@portll/cobolwork 0.2.140 → 0.3.0

package/lib/sbom.mjs

@@ -102,7 +102,20 @@ export function sbom(root, opts = {}) {
   const idx = tree.index;
   const top = resolve(root);
   const within = (p) => resolve(p).startsWith(top + sep);
-  const refOf = (p) => (within(p) ? relPath(root, p) : `copylib:${basename(p)}`);
+  // A member outside the tree is named by its file name, and by its directory's digest as well where
+  // another library holds a member of the same name.
+  const copylibRefs = new Map();
+  const claimed = new Map();
+  const refOf = (p) => {
+    if (within(p)) return relPath(root, p);
+    if (!copylibRefs.has(p)) {
+      let ref = `copylib:${basename(p)}`;
+      if (claimed.has(ref) && claimed.get(ref) !== p) ref = `copylib:${basename(p)}#${sha256(dirname(resolve(p))).slice(0, 8)}`;
+      claimed.set(ref, p);
+      copylibRefs.set(p, ref);
+    }
+    return copylibRefs.get(p);
+  };
 
   const entries = [];
   const programIds = new Map();
@@ -110,17 +123,24 @@ export function sbom(root, opts = {}) {
   const procIds = new Map();
   for (const f of tree.list().filter(inScope(opts)).sort()) {
     let bytes;
-    let src;
-    try { bytes = readFileSync(f); src = readSource(f).text; } catch { continue; }
-    const kind = kindOf(f, src);
+    let src = null;
+    try { bytes = readFileSync(f); } catch { continue; }
+    try { src = readSource(f).text; } catch { /* its bytes are listed; its text could not be decoded */ }
+    const kind = src === null ? (isProgram(f) ? 'program' : isCopybook(f) ? 'copybook' : isJcl(f) ? 'jcl' : isBms(f) ? 'bms' : null) : kindOf(f, src);
     if (!kind) continue;
-    const entry = { file: f, ref: relPath(root, f), bytes, src, kind };
+    const entry = { file: f, ref: relPath(root, f), bytes, src: src ?? '', kind, ...(src === null ? { unparsed: true, undecodable: true } : {}) };
+    if (src === null) { entries.push(entry); continue; }
     if (kind === 'program') {
       try {
         const res = parseSource(src, f, { format: 'auto', includeDirs: idx.copyDirs, fileIndex: idx.index, mainDir: dirname(f), copyFormat: 'auto', systemDirs: opts.systemDirs || [] });
         entry.programs = res.programs;
         entry.copies = res.copies;
-        for (const p of res.programs) if (p.id) programIds.set(String(p.id).toUpperCase(), entry.ref);
+        for (const p of res.programs) {
+          if (!p.id) continue;
+          const id = String(p.id).toUpperCase();
+          if (!programIds.has(id)) programIds.set(id, []);
+          if (!programIds.get(id).includes(entry.ref)) programIds.get(id).push(entry.ref);
+        }
       } catch { entry.unparsed = true; }
     } else if (kind === 'jcl' || kind === 'proc') {
       try { entry.jcl = parseJcl(src, f); } catch { entry.unparsed = true; }
@@ -139,9 +159,10 @@ export function sbom(root, opts = {}) {
   const dependencies = new Map();
   const depend = (from, to) => { if (!dependencies.has(from)) dependencies.set(from, new Set()); dependencies.get(from).add(to); };
   // A program the estate does not hold is a component of its own, so an edge to it is not lost.
+  // A PROGRAM-ID two files hold is an edge to each: which one a run loads is the load library's order.
   const runs = (from, name) => {
-    const target = programIds.get(name);
-    if (target) { if (target !== from) depend(from, target); return; }
+    const targets = programIds.get(name);
+    if (targets) { for (const t of targets) if (t !== from) depend(from, t); return; }
     if (platformRoutine(name)) return;
     const ref = `program:${name}`;
     depend(from, ref);
@@ -153,9 +174,12 @@ export function sbom(root, opts = {}) {
   for (const e of entries) {
     const properties = [{ name: 'cobolwork:kind', value: e.kind }];
     if (e.unparsed) properties.push({ name: 'cobolwork:unparsed', value: 'true' });
+    if (e.undecodable) properties.push({ name: 'cobolwork:undecodable', value: 'true' });
     if (e.kind === 'program' && e.programs && e.programs.length) {
       const ids = e.programs.map((p) => p.id).filter(Boolean);
       if (ids.length) properties.push({ name: 'cobolwork:program-id', value: ids.join(',') });
+      const twins = [...new Set(ids.flatMap((id) => (programIds.get(String(id).toUpperCase()) || []).filter((r) => r !== e.ref)))].sort(order);
+      if (twins.length) properties.push({ name: 'cobolwork:program-id-also-in', value: twins.join(',') });
       properties.push({ name: 'cobolwork:format', value: detectFormat(e.src) });
       const options = optionCards(e.src).flatMap((c) => c.options);
       if (options.length) properties.push({ name: 'cobolwork:options', value: options.join(' ') });
@@ -166,7 +190,7 @@ export function sbom(root, opts = {}) {
         if (!within(c.path) && !components.has(ref)) {
           let b = null;
           try { b = readFileSync(c.path); } catch { /* read at parse time, gone since */ }
-          components.set(ref, { 'bom-ref': ref, type: 'file', name: ref, ...(b ? { hashes: [{ alg: 'SHA-256', content: sha256(b) }] } : {}), properties: [{ name: 'cobolwork:kind', value: 'copybook' }, { name: 'cobolwork:source', value: 'copy library' }] });
+          components.set(ref, { 'bom-ref': ref, type: 'file', name: ref, ...(b ? { hashes: [{ alg: 'SHA-256', content: sha256(b) }] } : {}), properties: [{ name: 'cobolwork:kind', value: 'copybook' }, { name: 'cobolwork:source', value: 'copy library' }, ...(b ? [] : [{ name: 'cobolwork:unread', value: 'true' }])] });
         }
       }
       const calls = e.programs.flatMap((p) => p.calls || []);

package/lib/scan.mjs

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { sortFindings, tally, evidenceMap, EVIDENCE, EXPLOITABILITY } from './kernel/findings.mjs';
 import { directoryTree } from './kernel/source-tree.mjs';
 import { REGISTRY, RULE_SETS, ALL_RULES, reportKey } from './kernel/registry.mjs';
@@ -13,6 +13,7 @@ import { rollup } from './sets/flow.mjs';
 import { loadSite } from './site.mjs';
 import { reachFeedPaths, loadReachFeed, reachResolver, stampReach, stampEffect } from './reach.mjs';
 import { stampExploitability, byVerdict, HANDLING, witnessFeedPaths, loadWitnessFeed, applyWitness } from './exploitability.mjs';
+import { executionFeedPaths, loadExecutionFeed, applyExecution } from './execution.mjs';
 
 import { FLOW_MODEL, SCHEMA_VERSION, TOOL_VERSION } from './version.mjs';
 
@@ -133,7 +134,7 @@ function scanEach(root, opts) {
 // Reach and effect annotate rather than re-rank; where no fact is declared, a note says so rather
 // than the report reading as a clean bill.
 export function applyEstateFacts(findings, checked, root, opts = {}) {
-  const site = loadSite(root, opts.site || null);
+  const site = loadSite(root, opts.site || null, opts.tree);
   const feedRoot = opts.feedRoot || root;
   const reachFeeds = reachFeedPaths(opts).map((p) => loadReachFeed(p, { root: feedRoot }));
   const reach = reachResolver({ feeds: reachFeeds, site });
@@ -151,6 +152,8 @@ export function applyEstateFacts(findings, checked, root, opts = {}) {
   const witnessed = applyWitness(findings, checked, witnessFeeds);
   if (witnessed.overruled.length) sortFindings(findings);
   const byExploitability = byVerdict(findings);
+  const executionFeeds = executionFeedPaths(opts).map((p) => loadExecutionFeed(p));
+  const { byExecution } = applyExecution(findings, root, executionFeeds);
   const driven = byExploitability ? byExploitability['attacker-driven'] : 0;
   const loaded = witnessFeeds.filter((f) => !f.problem);
   return {
@@ -164,6 +167,8 @@ export function applyEstateFacts(findings, checked, root, opts = {}) {
     ...(byExploitability?.exploitable || byExploitability?.confirmed ? { handling: HANDLING } : {}),
     ...(loaded.length ? { witnessFeeds: loaded.map((f) => ({ file: f.file, witness: f.witness, recorded: f.recorded })), byWitness: witnessed.byWitness } : {}),
     ...(witnessFeeds.some((f) => f.problem || f.refused.length) ? { witnessFeedProblems: witnessFeeds.flatMap((f) => (f.problem ? [`${f.file}: ${f.problem}`] : f.refused.map((r) => `${f.file}: ${r.why}`))) } : {}),
+    ...(byExecution ? { executionFeeds: executionFeeds.filter((f) => !f.problem).map((f) => ({ file: f.file, programs: f.programs.size })), byExecution } : {}),
+    ...(executionFeeds.some((f) => f.problem) ? { executionFeedProblems: executionFeeds.filter((f) => f.problem).map((f) => `${f.file}: ${f.problem}`) } : {}),
     // A result no path finding carries: the code changed since the test, or the route is gone.
     ...(witnessed.unmatched.length ? { witnessUnmatched: witnessed.unmatched } : {}),
     // Routes the reading refuted that the estate reproduced: the check model was wrong about them.
@@ -234,10 +239,12 @@ export function scanAll(root, opts = {}) {
   const startedBy = parts.find((p) => p.tool === 'cobolwork-flow')?.startedBy || {};
   for (const p of parts) for (const f of p.findings) findings.push(!f.startedBy && f.program && startedBy[f.program] ? { ...f, startedBy: startedBy[f.program] } : { ...f });
   sortFindings(findings);
-  const identity = stampFingerprints(findings, { root, repo: opts.repoName || '' });
+  // A tree held in memory is read for the fingerprint's line text as it was for the finding.
+  const read = tree.kind === 'directory' ? null : (path) => tree.text(resolve(tree.root, path)).text;
+  const identity = stampFingerprints(findings, { root, repo: opts.repoName || '', read });
   // Routes a check stops keep their identity too, so a finding a fix clears can be found again here.
   const checked = parts.find((p) => p.tool === 'cobolwork-flow')?.checked || [];
-  stampFingerprints(checked, { root, repo: opts.repoName || '' });
+  stampFingerprints(checked, { root, repo: opts.repoName || '', read });
 
   const estate = applyEstateFacts(findings, checked, root, opts);
 

package/lib/sets/build.mjs

@@ -132,7 +132,7 @@ function withFeeds(coverage, feeds) {
 }
 
 export function scanBuild(root, opts = {}) {
-  const site = loadSite(root, opts.site || null);
+  const site = loadSite(root, opts.site || null, opts.tree);
   const tree = treeFor(root, opts);
   const files = tree.list().filter(inScope(opts)).filter(isBuildFile);
   const findings = [];

package/lib/sets/cics.mjs

@@ -136,6 +136,31 @@ function execOptions(exec) {
 
 const subtreeRead = (x) => x.directRefs > 0 || x.children.some(subtreeRead);
 
+// Whether EIBCALEN bounds what the program reads: a condition tests it, or a field it was moved or
+// computed into; it is the start or length of a reference modification, or what an OCCURS DEPENDING
+// ON counts by. A CALL handed it, or the whole EIB, may test it where this program cannot see.
+// Named anywhere else - logged, passed on to a LINK - it checks nothing.
+function testsLength(p) {
+  // A statement's own tokens, since its sources leave out what a condition or an expression wraps
+  // in parentheses: IF (EIBCALEN > 0).
+  const tokens = (p.proc && p.proc.tokens) || [];
+  const own = (st) => (st.at != null ? tokens.slice(st.at + 1, st.end) : st.sources || []);
+  const carriers = new Set(['EIBCALEN']);
+  for (let grew = true; grew;) {
+    grew = false;
+    for (const st of p.statements || []) {
+      if (!own(st).some((t) => carriers.has(t.u))) continue;
+      for (const t of st.targets || []) if (!carriers.has(t.u)) { carriers.add(t.u); grew = true; }
+    }
+  }
+  const carries = (toks) => (toks || []).some((t) => t && carriers.has(t.u));
+  return p.items.some((i) => i.dependingOn === 'EIBCALEN') || (p.statements || []).some((st) =>
+    ((st.verb === 'IF' || st.verb === 'EVALUATE' || st.verb === 'WHEN') && carries(own(st)))
+    || (st.loops || []).some((l) => carries(l.until))
+    || (st.indexes || []).some((x) => x.kind.startsWith('refmod-') && carries([x.tok]))
+    || (st.verb === 'CALL' && (st.sources || []).some((t) => t.u === 'EIBCALEN' || t.u === 'DFHEIBLK')));
+}
+
 // Commands whose failure a program ordinarily lets pass: removing a temporary-storage queue that may
 // not exist, a line written to a transient-data log, the clock, a screen sent to a terminal that may
 // have gone, an ASSIGN, and the RETURN that ends the task anyway.
@@ -191,7 +216,6 @@ export function scanCics(root, opts = {}) {
   // The whole of what the second pass reads, computed once, while the tree is still here.
   function summarise(p, path) {
     const isSignOn = [...new Set([...p.refs.map(x => x.tok.u), ...p.execs.flatMap(e => e.toks.filter(t => t.t === 'word').map(t => t.u))])].some((w) => PASSWORD.test(w));
-    const words = new Set([...p.refs.map(x => x.tok.u), ...p.execs.flatMap(e => e.toks.filter(t => t.t === 'word').map(t => t.u))]);
     const commarea = p.items.find(i => i.name === 'DFHCOMMAREA' && i.section === 'LINKAGE');
     // A variable naming the program usually holds one literal from its VALUE clause.
     const valueOf = (name) => {
@@ -236,7 +260,7 @@ export function scanCics(root, opts = {}) {
       ownCics: p.execs.some((e) => e.kind === 'CICS'),
       pointsItself,
       commarea: commarea ? { ...where(commarea, path), size: commarea.size, read: subtreeRead(commarea) } : null,
-      checksLength: words.has('EIBCALEN'),
+      checksLength: testsLength(p),
       transfers,
       signOnBypasses: isSignOn ? signOnBypasses(p, path) : [],
       // Gated the same way: a program with no password-named field is not answering a sign-on,
@@ -393,7 +417,7 @@ export function scanCics(root, opts = {}) {
         findings.push({
           rule: 'cics-commarea-without-length-check', path: s.commarea.path, line: s.commarea.line, program: s.id,
           ...(covered ? { sev: 'low' } : {}),
-          detail: `${s.id} reads DFHCOMMAREA (${s.commarea.size} bytes declared) and never references EIBCALEN, so a shorter or absent communication area is read as if it were whole${covered ? `; every caller in the tree passes at least ${s.commarea.size} bytes, and no transaction starts it` : ''}`,
+          detail: `${s.id} reads DFHCOMMAREA (${s.commarea.size} bytes declared) and never tests EIBCALEN, so a shorter or absent communication area is read as if it were whole${covered ? `; every caller in the tree passes at least ${s.commarea.size} bytes, and no transaction starts it` : ''}`,
         });
       }
     }

package/lib/sets/copybook.mjs

@@ -7,7 +7,7 @@ import { finish } from '../kernel/findings.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { eachWithinMemory } from '../kernel/memory.mjs';
-import { cobolCard } from '../card.mjs';
+import { cobolCard } from '../cards.mjs';
 
 // A copybook is resolved by name along a search path: the program's own directory first, then the
 // include directories, then the system library. Two files answering to one name mean the record

package/lib/sets/hidden.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { detectFormat, expandTabs } from '../parser.mjs';
-import { cobolCard } from '../card.mjs';
+import { cobolCard } from '../cards.mjs';
 import { decodeEbcdic, inScope, isJcl, isSource, looksEbcdic, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread } from '../kernel/source-tree.mjs';

package/lib/sets/jcl.mjs

@@ -237,7 +237,7 @@ export function scanJcl(root, opts = {}) {
   // A vendor product supplies its own utilities. An estate that has loaded the pack for a product
   // is telling us those programs exist, so reporting them as undefined would be a false positive
   // created by the customer having told us the truth.
-  const site = loadSite(root, opts.site || null);
+  const site = loadSite(root, opts.site || null, opts.tree);
   const { loaded } = loadPacks(opts.packs || site.vendorPacks || [], { allowUnvalidated: true });
   const vendorPrograms = programsOf(loaded);
 

package/lib/sets/priv.mjs

@@ -102,7 +102,7 @@ function under(dsn, prefixes) {
 }
 
 export function scanPriv(root, opts = {}) {
-  const site = loadSite(root, opts.site || null);
+  const site = loadSite(root, opts.site || null, opts.tree);
   const tree = treeFor(root, opts);
   const files = tree.list().filter(inScope(opts));
   const findings = [];

package/lib/sets/recon.mjs

@@ -17,7 +17,7 @@ import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { eachWithinMemory } from '../kernel/memory.mjs';
 import { loadSite, classifyPath, productionQualifierOf, SITE_FILE } from '../site.mjs';
 import { parseJcl, dispositionOf } from '../jcl.mjs';
-import { statementCard } from '../card.mjs';
+import { statementCard } from '../cards.mjs';
 
 
 // The production-dataset rules claim more than the name rule: that the job acts on production, not
@@ -161,7 +161,7 @@ function productionTouches(job, qualifiers) {
 }
 
 export function scanRecon(root, opts = {}) {
-  const site = loadSite(root, opts.site || null);
+  const site = loadSite(root, opts.site || null, opts.tree);
   const tree = treeFor(root, opts);
   const files = tree.list().filter(inScope(opts))
     .filter((f) => isJcl(f) || isProgram(f) || isCopybook(f));

package/lib/sets/semantics.mjs

@@ -216,7 +216,7 @@ export function scanSemantics(root, opts = {}) {
     truncOptPrograms: 0, truncUnknownPrograms: 0, arithExtendPrograms: 0, beyondEnterprisePrograms: 0, computesRead: 0, computesUnread: 0,
     rangesRead: 0, collatingDeclaredPrograms: 0,
   };
-  const site = loadSite(root, opts.site || null).compilerOptions || [];
+  const site = loadSite(root, opts.site || null, opts.tree).compilerOptions || [];
   const parsedJcl = [];
   for (const f of all.filter(isJcl)) {
     try { parsedJcl.push({ ...parseJcl(tree.text(f).text, f), file: relPath(root, f) }); } catch { /* the jcl set reports it */ }

package/lib/sets/vendor.mjs

@@ -26,7 +26,7 @@ export const VENDOR_RULES = {
 const evidenceOf = (r) => (r.severity === 'info' ? { evidence: 'context' } : {});
 
 export function scanVendor(root, opts = {}) {
-  const site = loadSite(root, opts.site || null);
+  const site = loadSite(root, opts.site || null, opts.tree);
   const wanted = opts.packs || site.vendorPacks || [];
   const { loaded, refused, problems, caveats } = loadPacks(wanted, {
     allowUnvalidated: !!(opts.allowUnvalidatedPacks ?? site.allowUnvalidatedPacks),

package/lib/site.mjs

@@ -9,7 +9,7 @@
 // It is also the only part of cobolwork that is inherently per-customer and inherently recurring:
 // conventions drift, environments are renamed, estates are acquired.
 import { readFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { resolvesInside } from './kernel/source-tree.mjs';
 import { printable } from './kernel/printable.mjs';
 
@@ -43,14 +43,24 @@ const EMPTY = {
 // A configuration that is absent is not a configuration that says "nothing is production". The
 // difference is the whole point: without it the recon rules have not looked, and a scan must say
 // it has not looked rather than report a clean result.
-export function loadSite(root, explicit = null) {
-  const path = explicit || join(root, SITE_FILE);
-  if (!existsSync(path)) return { ...EMPTY, path };
-  // A site file in the tree is not read through a link out of it; one the caller names is.
-  if (!explicit && !resolvesInside(root, path)) return { ...EMPTY, path, problems: [`${SITE_FILE} is a link that leads outside the tree, so it was not read`] };
+// `tree` is the scan's source tree: one held in memory (a git revision) supplies the site file
+// itself, and on disk the file is read from `root`.
+export function loadSite(root, explicit = null, tree = null) {
+  const held = !explicit && tree && tree.kind !== 'directory';
+  const path = explicit || (held ? resolve(tree.root, SITE_FILE) : join(root, SITE_FILE));
+  let read;
+  if (held) {
+    if (!tree.contains(path)) return { ...EMPTY, path };
+    read = () => tree.bytes(path).toString('utf8');
+  } else {
+    if (!existsSync(path)) return { ...EMPTY, path };
+    // A site file in the tree is not read through a link out of it; one the caller names is.
+    if (!explicit && !resolvesInside(root, path)) return { ...EMPTY, path, problems: [`${SITE_FILE} is a link that leads outside the tree, so it was not read`] };
+    read = () => readFileSync(path, 'utf8');
+  }
 
   let raw;
-  try { raw = JSON.parse(readFileSync(path, 'utf8')); } catch (e) {
+  try { raw = JSON.parse(read()); } catch (e) {
     return { ...EMPTY, path, problems: [`${SITE_FILE} is not readable as JSON: ${printable(e.message, 120)}`] };
   }
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ...EMPTY, path, problems: [`${SITE_FILE} is not a JSON object`] };

package/lib/sources.mjs

@@ -23,41 +23,90 @@ const has = (list) => (p) => list.includes(extname(p).toLowerCase());
 // of it and reporting a clean zero, which is the failure this project exists to refuse.
 //
 // So a file with no extension is classified by what is in it. Only the first few kilobytes are
-// read, only files without an extension are sniffed, and the answer is cached: this runs over
-// every file in the tree and must not cost a parse.
+// read and only files without an extension are sniffed. The tree a path belongs to classifies it
+// and keeps the answer for as long as the tree lives: this runs over every file in the tree and
+// must not cost a parse, and a cache that outlives the scan grows by one entry per file for the
+// life of the process.
 const SNIFF_BYTES = 4096;
-const sniffed = new Map();
 
 // Names that are certainly not source, so the commonest extensionless files cost nothing.
 const NOT_SOURCE = /^(LICEN[CS]E|README|MAKEFILE|DOCKERFILE|CHANGELOG|NOTICE|AUTHORS|CONTRIBUTING|CODEOWNERS|VERSION|COPYING|Jenkinsfile|Procfile|\..*)$/i;
+const notSource = (path) => NOT_SOURCE.test(path.split(/[\\/]/).pop());
+
+function kindOfHead(head) {
+  // An EBCDIC member is decoded before it is read, or every test below sees mojibake.
+  const text = looksEbcdic(head) ? decodeEbcdic(head) : head.toString('latin1');
+  // A NUL byte means binary. Tested on the bytes rather than with a literal, because a literal
+  // NUL in source is exactly the character an editor or a patch is most likely to eat.
+  if (head.includes(0)) return null;
+  if (/^\s*\/\/\S*\s+(?:JOB|EXEC|PROC|DD)\b/m.test(text)) return 'jcl';
+  if (/\bIDENTIFICATION\s+DIVISION|\bPROGRAM-ID\s*\./i.test(text)) return 'program';
+  // A copybook is a data description with no divisions: level numbers and picture clauses.
+  if (/^[^*\n]{0,10}\s*\d\d\s+[A-Z][A-Z0-9-]*\s+(?:PIC|PICTURE|OCCURS|REDEFINES|USAGE)\b/im.test(text)) return 'copybook';
+  // A BMS map opens its mapset with DFHMSD in the operation field. Tested last, so nothing that
+  // classified before classifies differently.
+  if (/^[^*\s]*[ \t]+DFHMSD(?=\s|$)/im.test(text)) return 'bms';
+  return null;
+}
 
-export function sniffKind(path) {
-  if (sniffed.has(path)) return sniffed.get(path);
-  let kind = null;
-  const name = path.split(/[\\/]/).pop();
-  if (!NOT_SOURCE.test(name)) {
-    try {
-      const fd = openSync(path, 'r');
-      const buf = Buffer.alloc(SNIFF_BYTES);
-      let n;
-      try { n = readSync(fd, buf, 0, SNIFF_BYTES, 0); } finally { closeSync(fd); }
-      const head = buf.subarray(0, n);
-      // An EBCDIC member is decoded before it is read, or every test below sees mojibake.
-      const text = looksEbcdic(head) ? decodeEbcdic(head) : head.toString('latin1');
-      // A NUL byte means binary. Tested on the bytes rather than with a literal, because a literal
-      // NUL in source is exactly the character an editor or a patch is most likely to eat.
-      if (head.includes(0)) kind = null;
-      else if (/^\s*\/\/\S*\s+(?:JOB|EXEC|PROC|DD)\b/m.test(text)) kind = 'jcl';
-      else if (/\bIDENTIFICATION\s+DIVISION|\bPROGRAM-ID\s*\./i.test(text)) kind = 'program';
-      // A copybook is a data description with no divisions: level numbers and picture clauses.
-      else if (/^[^*\n]{0,10}\s*\d\d\s+[A-Z][A-Z0-9-]*\s+(?:PIC|PICTURE|OCCURS|REDEFINES|USAGE)\b/im.test(text)) kind = 'copybook';
-      // A BMS map opens its mapset with DFHMSD in the operation field. Tested last, so nothing that
-      // classified before classifies differently.
-      else if (/^[^*\s]*[ \t]+DFHMSD(?=\s|$)/im.test(text)) kind = 'bms';
-    } catch { kind = null; }
+// What a member's bytes say it is, for a tree that holds them.
+export const kindOfBytes = (buf) => kindOfHead(buf.subarray(0, SNIFF_BYTES));
+
+function sniffDisk(path) {
+  if (notSource(path)) return null;
+  try {
+    const fd = openSync(path, 'r');
+    const buf = Buffer.alloc(SNIFF_BYTES);
+    let n;
+    try { n = readSync(fd, buf, 0, SNIFF_BYTES, 0); } finally { closeSync(fd); }
+    return kindOfHead(buf.subarray(0, n));
+  } catch { return null; }
+}
+
+// A tree's classifier for the paths under its root, remembered for as long as the tree lives.
+const classifiers = new Map();
+
+export const classifyUnder = (root, kindOf) => classifiers.set(root.replace(/[\\/]+$/, ''), new WeakRef(kindOf));
+
+// The classifier of the deepest live tree whose root the path sits under.
+function classifierFor(path) {
+  let best = null;
+  let depth = -1;
+  for (const [root, ref] of classifiers) {
+    if (root.length <= depth || !path.startsWith(root + sep)) continue;
+    const kindOf = ref.deref();
+    if (!kindOf) { classifiers.delete(root); continue; }
+    best = kindOf;
+    depth = root.length;
   }
-  sniffed.set(path, kind);
-  return kind;
+  return best;
+}
+
+// A directory tree's classifier: sniffed from disk once per path.
+export function diskClassifier() {
+  const seen = new Map();
+  return (path) => {
+    if (!seen.has(path)) seen.set(path, sniffDisk(path));
+    return seen.get(path);
+  };
+}
+
+// A held tree's classifier: sniffed from what the tree holds, never from disk.
+export function heldClassifier(bytesOf) {
+  const seen = new Map();
+  return (path) => {
+    if (!seen.has(path)) {
+      let kind = null;
+      if (!notSource(path)) try { kind = kindOfBytes(bytesOf(path)); } catch { kind = null; }
+      seen.set(path, kind);
+    }
+    return seen.get(path);
+  };
+}
+
+export function sniffKind(path) {
+  const kindOf = classifierFor(path);
+  return kindOf ? kindOf(path) : sniffDisk(path);
 }
 
 // Extension first, because it is free and it is right whenever it is present.
@@ -72,13 +121,6 @@ export const isSource = (p) => (extname(p)
   ? [...PROGRAM_EXT, ...COPY_EXT, ...JCL_EXT].includes(extname(p).toLowerCase())
   : ![null, 'bms'].includes(sniffKind(p)));
 
-// For a report that wants to say how much of what it read had no extension to go on.
-export const sniffedCount = () => {
-  let n = 0;
-  for (const v of sniffed.values()) if (v) n++;
-  return n;
-};
-
 // `opts.only` is about rule sets; this is about files. A rule set given an allow list reads the
 // files on it and no others.
 //
@@ -159,8 +201,10 @@ export function decodeEbcdic(buf) {
 
 // Every rule set reads source through here, so an EBCDIC member is decoded once, the same way,
 // and reported as EBCDIC instead of silently parsing as noise.
-export function readSource(path) {
-  const buf = readFileSync(path);
+export const readSource = (path) => decodeSource(readFileSync(path));
+
+// The same decoding for bytes that did not come from a file: a blob read out of a git revision.
+export function decodeSource(buf) {
   if (looksEbcdic(buf)) return { text: decodeEbcdic(buf), encoding: 'ebcdic' };
   return { text: buf.toString('latin1'), encoding: 'latin1' };
 }

package/lib/utilities.mjs

@@ -9,7 +9,7 @@
 // then only the ones its DD names decide on their own.
 
 import { ftpSession } from './ftp.mjs';
-import { statementCard } from './card.mjs';
+import { statementCard } from './cards.mjs';
 
 const upper = (s) => String(s).toUpperCase();
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portll/cobolwork",
-  "version": "0.2.140",
+  "version": "0.3.0",
   "description": "COBOL, JCL and CICS security analysis with zero runtime dependencies: reference-format parser, cross-program data flow, mainframe credential rules. Plugs into commitwork.",
   "license": "AGPL-3.0-or-later",
   "author": "Portll <john@portll.net>",
@@ -14,7 +14,7 @@
   },
   "type": "module",
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "bin": {
     "cobolwork": "bin/cobolwork.mjs"