@cdxgen/cdxgen 13.6.0 → 13.7.0

package/lib/inventory/hbomLoader.js

@@ -7,6 +7,21 @@ const LOCAL_HBOM_MODULE_URL = new URL(
   import.meta.url,
 );
 const LOCAL_HBOM_MODULE_PATH = fileURLToPath(LOCAL_HBOM_MODULE_URL);
+// The ./cdx20 export of @cdxgen/cdx-hbom (cdx-hbom#26), at the same place
+// relative to a local checkout as the package's exports map gives it.
+const LOCAL_HBOM_MAPPER_PATH = fileURLToPath(
+  new URL("../../cdx-hbom/src/common/cdx20.js", import.meta.url),
+);
+
+/**
+ * The places cdx-hbom is loaded from, in order: a local checkout next to
+ * cdxgen, else the installed package.
+ */
+export const HBOM_MODULE_LOCATIONS = Object.freeze({
+  localModulePath: LOCAL_HBOM_MODULE_PATH,
+  localMapperPath: LOCAL_HBOM_MAPPER_PATH,
+  packageMapperSpecifier: "@cdxgen/cdx-hbom/cdx20",
+});
 
 /**
  * Resolve the optional cdx-hbom module.
@@ -33,3 +48,154 @@ export async function importHbomModule() {
   }
   return hbomModule;
 }
+
+/**
+ * Load the optional CycloneDX 2.0 hardware mapper,
+ * `toCdx20HardwareComponent`, from the same cdx-hbom that importHbomModule
+ * loads: the local checkout when it exists (its src/common/cdx20.js), else
+ * the installed package's `./cdx20` export. A cdx-hbom without the mapper
+ * (the published 0.7.0 has no `./cdx20` export) or one that fails to load
+ * gives null, and the 2.0 render then keeps its generic conversion.
+ *
+ * @param {object} [locations] Where to look; defaults to
+ *   HBOM_MODULE_LOCATIONS
+ * @returns {Promise<Function|null>} The mapper, or null
+ */
+export async function loadHardwareMapper(locations = HBOM_MODULE_LOCATIONS) {
+  let specifier = locations.packageMapperSpecifier;
+  if (safeExistsSync(locations.localModulePath)) {
+    if (!safeExistsSync(locations.localMapperPath)) {
+      return null;
+    }
+    specifier = pathToFileURL(locations.localMapperPath).href;
+  }
+  let mapperModule;
+  try {
+    mapperModule = await import(specifier);
+  } catch (err) {
+    // cdx-hbom not installed, or a release without the ./cdx20 export: the
+    // generic conversion applies and nothing is wrong. Any other failure is
+    // a broken cdx-hbom and is reported before falling back.
+    if (!isMissingMapperError(err, specifier)) {
+      console.warn(
+        `The cdx-hbom CycloneDX 2.0 hardware mapper could not be loaded, so hardware components use the generic 2.0 conversion: ${err?.message || err}`,
+      );
+    }
+    return null;
+  }
+  return typeof mapperModule.toCdx20HardwareComponent === "function"
+    ? mapperModule.toCdx20HardwareComponent
+    : null;
+}
+
+/**
+ * Whether an import error means the mapper is simply absent: the package is
+ * not installed, or its exports map has no `./cdx20`. A missing module
+ * imported from inside the mapper is a fault, not an absence.
+ *
+ * @param {Error} err Import error
+ * @param {string} specifier The specifier that was imported
+ * @returns {boolean} true when the mapper is absent
+ */
+function isMissingMapperError(err, specifier) {
+  if (err?.code === "ERR_PACKAGE_PATH_NOT_EXPORTED") {
+    return true;
+  }
+  const message = String(err?.message || "");
+  const packageName = specifier.startsWith("@")
+    ? specifier.split("/").slice(0, 2).join("/")
+    : undefined;
+  if (packageName) {
+    // Node.js and Bun name the missing package; Deno reports an import that
+    // its import map or node_modules cannot resolve.
+    return (
+      message.includes(`'${packageName}'`) ||
+      message.includes(`"${packageName}"`) ||
+      message.includes(`${packageName}/cdx20`) ||
+      (err?.code === "ERR_MODULE_NOT_FOUND" && message.includes(packageName))
+    );
+  }
+  return false;
+}
+
+/** The identifier policy cdx-hbom records when raw identifiers were kept. */
+export const RAW_IDENTIFIER_POLICY = "raw-identifiers-enabled";
+
+/**
+ * The identifier policy the collector recorded for the run, on the HBOM
+ * subject (`metadata.component`) or in `metadata.properties`.
+ *
+ * @param {object} internalBom The 1.x-shaped internal model
+ * @returns {string|undefined} The `cdx:hbom:identifierPolicy` value
+ */
+export function recordedIdentifierPolicy(internalBom) {
+  for (const properties of [
+    internalBom?.metadata?.component?.properties,
+    internalBom?.metadata?.properties,
+  ]) {
+    const value = (Array.isArray(properties) ? properties : []).find(
+      (property) => property?.name === "cdx:hbom:identifierPolicy",
+    )?.value;
+    if (typeof value === "string") {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * The renderCycloneDx20 context for an internal model: the hardware mapper
+ * and its identifier options when the model has a component with a
+ * cdx:hbom:* property and a mapper is available, otherwise an empty context,
+ * so a BOM without hardware never loads cdx-hbom. Hardware identifiers are
+ * asserted only when the collector recorded `raw-identifiers-enabled` for the
+ * run (it does when HBOM generation was asked to include sensitive
+ * identifiers); a redacted run never yields identifiers, whichever command
+ * renders it.
+ *
+ * @param {object} internalBom The 1.x-shaped internal model
+ * @param {object} [locations] Passed to loadHardwareMapper
+ * @returns {Promise<{hardwareMapper?: Function, hardwareOptions?: {includeSensitiveIdentifiers: boolean, identifierPolicy?: string}}>}
+ *   The render context
+ */
+export async function hardwareRenderContext(internalBom, locations) {
+  if (!hasHardwareComponent(internalBom)) {
+    return {};
+  }
+  const hardwareMapper = await loadHardwareMapper(locations);
+  if (!hardwareMapper) {
+    return {};
+  }
+  const identifierPolicy = recordedIdentifierPolicy(internalBom);
+  const hardwareOptions = {
+    includeSensitiveIdentifiers: identifierPolicy === RAW_IDENTIFIER_POLICY,
+  };
+  if (identifierPolicy !== undefined) {
+    hardwareOptions.identifierPolicy = identifierPolicy;
+  }
+  return { hardwareMapper, hardwareOptions };
+}
+
+function hasHardwareComponent(internalBom) {
+  const pending = [
+    internalBom?.metadata?.component,
+    ...(Array.isArray(internalBom?.components) ? internalBom.components : []),
+  ];
+  while (pending.length) {
+    const component = pending.pop();
+    if (!component || typeof component !== "object") {
+      continue;
+    }
+    if (
+      (component.properties || []).some((property) =>
+        `${property?.name ?? ""}`.startsWith("cdx:hbom:"),
+      )
+    ) {
+      return true;
+    }
+    if (Array.isArray(component.components)) {
+      pending.push(...component.components);
+    }
+  }
+  return false;
+}

package/lib/inventory/mcpConfigParser.js

@@ -39,6 +39,8 @@ const MCP_CONFIG_PATTERNS = [
   "**/.zed/settings.json",
   ".roo/mcp.json",
   "**/.roo/mcp.json",
+  ".kiro/settings/mcp.json",
+  "**/.kiro/settings/mcp.json",
   ".codex/config.toml",
   "**/.codex/config.toml",
 ];
@@ -115,6 +117,9 @@ function configFormat(filePath) {
   if (lowerPath.includes("/.roo/")) {
     return "roo";
   }
+  if (lowerPath.includes("/.kiro/settings/")) {
+    return "kiro";
+  }
   if (
     lowerPath.includes("/.codex/") ||
     lowerPath.endsWith(".codex/config.toml")

package/lib/inventory/occurrenceKey.js

@@ -0,0 +1,90 @@
+/**
+ * The key of a place in a purl's occurrence set (`purlLocationMap`).
+ *
+ * Every location that enters an occurrence set is keyed by this function,
+ * whatever evidence source added it: the seeding from the input BOM
+ * (`initFromSbom`), the atom `usages` and `callsites` slices, the golem, rusi,
+ * kosi, dosai and scalasem reports, the C include attribution and the Swift
+ * semantics slices. Backslashes become `/`, so a place spelled with `\` in the
+ * input BOM (Windows cdxgen output) and `/` in a slice is one occurrence, not
+ * two (issue 4726). The path is otherwise left as spelled: no resolving, no
+ * case folding, no stripping of a leading `./`.
+ *
+ * A place a line already names is keyed `file#line`; a place a callsites
+ * record names down to its column (counted from 0, as atom writes it) is keyed
+ * `file:line:offset`, so two use
+ * sites on one line are two occurrences. An occurrence with only `location`
+ * and `line` names the line as a whole: it is the same place as any use site
+ * that line carries, and it is kept as an occurrence of its own only while no
+ * `file:line:offset` key of that line exists (the writer drops the line-only
+ * key then, see `dropSubsumedOccurrenceKeys`). That rule is what keeps a
+ * re-run of evinse over its own output at the same occurrences: the first run
+ * writes the `file:line:offset` keys, and the second run seeds and re-adds
+ * exactly those.
+ *
+ * @param {string} location File path or other location text
+ * @param {number} [line] Line number; not a positive number means the location names no line
+ * @param {number} [offset] Column within the line, counted from 0 as atom writes it; a value that is not an integer of 0 or more (atom writes -1 for an unknown column) means the place is the line
+ * @returns {string|undefined} Key in the `file:line:offset`, `file#line` or plain `file` shape; undefined when the location is empty
+ */
+export function occurrenceLocationKey(location, line, offset) {
+  const normalized = `${location ?? ""}`.trim().replaceAll("\\", "/");
+  if (!normalized) {
+    return undefined;
+  }
+  if (!(line > 0)) {
+    return normalized;
+  }
+  return Number.isInteger(offset) && offset >= 0
+    ? `${normalized}:${line}:${offset}`
+    : `${normalized}#${line}`;
+}
+
+/**
+ * Drop the occurrence keys a use-site key subsumes.
+ *
+ * A `file:line:offset` key names a use site on a line; the line-only
+ * `file#line` key of the same line names no place of its own any more, so it
+ * is removed rather than counted beside the use sites (issue 4726: an
+ * occurrence seeded from an input BOM with only `location` and `line` is the
+ * same place as a callsites occurrence at that line).
+ *
+ * @param {string[]} keys Occurrence-set keys
+ * @returns {string[]} The keys without the subsumed line-only entries
+ */
+export function dropSubsumedOccurrenceKeys(keys) {
+  const linesWithOffset = new Set();
+  for (const key of keys) {
+    const withOffset = /^(.*):(\d+):(\d+)$/.exec(key);
+    if (withOffset) {
+      linesWithOffset.add(`${withOffset[1]}#${withOffset[2]}`);
+    }
+  }
+  if (!linesWithOffset.size) {
+    return keys;
+  }
+  return keys.filter((key) => {
+    const lineOnly = /^(.*)#(\d+)$/.exec(key);
+    return !(lineOnly && linesWithOffset.has(`${lineOnly[1]}#${lineOnly[2]}`));
+  });
+}
+
+/**
+ * The location part of an occurrence-set key: `src/a.js` for `src/a.js#3`,
+ * `src/a.js:3:14` and `src/a.js` alike.
+ *
+ * @param {string} key Key made by `occurrenceLocationKey`
+ * @returns {string} The location the key names
+ */
+export function occurrenceKeyLocation(key) {
+  const text = `${key ?? ""}`;
+  const withOffset = /^(.*):(\d+):(\d+)$/.exec(text);
+  if (withOffset) {
+    return withOffset[1];
+  }
+  const hash = text.lastIndexOf("#");
+  if (hash > 0 && /^\d+$/.test(text.slice(hash + 1))) {
+    return text.slice(0, hash);
+  }
+  return text;
+}