@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/parsers/kiroPermissions.js

@@ -0,0 +1,166 @@
+/**
+ * Summarize Kiro CLI V3 permission documents into policy-safe posture facts.
+ *
+ * Kiro V3 describes what an agent may do with `capability`/`effect` rules that
+ * live in an agent definition's `permissions` object, in the user-scope
+ * `~/.kiro/settings/permissions.yaml`, and in the per-workspace
+ * `~/.kiro/workspace-roots/<hash>/permissions.yaml`. The rules carry `match`
+ * pattern lists, free-text reasons, and paths, none of which belong in a BOM.
+ * This module reduces a document to counts, allowlisted effect counts,
+ * validated capability names, and booleans, and never returns the patterns or
+ * any other free text.
+ */
+
+// Effects documented at kiro.dev/docs/permissions. An unknown effect is
+// counted by `ruleCount` alone and by no per-effect counter.
+const KIRO_EFFECTS = new Set(["allow", "deny", "ask", "evaluate"]);
+
+// Policy presets that may be listed under the top-level `policies` key.
+// kiro.dev documents `approve-for-me`; other preset names are dropped rather
+// than copied, because the full set is not documented.
+const KIRO_POLICY_PRESET_ALLOWLIST = new Set(["approve-for-me"]);
+
+// A capability is a short lowercase token such as `fs_read`, `shell`, or the
+// meta-capability `all`. Anything outside this shape is dropped instead of
+// being copied into the BOM.
+const KIRO_CAPABILITY_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/u;
+
+const isPlainEntry = (value) =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+
+const sortedUnique = (values) => [...new Set(values)].sort();
+
+/**
+ * Decide whether a rule's `match` list holds at least one non-empty pattern.
+ *
+ * @param {unknown} match The rule's match value
+ * @returns {boolean} True when a non-empty string pattern is present
+ */
+const hasNonEmptyMatch = (match) =>
+  Array.isArray(match) &&
+  match.some((entry) => typeof entry === "string" && entry.trim() !== "");
+
+/**
+ * Summarize a Kiro V3 permission document.
+ *
+ * Accepts the parsed `permissions` object of an agent definition or a parsed
+ * `permissions.yaml` document. A bare rules array is accepted as well. The
+ * result carries only counts, booleans, and validated token lists; `match`
+ * patterns, `exclude` lists, reasons, and paths are never returned.
+ *
+ * @param {Object|Array|undefined} rulesOrDoc Parsed permissions object, YAML
+ *   document, or rules array
+ * @returns {{
+ *   ruleCount: number,
+ *   allowRuleCount: number,
+ *   denyRuleCount: number,
+ *   askRuleCount: number,
+ *   evaluateRuleCount: number,
+ *   capabilities: string[],
+ *   allowsAllCapabilities: boolean,
+ *   unrestrictedAllowCapabilities: string[],
+ *   workspaceTrusted: boolean|undefined,
+ *   policyPresets: string[],
+ *   unknownPolicyPresetCount: number,
+ * }} Permission posture summary
+ */
+export function summarizeKiroPermissions(rulesOrDoc) {
+  const doc = Array.isArray(rulesOrDoc) ? { rules: rulesOrDoc } : rulesOrDoc;
+  const rules = Array.isArray(doc?.rules) ? doc.rules : [];
+  let ruleCount = 0;
+  const effectCounts = { allow: 0, deny: 0, ask: 0, evaluate: 0 };
+  const capabilities = [];
+  const unrestrictedAllowCapabilities = [];
+  let allowsAllCapabilities = false;
+  for (const rule of rules) {
+    if (!isPlainEntry(rule)) {
+      continue;
+    }
+    ruleCount += 1;
+    if (typeof rule.effect === "string" && KIRO_EFFECTS.has(rule.effect)) {
+      effectCounts[rule.effect] += 1;
+    }
+    if (typeof rule.capability === "string") {
+      const capability = rule.capability;
+      if (KIRO_CAPABILITY_PATTERN.test(capability)) {
+        capabilities.push(capability);
+        if (rule.effect === "allow" && !hasNonEmptyMatch(rule.match)) {
+          unrestrictedAllowCapabilities.push(capability);
+          if (capability === "all") {
+            allowsAllCapabilities = true;
+          }
+        }
+      }
+    }
+  }
+  const listedPresets = Array.isArray(doc?.policies)
+    ? doc.policies.filter((entry) => typeof entry === "string")
+    : [];
+  // Preset names outside the allowlist are counted, never copied, so a
+  // reviewer still learns that an unrecognised preset is active.
+  const policyPresets = listedPresets.filter((entry) =>
+    KIRO_POLICY_PRESET_ALLOWLIST.has(entry),
+  );
+  const unknownPolicyPresetCount = new Set(
+    listedPresets.filter((entry) => !KIRO_POLICY_PRESET_ALLOWLIST.has(entry)),
+  ).size;
+  return {
+    allowRuleCount: effectCounts.allow,
+    allowsAllCapabilities,
+    askRuleCount: effectCounts.ask,
+    capabilities: sortedUnique(capabilities),
+    denyRuleCount: effectCounts.deny,
+    evaluateRuleCount: effectCounts.evaluate,
+    policyPresets: sortedUnique(policyPresets),
+    ruleCount,
+    unknownPolicyPresetCount,
+    unrestrictedAllowCapabilities: sortedUnique(unrestrictedAllowCapabilities),
+    ...(typeof doc?.workspaceTrusted === "boolean"
+      ? { workspaceTrusted: doc.workspaceTrusted }
+      : {}),
+  };
+}
+
+/**
+ * Flatten a permission summary into property suffix/value pairs.
+ *
+ * Both scans that consume Kiro permission documents emit the same suffixes;
+ * the host scan prefixes them with `cdx:agentic:` and the project scan with
+ * `cdx:agent:`. Values are numbers, booleans, or comma-separated validated
+ * tokens, so no free text reaches a BOM through this mapping.
+ *
+ * @param {ReturnType<summarizeKiroPermissions>} summary Permission posture summary
+ * @returns {Record<string, number|boolean|string>} Property suffix mapped to its value
+ */
+export function kiroPermissionSummaryEntries(summary) {
+  const entries = {
+    permissionAllowRuleCount: summary.allowRuleCount,
+    permissionAllowsAll: Boolean(summary.allowsAllCapabilities),
+    permissionAskRuleCount: summary.askRuleCount,
+    permissionDenyRuleCount: summary.denyRuleCount,
+    permissionEvaluateRuleCount: summary.evaluateRuleCount,
+    permissionRuleCount: summary.ruleCount,
+  };
+  // An empty list carries no information, so the property is omitted instead
+  // of being emitted with an empty value.
+  for (const [suffix, list] of [
+    ["permissionCapabilities", summary.capabilities],
+    [
+      "permissionUnrestrictedAllowCapabilities",
+      summary.unrestrictedAllowCapabilities,
+    ],
+    ["permissionPolicyPresets", summary.policyPresets],
+  ]) {
+    if (list?.length) {
+      entries[suffix] = list.join(",");
+    }
+  }
+  if (summary.unknownPolicyPresetCount) {
+    entries.permissionUnknownPolicyPresetCount =
+      summary.unknownPolicyPresetCount;
+  }
+  if (typeof summary.workspaceTrusted === "boolean") {
+    entries.permissionWorkspaceTrusted = summary.workspaceTrusted;
+  }
+  return entries;
+}

package/lib/parsers/largeJson.js

@@ -54,9 +54,20 @@ function applySpec(value, spec) {
     return value;
   }
   if (Array.isArray(value)) {
+    let elements = value;
+    if (spec.map) {
+      const mapped = [];
+      for (const element of elements) {
+        const transformed = spec.map(element);
+        if (transformed !== undefined) {
+          mapped.push(transformed);
+        }
+      }
+      elements = mapped;
+    }
     return spec.filter
-      ? value.filter((element) => spec.filter(element))
-      : value;
+      ? elements.filter((element) => spec.filter(element))
+      : elements;
   }
   if (!spec.members) {
     return value;
@@ -294,9 +305,10 @@ function scanObjectMembers(cursor, stopAt = undefined) {
   }
 }
 
-// Decode the array at the cursor in runs of whole elements, keeping those that
-// `filter` accepts.
-function readArrayElements(cursor, filter, batchBytes) {
+// Decode the array at the cursor in runs of whole elements, mapping each one
+// through `spec.map` (an undefined result drops it) and keeping those that
+// `spec.filter` accepts.
+function readArrayElements(cursor, spec, batchBytes) {
   if (cursor.nextToken() !== OPEN_BRACKET) {
     cursor.fail("Expected an array");
   }
@@ -310,8 +322,12 @@ function readArrayElements(cursor, filter, batchBytes) {
     for (const element of JSON.parse(
       `[${cursor.endCapture(cursor.pos - 1)}]`,
     )) {
-      if (!filter || filter(element)) {
-        elements.push(element);
+      const mapped = spec?.map ? spec.map(element) : element;
+      if (mapped === undefined) {
+        continue;
+      }
+      if (!spec?.filter || spec.filter(mapped)) {
+        elements.push(mapped);
       }
     }
   };
@@ -367,7 +383,7 @@ function decodeRange(fd, start, end, spec, options) {
       );
     }
   } else if (first === OPEN_BRACKET) {
-    value = readArrayElements(cursor, spec?.filter, options.batchBytes);
+    value = readArrayElements(cursor, spec, options.batchBytes);
   } else {
     // A string or number this large has no smaller parts; JSON.parse reports
     // it the way it would for the whole file.
@@ -449,9 +465,10 @@ export function readJsonMember(filePath, name, options = {}) {
  * more than a bounded run of it in one string.
  *
  * `spec` narrows what is kept. `{ members: { name: spec } }` keeps only the
- * named members of an object, each narrowed by its own spec. `{ filter }`
- * keeps the elements of an array that `filter(element)` accepts. Anything else
- * keeps the whole value.
+ * named members of an object, each narrowed by its own spec. `{ map }`
+ * transforms each element of an array, an undefined result dropping it, and
+ * `{ filter }` keeps the mapped elements that `filter(element)` accepts.
+ * Anything else keeps the whole value.
  *
  * @param {string} filePath JSON file
  * @param {{start: number, end: number}} range Byte range of the value, such as one returned by indexJsonObject

package/lib/parsers/vscodeExtensionId.js

@@ -0,0 +1,183 @@
+// The one place that reads the identity of an installed VS Code-family
+// extension from the name of its folder.
+//
+// An editor installs an extension into `<publisher>.<name>-<version>`, and a
+// platform-specific build into `<publisher>.<name>-<version>-<platform>`, for
+// example `anthropic.claude-code-2.1.313-darwin-arm64`. The extension scan and
+// the osquery `vscode_extensions` rows both name the extension from this, so an
+// extension found by `cdxgen -t vscode-extension` and by `obom` is the same
+// component with the same purl.
+
+/**
+ * Target platforms a VS Code-family marketplace publishes an extension for.
+ * `universal` and `web` builds are the same artefact on every platform and are
+ * not part of the extension's identity.
+ */
+export const VSCODE_TARGET_PLATFORMS = new Set([
+  "win32-x64",
+  "win32-arm64",
+  "win32-ia32",
+  "linux-x64",
+  "linux-arm64",
+  "linux-armhf",
+  "alpine-x64",
+  "alpine-arm64",
+  "darwin-x64",
+  "darwin-arm64",
+]);
+
+// Folder suffixes for builds that run on every platform.
+const NEUTRAL_PLATFORMS = ["universal", "web"];
+
+/**
+ * Normalize a target platform value from a manifest, an `extensions.json`
+ * record, or a folder name. Values that do not name a specific platform, such
+ * as `universal`, `web`, `undefined`, or an empty string, return an empty
+ * string.
+ *
+ * @param {string} value Raw target platform
+ * @returns {string} A value from VSCODE_TARGET_PLATFORMS, or an empty string
+ */
+export function normalizeVscodeTargetPlatform(value) {
+  const platform = `${value || ""}`.trim().toLowerCase();
+  return VSCODE_TARGET_PLATFORMS.has(platform) ? platform : "";
+}
+
+/**
+ * Split an installed extension folder name into its publisher, name, version
+ * and target platform.
+ *
+ * @param {string} dirName Folder name, such as `ms-python.python-2025.4.0` or
+ *   `anthropic.claude-code-2.1.313-darwin-arm64`
+ * @returns {{publisher: string, name: string, version: string, platform: string}|undefined}
+ *   The parts, or undefined when the name does not follow the pattern
+ */
+export function parseVscodeExtensionDirName(dirName) {
+  let value = `${dirName || ""}`.trim();
+  while (value.endsWith("/") || value.endsWith("\\")) {
+    value = value.slice(0, -1);
+  }
+  const dotIdx = value.indexOf(".");
+  if (dotIdx < 1) {
+    return undefined;
+  }
+  const publisher = value.substring(0, dotIdx);
+  let rest = value.substring(dotIdx + 1);
+  let platform = "";
+  for (const candidate of [...VSCODE_TARGET_PLATFORMS, ...NEUTRAL_PLATFORMS]) {
+    if (rest.toLowerCase().endsWith(`-${candidate}`)) {
+      platform = normalizeVscodeTargetPlatform(candidate);
+      rest = rest.substring(0, rest.length - candidate.length - 1);
+      break;
+    }
+  }
+  // Marketplaces require semver versions, so the version starts at the first
+  // hyphen whose remainder is a whole semver: `python-3.11-tools-1.0.0` is the
+  // name `python-3.11-tools` at 1.0.0, and `1.0.0-beta-2` stays one version.
+  // A folder whose version is not semver falls back to the first hyphen
+  // followed by digits and a dot.
+  let versionStart = -1;
+  let fallbackStart = -1;
+  for (let i = 1; i < rest.length - 2; i++) {
+    if (rest[i] !== "-" || !isDigit(rest[i + 1])) {
+      continue;
+    }
+    if (isSemver(rest.substring(i + 1))) {
+      versionStart = i;
+      break;
+    }
+    let j = i + 1;
+    while (j < rest.length && isDigit(rest[j])) {
+      j++;
+    }
+    if (fallbackStart < 0 && rest[j] === ".") {
+      fallbackStart = i;
+    }
+  }
+  if (versionStart < 0) {
+    versionStart = fallbackStart;
+  }
+  if (versionStart < 1) {
+    return undefined;
+  }
+  const name = rest.substring(0, versionStart);
+  const version = rest.substring(versionStart + 1);
+  if (!name || !version) {
+    return undefined;
+  }
+  return { publisher, name, version, platform };
+}
+
+function isDigit(character) {
+  return character >= "0" && character <= "9";
+}
+
+function isIdentifierList(text, numericNoLeadingZero) {
+  if (!text) {
+    return false;
+  }
+  return text.split(".").every((part) => {
+    if (!part.length) {
+      return false;
+    }
+    for (const character of part) {
+      const ok =
+        isDigit(character) ||
+        character === "-" ||
+        (character >= "a" && character <= "z") ||
+        (character >= "A" && character <= "Z");
+      if (!ok) {
+        return false;
+      }
+    }
+    if (numericNoLeadingZero && [...part].every(isDigit)) {
+      return part === "0" || part[0] !== "0";
+    }
+    return true;
+  });
+}
+
+/**
+ * Check a string is a semantic version: three numeric parts, then an optional
+ * `-prerelease` and `+build`.
+ *
+ * @param {string} text Candidate version
+ * @returns {boolean} true for a semver
+ */
+export function isSemver(text) {
+  const plus = text.indexOf("+");
+  const core = plus >= 0 ? text.substring(0, plus) : text;
+  if (plus >= 0 && !isIdentifierList(text.substring(plus + 1), false)) {
+    return false;
+  }
+  const dash = core.indexOf("-");
+  const numbers = dash >= 0 ? core.substring(0, dash) : core;
+  if (dash >= 0 && !isIdentifierList(core.substring(dash + 1), true)) {
+    return false;
+  }
+  const parts = numbers.split(".");
+  return (
+    parts.length === 3 &&
+    parts.every(
+      (part) =>
+        part.length > 0 &&
+        [...part].every(isDigit) &&
+        (part === "0" || part[0] !== "0"),
+    )
+  );
+}
+
+/**
+ * Read the target platform from the path of an installed extension folder.
+ *
+ * @param {string} extensionPath Path to the extension folder, with either
+ *   separator
+ * @returns {string} The target platform, or an empty string
+ */
+export function vscodeExtensionPlatformFromPath(extensionPath) {
+  const segments = `${extensionPath || ""}`
+    .split(/[/\\]/u)
+    .filter((segment) => segment.length);
+  const dirName = segments[segments.length - 1];
+  return parseVscodeExtensionDirName(dirName)?.platform || "";
+}

package/lib/server/server.js

@@ -14,7 +14,12 @@ import {
   isSecureMode,
   readEnvironmentVariable,
 } from "../core/activity.js";
-import { PROJECT_TYPE_ALIASES } from "../core/env.js";
+import { HOST_SCOPE_PROJECT_TYPES } from "../core/env.js";
+import {
+  boundUntrustedGlobPatterns,
+  UNTRUSTED_GLOB_EXPANSION_BUDGET,
+  UNTRUSTED_GLOB_PATTERN_MAX_LENGTH,
+} from "../core/globPatterns.js";
 import { isWin } from "../core/paths.js";
 import { isSecureModeActive } from "../core/projectTooling.js";
 import { resetRunState } from "../core/runState.js";
@@ -22,7 +27,11 @@ import { CDXGEN_VERSION } from "../core/state.js";
 import { installConsoleShim, ui } from "../core/ui.js";
 import { fetchPomXmlAsJson } from "../ecosystems/ecosystems.js";
 import { normalizeOutputFormats } from "../helpers/exportUtils.js";
-import { isCycloneDxBom } from "../inventory/bomUtils.js";
+import {
+  isCycloneDx20SpecVersion,
+  isCycloneDxBom,
+} from "../inventory/bomUtils.js";
+import { DEPENDENCY_TRACK_CDX20_ERROR } from "../inventory/cyclonedx20.js";
 import {
   cleanupSourceDir,
   findGitRefForPurlVersion,
@@ -227,27 +236,6 @@ function restrictRequestOptions(options, operatorOptions) {
   }
 }
 
-// Project types that inventory the host the server runs on, such as installed
-// packages, users, shell history, IDE and browser extensions, or the Maven,
-// Gradle, sbt, Cargo and Helm caches in the server user's home directory.
-// They ignore the scan path, so the path allowlist does not limit them.
-const HOST_SCOPE_PROJECT_TYPES = new Set(
-  [
-    "os",
-    "hbom",
-    "cargo-cache",
-    "helm-index",
-    "gradle-index",
-    "sbt-index",
-    "maven-index",
-    "vscode-extension",
-    "chrome-extension",
-    "agentic",
-  ]
-    .flatMap((key) => PROJECT_TYPE_ALIASES[key] || [key])
-    .concat(["maven-repo"]),
-);
-
 /**
  * Check request options that the server must refuse outright.
  *
@@ -270,22 +258,18 @@ export function validateRequestOptions(reqOptions, operatorOptions = {}) {
       details: `The '${hostScopeType}' project type scans the server host. Start the server with this type to allow it.`,
     };
   }
-  const excludes = Array.isArray(reqOptions.exclude)
-    ? reqOptions.exclude
-    : [reqOptions.exclude];
-  // Brace patterns expand before matching, so one short pattern such as
-  // {1..100000} can keep the server busy for minutes.
+  // Every exclude pattern is matched against every file the scan walks, and
+  // brace patterns expand before matching, so one short pattern such as
+  // {1..100000}, or a long enough list, can keep the server busy for minutes.
   if (
     reqOptions.exclude !== operatorOptions.exclude &&
-    excludes.some(
-      (e) => typeof e === "string" && (e.includes("{") || e.length > 512),
-    )
+    boundUntrustedGlobPatterns(reqOptions.exclude, { allowBraces: false })
+      .refused.length
   ) {
     return {
       status: 400,
       error: "Invalid Exclude Pattern",
-      details:
-        "Exclude patterns sent to the server cannot use braces or exceed 512 characters.",
+      details: `Exclude patterns sent to the server cannot use braces, exceed ${UNTRUSTED_GLOB_PATTERN_MAX_LENGTH} characters, or number more than ${UNTRUSTED_GLOB_EXPANSION_BUDGET}.`,
     };
   }
   if (
@@ -333,6 +317,19 @@ export function validateRequestOptions(reqOptions, operatorOptions = {}) {
         "Formulation data may contain secrets and is not submitted to Dependency-Track in secure mode.",
     };
   }
+  // Dependency-Track ingests CycloneDX 1.x only, so a request that would
+  // upload (server URL plus API key) cannot ask for the 2.0 draft.
+  if (
+    reqOptions.serverUrl &&
+    reqOptions.apiKey &&
+    isCycloneDx20SpecVersion(reqOptions.specVersion)
+  ) {
+    return {
+      status: 400,
+      error: "Unsupported Spec Version For Dependency-Track",
+      details: DEPENDENCY_TRACK_CDX20_ERROR,
+    };
+  }
   return null;
 }
 
@@ -659,7 +656,18 @@ const start = (options) => {
             );
           }
         }
-        cloneDir = gitClone(sourcePath, gitRef);
+        try {
+          cloneDir = gitClone(sourcePath, gitRef);
+        } catch (_err) {
+          console.log("Unable to clone repository. See the server log.");
+          res.writeHead(500, { "Content-Type": "application/json" });
+          return res.end(
+            JSON.stringify({
+              error: "Unable to clone repository",
+              details: "Cloning the repository failed. See the server log.",
+            }),
+          );
+        }
         srcDir = cloneDir;
         if (purlResolution?.type === "npm") {
           const cloneRootDir = cloneDir;
@@ -738,7 +746,12 @@ const start = (options) => {
         requestedFormats.includes("spdx") &&
         isCycloneDxBom(bomNSData?.bomJson)
       ) {
-        responseBomJson = convertCycloneDxToSpdx(bomNSData.bomJson, reqOptions);
+        // The SPDX converter reads the 1.x shape; at 2.0 that is the
+        // internal model rather than the rendered document.
+        responseBomJson = convertCycloneDxToSpdx(
+          bomNSData.internalBomJson ?? bomNSData.bomJson,
+          reqOptions,
+        );
       }
       if (reqOptions.serverUrl && reqOptions.apiKey) {
         let serverHostname;

package/lib/stages/postgen/postgen.js

@@ -31,6 +31,7 @@ import {
 } from "../../inventory/aiInventory.js";
 import {
   DEFAULT_CDX_SPEC_VERSION,
+  isCycloneDx20SpecVersion,
   normalizeCycloneDxComponentTypeFilter,
   normalizeCycloneDxSpecVersion,
 } from "../../inventory/bomUtils.js";
@@ -40,8 +41,13 @@ import {
   createCitation,
   findCdxgenToolBomRef,
 } from "../../inventory/citations.js";
+import {
+  CDX20_INTERNAL_SECTIONS_KEY,
+  renderCycloneDx20,
+} from "../../inventory/cyclonedx20.js";
 import { mergeDependencies, mergeServices } from "../../inventory/depsUtils.js";
 import { addFormulationSection } from "../../inventory/formulationParsers.js";
+import { hardwareRenderContext } from "../../inventory/hbomLoader.js";
 import { getContainerFileInventoryStats } from "../../inventory/inventoryStats.js";
 import { enhanceBom } from "../../inventory/licenseEnhancer.js";
 import { applyMcpPinningState } from "../../inventory/mcpPinning.js";
@@ -546,6 +552,13 @@ async function applyIntrospection(bomNSData, options, filePath) {
 /**
  * Filter and enhance BOM post generation.
  *
+ * At CycloneDX 2.0 the returned `bomNSData` carries two documents:
+ * `bomJson` is the rendered 2.0 document (what library users, the server and
+ * the writer see), and `internalBomJson` is the 1.x-shaped model the audit,
+ * evinse, display and SPDX-export readers use. `internalBomJson` is never
+ * serialized; `refreshRenderedBom` re-renders `bomJson` from it after any
+ * later mutation. At 1.x `internalBomJson` is unset.
+ *
  * @param {Object} bomNSData BOM with namespaces object
  * @param {Object} options CLI options
  * @param {string} [filePath] Source path used for formulation and metadata context
@@ -615,10 +628,37 @@ export async function postProcess(bomNSData, options, filePath) {
   ]);
   cleanupEnv(options);
   cleanupTmpDir();
-  sortBomCollections(bomNSData.bomJson);
+  // A model read from another 2.0 document keeps that document's originals,
+  // keyed by the exact 1.x form of each object, so an unchanged object
+  // renders back as it was. Sorting would change those forms, so such a
+  // model keeps its order; cdxgen's own BOMs are sorted for determinism.
+  if (!bomNSData.bomJson?.[CDX20_INTERNAL_SECTIONS_KEY]?.shadows) {
+    sortBomCollections(bomNSData.bomJson);
+  }
   // Reflection reads the finished BOM, so it runs after sorting; it returns
   // its verdict alongside the BOM instead of mutating it.
   await applyIntrospection(bomNSData, options, filePath);
+  // CycloneDX 2.0: everything above produced the 1.x-shaped model. Keep it on
+  // `internalBomJson` for the readers that run after postProcess (audit,
+  // evinse, display, SPDX export) and render the 2.0 document once, here.
+  // `refreshRenderedBom` re-renders after any later mutation of the model,
+  // with the same render context (the optional cdx-hbom hardware mapper,
+  // loaded only when the model has hardware components).
+  // At 1.x both stay untouched, so those outputs are byte-identical. The
+  // document's own specVersion decides when the caller passed none, which is
+  // how an evinse run over a 2.0 input stays at 2.0.
+  if (
+    isCycloneDx20SpecVersion(
+      options.specVersion ?? bomNSData.bomJson?.specVersion,
+    )
+  ) {
+    bomNSData.renderContext = await hardwareRenderContext(bomNSData.bomJson);
+    bomNSData.internalBomJson = bomNSData.bomJson;
+    bomNSData.bomJson = renderCycloneDx20(
+      bomNSData.bomJson,
+      bomNSData.renderContext,
+    );
+  }
   return bomNSData;
 }
 

package/lib/stages/postgen/ruleEngine.js

@@ -672,16 +672,21 @@ async function interpolateTemplate(template, context, options = {}) {
     return template;
   }
   const templateRegex = /\{\{\s*([^}]+)\s*}}/g;
-  let result = template;
-  const matches = [...template.matchAll(templateRegex)];
-  for (const match of matches) {
+  // The template is rebuilt from its own slices in one pass, so a value taken
+  // from the BOM is never scanned for {{ }} again and never read as a
+  // String.replace pattern such as `$&`.
+  let result = "";
+  let cursor = 0;
+  for (const match of template.matchAll(templateRegex)) {
     const [fullMatch, expr] = match;
+    let replacement = fullMatch;
     try {
       const expression = jsonata(expr.trim());
       registerCdxHelpers(expression, options);
       const value = await safeEvaluate(expression, context);
-      const replacement = value !== undefined ? String(value) : fullMatch;
-      result = result.replace(fullMatch, replacement);
+      if (value !== undefined) {
+        replacement = String(value);
+      }
     } catch (err) {
       if (DEBUG_MODE) {
         console.warn(
@@ -690,7 +695,10 @@ async function interpolateTemplate(template, context, options = {}) {
         );
       }
     }
+    result += template.slice(cursor, match.index) + replacement;
+    cursor = match.index + fullMatch.length;
   }
+  result += template.slice(cursor);
   return result;
 }