@portll/cobolwork 0.4.0 → 0.6.0

package/lib/ironwork.mjs

@@ -15,6 +15,9 @@ import { EIB_FIELDS, DIB_FIELDS, SQLCA_FIELDS } from './words.mjs';
 // 12 S, 16 U. Only 0 and 4 produce a program.
 const COMPILED = new Set([0, 4]);
 const REJECTED = new Set([8, 12, 16]);
+// ironwork grades a refusal by name as severe (12), so a run that ends at 8 holds only IBM-graded
+// errors in the program, whatever their wording says; the wording decides only at 12 and 16.
+const GRADED_ERROR = 8;
 // Warnings and informational lines follow the errors, and say nothing about why a program failed.
 const NOT_AN_ERROR = /^(?:informational:|.*?: warning: )/;
 const PER_PROGRAM_MS = 60000;
@@ -73,7 +76,7 @@ export function checkWithIronwork(path, root, { allow = null, copylibs = [], env
       continue;
     }
     const found = String(r.stderr || '').split(/\r?\n/).filter((l) => l && !NOT_AN_ERROR.test(l)).map((l) => diagnostic(l, resolve(file), rel));
-    const errors = found.filter((d) => !notModelled(d.message) && !UNRESOLVED.test(d.message));
+    const errors = found.filter((d) => !(r.status !== GRADED_ERROR && notModelled(d.message)) && !UNRESOLVED.test(d.message));
     if (errors.length) out.failed.push({ ...errors[0], errors: errors.length });
     else if (found.some((d) => UNRESOLVED.test(d.message))) out.unresolved.push(found.find((d) => UNRESOLVED.test(d.message)));
     else out.notModelled.push(found[0] || { path: rel, message: `ironwork exited ${r.status} and gave no error` });

package/lib/kernel/registry.mjs

@@ -12,43 +12,50 @@
 // literal key `undefined` in every report for several commits. lib/scan.mjs grew an ESETNAME throw
 // to make the next rename fail loudly instead. The throw stays - see `reportKey` below - but the
 // map it guarded is gone, because a name derived from one place cannot disagree with itself.
-import { scan as scanFlow, RULES as FLOW_RULES } from '../sets/flow.mjs';
-import { scanCics, CICS_RULES } from '../sets/cics.mjs';
+import { scan as scanFlow, scanSteps as scanFlowSteps, RULES as FLOW_RULES } from '../sets/flow.mjs';
+import { scanCics, scanCicsSteps, CICS_RULES } from '../sets/cics.mjs';
 import { scanHidden, HIDDEN_RULES } from '../sets/hidden.mjs';
-import { scanCopybooks, COPYBOOK_RULES } from '../sets/copybook.mjs';
+import { scanCopybooks, scanCopybooksSteps, COPYBOOK_RULES } from '../sets/copybook.mjs';
 import { scanJcl, JCL_RULES } from '../sets/jcl.mjs';
 import { scanBuild, BUILD_RULES } from '../sets/build.mjs';
 import { scanRecon, RECON_RULES } from '../sets/recon.mjs';
 import { scanVendor, VENDOR_RULES } from '../sets/vendor.mjs';
 import { scanOpaque, OPAQUE_RULES } from '../sets/opaque.mjs';
-import { scanWeb, WEB_RULES } from '../sets/web.mjs';
-import { scanPriv, PRIV_RULES } from '../sets/priv.mjs';
-import { scanLog, LOG_RULES } from '../sets/log.mjs';
-import { scanCompile, COMPILE_RULES } from '../sets/compile.mjs';
-import { scanSemantics, SEMANTICS_RULES } from '../sets/semantics.mjs';
+import { scanWeb, scanWebSteps, WEB_RULES } from '../sets/web.mjs';
+import { scanPriv, scanPrivSteps, PRIV_RULES } from '../sets/priv.mjs';
+import { scanLog, scanLogSteps, LOG_RULES } from '../sets/log.mjs';
+import { scanCompile, scanCompileSteps, COMPILE_RULES } from '../sets/compile.mjs';
+import { scanSemantics, scanSemanticsSteps, SEMANTICS_RULES } from '../sets/semantics.mjs';
 import { scanZowe, ZOWE_RULES } from '../sets/zowe.mjs';
 import { scanAbend, ABEND_RULES } from '../sets/abend.mjs';
+import { scanHlasm, HLASM_RULES } from '../sets/hlasm.mjs';
+import { scanCrypto, CRYPTO_RULES } from '../sets/crypto.mjs';
+import { scanSecrets, SECRETS_RULES } from '../sets/secrets.mjs';
 import { toolName } from './ruleset.mjs';
 
 // The order is the order a scan runs them and the order --only lists them. It is not significant
-// to correctness; it is significant to a report being comparable with yesterday's.
+// to correctness; it is significant to a report being comparable with yesterday's. A set with
+// `steps` reads programs through the scan's one shared pass (lib/kernel/shared-pass.mjs).
 export const REGISTRY = [
-  { name: 'flow', scan: scanFlow, rules: FLOW_RULES },
-  { name: 'cics', scan: scanCics, rules: CICS_RULES },
+  { name: 'flow', scan: scanFlow, steps: scanFlowSteps, rules: FLOW_RULES },
+  { name: 'cics', scan: scanCics, steps: scanCicsSteps, rules: CICS_RULES },
   { name: 'hidden', scan: scanHidden, rules: HIDDEN_RULES },
-  { name: 'copybook', scan: scanCopybooks, rules: COPYBOOK_RULES },
+  { name: 'copybook', scan: scanCopybooks, steps: scanCopybooksSteps, rules: COPYBOOK_RULES },
   { name: 'jcl', scan: scanJcl, rules: JCL_RULES },
   { name: 'build', scan: scanBuild, rules: BUILD_RULES },
   { name: 'recon', scan: scanRecon, rules: RECON_RULES },
   { name: 'vendor', scan: scanVendor, rules: VENDOR_RULES },
   { name: 'opaque', scan: scanOpaque, rules: OPAQUE_RULES },
-  { name: 'web', scan: scanWeb, rules: WEB_RULES },
-  { name: 'compile', scan: scanCompile, rules: COMPILE_RULES },
-  { name: 'priv', scan: scanPriv, rules: PRIV_RULES },
-  { name: 'log', scan: scanLog, rules: LOG_RULES },
-  { name: 'semantics', scan: scanSemantics, rules: SEMANTICS_RULES },
+  { name: 'web', scan: scanWeb, steps: scanWebSteps, rules: WEB_RULES },
+  { name: 'compile', scan: scanCompile, steps: scanCompileSteps, rules: COMPILE_RULES },
+  { name: 'priv', scan: scanPriv, steps: scanPrivSteps, rules: PRIV_RULES },
+  { name: 'log', scan: scanLog, steps: scanLogSteps, rules: LOG_RULES },
+  { name: 'semantics', scan: scanSemantics, steps: scanSemanticsSteps, rules: SEMANTICS_RULES },
   { name: 'zowe', scan: scanZowe, rules: ZOWE_RULES },
   { name: 'abend', scan: scanAbend, rules: ABEND_RULES },
+  { name: 'hlasm', scan: scanHlasm, rules: HLASM_RULES },
+  { name: 'crypto', scan: scanCrypto, rules: CRYPTO_RULES },
+  { name: 'secrets', scan: scanSecrets, rules: SECRETS_RULES },
 ];
 
 // Re-exported from the kernel's ruleset module, which is where it has to live: this file imports

package/lib/kernel/shared-pass.mjs

@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// One pass over the tree for every rule set that reads programs, so that a file is read and parsed
+// once per scan rather than once per set.
+//
+// A set's scan is a generator. Where it would run its guarded loop it yields `loopOver(...)` and is
+// resumed with the loop's account, exactly what eachWithinMemory would have returned. `drive` runs
+// one set on its own, its loop as it always ran. `driveTogether` runs several: it gathers the loop
+// each asks for, walks the files of all of them once in the tree's order, gives each set its own
+// files in its own order, and resumes each with its own account. While a file is being handed round,
+// the tree answers text() and parse() for it from what the first set to ask was given.
+//
+// Each set's per-file work is unchanged, so its findings are the ones it reported alone. What is
+// shared is the reading and the parse, which is why no set may change a parse result it is given.
+import { eachWithinMemory, memoryStatus, stoppedBecause, watchMemoryBuffer, MEMORY_RESERVE } from './memory.mjs';
+
+const LOOP = Symbol('loop');
+
+// What a set yields in place of `eachWithinMemory(items, work, opts)`. `guarded: false` asks for a
+// plain loop: every item, no memory check and no byte budget.
+export const loopOver = (items, work, opts = {}) => ({ [LOOP]: true, items, work, opts });
+
+function plainLoop(items, work, label) {
+  for (let i = 0; i < items.length; i++) work(items[i], i);
+  return { label, processed: items.length, bytes: 0, skipped: [], complete: true, stoppedBy: null, peakHeapBytes: 0, note: null };
+}
+
+const runAlone = (req) => (req.opts.guarded === false
+  ? plainLoop(req.items, req.work, req.opts.label || 'scan')
+  : eachWithinMemory(req.items, req.work, req.opts));
+
+export function drive(steps) {
+  let step = steps.next();
+  while (!step.done) step = steps.next(runAlone(step.value));
+  return step.value;
+}
+
+// A tree that, while `focus` names a file, answers text() and parse() for that file once and hands
+// every later caller the same answer, its error included.
+export function sharingTree(base) {
+  let focus = null;
+  let text = null;
+  let parsed = null;
+  const tree = {
+    ...base,
+    focusOn(f) { focus = f; text = null; parsed = null; },
+    text(p) {
+      if (p !== focus) return base.text(p);
+      if (!text) { try { text = { value: base.text(p) }; } catch (e) { text = { error: e }; } }
+      if (text.error) throw text.error;
+      return text.value;
+    },
+    parse(p, src) {
+      if (p !== focus) return base.parse(p, src);
+      const own = src ?? tree.text(p).text;
+      if (!parsed || parsed.src !== own) {
+        try { parsed = { src: own, value: base.parse(p, own) }; } catch (e) { parsed = { src: own, error: e }; }
+      }
+      if (parsed.error) throw parsed.error;
+      return parsed.value;
+    },
+  };
+  return tree;
+}
+
+// Runs every generator to completion and returns their results in the order given. A generator
+// that throws, before its loop or inside it, yields { error } in its place, as a set that throws
+// alone does; the others carry on.
+export function driveTogether(stepsList, tree) {
+  const live = stepsList.map((steps) => ({ steps, step: null, result: undefined, error: null }));
+  const advance = (g, input, thrown) => {
+    try { g.step = thrown ? g.steps.throw(thrown) : g.steps.next(input); } catch (e) { g.error = e; g.step = { done: true }; return; }
+    if (g.step.done) g.result = g.step.value;
+  };
+  for (const g of live) advance(g);
+  for (;;) {
+    const waiting = live.filter((g) => !g.step.done);
+    if (!waiting.length) break;
+    const runs = mergedLoop(waiting.map((g) => g.step.value), tree);
+    waiting.forEach((g, k) => advance(g, runs[k].run, runs[k].error));
+  }
+  return live.map((g) => (g.error ? { error: g.error } : g.result));
+}
+
+// The files of every request, once each, in the order of the tree's list. A request whose items are
+// not in that order runs alone first, so no set sees its files in an order its own loop would not use.
+function mergedLoop(requests, tree) {
+  const rank = new Map(tree.list().map((p, i) => [p, i]));
+  const inOrder = (items) => items.every((p, i) => rank.has(p) && (i === 0 || rank.get(items[i - 1]) < rank.get(p)));
+  const states = requests.map((req) => ({
+    req, guarded: req.opts.guarded !== false, maxBytes: req.opts.maxBytes ?? Infinity, label: req.opts.label || 'scan',
+    next: 0, processed: 0, bytes: 0, skipped: [], stoppedBy: null, error: null, alone: null,
+  }));
+  for (const s of states) if (!inOrder(s.req.items)) {
+    try { s.alone = runAlone(s.req); } catch (e) { s.error = e; s.alone = {}; }
+  }
+  const shared = states.filter((s) => !s.alone);
+  const w = shared.map((s) => s.req.opts.watcher).find(Boolean) || watchMemoryBuffer();
+  const every = Math.min(...shared.map((s) => s.req.opts.every ?? 8), 8);
+  const files = [...new Set(shared.flatMap((s) => s.req.items))].sort((a, b) => rank.get(a) - rank.get(b));
+  let stoppedBy = null;
+  for (let i = 0; i < files.length; i++) {
+    const f = files[i];
+    const wanting = shared.filter((s) => s.req.items[s.next] === f);
+    if (!stoppedBy && wanting.some((s) => s.guarded && !s.error && s.bytes < s.maxBytes)
+      && (i % every === 0 || memoryStatus().fractionUsed > 1 - MEMORY_RESERVE)) {
+      const state = w.check();
+      if ((state === 'exhausted' || state === 'tight') && (!w.collect() || w.stillTight())) {
+        stoppedBy = state === 'exhausted' ? 'memory exhausted' : 'memory reserve';
+      }
+    }
+    tree.focusOn?.(f);
+    for (const s of wanting) {
+      const index = s.next++;
+      if (s.error) continue;
+      if (s.guarded) {
+        if (s.stoppedBy) { s.skipped.push(f); continue; }
+        if (s.bytes >= s.maxBytes) { s.stoppedBy = 'byte budget'; s.skipped.push(f); continue; }
+        if (stoppedBy) { s.stoppedBy = stoppedBy; s.skipped.push(f); continue; }
+      }
+      let took;
+      try { took = s.req.work(f, index); } catch (e) { s.error = e; continue; }
+      if (typeof took === 'number') s.bytes += took;
+      s.processed++;
+    }
+    tree.focusOn?.(null);
+  }
+  return states.map((s) => {
+    if (s.alone) return { run: s.alone, error: s.error };
+    const { items } = s.req;
+    const run = s.guarded
+      ? { label: s.label, processed: s.processed, bytes: s.bytes, skipped: s.skipped, complete: s.skipped.length === 0, stoppedBy: s.stoppedBy, peakHeapBytes: w.peak,
+        note: s.skipped.length === 0 ? null
+          : `${s.label}: ${s.skipped.length} of ${items.length} files were not read because ${stoppedBecause(s.stoppedBy)}. `
+            + 'The findings below are over what was read, and are not a result for this repository as a whole.' }
+      : { label: s.label, processed: s.processed, bytes: 0, skipped: [], complete: true, stoppedBy: null, peakHeapBytes: 0, note: null };
+    return { run, error: s.error };
+  });
+}

package/lib/options.mjs

@@ -485,17 +485,27 @@ export function sourceOperands(args, compiler = 'gnucobol') {
   return out;
 }
 
+// The first GnuCOBOL release with the -fec option, and with each condition added after it.
+const FEC_SINCE = '3.1';
+const CONDITION_SINCE = { 'EC-PROGRAM-ARG-MISMATCH': '3.2' };
+export const olderThan = (version, since) => {
+  const [a, b] = [version, since].map((v) => String(v).split('.').map(Number));
+  for (let i = 0; i < Math.max(a.length, b.length); i++) if ((a[i] || 0) !== (b[i] || 0)) return (a[i] || 0) < (b[i] || 0);
+  return false;
+};
+
 // A cobc argument vector. Returns { checks, forbidden, add }: `add` holds the -fec options that
 // supply a required check nothing turned on, and `forbidden` the options the policy's forbid list
 // names. A check turned off is a failed check, not overridden: appending past it would hide a build
-// configured against the policy.
-export function cobcChecks(args, { required, forbid = [] }) {
+// configured against the policy. With `pinned` ({ version, where }), a check that GnuCOBOL version
+// cannot generate fails, however the command asks for it.
+export function cobcChecks(args, { required, forbid = [], pinned = null }) {
   const state = new Map();
   const turnedOff = new Map();
   const set = (name, on, arg) => {
     for (const check of required) {
       if (!covers(name, EXCEPTION_OF_CHECK[check])) continue;
-      state.set(check, on);
+      state.set(check, on ? arg : false);
       if (on) turnedOff.delete(check); else turnedOff.set(check, arg);
     }
   };
@@ -509,11 +519,23 @@ export function cobcChecks(args, { required, forbid = [] }) {
     if (value === undefined) continue;
     set(exceptionName(value), !m[1], shown);
   }
+  const tooOld = (check, by) => {
+    if (!pinned) return null;
+    const condition = EXCEPTION_OF_CHECK[check];
+    const since = CONDITION_SINCE[condition];
+    const pin = `${pinned.where} pins ${pinned.version}`;
+    if (since && olderThan(pinned.version, since)) return `${check} needs ${condition}, which is in GnuCOBOL ${since} and later; ${pin}`;
+    if (!/^-(debug|d)$/.test(by) && olderThan(pinned.version, FEC_SINCE)) return `${check} needs -fec, which is in GnuCOBOL ${FEC_SINCE} and later; ${pin}`;
+    return null;
+  };
   const add = [];
   const checks = required.map((check) => {
-    if (state.get(check) === true) return { check, ok: true, why: 'turned on by the command line' };
     if (turnedOff.has(check)) return { check, ok: false, why: `${turnedOff.get(check)} turns off the ${check} check` };
     const flag = `-fec=${EXCEPTION_OF_CHECK[check]}`;
+    const by = state.get(check) || flag;
+    const old = tooOld(check, by);
+    if (old) return { check, ok: false, why: old };
+    if (state.get(check)) return { check, ok: true, why: 'turned on by the command line' };
     if (!add.includes(flag)) add.push(flag);
     return { check, ok: true, added: true, why: `added as ${flag}` };
   });

package/lib/policy.mjs

@@ -26,9 +26,13 @@ export const DEFAULT_POLICY = Object.freeze({
   checks: ['subscript', 'reference-modification'],
   forbid: { enterprise: [], gnucobol: [], gcobol: [] },
   requireEquivalence: 'never',
+  interface: 'warn',
 });
 
 export const EQUIVALENCE_MODES = ['never', 'machineAuthored', 'always'];
+// How an abend from a subprogram fuzzed at its interface, with no caller run shown to pass the input,
+// is gated: `warn` never blocks on it, `tier` gates it as any other finding.
+export const INTERFACE_MODES = ['warn', 'tier'];
 
 const KEYS = Object.keys(DEFAULT_POLICY);
 const isObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
@@ -64,6 +68,7 @@ export function validatePolicy(raw) {
     else for (const c of raw.checks) if (!CHECKS.includes(c)) errs.push(`checks: ${printable(c, 40)} is not one of ${CHECKS.join(', ')}`);
   }
   if ('requireEquivalence' in raw && !EQUIVALENCE_MODES.includes(raw.requireEquivalence)) errs.push(`requireEquivalence takes ${EQUIVALENCE_MODES.join(', ')}`);
+  if ('interface' in raw && !INTERFACE_MODES.includes(raw.interface)) errs.push(`interface takes ${INTERFACE_MODES.join(', ')}`);
   if ('forbid' in raw) {
     if (!isObject(raw.forbid)) errs.push(`forbid must be an object keyed by ${COMPILERS.join(', ')}`);
     else for (const [c, list] of Object.entries(raw.forbid)) {
@@ -142,6 +147,7 @@ export function combinePolicies({ floor = null, repository = null } = {}) {
     checks: checks.value,
     forbid: Object.fromEntries(COMPILERS.map((c) => [c, union((f.forbid || {})[c] || [], (r.forbid || {})[c] || [])])),
     requireEquivalence: pick('requireEquivalence', (a, b) => (EQUIVALENCE_MODES.indexOf(a) >= EQUIVALENCE_MODES.indexOf(b) ? a : b)),
+    interface: pick('interface', (a, b) => (a === 'tier' || b === 'tier' ? 'tier' : 'warn')),
     rules: {},
   };
   setBy.checks = checks.by;

package/lib/precompile-cics.mjs

@@ -12,7 +12,7 @@ export const builtinValue = (fn, name) => (fn === 'RESP' ? DFHRESP : DFHVALUE)[n
 const squeeze = (text) => text.replace(/('[^']*'|"[^"]*")|\s+/g, (_, lit) => lit || ' ').trim();
 
 // The options of an EXEC CICS command in order: each word, with its argument's text when it has one.
-function cicsOptions(text) {
+export function cicsOptions(text) {
   const out = [];
   let i = 0;
   while (i < text.length) {

package/lib/revision.json

@@ -1 +1 @@
-{"commit":"371041fbffe625df6b0a872249cf071268fcb6a6"}
+{"commit":"67c696c3d6f74d20137372b5f0a756e0b27753dd","tag":"v0.6.0"}

package/lib/sarif.mjs

@@ -213,6 +213,9 @@ export function toSarif(report, { toolVersion = '0.1.0' } = {}) {
             ...(f.reach ? { reach: f.reach } : {}),
             ...(f.effect ? { effect: f.effect } : {}),
             ...(f.exploitability ? { exploitability: f.exploitability } : {}),
+            // How an abend's input reached the program: through its own entry, or as arguments to
+            // a subprogram no caller run is shown to pass.
+            ...(f.abend?.inputFrom ? { inputFrom: f.abend.inputFrom } : {}),
           } } : {}),
           locations: [{ physicalLocation: { artifactLocation: { uri: uriOf(f.path), uriBaseId: '%SRCROOT%' }, region: { startLine: f.line || 1 } } }],
           ...(f.related ? { relatedLocations: f.related.map((r) => ({ physicalLocation: { artifactLocation: { uri: uriOf(r.path), uriBaseId: '%SRCROOT%' }, region: { startLine: r.line || 1 } }, message: { text: textOf(r.detail) } })) } : {}),

package/lib/scan.mjs

@@ -3,7 +3,8 @@ import { join, resolve } from 'node:path';
 import { sortFindings, tally, evidenceMap, EVIDENCE, EXPLOITABILITY } from './kernel/findings.mjs';
 import { directoryTree } from './kernel/source-tree.mjs';
 import { REGISTRY, RULE_SETS, ALL_RULES, reportKey } from './kernel/registry.mjs';
-import { inventory } from './inventory.mjs';
+import { inventorySteps } from './inventory.mjs';
+import { driveTogether, sharingTree } from './kernel/shared-pass.mjs';
 import { stoppedBecause } from './kernel/memory.mjs';
 import { complianceMap, FRAMEWORKS_LOADED, FRAMEWORKS_UNLOADED } from './compliance.mjs';
 import { stampFingerprints, FINGERPRINT_VERSION } from './kernel/identity.mjs';
@@ -178,13 +179,12 @@ export function applyEstateFacts(findings, checked, root, opts = {}) {
 }
 
 // A set that throws is reported as not having run, and the other sets' findings stand.
+const notRun = (set, e) => report(set.name, { rules: set.rules, findings: [], stats: {
+  coverageIncomplete: true,
+  notRead: `the rule set stopped on an error and reported nothing: ${printable(e?.message ?? e)}`,
+} });
 function runSet(set, root, o) {
-  try { return set.scan(root, o); } catch (e) {
-    return report(set.name, { rules: set.rules, findings: [], stats: {
-      coverageIncomplete: true,
-      notRead: `the rule set stopped on an error and reported nothing: ${printable(e?.message ?? e)}`,
-    } });
-  }
+  try { return set.scan(root, o); } catch (e) { return notRun(set, e); }
 }
 
 export function scanAll(root, opts = {}) {
@@ -193,12 +193,22 @@ export function scanAll(root, opts = {}) {
   // One walk of the tree for the whole scan. Every rule set used to call buildFileIndex(root) for
   // itself, so a scan read every directory entry and resolved every symlink nine times over, and
   // added a tenth walk each time a rule set was added.
-  const tree = opts.tree || directoryTree(root, opts);
+  const tree = sharingTree(opts.tree || directoryTree(root, opts));
   const o = { ...opts, tree };
-  const inv = inventory(root, o);
   // One loop over the registry, in its order. A set that is not registered cannot run, and
-  // cannot report a silent zero on its own behalf either.
-  const parts = REGISTRY.filter((set) => only.includes(set.name)).map((set) => runSet(set, root, o));
+  // cannot report a silent zero on its own behalf either. The inventory and the sets that read
+  // programs share one pass, so each program is read and parsed once.
+  const chosen = REGISTRY.filter((set) => only.includes(set.name));
+  const stepped = chosen.filter((set) => set.steps);
+  const [invResult, ...stepResults] = driveTogether([inventorySteps(root, o), ...stepped.map((set) => set.steps(root, o))], tree);
+  if (invResult && invResult.error) throw invResult.error;
+  const inv = invResult;
+  const byName = new Map(stepped.map((set, k) => [set.name, stepResults[k]]));
+  const parts = chosen.map((set) => {
+    if (!byName.has(set.name)) return runSet(set, root, o);
+    const r = byName.get(set.name);
+    return r && r.error ? notRun(set, r.error) : r;
+  });
 
   const flowPart = parts.find(p => p.tool === 'cobolwork-flow');
   const overBudget = flowPart ? flowPart.summary.filesOverBudget || 0 : 0;

package/lib/sets/abend.mjs

@@ -6,9 +6,11 @@
 // where the evidence verifies and the run's own journal records the abend the manifest claims, so
 // the finding rests on a record of the run rather than on the manifest's word.
 import { readFileSync, existsSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { delimiter, join, posix, basename } from 'node:path';
 import { report } from '../kernel/ruleset.mjs';
 import { verifyEvidence } from '../evidence/verify.mjs';
+import { NOT_RUN_ABENDS } from '../ironwork-ids.mjs';
 
 export const ABEND_RULES = {
   'input-causes-abend-s0c7': {
@@ -29,6 +31,18 @@ export const ABEND_RULES = {
     impact: 'SSRANGE caught the overrun and ended the run; compiled without SSRANGE, as production builds often are, the same input reads or writes storage beside the table or field',
     remedy: 'Check the index against both ends of the table or field before the statement the journal names, and keep SSRANGE on for the build',
   },
+  'input-causes-hang': {
+    sev: 'med', evidence: 'execution', cwe: 'CWE-834',
+    text: 'An input the program accepts keeps a loop running past the statement limit that stands in for its time limit (S322)',
+    impact: 'Whoever supplies that input decides how long the loop runs; on z/OS a long enough run holds the step and its processor until TIME= ends it, and the jobs behind it wait. The run shows the loop passed the limit, not that it would never end',
+    remedy: 'Find the loop at the line the journal names and bound its iterations: check the count or the exit condition the input supplies before the loop starts, or stop it at a counter and reject the input that would pass it',
+  },
+  'input-selects-program': {
+    sev: 'high', evidence: 'execution', cwe: 'CWE-470',
+    text: 'An input the program accepts chooses the program a CALL loads',
+    impact: "Whoever supplies that input picks which load module runs with this program's authority and data; the fuzz run named one the library does not hold, so the run ended in S806, but a name the library does hold runs",
+    remedy: 'Choose the called program from a fixed set of names checked against the input, or call it by a literal name, at the CALL the journal names',
+  },
   'input-causes-abend': {
     sev: 'med', evidence: 'execution', cwe: 'CWE-248',
     text: 'An input the program accepts ends its run with an abend',
@@ -37,6 +51,14 @@ export const ABEND_RULES = {
   },
 };
 
+// What the manifest's `optimized` says of an abend: whether the same input ends the same way with
+// the program compiled at OPTIMIZE(2), where IBM may compare invalid data by its bytes rather than
+// end in a data exception at OPTIMIZE(0), its default.
+const OPTIMIZED = {
+  true: '; compiled with OPTIMIZE(2) it ends the same way',
+  false: '; it holds at OPTIMIZE(0), IBM\'s default: compiled with OPTIMIZE(2) the same input does not end there',
+};
+
 // IBM's messages for an SSRANGE failure: a subscript or index, an OCCURS DEPENDING ON object, and a
 // reference modification's start, length, and start plus length.
 const RANGE_MESSAGES = /^IGZ00(06|07|72|73|74)S\b/;
@@ -46,30 +68,88 @@ export function abendRunPaths(opts = {}) {
   return (process.env.COBOLWORK_ABENDS || '').split(delimiter).filter(Boolean);
 }
 
+// How ironwork ends the message of a data or protection exception in a CICS task, whose abend
+// code CICS reports as ASRA.
+const CICS_PROGRAM_CHECK = /\((S0C7|S0C4), which CICS reports as ASRA\)$/;
+
 export function abendRule(abend) {
-  if (abend.code === 'S0C7') return 'input-causes-abend-s0c7';
-  if (abend.code === 'S0C4') return 'input-causes-abend-s0c4';
+  const code = (abend.code === 'ASRA' && CICS_PROGRAM_CHECK.exec(abend.message || '')?.[1]) || abend.code;
+  if (code === 'S0C7') return 'input-causes-abend-s0c7';
+  if (code === 'S0C4') return 'input-causes-abend-s0c4';
+  if (code === 'S322') return 'input-causes-hang';
+  if (code === 'S806') return 'input-selects-program';
   if (RANGE_MESSAGES.test(abend.message || '')) return 'input-causes-abend-subscript-range';
   return 'input-causes-abend';
 }
 
-// The abend a kept run's own journal records, or null.
+// The abend a kept run's own journal records, with the sources it read and the programs it CALLed,
+// or null.
 function journalAbend(evidenceDir, runId) {
   if (typeof runId !== 'string' || !/^[0-9TZ]+-[0-9a-f]{16}$/.test(runId)) return null;
   const file = join(evidenceDir, 'runs', `${runId}.jsonl`);
   if (!existsSync(file)) return null;
+  let abend = null;
+  const inputs = [];
+  const calls = [];
+  const sinks = [];
   for (const line of readFileSync(file, 'utf8').split('\n')) {
     if (!line) continue;
     const rec = JSON.parse(line);
-    if (rec.kind === 'abend') return rec;
+    if (rec.kind === 'abend') abend ??= rec;
+    else if (rec.kind === 'input') inputs.push(rec);
+    else if (rec.kind === 'call') calls.push(rec);
+    else if (rec.kind === 'sink') sinks.push(rec);
   }
-  return null;
+  return abend && { ...abend, inputs, calls, sinks };
 }
 
+const MANIFEST_FORMAT = 'ironwork-fuzz/v1';
+// A subprogram fuzzed at its interface: its inputs are arguments, and a caller passing them is
+// not shown to exist (ironwork docs/evidence.md §5.2).
+const INTERFACE_FORMAT = 'ironwork-fuzz-interface/v1';
+const FORMATS = [MANIFEST_FORMAT, INTERFACE_FORMAT];
+
+// What a finding from an interface run says of the caller its input needs.
+function interfaceClause(callers) {
+  const where = callers.length
+    ? `with arguments shaped by the CALL${callers.length === 1 ? '' : 's'} at ${callers.map((c) => `${c.file}:${c.line}`).join(', ')}`
+    : 'on generated arguments, with no CALL to it in the scanned tree';
+  return `; it ran as a subprogram, ${where}, on its first call in its initial state: a caller passing these bytes ends it, and no caller run shows one does`;
+}
+
+// ironwork's own abend codes for a construct it does not run: no IBM system would raise them.
+const NOT_MODELLED = new Set(NOT_RUN_ABENDS);
+
 const isString = (x) => typeof x === 'string' && x.length > 0;
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
 
-// One fuzz run: its findings, and what kept any of it from counting.
-export function loadAbendRun(dir) {
+// A manifest root as a directory of the scanned tree, or null when it is not one.
+function treeDir(dir) {
+  if (typeof dir !== 'string') return null;
+  const norm = posix.normalize(dir.replace(/\\/g, '/'));
+  return norm === '..' || norm.startsWith('../') || posix.isAbsolute(norm) ? null : norm;
+}
+
+// The directory in the scanned tree of the root the run read `file` from, located by the manifest's
+// roots: the root the journal's input record for that file names, or for a CALLed program's source,
+// which its call record names by path and digest alone, the root under which the tree holds that
+// file with that digest. Undefined where neither record names the file, null where the root cannot
+// be told or lies outside the tree.
+function rootDirectory(roots, journal, file, tree) {
+  if (!Array.isArray(roots)) return undefined;
+  const held = [...new Set(journal.inputs.filter((i) => i.path === file && Number.isInteger(i.root)).map((i) => i.root))];
+  if (held.length) return held.length === 1 ? treeDir(roots[held[0]]) : null;
+  const digests = new Set(journal.calls.filter((c) => c.from === file).map((c) => c.sha256));
+  if (!digests.size || !tree) return undefined;
+  const holding = [...new Set(roots.map(treeDir).filter((d) => d !== null && existsSync(join(tree, d, file))))];
+  const same = holding.filter((d) => digests.has(sha256(readFileSync(join(tree, d, file)))));
+  const found = same.length ? same : holding;
+  return found.length === 1 ? found[0] : null;
+}
+
+// One fuzz run: its findings, and what kept any of it from counting. `tree` is the scanned tree,
+// where a CALLed program's source is looked for.
+export function loadAbendRun(dir, tree) {
   const out = { dir: basename(dir), program: null, findings: [], problems: [], counts: null, notModelled: 0 };
   let doc;
   try { doc = JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8')); } catch (e) {
@@ -80,6 +160,15 @@ export function loadAbendRun(dir) {
     out.problems.push('manifest.json is not an ironwork-fuzz manifest with a program, inputs and runs');
     return out;
   }
+  // A manifest from before ironwork wrote `format` has the first format's shape.
+  if (doc.format !== undefined && !FORMATS.includes(doc.format)) {
+    out.problems.push(`manifest.json is in format ${JSON.stringify(doc.format)}, and this cobolwork reads ${FORMATS.join(' and ')}`);
+    return out;
+  }
+  const inputFrom = doc.format === INTERFACE_FORMAT ? 'interface' : 'entry';
+  const callers = inputFrom === 'interface' && Array.isArray(doc.callers)
+    ? doc.callers.filter((c) => c && isString(c.file) && Number.isInteger(c.line)).map((c) => ({ file: posix.normalize(c.file.replace(/\\/g, '/')), line: c.line }))
+    : [];
   const programFile = posix.normalize(doc.program.file.replace(/\\/g, '/'));
   if (programFile.startsWith('../') || posix.isAbsolute(programFile)) {
     out.problems.push(`the program ${doc.program.file} is outside the scanned tree`);
@@ -98,7 +187,7 @@ export function loadAbendRun(dir) {
   const seen = new Map();
   for (const run of doc.runs) {
     if (!run || run.outcome !== 'abend' || !run.abend || !isString(run.abend.code)) continue;
-    if (run.abend.code === 'IRONWORK') { out.notModelled++; continue; }
+    if (NOT_MODELLED.has(run.abend.code)) { out.notModelled++; continue; }
     const recorded = journalAbend(evidenceDir, run.journal);
     if (!recorded || recorded.code !== run.abend.code) {
       out.problems.push(`run ${run.journal ?? '(unnamed)'}: its journal does not record the abend ${run.abend.code} the manifest gives`);
@@ -111,19 +200,31 @@ export function loadAbendRun(dir) {
       out.problems.push(`run ${run.journal}: its journal records the abend at ${place.file}:${place.line}, not where the manifest puts it`);
       continue;
     }
-    const where = isString(place.file) ? posix.normalize(posix.join(posix.dirname(programFile), place.file.replace(/\\/g, '/'))) : programFile;
+    const rootDir = isString(place.file) ? rootDirectory(doc.roots, recorded, place.file, tree) : undefined;
+    if (rootDir === null) {
+      out.problems.push(`run ${run.journal}: the abend is in ${place.file}, which its journal and manifest do not place in the scanned tree`);
+      continue;
+    }
+    const where = isString(place.file) ? posix.normalize(posix.join(rootDir ?? posix.dirname(programFile), place.file.replace(/\\/g, '/'))) : programFile;
     const line = Number.isInteger(place.line) && place.line > 0 ? place.line : 1;
     const rule = abendRule(run.abend);
+    // An S806 is input choosing the program only where the run's own journal records the marker
+    // fuzz put in the input reaching that CALL's program load.
+    if (rule === 'input-selects-program' && !recorded.sinks.some((k) => k.sink === 'dynamic-program-load' && k.reached === true && k.file === place.file && k.line === place.line)) {
+      out.problems.push(`run ${run.journal}: its journal does not record the input reaching the CALL at ${place.file}:${place.line}, so its S806 is not reported`);
+      continue;
+    }
     const used = (Array.isArray(run.input) ? run.input : []).map((id) => inputs.get(id)).filter(Boolean)
-      .map((i) => ({ kind: i.kind, name: i.name, bytes: i.bytes, ...(i.minimized ? { minimized: true } : {}) }));
+      .map((i) => ({ kind: i.kind, name: i.name, bytes: i.bytes, ...(i.minimized ? { minimized: true } : {}), ...(Number.isInteger(i.position) ? { position: i.position } : {}), ...(i.omitted === true ? { omitted: true } : {}) }));
     const key = `${rule}|${where}|${line}`;
     const size = used.reduce((n, i) => n + String(i.bytes || '').length, 0);
     const held = seen.get(key);
     if (held && held.size <= size) continue;
+    const optimized = typeof run.abend.optimized === 'boolean' ? run.abend.optimized : undefined;
     const finding = {
       rule, path: where, line, program: out.program.id,
-      detail: `${out.program.id || programFile} ended with ${run.abend.code}${isString(run.abend.message) ? ` (${run.abend.message})` : ''} on an input the fuzz run ${out.dir} kept`,
-      abend: { code: run.abend.code, ...(isString(run.abend.message) ? { message: run.abend.message } : {}) },
+      detail: `${out.program.id || programFile} ended with ${run.abend.code}${isString(run.abend.message) ? ` (${run.abend.message})` : ''} on an input the fuzz run ${out.dir} kept${OPTIMIZED[optimized] ?? ''}${inputFrom === 'interface' ? interfaceClause(callers) : ''}`,
+      abend: { code: run.abend.code, ...(isString(run.abend.message) ? { message: run.abend.message } : {}), ...(optimized === undefined ? {} : { optimized }), inputFrom, ...(inputFrom === 'interface' ? { callers } : {}) },
       input: used, run: { dir: out.dir, journal: run.journal },
     };
     seen.set(key, { size, finding });
@@ -134,13 +235,14 @@ export function loadAbendRun(dir) {
 
 export function scanAbend(root, opts = {}) {
   const dirs = abendRunPaths(opts);
-  const runs = dirs.map((d) => loadAbendRun(d));
+  const runs = dirs.map((d) => loadAbendRun(d, root));
   const findings = runs.flatMap((r) => r.findings.filter((f) => existsSync(join(root, f.path))));
   const stats = {
     filesScanned: 0, filesUnreadable: 0,
     abendRuns: runs.map((r) => ({ dir: r.dir, program: r.program ? r.program.file : null, findings: r.findings.length, ...(r.notModelled ? { notModelled: r.notModelled } : {}), ...(r.counts ? { counts: r.counts } : {}) })),
     ...(runs.some((r) => r.problems.length) ? { abendRunProblems: runs.flatMap((r) => r.problems.map((p) => `${r.dir}: ${p}`)) } : {}),
     ...(runs.some((r) => r.findings.some((f) => !existsSync(join(root, f.path)))) ? { abendRunsElsewhere: runs.flatMap((r) => r.findings.filter((f) => !existsSync(join(root, f.path))).map((f) => `${r.dir}: ${f.path}`)) } : {}),
+    byInputFrom: { entry: findings.filter((f) => f.abend.inputFrom === 'entry').length, interface: findings.filter((f) => f.abend.inputFrom === 'interface').length },
     setIncomplete: runs.some((r) => r.problems.length > 0),
   };
   return report('abend', { rules: ABEND_RULES, findings, stats, run: null });