@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/evinser/swiftsem.js

@@ -20,6 +20,7 @@ import {
   safeRmSync,
   safeSpawnSync,
 } from "../core/fs.js";
+import { isProjectToolingAllowed } from "../ecosystems/gradleutils.js";
 import { splitCommandArgs } from "../ecosystems/parsers-js.js";
 import { collectSwiftProductionTargets } from "../ecosystems/parsers-misc.js";
 import { runSwiftCommand } from "../inventory/envcontext.js";
@@ -585,6 +586,45 @@ export function sanitizeSwiftModuleArgs(tokens) {
   return args;
 }
 
+// Compiler arguments that load code into the compiler or the SourceKit
+// service: macro plugins and their search paths, and the clang arguments
+// (`-Xcc -fplugin=...`) behind -Xcc.
+const SWIFT_CODE_LOADING_ARGS = new Set([
+  "-plugin-path",
+  "-external-plugin-path",
+  "-load-plugin-executable",
+  "-load-plugin-library",
+  "-in-process-plugin-server-path",
+  "-Xcc",
+]);
+
+/**
+ * Remove the arguments that would make SourceKit load code named by the
+ * project. A `.build` directory that cdxgen did not create is project content,
+ * so the compiler arguments read from it are cleaned this way whenever the
+ * project's own tooling may not run.
+ *
+ * @param {Array<String>} args Sanitized compiler arguments
+ * @returns {Array<String>} Arguments without plugin and clang pass-through flags
+ */
+export function withoutSwiftPluginArgs(args) {
+  const kept = [];
+  for (let i = 0; i < (args || []).length; i++) {
+    const token = args[i];
+    if (SWIFT_CODE_LOADING_ARGS.has(token)) {
+      i++;
+      continue;
+    }
+    // -Xfrontend <plugin flag> -Xfrontend <value>
+    if (token === "-Xfrontend" && SWIFT_CODE_LOADING_ARGS.has(args[i + 1])) {
+      i += 3;
+      continue;
+    }
+    kept.push(token);
+  }
+  return kept;
+}
+
 /**
  * Read the sources listed in a response or file-list file (`@<path>`), one
  * path per line.
@@ -2198,7 +2238,16 @@ export function createSemanticsSlices(basePath, options) {
   if (!pkgSwiftFiles.length) {
     return undefined;
   }
-  const toolchain = resolveSwiftToolchain(basePath);
+  // A SwiftPM manifest is a Swift program and the verbose build compiles the
+  // project, so both belong to the dependency-tooling surface disabled by
+  // --no-install-deps and the pre-build lifecycle. Evidence then comes from
+  // the .build artifacts a previous build left and import declarations.
+  const toolingAllowed = isProjectToolingAllowed(options);
+  // swiftly picks a toolchain from the project's .swift-version, so the
+  // toolchain is resolved outside the project when its tooling may not run
+  const toolchain = resolveSwiftToolchain(
+    toolingAllowed ? basePath : getTmpDir(),
+  );
   const sourcekittenEnv = sourcekittenEnvForToolchain(toolchain);
   // Without a working sourcekitten, the evidence is limited to the import
   // declarations of the modules the build describes
@@ -2211,13 +2260,22 @@ export function createSemanticsSlices(basePath, options) {
         : "",
     );
   }
+  if (!toolingAllowed) {
+    console.log(
+      "Skipping 'swift package dump-package' and the swift build for evidence since dependency installation is disabled. Evidence is limited to the build artifacts already in the project, without their compiler plugins.",
+    );
+  }
   // Package.swift contains the root targets, including which ones are tests
-  const packageMetadata = parseDumpPackage(dumpPackage(basePath));
+  const packageMetadata = toolingAllowed
+    ? parseDumpPackage(dumpPackage(basePath))
+    : undefined;
   const userCompilerArgs = process?.env?.SWIFT_COMPILER_ARGS;
   const userSdkArgs = process?.env?.SWIFT_SDK_ARGS;
   // A clean verbose debug build reveals the compiler arguments of every module
   const buildOutput =
-    userCompilerArgs && userSdkArgs ? undefined : verboseBuild(basePath);
+    !toolingAllowed || (userCompilerArgs && userSdkArgs)
+      ? undefined
+      : verboseBuild(basePath);
   const buildPlan = collectSwiftBuildPlan(
     basePath,
     buildOutput,
@@ -2267,7 +2325,9 @@ export function createSemanticsSlices(basePath, options) {
       moduleArgs[moduleName] = [
         ...(userCompilerArgs
           ? splitSwiftCommandArgs(`${userCompilerArgs} ${userSdkArgs || ""}`)
-          : amodule.args),
+          : toolingAllowed
+            ? amodule.args
+            : withoutSwiftPluginArgs(amodule.args)),
         "-module-cache-path",
         moduleCachePath,
       ];
@@ -2284,12 +2344,15 @@ export function createSemanticsSlices(basePath, options) {
     }
     // Sources that belong to no known module, for example when the build
     // failed, are indexed with the merged arguments of the root modules
-    const fallbackArgs = userCompilerArgs
+    let fallbackArgs = userCompilerArgs
       ? splitSwiftCommandArgs(`${userCompilerArgs} ${userSdkArgs || ""}`)
       : extractCompilerParamsFromBuild(
           buildOutput,
           packageMetadata?.rootModules,
         ).compilerArgs;
+    if (!userCompilerArgs && !toolingAllowed) {
+      fallbackArgs = withoutSwiftPluginArgs(fallbackArgs);
+    }
     // Sources of test and dependency modules are never indexed
     const plannedSources = new Set();
     for (const amodule of Object.values(buildPlan.modules)) {

package/lib/helpers/agenticToolutils.js

@@ -3,12 +3,12 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 
 import { build } from "@cdxgen/cdx-purl";
-import { parse as tomlParse } from "smol-toml";
 import { parse as loadYaml } from "yaml";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
 import { safeExistsSync } from "../core/fs.js";
 import { isMac, isWin } from "../core/paths.js";
+import { parseToml } from "../core/toml.js";
 
 /**
  * The purl type used for installed agentic CLI tools. These tools ship as
@@ -476,7 +476,7 @@ function countCodexSignals(dir) {
     return signals;
   }
   try {
-    const config = tomlParse(readFileSync(configPath, "utf-8"));
+    const config = parseToml(readFileSync(configPath, "utf-8"));
     if (config?.mcp_servers && typeof config.mcp_servers === "object") {
       signals.mcpServerCount = Object.keys(config.mcp_servers).length;
     }