@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/cli/jsBom.js

@@ -24,7 +24,10 @@ import {
   rewriteExtractedArchivePaths,
 } from "../ecosystems/asarutils.js";
 import { parseBunLock } from "../ecosystems/bunutils.js";
-import { parseCaxaMetadata } from "../ecosystems/caxa.js";
+import {
+  enrichCaxaMetadataFromApp,
+  parseCaxaMetadata,
+} from "../ecosystems/caxa.js";
 import {
   CHROME_EXTENSION_PURL_TYPE,
   collectChromeExtensionsFromPath,
@@ -53,6 +56,10 @@ import {
   fetchHuggingFaceAssetInventory,
   normalizeHuggingFaceReference,
 } from "../ecosystems/remote/huggingface.js";
+import {
+  AGENTIC_TOOL_PURL_TYPE,
+  collectAgenticTools,
+} from "../helpers/agenticToolutils.js";
 import {
   cleanupTempDir,
   collectInstalledExtensions,
@@ -73,6 +80,7 @@ import {
 } from "../inventory/analyzer.js";
 import {
   markNpmTypesPackagesAsExcluded,
+  markTypeOnlyDependenciesOptional,
   mergeDependencies,
   mergeServices,
   propagateRequiredScopeFromDependencies,
@@ -100,6 +108,13 @@ const isWin = _platform() === "win32";
  * local Modelfile/`.gguf` file input. Returns the explicit selection from
  * `getExactAiInventoryType` when one is present.
  *
+ * Direct HuggingFace interpretation of the source path is opt-in: only
+ * unambiguous references (`pkg:huggingface/...` purls and huggingface.co
+ * URLs) are recognized on their own. Bare `owner/repo`-shaped values are
+ * ordinary relative paths (eg: `repotests/sveltejs-realworld`) unless an AI
+ * inventory type such as `-t ai` is explicitly selected, in which case
+ * `getExactAiInventoryType` already returned it above.
+ *
  * @param {string} path Project or file path
  * @param {object} options CLI options
  * @returns {string|undefined} The detected AI inventory type (`"ai"`) or undefined
@@ -109,7 +124,7 @@ export function getDirectAiInventoryType(path, options) {
   if (exactAiInventoryType) {
     return exactAiInventoryType;
   }
-  if (normalizeHuggingFaceReference(path)) {
+  if (normalizeHuggingFaceReference(path, { explicitOnly: true })) {
     return "ai";
   }
   try {
@@ -157,8 +172,10 @@ export async function createNodejsBom(path, options) {
         excludedAiInventoryTypes,
       );
   let aiInventory = { components: [], dependencies: [], services: [] };
+  // A value that exists on the local filesystem is always a project path -
+  // never a remote model id - so existing inputs skip remote resolution.
   const directHuggingFaceSource =
-    exactAiInventoryType === "ai"
+    exactAiInventoryType === "ai" && !safeExistsSync(path)
       ? normalizeHuggingFaceReference(path)
       : undefined;
   if (directHuggingFaceSource?.repoId) {
@@ -554,7 +571,16 @@ export async function createNodejsBom(path, options) {
         recordSensitiveFileRead(npmrcFile, {
           label: "npm registry configuration",
         });
-        const npmrcObj = parseNpmrc(npmrcData);
+        let npmrcObj = {};
+        try {
+          npmrcObj = parseNpmrc(npmrcData);
+        } catch (e) {
+          // A malformed .npmrc must degrade to a warning, never abort the scan.
+          console.warn(
+            `Unable to parse ${npmrcFile}. Continuing without it. ${e?.message || ""}`,
+          );
+          npmrcObj = {};
+        }
         for (const [key, value] of Object.entries(npmrcObj)) {
           const baseKey = key.replace(/^(?:\/\/[^/]+\/|@[^:]+:)/, "");
           if (
@@ -944,8 +970,12 @@ export async function createNodejsBom(path, options) {
   ) {
     // Rush.js creates node_modules inside common/temp directory
     const nmDir = join(path, "common", "temp", "node_modules");
-    // Do rush install if we don't have node_modules directory
-    if (!safeExistsSync(nmDir)) {
+    // Do rush install if we don't have node_modules directory. `rush install`
+    // drives pnpm without cdxgen's --ignore-scripts hardening and
+    // --bypass-policy disables rush's own policy gate, so it must respect
+    // --no-install-deps and the pre-build lifecycle like every other
+    // installer.
+    if (!safeExistsSync(nmDir) && options.installDeps !== false) {
       console.log("Executing 'rush install --no-link'", path);
       const result = safeSpawnSync(
         "rush",
@@ -1023,6 +1053,7 @@ export async function createNodejsBom(path, options) {
       }
       pkgList = propagateRequiredScopeFromDependencies(pkgList, dependencies);
       pkgList = markNpmTypesPackagesAsExcluded(pkgList);
+      pkgList = markTypeOnlyDependenciesOptional(pkgList, dependencies);
       return buildBomNSData(options, pkgList, "npm", {
         allImports,
         allExports,
@@ -1107,25 +1138,25 @@ export async function createNodejsBom(path, options) {
               );
               workspacePackages.push(workspaceRef);
               workspaceSrcFiles[workspaceRef] = relativePkgJsonFile;
-              if (pkgData?.dependencies || pkgData?.devDependencies) {
-                const dlist = new Set();
-                for (const [k, v] of Object.entries({
-                  ...(pkgData.dependencies || {}),
-                  ...(pkgData.devDependencies || {}),
-                })) {
-                  if (v.match(/^\d/)) {
-                    dlist.add(`pkg:npm/${k}@${v}`);
-                  } else {
-                    dlist.add(`pkg:npm/${k}`);
-                  }
-                }
-                workspaceDirectDeps[workspaceRef] = Array.from(dlist);
-                for (const dep of workspaceDirectDeps[workspaceRef]) {
-                  if (!depsWorkspaceRefs[dep]) {
-                    depsWorkspaceRefs[dep] = [];
-                  }
-                  depsWorkspaceRefs[dep].push(workspaceRef);
+              // The declared name and range of each direct dependency, which
+              // parseYarnLock resolves against the lock file to link the
+              // member into the dependency tree.
+              const declaredDeps = {
+                ...(pkgData.dependencies || {}),
+                ...(pkgData.optionalDependencies || {}),
+                ...(pkgData.devDependencies || {}),
+              };
+              if (Object.keys(declaredDeps).length) {
+                workspaceDirectDeps[workspaceRef] = declaredDeps;
+              }
+              for (const [k, v] of Object.entries(declaredDeps)) {
+                const dep = /^\d/.test(String(v))
+                  ? `pkg:npm/${k}@${v}`
+                  : `pkg:npm/${k}`;
+                if (!depsWorkspaceRefs[dep]) {
+                  depsWorkspaceRefs[dep] = [];
                 }
+                depsWorkspaceRefs[dep].push(workspaceRef);
               }
             }
           }
@@ -1482,6 +1513,7 @@ export async function createNodejsBom(path, options) {
   );
   pkgList = propagateRequiredScopeFromDependencies(pkgList, dependencies);
   pkgList = markNpmTypesPackagesAsExcluded(pkgList);
+  pkgList = markTypeOnlyDependenciesOptional(pkgList, dependencies);
   if (exactAiInventoryType === "mcp") {
     pkgList = trimComponents(filterInventorySubjectsByTypes(pkgList, ["mcp"]));
     dependencies = filterInventoryDependencies(
@@ -1611,8 +1643,14 @@ export async function createCaxaBom(path, options) {
     if (DEBUG_MODE) {
       console.log(`Parsing ${mfile}`);
     }
-    const { parentComponent, components, dependencies } =
-      await parseCaxaMetadata(mfile);
+    let mdata = await parseCaxaMetadata(mfile);
+    if (options.caxaAppDir) {
+      mdata = await enrichCaxaMetadataFromApp(
+        mdata,
+        resolve(options.caxaAppDir),
+      );
+    }
+    const { parentComponent, components, dependencies } = mdata;
     if (parentComponent) {
       if (!finalParentComponent) {
         finalParentComponent = parentComponent;
@@ -1748,6 +1786,50 @@ export async function createVscodeExtensionBom(path, options) {
   });
 }
 
+/**
+ * Create a BOM that catalogs agentic CLI tools installed for the current user
+ * (for example Kiro CLI, zcode, opencode, and Claude Code), along with the
+ * agents, plugins, and providers they define.
+ *
+ * The scan is read-only and value-redacting: it records tool versions where a
+ * declarative source exists, plus structural counts, but never reads
+ * credentials, transcripts, session logs, or telemetry.
+ *
+ * @param {string} path Positional input. A host scan does not read a project
+ *   tree, so an explicit path other than the current directory is rejected
+ *   rather than silently ignored.
+ * @param {Object} options Parse options from the CLI
+ * @returns {Promise<Object>} Promise resolving to BOM data
+ */
+export async function createAgenticBom(path, options) {
+  // Guard against a surprising host-wide scan masquerading as a project scan.
+  // cdxgen always supplies a positional path (defaulting to "."), so only an
+  // explicit path that resolves somewhere other than the current directory is
+  // treated as a mistake.
+  const resolvedPath = path ? resolve(path) : process.cwd();
+  if (resolvedPath !== process.cwd()) {
+    throw new Error(
+      "The 'agentic' project type performs a host-wide scan of installed " +
+        "agentic CLI tool directories and does not accept a path argument. " +
+        `Re-run without the path (received '${path}').`,
+    );
+  }
+  // Must not go to stdout: every entry point keeps stdout reserved for the BOM
+  // payload so `cdxgen -t agentic -o -` stays pipeable.
+  thoughtLog(
+    "Scanning the current user's home directory for installed agentic CLI tools.",
+  );
+  const inventory = collectAgenticTools(options);
+  const pkgList = trimComponents(inventory.components || []);
+  return buildBomNSData(options, pkgList, AGENTIC_TOOL_PURL_TYPE, {
+    src: "~",
+    filename: "agentic-cli-tools",
+    nsMapping: {},
+    dependencies: inventory.dependencies || [],
+    services: inventory.services || [],
+  });
+}
+
 /**
  * Function to create BOM for Electron ASAR archives.
  *

package/lib/cli/jvmBom.js

@@ -49,6 +49,7 @@ import {
   parseGradleInfoLogsForUrls,
   parseGradleProperties,
   parseGradleResolvedDistributions,
+  parseGradleVersionCatalog,
   recordGradleInvocationFailure,
   splitOutputByGradleProjects,
 } from "../ecosystems/gradleutils.js";
@@ -166,14 +167,14 @@ export async function createJarBom(path, options) {
   const parentComponent = createDefaultParentComponent(path, "maven", options);
   if (options.useGradleCache) {
     nsMapping = await collectGradleDependencies(
-      getGradleCommand(path, null),
+      getGradleCommand(path, null, options),
       path,
       false,
       true,
     );
   } else if (options.useMavenCache) {
     nsMapping = await collectMvnDependencies(
-      getMavenCommand(path, null),
+      getMavenCommand(path, null, options),
       null,
       false,
       true,
@@ -244,6 +245,8 @@ export function discoverSbtProjectsFromCmd(basePath, sbtCmd, env) {
       {
         cwd: basePath,
         shell: true,
+        // The quotes around the sbt command are for the shell to strip.
+        cdxgenRawShellArgs: true,
         env,
         encoding: "utf-8",
       },
@@ -452,7 +455,7 @@ export async function createJavaBom(path, options) {
         }
       }
       const firstPom = pomFiles.length ? pomFiles[0] : undefined;
-      let mavenCmd = getMavenCommand(path, path);
+      let mavenCmd = getMavenCommand(path, path, options);
       for (const f of pomFiles) {
         const basePath = dirname(f);
         if (
@@ -472,7 +475,7 @@ export async function createJavaBom(path, options) {
           );
         }
         if (mavenCmd?.endsWith("mvn")) {
-          mavenCmd = getMavenCommand(basePath, path);
+          mavenCmd = getMavenCommand(basePath, path, options);
         }
         // Should we attempt to resolve class names
         if (options.resolveClass || options.deep) {
@@ -1040,11 +1043,23 @@ export async function createJavaBom(path, options) {
       if (resolveGradleDistribution && gradleInitArgs.length) {
         gradleInitArgs.push("-PcdxgenResolveDistribution=true");
       }
-      parallelPropTaskOut = executeParallelGradleProperties(
-        gradleRootPath,
-        [null].concat(includedBuilds),
-        gradleInitArgs,
-      );
+      // `gradle properties` evaluates the project's build scripts, so it is
+      // part of the dependency-tooling surface gated by --no-install-deps
+      // (and the pre-build lifecycle).
+      const gradleToolingAllowed =
+        options.installDeps !== false || options.introspect === true;
+      if (gradleToolingAllowed) {
+        parallelPropTaskOut = executeParallelGradleProperties(
+          gradleRootPath,
+          [null].concat(includedBuilds),
+          gradleInitArgs,
+          options,
+        );
+      } else {
+        console.log(
+          "Skipping 'gradle properties' since dependency installation is disabled. Only statically parsed Gradle metadata will be used.",
+        );
+      }
       if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS") === undefined) {
         const outputLines = parallelPropTaskOut.split("\n");
         for (const [_i, line] of outputLines.entries()) {
@@ -1072,7 +1087,14 @@ export async function createJavaBom(path, options) {
           }
           parallelPropTaskOut = parallelPropTaskOut.concat(
             "\n",
-            executeParallelGradleProperties(gradleRootPath, includedBuilds),
+            gradleToolingAllowed
+              ? executeParallelGradleProperties(
+                  gradleRootPath,
+                  includedBuilds,
+                  [],
+                  options,
+                )
+              : "",
           );
         }
       }
@@ -1113,6 +1135,8 @@ export async function createJavaBom(path, options) {
         parallelPropTaskOut = executeParallelGradleProperties(
           gradleRootPath,
           allProjectsStr.filter((module) => !modulesToSkip.includes(module)),
+          [],
+          options,
         );
         const splitPropTaskOut = splitOutputByGradleProjects(
           parallelPropTaskOut,
@@ -1160,7 +1184,7 @@ export async function createJavaBom(path, options) {
       )
     ) {
       allProjects.push(parentComponent);
-      const gradleCmd = getGradleCommand(gradleRootPath, null);
+      const gradleCmd = getGradleCommand(gradleRootPath, null, options);
       const gradleDepTask = readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
         ? readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
         : "dependencies";
@@ -1372,6 +1396,27 @@ export async function createJavaBom(path, options) {
           jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
         }
       }
+
+      // A version catalog declares coordinates without resolving them, so it
+      // is used only when Gradle produced no dependency information at all.
+      // The emitted components carry cdx:gradle:catalog=true to mark them as
+      // declared rather than resolved.
+      if (!pkgList.length) {
+        const catalogFiles = getAllFiles(
+          path,
+          `${options.multiProject ? "**/" : ""}gradle/libs.versions.toml`,
+          options,
+        );
+        for (const catalogFile of catalogFiles) {
+          if (DEBUG_MODE) {
+            console.log(`Parsing ${catalogFile}`);
+          }
+          const dlist = parseGradleVersionCatalog(catalogFile);
+          if (dlist?.length) {
+            pkgList = pkgList.concat(dlist);
+          }
+        }
+      }
     }
 
     // Bazel
@@ -1617,6 +1662,13 @@ export async function createJavaBom(path, options) {
             pkgList = pkgList.concat(dlist);
           }
         }
+      } else if (options.installDeps === false && !options.introspect) {
+        // Executing sbt evaluates the project's build definition (arbitrary
+        // Scala), so it belongs to the dependency-tooling surface disabled
+        // by --no-install-deps and the pre-build lifecycle.
+        console.log(
+          "Skipping sbt dependencyTree since dependency installation is disabled. Only statically parsed sbt metadata will be used.",
+        );
       } else {
         const SBT_CMD = readEnvironmentVariable("SBT_CMD") || "sbt";
         let sbtVersion = determineSbtVersion(path);
@@ -1732,6 +1784,9 @@ export async function createJavaBom(path, options) {
           const result = safeSpawnSync(SBT_CMD, sbtArgs, {
             cwd: basePath,
             shell: true,
+            // The sbt commands below embed their own shell quoting, which the
+            // shell must strip for sbt to see separate commands.
+            cdxgenRawShellArgs: true,
             env,
           });
           if (result.status !== 0 || result.error) {
@@ -1871,6 +1926,7 @@ export async function createJavaBom(path, options) {
 
     if (
       millFiles?.length &&
+      (options.installDeps !== false || options.introspect === true) &&
       isPackageManagerAllowed(
         "mill",
         ["bazel", "sbt", "gradle", "maven"],
@@ -1883,7 +1939,7 @@ export async function createJavaBom(path, options) {
         "maven",
         options,
       );
-      const millCmd = getMillCommand(millRootPath);
+      const millCmd = getMillCommand(millRootPath, options);
       const millCommonArgs = [
         "--color",
         "false",