@cdxgen/cdxgen 13.3.0 → 13.4.0

package/lib/inventory/aiCollector.js

@@ -90,8 +90,11 @@ const isVendoredArtifactPath = (filePath) => {
 };
 const GGUF_MIN_ALIGNMENT = 4;
 const GGUF_MAX_ALIGNMENT = 1024 * 1024;
+// Tested against full paths. The config exceptions follow IGNORE_FILE_PATTERN
+// in analyzer.js, with the app exception anchored to a path separator instead
+// of the start of a file name.
 const IGNORE_SOURCE_FILE_PATTERN =
-  /(^|\/|\\)(__tests__|fixtures?|examples?|samples?)($|\/|\\)|(^|\/|\\)(test|spec|mock|setup-jest|conftest|sitecustomize)\.(js|ts|tsx|py)$|(?<!vite\.|vue\.)(conf|config)\.(js|ts|tsx)$/iu;
+  /(^|\/|\\)(__tests__|fixtures?|examples?|samples?)($|\/|\\)|(^|\/|\\)(test|spec|mock|setup-jest|conftest|sitecustomize)\.([cm]?[jt]sx?|py)$|(?<!vite\.|vue\.|svelte\.|astro\.|(?:^|\/|\\)app\.)(conf|config)\.[cm]?[jt]sx?$/iu;
 const HOST_PROVIDER_PATTERNS = [
   ["openai", /(?:^|\.)openai\.com$/iu],
   ["anthropic", /(?:^|\.)anthropic\.com$/iu],

package/lib/inventory/analyzer.js

@@ -68,9 +68,19 @@ const IGNORE_DIRS = readEnvironmentVariable("ASTGEN_IGNORE_DIRS")
       "coverage",
     ];
 
+// The pattern is tested against file names. Config files are skipped because
+// their imports are mostly build and test tooling. The exceptions hold code the
+// application is built from: the Vite, Vue CLI, Svelte, and Astro configs name
+// the build plugins and integrations the app needs, and app.config.* holds
+// application code, such as the root providers of an Angular app. The app
+// exception is anchored to the start of the name, so names such as
+// webapp.config.ts are still skipped. [cm]?[jt]sx? covers every JavaScript and
+// TypeScript module extension, as the default test globs of Jest and Vitest do.
+// Keep the config exceptions in step with IGNORE_SOURCE_FILE_PATTERN in
+// aiCollector.js.
 const IGNORE_FILE_PATTERN = new RegExp(
   readEnvironmentVariable("ASTGEN_IGNORE_FILE_PATTERN") ||
-    "(test|spec|mock|setup-jest|\\.d)\\.(js|ts|tsx)$|(?<!vite\\.|vue\\.|svelte\\.)(conf|config)\\.(js|ts|tsx)$",
+    "(test|spec|mock|setup-jest|\\.d)\\.[cm]?[jt]sx?$|(?<!vite\\.|vue\\.|svelte\\.|astro\\.|^app\\.)(conf|config)\\.[cm]?[jt]sx?$",
   "i",
 );
 
@@ -210,6 +220,46 @@ const getAllFiles = (
   return result;
 };
 
+/**
+ * Walk a directory tree once and return the files whose names end with any of
+ * the given extensions.
+ *
+ * Files are grouped by extension in the order of `extensions`, and each group
+ * keeps the walk order. That is the order one walk per extension produced, and
+ * occurrences reach the BOM in it.
+ *
+ * @param {string} dir Directory to walk
+ * @param {string[]} extensions File extensions, each with its leading dot
+ * @param {boolean|Object} deepOrOptions Deep flag, or `{ deep, exclude, noIgnore }`
+ * @returns {string[]} Matching file paths
+ */
+const getAllFilesByExtensions = (dir, extensions, deepOrOptions) => {
+  const searchOptions = normalizeAnalyzerSearchOptions(deepOrOptions);
+  const files = getAllFiles(
+    searchOptions.deep,
+    dir,
+    undefined,
+    undefined,
+    undefined,
+    new RegExp(
+      `(?:${extensions.map((extension) => `\\${extension}`).join("|")})$`,
+    ),
+    dir,
+    searchOptions.exclude,
+    searchOptions.noIgnore,
+  );
+  const filesByExtension = extensions.map(() => []);
+  for (const file of files) {
+    const extensionIndex = extensions.findIndex((extension) =>
+      file.endsWith(extension),
+    );
+    if (extensionIndex !== -1) {
+      filesByExtension[extensionIndex].push(file);
+    }
+  }
+  return filesByExtension.flat();
+};
+
 const babelParserOptions = {
   sourceType: "unambiguous",
   allowImportExportEverywhere: true,
@@ -1752,37 +1802,29 @@ export const parseFileASTTreeCollected = (src, file) => {
   return { imports, exports };
 };
 
+const JS_TS_SOURCE_EXTENSIONS = [
+  ".js",
+  ".jsx",
+  ".cjs",
+  ".mjs",
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".vue",
+  ".svelte",
+];
+
 /**
- * Return paths to all (j|tsx?) files.
+ * Return paths to all JavaScript, TypeScript, Vue, and Svelte source files,
+ * found in one walk of the tree.
+ *
+ * @param {string} src Directory to walk
+ * @param {boolean|Object} deep Deep flag, or `{ deep, exclude, noIgnore }`
+ * @returns {string[]} Source file paths, grouped by extension
  */
 const getAllSrcJSAndTSFiles = (src, deep) =>
-  Promise.all(
-    [
-      ".js",
-      ".jsx",
-      ".cjs",
-      ".mjs",
-      ".ts",
-      ".tsx",
-      ".mts",
-      ".cts",
-      ".vue",
-      ".svelte",
-    ].map((extension) => {
-      const searchOptions = normalizeAnalyzerSearchOptions(deep);
-      return getAllFiles(
-        searchOptions.deep,
-        src,
-        extension,
-        undefined,
-        undefined,
-        undefined,
-        src,
-        searchOptions.exclude,
-        searchOptions.noIgnore,
-      );
-    }),
-  );
+  getAllFilesByExtensions(src, JS_TS_SOURCE_EXTENSIONS, deep);
 
 const getAngularWorkspaceManifestFiles = (
   dir,
@@ -2139,51 +2181,42 @@ const parseAngularStyleFiles = (
   excludePatterns,
   noIgnore = false,
 ) => {
-  for (const extension of ANGULAR_STYLE_FILE_EXTENSIONS) {
-    const styleFiles = getAllFiles(
-      deep,
-      src,
-      extension,
-      undefined,
-      undefined,
-      undefined,
-      src,
-      excludePatterns,
-      noIgnore,
-    );
-    for (const styleFile of styleFiles) {
-      let content;
-      try {
-        content = readFileSync(styleFile, "utf-8");
-      } catch {
-        continue;
-      }
-      for (const referencePattern of STYLE_PACKAGE_REFERENCE_PATTERNS) {
-        for (const match of content.matchAll(referencePattern)) {
-          const reference = match[1];
-          if (!reference) {
-            continue;
-          }
-          if (
-            match[0]?.trim().startsWith("url") &&
-            !isPackageStyleUrlReference(reference)
-          ) {
-            continue;
-          }
-          const prefix = content.slice(0, match.index || 0);
-          const lineNumber = prefix.split(/\r?\n/).length;
-          const lineStart = prefix.lastIndexOf("\n");
-          const columnNumber =
-            lineStart >= 0 ? prefix.length - lineStart - 1 : 0;
-          setAngularPackageRef(
-            allImports,
-            allExports,
-            src,
-            styleFile,
-            reference,
-            { column: columnNumber, line: lineNumber },
-          );
+  const styleFiles = getAllFilesByExtensions(
+    src,
+    ANGULAR_STYLE_FILE_EXTENSIONS,
+    { deep, exclude: excludePatterns, noIgnore },
+  );
+  for (const styleFile of styleFiles) {
+    let content;
+    try {
+      content = readFileSync(styleFile, "utf-8");
+    } catch {
+      continue;
+    }
+    for (const referencePattern of STYLE_PACKAGE_REFERENCE_PATTERNS) {
+      for (const match of content.matchAll(referencePattern)) {
+        const reference = match[1];
+        if (!reference) {
+          continue;
         }
+        if (
+          match[0]?.trim().startsWith("url") &&
+          !isPackageStyleUrlReference(reference)
+        ) {
+          continue;
+        }
+        const prefix = content.slice(0, match.index || 0);
+        const lineNumber = prefix.split(/\r?\n/).length;
+        const lineStart = prefix.lastIndexOf("\n");
+        const columnNumber = lineStart >= 0 ? prefix.length - lineStart - 1 : 0;
+        setAngularPackageRef(
+          allImports,
+          allExports,
+          src,
+          styleFile,
+          reference,
+          { column: columnNumber, line: lineNumber },
+        );
       }
     }
   }
@@ -3478,8 +3511,7 @@ export const findJSImportsExports = async (src, deep) => {
     // scope of astWorker.js. Absence is silent — tier 1 covers all scope
     // evidence.
     await primeSvelteParser();
-    const promiseMap = await getAllSrcJSAndTSFiles(src, deep);
-    const srcFiles = promiseMap.flat();
+    const srcFiles = getAllSrcJSAndTSFiles(src, deep);
     const tasks = srcFiles.map((file) => ({ src, file }));
     const parallelWorthwhile =
       totalSourceBytes(srcFiles) >= MIN_PARALLEL_PARSE_BYTES;
@@ -4580,8 +4612,7 @@ export const analyzeJsCryptoFile = (filePath) => {
 export const detectJsCryptoInventory = async (src, deep = false) => {
   let srcFiles = [];
   try {
-    const promiseMap = await getAllSrcJSAndTSFiles(src, deep);
-    srcFiles = promiseMap.flat();
+    srcFiles = getAllSrcJSAndTSFiles(src, deep);
   } catch {
     return { algorithms: [], libraries: [] };
   }
@@ -4626,31 +4657,7 @@ export const detectExtensionCapabilities = (src, deep = false) => {
   }
   let srcFiles = [];
   try {
-    const searchOptions = normalizeAnalyzerSearchOptions(deep);
-    srcFiles = [
-      ".js",
-      ".jsx",
-      ".cjs",
-      ".mjs",
-      ".ts",
-      ".tsx",
-      ".mts",
-      ".cts",
-      ".vue",
-      ".svelte",
-    ].flatMap((extension) =>
-      getAllFiles(
-        searchOptions.deep,
-        src,
-        extension,
-        undefined,
-        undefined,
-        undefined,
-        src,
-        searchOptions.exclude,
-        searchOptions.noIgnore,
-      ),
-    );
+    srcFiles = getAllSrcJSAndTSFiles(src, deep);
   } catch (_err) {
     return { capabilities: [], indicators: {} };
   }
@@ -5857,31 +5864,7 @@ export const detectMcpInventory = (src, deep = false) => {
   const servicesByKey = new Map();
   let srcFiles = [];
   try {
-    const searchOptions = normalizeAnalyzerSearchOptions(deep);
-    srcFiles = [
-      ".js",
-      ".jsx",
-      ".cjs",
-      ".mjs",
-      ".ts",
-      ".tsx",
-      ".mts",
-      ".cts",
-      ".vue",
-      ".svelte",
-    ].flatMap((extension) =>
-      getAllFiles(
-        searchOptions.deep,
-        src,
-        extension,
-        undefined,
-        undefined,
-        undefined,
-        src,
-        searchOptions.exclude,
-        searchOptions.noIgnore,
-      ),
-    );
+    srcFiles = getAllSrcJSAndTSFiles(src, deep);
   } catch {
     return { components: [], dependencies: [], services: [] };
   }

package/lib/inventory/atomUtils.js

@@ -6,7 +6,13 @@ import {
   statSync,
 } from "node:fs";
 import { tmpdir, totalmem } from "node:os";
-import { delimiter as _delimiter, dirname, join, resolve } from "node:path";
+import {
+  delimiter as _delimiter,
+  basename,
+  dirname,
+  join,
+  resolve,
+} from "node:path";
 import process from "node:process";
 
 import {
@@ -23,7 +29,9 @@ import {
 } from "../core/fs.js";
 import { TRACE_MODE } from "../core/logger.js";
 import { dirNameStr, isWin } from "../core/paths.js";
+import { formatDuration, reapProcessTree } from "../core/processTree.js";
 import { readJsonFile } from "../parsers/largeJson.js";
+import { cmakeBuildDirCandidates } from "./cmakeBuildDirs.js";
 
 const ASTGEN_DEFAULT_IGNORE_DIRS = [
   "venv",
@@ -83,9 +91,6 @@ const ATOM_C_LANGUAGES = new Set([
 
 const COMPILE_COMMANDS_FILE = "compile_commands.json";
 
-/** Build directories, under the scan root, searched for a compilation database. */
-const COMPILE_COMMANDS_BUILD_DIRS = ["build", "out", "builddir"];
-
 /**
  * Characters a Windows shell command line would interpret: `&`, `|`, `<` and
  * `>` chain or redirect commands, `%` expands variables even inside quotes,
@@ -117,9 +122,12 @@ function compileCommandsIn(dir) {
  * language its build uses.
  *
  * An explicit `options.compileCommands` (a file, or a directory holding one
- * directly or under `build/`) wins. Otherwise the scan root, `build/`, `out/`,
- * `builddir/`, `cmake-build-*` and the directory of `options.cmakeCache` are
- * searched. A database can come with the code it describes, and atom asks the
+ * directly or under `build/`) wins. Otherwise the scan root and the project's
+ * build directories are searched: the directory of `options.cmakeCache`, the
+ * build directories of its CMake presets, and the conventional `build`,
+ * `out`, `builddir` and `cmake-build-` directories (see
+ * `cmakeBuildDirCandidates`). A database can come with the code it describes,
+ * and atom asks the
  * GCC or Clang driver it names (from the PATH, or an absolute path outside
  * the project) for its predefined macros, so in secure mode only an explicit
  * database is used.
@@ -159,20 +167,7 @@ export function findCompileCommands(src, options = {}) {
   if (!rootIsDir) {
     return undefined;
   }
-  const dirs = [root, ...COMPILE_COMMANDS_BUILD_DIRS.map((d) => join(root, d))];
-  try {
-    dirs.push(
-      ...readdirSync(root, { withFileTypes: true })
-        .filter((e) => e.isDirectory() && e.name.startsWith("cmake-build-"))
-        .map((e) => join(root, e.name))
-        .sort(),
-    );
-  } catch (_err) {
-    // an unreadable root has no build directories to offer
-  }
-  if (options.cmakeCache) {
-    dirs.push(dirname(resolve(`${options.cmakeCache}`)));
-  }
+  const dirs = [root, ...cmakeBuildDirCandidates(root, options)];
   for (const dir of dirs) {
     const candidate = join(dir, COMPILE_COMMANDS_FILE);
     try {
@@ -751,18 +746,32 @@ export function buildAtomCommandEnv(options = {}, language = "") {
   // that does not exist on native platforms, and atom 3.0.x crashes parsing
   // that bogus value. Forward the resolved php-parse location through the env
   // so executeAtom can bypass the dispatcher for PHP (see
-  // resolveDirectAtomBinaryPath). Computed independently of exclude patterns.
+  // resolveDirectAtomBinaryPath). PHP_ASTGEN_BIN additionally names the
+  // batch-capable generator (phpastgen.js): chen parses the whole tree, vendor
+  // included, in one generator run instead of one php interpreter per file,
+  // which on windows is the difference between minutes and hours. Computed
+  // independently of exclude patterns.
   const phpParseBin = ATOM_PHP_LANGUAGES.has(normalizedLanguage)
     ? resolvePhpParseBin()
     : undefined;
+  const phpAstgenBin = ATOM_PHP_LANGUAGES.has(normalizedLanguage)
+    ? resolvePhpAstgenBin()
+    : undefined;
+  const phpEnv = {};
+  if (phpParseBin) {
+    phpEnv.PHP_PARSER_BIN = phpParseBin;
+  }
+  if (phpAstgenBin) {
+    phpEnv.PHP_ASTGEN_BIN = phpAstgenBin;
+  }
   if (!excludePatterns.length) {
-    return phpParseBin ? { PHP_PARSER_BIN: phpParseBin } : {};
+    return phpEnv;
   }
   const chenIgnoreDirs = mergeCsvValues(
     readEnvironmentVariable("CHEN_IGNORE_DIRS"),
     extractIgnoreDirsFromExcludePatterns(excludePatterns, true),
   );
-  const env = {};
+  const env = { ...phpEnv };
   if (chenIgnoreDirs) {
     env.CHEN_IGNORE_DIRS = chenIgnoreDirs;
   }
@@ -788,9 +797,6 @@ export function buildAtomCommandEnv(options = {}, language = "") {
       env.ASTGEN_IGNORE_FILE_PATTERN = astgenIgnoreFilePattern;
     }
   }
-  if (phpParseBin) {
-    env.PHP_PARSER_BIN = phpParseBin;
-  }
   return env;
 }
 
@@ -880,15 +886,19 @@ export function resolveAtomProvider(opts = {}) {
  * ceiling differently, and a native-image runtime option on a jar run reaches
  * atom as an unknown argument that fails every slice. So the kind follows what
  * is installed where cdxgen can see it: the native binary means native, the jar
- * package without it means jar. With neither in view (a custom `ATOM_CMD`, an
- * install elsewhere) the platform's kind stands.
+ * package without it means jar. An `ATOM_CMD` is classified by what it names
+ * (see `atomCommandKind`). With nothing in view (an install elsewhere) the
+ * platform's kind stands.
  *
  * Also used to gate Java/JDK advice, so users on the five native platforms are
  * not told to install a JDK for a failure that has nothing to do with Java.
  */
 export function atomProviderKind() {
   const { kind } = resolveAtomProvider();
-  if (kind !== "native" || readEnvironmentVariable("ATOM_CMD")) {
+  if (readEnvironmentVariable("ATOM_CMD")) {
+    return atomCommandKind(readEnvironmentVariable("ATOM_CMD"), kind);
+  }
+  if (kind !== "native") {
     return kind;
   }
   const atomHome = readEnvironmentVariable("ATOM_HOME");
@@ -906,13 +916,64 @@ export function atomProviderKind() {
   return jarPlugins ? "jar" : kind;
 }
 
+/**
+ * Whether `ATOM_CMD` launches a jar or follows the platform.
+ *
+ * The jar launchers (`plugins/bin/atom`, `plugins/bin/atom.bat`) sit next to a
+ * `plugins/lib` directory holding atom's jars, so a launcher with that sibling,
+ * or any `.bat` (only the jar payload ships one), runs on the JVM whatever the
+ * platform is. Everything else, including the npm dispatcher (`node
+ * .../index.js`, its `atom`/`atom.cmd` bin shims) and a native binary, follows
+ * the platform's kind. A GraalVM `-XX:` heap argument handed to a jar launcher
+ * is rejected by atom's option parser before any analysis starts, and a
+ * `JAVA_TOOL_OPTIONS` ceiling handed to a native image is silently ignored, so
+ * the distinction decides whether the heap is bounded at all.
+ *
+ * @param {string} command The `ATOM_CMD` value
+ * @param {"native"|"jar"} platformKind Kind the platform prefers
+ * @returns {"native"|"jar"}
+ */
+export function atomCommandKind(command, platformKind) {
+  const [bin, leadingArg] = splitAtomCommand(command);
+  const runsScript =
+    leadingArg !== undefined && /^node(\.exe)?$/i.test(basename(bin));
+  let launcher = runsScript ? leadingArg : bin;
+  if (/\.bat$/i.test(launcher)) {
+    return "jar";
+  }
+  try {
+    // npm bin entries are symlinks into the package (`/usr/local/bin/atom` ->
+    // `.../@appthreat/atom/index.js`), and `/usr/local` has a `lib` of its own.
+    launcher = realpathSync(launcher);
+  } catch {
+    return platformKind;
+  }
+  const binDir = dirname(launcher);
+  if (basename(binDir) !== "bin") {
+    return platformKind;
+  }
+  try {
+    const libDir = join(dirname(binDir), "lib");
+    if (
+      readdirSync(libDir).some(
+        (file) => file.startsWith("io.appthreat.atom") && file.endsWith(".jar"),
+      )
+    ) {
+      return "jar";
+    }
+  } catch {
+    // no lib directory: not a jar layout
+  }
+  return platformKind;
+}
+
 /**
  * Locate the `php-parse` binary that the PHP frontend needs.
  *
  * atom 3's dispatcher unconditionally sets `PHP_PARSER_BIN=<ATOM_HOME>/bin/php-parse`,
  * which for a native sub-package does not exist and also clobbers a caller-set
- * value. cdxgen therefore resolves the real location and forwards it through
- * the child env (see `buildAtomCommandEnv`); `executeAtom` then spawns the
+ * value. cdxgen therefore resolves the real location and forwards it through the
+ * child env (see `buildAtomCommandEnv`); `executeAtom` then spawns the
  * native binary directly for PHP so the dispatcher cannot clobber it (see
  * `resolveDirectAtomBinaryPath`). Resolution order:
  *   1. explicit `PHP_PARSER_BIN` env var (operators / container images)
@@ -929,6 +990,44 @@ export function resolvePhpParseBin() {
   if (readEnvironmentVariable("PHP_PARSER_BIN")) {
     return readEnvironmentVariable("PHP_PARSER_BIN");
   }
+  return parsetoolsFile("plugins", "bin", "php-parse");
+}
+
+/**
+ * Locate the `phpastgen` generator that lets the PHP frontend parse whole
+ * directories in one batch.
+ *
+ * `php-parse` (forwarded as `PHP_PARSER_BIN`) is the per-file parser: atom
+ * starts a php interpreter for every `.php` file, which on windows turns a
+ * vendored PHP project (thousands of files under `vendor/`) into an hours-long
+ * run that no timeout can rescue. `phpastgen` answers the `--parser-info`
+ * capability probe, so atom's batch path engages, and atom-parsetools 1.9 and
+ * later parse the whole tree, vendor included, with a few interpreters that
+ * each take a chunk of files. It is a Node script, so the frontend launches it
+ * with `node` rather than `php`; an atom that does not know `PHP_ASTGEN_BIN`
+ * simply ignores it and keeps today's per-file behaviour. Resolution order:
+ *   1. explicit `PHP_ASTGEN_BIN` env var (operators / container images)
+ *   2. `@appthreat/atom-parsetools/phpastgen.js` under cdxgen's own
+ *      node_modules, then under `GLOBAL_NODE_MODULES_PATH` for global installs
+ *
+ * @returns {string|undefined}
+ */
+export function resolvePhpAstgenBin() {
+  if (readEnvironmentVariable("PHP_ASTGEN_BIN")) {
+    return readEnvironmentVariable("PHP_ASTGEN_BIN");
+  }
+  return parsetoolsFile("phpastgen.js");
+}
+
+/**
+ * Resolve a file inside the installed `@appthreat/atom-parsetools` package,
+ * searching cdxgen's own node_modules and `GLOBAL_NODE_MODULES_PATH` for global
+ * installs.
+ *
+ * @param {...string} segments Path segments below the package root
+ * @returns {string|undefined}
+ */
+export function parsetoolsFile(...segments) {
   const roots = [dirNameStr];
   if (readEnvironmentVariable("GLOBAL_NODE_MODULES_PATH")) {
     roots.push(dirname(readEnvironmentVariable("GLOBAL_NODE_MODULES_PATH")));
@@ -939,9 +1038,7 @@ export function resolvePhpParseBin() {
       "node_modules",
       "@appthreat",
       "atom-parsetools",
-      "plugins",
-      "bin",
-      "php-parse",
+      ...segments,
     );
     if (safeExistsSync(candidate)) {
       return candidate;
@@ -1213,25 +1310,41 @@ export function atomTimeouts() {
   };
 }
 
-function formatDuration(ms) {
-  if (ms >= 60_000) {
-    const minutes = Math.round(ms / 6_000) / 10;
-    return `${minutes} minute${minutes === 1 ? "" : "s"}`;
-  }
-  return `${Math.round(ms / 100) / 10} seconds`;
-}
-
 // The status the atom dispatcher exits with when ATOM_TIMEOUT stops atom.
 const ATOM_TIMEOUT_EXIT_CODE = 124;
 
+/**
+ * Reap everything a timed-out atom run left behind on Windows.
+ *
+ * cdxgen starts atom through a shell there (`shell: isWin`), so the spawn
+ * timeout terminates only that `cmd.exe`, and the runtime and every parser
+ * worker under it (one `php.exe` per file for the per-file PHP frontend) keep
+ * running against the next slice of the same run. See
+ * {@link reapProcessTree} for how they are found. A chain broken by an
+ * intermediate that already exited (the npm dispatcher stopping its runtime
+ * itself) cannot be followed, and atom 4 stops its helpers once
+ * `ATOM_PARENT_PID` is gone.
+ *
+ * @param {number|undefined} rootPid pid of the process cdxgen spawned
+ * @param {number} startedAt Epoch milliseconds at which the run started
+ * @param {number} [endedAt] Epoch milliseconds at which the spawned process ended
+ * @returns {number[]} The pids that were stopped
+ */
+export function reapAtomProcessTree(rootPid, startedAt, endedAt = Date.now()) {
+  return reapProcessTree(rootPid, startedAt, endedAt, "atom");
+}
+
 /**
  * Whether an atom run ended because it ran out of time.
  *
  * The dispatcher reports its own limit with status 124. cdxgen's spawn timeout
  * shows up as `ETIMEDOUT`. A dispatcher older than the status code stops atom
- * with SIGTERM and exits 1, so status 1 at or past the limit counts as well,
- * unless atom's own output shows it failed for another reason first (an
- * exhausted heap, a crash), which deserves its own diagnosis.
+ * with SIGTERM and passes on how the runtime ended: 1, or the runtime's own
+ * exit on SIGTERM (143) or SIGKILL (137), which is what atom 3.1 reports. Those
+ * statuses at or past the limit count as well, unless atom's own output shows
+ * it failed for another reason first (an exhausted heap, a crash), which
+ * deserves its own diagnosis. Missing one leaves the half-written atom behind,
+ * and the next slice of the run fails to load it.
  *
  * @param {Object} result spawnSync result
  * @param {number} elapsedMs How long the run took
@@ -1245,13 +1358,21 @@ export function atomRunTimedOut(result, elapsedMs, atomTimeoutMs) {
   if (result?.error?.code === "ETIMEDOUT") {
     return true;
   }
-  if (result?.status !== 1 || elapsedMs < atomTimeoutMs) {
+  if (
+    !ATOM_STOPPED_STATUSES.includes(result?.status) ||
+    elapsedMs < atomTimeoutMs
+  ) {
     return false;
   }
   const output = `${result.stdout || ""}\n${result.stderr || ""}`;
   return !ATOM_FAILURE_MARKERS.some((marker) => output.includes(marker));
 }
 
+// How a runtime stopped by an older dispatcher at ATOM_TIMEOUT exits: the
+// dispatcher's own 1, or the runtime's exit on SIGTERM (128 + 15) or SIGKILL
+// (128 + 9) passed through.
+const ATOM_STOPPED_STATUSES = [1, 137, 143];
+
 // Output that means atom failed by itself, whatever the clock says.
 const ATOM_FAILURE_MARKERS = [
   "OutOfMemoryError",
@@ -1350,10 +1471,12 @@ export function executeAtom(src, args, extra_env = {}) {
     env,
     timeout: spawnTimeoutMs,
   });
-  if (atomRunTimedOut(result, Date.now() - startedAt, atomTimeoutMs)) {
+  const endedAt = Date.now();
+  if (atomRunTimedOut(result, endedAt - startedAt, atomTimeoutMs)) {
     console.warn(
       `WARN: atom did not finish within ${formatDuration(atomTimeoutMs)} and was stopped, so its results are missing or incomplete. Allow more time with ATOM_TIMEOUT (milliseconds, atom only) or CDXGEN_TIMEOUT_MS (every external command).`,
     );
+    reapAtomProcessTree(result.pid, startedAt, endedAt);
     // A stopped atom leaves its graph half written, and the next slice of the
     // same run would try to reuse it and fail to load it.
     const atomFileIndex = args.indexOf("-o");

package/lib/inventory/auditCategories.js

@@ -23,6 +23,12 @@ export const GOLEM_AUDIT_CATEGORIES = Object.freeze([
   "golem-compliance",
 ]);
 
+/** Frozen list of Scala Evinse (scalasem) audit categories. */
+export const SCALA_AUDIT_CATEGORIES = Object.freeze([
+  "scala-security",
+  "scala-compliance",
+]);
+
 /** Frozen list of Cargo (Rust) audit categories. */
 export const CARGO_AUDIT_CATEGORIES = Object.freeze([
   "cargo-security",
@@ -64,6 +70,7 @@ export const BOM_AUDIT_CATEGORY_ALIASES = Object.freeze({
   golem: [...GOLEM_AUDIT_CATEGORIES],
   hbom: [...HBOM_AUDIT_CATEGORIES],
   rust: [...CARGO_AUDIT_CATEGORIES],
+  scala: [...SCALA_AUDIT_CATEGORIES],
   host: [...HBOM_AUDIT_CATEGORIES, ...HOST_TOPOLOGY_AUDIT_CATEGORIES],
 });