@portll/cobolwork 0.2.76 → 0.2.117

package/lib/sets/web.mjs

@@ -121,6 +121,25 @@ const TELLS = /^(server|x-powered-by|x-aspnet-version|x-generator|via)$/i;
 // STRING from a field whose name says what it holds - lib/sets/log.mjs already judges the name.
 const CREDENTIAL_PARAM = /[?&/][a-z0-9_-]*(password|passwd|pwd|token|apikey|api_key|secret|credential)[a-z0-9_-]*=/i;
 
+// What a request can make a program change: a file record, a row, or a transaction started. A
+// temporary-storage queue is where a web program keeps its own conversation, so it is not counted.
+function stateChange(e) {
+  const w = e.toks.filter((t) => t.t === 'word').map((t) => t.u);
+  if (e.kind === 'SQL') return ['UPDATE', 'INSERT', 'DELETE', 'MERGE'].includes(w[0]) ? `EXEC SQL ${w[0]}` : null;
+  if (e.kind !== 'CICS') return null;
+  if (['WRITE', 'REWRITE', 'DELETE'].includes(w[0]) && ['FILE', 'DATASET'].includes(w[1])) return `EXEC CICS ${w[0]} ${w[1]}`;
+  if (w[0] === 'START' && w.includes('TRANSID')) return 'EXEC CICS START TRANSID';
+  return null;
+}
+const CONDITION_VERBS = new Set(['IF', 'EVALUATE', 'WHEN']);
+// A WHEN's statement runs to the next verb; its condition is the few words after it.
+const WHEN_WINDOW = 12;
+const CONDITION_WORDS = new Set(['IS', 'NOT', 'EQUAL', 'EQUALS', 'TO', 'THAN', 'GREATER', 'LESS', 'AND', 'OR', 'THEN', 'OF', 'IN', 'TRUE', 'FALSE', 'ALSO', 'OTHER', 'ANY']);
+const FIGURATIVE = /^(SPACES?|ZEROS?|ZEROES|LOW-VALUES?|HIGH-VALUES?|NULLS?|QUOTES?)$/;
+const TOKEN_WORDS = new Set(['TOKEN', 'NONCE', 'CSRF', 'ANTIFORGERY', 'XSRF']);
+const namesToken = (t) => String(t.u).split('-').some((w) => TOKEN_WORDS.has(w));
+const HTTP_METHOD = /^(GET|POST|PUT|PATCH|DELETE)$/i;
+
 // A definition that says nothing about SSL accepts cleartext, because CICS defaults it to NO. So
 // the absence and the explicit NO are one finding, and PROTOCOL only changes what is in the clear.
 const encrypted = (svc) => /^(YES|CLIENTAUTH|CLIENTCERT)$/i.test(String(svc.ssl || ''));
@@ -198,16 +217,18 @@ export function scanWeb(root, opts = {}) {
       const w = e.toks.filter((t) => t.t === 'word').map((t) => t.u);
       return w[0] === 'WEB' && (w[1] === 'RECEIVE' || w[1] === 'READ');
     });
-    const changes = p.execs.filter((e) => {
-      if (e.kind !== 'CICS') return false;
-      const w = e.toks.filter((t) => t.t === 'word').map((t) => t.u);
-      return ['WRITE', 'REWRITE', 'DELETE'].includes(w[0]) && ['FILE', 'DATASET'].includes(w[1]);
+    const changes = p.execs.map((e) => ({ e, what: stateChange(e) })).filter((c) => c.what);
+    // A token counts where a condition compares it with another field: moved, displayed or tested
+    // against SPACES, it verifies nothing.
+    const conditions = (p.statements || []).filter((st) => CONDITION_VERBS.has(st.verb))
+      .map((st) => (p.proc ? p.proc.tokens.slice(st.at + 1, st.end ?? st.at + 1 + WHEN_WINDOW) : []));
+    const comparesToken = conditions.some((c) => {
+      const words = c.filter((t) => t.t === 'word' && !CONDITION_WORDS.has(t.u) && !FIGURATIVE.test(t.u));
+      return words.some(namesToken) && words.length >= 2;
     });
-    const tokenWords = new Set(['TOKEN', 'NONCE', 'CSRF', 'ANTIFORGERY', 'XSRF']);
-    const comparesToken = (p.statements || []).some((st) => (st.sources || [])
-      .some((t) => t.t === 'word' && String(t.u).split('-').some((w) => tokenWords.has(w))));
+    const testsMethod = conditions.some((c) => c.some((t) => t.t === 'lit' && HTTP_METHOD.test(String(t.v).trim())));
 
-    return { headers, sends, cookies, computedHeaders, docText, looksHtml, id: p.id, uris, built, webRequest, changes, comparesToken };
+    return { headers, sends, cookies, computedHeaders, docText, looksHtml, id: p.id, uris, built, webRequest, changes, comparesToken, testsMethod };
   }
 
   // The listener that accepts the request these responses answer. It is defined in a CSD rather
@@ -287,9 +308,12 @@ export function scanWeb(root, opts = {}) {
         });
       }
       if (v.webRequest && v.changes.length && !v.comparesToken) {
+        const what = [...new Set(v.changes.map((c) => c.what))];
         findings.push({
-          rule: 'web-request-changes-state-without-a-token', ...where(v.changes[0], path), program: v.id,
-          detail: `${v.id} changes state on a request it received from the web and compares no token; nothing here follows a token checked in another program reached by LINK, so that is what this could not rule out`,
+          rule: 'web-request-changes-state-without-a-token', ...where(v.changes[0].e, path), program: v.id,
+          detail: `${v.id} changes state (${what.slice(0, 3).join(', ')}${what.length > 3 ? ', …' : ''}) on a request it received from the web and compares no token with another field`
+            + (v.testsMethod ? '; it tests the HTTP method, which a forged request sets too' : '')
+            + '; nothing here follows a token checked in another program reached by LINK, so that is what this could not rule out',
         });
       }
       const html = v.sends.filter((s) => s.html === true).length > 0 || (v.looksHtml && v.sends.length > 0);

package/lib/sets/zowe.mjs

@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Zowe team configuration and the MCP client configuration that launches the Zowe MCP server: where
+// a mainframe credential, a TLS setting or an agent's authority is written into the repository.
+// docs/spec/evidence.md §13.1. A finding names the file, the profile or server and the key, never
+// the value.
+import { basename } from 'node:path';
+import { relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+
+export const ZOWE_RULES = {
+  'zowe-config-secret-in-clear': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-256',
+    text: 'A Zowe team configuration holds a password or token in the file rather than in the credential vault',
+    impact: 'Anyone who can read the repository or a copy of it can log on to the mainframe as that user',
+    remedy: 'Remove the value from properties and list the key in the profile\'s secure array, so Zowe keeps it in the operating system\'s credential vault',
+  },
+  'zowe-config-tls-verify-off': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-295',
+    text: 'A Zowe profile turns off TLS certificate verification',
+    impact: 'Anyone on the network path can present their own certificate and read or change the traffic to the mainframe, logon included',
+    remedy: 'Set rejectUnauthorized to true and install the certificate authority that signed the mainframe\'s certificate',
+  },
+  'zowe-config-cleartext': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-319',
+    text: 'A Zowe profile for z/OSMF, API ML or RSE connects over plain HTTP',
+    impact: 'The logon and the data cross the network in cleartext',
+    remedy: 'Set protocol to https',
+  },
+  'zowe-mcp-password-in-config': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-798',
+    text: 'An MCP client configuration sets a Zowe MCP password, credential map or key passphrase to a literal value',
+    impact: 'Anyone who can read the configuration can log on to the mainframe as the user the agent acts for',
+    remedy: 'Replace the literal with a reference such as ${env:NAME} and keep the value in the environment or a secrets manager',
+  },
+  'zowe-mcp-tier-writes': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-250',
+    text: 'A Zowe MCP server runs at a capability tier that lets the agent change or delete mainframe data',
+    impact: 'The agent can write, update or delete data sets and members as the user it logs on as, without a person approving each change',
+    remedy: 'Run at read-strict or read unless write access is reviewed and needed; grant update or delete for the task that needs it',
+  },
+  'zowe-mcp-tier-full': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-250',
+    text: 'A Zowe MCP server runs at the full capability tier',
+    impact: 'The agent can submit jobs and run commands on the mainframe as the user it logs on as, so text an attacker places where the agent reads it can run work on the system',
+    remedy: 'Run at read-strict or read; give job submission to a separate, reviewed path',
+  },
+  'zowe-mcp-data-marking-off': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-1427',
+    text: 'A Zowe MCP server has its untrusted-data marking turned off',
+    impact: 'Data read from the mainframe reaches the agent unmarked, so instructions planted in a data set, job output or member are not flagged as data',
+    remedy: 'Remove ZOWE_MCP_DATA_MARKING=0 so the default marking applies',
+  },
+  'zowe-mcp-unpinned': {
+    sev: 'low', evidence: 'construct', cwe: 'CWE-829',
+    text: 'A Zowe MCP server is launched by npx with no pinned version',
+    impact: 'Whatever version the registry serves next runs with the agent\'s mainframe credentials',
+    remedy: 'Pin the version: npx @zowe/mcp-server@<version>',
+  },
+  'zowe-mock-credentials': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-798',
+    text: 'A Zowe MCP mock systems.json holds a password',
+    impact: 'A password in mock data is often a real one copied in, and anyone who can read the repository has it',
+    remedy: 'Remove the password from the mock data or replace it with a placeholder',
+  },
+};
+
+// JSON with comments and trailing commas, as VS Code settings and Zowe team configurations allow.
+function stripJsonc(text) {
+  let out = '';
+  let inStr = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inStr) {
+      out += c;
+      if (c === '\\') out += text[++i] ?? '';
+      else if (c === '"') inStr = false;
+    } else if (c === '"') { inStr = true; out += c; }
+    else if (c === '/' && text[i + 1] === '/') { while (i < text.length && text[i] !== '\n') i++; out += '\n'; }
+    else if (c === '/' && text[i + 1] === '*') { i += 2; while (i < text.length && !(text[i] === '*' && text[i + 1] === '/')) { if (text[i] === '\n') out += '\n'; i++; } i++; }
+    else if (c === ',') {
+      let j = i + 1;
+      while (j < text.length && /\s/.test(text[j])) j++;
+      if (text[j] !== '}' && text[j] !== ']') out += c;
+    } else out += c;
+  }
+  return out;
+}
+
+// The line of `"key"` after the first `"anchor"`, or of the first `"key"` in the file.
+function lineOf(text, key, anchor = null) {
+  const from = anchor ? Math.max(0, text.indexOf(`"${anchor}"`)) : 0;
+  let idx = text.indexOf(`"${key}"`, from);
+  if (idx < 0) idx = text.indexOf(`"${key}"`);
+  return idx < 0 ? 1 : text.slice(0, idx).split('\n').length;
+}
+
+const isReference = (v) => typeof v === 'string' && /^\$\{(?:env:|input:)?[A-Za-z_][A-Za-z0-9_]*\}$/.test(v);
+
+function kindOf(rel) {
+  const base = basename(rel);
+  const parts = rel.split('/');
+  const parent = parts.length > 1 ? parts[parts.length - 2] : '';
+  if (base === 'zowe.config.json' || base === 'zowe.config.user.json') return 'team';
+  if (base === '.mcp.json' || base === 'claude_desktop_config.json') return 'mcp';
+  if (base === 'mcp.json' && (parent === '.vscode' || parent === '.cursor')) return 'mcp';
+  if ((base === 'settings.json' || base === 'settings.local.json') && parent === '.claude') return 'mcp';
+  if (base === 'settings.json' && parent === '.gemini') return 'mcp';
+  if (base === 'settings.json' && parent === '.vscode') return 'vscode';
+  if (base === 'systems.json' && parts.slice(0, -1).some((p) => /mock/i.test(p))) return 'mock';
+  return null;
+}
+
+function eachProfile(profiles, prefix, fn) {
+  if (!profiles || typeof profiles !== 'object' || Array.isArray(profiles)) return;
+  for (const [name, profile] of Object.entries(profiles)) {
+    if (!profile || typeof profile !== 'object') continue;
+    const path = prefix ? `${prefix}.${name}` : name;
+    fn(profile, path, name);
+    eachProfile(profile.profiles, path, fn);
+  }
+}
+
+function teamConfig(config, raw, rel, findings) {
+  eachProfile(config.profiles, '', (profile, name, leaf) => {
+    const props = profile.properties && typeof profile.properties === 'object' ? profile.properties : {};
+    const secure = Array.isArray(profile.secure) ? profile.secure : [];
+    for (const key of ['password', 'tokenValue', 'authToken']) {
+      if (typeof props[key] === 'string' && props[key] && !secure.includes(key)) {
+        findings.push({ rule: 'zowe-config-secret-in-clear', path: rel, line: lineOf(raw, key, leaf), detail: `profile ${name} holds properties.${key} in the file, and its secure array does not list it` });
+      }
+    }
+    if (props.rejectUnauthorized === false) findings.push({ rule: 'zowe-config-tls-verify-off', path: rel, line: lineOf(raw, 'rejectUnauthorized', leaf), detail: `profile ${name} sets rejectUnauthorized to false` });
+    if (['zosmf', 'apiml', 'rse'].includes(String(profile.type)) && String(props.protocol).toLowerCase() === 'http') {
+      findings.push({ rule: 'zowe-config-cleartext', path: rel, line: lineOf(raw, 'protocol', leaf), detail: `profile ${name} (type ${profile.type}) connects over http` });
+    }
+  });
+}
+
+const isZoweServer = (s) => s && typeof s === 'object' && /@zowe\/mcp-server|zowe-mcp/.test([s.command, ...(Array.isArray(s.args) ? s.args : [])].map(String).join(' '));
+
+function tierOf(server) {
+  const args = Array.isArray(server.args) ? server.args.map(String) : [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--capability-tier' && i + 1 < args.length) return args[i + 1];
+    if (args[i].startsWith('--capability-tier=')) return args[i].slice('--capability-tier='.length);
+  }
+  const env = server.env && typeof server.env === 'object' ? server.env : {};
+  return typeof env.ZOWE_MCP_CAPABILITY_TIER === 'string' ? env.ZOWE_MCP_CAPABILITY_TIER : null;
+}
+
+function tierFinding(tier, rel, line, where) {
+  if (tier === 'full') return { rule: 'zowe-mcp-tier-full', path: rel, line, detail: `${where} runs at capability tier full` };
+  if (tier === 'update' || tier === 'delete') return { rule: 'zowe-mcp-tier-writes', path: rel, line, detail: `${where} runs at capability tier ${tier}` };
+  return null;
+}
+
+function mcpConfig(config, raw, rel, findings) {
+  const servers = config.mcpServers || config.servers || {};
+  if (!servers || typeof servers !== 'object') return;
+  for (const [name, server] of Object.entries(servers)) {
+    if (!isZoweServer(server)) continue;
+    const env = server.env && typeof server.env === 'object' ? server.env : {};
+    for (const [key, value] of Object.entries(env)) {
+      if ((key === 'ZOWE_MCP_CREDENTIALS' || key.startsWith('ZOWE_MCP_PASSWORD_') || key.startsWith('ZOWE_MCP_KEY_PASSPHRASE_')) && value !== '' && !isReference(value)) {
+        findings.push({ rule: 'zowe-mcp-password-in-config', path: rel, line: lineOf(raw, key, name), detail: `server ${name} sets ${key} to a literal value` });
+      }
+    }
+    const t = tierFinding(tierOf(server), rel, lineOf(raw, 'capability-tier', name) || lineOf(raw, 'ZOWE_MCP_CAPABILITY_TIER', name), `server ${name}`);
+    if (t) findings.push(t);
+    if (String(env.ZOWE_MCP_DATA_MARKING) === '0') findings.push({ rule: 'zowe-mcp-data-marking-off', path: rel, line: lineOf(raw, 'ZOWE_MCP_DATA_MARKING', name), detail: `server ${name} sets ZOWE_MCP_DATA_MARKING to 0` });
+    if (String(server.command) === 'npx') {
+      const pkg = (Array.isArray(server.args) ? server.args.map(String) : []).find((a) => a.startsWith('@zowe/mcp-server'));
+      if (pkg && (pkg === '@zowe/mcp-server' || pkg === '@zowe/mcp-server@latest')) findings.push({ rule: 'zowe-mcp-unpinned', path: rel, line: lineOf(raw, pkg, name), detail: `server ${name} runs ${pkg} through npx` });
+    }
+  }
+}
+
+function vscodeSettings(config, raw, rel, findings) {
+  const tier = config['zoweMCP.capabilityTier'];
+  const t = typeof tier === 'string' ? tierFinding(tier, rel, lineOf(raw, 'zoweMCP.capabilityTier'), 'the VS Code setting zoweMCP.capabilityTier') : null;
+  if (t) findings.push(t);
+}
+
+function passwordPaths(value, path, out) {
+  if (Array.isArray(value)) value.forEach((v, i) => passwordPaths(v, `${path}[${i}]`, out));
+  else if (value && typeof value === 'object') {
+    for (const [k, v] of Object.entries(value)) {
+      const p = path ? `${path}.${k}` : k;
+      if (/^password$/i.test(k) && typeof v === 'string' && v) out.push(p);
+      else passwordPaths(v, p, out);
+    }
+  }
+  return out;
+}
+
+function mockSystems(config, raw, rel, findings) {
+  for (const p of passwordPaths(config, '', [])) findings.push({ rule: 'zowe-mock-credentials', path: rel, line: lineOf(raw, 'password'), detail: `the mock systems file holds a password at ${p}` });
+}
+
+const READERS = { team: teamConfig, mcp: mcpConfig, vscode: vscodeSettings, mock: mockSystems };
+
+export function scanZowe(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const findings = [];
+  const stats = { filesScanned: 0, filesUnreadable: 0, filesUnparsed: 0 };
+  const files = tree.list().filter((f) => kindOf(relPath(root, f)));
+  const run = eachWithinMemory(files, (f) => {
+    const rel = relPath(root, f);
+    let raw;
+    try { raw = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    let config;
+    try { config = JSON.parse(stripJsonc(raw)); } catch { stats.filesUnparsed++; return raw.length; }
+    stats.filesScanned++;
+    if (config && typeof config === 'object') READERS[kindOf(rel)](config, raw, rel, findings);
+    return raw.length;
+  }, { label: 'zowe', maxBytes: opts.maxSourceBytes ?? Infinity });
+  return report('zowe', { rules: ZOWE_RULES, findings, stats, run });
+}

package/lib/sources.mjs

@@ -118,6 +118,16 @@ const E2A = (() => {
   return t;
 })();
 
+// A printable character's EBCDIC position, for ordering. Brackets, caret and not-sign move between
+// 037, 1047 and 1140, so they have no one position and give null, as does anything off the table.
+const A2E = (() => {
+  const at = new Map();
+  E2A.forEach((ch, b) => { if (b >= 0x40 && ch !== '�') at.set(ch, at.has(ch) ? null : b); });
+  for (const ch of '[]^¬') at.set(ch, null);
+  return at;
+})();
+export const ebcdicByte = (ch) => A2E.get(ch) ?? null;
+
 const ASCII_ALNUM = (b) => (b >= 0x30 && b <= 0x39) || (b >= 0x41 && b <= 0x5A) || (b >= 0x61 && b <= 0x7A);
 const EBCDIC_ALNUM = (b) => (b >= 0x81 && b <= 0xA9) || (b >= 0xC1 && b <= 0xE9) || (b >= 0xF0 && b <= 0xF9);
 

package/lib/tui/app.mjs

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { createScreen, put, styleRow } from './screen.mjs';
 import { ACTIONS, KEYMAPS, LEGEND, actionFor } from './keys.mjs';
-import { EVIDENCE } from '../kernel/findings.mjs';
+import { EVIDENCE, EXPLOITABILITY } from '../kernel/findings.mjs';
 import {
-  banner, countsLine, rows as findingRows, viewLabel, DEFAULT_VIEW, SORT_NAMES, EVIDENCE_KINDS, WHO_ACTS, SEV_LETTER,
+  banner, countsLine, exploitLine, rows as findingRows, viewLabel, DEFAULT_VIEW, SORT_NAMES, EVIDENCE_KINDS, VERDICTS, WHO_ACTS, SEV_LETTER,
 } from './model.mjs';
 
 export const PANELS = Object.freeze(['home', 'findings', 'finding', 'help']);
@@ -93,7 +93,7 @@ function move(s, action) {
   return done(s);
 }
 
-const SORT_WORDS = { SEV: 'severity', SEVERITY: 'severity', RULE: 'rule', PROGRAM: 'program', PGM: 'program', WHERE: 'where', FILE: 'where', PATH: 'where', EVIDENCE: 'evidence', EVID: 'evidence' };
+const SORT_WORDS = { SEV: 'severity', SEVERITY: 'severity', RULE: 'rule', PROGRAM: 'program', PGM: 'program', WHERE: 'where', FILE: 'where', PATH: 'where', EVIDENCE: 'evidence', EVID: 'evidence', EXPLOIT: 'exploit', EXPLOITABILITY: 'exploit' };
 
 function command(s, text) {
   const [word, ...rest] = text.split(/\s+/);
@@ -116,11 +116,13 @@ function command(s, text) {
       return key ? fresh({ ...s.view, sort: key }) : done({ ...s, message: `SORT takes ${SORT_NAMES.join(', ')}.` });
     }
     case 'FILTER': {
-      if (/^off$/i.test(arg)) return fresh({ ...s.view, evidence: null });
-      const kinds = arg.toLowerCase().split(/[,\s]+/).filter(Boolean);
-      const bad = kinds.filter((k) => !EVIDENCE_KINDS.includes(k));
-      if (!kinds.length || bad.length) return done({ ...s, message: `FILTER takes ${EVIDENCE_KINDS.join(', ')} or OFF${bad.length ? `; not ${bad.join(', ')}` : ''}.` });
-      return fresh({ ...s.view, evidence: kinds });
+      if (/^off$/i.test(arg)) return fresh({ ...s.view, evidence: null, exploit: null });
+      const words = arg.toLowerCase().split(/[,\s]+/).filter(Boolean);
+      const bad = words.filter((k) => !EVIDENCE_KINDS.includes(k) && !VERDICTS.includes(k));
+      if (!words.length || bad.length) return done({ ...s, message: `FILTER takes an evidence kind or an exploitability verdict (F1 lists them), or OFF${bad.length ? `; not ${bad.join(', ')}` : ''}.` });
+      const kinds = words.filter((k) => EVIDENCE_KINDS.includes(k));
+      const verdicts = words.filter((k) => VERDICTS.includes(k));
+      return fresh({ ...s.view, evidence: kinds.length ? kinds : null, exploit: verdicts.length ? verdicts : null });
     }
     case 'FIND':
       return arg ? fresh({ ...s.view, find: arg }) : done({ ...s, message: 'FIND needs the text to look for.' });
@@ -185,6 +187,8 @@ const DRAW = {
     let r = r0 + 1;
     put(scr, r++, 1, `Findings  ${sum.findings ?? s.report.findings.length}${accepted}`);
     put(scr, r++, 1, countsLine(s.report));
+    const exploit = exploitLine(s.report);
+    if (exploit) put(scr, r++, 1, exploit, sum.byExploitability.exploitable ? 'warn' : undefined);
     const kinds = [['programs', sum.programFiles], ['copybooks', sum.copybookFiles], ['JCL', sum.jclFiles]].filter(([, n]) => n != null);
     put(scr, r++, 1, `Read      ${sum.filesScanned ?? '?'} file(s)${kinds.length ? `: ${kinds.map(([k, n]) => `${n} ${k}`).join(', ')}` : ''}`);
     r++;
@@ -204,8 +208,11 @@ const DRAW = {
     let r = drawBanner(scr, s.report, 2, 4);
     put(scr, r++, 1, countsLine(s.report));
     const whereW = 17, progW = 9;
-    const ruleW = s.cols - 18 - progW - whereW - 1;
-    put(scr, r++, 0, `   Sv Evidence  X ${pad('Rule', ruleW)} ${pad('Program', progW)}${'Where'}`, 'dim');
+    // The verdict needs room the rule name cannot give up at 80 columns, so only a wider terminal shows it.
+    const exploitW = s.cols >= 100 ? 16 : 0;
+    const ruleW = s.cols - 18 - progW - whereW - 1 - exploitW;
+    const exploitCol = (text) => (exploitW ? `${pad(text, exploitW - 1)} ` : '');
+    put(scr, r++, 0, `   Sv Evidence  ${exploitCol('Exploit')}X ${pad('Rule', ruleW)} ${pad('Program', progW)}${'Where'}`, 'dim');
     const list = findingRows(s.report, s.view);
     if (!list.length) put(scr, layout.listTop, 1, s.report.findings.length ? 'No finding matches this view. RESET shows them all.' : 'No findings.');
     for (let i = 0; i < layout.height && s.top + i < list.length; i++) {
@@ -213,7 +220,7 @@ const DRAW = {
       const x = list[at];
       const row = layout.listTop + i;
       const mark = at === s.sel ? ' > ' : '   ';
-      put(scr, row, 0, `${mark}${x.letter}  ${pad(x.evidence, 9)} ${x.cross ? 'X' : ' '} ${pad(x.rule, ruleW)} ${pad(x.program || '-', progW)}${pad(x.where, whereW)}`);
+      put(scr, row, 0, `${mark}${x.letter}  ${pad(x.evidence, 9)} ${exploitCol(x.exploit)}${x.cross ? 'X' : ' '} ${pad(x.rule, ruleW)} ${pad(x.program || '-', progW)}${pad(x.where, whereW)}`);
       if (at === s.sel) styleRow(scr, row, 'sel');
       else if (x.sev === 'crit' || x.sev === 'high') put(scr, row, 3, x.letter, x.sev);
     }
@@ -265,6 +272,7 @@ function bodyLines(s, t) {
     return HELP[t.of].flatMap((p) => (p ? wrap(p, w).map((l) => ` ${l}`) : ['']));
   }
   const { f } = t;
+  const x = f.exploitability;
   const field = (label, value) => wrap(value, w - 11).map((l, i) => ` ${i ? ''.padEnd(10) : label.padEnd(10)}${l}`);
   const lines = [
     ...field('Rule', f.rule),
@@ -272,9 +280,17 @@ function bodyLines(s, t) {
     ...(f.guardedFrom ? field('Checked', `lowered from ${f.guardedFrom} by the check on ${f.guard.item} at ${f.guard.file}:${f.guard.line}`) : []),
     ...field('Evidence', `${f.evidence}: ${EVIDENCE[f.evidence] || ''}`),
     ...field('Who acts', WHO_ACTS[f.evidence] || 'not stated'),
+    ...(x ? field('Exploit', `${x.verdict}${x.drivenBy ? `, driven by ${x.drivenBy[0].toLowerCase()}${x.drivenBy.slice(1)}` : ''}`) : []),
     ...(f.program ? field('Program', `${f.program}${f.crossProgram ? '   crosses programs' : ''}${f.hops ? `   ${f.hops} hop(s)` : ''}`) : []),
     ...field('Where', `${f.path}:${f.line}`),
     ...field('Identity', f.fingerprint || 'none: this report predates fingerprints'),
+    ...(x ? [
+      '',
+      ...field('Verdict', EXPLOITABILITY[x.verdict] || x.verdict),
+      ...(x.because || []).flatMap((b, i) => wrap(`- ${b}`, w - 11, '  ').map((l, j) => ` ${(i || j ? '' : 'Because').padEnd(10)}${l}`)),
+      ...(x.unknown ? field('Unknown', x.unknown) : []),
+      ...(x.fixAt ? field('Fix at', x.fixAt.test || x.fixAt.why) : []),
+    ] : []),
     '',
     ...wrap(f.detail || '', w).map((l) => ` ${l}`),
   ];
@@ -307,8 +323,8 @@ const HELP = {
     'Enter opens the selected finding. F7 and F8, or Page Up and Page Down, move a page.',
     '',
     'Commands:',
-    '  SORT SEVERITY, RULE, PROGRAM, WHERE or EVIDENCE',
-    `  FILTER one or more of ${EVIDENCE_KINDS.join(', ')}; FILTER OFF`,
+    '  SORT SEVERITY, RULE, PROGRAM, WHERE, EVIDENCE or EXPLOIT',
+    `  FILTER one or more of ${EVIDENCE_KINDS.join(', ')}, or of ${VERDICTS.join(', ')}; FILTER OFF`,
     '  FIND text: rule, program, path or detail containing it',
     '  RESET: the whole list, by severity',
     '  TOP, BOTTOM, END, and =X to leave',
@@ -318,6 +334,8 @@ const HELP = {
     '',
     'Evidence says what the tool established. A path was traced by reading the code, not by running it. Severity says how urgent it is; a check on the route lowers it one step and is named here.',
     '',
+    'Exploit is whether an attacker can use a path: exploitable needs the estate to declare an entry that reaches it open to any user. Because lists the facts the verdict rests on; Unknown names the one that would move it.',
+    '',
     'Identity is the fingerprint. It does not change when code moves above the finding, so a baseline or a later report can refer to it.',
     '',
     'cobolwork explain <path> <fingerprint> prints the trace with the source line of every hop.',

package/lib/tui/model.mjs

@@ -1,10 +1,11 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import { EVIDENCE } from '../kernel/findings.mjs';
+import { EVIDENCE, EXPLOITABILITY } from '../kernel/findings.mjs';
 
 export { WHO_ACTS } from '../kernel/findings.mjs';
 export const SEVERITIES = Object.freeze(['crit', 'high', 'med', 'low', 'info']);
 export const SEV_LETTER = Object.freeze({ crit: 'C', high: 'H', med: 'M', low: 'L', info: 'I' });
 export const EVIDENCE_KINDS = Object.freeze(Object.keys(EVIDENCE));
+export const VERDICTS = Object.freeze(Object.keys(EXPLOITABILITY));
 
 export function readReport(doc) {
   const refuse = (why) => { throw new Error(`not a cobolwork findings report: ${why}`); };
@@ -52,30 +53,43 @@ export const countsLine = (report) => {
   return `Sev ${sev}    Evidence ${ev || 'none'}`;
 };
 
+// The path findings by verdict, or null for a report that carries none.
+export const exploitLine = (report) => {
+  const by = report.summary.byExploitability;
+  if (!by) return null;
+  const counts = VERDICTS.filter((v) => by[v]).map((v) => `${v} ${by[v]}`);
+  return `Exploit   ${counts.join('  ') || 'no path finding'}`;
+};
+
+const verdictRank = (f) => { const i = VERDICTS.indexOf(f.exploitability?.verdict); return i < 0 ? VERDICTS.length : i; };
+
 const SORTS = {
   severity: (a, b) => SEVERITIES.indexOf(a.sev) - SEVERITIES.indexOf(b.sev) || cmp(a.rule, b.rule) || cmpWhere(a, b),
   rule: (a, b) => cmp(a.rule, b.rule) || SEVERITIES.indexOf(a.sev) - SEVERITIES.indexOf(b.sev) || cmpWhere(a, b),
   program: (a, b) => cmp(a.program, b.program) || SORTS.severity(a, b),
   where: (a, b) => cmpWhere(a, b) || cmp(a.rule, b.rule),
   evidence: (a, b) => cmp(a.evidence, b.evidence) || SORTS.severity(a, b),
+  exploit: (a, b) => verdictRank(a.f) - verdictRank(b.f) || SORTS.severity(a, b),
 };
 export const SORT_NAMES = Object.freeze(Object.keys(SORTS));
 const cmp = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
 const cmpWhere = (a, b) => cmp(a.path, b.path) || (a.line || 0) - (b.line || 0);
 
-export const DEFAULT_VIEW = Object.freeze({ sort: 'severity', evidence: null, find: '' });
+export const DEFAULT_VIEW = Object.freeze({ sort: 'severity', evidence: null, exploit: null, find: '' });
 
 export function rows(report, view = DEFAULT_VIEW) {
   const find = (view.find || '').toUpperCase();
   const out = [];
   for (const f of report.findings) {
     if (view.evidence && !view.evidence.includes(f.evidence)) continue;
+    if (view.exploit && !view.exploit.includes(f.exploitability?.verdict)) continue;
     if (find && ![f.rule, f.program, f.path, f.detail].some((x) => x && String(x).toUpperCase().includes(find))) continue;
     out.push({
       f,
       sev: f.sev,
       letter: SEV_LETTER[f.sev] || '?',
       evidence: f.evidence || '',
+      exploit: f.exploitability?.verdict || '',
       rule: f.rule || '',
       program: f.program || '',
       path: f.path || '',
@@ -91,6 +105,7 @@ export function viewLabel(view) {
   const parts = [];
   if (view.sort && view.sort !== 'severity') parts.push(`sorted by ${view.sort}`);
   if (view.evidence) parts.push(`evidence ${view.evidence.join(',')}`);
+  if (view.exploit) parts.push(`exploit ${view.exploit.join(',')}`);
   if (view.find) parts.push(`find ${view.find}`);
   return parts.join(', ');
 }