@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/core/boundedFile.js

@@ -0,0 +1,344 @@
+// Bounded, read-only access to files inside an extracted image or a live host.
+//
+// Every file a scan opens may be hostile: only regular files that stay inside
+// the extracted root are opened, a symlink is never followed, a FIFO is never
+// opened, and reads are capped. A missing or odd file yields no result rather
+// than throwing.
+
+import { createHash } from "node:crypto";
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readSync,
+  realpathSync,
+} from "node:fs";
+import { resolve, sep } from "node:path";
+import process from "node:process";
+
+const READ_CHUNK_BYTES = 1024 * 1024;
+
+// O_NOFOLLOW refuses a symlink swapped in after lstat, and O_NONBLOCK keeps a
+// FIFO swapped in the same way from blocking the open. Neither exists on
+// Windows, where neither race applies.
+const OPEN_FLAGS =
+  constants.O_RDONLY |
+  (constants.O_NOFOLLOW || 0) |
+  (constants.O_NONBLOCK || 0);
+
+/**
+ * The largest file scanFileMarkers reads. Larger files are skipped whole
+ * rather than read in part, so a marker past the cap is never mistaken for an
+ * absent one; the result says the file was skipped.
+ *
+ * @type {number}
+ */
+export const MAX_MARKER_SCAN_BYTES = 2 * 1024 * 1024 * 1024;
+
+/**
+ * Open a path only when it is a regular file that does not resolve outside
+ * rootDir. lstat runs first so a FIFO is rejected without opening it (an open
+ * on a FIFO blocks until a writer appears) and a symlink is never followed.
+ *
+ * @param {string} absPath absolute path
+ * @param {string|undefined} rootDir extracted root the path must stay under
+ * @returns {{fd: number, size: number}|undefined} an open descriptor the
+ *   caller closes, or undefined
+ */
+export function openRegularFile(absPath, rootDir) {
+  let fd;
+  try {
+    if (typeof absPath !== "string" || !absPath) {
+      return undefined;
+    }
+    const lst = lstatSync(absPath);
+    if (!lst.isFile()) {
+      return undefined;
+    }
+    if (rootDir) {
+      const root = realpathSync(resolve(rootDir));
+      const real = realpathSync(absPath);
+      const rootPrefix = root.endsWith(sep) ? root : root + sep;
+      if (real !== root && !real.startsWith(rootPrefix)) {
+        return undefined;
+      }
+    }
+    fd = openSync(absPath, OPEN_FLAGS);
+    const stats = fstatSync(fd);
+    if (!stats.isFile()) {
+      closeSync(fd);
+      return undefined;
+    }
+    return { fd, size: stats.size };
+  } catch {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        // already closed
+      }
+    }
+    return undefined;
+  }
+}
+
+/**
+ * Read a small text file in full, only when it is a regular file no larger
+ * than maxBytes. A FIFO, a directory, a symlink or an oversized file reads as
+ * undefined.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size read
+ * @param {string|undefined} [rootDir] root the path must stay under
+ * @returns {string|undefined} the text, or undefined
+ */
+export function readRegularTextFile(absPath, maxBytes, rootDir) {
+  const opened = openRegularFile(absPath, rootDir);
+  if (!opened) {
+    return undefined;
+  }
+  try {
+    if (opened.size > maxBytes) {
+      return undefined;
+    }
+    const buffer = Buffer.alloc(opened.size);
+    let total = 0;
+    while (total < opened.size) {
+      const read = readSync(
+        opened.fd,
+        buffer,
+        total,
+        opened.size - total,
+        total,
+      );
+      if (read <= 0) {
+        break;
+      }
+      total += read;
+    }
+    return buffer.toString("utf8", 0, total);
+  } catch {
+    return undefined;
+  } finally {
+    try {
+      closeSync(opened.fd);
+    } catch {
+      // already closed
+    }
+  }
+}
+
+/**
+ * Find byte markers in a file with bounded chunked reads.
+ *
+ * Each hit records up to `beforeBytes` bytes before the marker and up to
+ * `contextBytes` bytes after it, so a caller can read a version that follows a
+ * marker or check what a string is part of. Consecutive reads overlap by the
+ * longest marker plus the context length, so a marker split across two reads
+ * is seen whole once. Only bytes that were read are searched.
+ *
+ * @param {string} absPath absolute path of the file
+ * @param {string|undefined} rootDir extracted root the file must stay under
+ * @param {Buffer[]} markers byte markers to look for
+ * @param {Object} [options] options
+ * @param {number} [options.maxBytes] files larger than this are not read
+ * @param {number} [options.contextBytes=64] bytes kept after each hit
+ * @param {number} [options.beforeBytes=1] bytes kept before each hit
+ * @param {number} [options.maxHits=16] hits kept per marker
+ * @returns {{hits: {before: Buffer, after: Buffer, offset: number}[][], size: number, skipped?: string}|undefined}
+ *   hits per marker, in marker order, and the file size; `skipped` is
+ *   `too-large` when the file is over the cap and was not read. Undefined when
+ *   the file cannot be opened.
+ */
+export function scanFileMarkers(
+  absPath,
+  rootDir,
+  markers,
+  {
+    maxBytes = MAX_MARKER_SCAN_BYTES,
+    contextBytes = 64,
+    beforeBytes = 1,
+    maxHits = 16,
+  } = {},
+) {
+  if (!Array.isArray(markers) || !markers.length) {
+    return undefined;
+  }
+  const opened = openRegularFile(absPath, rootDir);
+  if (!opened) {
+    return undefined;
+  }
+  const hits = markers.map(() => []);
+  try {
+    const { fd, size } = opened;
+    if (size > maxBytes) {
+      return { hits, size, skipped: "too-large" };
+    }
+    if (size <= 0) {
+      return { hits, size };
+    }
+    const longest = Math.max(...markers.map((marker) => marker.length));
+    const overlap = longest + contextBytes;
+    const bufferSize = Math.min(size, READ_CHUNK_BYTES) + overlap;
+    const buffer = Buffer.allocUnsafe(bufferSize);
+    // The bytes just before the current window, for a hit near its start.
+    let previousTail = Buffer.alloc(0);
+    for (let position = 0; position < size; position += READ_CHUNK_BYTES) {
+      const want = Math.min(bufferSize, size - position);
+      const read = readSync(fd, buffer, 0, want, position);
+      if (read <= 0) {
+        break;
+      }
+      // What a previous, longer read left in the buffer past `read` is never
+      // searched.
+      const window = buffer.subarray(0, read);
+      // Only hits starting inside this window are new; the overlap lets the
+      // next window see a marker and its context that cross the edge. The
+      // last window has no next one, so everything it read is searched.
+      const isLast = position + read >= size;
+      const searchLimit = isLast ? read : Math.min(READ_CHUNK_BYTES, read);
+      for (let index = 0; index < markers.length; index++) {
+        const marker = markers[index];
+        const found = hits[index];
+        let offset = window.indexOf(marker);
+        while (
+          offset !== -1 &&
+          offset < searchLimit &&
+          found.length < maxHits
+        ) {
+          const afterStart = offset + marker.length;
+          const before =
+            offset >= beforeBytes
+              ? window.subarray(offset - beforeBytes, offset)
+              : Buffer.concat([
+                  previousTail,
+                  window.subarray(0, offset),
+                ]).subarray(-beforeBytes);
+          found.push({
+            offset: position + offset,
+            before: Buffer.from(before),
+            after: Buffer.from(
+              window.subarray(
+                Math.min(afterStart, read),
+                Math.min(read, afterStart + contextBytes),
+              ),
+            ),
+          });
+          offset = window.indexOf(marker, offset + 1);
+        }
+      }
+      if (read < bufferSize) {
+        break;
+      }
+      previousTail = Buffer.from(
+        window.subarray(
+          Math.max(0, READ_CHUNK_BYTES - beforeBytes),
+          READ_CHUNK_BYTES,
+        ),
+      );
+    }
+    return { hits, size };
+  } catch {
+    return undefined;
+  } finally {
+    try {
+      closeSync(opened.fd);
+    } catch {
+      // already closed
+    }
+  }
+}
+
+/**
+ * Compute the digest of a regular file with bounded chunked reads, under the
+ * same rules as readRegularTextFile: a FIFO, a directory, a symlink, a file
+ * that resolves outside rootDir or one larger than maxBytes yields undefined.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size hashed
+ * @param {string|undefined} [rootDir] root the path must stay under
+ * @param {string} [algorithm="sha256"] node:crypto hash algorithm
+ * @returns {string|undefined} the hex digest, or undefined
+ */
+export function hashRegularFile(
+  absPath,
+  maxBytes,
+  rootDir,
+  algorithm = "sha256",
+) {
+  const opened = openRegularFile(absPath, rootDir);
+  if (!opened) {
+    return undefined;
+  }
+  try {
+    if (opened.size > maxBytes) {
+      return undefined;
+    }
+    const hash = createHash(algorithm);
+    const buffer = Buffer.alloc(Math.min(READ_CHUNK_BYTES, opened.size || 1));
+    let total = 0;
+    while (total < opened.size) {
+      const read = readSync(
+        opened.fd,
+        buffer,
+        0,
+        Math.min(buffer.length, opened.size - total),
+        total,
+      );
+      if (read <= 0) {
+        break;
+      }
+      hash.update(buffer.subarray(0, read));
+      total += read;
+    }
+    return hash.digest("hex");
+  } catch {
+    return undefined;
+  } finally {
+    try {
+      closeSync(opened.fd);
+    } catch {
+      // already closed
+    }
+  }
+}
+
+/**
+ * True when the process runs as root, where a symlink planted in a user's
+ * home could point a scan at files only root can read.
+ *
+ * @returns {boolean} true for uid 0
+ */
+export function isRunningAsRoot() {
+  return typeof process.getuid === "function" && process.getuid() === 0;
+}
+
+/**
+ * Read a small text file a user keeps in their home, such as an editor's or an
+ * agent's configuration. Dotfile managers often make these symlinks, so a
+ * symlink to a regular file is followed, except when the process runs as root.
+ * The target must still be a regular file no larger than maxBytes.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size read
+ * @returns {string|undefined} the text, or undefined
+ */
+export function readUserFileText(absPath, maxBytes) {
+  if (typeof absPath !== "string" || !absPath) {
+    return undefined;
+  }
+  let target = absPath;
+  try {
+    if (lstatSync(absPath).isSymbolicLink()) {
+      if (isRunningAsRoot()) {
+        return undefined;
+      }
+      target = realpathSync(absPath);
+    }
+  } catch {
+    return undefined;
+  }
+  return readRegularTextFile(target, maxBytes);
+}

package/lib/core/brotliProbe.js

@@ -0,0 +1,182 @@
+// Bounded probe for a Brotli decoder compiled into a native file, and for
+// whether that copy carries the CVE-2026-111497 fix.
+//
+// Node.js, the Python Brotli and brotlicffi wheels, the PHP and Ruby
+// extensions, the .NET runtime and many static binaries carry a private copy of
+// Google's C decoder. No package manager names that copy, and its version is
+// not stored as a string anywhere in the file, so a BOM has to read the file
+// to say whether a vulnerable decoder ships in it.
+//
+// Three kinds of evidence are read, each classified by the bytes around it:
+//
+// - The names of the decoder's error codes, which BrotliDecoderErrorString()
+//   returns (EXUBERANT_NIBBLE is one). Upstream 1.1+ stores them prefixed,
+//   `_ERROR_FORMAT_EXUBERANT_NIBBLE`; 1.0.x and Debian's backport store the
+//   bare name between NULs. The fix, google/brotli 0ed4268, added the name
+//   BLOCK_SWITCH, so a decoder whose table has it is patched.
+//   https://github.com/google/brotli/blob/v1.2.0/c/include/brotli/decode.h#L72
+//   https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b
+// - Two decoder tables, kCodeLengthCodeOrder and kCodeLengthPrefixValue
+//   (c/dec/decode.c). They stay when a linker drops the error-name table
+//   because nothing calls BrotliDecoderErrorString (--gc-sections, LTO,
+//   -dead_strip). The encoder keeps the first table but not the second. With
+//   the tables alone the decoder is present but its fix state is unknown.
+// - Node.js's zlib.constants table, BROTLI_DECODER_ERROR_FORMAT_*. It mirrors
+//   the brotli headers Node.js was built with, and a linker that merges string
+//   tails (lld -O2, lld-link /OPT:ICF) can leave only it in place of the
+//   decoder's own names. Next to the decoder tables it stands for them; alone,
+//   as in a Node.js linked to a shared libbrotlidec, it is no decoder.
+//
+// The ports are told apart. The Go port (andybalholm/brotli, fixed in v1.2.7)
+// keeps the same names in Go's undelimited string table, so a Go binary can
+// hold both a cgo-linked C decoder and the Go port, and each gets its own
+// fix state. The Rust port (brotli-decompressor) keeps `ERROR_FORMAT_...`
+// strings and the same tables but is not affected; its crate name in symbols
+// or panic paths marks it, and its evidence is ignored.
+//
+// Nothing is executed. A file over the read cap is reported as skipped, never
+// as free of a decoder.
+//
+// The component helpers that put the answer into a BOM are in
+// lib/inventory/brotliDecoder.js; this half lives in the core layer so the HTTP
+// client can ask it about its own runtime.
+
+import { scanFileMarkers } from "./boundedFile.js";
+
+const NAME = Buffer.from("EXUBERANT_NIBBLE");
+const FIX_NAME = Buffer.from("BLOCK_SWITCH");
+// The Go linker writes this magic at the start of the buildinfo section.
+// https://github.com/golang/go/blob/go1.25.0/src/debug/buildinfo/buildinfo.go#L58
+const GO_BUILDINFO_MAGIC = Buffer.from("\xff Go buildinf:", "latin1");
+// static const uint8_t kCodeLengthCodeOrder[18] and
+// kCodeLengthPrefixValue[16], c/dec/decode.c.
+const CODE_LENGTH_CODE_ORDER = Buffer.from([
+  1, 2, 3, 4, 0, 5, 17, 6, 16, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+]);
+const CODE_LENGTH_PREFIX_VALUE = Buffer.from([
+  0, 4, 3, 2, 0, 4, 3, 1, 0, 4, 3, 2, 0, 4, 3, 5,
+]);
+// Legacy and v0 Rust mangling length-prefix the crate name; panic messages
+// name the crate's source path.
+const RUST_CRATE_SYMBOL = Buffer.from("19brotli_decompressor");
+const RUST_CRATE_PATH = Buffer.from("brotli-decompressor-");
+
+const CONSTANT_PREFIX = Buffer.from("BROTLI_DECODER_ERROR_FORMAT_");
+const C_PREFIX = Buffer.from("_ERROR_FORMAT_");
+const RUST_PREFIX = Buffer.from("ERROR_FORMAT_");
+
+/**
+ * The most files of one kind (executables and libraries, or extension
+ * modules) one scan opens in search of a Brotli decoder.
+ *
+ * @type {number}
+ */
+export const MAX_BROTLI_PROBES = 4096;
+
+/**
+ * The most bytes one scan reads in search of Brotli decoders.
+ *
+ * @type {number}
+ */
+export const MAX_BROTLI_PROBE_BYTES = 16 * 1024 * 1024 * 1024;
+
+function endsWith(buffer, suffix) {
+  return (
+    buffer.length >= suffix.length &&
+    buffer.subarray(buffer.length - suffix.length).equals(suffix)
+  );
+}
+
+/**
+ * Classify one hit of an error name by what it is part of.
+ *
+ * @param {{before: Buffer, after: Buffer}} hit marker hit
+ * @returns {string} `constant`, `c`, `rust` or `other`
+ */
+function classify(hit) {
+  if (endsWith(hit.before, CONSTANT_PREFIX)) {
+    return "constant";
+  }
+  if (endsWith(hit.before, C_PREFIX)) {
+    return "c";
+  }
+  if (endsWith(hit.before, RUST_PREFIX)) {
+    return "rust";
+  }
+  const previous = hit.before.length ? hit.before[hit.before.length - 1] : 0;
+  if (previous === 0 && hit.after.length && hit.after[0] === 0) {
+    return "c";
+  }
+  return "other";
+}
+
+/**
+ * Read which Brotli decoders a native file embeds and whether each carries
+ * the CVE-2026-111497 fix.
+ *
+ * @param {string} absPath absolute path of the file
+ * @param {string|undefined} rootDir extracted root the file must stay under
+ * @returns {{c?: {blockSwitchFix: string, evidence: string}, go?: {blockSwitchFix: string}, skipped?: string, size: number}|undefined}
+ *   undefined when the file cannot be read or holds no decoder. `c` is
+ *   Google's C decoder, with blockSwitchFix `true`, `false` or `unknown` and
+ *   the evidence it rests on (`error-names`, `constant-names` or `tables`);
+ *   `go` is the Go port. `skipped` is `too-large` for a file over the read cap.
+ */
+export function readBrotliDecoder(absPath, rootDir) {
+  const scan = scanFileMarkers(
+    absPath,
+    rootDir,
+    [
+      NAME,
+      FIX_NAME,
+      GO_BUILDINFO_MAGIC,
+      CODE_LENGTH_CODE_ORDER,
+      CODE_LENGTH_PREFIX_VALUE,
+      RUST_CRATE_SYMBOL,
+      RUST_CRATE_PATH,
+    ],
+    { contextBytes: 1, beforeBytes: CONSTANT_PREFIX.length, maxHits: 256 },
+  );
+  if (!scan) {
+    return undefined;
+  }
+  if (scan.skipped) {
+    return { skipped: scan.skipped, size: scan.size };
+  }
+  const [
+    names,
+    fixNames,
+    goMagic,
+    codeOrder,
+    prefixValue,
+    rustSymbol,
+    rustPath,
+  ] = scan.hits;
+  const kinds = (hits) => new Set(hits.map(classify));
+  const nameKinds = kinds(names);
+  const fixKinds = kinds(fixNames);
+  const isGo = goMagic.length > 0;
+  const isRust = rustSymbol.length > 0 || rustPath.length > 0;
+  const hasTables = codeOrder.length > 0 && prefixValue.length > 0;
+  const result = { size: scan.size };
+  // Go strings are not delimited, so a name that is neither C-shaped nor a
+  // constant is the Go port's, in a Go binary.
+  const hasGoPort = isGo && nameKinds.has("other");
+  if (hasGoPort) {
+    result.go = { blockSwitchFix: fixKinds.has("other") ? "true" : "false" };
+  }
+  if (nameKinds.has("c")) {
+    result.c = {
+      blockSwitchFix: fixKinds.has("c") ? "true" : "false",
+      evidence: "error-names",
+    };
+  } else if (hasTables && !hasGoPort && !isRust) {
+    result.c = nameKinds.has("constant")
+      ? {
+          blockSwitchFix: fixKinds.has("constant") ? "true" : "false",
+          evidence: "constant-names",
+        }
+      : { blockSwitchFix: "unknown", evidence: "tables" };
+  }
+  return result.c || result.go ? result : undefined;
+}

package/lib/core/env.js

@@ -1,4 +1,4 @@
-import { join } from "node:path";
+import { join, win32 } from "node:path";
 
 import {
   buildReadCountSuffix,
@@ -301,6 +301,20 @@ export const SWIFT_CMD = readEnvironmentVariable("SWIFT_CMD") || "swift";
 /** Resolved Ruby executable command (RUBY_CMD env var, or "ruby"). */
 export const RUBY_CMD = readEnvironmentVariable("RUBY_CMD") || "ruby";
 
+/** Resolved RubyGems executable command (CDXGEN_GEM_CMD env var, or "gem"). */
+export const GEM_CMD = readEnvironmentVariable("CDXGEN_GEM_CMD") || "gem";
+
+/** Resolved Bundler executable command (CDXGEN_BUNDLE_CMD env var, or "bundle"). */
+export const BUNDLE_CMD =
+  readEnvironmentVariable("CDXGEN_BUNDLE_CMD") || "bundle";
+
+/** Resolved PHP executable command (PHP_CMD env var, or "php"). */
+export const PHP_CMD = readEnvironmentVariable("PHP_CMD") || "php";
+
+/** Resolved Composer executable command (COMPOSER_CMD env var, or "composer"). */
+export const COMPOSER_CMD =
+  readEnvironmentVariable("COMPOSER_CMD") || "composer";
+
 /** Python package components that can be excluded from the generated BOM. */
 export const PYTHON_EXCLUDED_COMPONENTS = [
   "pip",
@@ -513,6 +527,7 @@ export const PROJECT_TYPE_ALIASES = {
     "vscode",
     "openvsx",
     "vscode-extensions",
+    "ide",
     "ide-extension",
     "ide-extensions",
   ],
@@ -707,23 +722,38 @@ export function hasAnyProjectType(projectTypes, options, defaultStatus = true) {
   return shouldInclude;
 }
 
+/**
+ * Extract the lowercase command name from an invoked command path, without
+ * directories or a trailing `.js`, `.cjs`, `.mjs` or `.exe` extension. Both
+ * `/` and `\\` separators are handled, so a Windows path is inspected the
+ * same way on any host.
+ *
+ * @param {string} [commandPath] Invoked command path or name
+ * @returns {string} Lowercase command name
+ */
+export function getCommandName(commandPath) {
+  return win32
+    .basename(`${commandPath || ""}`)
+    .toLowerCase()
+    .replace(/\.(?:[cm]?js|exe)$/u, "");
+}
+
 /**
  * Determine whether the predictive dependency audit should run for the current
  * CLI invocation.
  *
- * OBOM-focused runs (`obom` or explicit `-t os` / OS aliases only) should keep
- * the direct BOM audit findings but skip the predictive dependency audit.
+ * OBOM and HBOM runs (commands named `obom` or `hbom`, including `hbom-slim`)
+ * and explicit `-t os` / OS / hardware project types alone keep the direct BOM
+ * audit findings but skip the predictive dependency audit. Only the command
+ * name is tested, never the directories leading to it.
  *
  * @param {object} options CLI options
  * @param {string} [commandPath] Invoked command path or name
  * @returns {boolean} True when predictive dependency audit should run
  */
 export function shouldRunPredictiveBomAudit(options, commandPath) {
-  const normalizedCommandPath = `${commandPath || ""}`.toLowerCase();
-  if (normalizedCommandPath.includes("obom")) {
-    return false;
-  }
-  if (normalizedCommandPath.includes("hbom")) {
+  const commandName = getCommandName(commandPath);
+  if (commandName.startsWith("obom") || commandName.startsWith("hbom")) {
     return false;
   }
   const projectTypes = Array.isArray(options?.projectType)

package/lib/core/fs.js

@@ -43,6 +43,7 @@ import {
 } from "./activity.js";
 import { thoughtLog, traceLog } from "./logger.js";
 import { isWin } from "./paths.js";
+import { recordExecutedTool } from "./toolRegistry.js";
 
 function getArchiveSourceByteSize(sourcePath) {
   if (!sourcePath || !safeExistsSync(sourcePath)) {
@@ -522,8 +523,13 @@ function isWindowsShellHijackRisk(command, options) {
   const absCwd = resolve(cwd);
   for (const candidate of candidates) {
     const candidatePath = path.join(absCwd, candidate);
-    if (existsSync(candidatePath)) {
-      return true;
+    // cmd.exe only runs files, so a directory named like the tool is harmless.
+    try {
+      if (statSync(candidatePath).isFile()) {
+        return true;
+      }
+    } catch (_err) {
+      // Not present.
     }
   }
   return false;
@@ -831,24 +837,28 @@ export function safeSpawnSync(command, args, options) {
       error: new Error("No execute permission"),
     };
   }
+  // cmd.exe looks in the working directory before PATH, so a scanned project
+  // could otherwise replace the tool cdxgen means to run. This holds outside
+  // secure mode too, since --no-install-deps scans still run version probes
+  // and read-only tools with the project as the working directory.
+  if (isWindowsShellHijackRisk(command, options)) {
+    const blockedReason = `${command} matches local file in cwd (Windows shell hijack risk)`;
+    console.warn(`\x1b[1;31mSecurity Alert: ${blockedReason}\x1b[0m`);
+    recordActivity({
+      kind: activityDescriptor.kind,
+      ...activityDescriptor.metadata,
+      reason: blockedReason,
+      status: "blocked",
+      target: activityDescriptor.target,
+    });
+    return {
+      status: 1,
+      stdout: undefined,
+      stderr: undefined,
+      error: new Error(blockedReason),
+    };
+  }
   if (isSecureMode) {
-    if (isWindowsShellHijackRisk(command, options)) {
-      const blockedReason = `${command} matches local file in cwd (Windows shell hijack risk)`;
-      console.warn(`\x1b[1;31mSecurity Alert: ${blockedReason}\x1b[0m`);
-      recordActivity({
-        kind: activityDescriptor.kind,
-        ...activityDescriptor.metadata,
-        reason: blockedReason,
-        status: "blocked",
-        target: activityDescriptor.target,
-      });
-      return {
-        status: 1,
-        stdout: undefined,
-        stderr: undefined,
-        error: new Error(blockedReason),
-      };
-    }
     if (options?.cwd && options.cwd !== resolve(options.cwd)) {
       if (DEBUG_MODE) {
         console.log(
@@ -982,6 +992,8 @@ export function safeSpawnSync(command, args, options) {
   }
   traceLog("spawn", { command, args, ...options });
   commandsExecuted.add(command);
+  // The tool as invoked, before a shell invocation folds the arguments in.
+  const executedCommand = command;
   // Fix for DEP0190 warning
   if (options?.shell === true) {
     const joined = joinShellCommand(command, args, rawShellArgs);
@@ -991,6 +1003,15 @@ export function safeSpawnSync(command, args, options) {
     }
   }
   const result = spawnSync(command, args, options);
+  // The run-scoped tool registry feeds metadata.tools (issue #598); every
+  // external execution funnels through this wrapper. A spawn that failed to
+  // start, such as a missing binary, ran nothing and is not recorded; through
+  // a shell, a missing command shows as exit code 127, or 9009 on cmd.exe.
+  const shellCommandNotFound =
+    options?.shell === true && [127, 9009].includes(result.status);
+  if (!result.error && !shellCommandNotFound) {
+    recordExecutedTool(executedCommand);
+  }
   recordActivity({
     kind: activityDescriptor.kind,
     ...activityDescriptor.metadata,