nuget) and omits cargo/gem, even though the engine ships Rust and Ruby reachability analyzers and its --purl-types gate accepts them. That misleading message is a Coana-engine issue, tracked separately under REA.
• The v2.0.0 / main line (monorepo packages/cli/src/... layout) has the identical CLI bug and needs a parallel port.

---

Note

Low Risk
CLI input validation only; narrows accepted values and fails fast with clearer errors, with no changes to scan execution or auth paths beyond earlier rejection of bad flags.

Overview
--reach-ecosystems on socket scan create (with --reach) and socket scan reach no longer validates against the full purl-type list. It now checks only the eight ecosystems the Coana reachability engine accepts (cargo, composer, gem, golang, maven, npm, nuget, pypi), so values like conda fail immediately with a clear error instead of dying mid-scan.

Shared REACHABILITY_SUPPORTED_ECOSYSTEMS, parseReachEcosystems(), and help text driven by getReachabilityEcosystemChoices() replace duplicated inline loops in both scan commands. socket fix --ecosystems still uses the full ALL_ECOSYSTEMS list.

Patch release 1.1.144 with a CHANGELOG entry; regression test covers rejecting conda on scan reach.

^{Reviewed by Cursor Bugbot for commit 8578ffc. Configure here.}