@cdxgen/cdxgen 13.5.0 → 13.6.0

package/lib/cli/jsBom.js

@@ -70,9 +70,13 @@ import {
 } from "../helpers/agenticToolutils.js";
 import {
   cleanupTempDir,
-  collectInstalledExtensions,
+  collectIdeInventory,
   discoverIdeExtensionDirs,
   extractVsixToTempDir,
+  identifyIdeFromExtensionsDir,
+  isInstalledExtensionDir,
+  isInstalledExtensionsDir,
+  mergeExtensionComponents,
   parseVsixFile,
   VSCODE_EXTENSION_PURL_TYPE,
 } from "../helpers/vsixutils.js";
@@ -96,6 +100,7 @@ import {
 } from "../inventory/depsUtils.js";
 import { GIT_COMMAND } from "../inventory/envcontext.js";
 import { tryBuildPurl } from "../inventory/purl.js";
+import { isInsideInstalledGem } from "../inventory/rubyBuildInfo.js";
 import { DEFAULT_NPMRC_BLOCKLIST, parseNpmrc } from "../parsers/npmrc.js";
 import {
   buildBomNSData,
@@ -127,6 +132,13 @@ const isWin = _platform() === "win32";
  * @param {object} options CLI options
  * @returns {string|undefined} The detected AI inventory type (`"ai"`) or undefined
  */
+// The manifests and lockfiles inside an installed gem, such as the VS Code
+// extension typeprof ships, are part of the gem's sources and install nothing.
+// An image scan reads each gem home as a directory of its own, so the check is
+// on the absolute path rather than a glob relative to the scanned directory.
+const outsideInstalledGems = (files, scanRoot) =>
+  files.filter((file) => !isInsideInstalledGem(file, safeExistsSync, scanRoot));
+
 export function getDirectAiInventoryType(path, options) {
   const exactAiInventoryType = getExactAiInventoryType(options);
   if (exactAiInventoryType) {
@@ -166,6 +178,9 @@ export async function createNodejsBom(path, options) {
   let dependencies = [];
   let parentComponent = {};
   const parentSubComponents = [];
+  // Formulation components reported by the pnpm lockfiles, such as the
+  // pnpm version resolved for the project.
+  const pnpmFormulationList = [];
   let ppurl = "";
   const exactAiInventoryType = getDirectAiInventoryType(path, options);
   const requestedAiInventoryTypes = getRequestedAiInventoryTypes(options);
@@ -225,7 +240,10 @@ export async function createNodejsBom(path, options) {
   }
   // Docker mode requires special handling
   if (hasAnyProjectType(["docker", "oci", "container", "os"], options, false)) {
-    const pkgJsonFiles = getAllFiles(path, "**/package.json", options);
+    const pkgJsonFiles = outsideInstalledGems(
+      getAllFiles(path, "**/package.json", options),
+      path,
+    );
     // Are there any package.json files in the container?
     if (pkgJsonFiles.length) {
       // Every manifest is read locally first, and the registry is asked about
@@ -314,33 +332,48 @@ export async function createNodejsBom(path, options) {
   // otherwise the dependencies of those nested projects are silently dropped
   // from the BOM (see #4224). node_modules and .git stay ignored by getAllFiles.
   const lockSearchOptions = { ...options, includeDot: true };
-  let yarnLockFiles = getAllFiles(
+  let yarnLockFiles = outsideInstalledGems(
+    getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}yarn.lock`,
+      lockSearchOptions,
+    ),
     path,
-    `${options.multiProject ? "**/" : ""}yarn.lock`,
-    lockSearchOptions,
   );
-  const shrinkwrapFiles = getAllFiles(
+  const shrinkwrapFiles = outsideInstalledGems(
+    getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}npm-shrinkwrap.json`,
+      lockSearchOptions,
+    ),
     path,
-    `${options.multiProject ? "**/" : ""}npm-shrinkwrap.json`,
-    lockSearchOptions,
   );
-  let pkgLockFiles = getAllFiles(
+  let pkgLockFiles = outsideInstalledGems(
+    getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}package-lock.json`,
+      lockSearchOptions,
+    ),
     path,
-    `${options.multiProject ? "**/" : ""}package-lock.json`,
-    lockSearchOptions,
   );
   if (shrinkwrapFiles.length) {
     pkgLockFiles = pkgLockFiles.concat(shrinkwrapFiles);
   }
-  let pnpmLockFiles = getAllFiles(
+  let pnpmLockFiles = outsideInstalledGems(
+    getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}pnpm-lock.yaml`,
+      lockSearchOptions,
+    ),
     path,
-    `${options.multiProject ? "**/" : ""}pnpm-lock.yaml`,
-    lockSearchOptions,
   );
-  const bunLockFiles = getAllFiles(
+  const bunLockFiles = outsideInstalledGems(
+    getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}bun.lock`,
+      lockSearchOptions,
+    ),
     path,
-    `${options.multiProject ? "**/" : ""}bun.lock`,
-    lockSearchOptions,
   );
   // Warn about the binary bun lockfile which cdxgen cannot parse. Users should
   // regenerate a text lockfile with `bun install --save-text-lockfile`.
@@ -476,15 +509,21 @@ export async function createNodejsBom(path, options) {
       }
     }
   }
-  const pkgJsonLockFiles = getAllFiles(
+  const pkgJsonLockFiles = outsideInstalledGems(
+    getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}package-lock.json`,
+      lockSearchOptions,
+    ),
     path,
-    `${options.multiProject ? "**/" : ""}package-lock.json`,
-    lockSearchOptions,
   );
-  const pkgJsonFiles = getAllFiles(
+  const pkgJsonFiles = outsideInstalledGems(
+    getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}package.json`,
+      lockSearchOptions,
+    ),
     path,
-    `${options.multiProject ? "**/" : ""}package.json`,
-    lockSearchOptions,
   );
   const npmInstallCount =
     Number.parseInt(readEnvironmentVariable("NPM_INSTALL_COUNT"), 10) || 2;
@@ -708,20 +747,29 @@ export async function createNodejsBom(path, options) {
         anyInstallSuccess = true;
       }
     }
-    pkgLockFiles = getAllFiles(
+    pkgLockFiles = outsideInstalledGems(
+      getAllFiles(
+        path,
+        `${options.multiProject ? "**/" : ""}package-lock.json`,
+        options,
+      ),
       path,
-      `${options.multiProject ? "**/" : ""}package-lock.json`,
-      options,
     );
-    pnpmLockFiles = getAllFiles(
+    pnpmLockFiles = outsideInstalledGems(
+      getAllFiles(
+        path,
+        `${options.multiProject ? "**/" : ""}pnpm-lock.yaml`,
+        options,
+      ),
       path,
-      `${options.multiProject ? "**/" : ""}pnpm-lock.yaml`,
-      options,
     );
-    yarnLockFiles = getAllFiles(
+    yarnLockFiles = outsideInstalledGems(
+      getAllFiles(
+        path,
+        `${options.multiProject ? "**/" : ""}yarn.lock`,
+        options,
+      ),
       path,
-      `${options.multiProject ? "**/" : ""}yarn.lock`,
-      options,
     );
     if (
       anyInstallSuccess &&
@@ -743,7 +791,6 @@ export async function createNodejsBom(path, options) {
     const workspaceSrcFiles = {};
     const workspaceDirectDeps = {};
     const depsWorkspaceRefs = {};
-    let workspaceCatalogs = {};
     const seenPkgJsonFiles = {};
     // Is this a pnpm workspace?
     for (const f of pnpmWorkspaceFiles) {
@@ -832,10 +879,6 @@ export async function createNodejsBom(path, options) {
           }
         }
       }
-      workspaceCatalogs = {
-        ...workspaceCatalogs,
-        ...(workspaceObj.catalogs || {}),
-      };
     }
     if (DEBUG_MODE && Object.keys(seenPkgJsonFiles).length) {
       console.log(
@@ -898,11 +941,13 @@ export async function createNodejsBom(path, options) {
         parentComponent,
         workspacePackages,
         workspaceSrcFiles,
-        workspaceCatalogs,
         workspaceDirectDeps,
         depsWorkspaceRefs,
         path,
       );
+      if (parsedList?.formulationList?.length) {
+        pnpmFormulationList.push(...parsedList.formulationList);
+      }
       const dlist = parsedList.pkgList;
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
@@ -1043,7 +1088,6 @@ export async function createNodejsBom(path, options) {
         {},
         {},
         {},
-        {},
         path,
       );
       let pkgList = addWasmComponentsFromImports(
@@ -1554,6 +1598,7 @@ export async function createNodejsBom(path, options) {
     dependencies,
     parentComponent,
     services: inventoryServices,
+    formulationList: pnpmFormulationList,
   });
 }
 
@@ -1724,12 +1769,13 @@ export async function createVscodeExtensionBom(path, options) {
   // Mode 1: Scan for .vsix files in the given directory, or treat the input
   // path as a single .vsix file.
   let vsixFiles = [];
-  if (path.endsWith(".vsix")) {
+  const isVsixPath = path.toLowerCase().endsWith(".vsix");
+  if (isVsixPath) {
     vsixFiles = [resolve(path)];
   } else {
     vsixFiles = getAllFiles(
       path,
-      `${options.multiProject ? "**/" : ""}*.vsix`,
+      `${options.multiProject ? "**/" : ""}*.{vsix,VSIX,Vsix}`,
       options,
     );
   }
@@ -1764,32 +1810,68 @@ export async function createVscodeExtensionBom(path, options) {
     }
   }
 
-  // Mode 2: Auto-discover extensions from known IDE locations
-  if (shouldDiscoverInstalledIdeExtensions) {
-    const ideDirs = discoverIdeExtensionDirs();
-    if (ideDirs.length) {
+  // Mode 2: The path is an editor's extensions folder, such as
+  // ~/.cursor/extensions copied off a workstation, or one extension in such a
+  // folder. A source repository that contains an extension is neither. The
+  // editor's own version is looked up beside the folder, never among this
+  // machine's installed applications.
+  const resolvedPath = resolve(path);
+  const pathIdeDirs = [];
+  const pathFolder = (dir, only) => {
+    const ide = identifyIdeFromExtensionsDir(dir);
+    return {
+      ...(ide || { name: undefined }),
+      dir,
+      only,
+      probeApps: false,
+    };
+  };
+  if (!isVsixPath && safeExistsSync(resolvedPath)) {
+    if (isInstalledExtensionsDir(resolvedPath)) {
+      pathIdeDirs.push(pathFolder(resolvedPath));
+    } else if (
+      isInstalledExtensionsDir(dirname(resolvedPath)) &&
+      isInstalledExtensionDir(resolvedPath)
+    ) {
+      pathIdeDirs.push(
+        pathFolder(dirname(resolvedPath), basename(resolvedPath)),
+      );
+    }
+  }
+
+  // Mode 3: Auto-discover extensions from known IDE locations when the path
+  // held nothing to scan, so `cdxgen -t ide` in any folder reads this host
+  // while `cdxgen -t ide <folder of .vsix files>` reads only that folder.
+  const hostIdeDirs =
+    shouldDiscoverInstalledIdeExtensions &&
+    !pathIdeDirs.length &&
+    !vsixFiles.length
+      ? discoverIdeExtensionDirs()
+      : [];
+  if (hostIdeDirs.length && DEBUG_MODE) {
+    console.log(
+      `Discovered IDE extension directories: ${hostIdeDirs.map((d) => `${d.name}: ${d.dir}`).join(", ")}`,
+    );
+  }
+  const ideDirs = [...pathIdeDirs, ...hostIdeDirs];
+  if (ideDirs.length) {
+    const inventory = collectIdeInventory(ideDirs);
+    if (inventory.components.length) {
       if (DEBUG_MODE) {
         console.log(
-          `Discovered IDE extension directories: ${ideDirs.map((d) => `${d.name}: ${d.dir}`).join(", ")}`,
+          `Found ${inventory.components.length} IDE and extension component(s) in ${ideDirs.length} folder(s)`,
         );
       }
-      const ideExtensions = collectInstalledExtensions(ideDirs);
-      if (ideExtensions.length) {
-        if (DEBUG_MODE) {
-          console.log(
-            `Found ${ideExtensions.length} IDE extension(s) from ${ideDirs.length} IDE location(s)`,
-          );
-        }
-        pkgList = pkgList.concat(ideExtensions);
-        // Deep analysis for IDE extension directories
-        for (const ideDir of ideDirs) {
-          await analyzeInstalledExtensionDirs(
-            ideDir.dir,
-            options,
-            pkgList,
-            dependencies,
-          );
-        }
+      pkgList = pkgList.concat(inventory.components);
+      dependencies = mergeDependencies(dependencies, inventory.dependencies);
+      for (const ideDir of ideDirs) {
+        await analyzeInstalledExtensionDirs(
+          ideDir.dir,
+          options,
+          pkgList,
+          dependencies,
+          ideDir.only,
+        );
       }
     }
   }
@@ -1798,7 +1880,9 @@ export async function createVscodeExtensionBom(path, options) {
   for (const td of tempDirs) {
     cleanupTempDir(td);
   }
-  pkgList = trimComponents(pkgList);
+  // A .vsix and the folder it was installed into describe one build; merge
+  // them before trimComponents keeps only the first.
+  pkgList = trimComponents(mergeExtensionComponents(pkgList));
   return buildBomNSData(options, pkgList, VSCODE_EXTENSION_PURL_TYPE, {
     src: path,
     filename: vsixFiles.join(", "),
@@ -2189,12 +2273,14 @@ export async function analyzeExtensionDir(extDir, options) {
  * @param {Object} options CLI options
  * @param {Object[]} pkgList Mutable array to push discovered components into
  * @param {Object[]} dependencies Mutable array to merge dependencies into
+ * @param {string} [onlyEntry] Analyze only this extension folder
  */
 export async function analyzeInstalledExtensionDirs(
   extensionsDir,
   options,
   pkgList,
   dependencies,
+  onlyEntry,
 ) {
   let entries;
   try {
@@ -2206,6 +2292,9 @@ export async function analyzeInstalledExtensionDirs(
     if (!entry.isDirectory() || entry.name.startsWith(".")) {
       continue;
     }
+    if (onlyEntry && entry.name !== onlyEntry) {
+      continue;
+    }
     const extDir = join(extensionsDir, entry.name);
     const deepResult = await analyzeExtensionDir(extDir, options);
     if (deepResult.pkgList.length) {