@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/helpers/remote/dependency-track.js

@@ -1,4 +1,5 @@
 import { Buffer } from "node:buffer";
+import { randomBytes } from "node:crypto";
 
 import { hasDangerousUnicode } from "../../core/activity.js";
 
@@ -44,26 +45,23 @@ export function getDependencyTrackBomUrl(serverUrl) {
 }
 
 /**
- * Build the payload for Dependency-Track BOM submission.
+ * Build the form fields for a Dependency-Track BOM submission.
+ *
+ * Field names follow the `multipart/form-data` variant of `/api/v1/bom`, which differs
+ * from the JSON variant: the JSON body calls the flag `isLatestProjectVersion` and takes
+ * `projectTags` as an array of objects, while the form takes `isLatest` and a
+ * comma-separated tag list.
  *
  * @param {Object} args CLI/server arguments
- * @param {Object} bomContents BOM Json
- * @returns {Object | undefined} payload object if project coordinates are valid
+ * @returns {Object | undefined} field map if the project coordinates are valid
  */
-export function buildDependencyTrackBomPayload(args, bomContents) {
-  let encodedBomContents = Buffer.from(JSON.stringify(bomContents)).toString(
-    "base64",
-  );
-  if (encodedBomContents.startsWith("77u/")) {
-    encodedBomContents = encodedBomContents.substring(4);
-  }
+export function buildDependencyTrackBomPayload(args) {
   const autoCreate =
     typeof args.autoCreate === "boolean"
       ? args.autoCreate
       : args.autoCreate !== "false";
   const bomPayload = {
     autoCreate: String(autoCreate),
-    bom: encodedBomContents,
   };
   if (
     typeof args.projectId !== "undefined" ||
@@ -103,15 +101,84 @@ export function buildDependencyTrackBomPayload(args, bomContents) {
     args.isLatest === "true" ||
     args.isLatest === "false"
   ) {
-    bomPayload.isLatest =
+    bomPayload.isLatest = String(
       typeof args.isLatest === "boolean"
         ? args.isLatest
-        : args.isLatest === "true";
+        : args.isLatest === "true",
+    );
   }
   if (typeof args.projectTag !== "undefined") {
+    // The server splits this field on commas, so a tag cannot itself contain one.
     bomPayload.projectTags = (
       Array.isArray(args.projectTag) ? args.projectTag : [args.projectTag]
-    ).map((tag) => ({ name: tag }));
+    ).join(",");
   }
   return bomPayload;
 }
+
+/**
+ * Encode text fields and a single file part as a `multipart/form-data` body.
+ *
+ * @param {Object} fields Text fields keyed by field name
+ * @param {Object} file File part
+ * @param {string} file.name Field name of the file part
+ * @param {string} file.filename File name reported to the server
+ * @param {string} file.contentType Content type of the file part
+ * @param {Buffer} file.content File content
+ * @returns {{ body: Buffer, contentType: string }} encoded body and its content type
+ */
+export function encodeMultipartFormData(fields, file) {
+  // A random boundary keeps the delimiter from colliding with the BOM content.
+  const boundary = `--------------------------cdxgen${randomBytes(16).toString("hex")}`;
+  const chunks = [];
+  const pushPart = (header, content) => {
+    chunks.push(
+      Buffer.from(`--${boundary}\r\n${header}\r\n\r\n`),
+      Buffer.isBuffer(content) ? content : Buffer.from(String(content)),
+      Buffer.from("\r\n"),
+    );
+  };
+  for (const [name, value] of Object.entries(fields)) {
+    pushPart(`Content-Disposition: form-data; name="${name}"`, value);
+  }
+  pushPart(
+    `Content-Disposition: form-data; name="${file.name}"; filename="${file.filename}"\r\nContent-Type: ${file.contentType}`,
+    file.content,
+  );
+  chunks.push(Buffer.from(`--${boundary}--\r\n`));
+  return {
+    body: Buffer.concat(chunks),
+    contentType: `multipart/form-data; boundary=${boundary}`,
+  };
+}
+
+/**
+ * Build the `multipart/form-data` request for Dependency-Track BOM submission.
+ *
+ * The JSON variant of the endpoint carries the BOM as a base64 string, which Jackson
+ * refuses to read beyond 20,000,000 characters - roughly a 15 MB BOM, which container
+ * image scans exceed routinely. The form variant carries the BOM as a file part and has
+ * no such limit, and is what the server recommends for large uploads.
+ *
+ * @param {Object} args CLI/server arguments
+ * @param {Object | string} bomContents BOM Json
+ * @returns {{ body: Buffer, contentType: string } | undefined} request body and content type if the arguments are valid
+ */
+export function buildDependencyTrackBomRequest(args, bomContents) {
+  if (!bomContents) {
+    return undefined;
+  }
+  const fields = buildDependencyTrackBomPayload(args);
+  if (!fields) {
+    return undefined;
+  }
+  const bomString =
+    typeof bomContents === "string" ? bomContents : JSON.stringify(bomContents);
+  return encodeMultipartFormData(fields, {
+    name: "bom",
+    filename: "bom.json",
+    contentType: "application/vnd.cyclonedx+json",
+    // The server rejects a BOM that still carries a byte order mark.
+    content: Buffer.from(bomString.replace(/^\ufeff/, "")),
+  });
+}

package/lib/inventory/agentFormulationParser.js

@@ -1,6 +1,7 @@
 import { readFileSync } from "node:fs";
-import { basename, extname } from "node:path";
+import { basename, dirname, extname, join } from "node:path";
 
+import { safeExistsSync } from "../core/fs.js";
 import { sanitizeBomUrl } from "../core/propertySanitizer.js";
 import {
   credentialIndicatorsForText,
@@ -11,10 +12,20 @@ import {
 import { scanTextForHiddenUnicode } from "./unicodeScan.js";
 
 const AGENT_FILE_PATTERNS = [
+  // The discovery glob is case-insensitive, so a single entry covers AGENTS.md
+  // and agents.md; AGENT.md is a distinct singular filename.
   "AGENTS.md",
-  "agents.md",
+  "AGENT.md",
   "CLAUDE.md",
+  "GEMINI.md",
+  "QWEN.md",
   "Cursor.md",
+  "CONVENTIONS.md",
+  ".cursorrules",
+  ".windsurfrules",
+  ".clinerules",
+  ".clinerules/**/*.{md,markdown,txt}",
+  ".aider.conf.yml",
   ".github/copilot-instructions.md",
   ".github/instructions/**/*.{md,mdx,markdown,txt}",
   ".github/workflows/copilot-setup-steps.yml",
@@ -49,15 +60,57 @@ function syntaxForFile(filePath) {
   return "text";
 }
 
+/**
+ * Determine whether a CONVENTIONS.md file is an Aider conventions file rather
+ * than an ordinary docs file, by looking for a sibling Aider marker.
+ *
+ * The original (not lower-cased) path must be passed: on a case-sensitive
+ * filesystem a lower-cased directory does not exist, which would silently make
+ * every CONVENTIONS.md look unmarked.
+ *
+ * @param {string} filePath Original file path as discovered
+ * @returns {boolean} true when an Aider marker sits alongside the file
+ */
+function hasAiderMarker(filePath) {
+  const directory = dirname(filePath);
+  return (
+    safeExistsSync(join(directory, ".aider.conf.yml")) ||
+    safeExistsSync(join(directory, ".aider.conf.yaml")) ||
+    safeExistsSync(join(directory, ".aider.model.settings.yml"))
+  );
+}
+
 function kindForFile(filePath) {
-  const lowerPath = filePath.toLowerCase();
+  // Normalize separators so the endsWith/includes checks below behave the same
+  // on Windows (backslash) and POSIX (forward slash) absolute paths.
+  const lowerPath = filePath.replaceAll("\\", "/").toLowerCase();
   if (lowerPath.endsWith("copilot-setup-steps.yml")) {
     return "copilot-setup-workflow";
   }
   if (lowerPath.endsWith("copilot-instructions.md")) {
     return "copilot-instructions";
   }
-  if (lowerPath.endsWith("agents.md") || lowerPath.endsWith("claude.md")) {
+  if (lowerPath.endsWith(".aider.conf.yml")) {
+    return "agent-config";
+  }
+  // CONVENTIONS.md is an Aider convention but also an ordinary docs filename.
+  // Only classify it as agent instructions when an Aider marker sits beside it;
+  // otherwise treat it as a generic file so unrelated repos are not tagged.
+  if (lowerPath.endsWith("conventions.md")) {
+    return hasAiderMarker(filePath) ? "agent-instructions" : "ai-agent-file";
+  }
+  if (
+    lowerPath.endsWith("agents.md") ||
+    lowerPath.endsWith("agent.md") ||
+    lowerPath.endsWith("claude.md") ||
+    lowerPath.endsWith("gemini.md") ||
+    lowerPath.endsWith("qwen.md") ||
+    lowerPath.endsWith("cursor.md") ||
+    lowerPath.endsWith(".cursorrules") ||
+    lowerPath.endsWith(".windsurfrules") ||
+    lowerPath.endsWith(".clinerules") ||
+    lowerPath.includes("/.clinerules/")
+  ) {
     return "agent-instructions";
   }
   if (lowerPath.endsWith(".prompt") || lowerPath.endsWith(".mdc")) {