@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/inventory/auditCategories.js

@@ -23,6 +23,21 @@ export const GOLEM_AUDIT_CATEGORIES = Object.freeze([
   "golem-compliance",
 ]);
 
+/** Frozen list of Cargo (Rust) audit categories. */
+export const CARGO_AUDIT_CATEGORIES = Object.freeze([
+  "cargo-security",
+  "cargo-compliance",
+]);
+
+/**
+ * Frozen list of audit categories that never activate on their own. These
+ * rule packs serve a specific feature (`--introspect` for build-fidelity) and
+ * stay inactive unless the caller explicitly requests the category, so a
+ * default `--bom-audit` run - which evaluates every loaded rule - cannot pick
+ * them up.
+ */
+export const OPT_IN_BOM_AUDIT_CATEGORIES = Object.freeze(["build-fidelity"]);
+
 /** Frozen list of AI-bill-of-materials audit categories. */
 export const AI_BOM_AUDIT_CATEGORIES = Object.freeze([
   "ai-governance",
@@ -43,10 +58,12 @@ export const BOM_AUDIT_CATEGORY_ALIASES = Object.freeze({
   "ai-bom": [...AI_BOM_AUDIT_CATEGORIES, "ai-agent", "mcp-server"],
   "ai-provenance": ["ai-provenance", "ai-oversight"],
   "ai-oversight": ["ai-oversight"],
+  cargo: [...CARGO_AUDIT_CATEGORIES],
   cbom: [...CBOM_AUDIT_CATEGORIES],
   "crypto-bom": [...CBOM_AUDIT_CATEGORIES],
   golem: [...GOLEM_AUDIT_CATEGORIES],
   hbom: [...HBOM_AUDIT_CATEGORIES],
+  rust: [...CARGO_AUDIT_CATEGORIES],
   host: [...HBOM_AUDIT_CATEGORIES, ...HOST_TOPOLOGY_AUDIT_CATEGORIES],
 });
 

package/lib/inventory/cbomutils.js

@@ -345,6 +345,36 @@ function normalizeDosaiCryptoNames(cryptoObject) {
       names.add("sha-512");
     }
   }
+  // dosai reports the post-quantum families under their generic names and no
+  // generic OID exists for any of them, so the parameter set has to come from
+  // the call-site context (dosai's Code field carries the source line, e.g.
+  // "MLDsa.GenerateKey(MLDsaAlgorithm.MLDsa65)"). Without a parameter set the
+  // asset stays unmapped and is skipped rather than emitted with a wrong OID.
+  if (/^ML-?DSA$/i.test(cleanName)) {
+    const parameterSet = context.match(/(?:MLDsa|ML-DSA-)(44|65|87)\b/i);
+    if (parameterSet) {
+      names.add(`ml-dsa-${parameterSet[1]}`);
+    }
+  }
+  if (/^ML-?KEM$/i.test(cleanName)) {
+    const parameterSet = context.match(/(?:MLKem|ML-KEM-)(512|768|1024)\b/i);
+    if (parameterSet) {
+      names.add(`ml-kem-${parameterSet[1]}`);
+    }
+  }
+  if (/^SLH-?DSA$/i.test(cleanName)) {
+    // .NET spells it SlhDsaSha2_128s; NIST SLH-DSA-SHA2-128s. The hash family
+    // is required: SHA2 and SHAKE have distinct OIDs, so a context naming only
+    // the size, such as SLH-DSA-192f, resolves to no single parameter set.
+    const parameterSet = context.match(
+      /(?:SlhDsa|SLH-DSA-)(SHA2|SHAKE)[-_]?(128|192|256)(s|f)\b/i,
+    );
+    if (parameterSet) {
+      names.add(
+        `slh-dsa-${parameterSet[1].toLowerCase()}-${parameterSet[2]}${parameterSet[3].toLowerCase()}`,
+      );
+    }
+  }
   return Array.from(names);
 }
 

package/lib/inventory/cdxrs.js

@@ -25,8 +25,13 @@ import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
 import { safeExistsSync } from "../core/fs.js";
 import { getDefaultPluginRuntime, resolvePluginBinary } from "./plugins.js";
 
-/** Major version this bridge expects from the cdxrs binary. */
-const CDXRS_VERSION_MAJOR = "3";
+/**
+ * Major version this bridge expects from the cdxrs binary. cdxgen-plugins-bin
+ * versions every tool in lockstep, so this moves with
+ * `@cdxgen/cdxgen-plugins-bin` in package.json even when cdxrs itself carries
+ * no breaking change (4.0.0 is 3.2.0 renumbered by the release).
+ */
+const CDXRS_VERSION_MAJOR = "4";
 
 /** Default timeout for a cdxrs invocation. */
 const DEFAULT_TIMEOUT_MS = 30_000;

package/lib/inventory/communityAiConfigParser.js

@@ -1,8 +1,9 @@
 import { readFileSync } from "node:fs";
-import { basename, dirname, extname } from "node:path";
+import { basename, dirname, extname, join } from "node:path";
 
 import { parse as loadYaml } from "yaml";
 
+import { safeExistsSync } from "../core/fs.js";
 import { sanitizeBomPropertyValue } from "../core/propertySanitizer.js";
 import { parseJsonLike } from "./jsonLike.js";
 import {
@@ -28,6 +29,18 @@ const COMMUNITY_AI_PATTERNS = [
   "**/.claude/skills/*/SKILL.md",
   ".agents/skills/*/SKILL.md",
   "**/.agents/skills/*/SKILL.md",
+  ".codex/skills/*/SKILL.md",
+  "**/.codex/skills/*/SKILL.md",
+  "skills/*/SKILL.md",
+  "**/skills/*/SKILL.md",
+  ".claude-plugin/plugin.json",
+  "**/.claude-plugin/plugin.json",
+  ".claude-plugin/marketplace.json",
+  "**/.claude-plugin/marketplace.json",
+  ".claude/agents/*.md",
+  "**/.claude/agents/*.md",
+  ".claude/commands/**/*.md",
+  "**/.claude/commands/**/*.md",
   ".cursor/rules/*.{md,mdc}",
   "**/.cursor/rules/*.{md,mdc}",
   ".windsurf/rules/**/*.md",
@@ -145,9 +158,24 @@ function frameworkForFile(filePath, raw = "") {
   if (lowerPath.includes("/.claude/skills/")) {
     return "claude-compatible";
   }
+  if (lowerPath.includes("/.claude-plugin/")) {
+    return "claude-plugin";
+  }
+  if (lowerPath.includes("/.claude/agents/")) {
+    return "claude-subagent";
+  }
+  if (lowerPath.includes("/.claude/commands/")) {
+    return "claude-command";
+  }
+  if (lowerPath.includes("/.codex/skills/")) {
+    return "codex";
+  }
   if (lowerPath.includes("/.agents/skills/")) {
     return "agent-compatible";
   }
+  if (/(?:^|\/)skills\/[^/]+\/skill\.md$/u.test(lowerPath)) {
+    return "agent-skills";
+  }
   return "community-ai";
 }
 
@@ -250,6 +278,173 @@ function parseSkillFile(filePath, raw) {
       metadata.metadata,
     );
   }
+  // Record whether the frontmatter satisfies the open Agent Skills constraints
+  // (name: 1-64 lowercase-alnum-hyphen; description: 1-1024 chars) as a single
+  // reviewer-friendly boolean rather than copying the raw values twice.
+  const specValid =
+    typeof metadata?.name === "string" &&
+    /^[a-z0-9-]{1,64}$/u.test(metadata.name) &&
+    typeof metadata?.description === "string" &&
+    metadata.description.length >= 1 &&
+    metadata.description.length <= 1024;
+  addUniqueProperty(
+    component.properties,
+    "cdx:skill:specValid",
+    specValid ? "true" : "false",
+  );
+  const skillDir = dirname(filePath);
+  for (const [subdir, property] of [
+    ["scripts", "cdx:skill:hasScripts"],
+    ["references", "cdx:skill:hasReferences"],
+    ["assets", "cdx:skill:hasAssets"],
+  ]) {
+    if (safeExistsSync(join(skillDir, subdir))) {
+      addUniqueProperty(component.properties, property, "true");
+    }
+  }
+  maybeAddFileSignals(component.properties, filePath, raw);
+  return [component];
+}
+
+/**
+ * Parse a Claude Code plugin manifest (`.claude-plugin/plugin.json`) into a
+ * single application component describing the plugin.
+ *
+ * @param {string} filePath Manifest path
+ * @param {string} raw File contents
+ * @returns {Object[]} Component list (one plugin component or empty)
+ */
+function parsePluginManifest(filePath, raw) {
+  let manifest;
+  try {
+    manifest = parseJsonLike(raw);
+  } catch {
+    return [];
+  }
+  if (!manifest?.name) {
+    return [];
+  }
+  const component = createComponent(
+    filePath,
+    "claude-plugin",
+    "agent-plugin",
+    manifest.name,
+  );
+  if (manifest.version) {
+    component.version = String(manifest.version);
+  }
+  addUniqueProperty(
+    component.properties,
+    "cdx:plugin:description",
+    manifest.description,
+  );
+  addUniqueProperty(
+    component.properties,
+    "cdx:plugin:author",
+    typeof manifest.author === "string"
+      ? manifest.author
+      : manifest.author?.name,
+  );
+  for (const [key, property] of [
+    ["commands", "cdx:plugin:commandCount"],
+    ["agents", "cdx:plugin:agentCount"],
+    ["skills", "cdx:plugin:skillCount"],
+    ["hooks", "cdx:plugin:hookCount"],
+    ["mcpServers", "cdx:plugin:mcpServerCount"],
+  ]) {
+    const value = manifest[key];
+    if (Array.isArray(value)) {
+      addUniqueProperty(component.properties, property, String(value.length));
+    } else if (value && typeof value === "object") {
+      addUniqueProperty(
+        component.properties,
+        property,
+        String(Object.keys(value).length),
+      );
+    }
+  }
+  maybeAddFileSignals(component.properties, filePath, raw);
+  return [component];
+}
+
+/**
+ * Parse a Claude Code plugin marketplace file
+ * (`.claude-plugin/marketplace.json`) into one component per listed plugin.
+ *
+ * @param {string} filePath Marketplace path
+ * @param {string} raw File contents
+ * @returns {Object[]} Component list
+ */
+function parsePluginMarketplace(filePath, raw) {
+  let marketplace;
+  try {
+    marketplace = parseJsonLike(raw);
+  } catch {
+    return [];
+  }
+  const plugins = Array.isArray(marketplace?.plugins)
+    ? marketplace.plugins
+    : [];
+  const components = [];
+  for (const plugin of plugins) {
+    const name = plugin?.name || plugin?.source;
+    if (!name) {
+      continue;
+    }
+    const component = createComponent(
+      filePath,
+      "claude-plugin",
+      "agent-plugin-listing",
+      String(name),
+    );
+    addUniqueProperty(
+      component.properties,
+      "cdx:plugin:description",
+      plugin.description,
+    );
+    addUniqueProperty(
+      component.properties,
+      "cdx:plugin:source",
+      typeof plugin.source === "string" ? plugin.source : undefined,
+    );
+    components.push(component);
+  }
+  return components;
+}
+
+/**
+ * Parse a Claude Code subagent definition (`.claude/agents/*.md`) into an
+ * agent-definition component using its markdown frontmatter.
+ *
+ * @param {string} filePath Subagent markdown path
+ * @param {string} raw File contents
+ * @returns {Object[]} Component list
+ */
+function parseClaudeSubagent(filePath, raw) {
+  const { metadata } = parseFrontmatter(raw);
+  const name = metadata?.name || basename(filePath, extname(filePath));
+  const component = createComponent(
+    filePath,
+    "claude-subagent",
+    "agent-definition",
+    name,
+  );
+  addUniqueProperty(component.properties, "cdx:agent:role", "claude-subagent");
+  addUniqueProperty(
+    component.properties,
+    "cdx:agent:description",
+    metadata?.description,
+  );
+  addUniqueProperty(component.properties, "cdx:agent:model", metadata?.model);
+  if (Array.isArray(metadata?.tools)) {
+    addUniqueProperty(
+      component.properties,
+      "cdx:agent:tools",
+      metadata.tools.join(","),
+    );
+  } else if (typeof metadata?.tools === "string") {
+    addUniqueProperty(component.properties, "cdx:agent:tools", metadata.tools);
+  }
   maybeAddFileSignals(component.properties, filePath, raw);
   return [component];
 }
@@ -708,10 +903,28 @@ export const communityAiConfigParser = {
         components.push(...parseAgentMarkdown(filePath, raw));
         continue;
       }
+      if (lowerPath.endsWith("/.claude-plugin/plugin.json")) {
+        components.push(...parsePluginManifest(filePath, raw));
+        continue;
+      }
+      if (lowerPath.endsWith("/.claude-plugin/marketplace.json")) {
+        components.push(...parsePluginMarketplace(filePath, raw));
+        continue;
+      }
+      if (lowerPath.includes("/.claude/agents/")) {
+        components.push(...parseClaudeSubagent(filePath, raw));
+        continue;
+      }
+      if (lowerPath.includes("/.claude/commands/")) {
+        components.push(...parseInstructionMarkdown(filePath, raw));
+        continue;
+      }
       if (
         lowerPath.includes("/.opencode/skills/") ||
         lowerPath.includes("/.claude/skills/") ||
-        lowerPath.includes("/.agents/skills/")
+        lowerPath.includes("/.agents/skills/") ||
+        lowerPath.includes("/.codex/skills/") ||
+        lowerPath.endsWith("/skill.md")
       ) {
         components.push(...parseSkillFile(filePath, raw));
         continue;

package/lib/inventory/depsUtils.js

@@ -222,6 +222,28 @@ function serviceIdentityKey(service) {
   return `${service?.group || ""}:${service?.name || ""}:${service?.version || ""}`.toLowerCase();
 }
 
+/**
+ * Union two services[].data[] lists, keyed by flow + classification + name so that repeated
+ * classifications of the same payload do not accumulate duplicates.
+ *
+ * @param {Array} existingData Data entries already on the service
+ * @param {Array} newData Data entries being merged in
+ * @returns {Array} Merged data entries
+ */
+function mergeServiceData(existingData = [], newData = []) {
+  const seen = new Map();
+  for (const entry of [...existingData, ...newData]) {
+    if (!entry?.flow || !entry?.classification) {
+      continue;
+    }
+    const key = `${entry.flow}|${entry.classification}|${entry.name || ""}`;
+    if (!seen.has(key)) {
+      seen.set(key, entry);
+    }
+  }
+  return Array.from(seen.values());
+}
+
 function mergeServiceProperties(existingProps = [], newProps = []) {
   const merged = [...existingProps];
   for (const newProp of newProps) {
@@ -249,6 +271,38 @@ function normalizeServiceEndpoints(endpoints) {
   return [];
 }
 
+function evidenceOccurrenceKey(occurrence) {
+  const location = occurrence?.location || {};
+  return `${location.path || ""}#${location.line ?? ""}#${location.column ?? ""}`;
+}
+
+/**
+ * Union two service evidence objects by their occurrences so a collision keeps
+ * every call site instead of whichever side arrived first.
+ *
+ * @param {Object} [existingEvidence] Evidence already on the service
+ * @param {Object} [newEvidence] Evidence being merged in
+ * @returns {Object} Evidence covering both inputs
+ */
+function mergeServiceEvidence(existingEvidence, newEvidence) {
+  if (!existingEvidence) {
+    return newEvidence;
+  }
+  const occurrences = [...(existingEvidence.occurrences || [])];
+  const seen = new Set(occurrences.map(evidenceOccurrenceKey));
+  for (const occurrence of newEvidence?.occurrences || []) {
+    const key = evidenceOccurrenceKey(occurrence);
+    if (!seen.has(key)) {
+      seen.add(key);
+      occurrences.push(occurrence);
+    }
+  }
+  if (!occurrences.length) {
+    return existingEvidence;
+  }
+  return { ...existingEvidence, occurrences };
+}
+
 /**
  * Merge CycloneDX services using bom-ref or group/name/version identity.
  *
@@ -313,6 +367,24 @@ export function mergeServices(services, newServices) {
       existing.properties || [],
       service.properties || [],
     );
+    // Carry the richer fields through a collision too. Without these, a dosai service that collided
+    // with one derived from endpoints lost precisely what schema 4.0.0 adds: its bom-ref, its data
+    // classifications, and its evidence.
+    existing["bom-ref"] = existing["bom-ref"] || service["bom-ref"];
+    if (Array.isArray(service.data) && service.data.length) {
+      existing.data = mergeServiceData(existing.data || [], service.data);
+    }
+    if (service.evidence) {
+      existing.evidence = mergeServiceEvidence(
+        existing.evidence,
+        service.evidence,
+      );
+    }
+    if (Array.isArray(service.tags) && service.tags.length) {
+      existing.tags = Array.from(
+        new Set([...(existing.tags || []), ...service.tags]),
+      );
+    }
     if (Array.isArray(service.services) && service.services.length) {
       existing.services = mergeServices(
         existing.services || [],