@portll/cobolwork 0.6.0 → 0.7.0

package/lib/sets/ddl.mjs

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Db2 for z/OS DDL: what a GRANT opens to PUBLIC or lets a grantee pass on, system and database
+// authorities granted, and the exit routines and external load modules that run inside Db2
+// (lib/db2/rules.mjs). A statement in another dialect is refused by the reader and counted as not
+// read, never matched as if it were Db2.
+import { inScope, isDb2, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { readDb2, parseDb2Statement } from '../db2/read.mjs';
+import { DB2_RULES, statementFindings } from '../db2/rules.mjs';
+
+export { DB2_RULES };
+
+export function scanDb2(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter(inScope(opts)).filter(isDb2);
+  const stats = { filesScanned: 0, filesUnreadable: 0, statementsRead: 0 };
+  const findings = [];
+  const unread = {};
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    stats.filesScanned++;
+    const path = relPath(root, f);
+    for (const st of readDb2(src).statements) {
+      const r = parseDb2Statement(st);
+      if (r.status === 'parsed') { stats.statementsRead++; findings.push(...statementFindings(path, st, r)); }
+      else (unread[r.kind] ||= { count: 0, first: `${path}:${st.line}` }).count++;
+    }
+    return src.length;
+  }, { label: 'ddl', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  if (Object.keys(unread).length) { stats.statementsNotRead = unread; stats.coverageIncomplete = true; }
+  return report('ddl', { rules: DB2_RULES, findings, stats, run });
+}

package/lib/sets/flow.mjs

@@ -14,21 +14,25 @@ export const RULES = {
   'cics-terminal-to-os-command': { sev: 'crit', evidence: 'path', cwe: 'CWE-78', text: 'Terminal input reaches an operating-system command routine' },
   'cics-web-to-os-command': { sev: 'crit', evidence: 'path', cwe: 'CWE-78', text: 'Web input reaches an operating-system command routine' },
   'file-record-to-os-command': { sev: 'high', evidence: 'path', cwe: 'CWE-78', text: 'A file record reaches an operating-system command routine' },
+  'cics-queue-to-os-command': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-78', text: 'A CICS queue item reaches an operating-system command routine' },
   'database-to-os-command': { sev: 'high', evidence: 'path', cwe: 'CWE-78', text: 'A database value reaches an operating-system command routine' },
   'argv-or-env-to-dynamic-sql': { sev: 'high', evidence: 'path', cwe: 'CWE-89', text: 'Command-line or environment input reaches dynamic SQL' },
   'cics-terminal-to-dynamic-sql': { sev: 'crit', evidence: 'path', cwe: 'CWE-89', text: 'Terminal input reaches dynamic SQL' },
   'cics-web-to-dynamic-sql': { sev: 'crit', evidence: 'path', cwe: 'CWE-89', text: 'Web input reaches dynamic SQL' },
   'file-record-to-dynamic-sql': { sev: 'high', evidence: 'path', cwe: 'CWE-89', text: 'A file record reaches dynamic SQL' },
+  'cics-queue-to-dynamic-sql': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-89', text: 'A CICS queue item reaches dynamic SQL' },
   'database-to-dynamic-sql': { sev: 'high', evidence: 'path', cwe: 'CWE-89', text: 'A database value reaches dynamic SQL' },
   'argv-or-env-to-cics-dynamic-transfer': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'Command-line or environment input decides which program CICS transfers to' },
   'cics-terminal-to-cics-dynamic-transfer': { sev: 'crit', evidence: 'path', cwe: 'CWE-470', text: 'Terminal input decides which program CICS transfers to' },
   'cics-web-to-cics-dynamic-transfer': { sev: 'crit', evidence: 'path', cwe: 'CWE-470', text: 'Web input decides which program CICS transfers to' },
   'file-record-to-cics-dynamic-transfer': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'A file record decides which program CICS transfers to' },
+  'cics-queue-to-cics-dynamic-transfer': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-470', text: 'A CICS queue item decides which program CICS transfers to' },
   'database-to-cics-dynamic-transfer': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'A database value decides which program CICS transfers to' },
   'argv-or-env-to-dynamic-program-load': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'Command-line or environment input decides which program is called' },
   'cics-terminal-to-dynamic-program-load': { sev: 'crit', evidence: 'path', cwe: 'CWE-470', text: 'Terminal input decides which program is called' },
   'cics-web-to-dynamic-program-load': { sev: 'crit', evidence: 'path', cwe: 'CWE-470', text: 'Web input decides which program is called' },
   'file-record-to-dynamic-program-load': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'A file record decides which program is called' },
+  'cics-queue-to-dynamic-program-load': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-470', text: 'A CICS queue item decides which program is called' },
   'database-to-dynamic-program-load': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'A database value decides which program is called' },
   // A program opening the file its own user named acts with that user's authority, which is every
   // one read in the 500-repository corpus; it escalates only where the estate says the entry that
@@ -37,6 +41,7 @@ export const RULES = {
   'cics-terminal-to-dynamic-file-path': { sev: 'high', evidence: 'path', cwe: 'CWE-73', text: 'Terminal input decides which file is opened' },
   'cics-web-to-dynamic-file-path': { sev: 'high', evidence: 'path', cwe: 'CWE-73', text: 'Web input decides which file is opened' },
   'file-record-to-dynamic-file-path': { sev: 'med', evidence: 'path', cwe: 'CWE-73', text: 'A file record decides which file is opened' },
+  'cics-queue-to-dynamic-file-path': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-73', text: 'A CICS queue item decides which file is opened' },
   'database-to-dynamic-file-path': { sev: 'med', evidence: 'path', cwe: 'CWE-73', text: 'A database value decides which file is opened' },
   // A JCL step is the entry point above the program. PARM is the mainframe's argv, and in-stream
   // data is a payload sitting in the repository: both are edited by anyone who can commit, so they
@@ -60,6 +65,7 @@ export const RULES = {
   'cics-terminal-to-internal-reader': { sev: 'crit', evidence: 'path', cwe: 'CWE-77', text: 'Terminal input is written into a job the internal reader submits' },
   'cics-web-to-internal-reader': { sev: 'crit', evidence: 'path', cwe: 'CWE-77', text: 'Web input is written into a job the internal reader submits' },
   'file-record-to-internal-reader': { sev: 'med', evidence: 'path', cwe: 'CWE-77', text: 'A file record is written into a job the internal reader submits' },
+  'cics-queue-to-internal-reader': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-77', text: 'A CICS queue item is written into a job the internal reader submits' },
   'database-to-internal-reader': { sev: 'med', evidence: 'path', cwe: 'CWE-77', text: 'A database value is written into a job the internal reader submits' },
   'jcl-parm-to-internal-reader': { sev: 'crit', evidence: 'path', cwe: 'CWE-77', text: 'A JCL PARM is written into a job the internal reader submits' },
   'jcl-instream-to-internal-reader': { sev: 'crit', evidence: 'path', cwe: 'CWE-77', text: 'In-stream job data is written into a job the internal reader submits' },
@@ -68,18 +74,22 @@ export const RULES = {
   'cics-web-to-web-response': { sev: 'high', evidence: 'path', cwe: 'CWE-79', text: 'Web input is written into the response this program returns' },
   'cics-terminal-to-web-response': { sev: 'high', evidence: 'path', cwe: 'CWE-79', text: 'Terminal input is written into the response this program returns' },
   'file-record-to-web-response': { sev: 'med', evidence: 'path', cwe: 'CWE-79', text: 'A file record is written into the response this program returns' },
+  'cics-queue-to-web-response': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-79', text: 'A CICS queue item is written into the response this program returns' },
   'database-to-web-response': { sev: 'med', evidence: 'path', cwe: 'CWE-79', text: 'A database value is written into the response this program returns' },
   'cics-web-to-http-header': { sev: 'high', evidence: 'path', cwe: 'CWE-113', text: 'Web input is written into a header of the response' },
   'cics-terminal-to-http-header': { sev: 'high', evidence: 'path', cwe: 'CWE-113', text: 'Terminal input is written into a header of the response' },
   'file-record-to-http-header': { sev: 'med', evidence: 'path', cwe: 'CWE-113', text: 'A file record is written into a header of the response' },
+  'cics-queue-to-http-header': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-113', text: 'A CICS queue item is written into a header of the response' },
   'database-to-http-header': { sev: 'med', evidence: 'path', cwe: 'CWE-113', text: 'A database value is written into a header of the response' },
   'cics-web-to-outbound-host': { sev: 'high', evidence: 'path', cwe: 'CWE-918', text: 'Web input decides the host or path this program sends a request to' },
   'cics-terminal-to-outbound-host': { sev: 'high', evidence: 'path', cwe: 'CWE-918', text: 'Terminal input decides the host or path this program sends a request to' },
   'file-record-to-outbound-host': { sev: 'med', evidence: 'path', cwe: 'CWE-918', text: 'A file record decides the host or path this program sends a request to' },
+  'cics-queue-to-outbound-host': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-918', text: 'A CICS queue item decides the host or path this program sends a request to' },
   'database-to-outbound-host': { sev: 'med', evidence: 'path', cwe: 'CWE-918', text: 'A database value decides the host or path this program sends a request to' },
   'cics-web-to-queue-name': { sev: 'high', evidence: 'path', cwe: 'CWE-99', text: 'Web input names the queue a command reads, writes or deletes' },
   'cics-terminal-to-queue-name': { sev: 'high', evidence: 'path', cwe: 'CWE-99', text: 'Terminal input names the queue a command reads, writes or deletes' },
   'file-record-to-queue-name': { sev: 'med', evidence: 'path', cwe: 'CWE-99', text: 'A file record names the queue a command reads, writes or deletes' },
+  'cics-queue-to-queue-name': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-99', text: 'A CICS queue item names the queue a command reads, writes or deletes' },
   'database-to-queue-name': { sev: 'med', evidence: 'path', cwe: 'CWE-99', text: 'A database value names the queue a command reads, writes or deletes' },
   // Where a statement reads or writes, decided by input from outside. Without SSRANGE, which is not
   // the Enterprise COBOL default, an index out of range reads or writes the storage beside the
@@ -133,10 +143,12 @@ export const RULES = {
   'cics-terminal-to-cics-sysid': { sev: 'med', evidence: 'path', cwe: 'CWE-15', text: 'Terminal input decides which region a CICS command is shipped to' },
   'cics-web-to-cics-sysid': { sev: 'med', evidence: 'path', cwe: 'CWE-15', text: 'Web input decides which region a CICS command is shipped to' },
   'file-record-to-cics-sysid': { sev: 'low', evidence: 'path', cwe: 'CWE-15', text: 'A file record decides which region a CICS command is shipped to' },
+  'cics-queue-to-cics-sysid': { sev: 'low', evidence: 'path', measured: false, cwe: 'CWE-15', text: 'A CICS queue item decides which region a CICS command is shipped to' },
   'database-to-cics-sysid': { sev: 'low', evidence: 'path', cwe: 'CWE-15', text: 'A database value decides which region a CICS command is shipped to' },
   'cics-terminal-to-cics-system-resource': { sev: 'high', evidence: 'path', cwe: 'CWE-15', text: 'Terminal input names the resource an EXEC CICS SET changes' },
   'cics-web-to-cics-system-resource': { sev: 'high', evidence: 'path', cwe: 'CWE-15', text: 'Web input names the resource an EXEC CICS SET changes' },
   'file-record-to-cics-system-resource': { sev: 'med', evidence: 'path', cwe: 'CWE-15', text: 'A file record names the resource an EXEC CICS SET changes' },
+  'cics-queue-to-cics-system-resource': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-15', text: 'A CICS queue item names the resource an EXEC CICS SET changes' },
   'database-to-cics-system-resource': { sev: 'med', evidence: 'path', cwe: 'CWE-15', text: 'A database value names the resource an EXEC CICS SET changes' },
   // A document from outside parsed as XML. Whether a DTD in it is honoured - an external entity
   // fetched, an internal one expanded - is the parser's, chosen by the XMLPARSE compiler option, and
@@ -168,12 +180,16 @@ export const RULES = {
   // way mainframe systems hand data to each other and is listed so the route is visible.
   'database-to-outbound-http': { sev: 'high', evidence: 'path', cwe: 'CWE-201', text: 'A database value is sent to a remote server over HTTP' },
   'file-record-to-outbound-http': { sev: 'high', evidence: 'path', cwe: 'CWE-201', text: 'A file record is sent to a remote server over HTTP' },
+  'cics-queue-to-outbound-http': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-201', text: 'A CICS queue item is sent to a remote server over HTTP' },
   'database-to-socket-send': { sev: 'high', evidence: 'path', cwe: 'CWE-201', text: 'A database value is written to a network socket' },
   'file-record-to-socket-send': { sev: 'high', evidence: 'path', cwe: 'CWE-201', text: 'A file record is written to a network socket' },
+  'cics-queue-to-socket-send': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-201', text: 'A CICS queue item is written to a network socket' },
   'database-to-message-queue': { sev: 'low', evidence: 'path', cwe: 'CWE-201', text: 'A database value is put on a message queue' },
   'database-to-extrapartition-queue': { sev: 'low', evidence: 'path', cwe: 'CWE-201', text: 'A database value is written to a transient-data queue that leaves the region' },
   'file-record-to-extrapartition-queue': { sev: 'low', evidence: 'path', cwe: 'CWE-201', text: 'A file record is written to a transient-data queue that leaves the region' },
+  'cics-queue-to-extrapartition-queue': { sev: 'low', evidence: 'path', measured: false, cwe: 'CWE-201', text: 'A CICS queue item is written to a transient-data queue that leaves the region' },
   'file-record-to-message-queue': { sev: 'low', evidence: 'path', cwe: 'CWE-201', text: 'A file record is put on a message queue' },
+  'cics-queue-to-message-queue': { sev: 'low', evidence: 'path', measured: false, cwe: 'CWE-201', text: 'A CICS queue item is put on a message queue' },
   // The CALL interface itself, from the same bound pairs the paths above cross. No input has to
   // reach these: a callee that declares more than it is passed reaches past it on every call.
   'call-parameter-exceeds-caller-record': { sev: 'high', evidence: 'construct', cwe: 'CWE-805', text: 'A called program declares a parameter longer than the whole record its caller passes' },
@@ -193,6 +209,7 @@ export const WHO = {
   'cics-terminal': 'A terminal user',
   'cics-web': 'A web caller',
   'file-record': 'Whoever can write the file record',
+  'cics-queue': 'Whoever can write the queue, or start the transaction with data',
   'database': 'Whoever can write the database row',
   'jcl-parm': "Whoever can edit the job's PARM",
   'jcl-instream': "Whoever can edit the job's in-stream data",
@@ -219,7 +236,7 @@ const SINK = {
   },
   'dynamic-file-path': {
     clause: 'chooses which dataset the program opens',
-    remedy: 'Map input to a fixed set of DDs or dataset names; do not build the ASSIGN or dynamic-allocation name from input',
+    remedy: 'Map input to a fixed set of DDs, dataset names or CICS file names; do not build the ASSIGN, dynamic-allocation or FILE name from input',
   },
   'internal-reader': {
     clause: "submits an arbitrary job, for a CICS program under the region's authority",

package/lib/sets/hidden.mjs

@@ -4,7 +4,7 @@ import { cobolCard } from '../cards.mjs';
 import { decodeEbcdic, inScope, isJcl, isSource, looksEbcdic, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 
 // Content a compiler ignores and an editor often hides, but an agent reading the source will see:
 // the sequence area, the identification area past column 72, comment lines, and characters that
@@ -154,14 +154,14 @@ const looksBinary = (buf) => {
   return odd / n > 0.05;
 };
 
-export function scanHidden(root, opts = {}) {
+export function* scanHiddenSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const files = tree.list().filter(isSource).filter(inScope(opts));
   const findings = [];
   const stats = { filesScanned: 0, filesUnreadable: 0, filesBinary: 0, filesEbcdic: 0 };
   // This set reads every source file in the tree as raw bytes, which is the widest reading of the
   // nine, so it is the one most worth walking inside the guard.
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let buf;
     try { buf = tree.bytes(f); } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     // An EBCDIC member is decoded before any rule reads it; read as bytes it looks binary, and a
@@ -210,3 +210,5 @@ export function scanHidden(root, opts = {}) {
 
   return report('hidden', { rules: HIDDEN_RULES, findings, stats, run });
 }
+
+export const scanHidden = (root, opts = {}) => drive(scanHiddenSteps(root, opts));

package/lib/sets/hlasm.mjs

@@ -7,18 +7,20 @@
 // It also answers the question the COBOL side cannot: a CALL 'SUBRTN' with no COBOL program of that
 // name may be an assembler module, and a CSECT or ENTRY of that name here is where it is.
 import { basename, extname } from 'node:path';
-import { inScope, isAssembler, isProgram, relPath, HLASM_EXT, COPY_EXT } from '../sources.mjs';
+import { inScope, isAssembler, isJcl, isProgram, relPath, HLASM_EXT, COPY_EXT } from '../sources.mjs';
+import { parseJcl } from '../jcl.mjs';
+import { optableIn, processOptions } from '../hlasm/optable.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
 import { eachWithinMemory } from '../kernel/memory.mjs';
-import { readHlasm, OPERATIONS } from '../hlasm.mjs';
+import { readHlasm, OPERATIONS, isDocument } from '../hlasm.mjs';
 import { readHlasmStatements, parseHlasmStatement, NAMED_MACROS } from '../hlasm/read.mjs';
 import { macroOperands, splitOperands } from '../hlasm/operands.mjs';
 
 export const HLASM_RULES = {
   'hlasm-supervisor-state-change': {
     sev: 'crit', evidence: 'construct', cwe: 'CWE-250',
-    text: 'Assembler source switches to PSW key zero or supervisor state',
+    text: 'Assembler source switches to PSW key zero, another system key, or supervisor state',
     impact: 'The code after the switch runs with the operating system\'s authority: it can read and change any storage, so a flaw in it is a flaw in the system rather than in one job',
     remedy: 'Keep the authorized code to the instructions that need it, return to the caller\'s key and problem state straight after (MODESET KEY=NZERO, MODE=PROB), and APF-authorize the module only where it has to be',
   },
@@ -85,23 +87,77 @@ function cobolCalls(source) {
   return calls;
 }
 
+// The repository's own definitions of macros the reader knows by name (IF, LINK, SAVE, ...): a
+// member so named whose first statement is MACRO. Only those names are read, so the cost is a few
+// files at most.
+function repositoryMacros(tree, files) {
+  const found = new Set();
+  for (const f of files) {
+    const name = basename(f, extname(f)).toUpperCase();
+    if (!NAMED_MACROS.has(name) || found.has(name)) continue;
+    let text;
+    try { text = tree.text(f).text; } catch { continue; }
+    const first = readHlasmStatements(text).statements.find((s) => s.kind === 'statement');
+    if (first?.operation === 'MACRO') found.add(name);
+  }
+  return found;
+}
+
+// The OPTABLE the estate's assembly steps give in PARM (ASMA90, the old IEV90, or a procedure such as
+// ASMACL), with where each was written. One level is the estate's; several leave each file to its own.
+function jclOptables(root, tree, files) {
+  const levels = new Map();
+  for (const f of files) {
+    let job;
+    try { job = parseJcl(tree.text(f).text, f); } catch { continue; }
+    for (const step of job.steps) {
+      if (!/^(?:ASMA90|IEV90)$/i.test(step.pgm || '') && !/^(?:ASMA|HLASM|IEV)/i.test(step.proc || '')) continue;
+      for (const [k, v] of step.keywords) {
+        const found = /^PARM(?:\.|$)/.test(k) ? optableIn(v) : null;
+        if (found && !levels.has(found.level)) levels.set(found.level, `${relPath(root, f)}:${step.line}`);
+      }
+    }
+  }
+  return levels;
+}
+
 export function scanHlasm(root, opts = {}) {
   const tree = treeFor(root, opts);
   const all = tree.list().filter(inScope(opts));
   const findings = [];
   const stats = { filesScanned: 0, filesUnreadable: 0, assemblerFiles: 0, bmsFiles: 0, imsFiles: 0, unrecognisedFiles: 0, readNotAssembled: true };
   const members = new Set(all.filter((f) => [...HLASM_EXT, ...COPY_EXT].some((e) => f.toLowerCase().endsWith(e))).map((f) => basename(f, extname(f)).toUpperCase()));
+  const libraryMacros = repositoryMacros(tree, all.filter(isAssembler));
+  const forms = { mvs38: opts.mvs38Forms !== false };
+  const fromJcl = opts.hlasmOptable ? new Map() : jclOptables(root, tree, all.filter(isJcl));
+  const estateOptable = opts.hlasmOptable ?? (fromJcl.size === 1 ? [...fromJcl.keys()][0] : null);
+  if (opts.hlasmOptable) stats.hlasmOptable = { level: opts.hlasmOptable, from: 'option' };
+  else if (fromJcl.size === 1) stats.hlasmOptable = { level: estateOptable, from: [...fromJcl.values()][0] };
+  else if (fromJcl.size > 1) stats.hlasmOptableConflict = Object.fromEntries(fromJcl);
+  // The table a file is assembled with: the option given to the scan, then a *PROCESS OVERRIDE in
+  // the file, the estate's PARM, and the file's own *PROCESS, as HLASM ranks them.
+  const optableOf = (src) => {
+    if (opts.hlasmOptable) return opts.hlasmOptable;
+    const own = optableIn(processOptions(src));
+    return own?.override ? own.level : estateOptable ?? own?.level ?? null;
+  };
   const refused = {};
   const macroCalls = new Map();
   const copyNotFound = new Set();
-  // Counts, for the coverage it reports, what the statement reader refused and which macros and COPY
-  // members a file uses.
+  // Reads a file's statements: its labels, what the reader refused, and the macros and COPY members it
+  // uses, which count toward the coverage report unless the file is a document.
   function readStatements(src, path) {
     const labels = new Map();
-    for (const st of readHlasmStatements(src).statements) {
-      if (st.inMacro) continue;
+    const read = readHlasmStatements(src, { libraryMacros }).statements;
+    const statements = read.filter((st) => !st.inMacro);
+    const fileForms = { ...forms, optable: optableOf(src) };
+    const results = statements.map((st) => parseHlasmStatement(st, fileForms));
+    const refusals = results.filter((res) => res.status === 'unparsed' || res.status === 'unknown').length;
+    if (isDocument(read.filter((st) => st.kind === 'statement'), statements.length, refusals)) return null;
+    statements.forEach((st, i) => {
+      const res = results[i];
       if (st.kind === 'statement' && st.name && !st.name.startsWith('&') && !st.name.startsWith('.')) labels.set(st.name.toUpperCase(), st);
-      const res = parseHlasmStatement(st);
+      if (res.node?.mvs38) stats.mvs38Forms = (stats.mvs38Forms || 0) + 1;
       if (res.status === 'unparsed' || res.status === 'unknown') (refused[res.kind] ||= { count: 0, first: `${path}:${st.line}` }).count++;
       const name = res.kind === 'MACRO CALL' ? st.operation : NAMED_MACROS.has(res.kind) ? res.kind : null;
       if (name) {
@@ -113,7 +169,7 @@ export function scanHlasm(root, opts = {}) {
         const member = String(res.status === 'parsed' ? res.node.member : (/^\s*([A-Z$#@][A-Z0-9$#@_]*)/i.exec(st.field || '') || [])[1] || '').toUpperCase();
         if (member && !members.has(member)) copyNotFound.add(member);
       }
-    }
+    });
     return labels;
   }
   const defines = new Map();
@@ -122,14 +178,16 @@ export function scanHlasm(root, opts = {}) {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     stats.filesScanned++;
-    const r = readHlasm(src);
+    const r = readHlasm(src, forms);
     if (r.kind === 'bms') { stats.bmsFiles++; return src.length; }
     if (r.kind === 'ims') { stats.imsFiles++; return src.length; }
     if (r.kind === 'unrecognised') { stats.unrecognisedFiles++; return src.length; }
-    stats.assemblerFiles++;
+    if (r.kind === 'listing') { stats.listingFiles = (stats.listingFiles || 0) + 1; return src.length; }
     const path = relPath(root, f);
-    for (const d of r.defines) if (!defines.has(d.name)) defines.set(d.name, { ...d, path });
     const labels = readStatements(src, path);
+    if (!labels) { stats.documentFiles = (stats.documentFiles || 0) + 1; return src.length; }
+    stats.assemblerFiles++;
+    for (const d of r.defines) if (!defines.has(d.name)) defines.set(d.name, { ...d, path });
     for (const use of r.operations) {
       if (use.class === 'module-load') {
         const { keywords } = macroOperands(use.field || '');
@@ -139,6 +197,8 @@ export function scanHlasm(root, opts = {}) {
       }
       if (use.name === 'MODESET') {
         if (use.stateChange) findings.push({ rule: 'hlasm-supervisor-state-change', path, line: use.line, detail: `MODESET ${use.stateChange} switches to ${STATE[use.stateChange.split('=')[0]]}.${where(use)}` });
+        // A system key writes storage problem-state keys cannot, short of key zero's reach.
+        else if (use.systemKey) findings.push({ rule: 'hlasm-supervisor-state-change', sev: 'high', path, line: use.line, detail: `MODESET ${use.systemKey.written} switches to PSW key ${use.systemKey.key}, a system key.${where(use)}` });
         continue;
       }
       const rule = RULE_OF_CLASS[use.class];

package/lib/sets/ims.mjs

@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// IMS database and program definitions: what a PSB lets a program change, SENSEGs that name segments
+// their DBD does not define, and what DBDGEN, PSBGEN or ACBGEN refuses (lib/ims/rules.mjs). DBDs and
+// PSBs are assembler macros and are often named .asm, so assembler files are read too, and kept only
+// where they hold a DBD or PSB.
+import { inScope, isAssembler, isIms, isJcl, isProgram, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { modelOf } from '../ims/model.mjs';
+import { IMS_RULES, checkModels, checkProcoptAgainstCalls } from '../ims/rules.mjs';
+import { DLI_ROUTINE, DLI_FUNCTIONS, DLI_SERVICES, psbOfParm } from '../ims/dli.mjs';
+import { parseJcl } from '../jcl.mjs';
+import { constantsReaching } from '../constants.mjs';
+import { execReading } from '../exec-reading.mjs';
+
+export { IMS_RULES };
+
+export function scanIms(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter(inScope(opts)).filter((f) => isIms(f) || isAssembler(f));
+  const stats = { filesScanned: 0, filesUnreadable: 0, dbdFiles: 0, psbFiles: 0 };
+  const models = [];
+  const unread = {};
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    const model = modelOf(src);
+    if (!model) return src.length;
+    stats.filesScanned++;
+    stats[model.kind === 'DBD' ? 'dbdFiles' : 'psbFiles']++;
+    const path = relPath(root, f);
+    for (const u of model.unread) (unread[u.operation || 'UNREADABLE'] ||= { count: 0, first: `${path}:${u.line}` }).count++;
+    models.push({ path, model });
+    return src.length;
+  }, { label: 'ims', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  // A statement the reader refused may hold a segment, a field or a PCB the rules never saw.
+  if (Object.keys(unread).length) { stats.statementsNotRead = unread; stats.coverageIncomplete = true; }
+
+  // Programs are read only when a PSB could be named for one, and only those that issue DL/I.
+  const programs = [];
+  const links = [];
+  let calls = null;
+  if (models.some(({ model }) => model.kind === 'PSB')) {
+    const sources = tree.list().filter(inScope(opts)).filter((f) => isProgram(f) || isJcl(f));
+    calls = eachWithinMemory(sources, (f) => {
+      let src;
+      try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+      const path = relPath(root, f);
+      if (isJcl(f)) {
+        if (!/DFSRRC00/i.test(src)) return src.length;
+        let jcl;
+        try { jcl = parseJcl(src); } catch { return src.length; }
+        for (const step of jcl.steps || []) {
+          const l = String(step.pgm || '').toUpperCase() === 'DFSRRC00' ? psbOfParm(step.parm) : null;
+          if (l) links.push({ ...l, at: `${path}:${step.line}` });
+        }
+        return src.length;
+      }
+      if (!/CBLTDLI|AIBTDLI|EXEC\s+DLI/i.test(src)) return src.length;
+      let r;
+      try { r = tree.parse(f, src); } catch (e) { noteUnparsed(stats, tree, f, e); return src.length; }
+      for (const prog of r.programs) {
+        const read = dliCallsOf(prog);
+        const id = String(prog.id).toUpperCase();
+        programs.push({ id, path, line: prog.line || 1, functions: read.functions });
+        for (const psb of read.schedules) links.push({ program: id, psb, at: `${path}, its own scheduling call` });
+      }
+      return src.length;
+    }, { label: 'ims programs', maxBytes: opts.maxSourceBytes ?? Infinity });
+    stats.programsWithDli = programs.length;
+  }
+  const findings = [...checkModels(models), ...checkProcoptAgainstCalls(models, programs, links)];
+  return report('ims', { rules: IMS_RULES, findings, stats, run: calls ? bothRuns(run, calls) : run });
+}
+
+// The DL/I database functions a program issues itself, null when they cannot all be told: a function
+// code no constant decides, a CALL that passes on a PCB or a LINKAGE item, which may hold one, or a
+// CICS LINK or XCTL from a program that schedules a PSB, whose target can issue DL/I against it. And
+// the PSBs it schedules itself, by EXEC DLI SCHD or a PCB call, where a constant names one.
+function dliCallsOf(prog) {
+  let functions = new Set();
+  const schedules = new Set();
+  const ignore = { ignoreCall: (x) => DLI_ROUTINE.test(String(x.name)) };
+  const valuesOf = (a) => {
+    if (!a) return { values: [], open: true };
+    if (a.lit != null) return { values: [String(a.lit)], open: false };
+    return a.word ? constantsReaching(prog, a.word, ignore) : { values: [], open: true };
+  };
+  const named = (k) => (k.open ? null : k.values.map((v) => String(v).trim().toUpperCase()));
+  const known = (v) => Object.hasOwn(DLI_FUNCTIONS, v) || DLI_SERVICES.has(v);
+  const byName = new Map((prog.items || []).map((it) => [it.name, it]));
+  const topOf = (it) => { while (it && it.parent) it = it.parent; return it; };
+  // The function code is the first of the two arguments whose constants name one; the PCB or AIB follows it.
+  const functionAt = (using) => [0, 1].find((i) => valuesOf(using[i]).values.some((v) => known(String(v).trim().toUpperCase())));
+  const pcbs = new Set();
+  for (const c of prog.calls || []) {
+    if (c.kind !== 'L' || !DLI_ROUTINE.test(String(c.name))) continue;
+    const at = functionAt(c.using || []);
+    const pcb = at === undefined ? null : (c.using || [])[at + 1];
+    if (pcb && pcb.word) pcbs.add(pcb.word);
+  }
+  const passesOn = (a) => a.word && (pcbs.has(a.word) || (topOf(byName.get(a.word)) || {}).section === 'LINKAGE');
+  for (const c of prog.calls || []) {
+    if (c.kind !== 'L') { functions = null; continue; }
+    if (!DLI_ROUTINE.test(String(c.name))) {
+      if ((c.using || []).some(passesOn)) functions = null;
+      continue;
+    }
+    const using = c.using || [];
+    const at = functionAt(using);
+    const codes = at === undefined ? null : named(valuesOf(using[at]));
+    if (!codes || !codes.every(known)) { functions = null; continue; }
+    if (codes.includes('PCB')) for (const n of named(valuesOf(using[at + 1])) || []) schedules.add(n);
+    if (functions) for (const fn of codes) if (Object.hasOwn(DLI_FUNCTIONS, fn)) functions.add(fn);
+  }
+  for (const e of prog.execs || []) {
+    if (e.kind !== 'DLI') continue;
+    const { verb, opts } = execReading(e);
+    if (verb === 'SCHD') {
+      const tok = (opts.get('PSB') || []).find((t) => t.t === 'word' || t.t === 'lit');
+      const k = !tok ? { values: [], open: true } : tok.t === 'lit' ? { values: [tok.v], open: false } : constantsReaching(prog, tok.v, ignore);
+      for (const n of named(k) || []) schedules.add(n);
+    } else if (functions && Object.hasOwn(DLI_FUNCTIONS, verb)) functions.add(verb);
+  }
+  const transfers = (prog.execs || []).some((e) => e.kind === 'CICS' && ['LINK', 'XCTL'].includes(execReading(e).verb));
+  if (schedules.size && transfers) functions = null;
+  return { functions: functions && functions.size ? functions : null, schedules: [...schedules] };
+}
+
+function bothRuns(a, b) {
+  return {
+    skipped: [...a.skipped, ...b.skipped],
+    stoppedBy: a.stoppedBy || b.stoppedBy,
+    peakHeapBytes: Math.max(a.peakHeapBytes || 0, b.peakHeapBytes || 0) || undefined,
+    note: [a.note, b.note].filter(Boolean).join(' ') || undefined,
+  };
+}

package/lib/sets/log.mjs

@@ -24,6 +24,7 @@ import { compileStepOptions } from '../options.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { drive, loopOver } from '../kernel/shared-pass.mjs';
+import { execReading } from '../exec-reading.mjs';
 
 
 export const LOG_RULES = {
@@ -107,17 +108,16 @@ function logSinks(p, where, path) {
   }
   for (const e of p.execs || []) {
     if (e.kind !== 'CICS') continue;
-    const w = e.toks.filter((t) => t.t === 'word').map((t) => t.u);
-    const isTd = w[0] === 'WRITEQ' && w[1] === 'TD';
-    const isJournal = w[0] === 'WRITE' && w.includes('JOURNALNAME');
+    const { verb, sub, words, opts } = execReading(e);
+    const isTd = verb === 'WRITEQ' && sub === 'TD';
+    const isJournal = verb === 'WRITE' && words.includes('JOURNALNAME');
     // The console, read by whoever is watching the region. A credential on it is as exposed as one
     // in SYSOUT, and it outlives the screen in the system log.
-    const isOperator = w[0] === 'WRITE' && w[1] === 'OPERATOR';
+    const isOperator = verb === 'WRITE' && sub === 'OPERATOR';
     if (!isTd && !isJournal && !isOperator) continue;
     // FROM names the area written, TEXT names the console message; that name is what this reads.
     const opt = isOperator ? 'TEXT' : 'FROM';
-    const i = e.toks.findIndex((t) => t.t === 'word' && t.u === opt);
-    const arg = i >= 0 ? e.toks.slice(i + 1).find((t) => t.t === 'word') : null;
+    const arg = (opts.get(opt) || []).find((t) => t.t === 'word') || null;
     const kind = isTd ? 'WRITEQ TD' : isOperator ? 'WRITE OPERATOR' : 'WRITE JOURNALNAME';
     if (arg) out.push({ kind, name: arg.u, ...where(e, path) });
   }

package/lib/sets/opaque.mjs

@@ -74,21 +74,41 @@ export function scanOpaque(root, opts = {}) {
     const path = relPath(root, f);
 
     // Which names were declared as pointers, so a CALL through one can be told from an ordinary
-    // CALL of a variable - which the flow rules already report as a dynamic program load.
-    const pointers = new Set();
-    for (const m of text.matchAll(/\b(?:\d\d\s+)?([A-Z0-9-]+)\b[^.\n]{0,80}\bUSAGE\s+(?:IS\s+)?(?:PROCEDURE-POINTER|POINTER)\b/gi)) {
-      pointers.add(m[1].toUpperCase());
-    }
+    // CALL of a variable - which the flow rules already report as a dynamic program load. Found
+    // only once a CALL needs it, since the search tries every word of the program.
+    let pointers = null;
+    const pointerNames = () => {
+      if (pointers) return pointers;
+      pointers = new Set();
+      for (const m of text.matchAll(/\b(?:\d\d\s+)?([A-Z0-9-]+)\b[^.\n]{0,80}\bUSAGE\s+(?:IS\s+)?(?:PROCEDURE-POINTER|POINTER)\b/gi)) {
+        pointers.add(m[1].toUpperCase());
+      }
+      return pointers;
+    };
+
+    // How many newlines of the joined text come before an offset, which is the normalised entry
+    // holding it.
+    const starts = [0];
+    for (let i = text.indexOf('\n'); i >= 0; i = text.indexOf('\n', i + 1)) starts.push(i + 1);
+    const entryAt = (offset) => {
+      let lo = 0;
+      let hi = starts.length - 1;
+      while (lo < hi) {
+        const mid = (lo + hi + 1) >> 1;
+        if (starts[mid] <= offset) lo = mid; else hi = mid - 1;
+      }
+      return lo;
+    };
 
     let hit = false;
     for (const p of PATTERNS) {
       p.re.lastIndex = 0;
       let m;
       while ((m = p.re.exec(text)) !== null) {
-        if (p.needsPointerOperand && !pointers.has(String(m[1]).toUpperCase())) continue;
+        if (p.needsPointerOperand && !pointerNames().has(String(m[1]).toUpperCase())) continue;
         // The line number is the normalised entry's own, so a construct that came from a copybook
         // is reported where the compiler would see it.
-        const before = text.slice(0, m.index).split('\n').length - 1;
+        const before = entryAt(m.index);
         const line = norm.entries[before] ? norm.entries[before].line : 1;
         findings.push({ rule: p.rule, path, line, detail: p.detail(m) });
         hit = true;

package/lib/sets/pli.mjs

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// PL/I programs read statement by statement (lib/pli): where they address storage through a pointer,
+// call through an entry variable or use the preprocessor, which a static reading cannot follow, and
+// ON units that swallow their condition. Data flow through PL/I is the flow set's; this set reports
+// what the program text itself shows, and counts every statement the reader could not parse.
+import { inScope, isPli, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { readPli } from '../pli/lex.mjs';
+import { parseStatement } from '../pli/statements.mjs';
+import { PLI_RULES, checkProgram } from '../pli/rules/index.mjs';
+
+export { PLI_RULES };
+
+export function scanPli(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter(inScope(opts)).filter(isPli);
+  const stats = { filesScanned: 0, filesUnreadable: 0, statements: 0, statementsParsed: 0 };
+  const notParsed = {};
+  const findings = [];
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    const path = relPath(root, f);
+    const statements = readPli(src, { file: path }).statements.map((st) => ({ ...st, parsed: parseStatement(st) }));
+    stats.filesScanned++;
+    for (const st of statements) {
+      stats.statements++;
+      if (st.parsed.status === 'parsed') { stats.statementsParsed++; continue; }
+      (notParsed[st.parsed.kind || 'UNKNOWN'] ||= { count: 0, first: `${path}:${st.line}` }).count++;
+    }
+    findings.push(...checkProgram({ path, statements }));
+    return src.length;
+  }, { label: 'pli', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  // A statement the reader could not parse may hold a pointer, an entry call or an ON unit.
+  if (Object.keys(notParsed).length) { stats.statementsNotParsed = notParsed; stats.coverageIncomplete = true; }
+  return report('pli', { rules: PLI_RULES, findings, stats, run });
+}

package/lib/sets/recon.mjs

@@ -14,7 +14,7 @@
 import { inScope, isJcl, isProgram, isCopybook, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 import { loadSite, classifyPath, productionQualifierOf, SITE_FILE } from '../site.mjs';
 import { parseJcl, dispositionOf } from '../jcl.mjs';
 import { statementCard } from '../cards.mjs';
@@ -161,7 +161,7 @@ function productionTouches(job, qualifiers) {
   return { found, claimed };
 }
 
-export function scanRecon(root, opts = {}) {
+export function* scanReconSteps(root, opts = {}) {
   const site = loadSite(root, opts.site || null, opts.tree);
   const tree = treeFor(root, opts);
   const files = tree.list().filter(inScope(opts))
@@ -192,7 +192,7 @@ export function scanRecon(root, opts = {}) {
 
   // This set reads every program, copybook and job in the tree, which is the widest reading any
   // set does, so it is walked inside the guard like the rest.
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     stats.filesScanned++;
@@ -267,3 +267,5 @@ export function scanRecon(root, opts = {}) {
   // production means, as against files going unread. Both travel, and they are not merged.
   return report('recon', { rules: RECON_RULES, findings, stats, run });
 }
+
+export const scanRecon = (root, opts = {}) => drive(scanReconSteps(root, opts));