@portll/cobolwork 0.3.0 → 0.4.0

package/lib/dataflow.mjs

@@ -87,6 +87,7 @@ function literalNames(prog) {
 // The value of the last NAME(value) option in a list: the last one wins, at either level.
 function lastOption(name, list) {
   for (let k = (list || []).length - 1; k >= 0; k--) {
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- name is a literal option name
     const m = new RegExp(`^${name}\\(([A-Z]+)\\)$`).exec(list[k]);
     if (m) return m[1];
   }
@@ -215,11 +216,13 @@ export function analyze(root, opts = {}) {
   const rel = (p) => { let r = relOf.get(p); if (r === undefined) { r = relPath(root, p); relOf.set(p, r); } return r; };
   // `at` is the statement an edge that is not a statement's own is read at: the CALL or LINK that
   // passes an argument, the PUT or GET of a container.
-  const edge = (a, b, why, dir, at) => {
+  // `link` marks an edge into a callee at a call site ({ call }) or back out to it ({ ret }).
+  const edge = (a, b, why, dir, at, link) => {
     if (!a || !b || a === b) return;
-    a.edgesOut.push(at != null ? { to: b, why, dir, at } : { to: b, why, dir });
+    a.edgesOut.push({ to: b, why, dir, ...(at != null ? { at } : {}), ...link });
     stats.edges++;
   };
+  let callSites = 0;
 
   // Everything the graph needs from one program is taken while its parse tree is in hand, and the
   // tree is then released. Holding every tree until the end is what exhausted a 4 GB heap on an
@@ -236,7 +239,9 @@ export function analyze(root, opts = {}) {
         let repeats = false;
         let table = null;
         for (let a = item; a; a = a.parent) if ((a.occurs || 1) > 1) { repeats = true; table = a; }
-        n = { id: nodes.length, pk, program: prog.id, file, name: item.name, off: item.offset ?? null, size: item.size ?? null, repeats, edgesOut: [], sources: [], sinks: [] };
+        let top = item;
+        while (top.parent) top = top.parent;
+        n = { id: nodes.length, pk, program: prog.id, file, name: item.name, off: item.offset ?? null, size: item.size ?? null, repeats, edgesOut: [], sources: [], sinks: [], ...(top.section === 'LINKAGE' ? { linkage: true } : {}) };
         // Where the outermost table holding this item sits in the record: every occurrence of the
         // item is somewhere inside it. A group's size already counts its occurrences; an
         // elementary item's is one element.
@@ -1040,21 +1045,23 @@ export function analyze(root, opts = {}) {
   for (const p of programs) {
     for (const t of p.transfers) {
       const r = calleesOf(t.callee, p.file);
+      const site = ++callSites;
       for (const callee of r.list) {
         if (!callee.commarea) continue;
-        edge(t.argNode, callee.commarea, `EXEC CICS ${t.verb} COMMAREA to ${t.callee}${t.through ? `, the program ${t.through} names` : ''}${ofN(r, t.callee)}`, undefined, t.point);
-        if (t.verb === 'LINK') edge(callee.commarea, t.argNode, `COMMAREA returned from ${t.callee}${ofN(r, t.callee)}`);
+        edge(t.argNode, callee.commarea, `EXEC CICS ${t.verb} COMMAREA to ${t.callee}${t.through ? `, the program ${t.through} names` : ''}${ofN(r, t.callee)}`, undefined, t.point, { call: site });
+        if (t.verb === 'LINK') edge(callee.commarea, t.argNode, `COMMAREA returned from ${t.callee}${ofN(r, t.callee)}`, undefined, undefined, { ret: site });
       }
     }
     for (const c of p.callSites) {
       const r = calleesOf(c.name, p.file);
+      const site = ++callSites;
       for (const callee of r.list) {
         if (!callee.params) continue;
         c.args.forEach((arg, i) => {
           const param = callee.params[i];
           if (!param || !arg.node || !param.node) return;
-          edge(arg.node, param.node, `CALL '${c.display}' argument ${i + 1} at ${rel(c.file)}:${c.line}${ofN(r, c.display)}`, undefined, c.point);
-          if (arg.mode === 'REFERENCE' && param.mode === 'REFERENCE') edge(param.node, arg.node, `CALL '${c.display}' argument ${i + 1} written back${ofN(r, c.display)}`);
+          edge(arg.node, param.node, `CALL '${c.display}' argument ${i + 1} at ${rel(c.file)}:${c.line}${ofN(r, c.display)}`, undefined, c.point, { call: site });
+          if (arg.mode === 'REFERENCE' && param.mode === 'REFERENCE') edge(param.node, arg.node, `CALL '${c.display}' argument ${i + 1} written back${ofN(r, c.display)}`, undefined, undefined, { ret: site });
         });
       }
       const callee = r.list.length === 1 ? r.list[0] : null;
@@ -1347,6 +1354,7 @@ export function analyze(root, opts = {}) {
   // last moved - at a point where the credit reaches `level`.
   function refuse(start, reach, credited, level, kind, shift = 0) {
     walk++;
+    stampCtx.clear();
     const want = credited.filter((c) => c.level >= level && c.sink.kind === kind && (c.sink.offset || 0) === shift);
     // Past the budget no route can be ruled out, so every credit in question is lost: a finding
     // may be reported unchecked, never dropped.
@@ -1380,17 +1388,15 @@ export function analyze(root, opts = {}) {
         // stand in for it.
         const guarded = since.some((n) => n.checks || n.guard);
         if (t.partial) {
-          const key = `${to.id}|${guarded}`;
+          const key = `${to.id}|${guarded}|${t.ctx}`;
           const held = parts.get(key);
           if (held && held.some((r) => (r[2] ? t.vague : !t.vague && r[0] <= t.lo && t.hi <= r[1]))) continue;
           if (held) held.push([t.lo, t.hi, t.vague]); else parts.set(key, [[t.lo, t.hi, t.vague]]);
         } else if (guarded) {
-          if (stampWhole[to.id] === walk || dirty.get(to.id) === walk) continue;
-          dirty.set(to.id, walk);
-        } else {
-          if (stampWhole[to.id] === walk) continue;
-          stampWhole[to.id] = walk;
-        }
+          const dk = `${to.id}|${t.ctx}`;
+          if (stampWhole[to.id] === walk || dirty.get(dk) === walk) continue;
+          dirty.set(dk, walk);
+        } else if (!firstVisit(to.id, t.ctx)) continue;
         open.push({ node: to, ...t, since });
       }
       if (edgesWalked - began > walkBudget) { stats.creditUndecided++; return new Set(want); }
@@ -1409,6 +1415,16 @@ export function analyze(root, opts = {}) {
   // Visit stamps instead of a per-walk Set: one walk per source, and a Set of string keys per walk
   // was most of the time spent on large repositories.
   const stampWhole = new Int32Array(nodes.length);
+  // A whole node reached with a call context, per walk. Reached with none, it stands in for every context.
+  const stampCtx = new Map();
+  const firstVisit = (id, ctx) => {
+    if (stampWhole[id] === walk) return false;
+    if (!ctx) { stampWhole[id] = walk; return true; }
+    const key = `${id}|${ctx}`;
+    if (stampCtx.get(key) === walk) return false;
+    stampCtx.set(key, walk);
+    return true;
+  };
   let walk = 0;
   // Every walk is bounded, and so is the analysis. One source of an estate whose programs share
   // their records through thousands of copybooks reached millions of nodes, and 22,905 such walks
@@ -1425,9 +1441,25 @@ export function analyze(root, opts = {}) {
   // it does not. Both walks below cross edges through this, so neither can take a route the other
   // would refuse.
   const known = (n) => n.off != null && n.size != null && !n.repeats;
+  // The call sites a value entered its callees through, innermost last, as a string; empty where any
+  // caller may be returned to: a value born in the callee, or one that rested in storage a program
+  // keeps between calls, which a later call from any caller can read.
+  const CONTEXT_DEPTH = 4;
+  function contextOver(state, e) {
+    const ctx = state.ctx || '';
+    if (e.ret != null) {
+      if (!ctx) return '';
+      const sites = ctx.split('/');
+      return Number(sites[sites.length - 1]) === e.ret ? sites.slice(0, -1).join('/') : null;
+    }
+    if (e.call != null) return [...(ctx ? ctx.split('/') : []), String(e.call)].slice(-CONTEXT_DEPTH).join('/');
+    return e.to.linkage ? ctx : '';
+  }
   function cross(state, e) {
     const cur = state.node;
     const to = e.to;
+    const ctx = contextOver(state, e);
+    if (ctx === null) return null;
     let partial = false, lo = 0, hi = 0, vague = false;
     if (opts.legacyGroupEdges) { /* every edge carries the whole item */ }
     else if (e.dir === 'up') {
@@ -1464,7 +1496,7 @@ export function analyze(root, opts = {}) {
         if (!vague && to.size != null) { hi = Math.min(hi, to.size); if (hi <= lo) return null; }
       }
     }
-    return { partial, lo, hi, vague };
+    return { partial, lo, hi, vague, ctx };
   }
   for (const start of nodes) {
     if (!start.sources.length || !canReach[start.id]) continue;
@@ -1473,6 +1505,7 @@ export function analyze(root, opts = {}) {
       if (!(canReach[start.id] & reach)) continue;
       if (edgesWalked >= totalBudget) { stats.sourcesNotWalked++; continue; }
       walk++;
+      stampCtx.clear();
       const credited = [];
       // A state is a node plus which of its bytes are tainted. Going up from a child taints only
       // that child's bytes of the group; going down reaches a child only if those bytes overlap it,
@@ -1539,16 +1572,14 @@ export function analyze(root, opts = {}) {
           const to = e.to;
           const crossed = cross(state, e);
           if (!crossed) continue;
-          const { partial, lo, hi, vague } = crossed;
+          const { partial, lo, hi, vague, ctx } = crossed;
           if (partial) {
-            const held = partSeen.get(to.id);
+            const pk = `${to.id}|${ctx}`;
+            const held = partSeen.get(pk);
             if (held && held.some(r => (r[2] ? vague : !vague && r[0] <= lo && hi <= r[1]))) continue;
-            if (held) held.push([lo, hi, vague]); else partSeen.set(to.id, [[lo, hi, vague]]);
-          } else {
-            if (stampWhole[to.id] === walk) continue;
-            stampWhole[to.id] = walk;
-          }
-          queue.push({ node: to, partial, lo, hi, vague, prev: state, why: e.why, dir: e.dir, point: pointOfEdge(e), moves: moves(e) });
+            if (held) held.push([lo, hi, vague]); else partSeen.set(pk, [[lo, hi, vague]]);
+          } else if (!firstVisit(to.id, ctx)) continue;
+          queue.push({ node: to, partial, lo, hi, vague, ctx, prev: state, why: e.why, dir: e.dir, point: pointOfEdge(e), moves: moves(e) });
         }
       }
       if (cut) stats.walksCut++;

package/lib/explain.mjs

@@ -2,7 +2,7 @@
 import { resolve, relative, sep, dirname } from 'node:path';
 import { realpathSync } from 'node:fs';
 import { readSource, isProgram, isCopybook, isJcl } from './sources.mjs';
-import { parseFile, buildFileIndex, detectFormat } from './parser.mjs';
+import { parseFile, buildFileIndex, detectFormat, normalize, tokenize, segmentEnd } from './parser.mjs';
 import { EVIDENCE } from './kernel/findings.mjs';
 import { REGISTRY } from './kernel/registry.mjs';
 import { WHO_ACTS } from './tui/model.mjs';
@@ -34,6 +34,21 @@ function contained(root, rel) {
   return { abs };
 }
 
+// The last line of the COBOL statement that starts on `line`, its period or END- terminator included,
+// so a drafter shown one line of a statement knows where the statement ends. Past MAX_EXTENT lines
+// nothing is claimed.
+const MAX_EXTENT = 30;
+function statementEnd(file, line) {
+  file.tokens ??= (() => { try { return tokenize(normalize(file.text, file.format), '').tokens; } catch { return []; } })();
+  const t = file.tokens;
+  const i = t.findIndex((x) => x.line === line);
+  if (i < 0 || t[i].t !== 'word') return line;
+  const e = segmentEnd(t, i, t.length);
+  const next = t[e];
+  const end = next && next.line >= line && (next.t === 'period' || (next.t === 'word' && next.u === `END-${t[i].u}`)) ? next.line : t[e - 1].line;
+  return end > line && end - line < MAX_EXTENT ? end : line;
+}
+
 // A hop's location: from `via` ("MOVE at pos/P1.cbl:9"), else the related entry for its file.
 function hopAt(hop, finding) {
   const m = /\bat (.+):(\d+)$/.exec(hop.via || '');
@@ -62,7 +77,7 @@ export function explainFinding(report, fingerprint, { root }) {
     else {
       try {
         const text = readSource(c.abs).text;
-        file = { kind: kindOf(c.abs), format: detectFormat(text), lines: text.split(/\r?\n/) };
+        file = { kind: kindOf(c.abs), format: detectFormat(text), text, lines: text.split(/\r?\n/) };
       } catch (e) { unread.push({ path, why: `it could not be read: ${e.message}` }); }
     }
     files.set(path, file);
@@ -72,15 +87,26 @@ export function explainFinding(report, fingerprint, { root }) {
   for (const x of [...report.findings, ...(report.suppressed || [])]) {
     if (HIDDEN_RULES.has(x.rule) && x.path && x.line) flagged.set(`${x.path}:${x.line}`, x.rule);
   }
-  const quote = (path, line) => {
+  const quoteLine = (path, file, line) => {
     const withheld = flagged.get(`${path}:${line}`);
     if (withheld) return { code: null, withheld };
-    const file = fileOf(path);
-    if (!file || !(line > 0 && line <= file.lines.length)) return { code: null };
     const area = codeArea(file.lines[line - 1], file.kind, file.format);
     const dropped = area.rest.trim() !== '' || /[^\d\s]/.test(area.seq);
     return { code: area.text.trimEnd(), ...(dropped ? { dropped } : {}) };
   };
+  // A statement that runs on past its first line carries endLine and the lines after the first.
+  const quote = (path, line) => {
+    const withheld = flagged.get(`${path}:${line}`);
+    if (withheld) return { code: null, withheld };
+    const file = fileOf(path);
+    if (!file || !(line > 0 && line <= file.lines.length)) return { code: null };
+    const first = quoteLine(path, file, line);
+    const endLine = file.kind === 'cobol' ? statementEnd(file, line) : line;
+    if (endLine === line) return first;
+    const rest = [];
+    for (let n = line + 1; n <= endLine; n++) rest.push({ line: n, ...quoteLine(path, file, n) });
+    return { ...first, endLine, rest };
+  };
 
   const hops = (f.trace || []).map((h, i) => {
     if (h.elided) return { n: i + 1, elided: h.elided, via: h.via };

package/lib/exploitability.mjs

@@ -6,12 +6,13 @@
 // running system confirms one, so a verdict says confirmed only where the estate brings the result
 // of its own test as a witness feed. See docs/spec/reach.md §9.
 import { readFileSync, realpathSync } from 'node:fs';
-import { basename, sep, delimiter } from 'node:path';
+import { basename, dirname, join, resolve, sep, delimiter } from 'node:path';
 import { ALL_RULES } from './kernel/registry.mjs';
 import { EXPLOITABILITY } from './kernel/findings.mjs';
 import { kindsOf } from './consequence.mjs';
 import { WHO } from './sets/flow.mjs';
 import { entryName, accessOfEntry, accessFromEntry, privilegedFromEntry } from './reach.mjs';
+import { verifyEvidence } from './evidence/verify.mjs';
 
 export const HANDLING = 'This report joins routes an attacker can drive with the estate\'s own access facts. It holds no source '
   + 'text, but it is a list of what to attack first: keep it where the access records it was built from may go, and do not '
@@ -62,9 +63,22 @@ const WITHOUT_A_TEST = {
 // response code is not input, so no test on it clears a route; the fix is not to send it.
 function fixAt(f, kinds) {
   const last = f.trace?.length ? f.trace[f.trace.length - 1] : null;
+  const instead = WITHOUT_A_TEST[kinds.sink];
+  // A value a STRING built holds the input as one part among literals, where no allow-list or class
+  // test describes the whole. The test belongs on the field folded in, before the STRING.
+  const built = f.trace ? f.trace.findLastIndex((h) => /^STRING at /.test(h.via || '')) : -1;
+  const part = built > 0 ? f.trace[built - 1] : null;
+  const where = part?.item && /\bat (.+):(\d+)$/.exec(f.trace[built].via);
+  if (where && kinds.source !== 'system-response' && TESTS[kinds.sink]) {
+    const [, path, line] = where;
+    return {
+      program: f.trace[built].program || f.program || null, path, line: Number(line), item: part.item,
+      builtInto: { item: last.item, path: f.path, line: f.line },
+      test: `before the STRING at ${path}:${line} that builds ${last.item}, on every route to it, test ${TESTS[kinds.sink](part.item)}, and let only a value that passes reach it${instead ? `; ${instead} needs no test` : ''}`,
+    };
+  }
   const item = last?.item || 'the value';
   const test = kinds.source === 'system-response' ? null : TESTS[kinds.sink]?.(item) || null;
-  const instead = WITHOUT_A_TEST[kinds.sink];
   return {
     program: f.program || null, path: f.path, line: f.line, item,
     ...(test ? { test: `before the operation at ${f.path}:${f.line}, on every route to it, test ${test}, and let only a value that passes reach it${instead ? `; ${instead} needs no test` : ''}` }
@@ -156,6 +170,28 @@ const OUTCOMES = new Set(['reproduced', 'not-reproduced']);
 const str = (v) => typeof v === 'string' && v.length > 0;
 const isoDate = (v) => typeof v === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(v);
 
+// What an ironwork run a result cites shows: each operation the marker reached and the abend the run
+// ended with, from a journal in an evidence directory that verifies. A string says why it shows nothing.
+function witnessedRun(ev, base, verdicts) {
+  if (!ev || typeof ev !== 'object' || !str(ev.dir) || !str(ev.run)) return 'cites evidence without a directory and a run';
+  if (!/^[0-9TZ]+-[0-9a-f]{16}$/.test(ev.run)) return `cites run ${ev.run}, which is not a run id`;
+  const dir = resolve(base, ev.dir);
+  if (!verdicts.has(dir)) verdicts.set(dir, verifyEvidence(dir));
+  const v = verdicts.get(dir);
+  if (!v.verified) return `cites evidence in ${ev.dir} that does not verify`;
+  if (v.unrecorded.includes(ev.run)) return `cites run ${ev.run}, which the ledger in ${ev.dir} does not record`;
+  let text;
+  try { text = readFileSync(join(dir, 'runs', `${ev.run}.jsonl`), 'utf8'); } catch { return `cites run ${ev.run}, which ${ev.dir} does not hold`; }
+  const records = [];
+  for (const line of text.split('\n')) {
+    if (!line) continue;
+    const rec = JSON.parse(line);
+    if (rec.kind === 'sink' && rec.reached === true) records.push({ kind: 'sink', sink: rec.sink, file: rec.file, line: rec.line });
+    else if (rec.kind === 'abend' && str(rec.file) && Number.isInteger(rec.line)) records.push({ kind: 'abend', code: rec.code, file: rec.file, line: rec.line });
+  }
+  return records.length ? { run: ev.run, records } : `cites run ${ev.run}, whose journal shows no operation the marker reached and no abend at a line`;
+}
+
 // The results of the estate's own tests, keyed by the fingerprint of the finding each tried, loaded
 // for one scan and refused from inside the scanned tree the way a reach feed is: a list of what was
 // reproduced is a list of what to attack. Shape:
@@ -176,6 +212,7 @@ export function loadWitnessFeed(path, { root = null } = {}) {
   if (!doc.results || typeof doc.results !== 'object' || Array.isArray(doc.results)) { feed.problem = 'holds no results'; return feed; }
   feed.witness = doc.witness;
   feed.recorded = doc.recorded;
+  const verdicts = new Map();
   for (const [fingerprint, r] of Object.entries(doc.results)) {
     const why = !r || typeof r !== 'object' ? 'is not an object'
       : !OUTCOMES.has(r.outcome) ? `says outcome ${JSON.stringify(r.outcome)}, not "reproduced" or "not-reproduced"`
@@ -183,7 +220,9 @@ export function loadWitnessFeed(path, { root = null } = {}) {
           : !isoDate(r.on) ? 'does not say when the test ran'
             : !str(r.system) ? 'does not say which system it ran on' : null;
     if (why) { feed.refused.push({ fingerprint, why: `the result for ${fingerprint} ${why}` }); continue; }
-    feed.results.set(fingerprint, { outcome: r.outcome, by: r.by, on: r.on, system: r.system, ...(str(r.reference) ? { reference: r.reference } : {}) });
+    const evidence = r.evidence === undefined ? null : witnessedRun(r.evidence, dirname(real), verdicts);
+    if (typeof evidence === 'string') { feed.refused.push({ fingerprint, why: `the result for ${fingerprint} ${evidence}` }); continue; }
+    feed.results.set(fingerprint, { outcome: r.outcome, by: r.by, on: r.on, system: r.system, ...(str(r.reference) ? { reference: r.reference } : {}), ...(evidence ? { evidence } : {}) });
   }
   return feed;
 }
@@ -214,8 +253,11 @@ export function applyWitness(findings, checked, feeds) {
     const x = f.exploitability;
     const hit = x && f.fingerprint ? newest(good, f.fingerprint) : null;
     if (!hit) return false;
-    matched.add(f.fingerprint);
     const { r, feed } = hit;
+    // A cited run witnesses this finding only where its journal places the operation or the abend at the finding's line.
+    const at = r.evidence ? r.evidence.records.find((e) => e.line === f.line && basename(e.file) === basename(f.path)) : null;
+    if (r.evidence && !at) return false;
+    matched.add(f.fingerprint);
     const cite = `${feed.file} (${feed.witness}, recorded ${feed.recorded})`;
     x.witness = { ...r, from: cite };
     byWitness[r.outcome]++;
@@ -227,6 +269,9 @@ export function applyWitness(findings, checked, feeds) {
     const was = x.verdict;
     x.verdict = 'confirmed';
     x.because.push(`reproduced on ${r.system} by ${r.by} on ${r.on}${r.reference ? ` (${r.reference})` : ''}, per ${cite}`);
+    if (at) x.because.push(at.kind === 'sink'
+      ? `run ${r.evidence.run}'s verified journal records the marker reaching the ${at.sink} operation at ${at.file}:${at.line}`
+      : `run ${r.evidence.run}'s verified journal records the run ending with ${at.code} at ${at.file}:${at.line}`);
     delete x.unknown;
     if (!x.fixAt) x.fixAt = fixAt(f, kindsOf(f.rule));
     if (f.guardedFrom) f.sev = f.guardedFrom;

package/lib/gate.mjs

@@ -20,7 +20,9 @@ const MAX_EDIT = 2000;
 const MAX_LINES = 200000;
 const MAX_COMPILES = 50;
 const COMPILE_BUDGET_MS = 10 * 60 * 1000;
-const PASSING = new Set(['cleared-by-check', 'statement-removed', 'source-removed', 'no-longer-fires']);
+// A fix keeps the program's statements and stops the route: deleting the flagged statement or the
+// source statement removes what the program did, and fails.
+const PASSING = new Set(['cleared-by-check', 'no-longer-fires']);
 const UNDECIDED = new Set(['lowered-by-check', 'gone-unexplained']);
 
 const pathText = (p) => printable(String(p ?? ''), 120);
@@ -115,15 +117,18 @@ export function findCobc({ explicit = null, repo, env = process.env, platform =
   return found.path ? found : { path: null, why: `--cobc ${pathText(resolve(explicit))} is not a file outside the repository` };
 }
 
-// A compiler run as `cobc -fsyntax-only`, from outside the tree, for a bounded time.
+// A compiler run as `cobc -fsyntax-only`, from outside the tree, for a bounded time. Its error lines
+// are kept so a drafter whose patch stopped a program compiling is told where.
 export function cobcCompiler(cobc) {
   return (file, { includeDirs = [], free = false } = {}) => {
     const r = spawnSync(cobc, ['-fsyntax-only', ...(free ? ['-free'] : []), ...includeDirs.flatMap((d) => ['-I', d]), file],
-      { cwd: tmpdir(), timeout: 60000, windowsHide: true, stdio: 'ignore' });
-    return r.status === 0;
+      { cwd: tmpdir(), timeout: 60000, windowsHide: true, stdio: ['ignore', 'ignore', 'pipe'], encoding: 'latin1', maxBuffer: 1 << 20 });
+    return { ok: r.status === 0, messages: String(r.stderr || '').split(/\r?\n/).filter((l) => /: error: /.test(l)) };
   };
 }
 
+const MAX_COMPILER_LINES = 3;
+
 // Level 1 matches across both lists first; each looser level pairs only what the level above left.
 export function pairLists(base, head, baseKeys, headKeys) {
   const headOf = new Array(base.length).fill(-1);
@@ -222,6 +227,10 @@ function targetReason(t, r) {
       return `the target is still reported, lowered from ${t.sev} to ${r.head.sev} by a check this patch added at ${where({ path: r.guard.file, line: r.guard.line })}; a check that lowers rather than stops may not turn away everything it should, so a person decides`;
     case 'program-removed':
       return `the patch removes ${pathText(t.path)}${t.program ? ` or its program ${printable(t.program, 40)}` : ''}, which held the target; removing the program is not a fix the gate accepts`;
+    case 'statement-removed':
+      return `the patch deletes the target's statement at ${where(t)}; a fix keeps the statement and stops the route to it, so deleting it is not a fix the gate accepts`;
+    case 'source-removed':
+      return `the patch deletes the statement the target's input comes from; a fix keeps it and stops the route from it, so deleting it is not a fix the gate accepts`;
     case 'gone-unexplained':
       return `the target, ${at}, is gone, but the patch neither removed its statement or its source nor added a check that stops its route; the route may be cut between its ends, or sent through something the engine does not follow, and a person decides`;
     default:
@@ -246,16 +255,29 @@ function compileCheck({ compiler, baseRoot, headRoot, baseProgs, headProgs, chan
     try { free = detectFormat(readFileSync(join(root, file), 'latin1')) === 'free'; } catch { /* unreadable: compiled as fixed */ }
     return { includeDirs: [...dirs].sort(), free };
   };
+  // A compiler answers true or false, or { ok, messages }.
+  const compile = (root, progs, file) => {
+    const r = compiler.run(join(root, file), optsFor(root, progs, file));
+    return r && typeof r === 'object' ? { ok: !!r.ok, messages: r.messages || [] } : { ok: !!r, messages: [] };
+  };
   const regressed = [], neverCompiled = [];
   const deadline = Date.now() + (compiler.budgetMs ?? COMPILE_BUDGET_MS);
   for (const file of [...files].sort()) {
     if (Date.now() > deadline) return { ok: null, compiled: `not compiled: the compiler ran past the gate's ${Math.round((compiler.budgetMs ?? COMPILE_BUDGET_MS) / 60000)}-minute budget`, reasons: [] };
-    const now = compiler.run(join(headRoot, file), optsFor(headRoot, headProgs, file));
-    if (now) continue;
-    const had = existsSync(join(baseRoot, file)) && compiler.run(join(baseRoot, file), optsFor(baseRoot, baseProgs, file));
-    (had ? regressed : neverCompiled).push(file);
+    const now = compile(headRoot, headProgs, file);
+    if (now.ok) continue;
+    const had = existsSync(join(baseRoot, file)) && compile(baseRoot, baseProgs, file).ok;
+    if (had) regressed.push({ file, messages: now.messages });
+    else neverCompiled.push(file);
+  }
+  // The compiler names the file by where the head was written; the reader knows it by its path.
+  const asInRepo = (m) => m.split(join(headRoot, sep)).join('');
+  if (regressed.length) {
+    return { ok: false, compiled: `${regressed.length} program(s) compiled before the patch and do not after`, reasons: regressed.flatMap(({ file, messages }) => [
+      `${pathText(file)} compiled before the patch and does not after`,
+      ...messages.slice(0, MAX_COMPILER_LINES).map((m) => `the compiler: ${asInRepo(m).trim()}`),
+    ]) };
   }
-  if (regressed.length) return { ok: false, compiled: `${regressed.length} program(s) compiled before the patch and do not after`, reasons: regressed.map((f) => `${pathText(f)} compiled before the patch and does not after`) };
   if (neverCompiled.length) return { ok: null, compiled: `${neverCompiled.length} program(s) do not compile before or after the patch, or are new and do not compile, which the gate cannot tell from a missing copy library`, reasons: [] };
   return { ok: true, compiled: `${files.size} program(s) compile`, reasons: [] };
 }

package/lib/kernel/findings.mjs

@@ -38,6 +38,7 @@ export const EVIDENCE = Object.freeze({
   advisory: 'a component version matches a published advisory against it',
   exposure: 'information about the estate is written into the source',
   change: 'a change moves an interface or adds a call target, which a reviewer has to look at',
+  execution: 'a run of the program on a recorded input ended this way, and the run\'s verified journal is the record of it',
   coverage: 'the analysis stopped following here; a limit of the tool, not a defect in the code',
   context: 'describes the estate - an entry point, a product in use - and asserts no defect',
 });
@@ -60,6 +61,7 @@ export const WHO_ACTS = Object.freeze({
   advisory: 'whoever owns the build',
   exposure: 'the owner',
   change: 'the reviewer of that change',
+  execution: "the program's owner",
   coverage: "nobody's code: read more, or accept the limit",
   context: 'nobody: it asserts no defect',
 });

package/lib/kernel/registry.mjs

@@ -27,6 +27,7 @@ import { scanLog, LOG_RULES } from '../sets/log.mjs';
 import { scanCompile, COMPILE_RULES } from '../sets/compile.mjs';
 import { scanSemantics, SEMANTICS_RULES } from '../sets/semantics.mjs';
 import { scanZowe, ZOWE_RULES } from '../sets/zowe.mjs';
+import { scanAbend, ABEND_RULES } from '../sets/abend.mjs';
 import { toolName } from './ruleset.mjs';
 
 // The order is the order a scan runs them and the order --only lists them. It is not significant
@@ -47,6 +48,7 @@ export const REGISTRY = [
   { name: 'log', scan: scanLog, rules: LOG_RULES },
   { name: 'semantics', scan: scanSemantics, rules: SEMANTICS_RULES },
   { name: 'zowe', scan: scanZowe, rules: ZOWE_RULES },
+  { name: 'abend', scan: scanAbend, rules: ABEND_RULES },
 ];
 
 // Re-exported from the kernel's ruleset module, which is where it has to live: this file imports

package/lib/kernel/source-tree.mjs

@@ -154,6 +154,7 @@ function heldTree({ kind, root, store, rel, systemDirs = [], copyDirs = null, cl
 // Buffer. Paths are used exactly as given, so a test reads the way it writes.
 export function memoryTree(files, { root = '/memory', systemDirs = [] } = {}) {
   const store = new Map(Object.entries(files).map(([p, v]) => [p, Buffer.isBuffer(v) ? v : Buffer.from(v, 'latin1')]));
+  // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- root is escaped
   const rel = (p) => String(p).replace(/\\/g, '/').replace(new RegExp('^' + root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '/?'), '');
   return heldTree({ kind: 'memory', root, store, rel, systemDirs });
 }

package/lib/options.mjs

@@ -433,7 +433,11 @@ export function compilerTasks(text) {
   };
   const valueOf = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v.value : v);
   const folder = (v) => String(v).replace(/\$\{(?:workspaceFolder|workspaceRoot)(?::[^}]*)?\}/g, '.').replace(/\$\{(?:\/|pathSeparator)\}/g, '/');
-  const quoted = (a) => { const s = String(valueOf(a) ?? ''); return /[\s"]/.test(s) || s === '' ? `"${s.replace(/"/g, '\\"')}"` : s; };
+  const quoted = (a, dialect) => {
+    const s = String(valueOf(a) ?? '');
+    const esc = ESCAPE[dialect];
+    return /[\s"]/.test(s) || s === '' ? `"${s.replace(/./gs, (c) => (c === '"' || c === esc ? esc + c : c))}"` : s;
+  };
   const out = [];
   const tasks = [doc, ...(Array.isArray(doc && doc.tasks) ? doc.tasks : [])];
   for (const task of tasks) {
@@ -448,7 +452,7 @@ export function compilerTasks(text) {
       const line = lineOf(JSON.stringify(command).slice(1, 41), task.label && JSON.stringify(task.label));
       const state = { dir };
       const found = [];
-      commandLine(folder([command, ...args.map(quoted)].join(' ')), dialect, state, line, found);
+      commandLine(folder([command, ...args.map((a) => quoted(a, dialect))].join(' ')), dialect, state, line, found);
       out.push(...found);
     }
   }

package/lib/packs.mjs

@@ -113,8 +113,10 @@ export function packProblems(pack) {
     const scopes = r.appliesTo || ['jcl-instream'];
     for (const sc of scopes) if (!SCOPES.includes(sc)) problems.push(`${pack.name}:${r.id}: unknown scope '${sc}'`);
     if (!scopes.length) problems.push(`${pack.name}:${r.id}: no scope, so it can never match anything`);
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- a shipped pack's pattern, checked here to compile
     try { new RegExp(r.pattern, r.flags || 'i'); } catch (e) { problems.push(`${pack.name}:${r.id}: ${e.message}`); }
     if (r.setsContext && !r.setsContextPattern) problems.push(`${pack.name}:${r.id}: setsContext without a pattern that sets it`);
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- a shipped pack's pattern, checked here to compile
     if (r.setsContextPattern) { try { new RegExp(r.setsContextPattern, 'i'); } catch (e) { problems.push(`${pack.name}:${r.id}: setsContextPattern ${e.message}`); } }
     // A rule that waits for a context nothing in the pack sets can never fire, which is the same
     // failure as an unknown scope and is caught the same way.
@@ -139,10 +141,12 @@ export function compilePack(pack) {
     pack: pack.name,
     vendor: pack.vendor,
     product: pack.product,
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- a shipped pack's pattern; test/hostile times each one
     re: new RegExp(r.pattern, r.flags || 'i'),
     appliesTo: r.appliesTo || ['jcl-instream'],
     // A rule may declare that it only means what it says once an earlier line has put the stream
     // into a mode, and a rule may be the thing that sets that mode.
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- a shipped pack's pattern; test/hostile times each one
     setsContextRe: r.setsContext && r.setsContextPattern ? new RegExp(r.setsContextPattern, 'i') : null,
   }));
 }