@portll/cobolwork 0.5.0 → 0.7.0

package/lib/sarif.mjs

@@ -45,13 +45,23 @@ const DECLARED = new Map([...Object.entries(ALL_RULES), ...Object.entries(DIFF_R
 const SET_OF = new Map();
 for (const s of REGISTRY) for (const id of Object.keys(s.rules)) SET_OF.set(id, s.name);
 
+// A related entry without a path is an advisory the finding rests on, not a place in the tree.
+const located = (f) => (f.related || []).filter((r) => r.path);
+
+const cweTaxon = (cwe) => /^CWE-(\d+)$/.exec(cwe || '')?.[1] ?? null;
+
+// The CWE taxonomy is run.taxonomies[0] whenever any rule names a CWE.
+const CWE_COMPONENT = { name: 'CWE', index: 0 };
+
 // SARIF's level cannot say what kind of claim a result is, so evidence rides in the property bags.
 const descriptorFor = (report) => (id) => {
   const properties = {
     ...(report.ruleCwe?.[id] ? { cwe: report.ruleCwe[id] } : {}),
     ...(report.ruleEvidence?.[id] ? { evidence: report.ruleEvidence[id] } : {}),
+    ...(report.ruleCompliance?.[id] ? { compliance: report.ruleCompliance[id] } : {}),
     ...(SECURITY_SEVERITY[DECLARED.get(id)] ? { 'security-severity': SECURITY_SEVERITY[DECLARED.get(id)] } : {}),
   };
+  const taxon = cweTaxon(report.ruleCwe?.[id]);
   return {
     id,
     shortDescription: { text: report.ruleText?.[id] || id },
@@ -59,10 +69,23 @@ const descriptorFor = (report) => (id) => {
     // rule. `help` is where GitHub code scanning shows a recommendation.
     ...(report.ruleImpact?.[id] ? { fullDescription: { text: textOf(report.ruleImpact[id]) } } : {}),
     ...(report.ruleRemedy?.[id] ? { help: { text: textOf(report.ruleRemedy[id]) } } : {}),
+    ...(taxon ? { relationships: [{ target: { id: taxon, toolComponent: CWE_COMPONENT } }] } : {}),
     ...(Object.keys(properties).length ? { properties } : {}),
   };
 };
 
+function cweTaxonomy(report, ruleIds) {
+  const taxa = [...new Set(ruleIds.map((id) => cweTaxon(report.ruleCwe?.[id])).filter(Boolean))].sort((a, b) => a - b);
+  if (!taxa.length) return [];
+  return [{
+    name: CWE_COMPONENT.name,
+    organization: 'MITRE',
+    shortDescription: { text: 'Common Weakness Enumeration' },
+    informationUri: 'https://cwe.mitre.org/',
+    taxa: taxa.map((id) => ({ id, helpUri: `https://cwe.mitre.org/data/definitions/${id}.html` })),
+  }];
+}
+
 function notifications(report) {
   const bySet = report.summary?.bySet || {};
   const execution = [];
@@ -111,6 +134,9 @@ function notifications(report) {
       properties: { set },
     });
   }
+  for (const [id, warnings] of [['cobolwork/site-key-ignored', report.summary?.siteWarnings], ['cobolwork/feed-key-ignored', report.summary?.feedWarnings]]) {
+    for (const w of warnings || []) configuration.push({ descriptor: { id }, level: 'warning', message: { text: textOf(w) } });
+  }
   // A diff whose two sides were scanned under different configuration.
   for (const { file, change } of report.summary?.configurationChanged || []) {
     configuration.push({
@@ -144,6 +170,16 @@ export function toSarif(report, { toolVersion = '0.1.0' } = {}) {
 
   const { execution, configuration } = notifications(report);
   const s = report.summary || {};
+  const taxonomies = cweTaxonomy(report, present);
+
+  // Every file a result or related location names, each listed once; locations point at it by index.
+  const results = [...report.findings, ...suppressed];
+  const uris = [...new Set(results.flatMap((f) => [f.path, ...located(f).map((r) => r.path)]).map(uriOf))].sort();
+  const artifactIndex = new Map(uris.map((uri, i) => [uri, i]));
+  const artifactLocation = (path) => {
+    const uri = uriOf(path);
+    return { uri, uriBaseId: '%SRCROOT%', index: artifactIndex.get(uri) };
+  };
 
   return {
     $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
@@ -158,6 +194,7 @@ export function toSarif(report, { toolVersion = '0.1.0' } = {}) {
         },
         ...(extensions.length ? { extensions } : {}),
       },
+      ...(taxonomies.length ? { taxonomies } : {}),
       invocations: [{
         // The verdict, where a consumer that reads nothing else will still see it.
         executionSuccessful: s.nosrc !== true,
@@ -183,7 +220,8 @@ export function toSarif(report, { toolVersion = '0.1.0' } = {}) {
           },
         },
       }],
-      results: [...report.findings, ...suppressed].map((f) => {
+      ...(uris.length ? { artifacts: uris.map((uri) => ({ location: { uri, uriBaseId: '%SRCROOT%' } })) } : {}),
+      results: results.map((f) => {
         const set = SET_OF.get(f.rule);
         const component = set !== undefined ? indexOfSet.get(set) : undefined;
         const within = component === undefined ? null : extensions[component].rules.findIndex((r) => r.id === f.rule);
@@ -213,9 +251,12 @@ export function toSarif(report, { toolVersion = '0.1.0' } = {}) {
             ...(f.reach ? { reach: f.reach } : {}),
             ...(f.effect ? { effect: f.effect } : {}),
             ...(f.exploitability ? { exploitability: f.exploitability } : {}),
+            // How an abend's input reached the program: through its own entry, or as arguments to
+            // a subprogram no caller run is shown to pass.
+            ...(f.abend?.inputFrom ? { inputFrom: f.abend.inputFrom } : {}),
           } } : {}),
-          locations: [{ physicalLocation: { artifactLocation: { uri: uriOf(f.path), uriBaseId: '%SRCROOT%' }, region: { startLine: f.line || 1 } } }],
-          ...(f.related ? { relatedLocations: f.related.map((r) => ({ physicalLocation: { artifactLocation: { uri: uriOf(r.path), uriBaseId: '%SRCROOT%' }, region: { startLine: r.line || 1 } }, message: { text: textOf(r.detail) } })) } : {}),
+          locations: [{ physicalLocation: { artifactLocation: artifactLocation(f.path), region: { startLine: f.line || 1 } } }],
+          ...(located(f).length ? { relatedLocations: located(f).map((r) => ({ physicalLocation: { artifactLocation: artifactLocation(r.path), region: { startLine: r.line || 1 } }, message: { text: textOf(r.detail) } })) } : {}),
           ...(f.suppressed ? { suppressions: [{ kind: 'external', status: 'accepted', justification: `${f.suppressed.action} by ${f.suppressed.who} until ${f.suppressed.expires}: ${f.suppressed.reason}` }] } : {}),
         };
       }),

package/lib/scan.mjs

@@ -3,7 +3,8 @@ import { join, resolve } from 'node:path';
 import { sortFindings, tally, evidenceMap, EVIDENCE, EXPLOITABILITY } from './kernel/findings.mjs';
 import { directoryTree } from './kernel/source-tree.mjs';
 import { REGISTRY, RULE_SETS, ALL_RULES, reportKey } from './kernel/registry.mjs';
-import { inventory } from './inventory.mjs';
+import { inventorySteps } from './inventory.mjs';
+import { driveTogether, sharingTree } from './kernel/shared-pass.mjs';
 import { stoppedBecause } from './kernel/memory.mjs';
 import { complianceMap, FRAMEWORKS_LOADED, FRAMEWORKS_UNLOADED } from './compliance.mjs';
 import { stampFingerprints, FINGERPRINT_VERSION } from './kernel/identity.mjs';
@@ -65,6 +66,9 @@ function mergeEstate(reports) {
     effectNote: effectless.length ? `no authority facts declared in ${of(effectless)}, so no finding there was judged to run privileged: name privilegedTransactions/privilegedJobs in each repository's cobolwork.site.json, or bring them in the COBOLWORK_REACH extract` : null,
     witnessFeeds: first('witnessFeeds'), byWitness: addUp('byWitness'), witnessFeedProblems: union('witnessFeedProblems'),
     witnessUnmatched: unmatched, witnessOverruled: overruled,
+    executionFeeds: first('executionFeeds'), byExecution: addUp('byExecution'), executionFeedProblems: union('executionFeedProblems'),
+    siteWarnings: all.flatMap((x) => (x.s.siteWarnings || []).map((w) => `${x.repo}/${w}`)),
+    feedWarnings: union('feedWarnings'),
   };
   return Object.fromEntries(Object.entries(merged).filter(([, v]) => (Array.isArray(v) ? v.length : v)));
 }
@@ -101,7 +105,7 @@ function scanEach(root, opts) {
       filesScanned, programs: sum('programs'), programFiles: sum('programFiles'), copybookFiles: sum('copybookFiles'),
       jclFiles: sum('jclFiles'), copiesMissing: sum('copiesMissing'), filesUnreadable: sum('filesUnreadable'),
       filesEbcdic: sum('filesEbcdic'), filesOverBudget: sum('filesOverBudget'), crossProgram: sum('crossProgram'),
-      ruleSets: opts.only || RULE_SETS, nosrc: filesScanned === 0,
+      ruleSets: opts.only || RULE_SETS, flowModel: FLOW_MODEL, toolVersion: TOOL_VERSION, nosrc: filesScanned === 0,
       coverageIncomplete: reports.some(({ r }) => r.summary.coverageIncomplete),
       identity: { version: FINGERPRINT_VERSION, shared },
       ...(reports[0]?.r.summary.advisoryFeeds ? { advisoryFeeds: reports[0].r.summary.advisoryFeeds } : {}),
@@ -157,7 +161,10 @@ export function applyEstateFacts(findings, checked, root, opts = {}) {
   const { byExecution } = applyExecution(findings, root, executionFeeds);
   const driven = byExploitability ? byExploitability['attacker-driven'] : 0;
   const loaded = witnessFeeds.filter((f) => !f.problem);
+  const feedWarnings = [...reachFeeds, ...witnessFeeds].flatMap((f) => f.warnings).sort();
   return {
+    ...(site.warnings.length ? { siteWarnings: site.warnings } : {}),
+    ...(feedWarnings.length ? { feedWarnings } : {}),
     ...(byReach ? { byReach } : {}),
     ...(byEffect ? { byEffect } : {}),
     ...(reachFeeds.some(f => !f.problem) ? { reachFeeds: reachFeeds.filter(f => !f.problem).map(f => ({ file: f.file, extract: f.extract, retrieved: f.retrieved })) } : {}),
@@ -178,13 +185,12 @@ export function applyEstateFacts(findings, checked, root, opts = {}) {
 }
 
 // A set that throws is reported as not having run, and the other sets' findings stand.
+const notRun = (set, e) => report(set.name, { rules: set.rules, findings: [], stats: {
+  coverageIncomplete: true,
+  notRead: `the rule set stopped on an error and reported nothing: ${printable(e?.message ?? e)}`,
+} });
 function runSet(set, root, o) {
-  try { return set.scan(root, o); } catch (e) {
-    return report(set.name, { rules: set.rules, findings: [], stats: {
-      coverageIncomplete: true,
-      notRead: `the rule set stopped on an error and reported nothing: ${printable(e?.message ?? e)}`,
-    } });
-  }
+  try { return set.scan(root, o); } catch (e) { return notRun(set, e); }
 }
 
 export function scanAll(root, opts = {}) {
@@ -193,12 +199,22 @@ export function scanAll(root, opts = {}) {
   // One walk of the tree for the whole scan. Every rule set used to call buildFileIndex(root) for
   // itself, so a scan read every directory entry and resolved every symlink nine times over, and
   // added a tenth walk each time a rule set was added.
-  const tree = opts.tree || directoryTree(root, opts);
+  const tree = sharingTree(opts.tree || directoryTree(root, opts));
   const o = { ...opts, tree };
-  const inv = inventory(root, o);
   // One loop over the registry, in its order. A set that is not registered cannot run, and
-  // cannot report a silent zero on its own behalf either.
-  const parts = REGISTRY.filter((set) => only.includes(set.name)).map((set) => runSet(set, root, o));
+  // cannot report a silent zero on its own behalf either. The inventory and the sets that read
+  // programs share one pass, so each program is read and parsed once.
+  const chosen = REGISTRY.filter((set) => only.includes(set.name));
+  const stepped = chosen.filter((set) => set.steps);
+  const [invResult, ...stepResults] = driveTogether([inventorySteps(root, o), ...stepped.map((set) => set.steps(root, o))], tree);
+  if (invResult && invResult.error) throw invResult.error;
+  const inv = invResult;
+  const byName = new Map(stepped.map((set, k) => [set.name, stepResults[k]]));
+  const parts = chosen.map((set) => {
+    if (!byName.has(set.name)) return runSet(set, root, o);
+    const r = byName.get(set.name);
+    return r && r.error ? notRun(set, r.error) : r;
+  });
 
   const flowPart = parts.find(p => p.tool === 'cobolwork-flow');
   const overBudget = flowPart ? flowPart.summary.filesOverBudget || 0 : 0;

package/lib/sets/abend.mjs

@@ -10,6 +10,7 @@ import { createHash } from 'node:crypto';
 import { delimiter, join, posix, basename } from 'node:path';
 import { report } from '../kernel/ruleset.mjs';
 import { verifyEvidence } from '../evidence/verify.mjs';
+import { NOT_RUN_ABENDS } from '../ironwork-ids.mjs';
 
 export const ABEND_RULES = {
   'input-causes-abend-s0c7': {
@@ -30,6 +31,18 @@ export const ABEND_RULES = {
     impact: 'SSRANGE caught the overrun and ended the run; compiled without SSRANGE, as production builds often are, the same input reads or writes storage beside the table or field',
     remedy: 'Check the index against both ends of the table or field before the statement the journal names, and keep SSRANGE on for the build',
   },
+  'input-causes-hang': {
+    sev: 'med', evidence: 'execution', cwe: 'CWE-834',
+    text: 'An input the program accepts keeps a loop running past the statement limit that stands in for its time limit (S322)',
+    impact: 'Whoever supplies that input decides how long the loop runs; on z/OS a long enough run holds the step and its processor until TIME= ends it, and the jobs behind it wait. The run shows the loop passed the limit, not that it would never end',
+    remedy: 'Find the loop at the line the journal names and bound its iterations: check the count or the exit condition the input supplies before the loop starts, or stop it at a counter and reject the input that would pass it',
+  },
+  'input-selects-program': {
+    sev: 'high', evidence: 'execution', cwe: 'CWE-470',
+    text: 'An input the program accepts chooses the program a CALL loads',
+    impact: "Whoever supplies that input picks which load module runs with this program's authority and data; the fuzz run named one the library does not hold, so the run ended in S806, but a name the library does hold runs",
+    remedy: 'Choose the called program from a fixed set of names checked against the input, or call it by a literal name, at the CALL the journal names',
+  },
   'input-causes-abend': {
     sev: 'med', evidence: 'execution', cwe: 'CWE-248',
     text: 'An input the program accepts ends its run with an abend',
@@ -38,19 +51,44 @@ export const ABEND_RULES = {
   },
 };
 
+// What the manifest's `optimized` says of an abend: whether the same input ends the same way with
+// the program compiled at OPTIMIZE(2), where IBM may compare invalid data by its bytes rather than
+// end in a data exception at OPTIMIZE(0), its default.
+const OPTIMIZED = {
+  true: '; compiled with OPTIMIZE(2) it ends the same way',
+  false: '; it holds at OPTIMIZE(0), IBM\'s default: compiled with OPTIMIZE(2) the same input does not end there',
+};
+
 // IBM's messages for an SSRANGE failure: a subscript or index, an OCCURS DEPENDING ON object, and a
 // reference modification's start, length, and start plus length.
 const RANGE_MESSAGES = /^IGZ00(06|07|72|73|74)S\b/;
 
+// Language Environment's message for a dynamic CALL of a module no library holds, which ironwork
+// ends U4038 (its assumption C450); earlier ironwork releases ended the same CALL S806.
+const MODULE_NOT_FOUND = /^CEE3501S The module .* was not found\.$/;
+
 export function abendRunPaths(opts = {}) {
   if (opts.abendRuns) return opts.abendRuns;
   return (process.env.COBOLWORK_ABENDS || '').split(delimiter).filter(Boolean);
 }
 
+// How ironwork ends the message of a data or protection exception in a CICS task, whose abend
+// code CICS reports as ASRA.
+const CICS_PROGRAM_CHECK = /\((S0C7|S0C4), which CICS reports as ASRA\)$/;
+
+// How ironwork ends the message of a Language Environment condition in a CICS task, U4038 in
+// batch, which CICS reports as transaction abend 4038 (its assumption C454).
+const CICS_LE_CONDITION = / \(U4038, which CICS reports as transaction abend 4038\)$/;
+
 export function abendRule(abend) {
-  if (abend.code === 'S0C7') return 'input-causes-abend-s0c7';
-  if (abend.code === 'S0C4') return 'input-causes-abend-s0c4';
-  if (RANGE_MESSAGES.test(abend.message || '')) return 'input-causes-abend-subscript-range';
+  const cicsLe = abend.code === '4038' && CICS_LE_CONDITION.test(abend.message || '');
+  const message = cicsLe ? abend.message.replace(CICS_LE_CONDITION, '') : abend.message || '';
+  const code = cicsLe ? 'U4038' : (abend.code === 'ASRA' && CICS_PROGRAM_CHECK.exec(message)?.[1]) || abend.code;
+  if (code === 'S0C7') return 'input-causes-abend-s0c7';
+  if (code === 'S0C4') return 'input-causes-abend-s0c4';
+  if (code === 'S322') return 'input-causes-hang';
+  if (code === 'S806' || (code === 'U4038' && MODULE_NOT_FOUND.test(message))) return 'input-selects-program';
+  if (RANGE_MESSAGES.test(message)) return 'input-causes-abend-subscript-range';
   return 'input-causes-abend';
 }
 
@@ -63,16 +101,35 @@ function journalAbend(evidenceDir, runId) {
   let abend = null;
   const inputs = [];
   const calls = [];
+  const sinks = [];
   for (const line of readFileSync(file, 'utf8').split('\n')) {
     if (!line) continue;
     const rec = JSON.parse(line);
     if (rec.kind === 'abend') abend ??= rec;
     else if (rec.kind === 'input') inputs.push(rec);
     else if (rec.kind === 'call') calls.push(rec);
+    else if (rec.kind === 'sink') sinks.push(rec);
   }
-  return abend && { ...abend, inputs, calls };
+  return abend && { ...abend, inputs, calls, sinks };
 }
 
+const MANIFEST_FORMAT = 'ironwork-fuzz/v1';
+// A subprogram fuzzed at its interface: its inputs are arguments, and a caller passing them is
+// not shown to exist (ironwork docs/evidence.md §5.2).
+const INTERFACE_FORMAT = 'ironwork-fuzz-interface/v1';
+const FORMATS = [MANIFEST_FORMAT, INTERFACE_FORMAT];
+
+// What a finding from an interface run says of the caller its input needs.
+function interfaceClause(callers) {
+  const where = callers.length
+    ? `with arguments shaped by the CALL${callers.length === 1 ? '' : 's'} at ${callers.map((c) => `${c.file}:${c.line}`).join(', ')}`
+    : 'on generated arguments, with no CALL to it in the scanned tree';
+  return `; it ran as a subprogram, ${where}, on its first call in its initial state: a caller passing these bytes ends it, and no caller run shows one does`;
+}
+
+// ironwork's own abend codes for a construct it does not run: no IBM system would raise them.
+const NOT_MODELLED = new Set(NOT_RUN_ABENDS);
+
 const isString = (x) => typeof x === 'string' && x.length > 0;
 const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
 
@@ -113,6 +170,15 @@ export function loadAbendRun(dir, tree) {
     out.problems.push('manifest.json is not an ironwork-fuzz manifest with a program, inputs and runs');
     return out;
   }
+  // A manifest from before ironwork wrote `format` has the first format's shape.
+  if (doc.format !== undefined && !FORMATS.includes(doc.format)) {
+    out.problems.push(`manifest.json is in format ${JSON.stringify(doc.format)}, and this cobolwork reads ${FORMATS.join(' and ')}`);
+    return out;
+  }
+  const inputFrom = doc.format === INTERFACE_FORMAT ? 'interface' : 'entry';
+  const callers = inputFrom === 'interface' && Array.isArray(doc.callers)
+    ? doc.callers.filter((c) => c && isString(c.file) && Number.isInteger(c.line)).map((c) => ({ file: posix.normalize(c.file.replace(/\\/g, '/')), line: c.line }))
+    : [];
   const programFile = posix.normalize(doc.program.file.replace(/\\/g, '/'));
   if (programFile.startsWith('../') || posix.isAbsolute(programFile)) {
     out.problems.push(`the program ${doc.program.file} is outside the scanned tree`);
@@ -131,7 +197,7 @@ export function loadAbendRun(dir, tree) {
   const seen = new Map();
   for (const run of doc.runs) {
     if (!run || run.outcome !== 'abend' || !run.abend || !isString(run.abend.code)) continue;
-    if (run.abend.code === 'IRONWORK') { out.notModelled++; continue; }
+    if (NOT_MODELLED.has(run.abend.code)) { out.notModelled++; continue; }
     const recorded = journalAbend(evidenceDir, run.journal);
     if (!recorded || recorded.code !== run.abend.code) {
       out.problems.push(`run ${run.journal ?? '(unnamed)'}: its journal does not record the abend ${run.abend.code} the manifest gives`);
@@ -152,16 +218,23 @@ export function loadAbendRun(dir, tree) {
     const where = isString(place.file) ? posix.normalize(posix.join(rootDir ?? posix.dirname(programFile), place.file.replace(/\\/g, '/'))) : programFile;
     const line = Number.isInteger(place.line) && place.line > 0 ? place.line : 1;
     const rule = abendRule(run.abend);
+    // A CALL of a missing program is input choosing the program only where the run's own journal
+    // records the marker fuzz put in the input reaching that CALL's program load.
+    if (rule === 'input-selects-program' && !recorded.sinks.some((k) => k.sink === 'dynamic-program-load' && k.reached === true && k.file === place.file && k.line === place.line)) {
+      out.problems.push(`run ${run.journal}: its journal does not record the input reaching the CALL at ${place.file}:${place.line}, so its missing-program ending is not reported`);
+      continue;
+    }
     const used = (Array.isArray(run.input) ? run.input : []).map((id) => inputs.get(id)).filter(Boolean)
-      .map((i) => ({ kind: i.kind, name: i.name, bytes: i.bytes, ...(i.minimized ? { minimized: true } : {}) }));
+      .map((i) => ({ kind: i.kind, name: i.name, bytes: i.bytes, ...(i.minimized ? { minimized: true } : {}), ...(Number.isInteger(i.position) ? { position: i.position } : {}), ...(i.omitted === true ? { omitted: true } : {}) }));
     const key = `${rule}|${where}|${line}`;
     const size = used.reduce((n, i) => n + String(i.bytes || '').length, 0);
     const held = seen.get(key);
     if (held && held.size <= size) continue;
+    const optimized = typeof run.abend.optimized === 'boolean' ? run.abend.optimized : undefined;
     const finding = {
       rule, path: where, line, program: out.program.id,
-      detail: `${out.program.id || programFile} ended with ${run.abend.code}${isString(run.abend.message) ? ` (${run.abend.message})` : ''} on an input the fuzz run ${out.dir} kept`,
-      abend: { code: run.abend.code, ...(isString(run.abend.message) ? { message: run.abend.message } : {}) },
+      detail: `${out.program.id || programFile} ended with ${run.abend.code}${isString(run.abend.message) ? ` (${run.abend.message})` : ''} on an input the fuzz run ${out.dir} kept${OPTIMIZED[optimized] ?? ''}${inputFrom === 'interface' ? interfaceClause(callers) : ''}`,
+      abend: { code: run.abend.code, ...(isString(run.abend.message) ? { message: run.abend.message } : {}), ...(optimized === undefined ? {} : { optimized }), inputFrom, ...(inputFrom === 'interface' ? { callers } : {}) },
       input: used, run: { dir: out.dir, journal: run.journal },
     };
     seen.set(key, { size, finding });
@@ -179,6 +252,7 @@ export function scanAbend(root, opts = {}) {
     abendRuns: runs.map((r) => ({ dir: r.dir, program: r.program ? r.program.file : null, findings: r.findings.length, ...(r.notModelled ? { notModelled: r.notModelled } : {}), ...(r.counts ? { counts: r.counts } : {}) })),
     ...(runs.some((r) => r.problems.length) ? { abendRunProblems: runs.flatMap((r) => r.problems.map((p) => `${r.dir}: ${p}`)) } : {}),
     ...(runs.some((r) => r.findings.some((f) => !existsSync(join(root, f.path)))) ? { abendRunsElsewhere: runs.flatMap((r) => r.findings.filter((f) => !existsSync(join(root, f.path))).map((f) => `${r.dir}: ${f.path}`)) } : {}),
+    byInputFrom: { entry: findings.filter((f) => f.abend.inputFrom === 'entry').length, interface: findings.filter((f) => f.abend.inputFrom === 'interface').length },
     setIncomplete: runs.some((r) => r.problems.length > 0),
   };
   return report('abend', { rules: ABEND_RULES, findings, stats, run: null });

package/lib/sets/build.mjs

@@ -55,7 +55,7 @@ const COMPILERS = new Set(['gnucobol', 'opentext-cobol', 'ibm-enterprise-cobol']
 
 // Files that decide what the build runs. A repository states this in one of a small number of
 // conventional places, and reading only those keeps the rule from matching prose in a README.
-function isBuildFile(path) {
+export function isBuildFile(path) {
   const name = basename(path);
   const p = path.replace(/\\/g, '/').toLowerCase();
   if (/^(dockerfile|containerfile)(\..+)?$/i.test(name)) return true;
@@ -98,6 +98,21 @@ const PINS = [
   { product: 'cics-transaction-gateway', re: /from\s+\S*cics[-_]?transaction[-_]?gateway\S*:v?(\d+(?:\.\d+)+)/gi },
 ];
 
+// Every product version the text pins, once each, with the text that pins it.
+export function pinsIn(src) {
+  const out = [];
+  const seen = new Set();
+  for (const { product, re } of PINS) {
+    for (const m of src.matchAll(re)) {
+      const key = `${product}@${m[1]}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push({ product, version: m[1], text: m[0] });
+    }
+  }
+  return out;
+}
+
 function withMavenProperties(src) {
   const block = src.match(/<properties>([\s\S]*?)<\/properties>/i);
   if (!block) return src;
@@ -189,42 +204,33 @@ export function scanBuild(root, opts = {}) {
     if (/pom\.xml$/i.test(path)) src = withMavenProperties(src);
     const lines = src.split(/\r?\n/);
 
-    const seen = new Set();
-    for (const { product, re } of PINS) {
-      re.lastIndex = 0;
-      let m;
-      while ((m = re.exec(src)) !== null) {
-        const version = m[1];
-        const key = product + '@' + version;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        stats.pinsFound++;
-
-        const hits = advisoriesFor(product, version, extra);
-        if (!hits.length) continue;
-
-        // A pin written across lines, as Maven writes one, is reported at its version.
-        const needle = m[0].includes('\n') ? m[0].split('\n').pop().trim() : m[0];
-        const line = lines.findIndex((l) => l.includes(needle)) + 1 || 1;
-        const exploited = hits.filter((a) => isKnownExploited(a.id));
-        const ids = hits.map((a) => a.id).sort(byText);
-
-        const kind = COMPILERS.has(product) ? 'compiler' : 'component';
-        if (exploited.length) {
-          findings.push({
-            rule: `build-pins-exploited-${kind}`, path, line,
-            detail: `${path} pins ${product} ${version}, which ${exploited.map((a) => a.id).sort(byText).join(', ')} affects and CISA lists as known to be exploited${fromFeeds(hits)}`,
-            related: hits.map(relatedOf),
-            knownExploited: exploited.map((a) => a.id).sort(byText),
-          });
-        } else {
-          findings.push({
-            rule: `build-pins-vulnerable-${kind}`, path, line,
-            detail: `${path} pins ${product} ${version}, which ${countOf(hits)}: ${ids.join(', ')}${fromFeeds(hits)}` +
-              (age.stale ? `. The KEV snapshot is ${age.days} days old, so whether any of these is now known to be exploited was not checked against a current catalogue` : ''),
-            related: hits.map(relatedOf),
-          });
-        }
+    for (const { product, version, text } of pinsIn(src)) {
+      stats.pinsFound++;
+
+      const hits = advisoriesFor(product, version, extra);
+      if (!hits.length) continue;
+
+      // A pin written across lines, as Maven writes one, is reported at its version.
+      const needle = text.includes('\n') ? text.split('\n').pop().trim() : text;
+      const line = lines.findIndex((l) => l.includes(needle)) + 1 || 1;
+      const exploited = hits.filter((a) => isKnownExploited(a.id));
+      const ids = hits.map((a) => a.id).sort(byText);
+
+      const kind = COMPILERS.has(product) ? 'compiler' : 'component';
+      if (exploited.length) {
+        findings.push({
+          rule: `build-pins-exploited-${kind}`, path, line,
+          detail: `${path} pins ${product} ${version}, which ${exploited.map((a) => a.id).sort(byText).join(', ')} affects and CISA lists as known to be exploited${fromFeeds(hits)}`,
+          related: hits.map(relatedOf),
+          knownExploited: exploited.map((a) => a.id).sort(byText),
+        });
+      } else {
+        findings.push({
+          rule: `build-pins-vulnerable-${kind}`, path, line,
+          detail: `${path} pins ${product} ${version}, which ${countOf(hits)}: ${ids.join(', ')}${fromFeeds(hits)}` +
+            (age.stale ? `. The KEV snapshot is ${age.days} days old, so whether any of these is now known to be exploited was not checked against a current catalogue` : ''),
+          related: hits.map(relatedOf),
+        });
       }
     }
     return src.length;

package/lib/sets/cics.mjs

@@ -4,9 +4,10 @@ import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { dirname, join } from 'node:path';
 import { parseSource } from '../parser.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 import { buildControl, hasFact } from '../control.mjs';
 import { parseCsd } from '../csd.mjs';
+import { execReading } from '../exec-reading.mjs';
 
 
 // `impact` says who can do what once the construct is present, so a reader can tell a defect they
@@ -113,27 +114,6 @@ export function signOnTest(test) {
 }
 
 
-function execOptions(exec) {
-  const opts = new Map();
-  const words = [];
-  const toks = exec.toks;
-  for (let i = 0; i < toks.length; i++) {
-    const t = toks[i];
-    if (t.t !== 'word') continue;
-    words.push(t.u);
-    if (toks[i + 1] && toks[i + 1].t === 'sep' && toks[i + 1].v === '(') {
-      const inner = [];
-      let depth = 1;
-      for (let k = i + 2; k < toks.length && depth > 0; k++) {
-        if (toks[k].t === 'sep') { depth += toks[k].v === '(' ? 1 : -1; if (depth === 0) break; continue; }
-        inner.push(toks[k]);
-      }
-      if (!opts.has(t.u)) opts.set(t.u, inner);
-    }
-  }
-  return { opts, words };
-}
-
 const subtreeRead = (x) => x.directRefs > 0 || x.children.some(subtreeRead);
 
 // Whether EIBCALEN bounds what the program reads: a condition tests it, or a field it was moved or
@@ -164,8 +144,8 @@ function testsLength(p) {
 // Commands whose failure a program ordinarily lets pass: removing a temporary-storage queue that may
 // not exist, a line written to a transient-data log, the clock, a screen sent to a terminal that may
 // have gone, an ASSIGN, and the RETURN that ends the task anyway.
-const QUIET_FAILURES = (words) => (words[0] === 'DELETEQ' && words[1] === 'TS') || (words[0] === 'WRITEQ' && words[1] === 'TD')
-  || ['ASKTIME', 'FORMATTIME', 'SEND', 'ASSIGN', 'RETURN'].includes(words[0]);
+const QUIET_FAILURES = ({ verb, sub }) => (verb === 'DELETEQ' && sub === 'TS') || (verb === 'WRITEQ' && sub === 'TD')
+  || ['ASKTIME', 'FORMATTIME', 'SEND', 'ASSIGN', 'RETURN'].includes(verb);
 const SHOWN_IGNORED = 5;
 
 // Commands whose outcome the program cannot see: NOHANDLE with no RESP and no EIBRESP test before the
@@ -175,15 +155,16 @@ function conditionsIgnored(p, path) {
   const execs = p.execs.filter((e) => e.kind === 'CICS').sort((a, b) => a.line - b.line);
   const hits = [];
   execs.forEach((e, k) => {
-    const { opts: o, words } = execOptions(e);
-    if (words[0] === 'IGNORE' && words[1] === 'CONDITION') {
+    const reading = execReading(e);
+    const { opts: o, words, verb, sub } = reading;
+    if (verb === 'IGNORE' && sub === 'CONDITION') {
       hits.push({ e, what: `IGNORE CONDITION ${words.slice(2).join(' ')}`.trim() });
       return;
     }
-    if (!words.includes('NOHANDLE') || o.has('RESP') || QUIET_FAILURES(words)) return;
+    if (!words.includes('NOHANDLE') || o.has('RESP') || QUIET_FAILURES(reading)) return;
     const until = execs[k + 1] ? execs[k + 1].line : Infinity;
     const tested = p.statements.some((st) => st.line > e.line && st.line < until && (st.sources || []).some((t) => t.t === 'word' && t.u === 'EIBRESP'));
-    if (!tested) hits.push({ e, what: `${words[0]}${words[1] && words[1] !== 'NOHANDLE' && !o.has(words[1]) ? ` ${words[1]}` : ''} NOHANDLE` });
+    if (!tested) hits.push({ e, what: `${verb}${sub && sub !== 'NOHANDLE' && !o.has(sub) ? ` ${sub}` : ''} NOHANDLE` });
   });
   if (!hits.length) return null;
   const shown = hits.slice(0, SHOWN_IGNORED).map((h) => `${h.what} at line ${h.e.line}`).join(', ');
@@ -201,7 +182,7 @@ function conditionsIgnored(p, path) {
 // away from, and this set kept doing it: on a 100,000-program repository it exhausted an 8 GB heap
 // and took a corpus run with it. What survives per program is an identifier, a communication area's
 // size, one boolean, and a short list of transfers.
-export function scanCics(root, opts = {}) {
+export function* scanCicsSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const files = tree.list().filter(isProgram).filter(inScope(opts));
   // Identifier to the size of that program's DFHCOMMAREA, which is all a caller needs of a callee.
@@ -226,8 +207,7 @@ export function scanCics(root, opts = {}) {
     const transfers = [];
     for (const e of p.execs) {
       if (e.kind !== 'CICS') continue;
-      const { opts: o, words: w } = execOptions(e);
-      const verb = w[0];
+      const { opts: o, verb } = execReading(e);
       if (!['LINK', 'XCTL', 'START'].includes(verb)) continue;
       const pgm = (o.get('PROGRAM') || o.get('TRANSID') || [])[0];
       const areaTok = (o.get('COMMAREA') || o.get('FROM') || [])[0];
@@ -275,7 +255,7 @@ export function scanCics(root, opts = {}) {
   // asking the security manager, and one that folds a password's case first. Passwords are recognised
   // by field name, as the sign-on rules above recognise them, and each finding says so.
   function passwordChecks(p, path) {
-    if (p.execs.some((e) => e.kind === 'CICS' && /^(VERIFY|SIGNON)$/.test(execOptions(e).words[0] || ''))) return [];
+    if (p.execs.some((e) => e.kind === 'CICS' && /^(VERIFY|SIGNON)$/.test(execReading(e).verb || ''))) return [];
     const byName = new Map();
     for (const it of p.items) if (!byName.has(it.name)) byName.set(it.name, it);
     const resolve = (tok) => (tok && tok.t === 'word' ? p.resolved.get(tok) || byName.get(tok.u) || null : null);
@@ -286,8 +266,8 @@ export function scanCics(root, opts = {}) {
     // FETCH fills, and everything under any of them. A copy made by MOVE first is not followed.
     const read = new Set();
     for (const e of p.execs) {
-      const { opts: o, words } = execOptions(e);
-      if (e.kind === 'CICS' && /^READ(NEXT|PREV)?$/.test(words[0] || '')) for (const t of o.get('INTO') || []) if (t.t === 'word') read.add(t.u);
+      const { opts: o, verb } = execReading(e);
+      if (e.kind === 'CICS' && /^READ(NEXT|PREV)?$/.test(verb || '')) for (const t of o.get('INTO') || []) if (t.t === 'word') read.add(t.u);
       if (e.kind === 'SQL' && (e.hostVariables || []).length) for (const h of e.hostVariables) if (h.written && h.tok) read.add(h.tok.u);
     }
     const stored = (name) => {
@@ -343,15 +323,15 @@ export function scanCics(root, opts = {}) {
     const sends = [];
     for (const e of p.execs) {
       if (e.kind !== 'CICS') continue;
-      const { opts: o, words: w } = execOptions(e);
-      const opt = w[0] === 'XCTL' || w[0] === 'LINK' ? 'PROGRAM' : (w[0] === 'RETURN' || w[0] === 'START') ? 'TRANSID' : null;
+      const { opts: o, verb } = execReading(e);
+      const opt = verb === 'XCTL' || verb === 'LINK' ? 'PROGRAM' : (verb === 'RETURN' || verb === 'START') ? 'TRANSID' : null;
       const t = opt && (o.get(opt) || [])[0];
       if (!t || t.t !== 'lit') continue;
       const target = `${opt === 'PROGRAM' ? '' : 'transaction '}${String(t.v).trim().toUpperCase()}`;
       if (target === p.id) continue;
       const bits = ctl.facts.get(ctl.nodeOf.get(e));
       if (!bits) continue;
-      sends.push({ e, verb: w[0], target, signedOn: hasFact(bits, bit) });
+      sends.push({ e, verb, target, signedOn: hasFact(bits, bit) });
     }
     const granted = new Set(sends.filter((x) => x.signedOn).map((x) => x.target));
     const aid = p.refs.some((r) => r.tok.u === 'EIBAID');
@@ -364,7 +344,7 @@ export function scanCics(root, opts = {}) {
   // Releasing each tree bounds what one program costs; it does not bound what a hundred thousand of
   // them cost together. The shared loop watches the heap and stops before V8 cannot collect, and
   // names every file it did not reach.
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     if (!/EXEC\s+CICS/i.test(src) && !/(?:^|[\s.])COPY\s+/i.test(src)) return src.length;
@@ -445,3 +425,5 @@ export function scanCics(root, opts = {}) {
 
   return report('cics', { rules: CICS_RULES, findings, stats, run });
 }
+
+export const scanCics = (root, opts = {}) => drive(scanCicsSteps(root, opts));