@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/inventory/auditCategories.js

@@ -23,6 +23,12 @@ export const GOLEM_AUDIT_CATEGORIES = Object.freeze([
   "golem-compliance",
 ]);
 
+/** Frozen list of Cargo (Rust) audit categories. */
+export const CARGO_AUDIT_CATEGORIES = Object.freeze([
+  "cargo-security",
+  "cargo-compliance",
+]);
+
 /**
  * Frozen list of audit categories that never activate on their own. These
  * rule packs serve a specific feature (`--introspect` for build-fidelity) and
@@ -52,10 +58,12 @@ export const BOM_AUDIT_CATEGORY_ALIASES = Object.freeze({
   "ai-bom": [...AI_BOM_AUDIT_CATEGORIES, "ai-agent", "mcp-server"],
   "ai-provenance": ["ai-provenance", "ai-oversight"],
   "ai-oversight": ["ai-oversight"],
+  cargo: [...CARGO_AUDIT_CATEGORIES],
   cbom: [...CBOM_AUDIT_CATEGORIES],
   "crypto-bom": [...CBOM_AUDIT_CATEGORIES],
   golem: [...GOLEM_AUDIT_CATEGORIES],
   hbom: [...HBOM_AUDIT_CATEGORIES],
+  rust: [...CARGO_AUDIT_CATEGORIES],
   host: [...HBOM_AUDIT_CATEGORIES, ...HOST_TOPOLOGY_AUDIT_CATEGORIES],
 });
 

package/lib/inventory/cbomutils.js

@@ -345,6 +345,36 @@ function normalizeDosaiCryptoNames(cryptoObject) {
       names.add("sha-512");
     }
   }
+  // dosai reports the post-quantum families under their generic names and no
+  // generic OID exists for any of them, so the parameter set has to come from
+  // the call-site context (dosai's Code field carries the source line, e.g.
+  // "MLDsa.GenerateKey(MLDsaAlgorithm.MLDsa65)"). Without a parameter set the
+  // asset stays unmapped and is skipped rather than emitted with a wrong OID.
+  if (/^ML-?DSA$/i.test(cleanName)) {
+    const parameterSet = context.match(/(?:MLDsa|ML-DSA-)(44|65|87)\b/i);
+    if (parameterSet) {
+      names.add(`ml-dsa-${parameterSet[1]}`);
+    }
+  }
+  if (/^ML-?KEM$/i.test(cleanName)) {
+    const parameterSet = context.match(/(?:MLKem|ML-KEM-)(512|768|1024)\b/i);
+    if (parameterSet) {
+      names.add(`ml-kem-${parameterSet[1]}`);
+    }
+  }
+  if (/^SLH-?DSA$/i.test(cleanName)) {
+    // .NET spells it SlhDsaSha2_128s; NIST SLH-DSA-SHA2-128s. The hash family
+    // is required: SHA2 and SHAKE have distinct OIDs, so a context naming only
+    // the size, such as SLH-DSA-192f, resolves to no single parameter set.
+    const parameterSet = context.match(
+      /(?:SlhDsa|SLH-DSA-)(SHA2|SHAKE)[-_]?(128|192|256)(s|f)\b/i,
+    );
+    if (parameterSet) {
+      names.add(
+        `slh-dsa-${parameterSet[1].toLowerCase()}-${parameterSet[2]}${parameterSet[3].toLowerCase()}`,
+      );
+    }
+  }
   return Array.from(names);
 }
 

package/lib/inventory/cdxrs.js

@@ -3,9 +3,9 @@
  *
  * This module is the ONLY place that spawns the `cdxrs` binary. It enforces
  * the governing invariant: **no failure mode may abort SBOM generation.**
- * Every failure (missing binary, non-zero exit, timeout, malformed stdout,
- * version-major mismatch, CDXGEN_RS_DISABLE) logs once at `warn` and returns
- * a sentinel that makes the caller take the JS path.
+ * Every failure (missing binary, non-zero exit, timeout, oversized stdout,
+ * malformed stdout, version-major mismatch, CDXGEN_RS_DISABLE) logs once at
+ * `warn` and returns a sentinel that makes the caller take the JS path.
  *
  * Protocol:
  *   cdxrs <subcommand> --input <file|-> --output <file|-> --format json
@@ -25,8 +25,13 @@ import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
 import { safeExistsSync } from "../core/fs.js";
 import { getDefaultPluginRuntime, resolvePluginBinary } from "./plugins.js";
 
-/** Major version this bridge expects from the cdxrs binary. */
-const CDXRS_VERSION_MAJOR = "3";
+/**
+ * Major version this bridge expects from the cdxrs binary. cdxgen-plugins-bin
+ * versions every tool in lockstep, so this moves with
+ * `@cdxgen/cdxgen-plugins-bin` in package.json even when cdxrs itself carries
+ * no breaking change (4.0.0 is 3.2.0 renumbered by the release).
+ */
+const CDXRS_VERSION_MAJOR = "4";
 
 /** Default timeout for a cdxrs invocation. */
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -37,6 +42,45 @@ const DEFAULT_TIMEOUT_MS = 30_000;
  */
 const MAX_STDIN_BYTES = 32 * 1024 * 1024;
 
+/**
+ * V8's maximum string length on 64-bit builds (2^29 − 24). Node exposes no
+ * API for it, so it is stated exactly as the runtime's own ERR_STRING_TOO_LONG
+ * message does. `Buffer#toString()` throws above it — the crash from issue
+ * 4393, where a pnpm workspace's registry fetch crossed the ceiling.
+ */
+const V8_MAX_STRING_CHARS = 0x1fffffe8;
+
+/**
+ * Ceiling on the stdout bytes collected from a cdxrs child. stdout must end up
+ * as a single JS string, so a payload above V8's string limit can never be
+ * delivered no matter how long the child runs: buffering it only burns memory
+ * until the concat throws. Past the ceiling the child is killed and the caller
+ * takes the JS path. Counting bytes (never smaller than the decoded character
+ * count) keeps the boundary safe for multibyte output.
+ */
+const DEFAULT_MAX_STDOUT_BYTES = V8_MAX_STRING_CHARS;
+
+/**
+ * Resolve the stdout ceiling for a run. CDXGEN_RS_MAX_STDOUT_BYTES lowers (or
+ * raises) it — used by tests and by hosts that want the failover earlier.
+ *
+ * @returns {number} Maximum stdout bytes to collect before failing over.
+ */
+function maxStdoutBytes() {
+  const raw = readEnvironmentVariable("CDXGEN_RS_MAX_STDOUT_BYTES");
+  if (!raw) {
+    return DEFAULT_MAX_STDOUT_BYTES;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isInteger(parsed) && parsed > 0) {
+    return parsed;
+  }
+  console.warn(
+    `cdxrs: ignoring malformed CDXGEN_RS_MAX_STDOUT_BYTES "${raw}"; using the default ${DEFAULT_MAX_STDOUT_BYTES} bytes.`,
+  );
+  return DEFAULT_MAX_STDOUT_BYTES;
+}
+
 /** Sentinel returned when the Rust path is unavailable. Callers take JS path. */
 export const CDXRS_FALLBACK = Object.freeze({
   ok: false,
@@ -159,6 +203,11 @@ function probeVersion(binPath) {
  *
  * Passing `content` is the normal case, since cdxgen holds BOMs in memory.
  *
+ * Collected stdout is bounded: it must become a single JS string, so a child
+ * that would exceed V8's string limit (by default; see
+ * CDXGEN_RS_MAX_STDOUT_BYTES) is killed and reported as a fallback instead of
+ * crashing the process at the concat.
+ *
  * @param {string} subcommand The subcommand to run (e.g. "info").
  * @param {Object} opts
  * @param {string|Buffer} [opts.content] BOM data to feed over stdin.
@@ -279,6 +328,9 @@ export async function runCdxrs(subcommand, opts = {}) {
     let timedOut = false;
     const stdoutChunks = [];
     const stderrChunks = [];
+    const stdoutLimit = maxStdoutBytes();
+    let stdoutBytes = 0;
+    let stdoutOverflow = false;
 
     const pluginRuntime = getDefaultPluginRuntime();
     const env = { ...process.env };
@@ -308,6 +360,17 @@ export async function runCdxrs(subcommand, opts = {}) {
       child.stdin.end(stdinContent);
     }
 
+    // Kill the process group (-pid) so any child processes of cdxrs die too.
+    // Best effort: the process may have already exited, in which case the
+    // close/error handlers take over.
+    const killProcessGroup = () => {
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+        child.kill("SIGKILL");
+      }
+    };
+
     const timer = setTimeout(() => {
       timedOut = true;
       if (DEBUG_MODE) {
@@ -315,16 +378,21 @@ export async function runCdxrs(subcommand, opts = {}) {
           `cdxrs: timeout after ${timeoutMs}ms, killing process group.`,
         );
       }
-      try {
-        // Kill the process group (-pid) so any child processes of cdxrs die too.
-        process.kill(-child.pid, "SIGKILL");
-      } catch {
-        // Process may have already exited; fall through to error handling.
-        child.kill("SIGKILL");
-      }
+      killProcessGroup();
     }, timeoutMs);
 
     child.stdout?.on("data", (chunk) => {
+      if (stdoutOverflow) {
+        return;
+      }
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > stdoutLimit) {
+        // The payload can never become a deliverable string, so stop
+        // buffering, kill the child, and let the close handler fall back.
+        stdoutOverflow = true;
+        killProcessGroup();
+        return;
+      }
       stdoutChunks.push(chunk);
     });
 
@@ -360,8 +428,36 @@ export async function runCdxrs(subcommand, opts = {}) {
         return;
       }
 
-      const stdout = Buffer.concat(stdoutChunks).toString();
-      const stderr = Buffer.concat(stderrChunks).toString();
+      // Checked before the exit code: the child was killed mid-stream for
+      // producing more stdout than can ever be delivered as a string, so even
+      // an exit-0 result is an undeliverable truncation (issue 4393).
+      if (stdoutOverflow) {
+        console.warn(
+          `cdxrs: stdout passed ${stdoutLimit} bytes (a string cannot exceed ${V8_MAX_STRING_CHARS} characters), so the child was stopped.`,
+        );
+        resolve({ ...CDXRS_FALLBACK, reason: "stdout-too-large" });
+        return;
+      }
+
+      let stdout;
+      try {
+        stdout = Buffer.concat(stdoutChunks).toString();
+      } catch (err) {
+        // The byte cap above should make this unreachable; it is kept so that
+        // no failure inside this handler can abort SBOM generation.
+        console.warn(
+          `cdxrs: could not collect child stdout (${err.message}), falling back to JS path.`,
+        );
+        resolve({ ...CDXRS_FALLBACK, reason: "stdout-collect-failed" });
+        return;
+      }
+      let stderr = "";
+      try {
+        stderr = Buffer.concat(stderrChunks).toString();
+      } catch {
+        // stderr carries NDJSON logs, already forwarded as they arrived;
+        // dropping the raw tail must not fail a run with valid stdout.
+      }
 
       // For the validate subcommand, exit code 3 means "validation failure
       // with findings on stdout" — the operation succeeded, the BOM just has

package/lib/inventory/communityAiConfigParser.js

@@ -1,8 +1,9 @@
 import { readFileSync } from "node:fs";
-import { basename, dirname, extname } from "node:path";
+import { basename, dirname, extname, join } from "node:path";
 
 import { parse as loadYaml } from "yaml";
 
+import { safeExistsSync } from "../core/fs.js";
 import { sanitizeBomPropertyValue } from "../core/propertySanitizer.js";
 import { parseJsonLike } from "./jsonLike.js";
 import {
@@ -28,6 +29,18 @@ const COMMUNITY_AI_PATTERNS = [
   "**/.claude/skills/*/SKILL.md",
   ".agents/skills/*/SKILL.md",
   "**/.agents/skills/*/SKILL.md",
+  ".codex/skills/*/SKILL.md",
+  "**/.codex/skills/*/SKILL.md",
+  "skills/*/SKILL.md",
+  "**/skills/*/SKILL.md",
+  ".claude-plugin/plugin.json",
+  "**/.claude-plugin/plugin.json",
+  ".claude-plugin/marketplace.json",
+  "**/.claude-plugin/marketplace.json",
+  ".claude/agents/*.md",
+  "**/.claude/agents/*.md",
+  ".claude/commands/**/*.md",
+  "**/.claude/commands/**/*.md",
   ".cursor/rules/*.{md,mdc}",
   "**/.cursor/rules/*.{md,mdc}",
   ".windsurf/rules/**/*.md",
@@ -145,9 +158,24 @@ function frameworkForFile(filePath, raw = "") {
   if (lowerPath.includes("/.claude/skills/")) {
     return "claude-compatible";
   }
+  if (lowerPath.includes("/.claude-plugin/")) {
+    return "claude-plugin";
+  }
+  if (lowerPath.includes("/.claude/agents/")) {
+    return "claude-subagent";
+  }
+  if (lowerPath.includes("/.claude/commands/")) {
+    return "claude-command";
+  }
+  if (lowerPath.includes("/.codex/skills/")) {
+    return "codex";
+  }
   if (lowerPath.includes("/.agents/skills/")) {
     return "agent-compatible";
   }
+  if (/(?:^|\/)skills\/[^/]+\/skill\.md$/u.test(lowerPath)) {
+    return "agent-skills";
+  }
   return "community-ai";
 }
 
@@ -250,6 +278,173 @@ function parseSkillFile(filePath, raw) {
       metadata.metadata,
     );
   }
+  // Record whether the frontmatter satisfies the open Agent Skills constraints
+  // (name: 1-64 lowercase-alnum-hyphen; description: 1-1024 chars) as a single
+  // reviewer-friendly boolean rather than copying the raw values twice.
+  const specValid =
+    typeof metadata?.name === "string" &&
+    /^[a-z0-9-]{1,64}$/u.test(metadata.name) &&
+    typeof metadata?.description === "string" &&
+    metadata.description.length >= 1 &&
+    metadata.description.length <= 1024;
+  addUniqueProperty(
+    component.properties,
+    "cdx:skill:specValid",
+    specValid ? "true" : "false",
+  );
+  const skillDir = dirname(filePath);
+  for (const [subdir, property] of [
+    ["scripts", "cdx:skill:hasScripts"],
+    ["references", "cdx:skill:hasReferences"],
+    ["assets", "cdx:skill:hasAssets"],
+  ]) {
+    if (safeExistsSync(join(skillDir, subdir))) {
+      addUniqueProperty(component.properties, property, "true");
+    }
+  }
+  maybeAddFileSignals(component.properties, filePath, raw);
+  return [component];
+}
+
+/**
+ * Parse a Claude Code plugin manifest (`.claude-plugin/plugin.json`) into a
+ * single application component describing the plugin.
+ *
+ * @param {string} filePath Manifest path
+ * @param {string} raw File contents
+ * @returns {Object[]} Component list (one plugin component or empty)
+ */
+function parsePluginManifest(filePath, raw) {
+  let manifest;
+  try {
+    manifest = parseJsonLike(raw);
+  } catch {
+    return [];
+  }
+  if (!manifest?.name) {
+    return [];
+  }
+  const component = createComponent(
+    filePath,
+    "claude-plugin",
+    "agent-plugin",
+    manifest.name,
+  );
+  if (manifest.version) {
+    component.version = String(manifest.version);
+  }
+  addUniqueProperty(
+    component.properties,
+    "cdx:plugin:description",
+    manifest.description,
+  );
+  addUniqueProperty(
+    component.properties,
+    "cdx:plugin:author",
+    typeof manifest.author === "string"
+      ? manifest.author
+      : manifest.author?.name,
+  );
+  for (const [key, property] of [
+    ["commands", "cdx:plugin:commandCount"],
+    ["agents", "cdx:plugin:agentCount"],
+    ["skills", "cdx:plugin:skillCount"],
+    ["hooks", "cdx:plugin:hookCount"],
+    ["mcpServers", "cdx:plugin:mcpServerCount"],
+  ]) {
+    const value = manifest[key];
+    if (Array.isArray(value)) {
+      addUniqueProperty(component.properties, property, String(value.length));
+    } else if (value && typeof value === "object") {
+      addUniqueProperty(
+        component.properties,
+        property,
+        String(Object.keys(value).length),
+      );
+    }
+  }
+  maybeAddFileSignals(component.properties, filePath, raw);
+  return [component];
+}
+
+/**
+ * Parse a Claude Code plugin marketplace file
+ * (`.claude-plugin/marketplace.json`) into one component per listed plugin.
+ *
+ * @param {string} filePath Marketplace path
+ * @param {string} raw File contents
+ * @returns {Object[]} Component list
+ */
+function parsePluginMarketplace(filePath, raw) {
+  let marketplace;
+  try {
+    marketplace = parseJsonLike(raw);
+  } catch {
+    return [];
+  }
+  const plugins = Array.isArray(marketplace?.plugins)
+    ? marketplace.plugins
+    : [];
+  const components = [];
+  for (const plugin of plugins) {
+    const name = plugin?.name || plugin?.source;
+    if (!name) {
+      continue;
+    }
+    const component = createComponent(
+      filePath,
+      "claude-plugin",
+      "agent-plugin-listing",
+      String(name),
+    );
+    addUniqueProperty(
+      component.properties,
+      "cdx:plugin:description",
+      plugin.description,
+    );
+    addUniqueProperty(
+      component.properties,
+      "cdx:plugin:source",
+      typeof plugin.source === "string" ? plugin.source : undefined,
+    );
+    components.push(component);
+  }
+  return components;
+}
+
+/**
+ * Parse a Claude Code subagent definition (`.claude/agents/*.md`) into an
+ * agent-definition component using its markdown frontmatter.
+ *
+ * @param {string} filePath Subagent markdown path
+ * @param {string} raw File contents
+ * @returns {Object[]} Component list
+ */
+function parseClaudeSubagent(filePath, raw) {
+  const { metadata } = parseFrontmatter(raw);
+  const name = metadata?.name || basename(filePath, extname(filePath));
+  const component = createComponent(
+    filePath,
+    "claude-subagent",
+    "agent-definition",
+    name,
+  );
+  addUniqueProperty(component.properties, "cdx:agent:role", "claude-subagent");
+  addUniqueProperty(
+    component.properties,
+    "cdx:agent:description",
+    metadata?.description,
+  );
+  addUniqueProperty(component.properties, "cdx:agent:model", metadata?.model);
+  if (Array.isArray(metadata?.tools)) {
+    addUniqueProperty(
+      component.properties,
+      "cdx:agent:tools",
+      metadata.tools.join(","),
+    );
+  } else if (typeof metadata?.tools === "string") {
+    addUniqueProperty(component.properties, "cdx:agent:tools", metadata.tools);
+  }
   maybeAddFileSignals(component.properties, filePath, raw);
   return [component];
 }
@@ -708,10 +903,28 @@ export const communityAiConfigParser = {
         components.push(...parseAgentMarkdown(filePath, raw));
         continue;
       }
+      if (lowerPath.endsWith("/.claude-plugin/plugin.json")) {
+        components.push(...parsePluginManifest(filePath, raw));
+        continue;
+      }
+      if (lowerPath.endsWith("/.claude-plugin/marketplace.json")) {
+        components.push(...parsePluginMarketplace(filePath, raw));
+        continue;
+      }
+      if (lowerPath.includes("/.claude/agents/")) {
+        components.push(...parseClaudeSubagent(filePath, raw));
+        continue;
+      }
+      if (lowerPath.includes("/.claude/commands/")) {
+        components.push(...parseInstructionMarkdown(filePath, raw));
+        continue;
+      }
       if (
         lowerPath.includes("/.opencode/skills/") ||
         lowerPath.includes("/.claude/skills/") ||
-        lowerPath.includes("/.agents/skills/")
+        lowerPath.includes("/.agents/skills/") ||
+        lowerPath.includes("/.codex/skills/") ||
+        lowerPath.endsWith("/skill.md")
       ) {
         components.push(...parseSkillFile(filePath, raw));
         continue;