@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/inventory/atomUtils.js

@@ -1,17 +1,37 @@
-import { lstatSync, readFileSync } from "node:fs";
+import {
+  lstatSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+} from "node:fs";
 import { tmpdir, totalmem } from "node:os";
-import { delimiter as _delimiter, dirname, join, resolve } from "node:path";
+import {
+  delimiter as _delimiter,
+  basename,
+  dirname,
+  join,
+  resolve,
+} from "node:path";
 import process from "node:process";
 
-import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import {
+  DEBUG_MODE,
+  isSecureMode,
+  readEnvironmentVariable,
+} from "../core/activity.js";
 import {
   safeExistsSync,
   safeMkdtempSync,
   safeRmSync,
   safeSpawnSync,
+  TIMEOUT_MS,
 } from "../core/fs.js";
 import { TRACE_MODE } from "../core/logger.js";
 import { dirNameStr, isWin } from "../core/paths.js";
+import { formatDuration, reapProcessTree } from "../core/processTree.js";
+import { readJsonFile } from "../parsers/largeJson.js";
+import { cmakeBuildDirCandidates } from "./cmakeBuildDirs.js";
 
 const ASTGEN_DEFAULT_IGNORE_DIRS = [
   "venv",
@@ -57,6 +77,243 @@ export const ATOM_NATIVE_PACKAGES = new Set([
 
 const ATOM_PHP_LANGUAGES = new Set(["php"]);
 
+/** atom `-l` values that parse C/C++ headers without function bodies. */
+const ATOM_HEADER_LANGUAGES = new Set(["h", "hpp", "i"]);
+
+/** atom `-l` values handled by the C/C++ frontend. */
+const ATOM_C_LANGUAGES = new Set([
+  "c",
+  "cpp",
+  "c++",
+  "newc",
+  ...ATOM_HEADER_LANGUAGES,
+]);
+
+const COMPILE_COMMANDS_FILE = "compile_commands.json";
+
+/**
+ * Characters a Windows shell command line would interpret: `&`, `|`, `<` and
+ * `>` chain or redirect commands, `%` expands variables even inside quotes,
+ * `^` escapes, `!` expands under delayed expansion, and a quote breaks the
+ * quoting Node applies to arguments when `shell` is on. A database is often
+ * discovered inside the scanned tree, so its path is not trusted input.
+ */
+const UNSAFE_SHELL_CHARS_RE = /[\r\n\t&|<>%^!"]/;
+
+function compileCommandsIn(dir) {
+  for (const candidate of [
+    join(dir, COMPILE_COMMANDS_FILE),
+    join(dir, "build", COMPILE_COMMANDS_FILE),
+  ]) {
+    try {
+      if (statSync(candidate).isFile()) {
+        return candidate;
+      }
+    } catch (_err) {
+      // not there
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Locate the JSON compilation database (`compile_commands.json`) of a C/C++
+ * project, which lets atom parse each file with the include paths, macros and
+ * language its build uses.
+ *
+ * An explicit `options.compileCommands` (a file, or a directory holding one
+ * directly or under `build/`) wins. Otherwise the scan root and the project's
+ * build directories are searched: the directory of `options.cmakeCache`, the
+ * build directories of its CMake presets, and the conventional `build`,
+ * `out`, `builddir` and `cmake-build-` directories (see
+ * `cmakeBuildDirCandidates`). A database can come with the code it describes,
+ * and atom asks the
+ * GCC or Clang driver it names (from the PATH, or an absolute path outside
+ * the project) for its predefined macros, so in secure mode only an explicit
+ * database is used.
+ *
+ * @param {string} src Project scan root
+ * @param {Object} options CLI options
+ * @returns {string|undefined} Absolute path of the database
+ */
+export function findCompileCommands(src, options = {}) {
+  if (options.compileCommands) {
+    const requested = resolve(`${options.compileCommands}`);
+    let found;
+    try {
+      found = statSync(requested).isDirectory()
+        ? compileCommandsIn(requested)
+        : requested;
+    } catch (_err) {
+      found = undefined;
+    }
+    if (!found) {
+      console.warn(
+        `No compilation database at ${requested}. Parsing the C/C++ sources without one.`,
+      );
+    }
+    return found;
+  }
+  if (isSecureMode || !src) {
+    return undefined;
+  }
+  const root = resolve(src);
+  let rootIsDir = false;
+  try {
+    rootIsDir = statSync(root).isDirectory();
+  } catch (_err) {
+    return undefined;
+  }
+  if (!rootIsDir) {
+    return undefined;
+  }
+  const dirs = [root, ...cmakeBuildDirCandidates(root, options)];
+  for (const dir of dirs) {
+    const candidate = join(dir, COMPILE_COMMANDS_FILE);
+    try {
+      if (statSync(candidate).isFile()) {
+        return candidate;
+      }
+    } catch (_err) {
+      // not there
+    }
+  }
+  return undefined;
+}
+
+const atomFrontendArgKeysCache = new Map();
+
+/**
+ * Split an atom command that may carry a leading argument (`node
+ * script.js`, a custom `ATOM_CMD`) into its binary and that argument. The
+ * first space only splits when it can: a binary under a path with spaces
+ * (`C:\Program Files\...\node.exe script.js`) would otherwise be cut
+ * mid-path and the shell told to run `C:\Program`. A command name without a
+ * path separator (`node script.js`) resolves through the PATH, so it splits
+ * at its first space as before; otherwise the first prefix that exists as a
+ * file is the binary, and when none does the first space keeps the old
+ * behaviour.
+ *
+ * @param {string} command The atom command, possibly with an argument
+ * @returns {[string, string|undefined]} The binary and its leading argument, when present
+ */
+export function splitAtomCommand(command) {
+  const firstSpace = `${command}`.indexOf(" ");
+  if (firstSpace === -1) {
+    return [`${command}`, undefined];
+  }
+  const head = command.slice(0, firstSpace);
+  if (!/[/\\]/.test(head)) {
+    return [head, command.slice(firstSpace + 1)];
+  }
+  let splitAt = firstSpace;
+  let index = firstSpace;
+  while ((index = command.indexOf(" ", index + 1)) !== -1) {
+    try {
+      if (statSync(command.slice(0, index)).isFile()) {
+        splitAt = index;
+        break;
+      }
+    } catch (_err) {
+      // not a file; a later space may still split at the real binary
+    }
+  }
+  return [command.slice(0, splitAt), command.slice(splitAt + 1)];
+}
+
+/**
+ * The `--frontend-args` keys the installed atom accepts for a language, as
+ * `atom --frontend-args-keys -l <language>` lists them. Asked once per atom
+ * command and language. An atom that cannot list them (a release without
+ * `--frontend-args`, or one that fails to start) accepts none.
+ *
+ * @param {string} language atom `-l` value
+ * @returns {Set<string>} Supported keys
+ */
+export function atomFrontendArgKeys(language) {
+  const command = getAtomCommand();
+  const cacheKey = `${command}\u0000${language}`;
+  if (atomFrontendArgKeysCache.has(cacheKey)) {
+    return atomFrontendArgKeysCache.get(cacheKey);
+  }
+  const [bin, leadingArg] = splitAtomCommand(command);
+  const args = ["--frontend-args-keys", "-l", `${language}`];
+  if (leadingArg !== undefined) {
+    args.unshift(leadingArg);
+  }
+  const env = { ...process.env };
+  if (readEnvironmentVariable("ATOM_JAVA_HOME")) {
+    env.JAVA_HOME = readEnvironmentVariable("ATOM_JAVA_HOME");
+  }
+  const keys = new Set();
+  const result = safeSpawnSync(bin, args, {
+    shell: isWin,
+    env,
+    timeout: 120000,
+  });
+  if (result?.status === 0 && result.stdout) {
+    let inTable = false;
+    for (const line of `${result.stdout}`.split(/\r?\n/)) {
+      if (line.startsWith("----")) {
+        inTable = true;
+      } else if (inTable && /^[a-z][a-z0-9-]*\s/.test(line)) {
+        keys.add(line.split(/\s+/)[0]);
+      }
+    }
+  }
+  if (DEBUG_MODE && !keys.size) {
+    console.log(
+      `The installed atom did not list its --frontend-args keys for ${language}.`,
+    );
+  }
+  atomFrontendArgKeysCache.set(cacheKey, keys);
+  return keys;
+}
+
+/**
+ * The `--frontend-args` atom takes for a C/C++ language: the project's
+ * compilation database, when there is one and the installed atom reads it
+ * (atom 4 and later). An older atom is given the arguments it has always
+ * been given, and parses the sources without the database.
+ *
+ * @param {string} src Project scan root
+ * @param {string} language atom `-l` value
+ * @param {Object} options CLI options
+ * @returns {string[]} Arguments to add to the atom command
+ */
+export function atomCompileCommandsArgs(src, language, options = {}) {
+  if (!ATOM_C_LANGUAGES.has(`${language}`.toLowerCase())) {
+    return [];
+  }
+  const database = findCompileCommands(src, options);
+  if (!database) {
+    return [];
+  }
+  // --frontend-args separates its key=value pairs with commas
+  if (database.includes(",")) {
+    console.warn(
+      `The compilation database path ${database} contains a comma, which atom cannot take. Parsing the C/C++ sources without it.`,
+    );
+    return [];
+  }
+  // The argument reaches a Windows shell command line through `shell: isWin`
+  // in executeAtom, and the path is routinely discovered inside the scanned
+  // tree, so a database whose path a shell would interpret is never passed on.
+  if (UNSAFE_SHELL_CHARS_RE.test(database)) {
+    console.warn(
+      `The compilation database path ${database} contains characters a shell would interpret. Parsing the C/C++ sources without it.`,
+    );
+    return [];
+  }
+  if (!atomFrontendArgKeys(language).has("compile-commands")) {
+    return [];
+  }
+  if (DEBUG_MODE) {
+    console.log(`Passing the compilation database ${database} to atom.`);
+  }
+  return ["--frontend-args", `compile-commands=${database}`];
+}
+
 // Absolute ceiling on atom's heap. Past this point a larger heap buys a
 // collector that runs less often rather than an analysis that succeeds where it
 // otherwise would not, while the reservation itself is what pushes a build
@@ -489,18 +746,32 @@ export function buildAtomCommandEnv(options = {}, language = "") {
   // that does not exist on native platforms, and atom 3.0.x crashes parsing
   // that bogus value. Forward the resolved php-parse location through the env
   // so executeAtom can bypass the dispatcher for PHP (see
-  // resolveDirectAtomBinaryPath). Computed independently of exclude patterns.
+  // resolveDirectAtomBinaryPath). PHP_ASTGEN_BIN additionally names the
+  // batch-capable generator (phpastgen.js): chen parses the whole tree, vendor
+  // included, in one generator run instead of one php interpreter per file,
+  // which on windows is the difference between minutes and hours. Computed
+  // independently of exclude patterns.
   const phpParseBin = ATOM_PHP_LANGUAGES.has(normalizedLanguage)
     ? resolvePhpParseBin()
     : undefined;
+  const phpAstgenBin = ATOM_PHP_LANGUAGES.has(normalizedLanguage)
+    ? resolvePhpAstgenBin()
+    : undefined;
+  const phpEnv = {};
+  if (phpParseBin) {
+    phpEnv.PHP_PARSER_BIN = phpParseBin;
+  }
+  if (phpAstgenBin) {
+    phpEnv.PHP_ASTGEN_BIN = phpAstgenBin;
+  }
   if (!excludePatterns.length) {
-    return phpParseBin ? { PHP_PARSER_BIN: phpParseBin } : {};
+    return phpEnv;
   }
   const chenIgnoreDirs = mergeCsvValues(
     readEnvironmentVariable("CHEN_IGNORE_DIRS"),
     extractIgnoreDirsFromExcludePatterns(excludePatterns, true),
   );
-  const env = {};
+  const env = { ...phpEnv };
   if (chenIgnoreDirs) {
     env.CHEN_IGNORE_DIRS = chenIgnoreDirs;
   }
@@ -526,9 +797,6 @@ export function buildAtomCommandEnv(options = {}, language = "") {
       env.ASTGEN_IGNORE_FILE_PATTERN = astgenIgnoreFilePattern;
     }
   }
-  if (phpParseBin) {
-    env.PHP_PARSER_BIN = phpParseBin;
-  }
   return env;
 }
 
@@ -610,12 +878,93 @@ export function resolveAtomProvider(opts = {}) {
 }
 
 /**
- * Returns `"native"` or `"jar"` for the currently resolved atom provider.
- * Used to gate Java/JDK advice so users on the five native platforms are not
- * told to install a JDK for a failure that has nothing to do with Java.
+ * Returns `"native"` or `"jar"` for the atom provider that will actually run.
+ *
+ * The platform decides which provider atom prefers, but the dispatcher falls
+ * back to the jar package when the platform's native package is not installed
+ * (optional dependencies skipped, a failed download). The two take the heap
+ * ceiling differently, and a native-image runtime option on a jar run reaches
+ * atom as an unknown argument that fails every slice. So the kind follows what
+ * is installed where cdxgen can see it: the native binary means native, the jar
+ * package without it means jar. An `ATOM_CMD` is classified by what it names
+ * (see `atomCommandKind`). With nothing in view (an install elsewhere) the
+ * platform's kind stands.
+ *
+ * Also used to gate Java/JDK advice, so users on the five native platforms are
+ * not told to install a JDK for a failure that has nothing to do with Java.
  */
 export function atomProviderKind() {
-  return resolveAtomProvider().kind;
+  const { kind } = resolveAtomProvider();
+  if (readEnvironmentVariable("ATOM_CMD")) {
+    return atomCommandKind(readEnvironmentVariable("ATOM_CMD"), kind);
+  }
+  if (kind !== "native") {
+    return kind;
+  }
+  const atomHome = readEnvironmentVariable("ATOM_HOME");
+  if (atomHome) {
+    // A jar install's ATOM_HOME is its plugins/ directory, which carries lib/;
+    // a native sub-package directory does not.
+    return safeExistsSync(join(atomHome, "lib")) ? "jar" : kind;
+  }
+  if (resolveDirectAtomBinaryPath()) {
+    return "native";
+  }
+  const jarPlugins = atomSubPackageCandidates("atom-jar").some((dir) =>
+    safeExistsSync(join(dir, "plugins")),
+  );
+  return jarPlugins ? "jar" : kind;
+}
+
+/**
+ * Whether `ATOM_CMD` launches a jar or follows the platform.
+ *
+ * The jar launchers (`plugins/bin/atom`, `plugins/bin/atom.bat`) sit next to a
+ * `plugins/lib` directory holding atom's jars, so a launcher with that sibling,
+ * or any `.bat` (only the jar payload ships one), runs on the JVM whatever the
+ * platform is. Everything else, including the npm dispatcher (`node
+ * .../index.js`, its `atom`/`atom.cmd` bin shims) and a native binary, follows
+ * the platform's kind. A GraalVM `-XX:` heap argument handed to a jar launcher
+ * is rejected by atom's option parser before any analysis starts, and a
+ * `JAVA_TOOL_OPTIONS` ceiling handed to a native image is silently ignored, so
+ * the distinction decides whether the heap is bounded at all.
+ *
+ * @param {string} command The `ATOM_CMD` value
+ * @param {"native"|"jar"} platformKind Kind the platform prefers
+ * @returns {"native"|"jar"}
+ */
+export function atomCommandKind(command, platformKind) {
+  const [bin, leadingArg] = splitAtomCommand(command);
+  const runsScript =
+    leadingArg !== undefined && /^node(\.exe)?$/i.test(basename(bin));
+  let launcher = runsScript ? leadingArg : bin;
+  if (/\.bat$/i.test(launcher)) {
+    return "jar";
+  }
+  try {
+    // npm bin entries are symlinks into the package (`/usr/local/bin/atom` ->
+    // `.../@appthreat/atom/index.js`), and `/usr/local` has a `lib` of its own.
+    launcher = realpathSync(launcher);
+  } catch {
+    return platformKind;
+  }
+  const binDir = dirname(launcher);
+  if (basename(binDir) !== "bin") {
+    return platformKind;
+  }
+  try {
+    const libDir = join(dirname(binDir), "lib");
+    if (
+      readdirSync(libDir).some(
+        (file) => file.startsWith("io.appthreat.atom") && file.endsWith(".jar"),
+      )
+    ) {
+      return "jar";
+    }
+  } catch {
+    // no lib directory: not a jar layout
+  }
+  return platformKind;
 }
 
 /**
@@ -623,8 +972,8 @@ export function atomProviderKind() {
  *
  * atom 3's dispatcher unconditionally sets `PHP_PARSER_BIN=<ATOM_HOME>/bin/php-parse`,
  * which for a native sub-package does not exist and also clobbers a caller-set
- * value. cdxgen therefore resolves the real location and forwards it through
- * the child env (see `buildAtomCommandEnv`); `executeAtom` then spawns the
+ * value. cdxgen therefore resolves the real location and forwards it through the
+ * child env (see `buildAtomCommandEnv`); `executeAtom` then spawns the
  * native binary directly for PHP so the dispatcher cannot clobber it (see
  * `resolveDirectAtomBinaryPath`). Resolution order:
  *   1. explicit `PHP_PARSER_BIN` env var (operators / container images)
@@ -641,6 +990,44 @@ export function resolvePhpParseBin() {
   if (readEnvironmentVariable("PHP_PARSER_BIN")) {
     return readEnvironmentVariable("PHP_PARSER_BIN");
   }
+  return parsetoolsFile("plugins", "bin", "php-parse");
+}
+
+/**
+ * Locate the `phpastgen` generator that lets the PHP frontend parse whole
+ * directories in one batch.
+ *
+ * `php-parse` (forwarded as `PHP_PARSER_BIN`) is the per-file parser: atom
+ * starts a php interpreter for every `.php` file, which on windows turns a
+ * vendored PHP project (thousands of files under `vendor/`) into an hours-long
+ * run that no timeout can rescue. `phpastgen` answers the `--parser-info`
+ * capability probe, so atom's batch path engages, and atom-parsetools 1.9 and
+ * later parse the whole tree, vendor included, with a few interpreters that
+ * each take a chunk of files. It is a Node script, so the frontend launches it
+ * with `node` rather than `php`; an atom that does not know `PHP_ASTGEN_BIN`
+ * simply ignores it and keeps today's per-file behaviour. Resolution order:
+ *   1. explicit `PHP_ASTGEN_BIN` env var (operators / container images)
+ *   2. `@appthreat/atom-parsetools/phpastgen.js` under cdxgen's own
+ *      node_modules, then under `GLOBAL_NODE_MODULES_PATH` for global installs
+ *
+ * @returns {string|undefined}
+ */
+export function resolvePhpAstgenBin() {
+  if (readEnvironmentVariable("PHP_ASTGEN_BIN")) {
+    return readEnvironmentVariable("PHP_ASTGEN_BIN");
+  }
+  return parsetoolsFile("phpastgen.js");
+}
+
+/**
+ * Resolve a file inside the installed `@appthreat/atom-parsetools` package,
+ * searching cdxgen's own node_modules and `GLOBAL_NODE_MODULES_PATH` for global
+ * installs.
+ *
+ * @param {...string} segments Path segments below the package root
+ * @returns {string|undefined}
+ */
+export function parsetoolsFile(...segments) {
   const roots = [dirNameStr];
   if (readEnvironmentVariable("GLOBAL_NODE_MODULES_PATH")) {
     roots.push(dirname(readEnvironmentVariable("GLOBAL_NODE_MODULES_PATH")));
@@ -651,9 +1038,7 @@ export function resolvePhpParseBin() {
       "node_modules",
       "@appthreat",
       "atom-parsetools",
-      "plugins",
-      "bin",
-      "php-parse",
+      ...segments,
     );
     if (safeExistsSync(candidate)) {
       return candidate;
@@ -683,6 +1068,25 @@ export function resolveDirectAtomBinaryPath() {
   }
   const folder = preferredPkg.split("/")[1];
   const exeName = isWin ? "atom.exe" : "atom";
+  for (const dir of atomSubPackageCandidates(folder)) {
+    const candidate = join(dir, "bin", exeName);
+    if (safeExistsSync(candidate)) {
+      return candidate;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Directories where an `@appthreat/atom-*` sub-package may be installed next to
+ * the dispatcher cdxgen uses, for npm, pnpm and global layouts: a sibling of
+ * `@appthreat/atom`, nested under it, in a pnpm virtual store, or a sibling of
+ * the dispatcher's real (symlink-resolved) directory.
+ *
+ * @param {string} folder Sub-package folder name, e.g. `atom-jar`
+ * @returns {string[]} Candidate package directories
+ */
+function atomSubPackageCandidates(folder) {
   const version = readAtomVersion();
   const roots = [join(dirNameStr, "node_modules")];
   if (readEnvironmentVariable("GLOBAL_NODE_MODULES_PATH")) {
@@ -690,18 +1094,9 @@ export function resolveDirectAtomBinaryPath() {
   }
   const candidates = [];
   for (const root of roots) {
-    candidates.push(join(root, "@appthreat", folder, "bin", exeName));
+    candidates.push(join(root, "@appthreat", folder));
     candidates.push(
-      join(
-        root,
-        "@appthreat",
-        "atom",
-        "node_modules",
-        "@appthreat",
-        folder,
-        "bin",
-        exeName,
-      ),
+      join(root, "@appthreat", "atom", "node_modules", "@appthreat", folder),
     );
     if (version) {
       candidates.push(
@@ -712,18 +1107,19 @@ export function resolveDirectAtomBinaryPath() {
           "node_modules",
           "@appthreat",
           folder,
-          "bin",
-          exeName,
         ),
       );
     }
-  }
-  for (const candidate of candidates) {
-    if (safeExistsSync(candidate)) {
-      return candidate;
+    // pnpm links @appthreat/atom to its store entry, where the sub-packages
+    // are its siblings.
+    try {
+      const atomDir = realpathSync(join(root, "@appthreat", "atom"));
+      candidates.push(join(dirname(atomDir), folder));
+    } catch {
+      // not installed under this root
     }
   }
-  return undefined;
+  return [...new Set(candidates)];
 }
 
 function readAtomVersion() {
@@ -874,6 +1270,117 @@ function applyAtomHeapLimit(args, env) {
   }
 }
 
+// How long cdxgen waits past atom's own time limit for the dispatcher to stop
+// the runtime and exit. It covers the dispatcher's SIGTERM-to-SIGKILL grace (10
+// seconds) and the runtime's exit. A short limit (a test, a smoke run) gets a
+// quarter of itself instead.
+const ATOM_STOP_GRACE_MS = 30_000;
+
+/**
+ * Compute how long atom may run, and how long cdxgen waits for it.
+ *
+ * cdxgen's spawn timeout kills only the process cdxgen started, and for atom
+ * that is the npm dispatcher. The runtime under it (the native binary or the
+ * JVM) used to survive that kill, re-parented and still holding its heap. atom
+ * therefore gets its own limit, `ATOM_TIMEOUT`, which the dispatcher enforces on
+ * the runtime, and cdxgen's spawn timeout sits a grace period beyond it as the
+ * last resort.
+ *
+ * An explicit `ATOM_TIMEOUT` (milliseconds) sets atom's limit independently of
+ * `CDXGEN_TIMEOUT_MS`, which keeps bounding every other tool. Otherwise atom's
+ * limit is `CDXGEN_TIMEOUT_MS` less the grace period.
+ *
+ * @returns {{atomTimeoutMs: number, spawnTimeoutMs: number}} atom's own limit and cdxgen's spawn timeout for it
+ */
+export function atomTimeouts() {
+  const graceFor = (ms) => Math.min(ATOM_STOP_GRACE_MS, Math.floor(ms / 4));
+  const configured = Number.parseInt(
+    readEnvironmentVariable("ATOM_TIMEOUT"),
+    10,
+  );
+  if (configured > 0) {
+    return {
+      atomTimeoutMs: configured,
+      spawnTimeoutMs: configured + graceFor(configured),
+    };
+  }
+  return {
+    atomTimeoutMs: TIMEOUT_MS - graceFor(TIMEOUT_MS),
+    spawnTimeoutMs: TIMEOUT_MS,
+  };
+}
+
+// The status the atom dispatcher exits with when ATOM_TIMEOUT stops atom.
+const ATOM_TIMEOUT_EXIT_CODE = 124;
+
+/**
+ * Reap everything a timed-out atom run left behind on Windows.
+ *
+ * cdxgen starts atom through a shell there (`shell: isWin`), so the spawn
+ * timeout terminates only that `cmd.exe`, and the runtime and every parser
+ * worker under it (one `php.exe` per file for the per-file PHP frontend) keep
+ * running against the next slice of the same run. See
+ * {@link reapProcessTree} for how they are found. A chain broken by an
+ * intermediate that already exited (the npm dispatcher stopping its runtime
+ * itself) cannot be followed, and atom 4 stops its helpers once
+ * `ATOM_PARENT_PID` is gone.
+ *
+ * @param {number|undefined} rootPid pid of the process cdxgen spawned
+ * @param {number} startedAt Epoch milliseconds at which the run started
+ * @param {number} [endedAt] Epoch milliseconds at which the spawned process ended
+ * @returns {number[]} The pids that were stopped
+ */
+export function reapAtomProcessTree(rootPid, startedAt, endedAt = Date.now()) {
+  return reapProcessTree(rootPid, startedAt, endedAt, "atom");
+}
+
+/**
+ * Whether an atom run ended because it ran out of time.
+ *
+ * The dispatcher reports its own limit with status 124. cdxgen's spawn timeout
+ * shows up as `ETIMEDOUT`. A dispatcher older than the status code stops atom
+ * with SIGTERM and passes on how the runtime ended: 1, or the runtime's own
+ * exit on SIGTERM (143) or SIGKILL (137), which is what atom 3.1 reports. Those
+ * statuses at or past the limit count as well, unless atom's own output shows
+ * it failed for another reason first (an exhausted heap, a crash), which
+ * deserves its own diagnosis. Missing one leaves the half-written atom behind,
+ * and the next slice of the run fails to load it.
+ *
+ * @param {Object} result spawnSync result
+ * @param {number} elapsedMs How long the run took
+ * @param {number} atomTimeoutMs atom's time limit
+ * @returns {boolean} true when the run hit a time limit
+ */
+export function atomRunTimedOut(result, elapsedMs, atomTimeoutMs) {
+  if (result?.status === ATOM_TIMEOUT_EXIT_CODE) {
+    return true;
+  }
+  if (result?.error?.code === "ETIMEDOUT") {
+    return true;
+  }
+  if (
+    !ATOM_STOPPED_STATUSES.includes(result?.status) ||
+    elapsedMs < atomTimeoutMs
+  ) {
+    return false;
+  }
+  const output = `${result.stdout || ""}\n${result.stderr || ""}`;
+  return !ATOM_FAILURE_MARKERS.some((marker) => output.includes(marker));
+}
+
+// How a runtime stopped by an older dispatcher at ATOM_TIMEOUT exits: the
+// dispatcher's own 1, or the runtime's exit on SIGTERM (128 + 15) or SIGKILL
+// (128 + 9) passed through.
+const ATOM_STOPPED_STATUSES = [1, 137, 143];
+
+// Output that means atom failed by itself, whatever the clock says.
+const ATOM_FAILURE_MARKERS = [
+  "OutOfMemoryError",
+  "A fatal error has been detected by the Java Runtime Environment",
+  "The crash happened outside the Java Virtual Machine in native code",
+  "Failure: ",
+];
+
 /**
  * Execute the atom tool against a source directory or file with the given arguments.
  *
@@ -914,14 +1421,12 @@ export function executeAtom(src, args, extra_env = {}) {
     ...extra_env,
   };
   // Bound the heap while argv still starts at atom's own arguments: the
-  // space-split below prepends the launcher script, which has to stay first.
+  // split below prepends the launcher script, which has to stay first.
   applyAtomHeapLimit(args, env);
-  if (ATOM_BIN.includes(" ")) {
-    const tmpA = ATOM_BIN.split(" ");
-    if (tmpA && tmpA.length > 1) {
-      ATOM_BIN = tmpA[0];
-      args.unshift(tmpA[1]);
-    }
+  const [resolvedBin, leadingArg] = splitAtomCommand(ATOM_BIN);
+  if (leadingArg !== undefined) {
+    ATOM_BIN = resolvedBin;
+    args.unshift(leadingArg);
   }
   if (DEBUG_MODE) {
     console.log("Executing", ATOM_BIN);
@@ -952,12 +1457,35 @@ export function executeAtom(src, args, extra_env = {}) {
       ".bin",
     )}`;
   }
+  const { atomTimeoutMs, spawnTimeoutMs } = atomTimeouts();
+  env.ATOM_TIMEOUT = String(atomTimeoutMs);
+  // Name cdxgen as the supervisor: the dispatcher, and atom under it, stop when
+  // cdxgen is gone (killed by a caller's own timeout, say) instead of analysing
+  // on for nobody.
+  env.ATOM_PARENT_PID = String(process.pid);
+  const startedAt = Date.now();
   const result = safeSpawnSync(ATOM_BIN, args, {
     cwd,
     shell: isWin,
     killSignal: "SIGKILL",
     env,
+    timeout: spawnTimeoutMs,
   });
+  const endedAt = Date.now();
+  if (atomRunTimedOut(result, endedAt - startedAt, atomTimeoutMs)) {
+    console.warn(
+      `WARN: atom did not finish within ${formatDuration(atomTimeoutMs)} and was stopped, so its results are missing or incomplete. Allow more time with ATOM_TIMEOUT (milliseconds, atom only) or CDXGEN_TIMEOUT_MS (every external command).`,
+    );
+    reapAtomProcessTree(result.pid, startedAt, endedAt);
+    // A stopped atom leaves its graph half written, and the next slice of the
+    // same run would try to reuse it and fail to load it.
+    const atomFileIndex = args.indexOf("-o");
+    const atomFile = atomFileIndex >= 0 ? args[atomFileIndex + 1] : undefined;
+    if (atomFile && safeExistsSync(atomFile)) {
+      safeRmSync(atomFile, { recursive: true, force: true });
+    }
+    return false;
+  }
   const isJarKind = atomProviderKind() === "jar";
   if (result.stderr) {
     if (
@@ -1036,6 +1564,130 @@ export function executeAtom(src, args, extra_env = {}) {
   return isSupported && !result.error && result.status === 0;
 }
 
+const CHUNK_MTIME_SLACK_MS = 2000;
+
+/**
+ * The numbered chunks atom wrote beside a reachables slices file.
+ *
+ * atom writes reachables at most 1000 flows per file: `<base>.json`, then
+ * `<base>_1.json`, `<base>_2.json` and so on. Chunks are taken until the first
+ * gap. A chunk older than the base file was left by an earlier run with more
+ * flows (atom before 4.0.0 did not remove those), so it ends the sequence
+ * instead of being merged.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ * @returns {string[]} Chunk file paths, in order
+ */
+export function reachablesChunkFiles(slicesFile) {
+  const baseMtimeMs = mtimeMsOf(slicesFile);
+  if (!slicesFile?.endsWith(".json") || baseMtimeMs === undefined) {
+    return [];
+  }
+  const stem = slicesFile.slice(0, -".json".length);
+  // atom writes the base file first, so its chunks are never older. The slack
+  // covers filesystems that store modification times in whole seconds or two;
+  // it assumes no earlier run wrote chunks to the same path within that window.
+  // atom 4 and cdxgen both remove old chunks before atom writes new ones, so
+  // the mtime test only matters for slices files produced elsewhere.
+  const oldestChunkMtimeMs = baseMtimeMs - CHUNK_MTIME_SLACK_MS;
+  const chunks = [];
+  for (let index = 1; ; index++) {
+    const chunk = `${stem}_${index}.json`;
+    const chunkMtimeMs = mtimeMsOf(chunk);
+    if (chunkMtimeMs === undefined || chunkMtimeMs < oldestChunkMtimeMs) {
+      break;
+    }
+    chunks.push(chunk);
+  }
+  return chunks;
+}
+
+// A file that disappears between listing and stat ends the sequence, not the run.
+function mtimeMsOf(file) {
+  if (!file || !safeExistsSync(file)) {
+    return undefined;
+  }
+  try {
+    return statSync(file).mtimeMs;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Remove the numbered chunks beside a reachables slices file, before atom
+ * writes a new set there, so no chunk of an earlier run survives next to it.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ */
+export function removeReachablesChunkFiles(slicesFile) {
+  if (!slicesFile?.endsWith(".json")) {
+    return;
+  }
+  const stem = slicesFile.slice(0, -".json".length);
+  for (let index = 1; safeExistsSync(`${stem}_${index}.json`); index++) {
+    safeRmSync(`${stem}_${index}.json`, { force: true });
+  }
+}
+
+/**
+ * Read an atom slices file, or warn and return `undefined` when it cannot be
+ * parsed. A run stopped while writing (a timeout, a kill) can leave a
+ * truncated file, and the evidence from the other slices is still worth
+ * keeping.
+ *
+ * @param {string} slicesFile Path of the slices file
+ * @param {string} sliceType Slice type, for the warning
+ * @returns {*} The parsed slices, or `undefined`
+ */
+export function readSlicesFile(slicesFile, sliceType) {
+  if (!slicesFile || !safeExistsSync(slicesFile)) {
+    return undefined;
+  }
+  try {
+    return readJsonFile(slicesFile);
+  } catch (e) {
+    console.warn(
+      `WARN: Ignoring the ${sliceType} slices file ${slicesFile}, which is incomplete or not valid JSON (${e.message}).`,
+    );
+    return undefined;
+  }
+}
+
+/**
+ * Read a reachables slices file together with its chunks.
+ *
+ * Reading only the base file silently dropped every flow past the first
+ * thousand. A chunk that cannot be parsed ends the sequence, keeping the flows
+ * read before it.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ * @returns {Object[]|Object|undefined} Every flow, in the base file's shape (an array, or an object with `reachables`)
+ */
+export function readReachablesSlices(slicesFile) {
+  const data = readSlicesFile(slicesFile, "reachables");
+  if (data === undefined) {
+    return undefined;
+  }
+  const chunks = reachablesChunkFiles(slicesFile);
+  if (!chunks.length) {
+    return data;
+  }
+  const flowsOf = (slices) =>
+    Array.isArray(slices) ? slices : slices?.reachables || [];
+  const flows = [...flowsOf(data)];
+  for (const chunk of chunks) {
+    const chunkData = readSlicesFile(chunk, "reachables");
+    if (chunkData === undefined) {
+      break;
+    }
+    for (const flow of flowsOf(chunkData)) {
+      flows.push(flow);
+    }
+  }
+  return Array.isArray(data) || !data ? flows : { ...data, reachables: flows };
+}
+
 /**
  * Find the imported modules in the application with atom parsedeps command
  *
@@ -1068,6 +1720,14 @@ export function findAppModules(
     "--slice-outfile",
     resolve(slicesFile),
   ];
+  // The header languages parse without function bodies. Their AST cache, kept
+  // in <src>/.chen, would be replayed by a later full C/C++ run over the same
+  // directory (evinse, or `-t c --deep`) on atom releases that do not key the
+  // cache on that difference, leaving that run with no method bodies.
+  if (ATOM_HEADER_LANGUAGES.has(`${language}`.toLowerCase())) {
+    args.push("--no-ast-cache");
+  }
+  args.push(...atomCompileCommandsArgs(src, language, options));
   args.push(resolve(src));
   executeAtom(src, args, buildAtomCommandEnv(options, language));
   if (safeExistsSync(slicesFile)) {