@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/helpers/agenticToolutils.js

@@ -1,14 +1,18 @@
-import { readdirSync, readFileSync } from "node:fs";
+import { readdirSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { basename, dirname, isAbsolute, join } from "node:path";
 
 import { build } from "@cdxgen/cdx-purl";
 import { parse as loadYaml } from "yaml";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { readUserFileText } from "../core/boundedFile.js";
 import { safeExistsSync } from "../core/fs.js";
-import { isMac, isWin } from "../core/paths.js";
+import { isMac, isWin, redactHomePath } from "../core/paths.js";
 import { parseToml } from "../core/toml.js";
+import { findIdeProductInfo, IDE_PRODUCTS } from "./vsixutils.js";
+
+export { redactHomePath };
 
 /**
  * The purl type used for installed agentic CLI tools. These tools ship as
@@ -45,29 +49,6 @@ function buildGenericPurl(name, version) {
   }
 }
 
-/**
- * Rewrite an absolute path under the user's home directory to a `~`-relative
- * form so the emitted BOM does not carry the local username.
- *
- * @param {string} filePath Absolute path
- * @returns {string} Home-relative path when applicable, else the input
- */
-export function redactHomePath(filePath) {
-  const home = homedir();
-  const value = String(filePath || "");
-  if (!home || !value.startsWith(home)) {
-    return value;
-  }
-  // Require a path boundary so a sibling home such as /Users/alice-backup is
-  // not rewritten as if it sat under /Users/alice.
-  const remainder = value.slice(home.length);
-  if (remainder && !/^[/\\]/u.test(remainder)) {
-    return value;
-  }
-  const rest = remainder.replace(/^[/\\]/u, "");
-  return rest ? `~/${rest.replaceAll("\\", "/")}` : "~";
-}
-
 // Directory or file names inside a tool home that must never be read for their
 // values. They hold credentials, transcripts, or telemetry. The scanner may
 // count entries under some of these, but it does not open their contents.
@@ -95,23 +76,39 @@ const SENSITIVE_ENTRY_NAMES = new Set([
  * extension locations). Only the current platform's directories plus
  * always-present dot-directories are included.
  *
- * @returns {Array<{tool: string, name: string, dirs: string[], supportDirs?: string[]}>}
+ * An entry may also name `mcpConfigs`, the files and keys where the tool
+ * lists its MCP servers, and `ide`, the IDE_PRODUCTS id of the editor the tool
+ * ships in, whose installed version and extensions folder it then reports.
+ *
+ * @param {string} [home] Home directory to resolve the folders against
+ * @returns {Array<{tool: string, name: string, dirs: string[], supportDirs?: string[], mcpConfigs?: Array<{file: string, key: string}>, ide?: string}>}
  *   One entry per known agentic CLI tool.
  */
-export function getAgenticToolDirs() {
-  const home = homedir();
+export function getAgenticToolDirs(home = homedir()) {
+  // These variables describe the current user, so another home, such as a
+  // fixture or another user's home, uses the defaults.
+  const ownHome = home === homedir();
   const appData =
-    readEnvironmentVariable("APPDATA") || join(home, "AppData", "Roaming");
+    (ownHome && readEnvironmentVariable("APPDATA")) ||
+    join(home, "AppData", "Roaming");
   const xdgConfigHome =
-    readEnvironmentVariable("XDG_CONFIG_HOME") || join(home, ".config");
+    (ownHome && readEnvironmentVariable("XDG_CONFIG_HOME")) ||
+    join(home, ".config");
   const xdgDataHome =
-    readEnvironmentVariable("XDG_DATA_HOME") || join(home, ".local", "share");
+    (ownHome && readEnvironmentVariable("XDG_DATA_HOME")) ||
+    join(home, ".local", "share");
 
   return [
     {
       tool: "kiro-cli",
       name: "Kiro CLI",
-      dirs: [join(home, ".kiro")],
+      // The Kiro editor also creates ~/.kiro, so the CLI is recognised by the
+      // files only the CLI writes there.
+      dirs: [
+        join(home, ".kiro", "settings", "cli.json"),
+        join(home, ".kiro", "sessions", "cli"),
+      ],
+      homeDir: join(home, ".kiro"),
       supportDirs: isWin
         ? [join(appData, "kiro-cli")]
         : isMac
@@ -136,6 +133,8 @@ export function getAgenticToolDirs() {
       tool: "claude-code",
       name: "Claude Code",
       dirs: [join(home, ".claude")],
+      // User-scope MCP servers live in ~/.claude.json, beside the folder.
+      mcpConfigs: [{ file: join(home, ".claude.json"), key: "mcpServers" }],
     },
     {
       tool: "codex",
@@ -161,11 +160,111 @@ export function getAgenticToolDirs() {
       tool: "cursor",
       name: "Cursor",
       dirs: [join(home, ".cursor")],
+      mcpConfigs: [{ file: "mcp.json", key: "mcpServers" }],
+      ide: "cursor",
     },
     {
       tool: "windsurf",
       name: "Windsurf",
       dirs: [join(home, ".codeium", "windsurf")],
+      mcpConfigs: [{ file: "mcp_config.json", key: "mcpServers" }],
+      ide: "windsurf",
+    },
+    {
+      tool: "devin-desktop",
+      name: "Devin Desktop",
+      dirs: [join(home, ".devin")],
+      mcpConfigs: [
+        {
+          file: join(xdgConfigHome, "devin", "config.json"),
+          key: "mcpServers",
+        },
+      ],
+      ide: "devin-desktop",
+    },
+    {
+      tool: "kiro",
+      name: "Kiro",
+      // Kiro and Kiro CLI share ~/.kiro; the IDE is told apart by its
+      // extensions folder.
+      dirs: [join(home, ".kiro", "extensions")],
+      homeDir: join(home, ".kiro"),
+      mcpConfigs: [{ file: join("settings", "mcp.json"), key: "mcpServers" }],
+      ide: "kiro",
+    },
+    {
+      tool: "trae",
+      name: "Trae",
+      dirs: [join(home, ".trae")],
+      ide: "trae",
+    },
+    {
+      tool: "antigravity",
+      name: "Antigravity",
+      dirs: [join(home, ".antigravity")],
+      ide: "antigravity",
+    },
+    {
+      tool: "antigravity-ide",
+      name: "Antigravity IDE",
+      dirs: [join(home, ".antigravity-ide")],
+      ide: "antigravity-ide",
+    },
+    {
+      tool: "qoder",
+      name: "Qoder",
+      dirs: [join(home, ".qoder")],
+      ide: "qoder",
+    },
+    {
+      tool: "void",
+      name: "Void",
+      dirs: [join(home, ".void-editor")],
+      ide: "void",
+    },
+    {
+      tool: "qwen-code",
+      name: "Qwen Code",
+      dirs: [join(home, ".qwen")],
+      mcpConfigs: [{ file: "settings.json", key: "mcpServers" }],
+    },
+    {
+      tool: "factory-droid",
+      name: "Factory Droid",
+      dirs: [join(home, ".factory")],
+      mcpConfigs: [{ file: "mcp.json", key: "mcpServers" }],
+    },
+    {
+      tool: "auggie",
+      name: "Augment Auggie CLI",
+      dirs: [join(home, ".augment")],
+      mcpConfigs: [{ file: "settings.json", key: "mcpServers" }],
+    },
+    {
+      tool: "continue",
+      name: "Continue",
+      dirs: [join(home, ".continue")],
+    },
+    {
+      tool: "cline-cli",
+      name: "Cline CLI",
+      dirs: [join(home, ".cline")],
+      mcpConfigs: [
+        {
+          file: join("data", "settings", "cline_mcp_settings.json"),
+          key: "mcpServers",
+        },
+      ],
+    },
+    {
+      tool: "claude-desktop",
+      name: "Claude Desktop",
+      dirs: isWin
+        ? [join(appData, "Claude")]
+        : isMac
+          ? [join(home, "Library", "Application Support", "Claude")]
+          : [join(xdgConfigHome, "Claude")],
+      mcpConfigs: [{ file: "claude_desktop_config.json", key: "mcpServers" }],
     },
     {
       tool: "goose",
@@ -184,11 +283,16 @@ export function getAgenticToolDirs() {
         join(home, ".config", "amp"),
         ...(isWin ? [join(appData, "amp")] : []),
       ],
+      mcpConfigs: [
+        { file: "settings.json", key: "amp.mcpServers" },
+        { file: "settings.jsonc", key: "amp.mcpServers" },
+      ],
     },
     {
       tool: "copilot-cli",
       name: "GitHub Copilot CLI",
       dirs: [join(home, ".copilot-cli"), join(home, ".copilot")],
+      mcpConfigs: [{ file: "mcp-config.json", key: "mcpServers" }],
     },
     {
       tool: "crush",
@@ -206,27 +310,52 @@ export function getAgenticToolDirs() {
  * Discover which agentic CLI tools are installed for the current user by
  * checking their known home directories.
  *
- * @returns {Array<{tool: string, name: string, dir: string, supportDir?: string}>}
+ * @param {string} [home] Home directory to resolve the folders against
+ * @returns {Array<{tool: string, name: string, dir: string, supportDir?: string, mcpConfigs?: Object[], ide?: string}>}
  *   One entry per discovered tool, using the first existing directory.
  */
-export function discoverAgenticTools() {
+export function discoverAgenticTools(home = homedir()) {
   const found = [];
-  for (const entry of getAgenticToolDirs()) {
-    const dir = entry.dirs.find((candidate) => safeExistsSync(candidate));
-    if (!dir) {
+  for (const entry of getAgenticToolDirs(home)) {
+    const marker = entry.dirs.find((candidate) => safeExistsSync(candidate));
+    if (!marker) {
       continue;
     }
     const supportDir = (entry.supportDirs || []).find((candidate) =>
       safeExistsSync(candidate),
     );
-    found.push({ tool: entry.tool, name: entry.name, dir, supportDir });
+    found.push({
+      tool: entry.tool,
+      name: entry.name,
+      dir: entry.homeDir || marker,
+      supportDir,
+      mcpConfigs: entry.mcpConfigs,
+      ide: entry.ide,
+    });
   }
   return found;
 }
 
+// Largest tool configuration file read. ~/.claude.json keeps per-project state
+// and grows with use, so the cap is generous; it only has to stop a FIFO, a
+// device or a runaway file from stalling the scan or exhausting memory.
+const MAX_CONFIG_FILE_BYTES = 64 * 1024 * 1024;
+
+/**
+ * Read a tool configuration file only when it is a regular file of bounded
+ * size. A FIFO or a device reads as undefined, and so does a symlink when the
+ * scan runs as root.
+ *
+ * @param {string} filePath Absolute path
+ * @returns {string|undefined} File text, or undefined
+ */
+function readConfigText(filePath) {
+  return readUserFileText(filePath, MAX_CONFIG_FILE_BYTES);
+}
+
 function parseJsonFile(filePath) {
   try {
-    return parseJsonLikeText(readFileSync(filePath, "utf-8"));
+    return parseJsonLikeText(readConfigText(filePath));
   } catch {
     return undefined;
   }
@@ -335,7 +464,52 @@ function countDirEntries(dirPath, filterFn) {
  * @param {string} [supportDir] Optional platform support directory
  * @returns {string|undefined} Version string when found
  */
+/**
+ * Read a semver-like version from the start of a release folder name such as
+ * `2.1.278` or `0.137.0-aarch64-apple-darwin`.
+ *
+ * @param {string} name Folder name
+ * @returns {string|undefined} The version, or undefined
+ */
+function versionFromReleaseName(name) {
+  const match = /^v?(\d+\.\d+\.\d+)/u.exec(`${name || ""}`);
+  return match ? match[1] : undefined;
+}
+
+/**
+ * Follow a launcher symlink that points into a per-version folder, as the
+ * native Claude Code and Codex installers do, and read the version from the
+ * folder name.
+ *
+ * @param {string} linkPath Launcher or `current` symlink
+ * @returns {string|undefined} The version, or undefined
+ */
+function versionFromReleaseLink(linkPath) {
+  try {
+    return versionFromReleaseName(basename(realpathSync(linkPath)));
+  } catch {
+    return undefined;
+  }
+}
+
 function readToolVersion(tool, dir, supportDir) {
+  if (tool === "claude-code") {
+    const home = dirname(dir);
+    const version =
+      versionFromReleaseLink(join(home, ".local", "bin", "claude")) ||
+      versionFromReleaseLink(join(home, ".claude", "local", "claude"));
+    if (version) {
+      return version;
+    }
+  }
+  if (tool === "codex") {
+    const version = versionFromReleaseLink(
+      join(dir, "packages", "standalone", "current"),
+    );
+    if (version) {
+      return version;
+    }
+  }
   const candidates = [];
   if (tool === "opencode") {
     // ~/.opencode/package.json pins the installed opencode plugin runtime,
@@ -370,7 +544,7 @@ function readToolVersion(tool, dir, supportDir) {
       }
     } else {
       try {
-        const raw = readFileSync(candidate, "utf-8").trim();
+        const raw = (readConfigText(candidate) || "").trim();
         if (/^v?\d+\.\d+/.test(raw)) {
           return raw.replace(/^v/, "");
         }
@@ -476,7 +650,7 @@ function countCodexSignals(dir) {
     return signals;
   }
   try {
-    const config = parseToml(readFileSync(configPath, "utf-8"));
+    const config = parseToml(readConfigText(configPath) || "");
     if (config?.mcp_servers && typeof config.mcp_servers === "object") {
       signals.mcpServerCount = Object.keys(config.mcp_servers).length;
     }
@@ -488,24 +662,35 @@ function countCodexSignals(dir) {
 
 function countCursorSignals(dir) {
   const signals = {};
-  const mcpConfig = parseJsonFile(join(dir, "mcp.json"));
-  if (mcpConfig?.mcpServers && typeof mcpConfig.mcpServers === "object") {
-    signals.mcpServerCount = Object.keys(mcpConfig.mcpServers).length;
-  }
   const agentsDir = join(dir, "agents");
   if (safeExistsSync(agentsDir)) {
     signals.agentCount = countDirEntries(agentsDir, (name) =>
       name.endsWith(".md"),
     );
   }
-  return signals;
-}
-
-function countWindsurfSignals(dir) {
-  const signals = {};
-  const mcpConfig = parseJsonFile(join(dir, "mcp_config.json"));
-  if (mcpConfig?.mcpServers && typeof mcpConfig.mcpServers === "object") {
-    signals.mcpServerCount = Object.keys(mcpConfig.mcpServers).length;
+  const rulesDir = join(dir, "rules");
+  if (safeExistsSync(rulesDir)) {
+    signals.ruleCount = countDirEntries(rulesDir, (name) =>
+      /\.(md|mdc)$/u.test(name),
+    );
+  }
+  for (const [skillsDir, key] of [
+    [join(dir, "skills"), "skillCount"],
+    [join(dir, "skills-cursor"), "bundledSkillCount"],
+  ]) {
+    if (safeExistsSync(skillsDir)) {
+      signals[key] = countDirEntries(skillsDir);
+    }
+  }
+  // The Cursor CLI keeps its tool permissions in cli-config.json. Only the
+  // number of rules is recorded, not the commands or paths they name.
+  const cliConfig = parseJsonFile(join(dir, "cli-config.json"));
+  const permissions = cliConfig?.permissions;
+  if (Array.isArray(permissions?.allow)) {
+    signals.cliAllowRuleCount = permissions.allow.length;
+  }
+  if (Array.isArray(permissions?.deny)) {
+    signals.cliDenyRuleCount = permissions.deny.length;
   }
   return signals;
 }
@@ -514,7 +699,7 @@ function countGooseSignals(dir) {
   const signals = {};
   // Goose keeps its resolved extension set in config.yaml.
   try {
-    const config = loadYaml(readFileSync(join(dir, "config.yaml"), "utf-8"));
+    const config = loadYaml(readConfigText(join(dir, "config.yaml")) || "");
     if (Array.isArray(config?.extensions)) {
       signals.extensionCount = config.extensions.length;
     }
@@ -546,6 +731,81 @@ function countGeminiSignals(dir) {
   return signals;
 }
 
+function countClaudeDesktopSignals(dir) {
+  const signals = {};
+  // Desktop extensions (.mcpb/.dxt) each bundle an MCP server.
+  const extensionsDir = join(dir, "Claude Extensions");
+  if (safeExistsSync(extensionsDir)) {
+    signals.extensionCount = countDirEntries(extensionsDir);
+  }
+  return signals;
+}
+
+/**
+ * Count the MCP servers a tool lists across its configuration files. A server
+ * named in two files is counted once.
+ *
+ * @param {string} dir Tool home directory, which relative files resolve against
+ * @param {Array<{file: string, key: string}>} [mcpConfigs] Files and the key
+ *   holding the server map. A key is looked up as written first, so a dotted
+ *   key such as `amp.mcpServers` matches a literal property.
+ * @returns {number|undefined} Number of servers, or undefined when no file
+ *   defines any
+ */
+export function countConfiguredMcpServers(dir, mcpConfigs) {
+  const names = new Set();
+  let sawConfig = false;
+  for (const { file, key } of mcpConfigs || []) {
+    const config = parseJsonFile(isAbsolute(file) ? file : join(dir, file));
+    if (!config || typeof config !== "object") {
+      continue;
+    }
+    let servers = config[key];
+    if (servers === undefined && key.includes(".")) {
+      servers = key.split(".").reduce((value, part) => value?.[part], config);
+    }
+    if (servers && typeof servers === "object" && !Array.isArray(servers)) {
+      sawConfig = true;
+      for (const name of Object.keys(servers)) {
+        names.add(name);
+      }
+    }
+  }
+  return sawConfig ? names.size : undefined;
+}
+
+/**
+ * Describe the editor an agentic tool ships in: its installed version and
+ * how many extensions are in its extensions folder.
+ *
+ * @param {string} ideId Entry id from IDE_PRODUCTS
+ * @param {string} home Home directory
+ * @returns {{version?: string, installDir?: string, extensionCount?: number}}
+ *   What could be read
+ */
+function describeAgenticIde(ideId, home) {
+  const product = IDE_PRODUCTS.find((p) => p.id === ideId);
+  if (!product) {
+    return {};
+  }
+  const info = findIdeProductInfo({ id: ideId, kind: "desktop" }, home);
+  const result = {};
+  if (info?.version) {
+    result.version = info.version;
+  }
+  if (info?.appDir) {
+    result.installDir = info.appDir;
+  }
+  const extensionsDir = join(home, product.dataFolderName, "extensions");
+  if (safeExistsSync(extensionsDir)) {
+    result.extensionCount = countDirEntries(
+      extensionsDir,
+      (name) => !name.startsWith(".") && name !== "extensions.json",
+    );
+  }
+  return result;
+}
+
 /**
  * Compute safe, redacted signal counts for a discovered tool. Only structural
  * counts and small enumerated values are returned; no credential, transcript,
@@ -554,9 +814,34 @@ function countGeminiSignals(dir) {
  * @param {string} tool Tool key
  * @param {string} dir Discovered tool home directory
  * @param {string} [supportDir] Optional platform support directory
+ * @param {Array<{file: string, key: string}>} [mcpConfigs] Files that list
+ *   the tool's MCP servers, used when the tool has no reader of its own
+ * @param {string} [home] Home directory the tool was found in
  * @returns {Object} Map of signal name to count/boolean/small-string value
  */
-export function collectToolSignals(tool, dir, supportDir) {
+export function collectToolSignals(
+  tool,
+  dir,
+  supportDir,
+  mcpConfigs,
+  home = homedir(),
+) {
+  const signals = toolSpecificSignals(tool, dir, supportDir);
+  if (signals.mcpServerCount === undefined) {
+    const mcpServerCount = countConfiguredMcpServers(
+      dir,
+      mcpConfigs ||
+        getAgenticToolDirs(home).find((entry) => entry.tool === tool)
+          ?.mcpConfigs || [{ file: ".mcp.json", key: "mcpServers" }],
+    );
+    if (mcpServerCount !== undefined) {
+      signals.mcpServerCount = mcpServerCount;
+    }
+  }
+  return signals;
+}
+
+function toolSpecificSignals(tool, dir, supportDir) {
   switch (tool) {
     case "kiro-cli":
       return countKiroSignals(dir, supportDir);
@@ -572,48 +857,60 @@ export function collectToolSignals(tool, dir, supportDir) {
       return countGeminiSignals(dir);
     case "cursor":
       return countCursorSignals(dir);
-    case "windsurf":
-      return countWindsurfSignals(dir);
+    case "claude-desktop":
+      return countClaudeDesktopSignals(dir);
     case "goose":
       return countGooseSignals(dir);
     case "crush":
       return countCrushSignals(dir);
-    default: {
-      // Generic fallback: count top-level, non-sensitive config entries.
-      const signals = {};
-      const mcpConfig = parseJsonFile(join(dir, ".mcp.json"));
-      if (mcpConfig?.mcpServers) {
-        signals.mcpServerCount = Object.keys(mcpConfig.mcpServers).length;
-      }
-      return signals;
-    }
+    default:
+      return {};
   }
 }
 
 /**
  * Build a CycloneDX application component for one discovered agentic tool.
  *
- * @param {{tool: string, name: string, dir: string, supportDir?: string}} entry
+ * @param {{tool: string, name: string, dir: string, supportDir?: string, mcpConfigs?: Object[], ide?: string}} entry
  *   Discovered tool entry
+ * @param {string} [home] Home directory, used to find the tool's editor
  * @returns {Object} CycloneDX component
  */
-export function componentForAgenticTool(entry) {
-  const { tool, name, dir, supportDir } = entry;
-  const version = readToolVersion(tool, dir, supportDir);
+export function componentForAgenticTool(entry, home = homedir()) {
+  const { tool, name, dir, supportDir, mcpConfigs, ide } = entry;
+  const ideInfo = ide ? describeAgenticIde(ide, home) : {};
+  const version = readToolVersion(tool, dir, supportDir) || ideInfo.version;
   const purl = buildGenericPurl(tool, version);
   const properties = [
-    { name: "internal:SrcFile", value: redactHomePath(dir) },
+    { name: "internal:SrcFile", value: redactHomePath(dir, home) },
     { name: "cdx:agentic:tool", value: tool },
-    { name: "cdx:agentic:home", value: redactHomePath(dir) },
+    { name: "cdx:agentic:home", value: redactHomePath(dir, home) },
     { name: "cdx:agentic:inventorySource", value: "host-scan" },
   ];
   if (supportDir) {
     properties.push({
       name: "cdx:agentic:supportDir",
-      value: redactHomePath(supportDir),
+      value: redactHomePath(supportDir, home),
     });
   }
-  const signals = collectToolSignals(tool, dir, supportDir);
+  // ~/.cursor or ~/.codeium/windsurf can exist with only a CLI or a plugin
+  // installed, so the editor is named only when it was found.
+  const ideFound =
+    Boolean(ide) &&
+    (ideInfo.installDir !== undefined || ideInfo.extensionCount !== undefined);
+  if (ideFound) {
+    properties.push({ name: "cdx:agentic:ide", value: ide });
+  }
+  if (ideInfo.installDir) {
+    properties.push({
+      name: "cdx:agentic:ideInstallDir",
+      value: redactHomePath(ideInfo.installDir, home),
+    });
+  }
+  const signals = collectToolSignals(tool, dir, supportDir, mcpConfigs, home);
+  if (ideInfo.extensionCount !== undefined) {
+    signals.extensionCount = ideInfo.extensionCount;
+  }
   for (const [key, value] of Object.entries(signals)) {
     if (value === undefined || value === null || value === "") {
       continue;
@@ -639,7 +936,12 @@ export function componentForAgenticTool(entry) {
   if (purl) {
     component.purl = purl;
   }
-  component.description = `${name} agentic CLI tool discovered on the host`;
+  component.description = ideFound
+    ? `${name} AI editor discovered on the host`
+    : `${name} agentic CLI tool discovered on the host`;
+  if (ideFound) {
+    component.tags.push("ai-ide");
+  }
   return component;
 }
 
@@ -656,9 +958,10 @@ function childBomRef(parentRef, kind, id) {
  *
  * @param {string} dir Kiro home directory
  * @param {string} parentRef Parent tool bom-ref
+ * @param {string} [home] Home directory the tool was found in, for redaction
  * @returns {Object[]} Child components
  */
-function parseKiroAgents(dir, parentRef) {
+function parseKiroAgents(dir, parentRef, home = homedir()) {
   const agentsDir = join(dir, "agents");
   if (!safeExistsSync(agentsDir)) {
     return [];
@@ -681,7 +984,7 @@ function parseKiroAgents(dir, parentRef) {
     const properties = [
       {
         name: "internal:SrcFile",
-        value: redactHomePath(join(agentsDir, file)),
+        value: redactHomePath(join(agentsDir, file), home),
       },
       { name: "cdx:agentic:tool", value: "kiro-cli" },
       { name: "cdx:agentic:kind", value: "agent-definition" },
@@ -725,9 +1028,10 @@ function parseKiroAgents(dir, parentRef) {
  *
  * @param {string} dir zcode home directory
  * @param {string} parentRef Parent tool bom-ref
+ * @param {string} [home] Home directory the tool was found in, for redaction
  * @returns {Object[]} Child components
  */
-function parseZcodePlugins(dir, parentRef) {
+function parseZcodePlugins(dir, parentRef, home = homedir()) {
   const cacheDir = join(dir, "cli", "plugins", "cache");
   if (!safeExistsSync(cacheDir)) {
     return [];
@@ -763,7 +1067,7 @@ function parseZcodePlugins(dir, parentRef) {
           typeof plugin.version === "string" ? plugin.version : undefined,
         );
         const properties = [
-          { name: "internal:SrcFile", value: redactHomePath(full) },
+          { name: "internal:SrcFile", value: redactHomePath(full, home) },
           { name: "cdx:agentic:tool", value: "zcode" },
           { name: "cdx:agentic:kind", value: "plugin" },
         ];
@@ -813,6 +1117,7 @@ function parseZcodePlugins(dir, parentRef) {
  *
  * @param {string} dir opencode home directory
  * @param {string} parentRef Parent tool bom-ref
+ * @param {string} [home] Home directory the tool was found in, for redaction
  * @returns {Object[]} Child components
  */
 /**
@@ -823,9 +1128,10 @@ function parseZcodePlugins(dir, parentRef) {
  *
  * @param {string} dir opencode home directory
  * @param {string} parentRef Parent tool bom-ref
+ * @param {string} [home] Home directory the tool was found in, for redaction
  * @returns {Object[]} Child provider services
  */
-function parseOpencodeProviders(dir, parentRef) {
+function parseOpencodeProviders(dir, parentRef, home = homedir()) {
   const jsonPath = join(dir, "opencode.json");
   const jsoncPath = join(dir, "opencode.jsonc");
   const usedPath = safeExistsSync(jsonPath) ? jsonPath : jsoncPath;
@@ -840,7 +1146,7 @@ function parseOpencodeProviders(dir, parentRef) {
       group: providerName,
       name: providerName,
       properties: [
-        { name: "internal:SrcFile", value: redactHomePath(usedPath) },
+        { name: "internal:SrcFile", value: redactHomePath(usedPath, home) },
         { name: "cdx:agentic:tool", value: "opencode" },
         { name: "cdx:agentic:kind", value: "provider" },
         { name: "cdx:ai:kind", value: "inference-service" },
@@ -857,18 +1163,25 @@ function parseOpencodeProviders(dir, parentRef) {
  * @param {string} tool Tool key
  * @param {string} dir Tool home directory
  * @param {string} parentRef Parent tool bom-ref
+ * @param {string} [home] Home directory the tool was found in, for redaction
  * @returns {{components: Object[], services: Object[]}} Child inventory
  */
-function collectToolChildren(tool, dir, parentRef) {
+function collectToolChildren(tool, dir, parentRef, home = homedir()) {
   switch (tool) {
     case "kiro-cli":
-      return { components: parseKiroAgents(dir, parentRef), services: [] };
+      return {
+        components: parseKiroAgents(dir, parentRef, home),
+        services: [],
+      };
     case "zcode":
-      return { components: parseZcodePlugins(dir, parentRef), services: [] };
+      return {
+        components: parseZcodePlugins(dir, parentRef, home),
+        services: [],
+      };
     case "opencode":
       return {
         components: [],
-        services: parseOpencodeProviders(dir, parentRef),
+        services: parseOpencodeProviders(dir, parentRef, home),
       };
     default:
       return { components: [], services: [] };
@@ -882,22 +1195,29 @@ function collectToolChildren(tool, dir, parentRef) {
  *
  * This host scan is unconditional: it does not consult scan filters such as
  * `--exclude` or profile/technique options, because it inventories fixed tool
- * home directories rather than a project tree. The `options` argument is
- * accepted for signature parity and is intentionally not used to alter results.
+ * home directories rather than a project tree.
  *
- * @param {Object} [options={}] Collection options (accepted but not applied)
+ * @param {Object} [options={}] Collection options
+ * @param {string} [options.home] Home directory to scan, defaulting to the
+ *   current user's
  * @returns {{components: Object[], services: Object[], dependencies: Object[]}} Discovered inventory
  */
-export function collectAgenticTools(_options = {}) {
+export function collectAgenticTools(options = {}) {
   const components = [];
   const services = [];
   const dependencies = [];
-  for (const entry of discoverAgenticTools()) {
+  const home = options.home || homedir();
+  for (const entry of discoverAgenticTools(home)) {
     try {
-      const toolComponent = componentForAgenticTool(entry);
+      const toolComponent = componentForAgenticTool(entry, home);
       components.push(toolComponent);
       const parentRef = toolComponent["bom-ref"];
-      const children = collectToolChildren(entry.tool, entry.dir, parentRef);
+      const children = collectToolChildren(
+        entry.tool,
+        entry.dir,
+        parentRef,
+        home,
+      );
       const childRefs = [];
       if (children.components.length) {
         components.push(...children.components);