@cdxgen/cdxgen 13.2.0 → 13.3.0

package/lib/inventory/atomUtils.js

@@ -1,17 +1,29 @@
-import { lstatSync, readFileSync } from "node:fs";
+import {
+  lstatSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+} from "node:fs";
 import { tmpdir, totalmem } from "node:os";
 import { delimiter as _delimiter, dirname, join, resolve } from "node:path";
 import process from "node:process";
 
-import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import {
+  DEBUG_MODE,
+  isSecureMode,
+  readEnvironmentVariable,
+} from "../core/activity.js";
 import {
   safeExistsSync,
   safeMkdtempSync,
   safeRmSync,
   safeSpawnSync,
+  TIMEOUT_MS,
 } from "../core/fs.js";
 import { TRACE_MODE } from "../core/logger.js";
 import { dirNameStr, isWin } from "../core/paths.js";
+import { readJsonFile } from "../parsers/largeJson.js";
 
 const ASTGEN_DEFAULT_IGNORE_DIRS = [
   "venv",
@@ -57,6 +69,256 @@ export const ATOM_NATIVE_PACKAGES = new Set([
 
 const ATOM_PHP_LANGUAGES = new Set(["php"]);
 
+/** atom `-l` values that parse C/C++ headers without function bodies. */
+const ATOM_HEADER_LANGUAGES = new Set(["h", "hpp", "i"]);
+
+/** atom `-l` values handled by the C/C++ frontend. */
+const ATOM_C_LANGUAGES = new Set([
+  "c",
+  "cpp",
+  "c++",
+  "newc",
+  ...ATOM_HEADER_LANGUAGES,
+]);
+
+const COMPILE_COMMANDS_FILE = "compile_commands.json";
+
+/** Build directories, under the scan root, searched for a compilation database. */
+const COMPILE_COMMANDS_BUILD_DIRS = ["build", "out", "builddir"];
+
+/**
+ * Characters a Windows shell command line would interpret: `&`, `|`, `<` and
+ * `>` chain or redirect commands, `%` expands variables even inside quotes,
+ * `^` escapes, `!` expands under delayed expansion, and a quote breaks the
+ * quoting Node applies to arguments when `shell` is on. A database is often
+ * discovered inside the scanned tree, so its path is not trusted input.
+ */
+const UNSAFE_SHELL_CHARS_RE = /[\r\n\t&|<>%^!"]/;
+
+function compileCommandsIn(dir) {
+  for (const candidate of [
+    join(dir, COMPILE_COMMANDS_FILE),
+    join(dir, "build", COMPILE_COMMANDS_FILE),
+  ]) {
+    try {
+      if (statSync(candidate).isFile()) {
+        return candidate;
+      }
+    } catch (_err) {
+      // not there
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Locate the JSON compilation database (`compile_commands.json`) of a C/C++
+ * project, which lets atom parse each file with the include paths, macros and
+ * language its build uses.
+ *
+ * An explicit `options.compileCommands` (a file, or a directory holding one
+ * directly or under `build/`) wins. Otherwise the scan root, `build/`, `out/`,
+ * `builddir/`, `cmake-build-*` and the directory of `options.cmakeCache` are
+ * searched. A database can come with the code it describes, and atom asks the
+ * GCC or Clang driver it names (from the PATH, or an absolute path outside
+ * the project) for its predefined macros, so in secure mode only an explicit
+ * database is used.
+ *
+ * @param {string} src Project scan root
+ * @param {Object} options CLI options
+ * @returns {string|undefined} Absolute path of the database
+ */
+export function findCompileCommands(src, options = {}) {
+  if (options.compileCommands) {
+    const requested = resolve(`${options.compileCommands}`);
+    let found;
+    try {
+      found = statSync(requested).isDirectory()
+        ? compileCommandsIn(requested)
+        : requested;
+    } catch (_err) {
+      found = undefined;
+    }
+    if (!found) {
+      console.warn(
+        `No compilation database at ${requested}. Parsing the C/C++ sources without one.`,
+      );
+    }
+    return found;
+  }
+  if (isSecureMode || !src) {
+    return undefined;
+  }
+  const root = resolve(src);
+  let rootIsDir = false;
+  try {
+    rootIsDir = statSync(root).isDirectory();
+  } catch (_err) {
+    return undefined;
+  }
+  if (!rootIsDir) {
+    return undefined;
+  }
+  const dirs = [root, ...COMPILE_COMMANDS_BUILD_DIRS.map((d) => join(root, d))];
+  try {
+    dirs.push(
+      ...readdirSync(root, { withFileTypes: true })
+        .filter((e) => e.isDirectory() && e.name.startsWith("cmake-build-"))
+        .map((e) => join(root, e.name))
+        .sort(),
+    );
+  } catch (_err) {
+    // an unreadable root has no build directories to offer
+  }
+  if (options.cmakeCache) {
+    dirs.push(dirname(resolve(`${options.cmakeCache}`)));
+  }
+  for (const dir of dirs) {
+    const candidate = join(dir, COMPILE_COMMANDS_FILE);
+    try {
+      if (statSync(candidate).isFile()) {
+        return candidate;
+      }
+    } catch (_err) {
+      // not there
+    }
+  }
+  return undefined;
+}
+
+const atomFrontendArgKeysCache = new Map();
+
+/**
+ * Split an atom command that may carry a leading argument (`node
+ * script.js`, a custom `ATOM_CMD`) into its binary and that argument. The
+ * first space only splits when it can: a binary under a path with spaces
+ * (`C:\Program Files\...\node.exe script.js`) would otherwise be cut
+ * mid-path and the shell told to run `C:\Program`. A command name without a
+ * path separator (`node script.js`) resolves through the PATH, so it splits
+ * at its first space as before; otherwise the first prefix that exists as a
+ * file is the binary, and when none does the first space keeps the old
+ * behaviour.
+ *
+ * @param {string} command The atom command, possibly with an argument
+ * @returns {[string, string|undefined]} The binary and its leading argument, when present
+ */
+export function splitAtomCommand(command) {
+  const firstSpace = `${command}`.indexOf(" ");
+  if (firstSpace === -1) {
+    return [`${command}`, undefined];
+  }
+  const head = command.slice(0, firstSpace);
+  if (!/[/\\]/.test(head)) {
+    return [head, command.slice(firstSpace + 1)];
+  }
+  let splitAt = firstSpace;
+  let index = firstSpace;
+  while ((index = command.indexOf(" ", index + 1)) !== -1) {
+    try {
+      if (statSync(command.slice(0, index)).isFile()) {
+        splitAt = index;
+        break;
+      }
+    } catch (_err) {
+      // not a file; a later space may still split at the real binary
+    }
+  }
+  return [command.slice(0, splitAt), command.slice(splitAt + 1)];
+}
+
+/**
+ * The `--frontend-args` keys the installed atom accepts for a language, as
+ * `atom --frontend-args-keys -l <language>` lists them. Asked once per atom
+ * command and language. An atom that cannot list them (a release without
+ * `--frontend-args`, or one that fails to start) accepts none.
+ *
+ * @param {string} language atom `-l` value
+ * @returns {Set<string>} Supported keys
+ */
+export function atomFrontendArgKeys(language) {
+  const command = getAtomCommand();
+  const cacheKey = `${command}\u0000${language}`;
+  if (atomFrontendArgKeysCache.has(cacheKey)) {
+    return atomFrontendArgKeysCache.get(cacheKey);
+  }
+  const [bin, leadingArg] = splitAtomCommand(command);
+  const args = ["--frontend-args-keys", "-l", `${language}`];
+  if (leadingArg !== undefined) {
+    args.unshift(leadingArg);
+  }
+  const env = { ...process.env };
+  if (readEnvironmentVariable("ATOM_JAVA_HOME")) {
+    env.JAVA_HOME = readEnvironmentVariable("ATOM_JAVA_HOME");
+  }
+  const keys = new Set();
+  const result = safeSpawnSync(bin, args, {
+    shell: isWin,
+    env,
+    timeout: 120000,
+  });
+  if (result?.status === 0 && result.stdout) {
+    let inTable = false;
+    for (const line of `${result.stdout}`.split(/\r?\n/)) {
+      if (line.startsWith("----")) {
+        inTable = true;
+      } else if (inTable && /^[a-z][a-z0-9-]*\s/.test(line)) {
+        keys.add(line.split(/\s+/)[0]);
+      }
+    }
+  }
+  if (DEBUG_MODE && !keys.size) {
+    console.log(
+      `The installed atom did not list its --frontend-args keys for ${language}.`,
+    );
+  }
+  atomFrontendArgKeysCache.set(cacheKey, keys);
+  return keys;
+}
+
+/**
+ * The `--frontend-args` atom takes for a C/C++ language: the project's
+ * compilation database, when there is one and the installed atom reads it
+ * (atom 4 and later). An older atom is given the arguments it has always
+ * been given, and parses the sources without the database.
+ *
+ * @param {string} src Project scan root
+ * @param {string} language atom `-l` value
+ * @param {Object} options CLI options
+ * @returns {string[]} Arguments to add to the atom command
+ */
+export function atomCompileCommandsArgs(src, language, options = {}) {
+  if (!ATOM_C_LANGUAGES.has(`${language}`.toLowerCase())) {
+    return [];
+  }
+  const database = findCompileCommands(src, options);
+  if (!database) {
+    return [];
+  }
+  // --frontend-args separates its key=value pairs with commas
+  if (database.includes(",")) {
+    console.warn(
+      `The compilation database path ${database} contains a comma, which atom cannot take. Parsing the C/C++ sources without it.`,
+    );
+    return [];
+  }
+  // The argument reaches a Windows shell command line through `shell: isWin`
+  // in executeAtom, and the path is routinely discovered inside the scanned
+  // tree, so a database whose path a shell would interpret is never passed on.
+  if (UNSAFE_SHELL_CHARS_RE.test(database)) {
+    console.warn(
+      `The compilation database path ${database} contains characters a shell would interpret. Parsing the C/C++ sources without it.`,
+    );
+    return [];
+  }
+  if (!atomFrontendArgKeys(language).has("compile-commands")) {
+    return [];
+  }
+  if (DEBUG_MODE) {
+    console.log(`Passing the compilation database ${database} to atom.`);
+  }
+  return ["--frontend-args", `compile-commands=${database}`];
+}
+
 // Absolute ceiling on atom's heap. Past this point a larger heap buys a
 // collector that runs less often rather than an analysis that succeeds where it
 // otherwise would not, while the reservation itself is what pushes a build
@@ -610,12 +872,38 @@ export function resolveAtomProvider(opts = {}) {
 }
 
 /**
- * Returns `"native"` or `"jar"` for the currently resolved atom provider.
- * Used to gate Java/JDK advice so users on the five native platforms are not
- * told to install a JDK for a failure that has nothing to do with Java.
+ * Returns `"native"` or `"jar"` for the atom provider that will actually run.
+ *
+ * The platform decides which provider atom prefers, but the dispatcher falls
+ * back to the jar package when the platform's native package is not installed
+ * (optional dependencies skipped, a failed download). The two take the heap
+ * ceiling differently, and a native-image runtime option on a jar run reaches
+ * atom as an unknown argument that fails every slice. So the kind follows what
+ * is installed where cdxgen can see it: the native binary means native, the jar
+ * package without it means jar. With neither in view (a custom `ATOM_CMD`, an
+ * install elsewhere) the platform's kind stands.
+ *
+ * Also used to gate Java/JDK advice, so users on the five native platforms are
+ * not told to install a JDK for a failure that has nothing to do with Java.
  */
 export function atomProviderKind() {
-  return resolveAtomProvider().kind;
+  const { kind } = resolveAtomProvider();
+  if (kind !== "native" || readEnvironmentVariable("ATOM_CMD")) {
+    return kind;
+  }
+  const atomHome = readEnvironmentVariable("ATOM_HOME");
+  if (atomHome) {
+    // A jar install's ATOM_HOME is its plugins/ directory, which carries lib/;
+    // a native sub-package directory does not.
+    return safeExistsSync(join(atomHome, "lib")) ? "jar" : kind;
+  }
+  if (resolveDirectAtomBinaryPath()) {
+    return "native";
+  }
+  const jarPlugins = atomSubPackageCandidates("atom-jar").some((dir) =>
+    safeExistsSync(join(dir, "plugins")),
+  );
+  return jarPlugins ? "jar" : kind;
 }
 
 /**
@@ -683,6 +971,25 @@ export function resolveDirectAtomBinaryPath() {
   }
   const folder = preferredPkg.split("/")[1];
   const exeName = isWin ? "atom.exe" : "atom";
+  for (const dir of atomSubPackageCandidates(folder)) {
+    const candidate = join(dir, "bin", exeName);
+    if (safeExistsSync(candidate)) {
+      return candidate;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Directories where an `@appthreat/atom-*` sub-package may be installed next to
+ * the dispatcher cdxgen uses, for npm, pnpm and global layouts: a sibling of
+ * `@appthreat/atom`, nested under it, in a pnpm virtual store, or a sibling of
+ * the dispatcher's real (symlink-resolved) directory.
+ *
+ * @param {string} folder Sub-package folder name, e.g. `atom-jar`
+ * @returns {string[]} Candidate package directories
+ */
+function atomSubPackageCandidates(folder) {
   const version = readAtomVersion();
   const roots = [join(dirNameStr, "node_modules")];
   if (readEnvironmentVariable("GLOBAL_NODE_MODULES_PATH")) {
@@ -690,18 +997,9 @@ export function resolveDirectAtomBinaryPath() {
   }
   const candidates = [];
   for (const root of roots) {
-    candidates.push(join(root, "@appthreat", folder, "bin", exeName));
+    candidates.push(join(root, "@appthreat", folder));
     candidates.push(
-      join(
-        root,
-        "@appthreat",
-        "atom",
-        "node_modules",
-        "@appthreat",
-        folder,
-        "bin",
-        exeName,
-      ),
+      join(root, "@appthreat", "atom", "node_modules", "@appthreat", folder),
     );
     if (version) {
       candidates.push(
@@ -712,18 +1010,19 @@ export function resolveDirectAtomBinaryPath() {
           "node_modules",
           "@appthreat",
           folder,
-          "bin",
-          exeName,
         ),
       );
     }
-  }
-  for (const candidate of candidates) {
-    if (safeExistsSync(candidate)) {
-      return candidate;
+    // pnpm links @appthreat/atom to its store entry, where the sub-packages
+    // are its siblings.
+    try {
+      const atomDir = realpathSync(join(root, "@appthreat", "atom"));
+      candidates.push(join(dirname(atomDir), folder));
+    } catch {
+      // not installed under this root
     }
   }
-  return undefined;
+  return [...new Set(candidates)];
 }
 
 function readAtomVersion() {
@@ -874,6 +1173,93 @@ function applyAtomHeapLimit(args, env) {
   }
 }
 
+// How long cdxgen waits past atom's own time limit for the dispatcher to stop
+// the runtime and exit. It covers the dispatcher's SIGTERM-to-SIGKILL grace (10
+// seconds) and the runtime's exit. A short limit (a test, a smoke run) gets a
+// quarter of itself instead.
+const ATOM_STOP_GRACE_MS = 30_000;
+
+/**
+ * Compute how long atom may run, and how long cdxgen waits for it.
+ *
+ * cdxgen's spawn timeout kills only the process cdxgen started, and for atom
+ * that is the npm dispatcher. The runtime under it (the native binary or the
+ * JVM) used to survive that kill, re-parented and still holding its heap. atom
+ * therefore gets its own limit, `ATOM_TIMEOUT`, which the dispatcher enforces on
+ * the runtime, and cdxgen's spawn timeout sits a grace period beyond it as the
+ * last resort.
+ *
+ * An explicit `ATOM_TIMEOUT` (milliseconds) sets atom's limit independently of
+ * `CDXGEN_TIMEOUT_MS`, which keeps bounding every other tool. Otherwise atom's
+ * limit is `CDXGEN_TIMEOUT_MS` less the grace period.
+ *
+ * @returns {{atomTimeoutMs: number, spawnTimeoutMs: number}} atom's own limit and cdxgen's spawn timeout for it
+ */
+export function atomTimeouts() {
+  const graceFor = (ms) => Math.min(ATOM_STOP_GRACE_MS, Math.floor(ms / 4));
+  const configured = Number.parseInt(
+    readEnvironmentVariable("ATOM_TIMEOUT"),
+    10,
+  );
+  if (configured > 0) {
+    return {
+      atomTimeoutMs: configured,
+      spawnTimeoutMs: configured + graceFor(configured),
+    };
+  }
+  return {
+    atomTimeoutMs: TIMEOUT_MS - graceFor(TIMEOUT_MS),
+    spawnTimeoutMs: TIMEOUT_MS,
+  };
+}
+
+function formatDuration(ms) {
+  if (ms >= 60_000) {
+    const minutes = Math.round(ms / 6_000) / 10;
+    return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+  }
+  return `${Math.round(ms / 100) / 10} seconds`;
+}
+
+// The status the atom dispatcher exits with when ATOM_TIMEOUT stops atom.
+const ATOM_TIMEOUT_EXIT_CODE = 124;
+
+/**
+ * Whether an atom run ended because it ran out of time.
+ *
+ * The dispatcher reports its own limit with status 124. cdxgen's spawn timeout
+ * shows up as `ETIMEDOUT`. A dispatcher older than the status code stops atom
+ * with SIGTERM and exits 1, so status 1 at or past the limit counts as well,
+ * unless atom's own output shows it failed for another reason first (an
+ * exhausted heap, a crash), which deserves its own diagnosis.
+ *
+ * @param {Object} result spawnSync result
+ * @param {number} elapsedMs How long the run took
+ * @param {number} atomTimeoutMs atom's time limit
+ * @returns {boolean} true when the run hit a time limit
+ */
+export function atomRunTimedOut(result, elapsedMs, atomTimeoutMs) {
+  if (result?.status === ATOM_TIMEOUT_EXIT_CODE) {
+    return true;
+  }
+  if (result?.error?.code === "ETIMEDOUT") {
+    return true;
+  }
+  if (result?.status !== 1 || elapsedMs < atomTimeoutMs) {
+    return false;
+  }
+  const output = `${result.stdout || ""}\n${result.stderr || ""}`;
+  return !ATOM_FAILURE_MARKERS.some((marker) => output.includes(marker));
+}
+
+// Output that means atom failed by itself, whatever the clock says.
+const ATOM_FAILURE_MARKERS = [
+  "OutOfMemoryError",
+  "A fatal error has been detected by the Java Runtime Environment",
+  "The crash happened outside the Java Virtual Machine in native code",
+  "Failure: ",
+];
+
 /**
  * Execute the atom tool against a source directory or file with the given arguments.
  *
@@ -914,14 +1300,12 @@ export function executeAtom(src, args, extra_env = {}) {
     ...extra_env,
   };
   // Bound the heap while argv still starts at atom's own arguments: the
-  // space-split below prepends the launcher script, which has to stay first.
+  // split below prepends the launcher script, which has to stay first.
   applyAtomHeapLimit(args, env);
-  if (ATOM_BIN.includes(" ")) {
-    const tmpA = ATOM_BIN.split(" ");
-    if (tmpA && tmpA.length > 1) {
-      ATOM_BIN = tmpA[0];
-      args.unshift(tmpA[1]);
-    }
+  const [resolvedBin, leadingArg] = splitAtomCommand(ATOM_BIN);
+  if (leadingArg !== undefined) {
+    ATOM_BIN = resolvedBin;
+    args.unshift(leadingArg);
   }
   if (DEBUG_MODE) {
     console.log("Executing", ATOM_BIN);
@@ -952,12 +1336,33 @@ export function executeAtom(src, args, extra_env = {}) {
       ".bin",
     )}`;
   }
+  const { atomTimeoutMs, spawnTimeoutMs } = atomTimeouts();
+  env.ATOM_TIMEOUT = String(atomTimeoutMs);
+  // Name cdxgen as the supervisor: the dispatcher, and atom under it, stop when
+  // cdxgen is gone (killed by a caller's own timeout, say) instead of analysing
+  // on for nobody.
+  env.ATOM_PARENT_PID = String(process.pid);
+  const startedAt = Date.now();
   const result = safeSpawnSync(ATOM_BIN, args, {
     cwd,
     shell: isWin,
     killSignal: "SIGKILL",
     env,
+    timeout: spawnTimeoutMs,
   });
+  if (atomRunTimedOut(result, Date.now() - startedAt, atomTimeoutMs)) {
+    console.warn(
+      `WARN: atom did not finish within ${formatDuration(atomTimeoutMs)} and was stopped, so its results are missing or incomplete. Allow more time with ATOM_TIMEOUT (milliseconds, atom only) or CDXGEN_TIMEOUT_MS (every external command).`,
+    );
+    // A stopped atom leaves its graph half written, and the next slice of the
+    // same run would try to reuse it and fail to load it.
+    const atomFileIndex = args.indexOf("-o");
+    const atomFile = atomFileIndex >= 0 ? args[atomFileIndex + 1] : undefined;
+    if (atomFile && safeExistsSync(atomFile)) {
+      safeRmSync(atomFile, { recursive: true, force: true });
+    }
+    return false;
+  }
   const isJarKind = atomProviderKind() === "jar";
   if (result.stderr) {
     if (
@@ -1036,6 +1441,130 @@ export function executeAtom(src, args, extra_env = {}) {
   return isSupported && !result.error && result.status === 0;
 }
 
+const CHUNK_MTIME_SLACK_MS = 2000;
+
+/**
+ * The numbered chunks atom wrote beside a reachables slices file.
+ *
+ * atom writes reachables at most 1000 flows per file: `<base>.json`, then
+ * `<base>_1.json`, `<base>_2.json` and so on. Chunks are taken until the first
+ * gap. A chunk older than the base file was left by an earlier run with more
+ * flows (atom before 4.0.0 did not remove those), so it ends the sequence
+ * instead of being merged.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ * @returns {string[]} Chunk file paths, in order
+ */
+export function reachablesChunkFiles(slicesFile) {
+  const baseMtimeMs = mtimeMsOf(slicesFile);
+  if (!slicesFile?.endsWith(".json") || baseMtimeMs === undefined) {
+    return [];
+  }
+  const stem = slicesFile.slice(0, -".json".length);
+  // atom writes the base file first, so its chunks are never older. The slack
+  // covers filesystems that store modification times in whole seconds or two;
+  // it assumes no earlier run wrote chunks to the same path within that window.
+  // atom 4 and cdxgen both remove old chunks before atom writes new ones, so
+  // the mtime test only matters for slices files produced elsewhere.
+  const oldestChunkMtimeMs = baseMtimeMs - CHUNK_MTIME_SLACK_MS;
+  const chunks = [];
+  for (let index = 1; ; index++) {
+    const chunk = `${stem}_${index}.json`;
+    const chunkMtimeMs = mtimeMsOf(chunk);
+    if (chunkMtimeMs === undefined || chunkMtimeMs < oldestChunkMtimeMs) {
+      break;
+    }
+    chunks.push(chunk);
+  }
+  return chunks;
+}
+
+// A file that disappears between listing and stat ends the sequence, not the run.
+function mtimeMsOf(file) {
+  if (!file || !safeExistsSync(file)) {
+    return undefined;
+  }
+  try {
+    return statSync(file).mtimeMs;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Remove the numbered chunks beside a reachables slices file, before atom
+ * writes a new set there, so no chunk of an earlier run survives next to it.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ */
+export function removeReachablesChunkFiles(slicesFile) {
+  if (!slicesFile?.endsWith(".json")) {
+    return;
+  }
+  const stem = slicesFile.slice(0, -".json".length);
+  for (let index = 1; safeExistsSync(`${stem}_${index}.json`); index++) {
+    safeRmSync(`${stem}_${index}.json`, { force: true });
+  }
+}
+
+/**
+ * Read an atom slices file, or warn and return `undefined` when it cannot be
+ * parsed. A run stopped while writing (a timeout, a kill) can leave a
+ * truncated file, and the evidence from the other slices is still worth
+ * keeping.
+ *
+ * @param {string} slicesFile Path of the slices file
+ * @param {string} sliceType Slice type, for the warning
+ * @returns {*} The parsed slices, or `undefined`
+ */
+export function readSlicesFile(slicesFile, sliceType) {
+  if (!slicesFile || !safeExistsSync(slicesFile)) {
+    return undefined;
+  }
+  try {
+    return readJsonFile(slicesFile);
+  } catch (e) {
+    console.warn(
+      `WARN: Ignoring the ${sliceType} slices file ${slicesFile}, which is incomplete or not valid JSON (${e.message}).`,
+    );
+    return undefined;
+  }
+}
+
+/**
+ * Read a reachables slices file together with its chunks.
+ *
+ * Reading only the base file silently dropped every flow past the first
+ * thousand. A chunk that cannot be parsed ends the sequence, keeping the flows
+ * read before it.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ * @returns {Object[]|Object|undefined} Every flow, in the base file's shape (an array, or an object with `reachables`)
+ */
+export function readReachablesSlices(slicesFile) {
+  const data = readSlicesFile(slicesFile, "reachables");
+  if (data === undefined) {
+    return undefined;
+  }
+  const chunks = reachablesChunkFiles(slicesFile);
+  if (!chunks.length) {
+    return data;
+  }
+  const flowsOf = (slices) =>
+    Array.isArray(slices) ? slices : slices?.reachables || [];
+  const flows = [...flowsOf(data)];
+  for (const chunk of chunks) {
+    const chunkData = readSlicesFile(chunk, "reachables");
+    if (chunkData === undefined) {
+      break;
+    }
+    for (const flow of flowsOf(chunkData)) {
+      flows.push(flow);
+    }
+  }
+  return Array.isArray(data) || !data ? flows : { ...data, reachables: flows };
+}
+
 /**
  * Find the imported modules in the application with atom parsedeps command
  *
@@ -1068,6 +1597,14 @@ export function findAppModules(
     "--slice-outfile",
     resolve(slicesFile),
   ];
+  // The header languages parse without function bodies. Their AST cache, kept
+  // in <src>/.chen, would be replayed by a later full C/C++ run over the same
+  // directory (evinse, or `-t c --deep`) on atom releases that do not key the
+  // cache on that difference, leaving that run with no method bodies.
+  if (ATOM_HEADER_LANGUAGES.has(`${language}`.toLowerCase())) {
+    args.push("--no-ast-cache");
+  }
+  args.push(...atomCompileCommandsArgs(src, language, options));
   args.push(resolve(src));
   executeAtom(src, args, buildAtomCommandEnv(options, language));
   if (safeExistsSync(slicesFile)) {