@portll/cobolwork 0.2.117 → 0.2.150

package/lib/sets/recon.mjs

@@ -17,6 +17,7 @@ import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { eachWithinMemory } from '../kernel/memory.mjs';
 import { loadSite, classifyPath, productionQualifierOf, SITE_FILE } from '../site.mjs';
 import { parseJcl, dispositionOf } from '../jcl.mjs';
+import { statementCard } from '../cards.mjs';
 
 
 // The production-dataset rules claim more than the name rule: that the job acts on production, not
@@ -93,7 +94,7 @@ function routableAddresses(text, jcl) {
   if (jcl) {
     for (const line of text.split(/\r?\n/)) {
       if (/^\/\/\*/.test(line)) continue;
-      collect(line.slice(0, 72), out);
+      collect(statementCard(line).text, out);
     }
     return out;
   }
@@ -160,7 +161,7 @@ function productionTouches(job, qualifiers) {
 }
 
 export function scanRecon(root, opts = {}) {
-  const site = loadSite(root, opts.site || null);
+  const site = loadSite(root, opts.site || null, opts.tree);
   const tree = treeFor(root, opts);
   const files = tree.list().filter(inScope(opts))
     .filter((f) => isJcl(f) || isProgram(f) || isCopybook(f));

package/lib/sets/semantics.mjs

@@ -216,7 +216,7 @@ export function scanSemantics(root, opts = {}) {
     truncOptPrograms: 0, truncUnknownPrograms: 0, arithExtendPrograms: 0, beyondEnterprisePrograms: 0, computesRead: 0, computesUnread: 0,
     rangesRead: 0, collatingDeclaredPrograms: 0,
   };
-  const site = loadSite(root, opts.site || null).compilerOptions || [];
+  const site = loadSite(root, opts.site || null, opts.tree).compilerOptions || [];
   const parsedJcl = [];
   for (const f of all.filter(isJcl)) {
     try { parsedJcl.push({ ...parseJcl(tree.text(f).text, f), file: relPath(root, f) }); } catch { /* the jcl set reports it */ }

package/lib/sets/vendor.mjs

@@ -26,7 +26,7 @@ export const VENDOR_RULES = {
 const evidenceOf = (r) => (r.severity === 'info' ? { evidence: 'context' } : {});
 
 export function scanVendor(root, opts = {}) {
-  const site = loadSite(root, opts.site || null);
+  const site = loadSite(root, opts.site || null, opts.tree);
   const wanted = opts.packs || site.vendorPacks || [];
   const { loaded, refused, problems, caveats } = loadPacks(wanted, {
     allowUnvalidated: !!(opts.allowUnvalidatedPacks ?? site.allowUnvalidatedPacks),

package/lib/sets/zowe.mjs

@@ -54,9 +54,9 @@ export const ZOWE_RULES = {
   },
   'zowe-mcp-unpinned': {
     sev: 'low', evidence: 'construct', cwe: 'CWE-829',
-    text: 'A Zowe MCP server is launched by npx with no pinned version',
+    text: 'A Zowe MCP server is launched from the registry with no pinned version',
     impact: 'Whatever version the registry serves next runs with the agent\'s mainframe credentials',
-    remedy: 'Pin the version: npx @zowe/mcp-server@<version>',
+    remedy: 'Pin the version: @zowe/mcp-server@<version>',
   },
   'zowe-mock-credentials': {
     sev: 'med', evidence: 'construct', cwe: 'CWE-798',
@@ -81,7 +81,12 @@ function stripJsonc(text) {
     else if (c === '/' && text[i + 1] === '*') { i += 2; while (i < text.length && !(text[i] === '*' && text[i + 1] === '/')) { if (text[i] === '\n') out += '\n'; i++; } i++; }
     else if (c === ',') {
       let j = i + 1;
-      while (j < text.length && /\s/.test(text[j])) j++;
+      for (;;) {
+        while (j < text.length && /\s/.test(text[j])) j++;
+        if (text[j] === '/' && text[j + 1] === '/') { while (j < text.length && text[j] !== '\n') j++; }
+        else if (text[j] === '/' && text[j + 1] === '*') { j += 2; while (j < text.length && !(text[j] === '*' && text[j + 1] === '/')) j++; j += 2; }
+        else break;
+      }
       if (text[j] !== '}' && text[j] !== ']') out += c;
     } else out += c;
   }
@@ -109,6 +114,7 @@ function kindOf(rel) {
   if (base === 'settings.json' && parent === '.gemini') return 'mcp';
   if (base === 'settings.json' && parent === '.vscode') return 'vscode';
   if (base === 'systems.json' && parts.slice(0, -1).some((p) => /mock/i.test(p))) return 'mock';
+  if (base === 'native-config.json') return 'native';
   return null;
 }
 
@@ -138,7 +144,10 @@ function teamConfig(config, raw, rel, findings) {
   });
 }
 
-const isZoweServer = (s) => s && typeof s === 'object' && /@zowe\/mcp-server|zowe-mcp/.test([s.command, ...(Array.isArray(s.args) ? s.args : [])].map(String).join(' '));
+// The Zowe MCP server by its package or command, or by the ZOWE_MCP_ variables only it reads.
+const isZoweServer = (s) => s && typeof s === 'object' && (/@zowe\/mcp-server|zowe-mcp/.test([s.command, ...(Array.isArray(s.args) ? s.args : [])].map(String).join(' ')) || Object.keys(s.env && typeof s.env === 'object' ? s.env : {}).some((k) => k.startsWith('ZOWE_MCP_')));
+// Commands that run whatever version of a package the registry serves.
+const REGISTRY_RUNNERS = new Set(['npx', 'bunx', 'pnpx', 'pnpm', 'yarn', 'npm']);
 
 function tierOf(server) {
   const args = Array.isArray(server.args) ? server.args.map(String) : [];
@@ -170,9 +179,9 @@ function mcpConfig(config, raw, rel, findings) {
     const t = tierFinding(tierOf(server), rel, lineOf(raw, 'capability-tier', name) || lineOf(raw, 'ZOWE_MCP_CAPABILITY_TIER', name), `server ${name}`);
     if (t) findings.push(t);
     if (String(env.ZOWE_MCP_DATA_MARKING) === '0') findings.push({ rule: 'zowe-mcp-data-marking-off', path: rel, line: lineOf(raw, 'ZOWE_MCP_DATA_MARKING', name), detail: `server ${name} sets ZOWE_MCP_DATA_MARKING to 0` });
-    if (String(server.command) === 'npx') {
+    if (REGISTRY_RUNNERS.has(String(server.command))) {
       const pkg = (Array.isArray(server.args) ? server.args.map(String) : []).find((a) => a.startsWith('@zowe/mcp-server'));
-      if (pkg && (pkg === '@zowe/mcp-server' || pkg === '@zowe/mcp-server@latest')) findings.push({ rule: 'zowe-mcp-unpinned', path: rel, line: lineOf(raw, pkg, name), detail: `server ${name} runs ${pkg} through npx` });
+      if (pkg && (pkg === '@zowe/mcp-server' || pkg === '@zowe/mcp-server@latest')) findings.push({ rule: 'zowe-mcp-unpinned', path: rel, line: lineOf(raw, pkg, name), detail: `server ${name} runs ${pkg} through ${server.command}` });
     }
   }
 }
@@ -188,7 +197,7 @@ function passwordPaths(value, path, out) {
   else if (value && typeof value === 'object') {
     for (const [k, v] of Object.entries(value)) {
       const p = path ? `${path}.${k}` : k;
-      if (/^password$/i.test(k) && typeof v === 'string' && v) out.push(p);
+      if (/^password$/i.test(k) && ((typeof v === 'string' && v && !isReference(v)) || typeof v === 'number')) out.push(p);
       else passwordPaths(v, p, out);
     }
   }
@@ -199,7 +208,24 @@ function mockSystems(config, raw, rel, findings) {
   for (const p of passwordPaths(config, '', [])) findings.push({ rule: 'zowe-mock-credentials', path: rel, line: lineOf(raw, 'password'), detail: `the mock systems file holds a password at ${p}` });
 }
 
-const READERS = { team: teamConfig, mcp: mcpConfig, vscode: vscodeSettings, mock: mockSystems };
+// The server's own configuration, read without assuming its layout: a literal password, and TLS
+// verification turned off, wherever they are.
+function nativeConfig(config, raw, rel, findings) {
+  for (const p of passwordPaths(config, '', [])) findings.push({ rule: 'zowe-config-secret-in-clear', path: rel, line: lineOf(raw, 'password'), detail: `the Zowe MCP server configuration holds a password at ${p}` });
+  const walk = (v, path) => {
+    if (Array.isArray(v)) v.forEach((x, i) => walk(x, `${path}[${i}]`));
+    else if (v && typeof v === 'object') {
+      for (const [k, x] of Object.entries(v)) {
+        const p = path ? `${path}.${k}` : k;
+        if (k === 'rejectUnauthorized' && x === false) findings.push({ rule: 'zowe-config-tls-verify-off', path: rel, line: lineOf(raw, 'rejectUnauthorized'), detail: `the Zowe MCP server configuration turns TLS verification off at ${p}` });
+        else walk(x, p);
+      }
+    }
+  };
+  walk(config, '');
+}
+
+const READERS = { team: teamConfig, mcp: mcpConfig, vscode: vscodeSettings, mock: mockSystems, native: nativeConfig };
 
 export function scanZowe(root, opts = {}) {
   const tree = treeFor(root, opts);

package/lib/site.mjs

@@ -9,7 +9,7 @@
 // It is also the only part of cobolwork that is inherently per-customer and inherently recurring:
 // conventions drift, environments are renamed, estates are acquired.
 import { readFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { resolvesInside } from './kernel/source-tree.mjs';
 import { printable } from './kernel/printable.mjs';
 
@@ -43,14 +43,24 @@ const EMPTY = {
 // A configuration that is absent is not a configuration that says "nothing is production". The
 // difference is the whole point: without it the recon rules have not looked, and a scan must say
 // it has not looked rather than report a clean result.
-export function loadSite(root, explicit = null) {
-  const path = explicit || join(root, SITE_FILE);
-  if (!existsSync(path)) return { ...EMPTY, path };
-  // A site file in the tree is not read through a link out of it; one the caller names is.
-  if (!explicit && !resolvesInside(root, path)) return { ...EMPTY, path, problems: [`${SITE_FILE} is a link that leads outside the tree, so it was not read`] };
+// `tree` is the scan's source tree: one held in memory (a git revision) supplies the site file
+// itself, and on disk the file is read from `root`.
+export function loadSite(root, explicit = null, tree = null) {
+  const held = !explicit && tree && tree.kind !== 'directory';
+  const path = explicit || (held ? resolve(tree.root, SITE_FILE) : join(root, SITE_FILE));
+  let read;
+  if (held) {
+    if (!tree.contains(path)) return { ...EMPTY, path };
+    read = () => tree.bytes(path).toString('utf8');
+  } else {
+    if (!existsSync(path)) return { ...EMPTY, path };
+    // A site file in the tree is not read through a link out of it; one the caller names is.
+    if (!explicit && !resolvesInside(root, path)) return { ...EMPTY, path, problems: [`${SITE_FILE} is a link that leads outside the tree, so it was not read`] };
+    read = () => readFileSync(path, 'utf8');
+  }
 
   let raw;
-  try { raw = JSON.parse(readFileSync(path, 'utf8')); } catch (e) {
+  try { raw = JSON.parse(read()); } catch (e) {
     return { ...EMPTY, path, problems: [`${SITE_FILE} is not readable as JSON: ${printable(e.message, 120)}`] };
   }
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ...EMPTY, path, problems: [`${SITE_FILE} is not a JSON object`] };

package/lib/sources.mjs

@@ -23,41 +23,90 @@ const has = (list) => (p) => list.includes(extname(p).toLowerCase());
 // of it and reporting a clean zero, which is the failure this project exists to refuse.
 //
 // So a file with no extension is classified by what is in it. Only the first few kilobytes are
-// read, only files without an extension are sniffed, and the answer is cached: this runs over
-// every file in the tree and must not cost a parse.
+// read and only files without an extension are sniffed. The tree a path belongs to classifies it
+// and keeps the answer for as long as the tree lives: this runs over every file in the tree and
+// must not cost a parse, and a cache that outlives the scan grows by one entry per file for the
+// life of the process.
 const SNIFF_BYTES = 4096;
-const sniffed = new Map();
 
 // Names that are certainly not source, so the commonest extensionless files cost nothing.
 const NOT_SOURCE = /^(LICEN[CS]E|README|MAKEFILE|DOCKERFILE|CHANGELOG|NOTICE|AUTHORS|CONTRIBUTING|CODEOWNERS|VERSION|COPYING|Jenkinsfile|Procfile|\..*)$/i;
+const notSource = (path) => NOT_SOURCE.test(path.split(/[\\/]/).pop());
+
+function kindOfHead(head) {
+  // An EBCDIC member is decoded before it is read, or every test below sees mojibake.
+  const text = looksEbcdic(head) ? decodeEbcdic(head) : head.toString('latin1');
+  // A NUL byte means binary. Tested on the bytes rather than with a literal, because a literal
+  // NUL in source is exactly the character an editor or a patch is most likely to eat.
+  if (head.includes(0)) return null;
+  if (/^\s*\/\/\S*\s+(?:JOB|EXEC|PROC|DD)\b/m.test(text)) return 'jcl';
+  if (/\bIDENTIFICATION\s+DIVISION|\bPROGRAM-ID\s*\./i.test(text)) return 'program';
+  // A copybook is a data description with no divisions: level numbers and picture clauses.
+  if (/^[^*\n]{0,10}\s*\d\d\s+[A-Z][A-Z0-9-]*\s+(?:PIC|PICTURE|OCCURS|REDEFINES|USAGE)\b/im.test(text)) return 'copybook';
+  // A BMS map opens its mapset with DFHMSD in the operation field. Tested last, so nothing that
+  // classified before classifies differently.
+  if (/^[^*\s]*[ \t]+DFHMSD(?=\s|$)/im.test(text)) return 'bms';
+  return null;
+}
 
-export function sniffKind(path) {
-  if (sniffed.has(path)) return sniffed.get(path);
-  let kind = null;
-  const name = path.split(/[\\/]/).pop();
-  if (!NOT_SOURCE.test(name)) {
-    try {
-      const fd = openSync(path, 'r');
-      const buf = Buffer.alloc(SNIFF_BYTES);
-      let n;
-      try { n = readSync(fd, buf, 0, SNIFF_BYTES, 0); } finally { closeSync(fd); }
-      const head = buf.subarray(0, n);
-      // An EBCDIC member is decoded before it is read, or every test below sees mojibake.
-      const text = looksEbcdic(head) ? decodeEbcdic(head) : head.toString('latin1');
-      // A NUL byte means binary. Tested on the bytes rather than with a literal, because a literal
-      // NUL in source is exactly the character an editor or a patch is most likely to eat.
-      if (head.includes(0)) kind = null;
-      else if (/^\s*\/\/\S*\s+(?:JOB|EXEC|PROC|DD)\b/m.test(text)) kind = 'jcl';
-      else if (/\bIDENTIFICATION\s+DIVISION|\bPROGRAM-ID\s*\./i.test(text)) kind = 'program';
-      // A copybook is a data description with no divisions: level numbers and picture clauses.
-      else if (/^[^*\n]{0,10}\s*\d\d\s+[A-Z][A-Z0-9-]*\s+(?:PIC|PICTURE|OCCURS|REDEFINES|USAGE)\b/im.test(text)) kind = 'copybook';
-      // A BMS map opens its mapset with DFHMSD in the operation field. Tested last, so nothing that
-      // classified before classifies differently.
-      else if (/^[^*\s]*[ \t]+DFHMSD(?=\s|$)/im.test(text)) kind = 'bms';
-    } catch { kind = null; }
+// What a member's bytes say it is, for a tree that holds them.
+export const kindOfBytes = (buf) => kindOfHead(buf.subarray(0, SNIFF_BYTES));
+
+function sniffDisk(path) {
+  if (notSource(path)) return null;
+  try {
+    const fd = openSync(path, 'r');
+    const buf = Buffer.alloc(SNIFF_BYTES);
+    let n;
+    try { n = readSync(fd, buf, 0, SNIFF_BYTES, 0); } finally { closeSync(fd); }
+    return kindOfHead(buf.subarray(0, n));
+  } catch { return null; }
+}
+
+// A tree's classifier for the paths under its root, remembered for as long as the tree lives.
+const classifiers = new Map();
+
+export const classifyUnder = (root, kindOf) => classifiers.set(root.replace(/[\\/]+$/, ''), new WeakRef(kindOf));
+
+// The classifier of the deepest live tree whose root the path sits under.
+function classifierFor(path) {
+  let best = null;
+  let depth = -1;
+  for (const [root, ref] of classifiers) {
+    if (root.length <= depth || !path.startsWith(root + sep)) continue;
+    const kindOf = ref.deref();
+    if (!kindOf) { classifiers.delete(root); continue; }
+    best = kindOf;
+    depth = root.length;
   }
-  sniffed.set(path, kind);
-  return kind;
+  return best;
+}
+
+// A directory tree's classifier: sniffed from disk once per path.
+export function diskClassifier() {
+  const seen = new Map();
+  return (path) => {
+    if (!seen.has(path)) seen.set(path, sniffDisk(path));
+    return seen.get(path);
+  };
+}
+
+// A held tree's classifier: sniffed from what the tree holds, never from disk.
+export function heldClassifier(bytesOf) {
+  const seen = new Map();
+  return (path) => {
+    if (!seen.has(path)) {
+      let kind = null;
+      if (!notSource(path)) try { kind = kindOfBytes(bytesOf(path)); } catch { kind = null; }
+      seen.set(path, kind);
+    }
+    return seen.get(path);
+  };
+}
+
+export function sniffKind(path) {
+  const kindOf = classifierFor(path);
+  return kindOf ? kindOf(path) : sniffDisk(path);
 }
 
 // Extension first, because it is free and it is right whenever it is present.
@@ -72,13 +121,6 @@ export const isSource = (p) => (extname(p)
   ? [...PROGRAM_EXT, ...COPY_EXT, ...JCL_EXT].includes(extname(p).toLowerCase())
   : ![null, 'bms'].includes(sniffKind(p)));
 
-// For a report that wants to say how much of what it read had no extension to go on.
-export const sniffedCount = () => {
-  let n = 0;
-  for (const v of sniffed.values()) if (v) n++;
-  return n;
-};
-
 // `opts.only` is about rule sets; this is about files. A rule set given an allow list reads the
 // files on it and no others.
 //
@@ -159,8 +201,10 @@ export function decodeEbcdic(buf) {
 
 // Every rule set reads source through here, so an EBCDIC member is decoded once, the same way,
 // and reported as EBCDIC instead of silently parsing as noise.
-export function readSource(path) {
-  const buf = readFileSync(path);
+export const readSource = (path) => decodeSource(readFileSync(path));
+
+// The same decoding for bytes that did not come from a file: a blob read out of a git revision.
+export function decodeSource(buf) {
   if (looksEbcdic(buf)) return { text: decodeEbcdic(buf), encoding: 'ebcdic' };
   return { text: buf.toString('latin1'), encoding: 'latin1' };
 }

package/lib/utilities.mjs

@@ -8,6 +8,9 @@
 // statements are not in the job - SYSIN naming a library member - says so, because its copies are
 // then only the ones its DD names decide on their own.
 
+import { ftpSession } from './ftp.mjs';
+import { statementCard } from './cards.mjs';
+
 const upper = (s) => String(s).toUpperCase();
 
 // The DDs of a step by name, each followed by the datasets concatenated to it.
@@ -93,7 +96,7 @@ function commands(lines) {
   let comment = false;
   for (const { line, text } of lines) {
     let t = '';
-    const s = text.slice(0, 72);
+    const s = statementCard(text).text;
     for (let i = 0; i < s.length; i++) {
       if (comment) { if (s[i] === '*' && s[i + 1] === '/') { comment = false; i++; } continue; }
       if (s[i] === '/' && s[i + 1] === '*') { comment = true; i++; continue; }
@@ -189,11 +192,42 @@ function sortCopies(step, dds) {
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i211.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/import.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2221.htm
+// PRINT reads INFILE(ddname) or INDATASET(entryname) and writes the listing to OUTFILE(ddname),
+// SYSPRINT when it names none, so a production data set printed to SYSOUT leaves by that DD.
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/print.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2244.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2245.htm
+// ALTER entryname NEWNAME(newname), abbreviated NEWNM, gives the entry a new name, so the data the
+// old name held is read under the new one. A generic name (both must then be generic) or a member
+// of a partitioned data set leaves the data set where it was, and is not followed.
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2052.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2055.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2056.htm
+function renamed(cmd) {
+  const m = /^ALTER\s+'?([^\s(),'*]+)'?(?=[\s,]|$)/i.exec(cmd.text);
+  const to = m && param(cmd.text, ['NEWNAME', 'NEWNM']);
+  if (!to || /[*(]/.test(to[0])) return null;
+  return { from: [{ dsn: upper(m[1]) }], to: [{ dsn: to[0] }], line: cmd.line };
+}
+
 function reproCopies(step, dds) {
   const { lines, unread } = cards(dds.get('SYSIN'));
-  const notes = unread ? [{ line: step.line, text: `${who(step)} runs IDCAMS with commands in ${unread}, which this reader cannot see, so any REPRO, EXPORT or IMPORT it runs is not known` }] : [];
+  const notes = unread ? [{ line: step.line, text: `${who(step)} runs IDCAMS with commands in ${unread}, which this reader cannot see, so any REPRO, EXPORT, IMPORT, PRINT or rename it runs is not known` }] : [];
   const moves = [];
   for (const cmd of commands(lines)) {
+    if (/^ALTER\b/i.test(cmd.text)) {
+      const move = renamed(cmd);
+      if (move) moves.push(move);
+      continue;
+    }
+    if (/^PRINT\b/i.test(cmd.text)) {
+      const input = param(cmd.text, ['INFILE', 'IFILE']);
+      const ds = !input && param(cmd.text, ['INDATASET', 'IDS']);
+      const out = param(cmd.text, ['OUTFILE', 'OFILE']);
+      const from = input ? [{ dd: input[0] }] : ds ? [{ dsn: ds[0] }] : [];
+      moves.push({ from, to: [{ dd: out ? out[0] : 'SYSPRINT' }], line: cmd.line });
+      continue;
+    }
     const verb = /^(REPRO|EXPORT|EXP|IMPORT)\b/i.exec(cmd.text);
     if (!verb) continue;
     const entry = /^EXP/i.test(verb[1]) && /^\S+\s+([^\s(),]+)/.exec(cmd.text);
@@ -293,7 +327,7 @@ function icetoolCopies(step, dds) {
   const statements = [];
   let cur = null;
   for (const { line, text } of lines) {
-    const s = text.slice(0, 72);
+    const s = statementCard(text).text;
     if (!cur && (/^\*/.test(s) || !s.trim())) continue;
     const tokens = s.trim().split(/\s+/);
     const hyphen = tokens.findIndex((t) => t.endsWith('-'));
@@ -321,6 +355,21 @@ function icetoolCopies(step, dds) {
   return { moves, notes };
 }
 
+// An FTP step's transfers, from the session lib/ftp.mjs reads: what PUt, MPut and APpend send leaves
+// for the remote host, and what Get and MGet fetch is written locally. The remote end names the host
+// and file, and the FILETYPE a SIte gave it.
+function ftpCopies(step, dds) {
+  const s = ftpSession(step, dds);
+  const localEnds = (x) => (x.dd ? [{ dd: x.dd }] : x.dsns.map((dsn) => ({ dsn })));
+  const remote = (name, x) => ({ remote: { host: s.host, name, ...(x.filetype ? { filetype: x.filetype } : {}) } });
+  const moves = [
+    ...s.sends.map((x) => ({ from: localEnds(x), to: [remote(x.foreign, x)], line: x.line })),
+    ...s.gets.map((x) => ({ from: [remote(x.name, x)], to: localEnds(x), line: x.line })),
+  ].sort((a, b) => a.line - b.line);
+  const notes = s.inputUnread ? [{ line: step.line, text: `${who(step)} runs FTP with subcommands in ${s.inputUnread}, which this reader cannot see, so what it sends or fetches is not known` }] : [];
+  return { moves, notes };
+}
+
 const TABLE = [
   [['IEBGENER', 'ICEGENER', 'IEBPTPCH', 'IEBUPDTE'], generCopy],
   [['SORT', 'ICEMAN', 'DFSORT', 'SYNCSORT'], sortCopies],
@@ -328,6 +377,7 @@ const TABLE = [
   [['IEBCOPY'], iebcopyCopies],
   [['ADRDSSU'], dssCopies],
   [['ICETOOL'], icetoolCopies],
+  [['FTP'], ftpCopies],
 ];
 const BY_PROGRAM = new Map(TABLE.flatMap(([names, fn]) => names.map((n) => [n, fn])));
 
@@ -346,7 +396,7 @@ export function copiesOf(step) {
   // An end naming a DD stands for every dataset concatenated under that name. A DD the step does
   // not define is kept, with no dataset: a statement naming it still says where the data went.
   const expand = (end) => {
-    if (!end.dd) return [{ dd: null, dsn: end.dsn }];
+    if (!end.dd) return [{ dd: null, dsn: end.dsn ?? null, ...(end.remote ? { remote: end.remote } : {}) }];
     const group = dds.get(end.dd);
     if (!group) return [{ dd: end.dd, dsn: null }];
     return group.map((dd) => ({ dd: end.dd, dsn: dd.dsn || null, ...(dd.inStream ? { inStream: true } : {}) }));
@@ -366,3 +416,95 @@ export function copiesOf(step) {
   }
   return { copies, uses, notes };
 }
+
+// A TSO command's operands: KEYWORD(value) with the value's parentheses and quotes kept, a quoted
+// string, or a bare word, split on blanks and commas. Blanks may stand between a keyword and its
+// parenthesis, as in PROGRAM (GETTAB).
+function tsoOperands(text) {
+  const out = [];
+  let i = 0;
+  while (i < text.length) {
+    if (/[\s,]/.test(text[i])) { i++; continue; }
+    const start = i;
+    let depth = 0, quoted = false;
+    for (; i < text.length; i++) {
+      const c = text[i];
+      if (c === "'") quoted = !quoted;
+      else if (quoted) continue;
+      else if (c === '(') depth++;
+      else if (c === ')') depth = Math.max(0, depth - 1);
+      else if (depth === 0 && /[\s,]/.test(c)) {
+        const next = /^\s*\(/.exec(text.slice(i));
+        if (next && /^[A-Z][A-Z0-9$#@]*$/i.test(text.slice(start, i))) { text = text.slice(0, i) + text.slice(i + next[0].length - 1); i--; continue; }
+        break;
+      }
+    }
+    const tok = text.slice(start, i);
+    const kw = /^([A-Z][A-Z0-9$#@]*)\((.*)\)$/is.exec(tok);
+    out.push(kw ? { key: upper(kw[1]), value: kw[2] } : { word: tok });
+  }
+  return out;
+}
+
+const unquote = (s) => s.replace(/^'(.*)'$/s, '$1').replace(/''/g, "'");
+
+// ALLOCATE's keywords, abbreviated as far as IBM's rule allows: to any leading part that no other
+// ALLOCATE keyword shares. FILE shares F, FI and FIL with FILEDATA, FCB, FLASH and FORMS, and DSNAME
+// shares DS and DSN with DSNTYPE and DSORG.
+const ALLOC_DATASET = /^(DA|DAT|DATA|DATAS|DATASE|DATASET|DSNA|DSNAM|DSNAME)$/;
+const ALLOC_FILE = /^(FILE|DD|DDN|DDNA|DDNAM|DDNAME)$/;
+const ALLOC_STATUS = new Set(['OLD', 'SHR', 'MOD', 'NEW']);
+
+// What a TSO batch step (IKJEFT01, IKJEFT1A, IKJEFT1B) does in its commands, from the step's PARM,
+// which TSO runs as its first command, and the in-stream SYSTSIN:
+//   allocations: ALLOCATE's DDs, which the programs the step runs open as if the JCL defined them.
+//     A data set name in quotes is the whole name; one without has the user's prefix added, which
+//     the job does not say, so it is kept as written with no dsn.
+//   runs: the programs the step starts, by TSO CALL, whose parameter string reaches the program as
+//     EXEC PARM does, and by the DSN subcommand RUN PROGRAM, with PARMS.
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.1.0/com.ibm.zos.v2r1.ikjc500/allocsyn.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.2.0/com.ibm.zos.v3r2.ikjc500/alloccmd.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.1.0/com.ibm.zos.v3r1.ikjp100/ikjp100114.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.5.0/com.ibm.zos.v2r5.ikjc200/ikj2o20039.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.1.0/com.ibm.zos.v3r1.ikjc500/ikj2l2_CALL_command_operands.htm
+//   https://www.ibm.com/docs/api/v1/content/SSEPEK_13.0.0/comref/src/tpc/db2z_cmd_run.html
+export const TSO_BATCH = new Set(['IKJEFT01', 'IKJEFT1A', 'IKJEFT1B']);
+
+export function tsoCommands(step) {
+  const out = { allocations: [], runs: [], notes: [] };
+  if (!step.pgm || !TSO_BATCH.has(upper(step.pgm))) return out;
+  const { lines, unread } = cards(ddGroups(step).get('SYSTSIN'));
+  if (unread) out.notes.push({ line: step.line, text: `${who(step)} runs TSO with commands in ${unread}, which this reader cannot see, so any ALLOCATE, CALL or RUN it runs is not known` });
+  // PARM keeps JCL's doubled apostrophes; TSO sees one.
+  const cmds = [...(step.parm ? [{ line: step.line, text: step.parm.replace(/''/g, "'") }] : []), ...commands(lines)];
+  for (const cmd of cmds) {
+    const verb = upper(/^\S*/.exec(cmd.text)[0]);
+    const ops = tsoOperands(cmd.text.slice(verb.length));
+    if (verb === 'ALLOC' || verb === 'ALLOCATE') {
+      const file = ops.find((o) => o.key && ALLOC_FILE.test(o.key));
+      if (!file) continue;
+      const names = ops.find((o) => o.key && ALLOC_DATASET.test(o.key));
+      const words = ops.filter((o) => o.word).map((o) => upper(o.word));
+      const sysout = ops.find((o) => o.key === 'SYSOUT') || (words.includes('SYSOUT') ? { value: '' } : null);
+      const datasets = names ? tsoOperands(names.value).map((o) => o.word).filter((w) => w && w !== '*') : [];
+      if (!datasets.length && !sysout) continue;
+      out.allocations.push({
+        dd: upper(unquote(file.value)), line: cmd.line,
+        status: words.find((w) => ALLOC_STATUS.has(w)) || null,
+        sysout: sysout ? upper(sysout.value) || '*' : null,
+        datasets: datasets.map((w) => ({ written: w, dsn: /^'.*'$/.test(w) ? upper(unquote(w)) : null })),
+      });
+    } else if (verb === 'CALL') {
+      const target = ops[0]?.word || (ops[0]?.key ? `${ops[0].key}(${ops[0].value})` : '');
+      const member = /\(([A-Z0-9$#@]{1,8})\)'?$/i.exec(target);
+      const parm = ops[1]?.word && /^'.*'$/s.test(ops[1].word) ? unquote(ops[1].word) : null;
+      out.runs.push({ program: member ? upper(member[1]) : 'TEMPNAME', parm, line: cmd.line, via: 'TSO CALL' });
+    } else if (verb === 'RUN') {
+      const program = ops.find((o) => o.key === 'PROGRAM');
+      if (!program || !/^[A-Z0-9$#@]{1,8}$/i.test(program.value.trim())) continue;
+      const parms = ops.find((o) => o.key === 'PARMS');
+      out.runs.push({ program: upper(program.value.trim()), parm: parms ? unquote(parms.value.trim()) : null, line: cmd.line, via: 'DSN RUN' });
+    }
+  }
+  return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portll/cobolwork",
-  "version": "0.2.117",
+  "version": "0.2.150",
   "description": "COBOL, JCL and CICS security analysis with zero runtime dependencies: reference-format parser, cross-program data flow, mainframe credential rules. Plugs into commitwork.",
   "license": "AGPL-3.0-or-later",
   "author": "Portll <john@portll.net>",