@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/cli/index.js

@@ -18,6 +18,7 @@ import {
   recordActivity,
   setActivityContext,
 } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
 import { hasAnyProjectType, PROJECT_TYPE_ALIASES } from "../core/env.js";
 import {
   clearFileDiscoveryCache,
@@ -31,6 +32,11 @@ import { thoughtLog } from "../core/logger.js";
 import { mapWithConcurrency } from "../core/parallel.js";
 import { dirNameStr } from "../core/paths.js";
 import { ui } from "../core/ui.js";
+import { isElmProjectFile } from "../ecosystems/parsers-elm.js";
+import {
+  isJuliaManifestFile,
+  isJuliaProjectFile,
+} from "../ecosystems/parsers-julia.js";
 import {
   parseBitbucketPipelinesFile,
   parseContainerFile,
@@ -40,7 +46,7 @@ import {
 } from "../ecosystems/parsers-misc.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
-  buildDependencyTrackBomPayload,
+  buildDependencyTrackBomRequest,
   getDependencyTrackBomApiUrl,
 } from "../helpers/remote/dependency-track.js";
 import { optionIncludesAiInventoryProjectType } from "../inventory/aiInventory.js";
@@ -89,6 +95,7 @@ import {
   determineParentComponent,
 } from "./bomAssembly.js";
 import {
+  createAgenticBom,
   createAsarBom,
   createCaxaBom,
   createChromeExtensionBom,
@@ -125,24 +132,36 @@ import {
   createGitHubBom,
   createHelmBom,
   createJenkinsBom,
+  createPerlBom,
   createPHPBom,
   createPythonBom,
+  createRBom,
   createRubyBom,
+  createTerraformBom,
 } from "./managedBom.js";
 import {
   createCargoCacheBom,
   createClojureBom,
   createCocoaBom,
   createCppBom,
+  createCrystalBom,
   createDartBom,
   createElixirBom,
+  createElmBom,
+  createErlangBom,
   createGleamBom,
   createGoBom,
   createHaskellBom,
+  createJuliaBom,
+  createLuaBom,
+  createNimBom,
   createNixBom,
+  createOCamlBom,
   createRustBom,
+  createSpackBom,
   createSwiftBom,
   createZigBom,
+  findStackLockFiles,
   getCargoCacheDir,
 } from "./nativeBom.js";
 
@@ -153,26 +172,42 @@ export {
   createGitHubBom,
   createHelmBom,
   createJenkinsBom,
+  createPerlBom,
   createPHPBom,
   createPixiBom,
   createPythonBom,
+  createRBom,
   createRubyBom,
+  createTerraformBom,
 } from "./managedBom.js";
 export {
   createClojureBom,
   createCocoaBom,
   createCppBom,
+  createCrystalBom,
   createDartBom,
   createElixirBom,
+  createElmBom,
+  createErlangBom,
   createGleamBom,
   createGoBom,
   createHaskellBom,
+  createJuliaBom,
+  createLuaBom,
+  createNimBom,
   createNixBom,
+  createOCamlBom,
   createRustBom,
+  createSpackBom,
   createSwiftBom,
   createZigBom,
 } from "./nativeBom.js";
 
+import {
+  deferFailOnError,
+  isDeferredFailOnError,
+} from "../core/deferredExit.js";
+
 const dirName = dirNameStr;
 
 const isWin = _platform() === "win32";
@@ -816,6 +851,23 @@ export async function createMultiXBom(pathList, options) {
   // from here on, so repeated walks of them can share one view of the tree.
   setDirWalkCacheRoot(options.allLayersExplodedDir);
   const scanOnePath = async (path) => {
+    try {
+      return await scanOnePathInner(path);
+    } catch (err) {
+      if (!isDeferredFailOnError(err)) {
+        throw err;
+      }
+      // The failing path contributes nothing, and the remaining paths still
+      // do: fail-on-error scopes the loss to the leg that failed.
+      return {
+        components: [],
+        dependencies: [],
+        options: { ...sharedOptions },
+        parentSubComponents: [],
+      };
+    }
+  };
+  const scanOnePathInner = async (path) => {
     // Each path accumulates into its own lists and its own view of options, so
     // that legs which record a parent component or a tool cannot overwrite
     // another path's. The lists are merged below in pathList order.
@@ -1433,6 +1485,14 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("jar", path);
+      recordDegradation("jvm.jar.heuristic", {
+        ecosystem: "java",
+        tool: "jar",
+        impact: "versions",
+        path,
+        detail:
+          "Components are being inferred by scanning jar/war/ear files from disk.",
+      });
       bomData = await createJarBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -2029,7 +2089,8 @@ export async function createXBom(path, options) {
     `${options.multiProject ? "**/" : ""}cabal.project.freeze`,
     options,
   );
-  if (hackageFiles.length) {
+  const stackLockDetectFiles = findStackLockFiles(path, options);
+  if (hackageFiles.length || stackLockDetectFiles.length) {
     return createHaskellBom(path, options);
   }
 
@@ -2254,6 +2315,131 @@ export async function createXBom(path, options) {
   if (gleamTomlFiles.length) {
     return await createGleamBom(path, options);
   }
+
+  // Julia
+  const juliaProjectFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}Project.toml`,
+    options,
+  );
+  const juliaManifestFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}Manifest.toml`,
+    options,
+  );
+  // `Project.toml` is not a name Julia owns — Cloud Native Buildpacks use it
+  // too — so dispatch only when a file actually declares a Julia environment.
+  if (
+    juliaManifestFiles.some(isJuliaManifestFile) ||
+    juliaProjectFiles.some(isJuliaProjectFile)
+  ) {
+    return await createJuliaBom(path, options);
+  }
+
+  // Erlang with rebar3
+  const rebarLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}rebar.lock`,
+    options,
+  );
+  if (rebarLockFiles.length) {
+    return await createErlangBom(path, options);
+  }
+
+  // OCaml with opam
+  const opamLockedFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.opam.locked`,
+    options,
+  );
+  if (opamLockedFiles.length) {
+    return await createOCamlBom(path, options);
+  }
+
+  // Elm with elm.json (0.19) or elm-package.json (0.18)
+  const elmJsonFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm.json`,
+    options,
+  ).filter(isElmProjectFile);
+  const legacyElmFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm-package.json`,
+    options,
+  );
+  if (elmJsonFiles.length || legacyElmFiles.length) {
+    return await createElmBom(path, options);
+  }
+
+  // Crystal with shards
+  const shardYmlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}shard.yml`,
+    options,
+  );
+  if (shardYmlFiles.length) {
+    return await createCrystalBom(path, options);
+  }
+
+  // Nim with nimble
+  const nimbleFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.nimble`,
+    options,
+  );
+  if (nimbleFiles.length) {
+    return await createNimBom(path, options);
+  }
+
+  // Lua with LuaRocks
+  const rockspecFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.rockspec`,
+    options,
+  );
+  if (rockspecFiles.length) {
+    return await createLuaBom(path, options);
+  }
+
+  // Spack environments
+  const spackLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}spack.lock`,
+    options,
+  );
+  if (spackLockFiles.length) {
+    return await createSpackBom(path, options);
+  }
+
+  // R with renv
+  const renvLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}renv.lock`,
+    options,
+  );
+  if (renvLockFiles.length) {
+    return createRBom(path, options);
+  }
+
+  // Perl with Carton
+  const cpanSnapshotFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}cpanfile.snapshot`,
+    options,
+  );
+  if (cpanSnapshotFiles.length) {
+    return createPerlBom(path, options);
+  }
+
+  // Terraform and OpenTofu providers
+  const tfLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
+    options,
+  );
+  if (tfLockFiles.length) {
+    return createTerraformBom(path, options);
+  }
 }
 
 /**
@@ -2292,7 +2478,28 @@ export async function createHBom(_path, options) {
  * @param {Object} options Parse options from the cli
  * @returns {Promise<Object>} Promise resolving to BOM object
  */
+/**
+ * Generate a BOM for one path, letting a deferred fail-on-error abort return
+ * the empty BOM the flag promises rather than unwinding past the reports.
+ *
+ * @param {string} path Source path.
+ * @param {Object} options CLI options.
+ * @returns {Promise<Object>} BOM NS data.
+ */
 export async function createBom(path, options) {
+  try {
+    return await createBomForPath(path, options);
+  } catch (err) {
+    if (!isDeferredFailOnError(err)) {
+      throw err;
+    }
+    // fail-on-error forbids an incomplete result, so the extractor kept
+    // nothing; the CLI still writes the reports and exits non-zero.
+    return buildBomNSData(options, [], "", { src: path, filename: "" });
+  }
+}
+
+async function createBomForPath(path, options) {
   clearFileDiscoveryCache();
   let { projectType } = options;
   if (!projectType) {
@@ -2327,7 +2534,11 @@ export async function createBom(path, options) {
       console.log(
         `OS BOM generation has failed due to problems with exporting the image ${path}`,
       );
-      options.failOnError && process.exit(1);
+      deferFailOnError(options, {
+        ecosystem: "container",
+        tool: "docker",
+        detail: "exporting the image for the OS BOM failed",
+      });
       return {};
     }
     isContainerMode = true;
@@ -2367,7 +2578,11 @@ export async function createBom(path, options) {
         console.log(
           `OCI BOM generation has failed due to problems with exporting the image ${path}.`,
         );
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "container",
+          tool: "docker",
+          detail: "exporting the image for the OCI BOM failed",
+        });
         return {};
       }
       if (DEBUG_MODE) {
@@ -2576,6 +2791,39 @@ export async function createBom(path, options) {
   if (PROJECT_TYPE_ALIASES["gleam"].includes(projectType[0])) {
     return await createGleamBom(path, options);
   }
+  if (PROJECT_TYPE_ALIASES["julia"].includes(projectType[0])) {
+    return await createJuliaBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["erlang"].includes(projectType[0])) {
+    return await createErlangBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["ocaml"].includes(projectType[0])) {
+    return await createOCamlBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["elm"].includes(projectType[0])) {
+    return await createElmBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["crystal"].includes(projectType[0])) {
+    return await createCrystalBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["nim"].includes(projectType[0])) {
+    return await createNimBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["lua"].includes(projectType[0])) {
+    return await createLuaBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["spack"].includes(projectType[0])) {
+    return await createSpackBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["r"].includes(projectType[0])) {
+    return createRBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["perl"].includes(projectType[0])) {
+    return createPerlBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["terraform"].includes(projectType[0])) {
+    return createTerraformBom(path, options);
+  }
   if (PROJECT_TYPE_ALIASES["caxa"].includes(projectType[0])) {
     return await createCaxaBom(path, options);
   }
@@ -2585,6 +2833,9 @@ export async function createBom(path, options) {
   if (PROJECT_TYPE_ALIASES["vscode-extension"].includes(projectType[0])) {
     return await createVscodeExtensionBom(path, options);
   }
+  if (PROJECT_TYPE_ALIASES["agentic"].includes(projectType[0])) {
+    return await createAgenticBom(path, options);
+  }
   if (PROJECT_TYPE_ALIASES["chrome-extension"].includes(projectType[0])) {
     return await createChromeExtensionBom(path, options);
   }
@@ -2660,8 +2911,8 @@ export async function submitBom(args, bomContents) {
     });
     return undefined;
   }
-  const bomPayload = buildDependencyTrackBomPayload(args, bomContents);
-  if (!bomPayload) {
+  const bomRequest = buildDependencyTrackBomRequest(args, bomContents);
+  if (!bomRequest) {
     console.log(
       "Invalid Dependency-Track submission arguments. Provide projectId or projectName (projectVersion defaults to main) and specify parent project either by UUID or by parent project name + version.",
     );
@@ -2674,21 +2925,21 @@ export async function submitBom(args, bomContents) {
       serverUrl,
       "params",
       args.projectName,
-      bomPayload.projectVersion,
+      args.projectVersion || "main",
     );
   }
   try {
     const requestOptions = {
-      method: "PUT",
+      method: "POST",
       followRedirect: false,
       https: {
         rejectUnauthorized: !args.skipDtTlsCheck,
       },
       headers: {
         "X-Api-Key": (args.apiKey || "").replace(/[\r\n]/g, ""),
-        "Content-Type": "application/json",
+        "Content-Type": bomRequest.contentType,
       },
-      json: bomPayload,
+      body: bomRequest.body,
       responseType: "json",
       context: {
         activityIntent: "bom-submit",
@@ -2711,47 +2962,15 @@ export async function submitBom(args, bomContents) {
       );
     } else if (error.response && error.response.statusCode === 405) {
       console.log(
-        "Method PUT not allowed on Dependency-Track server. Trying with POST ...",
+        `The server at ${serverUrl} does not accept a multipart/form-data POST on /api/v1/bom. Check that the URL points to a Dependency-Track 4.x or later API server.`,
+      );
+    } else if (DEBUG_MODE) {
+      console.log(
+        "Unable to submit the SBOM to the Dependency-Track server",
+        error,
       );
-      // Method not allowed errors
-      try {
-        return await cdxgenAgent(dependencyTrackApiUrl, {
-          method: "POST",
-          followRedirect: false,
-          https: {
-            rejectUnauthorized: !args.skipDtTlsCheck,
-          },
-          headers: {
-            "X-Api-Key": (args.apiKey || "").replace(/[\r\n]/g, ""),
-            "Content-Type": "application/json",
-          },
-          json: bomPayload,
-          responseType: "json",
-          context: {
-            activityIntent: "bom-submit",
-          },
-        }).json();
-      } catch (error) {
-        if (DEBUG_MODE) {
-          console.log(
-            "Unable to submit the SBOM to the Dependency-Track server using POST method",
-            error,
-          );
-        } else {
-          console.log(
-            "Unable to submit the SBOM to the Dependency-Track server using POST method",
-          );
-        }
-      }
     } else {
-      if (DEBUG_MODE) {
-        console.log(
-          "Unable to submit the SBOM to the Dependency-Track server using POST method",
-          error,
-        );
-      } else {
-        console.log("Unable to submit the SBOM to the Dependency-Track server");
-      }
+      console.log("Unable to submit the SBOM to the Dependency-Track server");
     }
     // rethrow error as function is async and we should try to catch it in the caller
     throw error;

package/lib/cli/jsBom.js

@@ -11,6 +11,8 @@ import {
   readEnvironmentVariable,
   recordSensitiveFileRead,
 } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import { deferFailOnError } from "../core/deferredExit.js";
 import { hasAnyProjectType, isPackageManagerAllowed } from "../core/env.js";
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
@@ -51,6 +53,10 @@ import {
   fetchHuggingFaceAssetInventory,
   normalizeHuggingFaceReference,
 } from "../ecosystems/remote/huggingface.js";
+import {
+  AGENTIC_TOOL_PURL_TYPE,
+  collectAgenticTools,
+} from "../helpers/agenticToolutils.js";
 import {
   cleanupTempDir,
   collectInstalledExtensions,
@@ -98,6 +104,13 @@ const isWin = _platform() === "win32";
  * local Modelfile/`.gguf` file input. Returns the explicit selection from
  * `getExactAiInventoryType` when one is present.
  *
+ * Direct HuggingFace interpretation of the source path is opt-in: only
+ * unambiguous references (`pkg:huggingface/...` purls and huggingface.co
+ * URLs) are recognized on their own. Bare `owner/repo`-shaped values are
+ * ordinary relative paths (eg: `repotests/sveltejs-realworld`) unless an AI
+ * inventory type such as `-t ai` is explicitly selected, in which case
+ * `getExactAiInventoryType` already returned it above.
+ *
  * @param {string} path Project or file path
  * @param {object} options CLI options
  * @returns {string|undefined} The detected AI inventory type (`"ai"`) or undefined
@@ -107,7 +120,7 @@ export function getDirectAiInventoryType(path, options) {
   if (exactAiInventoryType) {
     return exactAiInventoryType;
   }
-  if (normalizeHuggingFaceReference(path)) {
+  if (normalizeHuggingFaceReference(path, { explicitOnly: true })) {
     return "ai";
   }
   try {
@@ -155,8 +168,10 @@ export async function createNodejsBom(path, options) {
         excludedAiInventoryTypes,
       );
   let aiInventory = { components: [], dependencies: [], services: [] };
+  // A value that exists on the local filesystem is always a project path -
+  // never a remote model id - so existing inputs skip remote resolution.
   const directHuggingFaceSource =
-    exactAiInventoryType === "ai"
+    exactAiInventoryType === "ai" && !safeExistsSync(path)
       ? normalizeHuggingFaceReference(path)
       : undefined;
   if (directHuggingFaceSource?.repoId) {
@@ -529,6 +544,14 @@ export async function createNodejsBom(path, options) {
         isSecureMode &&
         !installArgs.join(" ").includes("--allow-git")
       ) {
+        recordDegradation("js.git-dependency", {
+          ecosystem: "npm",
+          tool: pkgMgr,
+          impact: "integrity",
+          command: `${pkgMgr} ${installArgs.join(" ")}`,
+          detail:
+            "Secure mode npm install may still fetch and install git dependencies.",
+        });
         console.log(
           "Consider passing '--allow-git=none' via the environment variable NPM_INSTALL_ARGS to prevent any git dependencies from being fetched and installed via npm.",
         );
@@ -580,6 +603,13 @@ export async function createNodejsBom(path, options) {
           `**PACKAGE MANAGER**: Let's run the '${pkgMgr}' command with the arguments '${installArgs.join(" ")}' to generate the needed lock files.`,
         );
       }
+      recordDegradation("js.no-lockfile", {
+        ecosystem: "npm",
+        tool: pkgMgr,
+        impact: "versions",
+        detail:
+          "No lockfile was found for this project, so the SBOM is generated without pinned dependency versions.",
+      });
       console.warn(
         "\x1b[1;35mNotice: Generating an SBOM without a lockfile is risky and non-deterministic. Consider generating and committing the lockfile to your repository to ensure reproducible builds and SBOMs.\x1b[0m",
       );
@@ -640,7 +670,11 @@ export async function createNodejsBom(path, options) {
           console.log("---------------");
           console.log(result.stderr);
         }
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "npm",
+          tool: "npm",
+          detail: "the npm command failed",
+        });
       } else {
         anyInstallSuccess = true;
       }
@@ -936,7 +970,11 @@ export async function createNodejsBom(path, options) {
       );
       if (result.status === 1 || result.error) {
         console.error(result.stdout, result.stderr);
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "npm",
+          tool: "npm",
+          detail: "the yarn or pnpm command failed",
+        });
       }
     }
     // Look for shrinkwrap file
@@ -1013,7 +1051,11 @@ export async function createNodejsBom(path, options) {
       pnpmLock,
       "was found!",
     );
-    options.failOnError && process.exit(1);
+    deferFailOnError(options, {
+      ecosystem: "npm",
+      tool: "npm",
+      detail: "no JavaScript dependency evidence could be collected",
+    });
   }
   if (
     yarnLockFiles?.length &&
@@ -1719,6 +1761,50 @@ export async function createVscodeExtensionBom(path, options) {
   });
 }
 
+/**
+ * Create a BOM that catalogs agentic CLI tools installed for the current user
+ * (for example Kiro CLI, zcode, opencode, and Claude Code), along with the
+ * agents, plugins, and providers they define.
+ *
+ * The scan is read-only and value-redacting: it records tool versions where a
+ * declarative source exists, plus structural counts, but never reads
+ * credentials, transcripts, session logs, or telemetry.
+ *
+ * @param {string} path Positional input. A host scan does not read a project
+ *   tree, so an explicit path other than the current directory is rejected
+ *   rather than silently ignored.
+ * @param {Object} options Parse options from the CLI
+ * @returns {Promise<Object>} Promise resolving to BOM data
+ */
+export async function createAgenticBom(path, options) {
+  // Guard against a surprising host-wide scan masquerading as a project scan.
+  // cdxgen always supplies a positional path (defaulting to "."), so only an
+  // explicit path that resolves somewhere other than the current directory is
+  // treated as a mistake.
+  const resolvedPath = path ? resolve(path) : process.cwd();
+  if (resolvedPath !== process.cwd()) {
+    throw new Error(
+      "The 'agentic' project type performs a host-wide scan of installed " +
+        "agentic CLI tool directories and does not accept a path argument. " +
+        `Re-run without the path (received '${path}').`,
+    );
+  }
+  // Must not go to stdout: every entry point keeps stdout reserved for the BOM
+  // payload so `cdxgen -t agentic -o -` stays pipeable.
+  thoughtLog(
+    "Scanning the current user's home directory for installed agentic CLI tools.",
+  );
+  const inventory = collectAgenticTools(options);
+  const pkgList = trimComponents(inventory.components || []);
+  return buildBomNSData(options, pkgList, AGENTIC_TOOL_PURL_TYPE, {
+    src: "~",
+    filename: "agentic-cli-tools",
+    nsMapping: {},
+    dependencies: inventory.dependencies || [],
+    services: inventory.services || [],
+  });
+}
+
 /**
  * Function to create BOM for Electron ASAR archives.
  *