@cdxgen/cdxgen 13.3.0 → 13.5.0

package/README.md

@@ -16,7 +16,7 @@ cdxgen is a CLI tool, library, [REPL](./ADVANCED.md), and server to create, vali
 
 Supported BOM formats:
 
-- Hardware (HBOM) - For supported live hosts such as Apple Silicon macOS and Linux amd64/arm64 systems.
+- Hardware (HBOM) - For supported live hosts such as Apple Silicon macOS, Linux amd64/arm64, and Windows amd64/arm64 systems.
 - Software (SBOM) - For many languages and container images.
 - Cryptography (CBOM) - For Java keystores and certificates, plus JavaScript and TypeScript source-level algorithm inventory.
 - Operations (OBOM) - For Linux container images and VMs running Linux or Windows operating systems.
@@ -175,7 +175,7 @@ Regardless of how you install, the following commands are available:
 | `obom`          | Alias for `cdxgen -t os`                                                                                             | yes                              |
 | `saasbom`       | Alias for SaaSBOM-oriented `cdxgen` defaults                                                                         | yes                              |
 | `spdxgen`       | Alias for `cdxgen --format spdx`                                                                                     | use `cdxgen`                     |
-| `cdxgen-secure` | Alias for hardened `cdxgen` defaults                                                                                 | use `cdxgen`                     |
+| `cdxgen-secure` | `cdxgen` in secure mode, with dependency installation always off                                                     | use `cdxgen`                     |
 
 Standalone GitHub release binaries are published for `cdxgen`, `cdxgen-slim`, `aibom`, `cbom`, `obom`, `saasbom`, `hbom`, `hbom-slim`, `cdx-audit`, `cdx-convert`, `cdx-sign`, `cdx-validate`, `cdx-verify`, and `tracebom`.
 
@@ -187,7 +187,7 @@ The `cbom` and `saasbom` release binaries bundle the Atom analysis stack (`@appt
 
 For AI-heavy repositories, cdxgen also supports an AI-BOM workflow via the `aibom` command or the `-t ai` project type aliases (`ai`, `aibom`, `ai-bom`). This emits AI service/model evidence and pairs naturally with the `ai-bom` BOM-audit category alias for governance, security, performance, AI-agent, and MCP findings.
 
-For host inventories, `hbom --include-runtime` produces a merged HBOM + OBOM view with strict topology links such as interface-name, driver-module, storage/runtime, and explicit secure-boot trust matches, plus a `host-topology` BOM audit pack for higher-confidence host findings. When the live hardware collector reports missing utilities or permission-sensitive enrichments, use `hbom diagnostics` (or inspect the derived `cdx:hbom:analysis:*` summary properties) before deciding whether a rerun with `--privileged` is justified.
+For host inventories, `hbom --include-runtime` produces a merged HBOM + OBOM view with strict topology links such as interface-name, driver-module, storage/runtime (including Windows drive letters), and explicit secure-boot trust matches, plus a `host-topology` BOM audit pack for higher-confidence host findings. When the live hardware collector reports missing utilities or permission-sensitive enrichments, use `hbom diagnostics` (or inspect the derived `cdx:hbom:analysis:*` summary properties) before deciding whether a rerun with `--privileged` is justified. On Windows, `--privileged` only helps from an already-elevated session, and a non-administrator over SSH or WinRM is denied every WMI query; see [HBOM permissions](docs/PERMISSIONS.md#hbom-permissions).
 
 ### Standalone executables (recommended)
 
@@ -216,7 +216,7 @@ Common asset names:
 #### Linux
 
 ```bash
-VERSION="v13.3.0"
+VERSION="v13.5.0"
 ASSET="cdx-audit-linux-amd64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -230,7 +230,7 @@ chmod +x "${ASSET}"
 #### macOS
 
 ```bash
-VERSION="v13.3.0"
+VERSION="v13.5.0"
 ASSET="cdx-audit-darwin-arm64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -244,7 +244,7 @@ chmod +x "${ASSET}"
 #### Windows (PowerShell)
 
 ```powershell
-$Version = "v13.3.0"
+$Version = "v13.5.0"
 $Asset = "cdx-audit-windows-amd64.exe"
 $BaseUrl = "https://github.com/cdxgen/cdxgen/releases/download/$Version"
 
@@ -269,7 +269,7 @@ steps:
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
-      gh release download v13.3.0 \
+      gh release download v13.5.0 \
         --repo cdxgen/cdxgen \
         --pattern 'cdx-audit-linux-amd64' \
         --pattern 'cdx-audit-linux-amd64.sha256'
@@ -759,9 +759,9 @@ BOMs signed with cdxgen 13.2.0 or earlier must be re-signed with the current `cd
 For complex supply chain orchestration, use the bundled `cdx-sign` CLI. This tool allows multiple entities (e.g., a Builder and an Auditor) to co-sign an existing BOM without modifying its original data.
 
 ```shell
-# Append a parallel multi-signature (Auditor co-signing)
+# Append a parallel multi-signature (Auditor co-signing) after checking the Builder's signature
 # Note: Granular component signing is disabled to preserve the Builder's original signature payload.
-cdx-sign -i bom.json -k auditor_private.pem -a ES256 --key-id "auditor-qa" --mode signers --no-sign-components
+cdx-sign -i bom.json -k auditor_private.pem -a ES256 --key-id "auditor-qa" --mode signers --no-sign-components --verify-existing-with builder_public.pem
 ```
 
 ### Validating CycloneDX BOMs
@@ -780,6 +780,9 @@ cdx-verify -i bom.json --public-key public.key
 
 # Verify ONLY the top-level root signature (useful for verifying a multi-signer who didn't sign nested components)
 cdx-verify -i bom.json --public-key auditor_public.key --no-deep
+
+# Require every co-signer
+cdx-verify -i bom.json --public-key builder_public.key --public-key auditor_public.key --require-all
 ```
 
 ### Verifying the signature (pnpm)

package/bin/cdxgen-secure.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// cdxgen-secure: cdxgen in secure mode.
+//
+// This is an entry point of its own rather than a second name for
+// bin/cdxgen.js. cdxgen recognised the command from the script path in
+// process.argv[1], but bun reports the real file behind a symlink there and
+// the npm shims on Windows always name bin/cdxgen.js, so in both cases a
+// `cdxgen-secure` that pointed at bin/cdxgen.js ran as plain cdxgen. Turning
+// secure mode on here, before any cdxgen module loads, also means the modules
+// that read CDXGEN_SECURE_MODE once at import see it.
+import process from "node:process";
+
+process.env.CDXGEN_SECURE_MODE = "true";
+
+await import("./cdxgen.js");

package/bin/cdxgen.js

@@ -4,7 +4,6 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
-import { tmpdir } from "node:os";
 import {
   basename,
   dirname,
@@ -22,6 +21,7 @@ import { hideBin } from "yargs/helpers";
 import { getExactAiInventoryType } from "../lib/cli/bomAssembly.js";
 import {
   applyAdvancedOptions as applyAdvancedOptionsImpl,
+  applyOperatorToolingChoice,
   buildOptionsFromArgs,
   isUserProvided,
   validateSpecVersion,
@@ -34,10 +34,12 @@ import {
   isDeferredFailOnError,
 } from "../lib/core/deferredExit.js";
 import { TRACE_MODE, thoughtEnd, thoughtLog } from "../lib/core/logger.js";
+import { resolveSourcePathArgument } from "../lib/core/pluginRun.js";
 import {
   PROJECT_CONFIG_FILENAMES,
   sanitizeProjectConfig,
 } from "../lib/core/projectConfig.js";
+import { isSecureModeActive } from "../lib/core/projectTooling.js";
 import {
   ui as defaultUi,
   installConsoleShim,
@@ -102,6 +104,7 @@ import {
   printSummary,
   printTable,
 } from "../lib/inventory/display.js";
+import { runsEvidenceAnalysis } from "../lib/inventory/dosai.js";
 import {
   ensureNoMixedHbomProjectTypes,
   ensureSupportedHbomSpecVersion,
@@ -137,6 +140,11 @@ import { prepareEnv } from "../lib/stages/pregen/pregen.js";
 import { validateSpdx } from "../lib/validator/bomValidator.js";
 import { validateGeneratedBom } from "../lib/validator/index.js";
 
+// The environment as the operator launched cdxgen. The CLI later copies some
+// parsed options into the environment (--introspect becomes
+// CDXGEN_INTROSPECT), so the operator's own choices are read from this copy.
+const launchEnv = { ...process.env };
+
 // Support for config files. The config file lives in the directory under
 // analysis, so it carries that directory's trust level; see
 // sanitizeProjectConfig for the boundary this applies.
@@ -263,12 +271,12 @@ const args = _yargs
   .option("cmake-cache", {
     type: "string",
     description:
-      "Path to the CMakeCache.txt of a configured C/C++ build. Overrides the lookup under build/, out/ and cmake-build-*/.",
+      "Path to the CMakeCache.txt of a configured C/C++ build. Overrides the lookup in the build directories of the CMake presets, build*/, out/, builddir/ and cmake-build-*/.",
   })
   .option("compile-commands", {
     type: "string",
     description:
-      "Path to the compile_commands.json of a C/C++ build, or a directory holding one. atom then parses each file with its build's include paths, macros and language. Overrides the lookup in the project root, build/, out/, builddir/ and cmake-build-*/, which is skipped in secure mode.",
+      "Path to the compile_commands.json of a C/C++ build, or a directory holding one. atom then parses each file with its build's include paths, macros and language. Overrides the lookup in the project root and its build directories (those of the CMake presets, build*/, out/, builddir/, cmake-build-*/), which is skipped in secure mode.",
   })
   .option("git-branch", {
     description: "Git branch to clone when the source is a git URL or purl",
@@ -456,6 +464,23 @@ const args = _yargs
     default: false,
     description: "Generate SBOM with evidence for supported languages.",
   })
+  .option("scalasem", {
+    type: "boolean",
+    default: true,
+    description:
+      "Run the Scala semantic analyzer for the evidence of Scala projects. Use --no-scalasem to skip it.",
+  })
+  .option("scalasem-command", {
+    type: "string",
+    description:
+      "Use a specific scalasem script for the Scala evidence. Defaults to SCALASEM_CMD.",
+  })
+  .option("scalasem-include-tests", {
+    type: "boolean",
+    default: false,
+    description:
+      "Include test sources in the Scala evidence, tagged with their usage scope.",
+  })
   .option("deps-slices-file", {
     description: "Path for the parsedeps slice file created by atom.",
     default: "deps.slices.json",
@@ -893,7 +918,7 @@ const args = _yargs
     type: "boolean",
     default: true,
     description:
-      "Use the on-disk metadata cache for registry lookups. Pass --no-cache to bypass it for this run.",
+      "Use the on-disk metadata cache for registry lookups. Pass --no-cache to bypass it for this run; answers are still remembered within the run.",
   })
   .option("cache-ttl", {
     type: "number",
@@ -1013,9 +1038,24 @@ if (!readEnvironmentVariable("NODE_USE_SYSTEM_CA")) {
   process.env.NODE_USE_SYSTEM_CA = "1";
 }
 
-const filePath = args._[0] || process.cwd();
+let filePath = args._[0] || process.cwd();
 const sourceInputIsRemoteOrPurl =
   maybeRemotePath(filePath) || maybePurlSource(filePath);
+// Resolve the source argument once, before anything uses it. With the working
+// directory already set to the project and the argument relative to a
+// repository root (depscan's launch shape), every later resolve would produce
+// <project>/<argument>, a directory that does not exist: the BOM came out
+// empty and the plugins analyzed nothing, while the run still exited 0.
+if (!sourceInputIsRemoteOrPurl && args._?.[0]) {
+  const sourceResolution = resolveSourcePathArgument(filePath);
+  if (sourceResolution.rewritten) {
+    console.warn(
+      `Source path '${filePath}' does not exist relative to the working directory, which is itself the directory it names; using '${sourceResolution.path}'.`,
+    );
+    filePath = sourceResolution.path;
+    args._[0] = filePath;
+  }
+}
 if (!args.projectName) {
   if (filePath !== ".") {
     args.projectName = basename(filePath);
@@ -1094,8 +1134,10 @@ let autoLedgerSidecar;
 if (options.introspect) {
   process.env.CDXGEN_INTROSPECT = "true";
   if (!isDryRun && !readEnvironmentVariable("CDXGEN_INTROSPECT_LEDGER")) {
+    // The temp directory, not the OS one: under the permission model it is
+    // the directory cdxgen is granted writes to.
     autoLedgerSidecar = join(
-      tmpdir(),
+      getTmpDir(),
       `cdxgen-introspect-ledger-${process.pid}.jsonl`,
     );
     process.env.CDXGEN_INTROSPECT_LEDGER = autoLedgerSidecar;
@@ -1233,7 +1275,15 @@ if (options.lifecycle) {
 }
 const isHbomOnlyInvocation = isHbomOnlyProjectTypes(options.projectType);
 const advancedWarnings = applyAdvancedOptionsImpl(options, {
-  isSecureMode,
+  isSecureMode: isSecureModeActive(),
+});
+// The config file comes from the working directory, usually the scanned
+// project, so whether the project's own code may run stays the operator's
+// choice from the command line and environment.
+applyOperatorToolingChoice(options, {
+  env: launchEnv,
+  isSecureMode: isSecureModeActive(),
+  projectConfig: config,
 });
 if (options?.technique && Array.isArray(options.technique)) {
   if (options.technique.length === 1) {
@@ -2095,7 +2145,7 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     }
   }
   let internalCycloneDxInputPath = outputPlan.outputs.cyclonedx;
-  if ((options.evidence || options.includeCrypto) && bomNSData?.bomJson) {
+  if (runsEvidenceAnalysis(options) && bomNSData?.bomJson) {
     if (!internalCycloneDxInputPath) {
       internalCycloneDxInputPath = join(
         getTmpDir(),
@@ -2118,7 +2168,10 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     }
   }
   // Evidence generation
-  if (options.evidence || options.includeCrypto) {
+  // The same helper decides in createCsharpBom whether the dosai methods
+  // report may be trimmed: --include-crypto alone runs evinse too, so testing
+  // options.evidence alone here would trim a report this scan needs full.
+  if (runsEvidenceAnalysis(options)) {
     if (isDryRun) {
       recordActivity({
         kind: "write",
@@ -2137,30 +2190,61 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
         sourcePath: filePath,
       });
       const evinserModule = await import("../lib/evinser/evinser.js");
-      options.projectType = options.projectType || ["java"];
-      const evinseOptions = evinserModule.buildEvinseOptions(
-        options,
-        args,
-        internalCycloneDxInputPath || options.output,
-      );
-      const dbObjMap = await evinserModule.prepareDB(evinseOptions);
-      if (dbObjMap) {
-        const sliceArtefacts = await evinserModule.analyzeProject(
-          dbObjMap,
-          evinseOptions,
+      if (!options.projectType) {
+        const evidenceLanguage = evinserModule.defaultEvidenceLanguage(
+          filePath,
+          bomNSData?.bomJson,
+          options,
+        );
+        if (evidenceLanguage) {
+          options.projectType = [evidenceLanguage];
+        }
+      }
+      if (!options.projectType) {
+        console.log(
+          "Skipping the evidence analysis since the BOM lists no package in a language it supports. Pass -t to choose the language.",
         );
-        const evinseJson = await evinserModule.createEvinseFile(
-          sliceArtefacts,
-          evinseOptions,
+        if (bomNSData) {
+          bomNSData.bomJson = applyEvidenceBasedFilter(
+            bomNSData.bomJson,
+            options,
+          );
+        }
+      } else {
+        const evinseOptions = evinserModule.buildEvinseOptions(
+          options,
+          args,
+          internalCycloneDxInputPath || options.output,
         );
-        // The scope filter is deferred until here so the analyzers get to
-        // prove that an optional dependency is actually used.
-        bomNSData.bomJson = applyEvidenceBasedFilter(evinseJson, options);
-        if (options.print && evinseJson) {
-          printOccurrences(evinseJson);
-          printCallStack(evinseJson);
-          printReachables(sliceArtefacts);
-          printServices(evinseJson);
+        try {
+          const dbObjMap = await evinserModule.prepareDB(evinseOptions);
+          if (dbObjMap) {
+            const sliceArtefacts = await evinserModule.analyzeProject(
+              dbObjMap,
+              evinseOptions,
+            );
+            const evinseJson = await evinserModule.createEvinseFile(
+              sliceArtefacts,
+              evinseOptions,
+            );
+            // The scope filter is deferred until here so the analyzers get to
+            // prove that an optional dependency is actually used.
+            bomNSData.bomJson = applyEvidenceBasedFilter(evinseJson, options);
+            if (options.print && evinseJson) {
+              printOccurrences(evinseJson);
+              printCallStack(evinseJson);
+              printReachables(sliceArtefacts);
+              printServices(evinseJson);
+            }
+          }
+        } catch (err) {
+          // A rusi/golem analysis failure under --fail-on-error on an
+          // introspected run defers its exit so the BOM and the reports are
+          // still written; the run continues here without the reachability
+          // evidence, exactly as the deferral contract describes.
+          if (!isDeferredFailOnError(err)) {
+            throw err;
+          }
         }
       }
     }

package/bin/evinse.js

@@ -91,7 +91,7 @@ const args = yargs(hideBin(process.argv))
   })
   .option("compile-commands", {
     description:
-      "Path to the compile_commands.json of a C/C++ build, or a directory holding one, for atom to parse each file as its build does. Overrides the lookup in the project root, build/, out/, builddir/ and cmake-build-*/, which is skipped in secure mode.",
+      "Path to the compile_commands.json of a C/C++ build, or a directory holding one, for atom to parse each file as its build does. Overrides the lookup in the project root and its build directories (those of the CMake presets, build*/, out/, builddir/, cmake-build-*/), which is skipped in secure mode.",
     type: "string",
   })
   .option("golem-command", {
@@ -226,6 +226,11 @@ const args = yargs(hideBin(process.argv))
     default: false,
     type: "boolean",
   })
+  .option("install-deps", {
+    description:
+      "Let evinse run the project's own build tools, such as Maven and SwiftPM, to collect evidence. On by default, and off in secure mode. Pass --no-install-deps for projects you do not trust.",
+    type: "boolean",
+  })
   .option("with-deep-jar-collector", {
     description:
       "Enable collection of all jars from maven cache directory. Useful to improve the recall for callstack evidence.",
@@ -264,6 +269,23 @@ const args = yargs(hideBin(process.argv))
     description: "Use an existing usages slices file.",
     default: "usages.slices.json",
   })
+  .option("scalasem-command", {
+    description:
+      "Use a specific scalasem script for Scala evidence analysis. Defaults to SCALASEM_CMD.",
+    default: readEnvironmentVariable("SCALASEM_CMD"),
+  })
+  .option("scalasem-include-tests", {
+    description:
+      "Include test sources in the Scala semantic evidence, tagged with their usage scope.",
+    default: false,
+    type: "boolean",
+  })
+  .option("scalasem", {
+    description:
+      "Run the Scala semantic analyzer for Scala projects. Use --no-scalasem to skip it and keep the plain BOM.",
+    default: true,
+    type: "boolean",
+  })
   .option("data-flow-slices-file", {
     description: "Use an existing data-flow slices file.",
     default: "data-flow.slices.json",

package/bin/hbom.js

@@ -26,7 +26,10 @@ import {
   ensureSupportedHbomSpecVersion,
   hasHbomProjectType,
 } from "../lib/inventory/hbom.js";
-import { getHbomSummary } from "../lib/inventory/hbomAnalysis.js";
+import {
+  getHbomPrivilegeGuidance,
+  getHbomSummary,
+} from "../lib/inventory/hbomAnalysis.js";
 import {
   importProtobomModule,
   isProtoBomPath,
@@ -130,12 +133,13 @@ const args = _yargs
   })
   .option("privileged", {
     description:
-      "Enable privileged Linux enrichment and non-interactive sudo retries for documented permission-sensitive commands.",
+      "Enable privileged enrichment for documented permission-sensitive sources. Linux: privileged enrichment and non-interactive sudo retries. Windows: the TPM, BitLocker, storage-reliability and Secure Boot batch, which only an already-elevated (Run as administrator) session can read; HBOM never prompts for UAC and records permission-denied diagnostics otherwise. No effect on macOS.",
     type: "boolean",
     default: false,
   })
   .option("plist-enrichment", {
-    description: "Enable additional Darwin plist-based enrichment.",
+    description:
+      "Enable additional plist-based enrichment. Darwin only; ignored on Linux and Windows.",
     type: "boolean",
     default: false,
   })
@@ -172,7 +176,10 @@ const args = _yargs
     ["$0", "Generate an HBOM file for the current host"],
     ["$0 -p", "Print the generated HBOM to stdout"],
     ["$0 --platform linux --arch amd64", "Override target selection"],
-    ["$0 --privileged --pretty", "Enable privileged Linux enrichment"],
+    [
+      "$0 --privileged --pretty",
+      "Enable privileged enrichment: sudo retries on Linux, the elevated-only batch on Windows (run from an administrator prompt)",
+    ],
     [
       "$0 diagnostics",
       "Run a live HBOM diagnostic pass and summarize missing commands or permission-sensitive enrichments",
@@ -226,6 +233,9 @@ const options = {
   arch: args.arch,
   command: selectedCommand,
   commandName: hbomCommandName,
+  // yargs turns `--no-command-enrichment` into `commandEnrichment: false` and
+  // leaves `noCommandEnrichment` at its default, so forward both spellings.
+  commandEnrichment: args.commandEnrichment,
   dryRun: args.dryRun,
   input: args.input ? resolve(args.input) : undefined,
   noCommandEnrichment: args.noCommandEnrichment,
@@ -420,9 +430,7 @@ function printHbomDiagnosticsReport(bomJson) {
   }
 
   if (hbomSummary.requiresPrivilegedEnrichment) {
-    console.log(
-      "\nSome Linux enrichments can likely succeed only with --privileged and a target environment that allows non-interactive sudo.",
-    );
+    console.log(`\n${getHbomPrivilegeGuidance(hbomSummary.platform)}`);
   }
 }
 

package/bin/repl.js

@@ -25,6 +25,8 @@ import {
   printAiBomPedigree,
   printAiBomVariants,
   printCallStack,
+  printCertificateChain,
+  printCertificatesTable,
   printDependencyTree,
   printFormulation,
   printOccurrences,
@@ -1224,6 +1226,32 @@ cdxgenRepl.defineCommand("cryptos", {
     this.displayPrompt();
   },
 });
+cdxgenRepl.defineCommand("certs", {
+  help: "print the certificate components with role, issuer, expiry and SPKI prefix",
+  action() {
+    if (sbom) {
+      printCertificatesTable(sbom);
+    } else {
+      console.log(
+        "⚠ No BOM is loaded. Use .import command to import an existing BOM",
+      );
+    }
+    this.displayPrompt();
+  },
+});
+cdxgenRepl.defineCommand("certchain", {
+  help: "show the issuer chain above a certificate and the certificates issued under it (.certchain <bom-ref|spki-prefix|cert-prefix>)",
+  action(selector) {
+    if (sbom) {
+      printCertificateChain(sbom, selector);
+    } else {
+      console.log(
+        "⚠ No BOM is loaded. Use .import command to import an existing BOM",
+      );
+    }
+    this.displayPrompt();
+  },
+});
 cdxgenRepl.defineCommand("sourcecryptos", {
   help: "show source-derived cryptographic assets detected from JS AST analysis",
   action() {
@@ -1741,6 +1769,92 @@ cdxgenRepl.defineCommand("golemcoverage", {
     this.displayPrompt();
   },
 });
+function hasScalasemProperties(component) {
+  return Boolean(
+    component?.properties?.some((property) =>
+      property?.name?.startsWith("cdx:scalasem:"),
+    ),
+  );
+}
+
+cdxgenRepl.defineCommand("scalasemsummary", {
+  help: "summarize Scala Evinse/scalasem metadata and evidence coverage",
+  action() {
+    const interactiveBom = getInteractiveBom();
+    if (!interactiveBom) {
+      console.log("⚠ No BOM is loaded. Use .import command to import an SBOM");
+      this.displayPrompt();
+      return;
+    }
+    if (!hasScalasemProperties(interactiveBom.metadata?.component)) {
+      console.log(
+        "No scalasem properties found. Generate an evidence BOM with evinse -l scala or cdxgen --evidence to use this view.",
+      );
+      this.displayPrompt();
+      return;
+    }
+    const rootComponent = interactiveBom.metadata?.component || {};
+    const components = interactiveBom.components || [];
+    const occurrences = components.reduce(
+      (total, component) =>
+        total + (component?.evidence?.occurrences?.length || 0),
+      0,
+    );
+    const occurrencesWithLine = components.reduce(
+      (total, component) =>
+        total +
+        (component?.evidence?.occurrences || []).filter(
+          (occurrence) => occurrence?.line,
+        ).length,
+      0,
+    );
+    const callstacks = components.filter(
+      (component) => component?.evidence?.callstack?.frames?.length,
+    ).length;
+    const cryptoAssets = components.filter(
+      (component) => component?.type === "cryptographic-asset",
+    ).length;
+    printKeyValueTable("Scala Evinse / scalasem summary", [
+      [
+        "Schema version",
+        getPropertyValue(rootComponent, "cdx:scalasem:schemaVersion"),
+      ],
+      [
+        "Facts source",
+        getPropertyValue(rootComponent, "cdx:scalasem:factsSource"),
+      ],
+      [
+        "Scala versions",
+        getPropertyValue(rootComponent, "cdx:scalasem:scalaVersions"),
+      ],
+      ["Platforms", getPropertyValue(rootComponent, "cdx:scalasem:platforms")],
+      [
+        "Files analyzed",
+        getPropertyValue(rootComponent, "cdx:scalasem:filesAnalyzed"),
+      ],
+      ["Degraded", getPropertyValue(rootComponent, "cdx:scalasem:degraded")],
+      ...(rootComponent.properties || [])
+        .filter((property) =>
+          property?.name?.startsWith("cdx:scalasem:diagnostic:"),
+        )
+        .map((property) => [
+          `Diagnostic ${property.name.slice("cdx:scalasem:diagnostic:".length)}`,
+          property.value,
+        ]),
+      [
+        "Components with occurrences",
+        components.filter((c) => c?.evidence?.occurrences?.length).length,
+      ],
+      ["Occurrences", occurrences],
+      ["Occurrences with line", occurrencesWithLine],
+      ["Components with call stacks", callstacks],
+      ["Crypto assets", cryptoAssets],
+      ["Services", (interactiveBom.services || []).length],
+    ]);
+    this.displayPrompt();
+  },
+});
+
 cdxgenRepl.defineCommand("auditfindings", {
   help: "summarize cdx-audit and bom-audit annotations from the loaded BOM",
   action() {
@@ -2117,6 +2231,7 @@ cdxgenRepl.defineCommand("tagcloud", {
 });
 // Let's dynamically define more commands from the queries
 [
+  "apk_packages",
   "apt_sources",
   "behavioral_reverse_shell",
   "certificates",