[lelia]

Documents the network access full application reachability needs (socket scan reach, socket scan create --reach). None of it is in the README today, and one failure mode is quiet: with the package registry blocked, the analysis completes and reports every affected vulnerability as INSTALL ERROR.

• New "Network access" section under Reachability analysis:
  • the hosts: api.socket.dev, storage.googleapis.com (engine download, about 120 MB) and each ecosystem's package registry, with what fails when each is blocked;
  • that an npm mirror does not cover the engine download, and that preinstalled dependencies remove the registry need;
  • the $XDG_CACHE_HOME/socket/coana cache.
• Proxy workaround: the CLI does not apply HTTPS_PROXY or SOCKET_CLI_API_PROXY to its own requests, and fails with getaddrinfo EAI_AGAIN api.socket.dev. Setting NODE_USE_ENV_PROXY=1 routes them through the proxy. The SOCKET_CLI_API_PROXY entry under development environment variables points to this.

Documentation-only, so no changelog entry.

Verification

Every claim was checked against socket 1.13.1 (socket scan reach, driven by Socket Basics) on an npm test project, with a DNS sidecar that logged and allowlisted hostnames, plus a logging proxy on a network with no other egress:

Setup	Result
everything allowed	1 reachable, 4 unreachable; lookups: api.socket.dev, storage.googleapis.com, registry.npmjs.org
api.socket.dev, storage.googleapis.com only	completes, all 5 vulnerabilities INSTALL ERROR
same, with node_modules preinstalled	full results
storage.googleapis.com blocked	Failed to get the Coana CLI 15.14.1: getaddrinfo ENOTFOUND storage.googleapis.com
warm cache, storage.googleapis.com blocked	full results, no engine download
proxy only, HTTPS_PROXY or SOCKET_CLI_API_PROXY	getaddrinfo EAI_AGAIN api.socket.dev (1.1.165 behaves the same)
proxy only, plus NODE_USE_ENV_PROXY=1	full results, all traffic through the proxy