@cdxgen/cdxgen 13.3.0 → 13.4.0

package/lib/inventory/mcpConfigParser.js

@@ -1,12 +1,11 @@
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 
-import * as toml from "smol-toml";
-
 import {
   sanitizeBomPropertyValue,
   sanitizeBomUrl,
 } from "../core/propertySanitizer.js";
+import { parseToml } from "../core/toml.js";
 import { parseJsonLike } from "./jsonLike.js";
 import { classifyMcpReference } from "./mcp.js";
 import {
@@ -813,7 +812,7 @@ export const mcpConfigParser = {
       let configJson;
       try {
         configJson = filePath.toLowerCase().endsWith(".toml")
-          ? toml.parse(raw)
+          ? parseToml(raw)
           : parseJsonLike(raw);
       } catch {
         continue;

package/lib/inventory/parentSelection.js

@@ -0,0 +1,146 @@
+/**
+ * Which detected project becomes the parent (`metadata.component`) when one
+ * scan covers several ecosystems and no parent was given.
+ *
+ * Each ecosystem detects its own project from its own manifest. The project
+ * whose manifest sits at the scan root describes the repository; one found
+ * deeper is a part of it (a web client in `tools/ui/`, a helper script's
+ * `pyproject.toml`). So candidates are ordered by how deep their ecosystem's
+ * manifests sit, the scan root first, and ties keep the ecosystem order the
+ * scan ran in.
+ */
+
+import { readdirSync } from "node:fs";
+import { dirname, relative, resolve, sep } from "node:path";
+
+import { getAllFiles } from "../core/fs.js";
+
+/**
+ * Manifest file names (or `*.ext` suffixes) per purl type: the files a
+ * project of that ecosystem is described by.
+ */
+const MANIFESTS_BY_PURL_TYPE = {
+  npm: ["package.json"],
+  pypi: [
+    "pyproject.toml",
+    "setup.py",
+    "setup.cfg",
+    "Pipfile",
+    "requirements.txt",
+    "uv.lock",
+    "poetry.lock",
+    "pixi.toml",
+  ],
+  generic: [
+    "CMakeLists.txt",
+    "meson.build",
+    "conanfile.txt",
+    "conanfile.py",
+    "vcpkg.json",
+    "xmake.lua",
+  ],
+  maven: ["pom.xml", "build.gradle", "build.gradle.kts", "build.sbt"],
+  golang: ["go.mod"],
+  cargo: ["Cargo.toml"],
+  composer: ["composer.json"],
+  gem: ["Gemfile", "*.gemspec"],
+  nuget: ["*.csproj", "*.fsproj", "*.vbproj", "*.sln", "packages.config"],
+  pub: ["pubspec.yaml"],
+  hex: ["mix.exs"],
+  hackage: ["*.cabal", "stack.yaml"],
+  swift: ["Package.swift"],
+  cocoapods: ["Podfile"],
+  clojars: ["deps.edn", "project.clj"],
+};
+
+/** The purl type of a component, or `undefined`. */
+function purlTypeOf(component) {
+  const purl = `${component?.purl || ""}`;
+  if (!purl.startsWith("pkg:")) {
+    return undefined;
+  }
+  const rest = purl.slice(4);
+  const end = rest.search(/[/@?#]/);
+  return (end < 0 ? rest : rest.slice(0, end)).toLowerCase();
+}
+
+function matchesManifest(name, patterns) {
+  return patterns.some((p) =>
+    p.startsWith("*.") ? name.endsWith(p.slice(1)) : name === p,
+  );
+}
+
+/**
+ * How deep the shallowest manifest of an ecosystem sits under a scan root:
+ * 0 for one at the root itself, `Infinity` when there is none (or the
+ * ecosystem is not one this module knows).
+ *
+ * @param {string} root Scan root
+ * @param {string} purlType Purl type of the ecosystem
+ * @param {Object} options CLI options (exclusions)
+ * @returns {number}
+ */
+export function manifestDepth(root, purlType, options = {}) {
+  const patterns = MANIFESTS_BY_PURL_TYPE[purlType];
+  if (!patterns || !root) {
+    return Number.POSITIVE_INFINITY;
+  }
+  const absRoot = resolve(root);
+  try {
+    if (readdirSync(absRoot).some((name) => matchesManifest(name, patterns))) {
+      return 0;
+    }
+  } catch (_err) {
+    return Number.POSITIVE_INFINITY;
+  }
+  const glob =
+    patterns.length === 1 ? `**/${patterns[0]}` : `**/{${patterns.join(",")}}`;
+  const files = getAllFiles(absRoot, glob, options);
+  let depth = Number.POSITIVE_INFINITY;
+  for (const f of files) {
+    const rel = relative(absRoot, dirname(resolve(f)));
+    if (!rel || rel.startsWith("..")) {
+      continue;
+    }
+    depth = Math.min(depth, rel.split(sep).length);
+  }
+  return depth;
+}
+
+/**
+ * Order parent candidates by the depth of their ecosystem's manifests under
+ * the scan roots (the shallowest first). The sort is stable, so candidates of
+ * equal depth keep the order the ecosystems were scanned in.
+ *
+ * @param {Object[]} candidates Detected parent components, in scan order
+ * @param {string[]} roots Scan roots
+ * @param {Object} options CLI options
+ * @returns {Object[]} The candidates, reordered
+ */
+export function orderParentCandidates(candidates, roots, options = {}) {
+  const depthByType = new Map();
+  const depthOf = (component) => {
+    const type = purlTypeOf(component);
+    if (!type) {
+      return Number.POSITIVE_INFINITY;
+    }
+    if (!depthByType.has(type)) {
+      depthByType.set(
+        type,
+        Math.min(
+          Number.POSITIVE_INFINITY,
+          ...(roots || []).map((r) => manifestDepth(r, type, options)),
+        ),
+      );
+    }
+    return depthByType.get(type);
+  };
+  return candidates
+    .map((component, index) => ({
+      component,
+      index,
+      depth: depthOf(component),
+    }))
+    .sort((a, b) => a.depth - b.depth || a.index - b.index)
+    .map((c) => c.component);
+}

package/lib/inventory/rustFormulationParser.js

@@ -1,9 +1,8 @@
 import { readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 
-import * as toml from "smol-toml";
-
 import { safeExistsSync } from "../core/fs.js";
+import { parseToml } from "../core/toml.js";
 
 // Keep this list conservative and high-signal: it is meant to surface common
 // Rust native build helpers for audit triage, not to exhaustively model every
@@ -67,7 +66,7 @@ function createFormulationComponent(name, filePath, toolName) {
 function parseCargoManifest(filePath) {
   let cargoData;
   try {
-    cargoData = toml.parse(readFileSync(filePath, { encoding: "utf-8" }));
+    cargoData = parseToml(readFileSync(filePath, { encoding: "utf-8" }));
   } catch {
     return undefined;
   }
@@ -252,7 +251,7 @@ function parseCargoManifest(filePath) {
 function parsePyProject(filePath) {
   let pyprojectData;
   try {
-    pyprojectData = toml.parse(readFileSync(filePath, { encoding: "utf-8" }));
+    pyprojectData = parseToml(readFileSync(filePath, { encoding: "utf-8" }));
   } catch {
     return undefined;
   }

package/lib/inventory/scalaCoords.js

@@ -0,0 +1,153 @@
+import { Purl } from "@cdxgen/cdx-purl";
+
+// Scala libraries publish their Maven artifacts with a trailing Scala binary
+// version suffix (`jwt-core_3`, `coursier_2.13`), optionally preceded by a
+// platform suffix for Scala.js and Scala Native builds (`upickle_sjs1_3`,
+// `upickle_native0.5_3`). sbt components strip the binary suffix and keep the
+// platform suffix (`jwt-core`, `upickle_sjs1`), so the same library is named
+// differently depending on the build tool that reported it.
+const SCALA_BINARY_SUFFIX_REGEX = /_(2\.\d+|3)$/;
+const SCALA_PLATFORM_SUFFIX_REGEX = /_(sjs1|sjs0\.6|native0\.\d+)$/;
+
+/**
+ * Parse a Scala-published Maven artifact name into its coordinate parts.
+ *
+ * @param {string} name Maven artifactId, for example `upickle_sjs1_3`
+ * @returns {{ originalName: string, artifactBase: string, binaryVersion: string|null,
+ *   platformSuffix: string, purlName: string }} The artifact name without any
+ *   Scala suffix (`upickle`), the Scala binary version from the suffix (`3`),
+ *   the platform suffix including the underscore (`_sjs1`) or an empty string,
+ *   and the artifact name sbt-style purls emit (binary suffix dropped, platform
+ *   suffix kept).
+ */
+export function parseScalaArtifact(name) {
+  const result = {
+    originalName: name,
+    artifactBase: name,
+    binaryVersion: null,
+    platformSuffix: "",
+    purlName: name,
+  };
+  if (!name) {
+    return result;
+  }
+  let rest = name;
+  const binaryMatch = rest.match(SCALA_BINARY_SUFFIX_REGEX);
+  if (binaryMatch) {
+    result.binaryVersion = binaryMatch[1];
+    rest = rest.slice(0, rest.length - binaryMatch[0].length);
+  }
+  const platformMatch = rest.match(SCALA_PLATFORM_SUFFIX_REGEX);
+  if (platformMatch) {
+    result.platformSuffix = platformMatch[0];
+    rest = rest.slice(0, rest.length - platformMatch[0].length);
+  }
+  result.artifactBase = rest;
+  result.purlName = binaryMatch ? `${rest}${result.platformSuffix}` : name;
+  return result;
+}
+
+/**
+ * Build a qualifier-free coordinate key for a Scala-published artifact.
+ *
+ * The key ignores purl qualifiers such as `repository_url` and `type`, so the
+ * POM-coordinate keys of the jar namespace mapping and the sbt-style purls of
+ * the components resolve to the same entry.
+ *
+ * @param {Object} parts Coordinate parts
+ * @param {string} [parts.type] Purl type, defaults to `maven`
+ * @param {string} [parts.group] Maven groupId
+ * @param {string} parts.artifactBase Artifact name without any Scala suffix
+ * @param {string} [parts.platformSuffix] `_sjs1`, `_native0.5` or empty
+ * @param {string} [parts.version] Package version
+ * @returns {string} The coordinate key
+ */
+export function scalaCoordinateKey({
+  type = "maven",
+  group = "",
+  artifactBase = "",
+  platformSuffix = "",
+  version = "",
+} = {}) {
+  return [type, group, artifactBase, platformSuffix, version].join(":");
+}
+
+/**
+ * Build the qualifier-free coordinate key of a purl string.
+ *
+ * The artifact name is normalized with {@link parseScalaArtifact}, so
+ * `pkg:maven/g/foo_3@1.0` and the sbt-style `pkg:maven/g/foo@1.0` share a key,
+ * while the Scala.js build `foo_sjs1_3` keeps its own key (`foo` plus the
+ * `_sjs1` platform suffix) and never joins the plain `foo` component.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {string|undefined} The coordinate key, or undefined when the string
+ *   is not a parseable purl
+ */
+export function coordinateKeyFromPurl(purlString) {
+  return scalaCoordinateOfPurl(purlString)?.key;
+}
+
+/**
+ * The coordinate key of a purl together with the Scala binary version its
+ * artifact name carries, if any.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {{ key: string, binaryVersion: string|null }|undefined} The key
+ *   and binary version, or undefined when the string is not a parseable purl
+ */
+export function scalaCoordinateOfPurl(purlString) {
+  if (!purlString?.startsWith("pkg:")) {
+    return undefined;
+  }
+  let purlObj;
+  try {
+    purlObj = Purl.parse(purlString);
+  } catch (_err) {
+    return undefined;
+  }
+  if (!purlObj?.name) {
+    return undefined;
+  }
+  const scalaInfo = parseScalaArtifact(purlObj.name);
+  return {
+    key: scalaCoordinateKey({
+      type: purlObj.type,
+      group: purlObj.namespace || "",
+      artifactBase: scalaInfo.artifactBase,
+      platformSuffix: scalaInfo.platformSuffix,
+      version: purlObj.version || "",
+    }),
+    binaryVersion: scalaInfo.binaryVersion,
+  };
+}
+
+// An artifact name that already ends in a full Scala version, as scala-cli
+// `:::` and sbt `CrossVersion.full` artifacts do (`_3.3.7`, `_2.13.16`). A
+// binary suffix such as `_3` left on a name is part of the name: the
+// component producers strip exactly one, into the compiler version.
+const SCALA_FULL_VERSION_SUFFIX_REGEX = /_\d+\.\d+\.\d+(?:-[A-Za-z0-9.]+)?$/;
+
+/**
+ * The artifactId the library is published under, for cache and repository
+ * lookups only. Components a Scala build tool reports carry the name with the
+ * Scala binary suffix stripped (the platform suffix kept) together with
+ * `cdx:scala:compilerVersion`; on disk and in the repository the artifact is
+ * `cats-core_2.13` or `upickle_sjs1_3`. Names that end in a full Scala version
+ * are used as they are.
+ *
+ * The component's own `name`, `purl` and `bom-ref` never change.
+ *
+ * @param {Object} pkg Package with `name` and `properties`.
+ * @returns {string} The artifactId to look up.
+ */
+export function publishedArtifactId(pkg) {
+  const name = pkg?.name;
+  if (!name || SCALA_FULL_VERSION_SUFFIX_REGEX.test(name)) {
+    return name;
+  }
+  const binaryVersion = (pkg.properties || []).find(
+    (property) => property.name === "cdx:scala:compilerVersion",
+  )?.value;
+  return binaryVersion ? `${name}_${binaryVersion}` : name;
+}

package/lib/inventory/source.js

@@ -7,7 +7,6 @@ import { Purl } from "@cdxgen/cdx-purl";
 import { coerce, diff, prerelease } from "semver";
 
 import {
-  cdxgenAgent,
   createDryRunError,
   DEBUG_MODE,
   hasDangerousUnicode,
@@ -24,11 +23,12 @@ import {
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { isValidDriveRoot, isWin } from "../core/paths.js";
+import { registerRunReset } from "../core/runState.js";
 import {
+  gatedGet,
   prefetchEnabled,
   prefetchedResponse,
   prefetchJson,
-  withHostRateLimit,
 } from "./fetchBatch.js";
 import { canonicalPurlFromLooseString } from "./purl.js";
 
@@ -1165,6 +1165,8 @@ export function resetGitUrlSourcePrefetch() {
   gitUrlSourcePrefetch = new Map();
 }
 
+registerRunReset("source:registry-documents", resetGitUrlSourcePrefetch);
+
 /**
  * Prefetch the registry documents a list of purls will be resolved from.
  *
@@ -1218,12 +1220,10 @@ async function fetchRegistryDocument(lookup) {
   // whose policy is one request per second however the request was reached.
   return (
     prefetchedResponse(gitUrlSourcePrefetch, lookup.url) ||
-    (await withHostRateLimit(lookup.url, () =>
-      cdxgenAgent.get(lookup.url, {
-        ...(lookup.accept ? { headers: { Accept: lookup.accept } } : {}),
-        responseType: "json",
-      }),
-    ))
+    (await gatedGet(lookup.url, {
+      ...(lookup.accept ? { headers: { Accept: lookup.accept } } : {}),
+      responseType: "json",
+    }))
   );
 }
 

package/lib/inventory/spdx.js

@@ -343,12 +343,113 @@ export function findLicenseId(name) {
     : name;
 }
 
+/**
+ * Identify a license from the title and opening of its full text. A license
+ * text quotes other licenses (the GNU GPL's text names the GNU Lesser GPL),
+ * so the substring scan of `guessLicenseId` alone can name the wrong one.
+ *
+ * @param {string} content License file contents
+ * @returns {string|undefined} SPDX license id or expression
+ */
+export function licenseIdFromText(content) {
+  if (typeof content !== "string" || !content.trim()) {
+    return undefined;
+  }
+  const head = content.slice(0, 4000).replace(/\s+/g, " ").trim().toUpperCase();
+  const version = (prefix) => {
+    const at = head.indexOf(prefix);
+    if (at < 0) {
+      return undefined;
+    }
+    const tail = head.slice(at + prefix.length, at + prefix.length + 60);
+    const match = tail.match(/VERSION (\d(?:\.\d)?)/);
+    return match?.[1];
+  };
+  // the first lines name the license; quotations of others come later, so
+  // of the GNU licenses the one named first is the one the text is
+  const title = head.slice(0, 200);
+  const gnu = [
+    ["GNU AFFERO GENERAL PUBLIC LICENSE", { 3: "AGPL-3.0-only" }],
+    [
+      "GNU LESSER GENERAL PUBLIC LICENSE",
+      { 3: "LGPL-3.0-only", 2.1: "LGPL-2.1-only", 2: "LGPL-2.0-only" },
+    ],
+    [
+      "GNU LIBRARY GENERAL PUBLIC LICENSE",
+      { 2.1: "LGPL-2.1-only", 2: "LGPL-2.0-only" },
+    ],
+    [
+      "GNU GENERAL PUBLIC LICENSE",
+      { 3: "GPL-3.0-only", 2: "GPL-2.0-only", 1: "GPL-1.0-only" },
+    ],
+  ]
+    .map(([name, ids]) => ({ name, ids, at: title.indexOf(name) }))
+    .filter((t) => t.at >= 0)
+    .sort((a, b) => a.at - b.at)[0];
+  if (gnu) {
+    return gnu.ids[version(gnu.name)];
+  }
+  if (head.includes("APACHE LICENSE") && head.includes("VERSION 2.0")) {
+    return head.includes("LLVM EXCEPTION")
+      ? "Apache-2.0 WITH LLVM-exception"
+      : "Apache-2.0";
+  }
+  if (
+    title.includes("MOZILLA PUBLIC LICENSE") &&
+    head.includes("VERSION 2.0")
+  ) {
+    return "MPL-2.0";
+  }
+  if (title.includes("BOOST SOFTWARE LICENSE - VERSION 1.0")) {
+    return "BSL-1.0";
+  }
+  if (
+    head.includes(
+      "THIS IS FREE AND UNENCUMBERED SOFTWARE RELEASED INTO THE PUBLIC DOMAIN",
+    )
+  ) {
+    return "Unlicense";
+  }
+  if (head.includes("PERMISSION IS HEREBY GRANTED, FREE OF CHARGE")) {
+    return "MIT";
+  }
+  if (
+    head.includes(
+      "PERMISSION TO USE, COPY, MODIFY, AND/OR DISTRIBUTE THIS SOFTWARE FOR ANY PURPOSE WITH OR WITHOUT FEE IS HEREBY GRANTED",
+    )
+  ) {
+    return "ISC";
+  }
+  if (
+    head.includes("THIS SOFTWARE IS PROVIDED 'AS-IS'") &&
+    head.includes(
+      "PERMISSION IS GRANTED TO ANYONE TO USE THIS SOFTWARE FOR ANY PURPOSE",
+    )
+  ) {
+    return "Zlib";
+  }
+  if (head.includes("REDISTRIBUTION AND USE IN SOURCE AND BINARY FORMS")) {
+    if (head.includes("ALL ADVERTISING MATERIALS MENTIONING")) {
+      return "BSD-4-Clause";
+    }
+    return head.includes("NEITHER THE NAME") ||
+      head.includes("THE NAME OF THE AUTHOR MAY NOT BE USED")
+      ? "BSD-3-Clause"
+      : "BSD-2-Clause";
+  }
+  return undefined;
+}
+
 /**
  * Method to guess the spdx license id from license contents
  *
  * @param {string} content License file contents
  */
 export function guessLicenseId(content) {
+  const fromText = licenseIdFromText(content);
+  if (fromText) {
+    return fromText;
+  }
   content = content.replace(/\n/g, " ");
   for (const l of licenseMapping) {
     for (const j in l.names) {

package/lib/inventory/traceRunner.js

@@ -77,6 +77,7 @@ export function parseCommand(cmdStr) {
 export function resolveSaferExecBinary() {
   const currentPlatform = platform();
   const currentArch = arch();
+  const isWindows = currentPlatform === "win32";
   let pkgName = "";
 
   if (currentPlatform === "darwin") {
@@ -91,6 +92,14 @@ export function resolveSaferExecBinary() {
     } else if (currentArch === "arm64") {
       pkgName = "@cdxgen/safer-exec-linux-arm64";
     }
+  } else if (isWindows) {
+    // The Windows packages ship the MXC executor (wxc-exec.exe) next to the
+    // engine, which is where the engine looks for it.
+    if (currentArch === "x64") {
+      pkgName = "@cdxgen/safer-exec-windows-amd64";
+    } else if (currentArch === "arm64") {
+      pkgName = "@cdxgen/safer-exec-windows-arm64";
+    }
   }
 
   if (!pkgName) {
@@ -117,9 +126,14 @@ export function resolveSaferExecBinary() {
 
     for (const modulesDir of searchDirs) {
       // Direct structure under node_modules. The Go runtime inside the
-      // platform package is bin/safer-exec-rt; "safer-exec" is the JS
+      // platform package is bin/safer-exec-rt(.exe); "safer-exec" is the JS
       // dispatcher's npm bin name, not a file on disk.
-      const directPath = join(modulesDir, pkgName, "bin", "safer-exec-rt");
+      const directPath = join(
+        modulesDir,
+        pkgName,
+        "bin",
+        isWindows ? "safer-exec-rt.exe" : "safer-exec-rt",
+      );
       let realDirectPath;
       try {
         realDirectPath = realpathSync(directPath);
@@ -127,10 +141,12 @@ export function resolveSaferExecBinary() {
         realDirectPath = directPath;
       }
       if (existsSync(realDirectPath)) {
-        try {
-          chmodSync(realDirectPath, 0o755);
-        } catch (_err) {
-          // ignore
+        if (!isWindows) {
+          try {
+            chmodSync(realDirectPath, 0o755);
+          } catch (_err) {
+            // ignore
+          }
         }
         return realDirectPath;
       }
@@ -252,6 +268,14 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
     if (options.dryRun) {
       exec.enableDryRun();
     }
+    if (platform() === "win32" && options.blockInterpreters) {
+      // safer-exec reports --private-tmp and --protect-home on Windows when a
+      // grant defeats them, but --block-interpreters is macOS-only and stays
+      // silent (cdxgen/safer-exec#4).
+      console.warn(
+        "[cdxgen trace] --block-interpreters has no effect on Windows.",
+      );
+    }
     if (options.blockInterpreters) {
       exec.blockInterpreters();
     }
@@ -376,8 +400,41 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
 
     const result = await exec.run(cmd, args);
     const stderr = result?.stderr || "";
+    const { warnings, error: engineError } = engineMessages(stderr);
+    // Windows records DLL loads through an ETW session, which only an
+    // elevated process (or a Performance Log Users member) may start.
+    const etwDenied =
+      platform() === "win32" &&
+      warnings.some(
+        (line) =>
+          line.includes("DLL tracing:") &&
+          line.includes("administrator rights"),
+      );
+    // run() captures the engine's stderr, so a control the sandbox could not
+    // apply would otherwise read like one it did.
+    for (const line of warnings) {
+      if (etwDenied && line.includes("DLL tracing:")) {
+        continue;
+      }
+      console.warn(line);
+    }
+    if (etwDenied) {
+      console.warn(
+        "[cdxgen trace] library tracing on Windows needs an elevated prompt (or membership in the Performance Log Users group); the BOM has no library components. Egress services from --proxy-egress are still recorded.",
+      );
+    }
     if (result && result.exitCode !== 0) {
-      if (stderr.includes("[safer-exec] Error:")) {
+      if (engineError) {
+        console.error(engineError);
+        if (options.strict) {
+          // Under --strict the sandbox refused the run; an empty BOM would
+          // read as a command that loaded nothing.
+          throw Object.assign(
+            new Error(`Tracing refused under --strict: ${engineError}`),
+            { strictRefusal: true },
+          );
+        }
+      } else if (stderr.includes("[safer-exec] Error:")) {
         console.error("Tracing launcher execution failed:", stderr.trim());
       } else {
         // A failing command usually means a partial trace (for example a
@@ -488,11 +545,35 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
       dryRunSummary,
     };
   } catch (err) {
+    if (err?.strictRefusal) {
+      throw err;
+    }
     console.error("Tracing command execution failed:", err);
   }
   return emptyResult;
 }
 
+/**
+ * Picks the safer-exec engine's own lines out of the stderr it shares with the
+ * traced command. Warnings start with "safer-exec: warning:"; when the engine
+ * stops a run, its error is the last other "safer-exec: " line it prints.
+ *
+ * @param {string} stderr Captured stderr of a safer-exec run
+ * @returns {{warnings: string[], error: string|undefined}} Unique engine warnings, and the engine's error if any
+ */
+export function engineMessages(stderr) {
+  const lines = String(stderr || "")
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith("safer-exec: "));
+  const warnings = [
+    ...new Set(lines.filter((line) => line.startsWith("safer-exec: warning:"))),
+  ];
+  const others = lines.filter(
+    (line) => !line.startsWith("safer-exec: warning:"),
+  );
+  return { warnings, error: others.at(-1) };
+}
+
 /**
  * Returns the sorted, de-duplicated parameter names of a query string.
  *