@topy-ai/maggie 0.7.55 → 0.7.57

package/bundled-tools/clis/maggie_security_inventory.py

@@ -0,0 +1,1023 @@
+#!/usr/bin/env python3
+"""Stack inventory for ``maggie security inventory`` (PRD 01 section 6.1).
+
+Builds ``maggie-security-stack.v1`` from what is on disk and, optionally,
+from read-only host evidence. Covers the popular stacks:
+
+- JavaScript: package-lock.json (v1-v3), npm-shrinkwrap.json, pnpm-lock.yaml,
+  yarn.lock (v1 and berry), bun.lock
+- PHP: composer.lock
+- Python: requirements*.txt (pinned), Pipfile.lock, poetry.lock, uv.lock, pdm.lock
+- Java/Kotlin: pom.xml (with properties), gradle.lockfile, gradle/verification-metadata.xml
+- Go: go.mod (+ go directive), Ruby: Gemfile.lock (+ RUBY VERSION), Rust: Cargo.lock,
+  .NET: packages.lock.json, *.csproj PackageReference, global.json
+- WordPress core/plugins/themes from files
+- Containers: Dockerfile FROM, docker-compose/compose image lines -> images and
+  the runtime/database/server they carry (python, node, php, java, mysql,
+  postgres, redis, mongo, nginx, httpd, tomcat, ...)
+- Declared runtimes: .nvmrc, .node-version, .python-version, runtime.txt,
+  .ruby-version, .tool-versions, .java-version, package.json engines
+- Hosts: OS release, OS packages (dpkg / rpm / apk), and service versions
+  (nginx, apache, php, node, python, java, go, mysql/mariadb, postgresql,
+  redis, mongodb, memcached, docker, openssl) from the read-only collector
+  printed by ``--print-collector`` (the runtime-inventory collector plus
+  version probes), or from ``maggie deployment runtime-inventory`` JSON.
+
+Parsers are stdlib-only and tolerant: an unreadable file becomes a degraded
+source, never a crash. Lockfile test data under fixtures/security/lockfiles
+comes from google/osv-scanner testdata (Apache-2.0).
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import xml.etree.ElementTree as ET
+from pathlib import Path
+
+import maggie_security_core as core
+import maggie_security_versions as versions
+from maggie_host_runtime import COLLECTOR as RUNTIME_COLLECTOR, parse_os, parse_sections
+
+SKIP_DIRS = {"node_modules", ".git", "vendor", ".venv", "venv", "__pycache__", "dist", "build", ".next", ".astro", ".output",
+             "target", ".gradle", ".maggie", ".wrangler", "wp-admin", "wp-includes", "bower_components", ".cache"}
+MAX_DEPTH = 4
+
+# Default CVE product allowlist per site type (PRD 01 section 6.1); runtimes
+# and images found are added automatically.
+WATCH_DEFAULTS = {
+    "node-app": ["node", "nginx", "openssl"], "astro": ["node", "astro"], "workers": [],
+    "wordpress": ["wordpress", "php", "nginx", "apache", "mysql", "mariadb", "openssl"],
+    "php-app": ["php", "nginx", "apache", "mysql", "mariadb", "openssl"], "static": ["nginx"], "unknown": [],
+    "python-app": ["python", "nginx", "postgresql", "redis", "openssl"], "java-app": ["java", "tomcat", "nginx", "postgresql", "mysql"],
+    "go-app": ["go", "nginx", "postgresql"], "ruby-app": ["ruby", "nginx", "postgresql", "redis"], "dotnet-app": ["dotnet", "mssqlserver", "nginx"],
+}
+
+# Image repository -> runtime/service name (endoflife.date product mapping lives in the intel module).
+IMAGE_RUNTIMES = {
+    "node": "node", "python": "python", "php": "php", "wordpress": "wordpress", "ruby": "ruby", "golang": "go",
+    "openjdk": "java", "eclipse-temurin": "java", "amazoncorretto": "java", "ibm-semeru-runtimes": "java", "maven": "java",
+    "tomcat": "tomcat", "mysql": "mysql", "mariadb": "mariadb", "postgres": "postgresql", "postgresql": "postgresql",
+    "redis": "redis", "valkey": "valkey", "mongo": "mongodb", "mongodb": "mongodb", "memcached": "memcached",
+    "nginx": "nginx", "httpd": "apache", "caddy": "caddy", "haproxy": "haproxy", "traefik": "traefik",
+    "elasticsearch": "elasticsearch", "opensearch": "opensearch", "rabbitmq": "rabbitmq", "mcr.microsoft.com/dotnet/aspnet": "dotnet",
+    "mcr.microsoft.com/dotnet/runtime": "dotnet", "mcr.microsoft.com/dotnet/sdk": "dotnet", "mcr.microsoft.com/mssql/server": "mssqlserver",
+    "ubuntu": "ubuntu", "debian": "debian", "alpine": "alpine", "rockylinux": "rocky-linux", "almalinux": "almalinux",
+    "amazonlinux": "amazon-linux", "centos": "centos", "fedora": "fedora", "bun": "bun", "denoland/deno": "deno",
+    "rust": "rust", "kong": "kong", "keycloak": "keycloak", "grafana/grafana": "grafana", "sonarqube": "sonarqube",
+}
+
+# Read-only collector: the runtime-inventory sections plus version probes and
+# OS package lists. Every probe is a version query or a read of a package
+# database; nothing is written on the host.
+SECURITY_COLLECTOR = RUNTIME_COLLECTOR + r"""
+s nginx-v; nginx -v 2>&1 | head -1
+s apache-v; (apache2 -v 2>/dev/null || httpd -v 2>/dev/null) | head -1
+s node-v; node --version 2>/dev/null
+s python-v; (python3 --version 2>&1 || python --version 2>&1) | head -1
+s java-v; java -version 2>&1 | head -1
+s go-v; go version 2>/dev/null
+s ruby-v; ruby --version 2>/dev/null
+s dotnet-v; dotnet --list-runtimes 2>/dev/null | head -5
+s mysql-v; (mysqld --version 2>/dev/null || mysql --version 2>/dev/null || mariadbd --version 2>/dev/null) | head -1
+s postgres-v; (postgres --version 2>/dev/null || psql --version 2>/dev/null || ls /usr/lib/postgresql 2>/dev/null) | head -3
+s redis-v; redis-server --version 2>/dev/null
+s mongodb-v; mongod --version 2>/dev/null | head -1
+s memcached-v; memcached -V 2>/dev/null
+s openssl-v; openssl version 2>/dev/null
+s docker-v; docker --version 2>/dev/null
+s tomcat-v; ls -d /opt/tomcat* /usr/share/tomcat* 2>/dev/null | head -3
+s dpkg; dpkg-query -W -f='${Package}\t${Version}\t${Status}\n' 2>/dev/null
+s rpm; rpm -qa --qf '%{NAME}\t%{EPOCHNUM}:%{VERSION}-%{RELEASE}\n' 2>/dev/null
+s apk; apk info -v 2>/dev/null
+s kernel; uname -r
+"""
+
+SERVICE_PROBES = {
+    "nginx-v": ("nginx", r"nginx/(\d+\.\d+\.\d+)"),
+    "apache-v": ("apache", r"Apache/(\d+\.\d+\.\d+)"),
+    "node-v": ("node", r"v?(\d+\.\d+\.\d+)"),
+    "python-v": ("python", r"Python (\d+\.\d+\.\d+)"),
+    "java-v": ("java", r"version \"(\d+(?:\.\d+)*)"),
+    "go-v": ("go", r"go(\d+\.\d+(?:\.\d+)?)"),
+    "ruby-v": ("ruby", r"ruby (\d+\.\d+\.\d+)"),
+    "dotnet-v": ("dotnet", r"Microsoft\.\w+\.App (\d+\.\d+\.\d+)"),
+    "mysql-v": (None, r"(?:Ver |Distrib )(\d+\.\d+\.\d+)(?:-(MariaDB))?"),
+    "postgres-v": ("postgresql", r"(?:PostgreSQL\)? |^)(\d+(?:\.\d+)?)"),
+    "redis-v": ("redis", r"v=(\d+\.\d+\.\d+)"),
+    "mongodb-v": ("mongodb", r"v(\d+\.\d+\.\d+)"),
+    "memcached-v": ("memcached", r"memcached (\d+\.\d+\.\d+)"),
+    "openssl-v": ("openssl", r"OpenSSL (\d+\.\d+\.\d+[a-z]?)"),
+    "docker-v": ("docker-engine", r"version (\d+\.\d+\.\d+)"),
+    "php-v": ("php", r"PHP (\d+\.\d+\.\d+)"),
+}
+
+# Products whose endoflife.date release cycle is the major version only.
+MAJOR_CYCLES = {"node", "java", "debian", "rocky-linux", "almalinux", "rhel", "centos", "fedora", "docker-engine", "amazon-linux",
+                "elasticsearch", "opensearch", "deno", "bun"}
+
+OS_ECOSYSTEM = {"debian": "Debian", "ubuntu": "Ubuntu", "alpine": "Alpine", "rhel": "Red Hat", "rocky": "Rocky Linux",
+                "almalinux": "AlmaLinux", "opensuse-leap": "openSUSE", "sles": "SUSE", "amzn": "Amazon Linux"}
+
+
+class Inventory:
+    def __init__(self, project: Path, site: str, site_type: str) -> None:
+        self.project = project
+        self.site = site
+        self.site_type = site_type
+        self.sources: list[dict] = []
+        self.components: list[dict] = []
+        self.runtimes: list[dict] = []
+        self.images: list[dict] = []
+        self.hosts: list[dict] = []
+        self.wordpress: dict | None = None
+        self.problems: list[str] = []
+
+    # ------------------------------------------------------------------ helpers
+
+    def rel(self, path: Path) -> str:
+        try:
+            return str(path.resolve().relative_to(self.project.resolve()))
+        except ValueError:
+            return path.name
+
+    def add(self, ecosystem: str, name: str, version: str, path: Path, scope: str = "runtime", direct: bool | None = None) -> None:
+        version = (version or "").strip()
+        name = (name or "").strip()
+        if not name or not version or version.startswith(("file:", "link:", "workspace:", "git", "http", "github:", "portal:")):
+            return
+        if ecosystem == "npm" and version.startswith("npm:"):
+            alias = version[4:]
+            name, _, version = alias.rpartition("@")
+        self.components.append({"purl": core.make_purl(ecosystem, name, version), "ecosystem": ecosystem, "name": name,
+                                "version": version, "scope": scope, "direct": direct, "location": self.rel(path)})
+
+    def add_runtime(self, name: str, version: str, source: str, host: str | None = None, **extra: str) -> None:
+        version = (version or "").strip().lstrip("v")
+        if not name or not version or not re.match(r"\d", version):
+            return
+        cycle = versions.cycle_of(version, 1 if name in MAJOR_CYCLES or (name == "postgresql" and not version.startswith("9.")) else 2)
+        entry = {"name": name, "version": version, "cycle": cycle, "host": host, "source": source}
+        entry.update({k: v for k, v in extra.items() if v})
+        key = (name, version, host)
+        if not any((r["name"], r["version"], r.get("host")) == key for r in self.runtimes):
+            self.runtimes.append(entry)
+
+    def source(self, kind: str, path: Path | str) -> None:
+        rel = self.rel(path) if isinstance(path, Path) else path
+        if not any(s["path"] == rel and s["kind"] == kind for s in self.sources):
+            self.sources.append({"kind": kind, "path": rel})
+
+    def read(self, path: Path) -> str | None:
+        try:
+            return path.read_text(encoding="utf-8", errors="replace")
+        except OSError as error:
+            self.problems.append(f"{self.rel(path)}: {error}")
+            return None
+
+    # ------------------------------------------------------------------ discovery
+
+    def discover(self) -> list[Path]:
+        out: list[Path] = []
+
+        def walk(directory: Path, depth: int) -> None:
+            try:
+                entries = sorted(directory.iterdir())
+            except OSError:
+                return
+            for entry in entries:
+                if entry.is_dir():
+                    if entry.name in SKIP_DIRS or (entry.name.startswith(".") and entry.name not in (".github",)) or depth >= MAX_DEPTH:
+                        continue
+                    walk(entry, depth + 1)
+                elif entry.is_file():
+                    out.append(entry)
+
+        walk(self.project, 0)
+        return out
+
+    def scan_project(self) -> None:
+        files = self.discover()
+        names = {}
+        for path in files:
+            names.setdefault(path.name, []).append(path)
+        handled_npm_dirs: set[Path] = set()
+        for name in ("package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"):
+            for path in names.get(name, []):
+                if path.parent in handled_npm_dirs:
+                    continue
+                handled_npm_dirs.add(path.parent)
+                self.safe(getattr(self, "parse_" + name.replace("-", "_").replace(".", "_")), path)
+        dispatch = {
+            "composer.lock": self.parse_composer_lock, "Pipfile.lock": self.parse_pipfile_lock, "poetry.lock": self.parse_toml_lock,
+            "uv.lock": self.parse_toml_lock, "pdm.lock": self.parse_toml_lock, "Cargo.lock": self.parse_toml_lock,
+            "pom.xml": self.parse_pom, "gradle.lockfile": self.parse_gradle_lock, "go.mod": self.parse_go_mod,
+            "Gemfile.lock": self.parse_gemfile_lock, "packages.lock.json": self.parse_nuget_lock, "global.json": self.parse_global_json,
+            "Dockerfile": self.parse_dockerfile, "Containerfile": self.parse_dockerfile,
+            ".nvmrc": self.parse_version_file, ".node-version": self.parse_version_file, ".python-version": self.parse_version_file,
+            ".ruby-version": self.parse_version_file, ".java-version": self.parse_version_file, "runtime.txt": self.parse_version_file,
+            ".tool-versions": self.parse_tool_versions, "package.json": self.parse_package_json,
+        }
+        for name, parser in dispatch.items():
+            for path in names.get(name, []):
+                if name == "package.json" and path.parent != self.project:
+                    continue
+                self.safe(parser, path)
+        for path in files:
+            lower = path.name.lower()
+            if re.fullmatch(r"requirements[\w.-]*\.(txt|in)", lower) and lower.endswith(".txt"):
+                self.safe(self.parse_requirements, path)
+            elif lower.endswith(".csproj") or lower.endswith(".fsproj") or lower == "directory.packages.props":
+                self.safe(self.parse_csproj, path)
+            elif re.fullmatch(r"(docker-)?compose[\w.-]*\.ya?ml", lower):
+                self.safe(self.parse_compose, path)
+            elif lower.startswith("dockerfile.") or lower.endswith(".dockerfile"):
+                self.safe(self.parse_dockerfile, path)
+        wp_root = self.find_wordpress()
+        if wp_root:
+            self.safe(self.parse_wordpress, wp_root)
+        self.scan_js_bundles()
+
+    def safe(self, parser, path: Path) -> None:
+        try:
+            parser(path)
+        except Exception as error:  # noqa: BLE001 - a bad file degrades, never crashes
+            self.problems.append(f"{self.rel(path)}: could not parse ({type(error).__name__}: {error})")
+
+    # ------------------------------------------------------------------ JavaScript
+
+    def parse_package_lock_json(self, path: Path) -> None:
+        data = json.loads(self.read(path) or "{}")
+        self.source("lockfile", path)
+        root = (data.get("packages") or {}).get("") or {}
+        direct = set(root.get("dependencies") or {}) | set(root.get("devDependencies") or {}) | set(root.get("optionalDependencies") or {})
+        if data.get("packages"):
+            for key, meta in data["packages"].items():
+                if not key or "node_modules/" not in key or meta.get("link"):
+                    continue
+                name = meta.get("name") or key.rsplit("node_modules/", 1)[1]
+                scope = "dev" if meta.get("dev") or meta.get("devOptional") else "runtime"
+                self.add("npm", name, meta.get("version", ""), path, scope, name in direct and key == f"node_modules/{name}")
+        else:  # lockfileVersion 1
+            def walk(deps: dict, top: bool) -> None:
+                for name, meta in (deps or {}).items():
+                    self.add("npm", name, meta.get("version", ""), path, "dev" if meta.get("dev") else "runtime", top)
+                    walk(meta.get("dependencies") or {}, False)
+            walk(data.get("dependencies") or {}, True)
+
+    parse_npm_shrinkwrap_json = parse_package_lock_json
+
+    def parse_pnpm_lock_yaml(self, path: Path) -> None:
+        text = self.read(path) or ""
+        self.source("lockfile", path)
+        section = None
+        dev_names: set[str] = set()
+        direct: set[str] = set()
+        importer_kind = None
+        for line in text.splitlines():
+            if not line.strip() or line.lstrip().startswith("#"):
+                continue
+            indent = len(line) - len(line.lstrip())
+            if indent == 0:
+                section = line.rstrip(":").strip()
+                continue
+            if section == "importers":
+                stripped = line.strip()
+                if stripped in ("dependencies:", "devDependencies:", "optionalDependencies:"):
+                    importer_kind = stripped[:-1]
+                elif indent in (6, 2) and stripped.endswith(":") and importer_kind:
+                    name = stripped[:-1].strip("'\"")
+                    direct.add(name)
+                    if importer_kind == "devDependencies":
+                        dev_names.add(name)
+            elif section in ("dependencies", "devDependencies") and indent == 2 and line.strip().endswith(":"):
+                name = line.strip()[:-1].strip("'\"")
+                direct.add(name)
+                if section == "devDependencies":
+                    dev_names.add(name)
+            elif section == "packages" and indent == 2 and line.rstrip().endswith(":"):
+                key = line.strip()[:-1].strip("'\"").lstrip("/")
+                key = key.split("(", 1)[0]
+                match = re.match(r"^(@?[^@/]+(?:/[^@/]+)?)[@/](\d[^/_()]*)", key)
+                if match:
+                    name, version = match.group(1), match.group(2)
+                    self.add("npm", name, version, path, "dev" if name in dev_names else "runtime", name in direct)
+
+    def parse_yarn_lock(self, path: Path) -> None:
+        text = self.read(path) or ""
+        self.source("lockfile", path)
+        names: list[str] = []
+        for line in text.splitlines():
+            if not line.strip() or line.startswith("#"):
+                continue
+            if not line.startswith(" ") and line.rstrip().endswith(":"):
+                header = line.rstrip()[:-1]
+                names = []
+                for spec in header.split(","):
+                    spec = spec.strip().strip('"')
+                    if spec.startswith("__metadata"):
+                        continue
+                    name = spec[: spec.rfind("@")] if spec.rfind("@") > 0 else spec
+                    if name and name not in names:
+                        names.append(name)
+            else:
+                match = re.match(r'^\s+version:?\s+"?([^"\s]+)"?', line)
+                if match and names:
+                    for name in names[:1]:
+                        self.add("npm", name, match.group(1), path)
+                    names = []
+
+    def parse_bun_lock(self, path: Path) -> None:
+        text = self.read(path) or ""
+        self.source("lockfile", path)
+        cleaned = re.sub(r",(\s*[}\]])", r"\1", text)  # bun.lock is JSONC with trailing commas
+        data = json.loads(cleaned)
+        for entry in (data.get("packages") or {}).values():
+            if isinstance(entry, list) and entry and isinstance(entry[0], str):
+                spec = entry[0]
+                name, _, version = spec.rpartition("@")
+                if name and re.match(r"\d", version):
+                    self.add("npm", name, version, path)
+
+    def parse_package_json(self, path: Path) -> None:
+        data = json.loads(self.read(path) or "{}")
+        engine = ((data.get("engines") or {}).get("node") or "").strip()
+        match = re.search(r"(\d+(?:\.\d+){0,2})", engine)
+        if match and not any(r["name"] == "node" for r in self.runtimes):
+            self.add_runtime("node", match.group(1) if match.group(1).count(".") else match.group(1) + ".0.0", "declared")
+        if not any(c["ecosystem"] == "npm" and c["location"].startswith(self.rel(path.parent)) for c in self.components):
+            # No lockfile: record exact pins from package.json at lower confidence.
+            for section, scope in (("dependencies", "runtime"), ("devDependencies", "dev")):
+                for name, spec in (data.get(section) or {}).items():
+                    if isinstance(spec, str) and re.fullmatch(r"\d+\.\d+\.\d+(?:-[\w.]+)?", spec.strip()):
+                        self.add("npm", name, spec.strip(), path, scope, True)
+            if data.get("dependencies") or data.get("devDependencies"):
+                self.source("manifest", path)
+
+    # ------------------------------------------------------------------ PHP / Python / Ruby / Rust / Go / .NET / Java
+
+    def parse_composer_lock(self, path: Path) -> None:
+        data = json.loads(self.read(path) or "{}")
+        self.source("lockfile", path)
+        manifest = path.parent / "composer.json"
+        direct: set[str] = set()
+        if manifest.is_file():
+            with_json = json.loads(manifest.read_text(encoding="utf-8") or "{}")
+            direct = {k.lower() for k in list((with_json.get("require") or {})) + list((with_json.get("require-dev") or {}))}
+            php = (with_json.get("require") or {}).get("php") or ""
+        for key, scope in (("packages", "runtime"), ("packages-dev", "dev")):
+            for pkg in data.get(key) or []:
+                version = str(pkg.get("version", "")).lstrip("v")
+                if version.startswith("dev-") or version.endswith("-dev"):
+                    continue
+                self.add("Packagist", pkg.get("name", "").lower(), version, path, scope, pkg.get("name", "").lower() in direct)
+
+    def parse_requirements(self, path: Path) -> None:
+        text = self.read(path) or ""
+        found = False
+        scope = "dev" if re.search(r"(dev|test|lint|doc)", path.name) else "runtime"
+        for line in text.splitlines():
+            line = line.split("#", 1)[0].strip()
+            match = re.match(r"^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*===?\s*([^\s;,]+)", line)
+            if match:
+                self.add("PyPI", re.sub(r"[-_.]+", "-", match.group(1)).lower(), match.group(2), path, scope, True)
+                found = True
+        if found:
+            self.source("lockfile", path)
+
+    def parse_pipfile_lock(self, path: Path) -> None:
+        data = json.loads(self.read(path) or "{}")
+        self.source("lockfile", path)
+        for section, scope in (("default", "runtime"), ("develop", "dev")):
+            for name, meta in (data.get(section) or {}).items():
+                version = str((meta or {}).get("version", "")).lstrip("=")
+                self.add("PyPI", re.sub(r"[-_.]+", "-", name).lower(), version, path, scope)
+
+    def parse_toml_lock(self, path: Path) -> None:
+        """[[package]] tables with name/version (poetry.lock, uv.lock, pdm.lock, Cargo.lock)."""
+        text = self.read(path) or ""
+        ecosystem = "crates.io" if path.name == "Cargo.lock" else "PyPI"
+        self.source("lockfile", path)
+        for block in re.split(r"^\[\[package\]\]\s*$", text, flags=re.M)[1:]:
+            body = re.split(r"^\[", block, maxsplit=1, flags=re.M)[0]
+            name = re.search(r'^name\s*=\s*"([^"]+)"', body, re.M)
+            version = re.search(r'^version\s*=\s*"([^"]+)"', body, re.M)
+            if not name or not version:
+                continue
+            source = re.search(r"^source\s*=\s*(.+)$", body, re.M)
+            if source and ("virtual" in source.group(1) or "editable" in source.group(1) or "path" in source.group(1)):
+                continue
+            if ecosystem == "crates.io" and not source:
+                continue  # workspace crate, not from a registry
+            category = re.search(r'^category\s*=\s*"([^"]+)"', body, re.M)
+            groups = re.search(r'^groups\s*=\s*\[([^\]]*)\]', body, re.M)
+            dev = (category and category.group(1) == "dev") or (groups and "main" not in groups.group(1) and "default" not in groups.group(1))
+            pkg = name.group(1) if ecosystem == "crates.io" else re.sub(r"[-_.]+", "-", name.group(1)).lower()
+            self.add(ecosystem, pkg, version.group(1), path, "dev" if dev else "runtime")
+        if path.name == "uv.lock" or path.name == "poetry.lock":
+            match = re.search(r'^requires-python\s*=\s*"[^\d]*(\d+\.\d+)', text, re.M)
+            if match and not any(r["name"] == "python" for r in self.runtimes):
+                self.add_runtime("python", match.group(1), "declared")
+
+    def parse_gemfile_lock(self, path: Path) -> None:
+        text = self.read(path) or ""
+        self.source("lockfile", path)
+        section = None
+        for line in text.splitlines():
+            if line and not line.startswith(" "):
+                section = line.strip()
+                continue
+            if section in ("GEM", "GIT", "PATH") and re.match(r"^ {4}\S", line):
+                match = re.match(r"^ {4}([^\s(]+) \(([^)]+)\)", line)
+                if match and section == "GEM":
+                    self.add("RubyGems", match.group(1), match.group(2).split("-", 1)[0], path)
+            if section == "RUBY VERSION":
+                match = re.search(r"ruby (\d+\.\d+\.\d+)", line)
+                if match:
+                    self.add_runtime("ruby", match.group(1), "declared")
+
+    def parse_go_mod(self, path: Path) -> None:
+        text = self.read(path) or ""
+        self.source("lockfile", path)
+        go = re.search(r"^go (\d+\.\d+(?:\.\d+)?)", text, re.M)
+        if go:
+            self.add_runtime("go", go.group(1), "declared")
+        in_block = False
+        for line in text.splitlines():
+            stripped = line.split("//", 1)[0].strip()
+            indirect = "// indirect" in line
+            if stripped.startswith("require ("):
+                in_block = True
+                continue
+            if in_block and stripped == ")":
+                in_block = False
+                continue
+            match = re.match(r"^(?:require\s+)?(\S+)\s+(v\S+)$", stripped) if (in_block or stripped.startswith("require ")) else None
+            if match:
+                self.add("Go", match.group(1), match.group(2).lstrip("v"), path, "runtime", not indirect)
+
+    def parse_nuget_lock(self, path: Path) -> None:
+        data = json.loads(self.read(path) or "{}")
+        self.source("lockfile", path)
+        for framework in (data.get("dependencies") or {}).values():
+            for name, meta in (framework or {}).items():
+                if (meta or {}).get("type") == "Project":
+                    continue
+                self.add("NuGet", name, (meta or {}).get("resolved", ""), path, "runtime", (meta or {}).get("type") == "Direct")
+
+    def parse_csproj(self, path: Path) -> None:
+        root = ET.fromstring(self.read(path) or "<x/>")
+        found = False
+        for element in root.iter():
+            tag = element.tag.rsplit("}", 1)[-1]
+            if tag in ("PackageReference", "PackageVersion"):
+                name = element.get("Include") or element.get("Update")
+                version = element.get("Version") or (element.findtext("Version") or "")
+                if name and re.fullmatch(r"\d+(\.\d+){1,3}(-[\w.]+)?", version.strip()):
+                    self.add("NuGet", name, version.strip(), path, "runtime", True)
+                    found = True
+            if tag == "TargetFramework" and element.text:
+                match = re.match(r"net(\d+\.\d+)", element.text.strip())
+                if match:
+                    self.add_runtime("dotnet", match.group(1), "declared")
+        if found:
+            self.source("manifest", path)
+
+    def parse_global_json(self, path: Path) -> None:
+        data = json.loads(self.read(path) or "{}")
+        version = (data.get("sdk") or {}).get("version")
+        if version:
+            self.add_runtime("dotnet", ".".join(version.split(".")[:2]), "declared")
+
+    def parse_pom(self, path: Path) -> None:
+        root = ET.fromstring(self.read(path) or "<x/>")
+        ns = {"m": root.tag[1:].split("}", 1)[0]} if root.tag.startswith("{") else {}
+        q = (lambda tag: f"m:{tag}") if ns else (lambda tag: tag)
+        props: dict[str, str] = {}
+        properties = root.find(q("properties"), ns)
+        if properties is not None:
+            for prop in properties:
+                props[prop.tag.rsplit("}", 1)[-1]] = (prop.text or "").strip()
+        props["project.version"] = (root.findtext(q("version"), default="", namespaces=ns) or "").strip()
+
+        def resolve(value: str) -> str:
+            return re.sub(r"\$\{([^}]+)\}", lambda m: props.get(m.group(1), m.group(0)), value or "")
+
+        java = props.get("maven.compiler.release") or props.get("java.version") or props.get("maven.compiler.source") or ""
+        if java:
+            self.add_runtime("java", java.replace("1.", "", 1) if java.startswith("1.") else java, "declared")
+        found = False
+        for container in (root.find(q("dependencies"), ns), root.find(f"{q('dependencyManagement')}/{q('dependencies')}", ns)):
+            if container is None:
+                continue
+            for dep in container.findall(q("dependency"), ns):
+                group = resolve(dep.findtext(q("groupId"), default="", namespaces=ns).strip())
+                artifact = resolve(dep.findtext(q("artifactId"), default="", namespaces=ns).strip())
+                version = resolve(dep.findtext(q("version"), default="", namespaces=ns).strip())
+                scope = dep.findtext(q("scope"), default="compile", namespaces=ns).strip()
+                if "${" in version or not version or version.startswith(("[", "(")):
+                    continue
+                self.add("Maven", f"{group}:{artifact}", version, path, "dev" if scope in ("test", "provided") else "runtime", True)
+                found = True
+        parent = root.find(q("parent"), ns)
+        if parent is not None:
+            group = parent.findtext(q("groupId"), default="", namespaces=ns).strip()
+            artifact = parent.findtext(q("artifactId"), default="", namespaces=ns).strip()
+            version = parent.findtext(q("version"), default="", namespaces=ns).strip()
+            if group and artifact and version:
+                self.add("Maven", f"{group}:{artifact}", version, path, "build", True)
+                found = True
+        if found:
+            self.source("manifest", path)
+
+    def parse_gradle_lock(self, path: Path) -> None:
+        text = self.read(path) or ""
+        self.source("lockfile", path)
+        for line in text.splitlines():
+            if line.startswith("#") or "=" not in line:
+                continue
+            coords, _, configurations = line.partition("=")
+            parts = coords.strip().split(":")
+            if len(parts) == 3:
+                scope = "dev" if configurations and all("test" in c.lower() for c in configurations.split(",")) else "runtime"
+                self.add("Maven", f"{parts[0]}:{parts[1]}", parts[2], path, scope)
+
+    # ------------------------------------------------------------------ containers and declared runtimes
+
+    def add_image(self, ref: str, path: Path | str, host: str | None = None) -> None:
+        ref = ref.strip().strip('"\'')
+        if not ref or "$" in ref or ref.lower() == "scratch":
+            return
+        if any(i["ref"] == ref and i.get("host") == host for i in self.images):
+            return
+        digest = None
+        if "@sha256:" in ref:
+            ref, _, digest_hex = ref.partition("@sha256:")
+            digest = "sha256:" + digest_hex
+        self.images.append({"ref": ref, "digest": digest, "host": host})
+        name, _, tag = ref.rpartition(":") if ":" in ref.rsplit("/", 1)[-1] else (ref, "", "latest")
+        repo = re.sub(r"^(docker\.io/)?(library/)?", "", name)
+        runtime = IMAGE_RUNTIMES.get(repo) or IMAGE_RUNTIMES.get(repo.rsplit("/", 1)[-1])
+        version = re.match(r"^v?(\d+(?:\.\d+){0,2})", tag or "")
+        if runtime and version:
+            self.add_runtime(runtime, version.group(1), "image", host, image=ref)
+        os_hint = re.search(r"(alpine|bookworm|bullseye|buster|jammy|noble|focal)", tag or "")
+        if os_hint and runtime not in ("alpine", "debian", "ubuntu"):
+            codename = {"bookworm": ("debian", "12"), "bullseye": ("debian", "11"), "buster": ("debian", "10"),
+                        "jammy": ("ubuntu", "22.04"), "noble": ("ubuntu", "24.04"), "focal": ("ubuntu", "20.04")}.get(os_hint.group(1))
+            if codename:
+                self.add_runtime(codename[0], codename[1], "image", host, image=ref)
+
+    def parse_dockerfile(self, path: Path) -> None:
+        text = self.read(path) or ""
+        stages: set[str] = set()
+        for line in text.splitlines():
+            match = re.match(r"^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)(?:\s+AS\s+(\S+))?", line, re.I)
+            if match:
+                ref = match.group(1)
+                if ref not in stages:
+                    self.add_image(ref, path)
+                if match.group(2):
+                    stages.add(match.group(2))
+        self.source("manifest", path)
+
+    def parse_compose(self, path: Path) -> None:
+        text = self.read(path) or ""
+        for match in re.finditer(r"^\s*image:\s*['\"]?([^\s'\"#]+)", text, re.M):
+            self.add_image(match.group(1), path)
+        self.source("manifest", path)
+
+    def parse_version_file(self, path: Path) -> None:
+        text = (self.read(path) or "").strip().splitlines()
+        value = text[0].strip() if text else ""
+        name = {".nvmrc": "node", ".node-version": "node", ".python-version": "python", ".ruby-version": "ruby",
+                ".java-version": "java", "runtime.txt": "python"}[path.name]
+        match = re.search(r"(\d+(?:\.\d+){0,2})", value)
+        if match:
+            if path.name == "runtime.txt" and not value.startswith("python"):
+                return
+            self.add_runtime(name, match.group(1), "declared")
+
+    def parse_tool_versions(self, path: Path) -> None:
+        mapping = {"nodejs": "node", "python": "python", "ruby": "ruby", "golang": "go", "java": "java", "php": "php",
+                   "erlang": "erlang", "elixir": "elixir", "rust": "rust", "dotnet-core": "dotnet", "postgres": "postgresql",
+                   "redis": "redis", "mysql": "mysql"}
+        for line in (self.read(path) or "").splitlines():
+            parts = line.split("#", 1)[0].split()
+            if len(parts) >= 2 and parts[0] in mapping:
+                version = re.search(r"(\d+(?:\.\d+){0,2})", parts[1])
+                if version:
+                    self.add_runtime(mapping[parts[0]], version.group(1), "declared")
+
+    # ------------------------------------------------------------------ shipped JavaScript (retire.js extractors)
+
+    def scan_js_bundles(self, limit: int = 400) -> None:
+        """Libraries copied into the site (static/, public/, dist/, assets/, wp-content/) rather than installed.
+
+        Uses the filename and banner extractors from retire.js (Apache-2.0,
+        security_data/retire-extractors.json). Only the first 2 KB of each file
+        is read, where banners live.
+        """
+        extractors = _retire_extractors()
+        roots = [self.project / d for d in ("", "static", "public", "dist", "assets", "js", "wp-content/themes", "wp-content/plugins", "www", "build")]
+        seen: set[Path] = set()
+        found = 0
+        for root in roots:
+            if not root.is_dir():
+                continue
+            pattern = "**/*.js" if root != self.project else "*.js"
+            for path in root.glob(pattern):
+                if path in seen or "node_modules" in path.parts or found >= limit:
+                    continue
+                seen.add(path)
+                try:
+                    with path.open("r", encoding="utf-8", errors="replace") as handle:
+                        head = handle.read(2048)
+                except OSError:
+                    continue
+                for lib, (name_res, content_res, npm) in extractors.items():
+                    version = None
+                    for rx in name_res:
+                        match = rx.search(path.name)
+                        if match:
+                            version = match.group(1)
+                            break
+                    if not version:
+                        for rx in content_res:
+                            match = rx.search(head)
+                            if match:
+                                version = match.group(1)
+                                break
+                    if version:
+                        version = re.sub(r"([.-](min|slim|pack|prod|production|umd|esm|bundle|js))+$", "", version).rstrip(".-_")
+                        self.components.append({"purl": core.make_purl("npm", npm, version), "ecosystem": "npm", "name": npm,
+                                                "version": version, "scope": "runtime", "direct": None, "location": self.rel(path)})
+                        self.source("js-bundle", path)
+                        found += 1
+                        break
+
+    # ------------------------------------------------------------------ WordPress
+
+    def find_wordpress(self) -> Path | None:
+        for candidate in (self.project, self.project / "wordpress", self.project / "public", self.project / "web", self.project / "htdocs"):
+            if (candidate / "wp-includes" / "version.php").is_file() or (candidate / "wp-content").is_dir():
+                return candidate
+        return None
+
+    @staticmethod
+    def header(text: str, field: str) -> str | None:
+        match = re.search(rf"^[ \t/*#@]*{re.escape(field)}:\s*(.+)$", text, re.M | re.I)
+        return match.group(1).strip() if match else None
+
+    def parse_wordpress(self, root: Path) -> None:
+        wp: dict = {"core": None, "plugins": [], "themes": []}
+        version_file = root / "wp-includes" / "version.php"
+        if version_file.is_file():
+            match = re.search(r"\$wp_version\s*=\s*'([^']+)'", self.read(version_file) or "")
+            wp["core"] = match.group(1) if match else None
+        plugins = root / "wp-content" / "plugins"
+        if plugins.is_dir():
+            for directory in sorted(p for p in plugins.iterdir() if p.is_dir()):
+                for php in sorted(directory.glob("*.php"))[:20]:
+                    head = (self.read(php) or "")[:8192]
+                    if self.header(head, "Plugin Name"):
+                        wp["plugins"].append({"slug": directory.name, "version": self.header(head, "Version"), "active": None,
+                                              "text_domain": self.header(head, "Text Domain")})
+                        break
+        themes = root / "wp-content" / "themes"
+        if themes.is_dir():
+            for directory in sorted(p for p in themes.iterdir() if p.is_dir()):
+                style = directory / "style.css"
+                if style.is_file():
+                    head = (self.read(style) or "")[:8192]
+                    wp["themes"].append({"slug": directory.name, "version": self.header(head, "Version"), "active": None})
+        self.wordpress = wp
+        self.source("wordpress", root / "wp-content" if (root / "wp-content").is_dir() else root)
+        if wp["core"]:
+            self.add_runtime("wordpress", wp["core"], "files")
+
+    def apply_wp_cli(self, path: Path) -> None:
+        """Active state from `wp plugin list --format=json` / `wp theme list --format=json` output."""
+        data = json.loads(self.read(path) or "[]")
+        if not self.wordpress:
+            self.wordpress = {"core": None, "plugins": [], "themes": []}
+        for row in data:
+            status = row.get("status")
+            for bucket in ("plugins", "themes"):
+                for item in self.wordpress[bucket]:
+                    if item["slug"] == row.get("name"):
+                        item["active"] = status in ("active", "active-network", "parent")
+                        item["version"] = item["version"] or row.get("version")
+
+    # ------------------------------------------------------------------ hosts
+
+    def parse_host_evidence(self, text: str, alias: str, path_label: str) -> None:
+        """Sections from SECURITY_COLLECTOR (or the plain runtime-inventory collector)."""
+        sections = parse_sections(text)
+        os_info = parse_os(sections.get("os-release", ""))
+        public = True
+        if os_info.get("id"):
+            os_name = {"rhel": "rhel", "rocky": "rocky-linux", "almalinux": "almalinux", "amzn": "amazon-linux",
+                       "opensuse-leap": "opensuse", "sles": "sles", "centos": "centos", "fedora": "fedora"}.get(os_info["id"], os_info["id"])
+            self.add_runtime(os_name, os_info.get("version", ""), "runtime-inventory", alias)
+        self.hosts.append({"id": alias, "os": " ".join(x for x in (os_info.get("id"), os_info.get("version")) if x) or None, "public": public})
+        for section, (name, pattern) in SERVICE_PROBES.items():
+            body = sections.get(section, "")
+            match = re.search(pattern, body, re.M)
+            if not match:
+                continue
+            service = name
+            if section == "mysql-v":
+                service = "mariadb" if "mariadb" in body.lower() else "mysql"
+            self.add_runtime(service, match.group(1), "runtime-inventory", alias)
+        ecosystem = OS_ECOSYSTEM.get(os_info.get("id", ""))
+        release = os_info.get("version", "")
+        eco = f"{ecosystem}:{release}" if ecosystem and release else ecosystem
+        if ecosystem == "Alpine" and release:
+            eco = "Alpine:v" + versions.cycle_of(release, 2)  # OSV names Alpine releases "Alpine:v3.16"
+        if ecosystem == "Ubuntu" and release:
+            eco = f"Ubuntu:{release}" + (":LTS" if release.endswith(".04") and int(release.split(".")[0]) % 2 == 0 else "")
+        count = 0
+        for line in sections.get("dpkg", "").splitlines():
+            parts = line.split("\t")
+            if len(parts) >= 2 and (len(parts) < 3 or "installed" in parts[2]):
+                self.components.append({"purl": core.make_purl("deb", parts[0], parts[1]), "ecosystem": eco or "Debian", "name": parts[0],
+                                        "version": parts[1], "scope": "os", "direct": None, "location": f"{path_label}#dpkg", "host": alias})
+                count += 1
+        for line in sections.get("rpm", "").splitlines():
+            parts = line.split("\t")
+            if len(parts) == 2:
+                version = parts[1][2:] if parts[1].startswith("0:") else parts[1]
+                self.components.append({"purl": None, "ecosystem": eco or "Red Hat", "name": parts[0], "version": version,
+                                        "scope": "os", "direct": None, "location": f"{path_label}#rpm", "host": alias})
+                count += 1
+        for line in sections.get("apk", "").splitlines():
+            match = re.match(r"^(.+)-(\d[^-]*-r\d+)$", line.strip())
+            if match:
+                self.components.append({"purl": core.make_purl("apk", match.group(1), match.group(2)), "ecosystem": eco or "Alpine",
+                                        "name": match.group(1), "version": match.group(2), "scope": "os", "direct": None,
+                                        "location": f"{path_label}#apk", "host": alias})
+                count += 1
+        for line in sections.get("docker-ps", "").splitlines():
+            parts = line.split("\t")
+            if len(parts) >= 2:
+                self.add_image(parts[1], path_label, alias)
+        self.source("runtime-inventory", path_label)
+
+    def parse_dpkg_status(self, path: Path, alias: str) -> None:
+        """A copied /var/lib/dpkg/status file."""
+        text = self.read(path) or ""
+        lines = []
+        for block in text.split("\n\n"):
+            fields = dict(re.findall(r"^([A-Za-z-]+):\s*(.*)$", block, re.M))
+            if fields.get("Package") and fields.get("Version") and "installed" in fields.get("Status", "installed"):
+                lines.append(f"{fields['Package']}\t{fields['Version']}\t{fields.get('Status', 'install ok installed')}")
+        self.parse_host_evidence("### dpkg\n" + "\n".join(lines), alias, self.rel(path))
+
+    def parse_runtime_inventory_json(self, path: Path, alias: str) -> None:
+        data = json.loads(self.read(path) or "{}")
+        os_info = data.get("os") or {}
+        if os_info.get("id"):
+            self.add_runtime(os_info["id"], os_info.get("version", ""), "runtime-inventory", alias)
+        self.hosts.append({"id": alias, "os": " ".join(x for x in (os_info.get("id"), os_info.get("version")) if x) or None, "public": True})
+        if data.get("hostPhp"):
+            self.add_runtime("php", data["hostPhp"], "runtime-inventory", alias)
+        for container in data.get("containers") or []:
+            self.add_image(container.get("image", ""), self.rel(path), alias)
+        for site in data.get("sites") or []:
+            runtime = site.get("runtime") or {}
+            if runtime.get("version"):
+                self.add_runtime("php", runtime["version"], "runtime-inventory", alias, site_root=site.get("root"))
+        self.source("runtime-inventory", path)
+
+    # ------------------------------------------------------------------ result
+
+    def stack(self, domains: list[str], watch_extra: list[str]) -> dict:
+        seen = set()
+        components = []
+        for comp in sorted(self.components, key=lambda c: (c["ecosystem"], c["name"], c["version"], c["location"] or "")):
+            key = (comp["ecosystem"], comp["name"], comp["version"], comp["scope"])
+            if key in seen:
+                continue
+            seen.add(key)
+            components.append(comp)
+        # A declared "python 3.9" next to an exact "python 3.9.18" on the same host is the same runtime.
+        runtimes = []
+        for runtime in sorted(self.runtimes, key=lambda r: (r["name"], r.get("host") or "", -len(r["version"]), r["version"])):
+            if any(r["name"] == runtime["name"] and r.get("host") == runtime.get("host") and r["version"].startswith(runtime["version"] + ".")
+                   for r in runtimes):
+                continue
+            runtimes.append(runtime)
+        runtimes.sort(key=lambda r: (r["name"], r.get("host") or "", r["version"]))
+        images = sorted(self.images, key=lambda i: (i["ref"], i.get("host") or ""))
+        watch = list(dict.fromkeys(WATCH_DEFAULTS.get(self.site_type, []) + [r["name"] for r in runtimes] +
+                                   [c["name"] for c in components if c.get("direct") and c["ecosystem"] == "npm" and c["name"] in ("next", "astro", "nuxt", "express")] +
+                                   watch_extra))
+        digest = core.sha256_bytes(core.canonical_json([components, runtimes, self.wordpress, images]).encode("utf-8"))
+        return {
+            "schema": "maggie-security-stack.v1",
+            "site": {"id": self.site, "type": self.site_type, "domains": domains, "hosting": None},
+            "collected_at": core.iso(),
+            "hash": f"sha256:{digest}",
+            "sources": [{"kind": "manifest" if s["kind"] == "js-bundle" else s["kind"], "path": s["path"]} for s in self.sources],
+            "components": components,
+            "runtimes": runtimes,
+            "wordpress": self.wordpress,
+            "images": images,
+            "hosts": self.hosts,
+            "watch": {"products": watch},
+        }
+
+
+_EXTRACTORS: dict | None = None
+
+
+def _retire_extractors() -> dict:
+    global _EXTRACTORS
+    if _EXTRACTORS is None:
+        data = core.read_json(core.DATA_DIR / "retire-extractors.json")
+        version = r"([0-9][0-9.a-z_\-]+)"
+        compiled = {}
+        for lib, spec in data["libraries"].items():
+            names = [re.compile(p.replace("§§version§§", version[1:-1]).replace("(" + version[1:-1] + ")", version)) for p in spec.get("filename", [])]
+            contents = [re.compile(p.replace("§§version§§", version[1:-1]).replace("(" + version[1:-1] + ")", version)) for p in spec.get("filecontent", [])]
+            compiled[lib] = (names, contents, spec.get("npmname") or lib)
+        _EXTRACTORS = compiled
+    return _EXTRACTORS
+
+
+def summary(stack: dict, previous_hash: str | None) -> dict:
+    by_eco: dict[str, int] = {}
+    for comp in stack["components"]:
+        eco = comp["ecosystem"].split(":", 1)[0]
+        by_eco[eco] = by_eco.get(eco, 0) + 1
+    wp = stack.get("wordpress") or {}
+    return {"components": len(stack["components"]), "by_ecosystem": by_eco,
+            "runtimes": [f"{r['name']} {r['version']}" + (f" @{r['host']}" if r.get("host") else "") for r in stack["runtimes"]],
+            "images": [i["ref"] for i in stack["images"]],
+            "wordpress": {"core": wp.get("core"), "plugins": len(wp.get("plugins") or []), "themes": len(wp.get("themes") or [])} if wp else None,
+            "hash": stack["hash"], "changed": previous_hash != stack["hash"]}
+
+
+def build(ctx: core.Context) -> dict:
+    args = ctx.args
+    cfg = ctx.state.config()
+    site_type = args.site_type or cfg.get("site_type") or core.detect_site_type(ctx.project)
+    inv = Inventory(ctx.project, ctx.site, site_type)
+    if not args.no_scan:
+        inv.scan_project()
+    for lockfile in args.lockfile or []:
+        path = Path(lockfile)
+        path = path if path.is_absolute() else ctx.project / path
+        parser = {"package-lock.json": inv.parse_package_lock_json, "npm-shrinkwrap.json": inv.parse_package_lock_json,
+                  "pnpm-lock.yaml": inv.parse_pnpm_lock_yaml, "yarn.lock": inv.parse_yarn_lock, "bun.lock": inv.parse_bun_lock,
+                  "composer.lock": inv.parse_composer_lock, "Pipfile.lock": inv.parse_pipfile_lock, "poetry.lock": inv.parse_toml_lock,
+                  "uv.lock": inv.parse_toml_lock, "pdm.lock": inv.parse_toml_lock, "Cargo.lock": inv.parse_toml_lock,
+                  "pom.xml": inv.parse_pom, "gradle.lockfile": inv.parse_gradle_lock, "go.mod": inv.parse_go_mod,
+                  "Gemfile.lock": inv.parse_gemfile_lock, "packages.lock.json": inv.parse_nuget_lock}.get(path.name)
+        if parser is None and path.name.startswith("requirements"):
+            parser = inv.parse_requirements
+        if parser is None:
+            raise core.UsageError(f"unsupported lockfile {path.name}")
+        if not path.is_file():
+            raise core.UsageError(f"file not found: {path}")
+        inv.safe(parser, path)
+    if args.wordpress:
+        inv.safe(inv.parse_wordpress, Path(args.wordpress))
+    if args.wp_cli_json:
+        inv.safe(inv.apply_wp_cli, Path(args.wp_cli_json))
+    for item in args.host_evidence or []:
+        alias, _, file_name = item.partition("=") if "=" in item else ("host1", "", item)
+        path = Path(file_name)
+        if not path.is_file():
+            raise core.UsageError(f"file not found: {path}")
+        text = path.read_text(encoding="utf-8", errors="replace")
+        if text.lstrip().startswith("{"):
+            inv.safe(lambda p: inv.parse_runtime_inventory_json(p, alias), path)
+        elif text.lstrip().startswith("Package:"):
+            inv.safe(lambda p: inv.parse_dpkg_status(p, alias), path)
+        else:
+            inv.parse_host_evidence(text, alias, inv.rel(path))
+    for item in args.ssh or []:
+        alias, _, target = item.partition("=")
+        if not target:
+            raise core.UsageError("--ssh takes ALIAS=user@host")
+        core.require_consent(ctx.state, alias, "ssh-read")
+        text = _collect(target)
+        out = ctx.state.path("inventory", f"host-{alias}.txt")
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(text, encoding="utf-8")
+        inv.parse_host_evidence(text, alias, f".maggie/security/inventory/host-{alias}.txt")
+    domains = list(dict.fromkeys((args.domain or []) + (cfg.get("domains") or [])))
+    stack = inv.stack(domains, (args.watch_product or []) + (cfg.get("watch_products") or []))
+    if not stack["components"] and not stack["runtimes"] and not stack["wordpress"]:
+        raise core.UsageError("nothing to inventory: no lockfile, manifest, WordPress install or host evidence found")
+    errors = core.validate_contract(stack, "stack-v1")
+    if errors:
+        raise core.UsageError("stack failed its contract: " + "; ".join(errors[:5]))
+    path = ctx.state.path("inventory", "stack.json")
+    previous = core.read_json(path).get("hash") if path.is_file() else None
+    if not args.print:
+        core.write_json(path, stack)
+    return {"schema": "maggie-security-inventory-result.v1", "path": str(path) if not args.print else None,
+            "summary": summary(stack, previous), "problems": inv.problems, "stack": stack if args.print else None}
+
+
+def _collect(target: str) -> str:
+    import subprocess
+
+    result = subprocess.run(["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=15", target, "sh -s"], input=SECURITY_COLLECTOR,
+                            capture_output=True, text=True, timeout=180, check=False)
+    if result.returncode not in (0, 1) and not result.stdout:
+        raise core.DegradedError(f"ssh {target}: {result.stderr.strip()[:200]}")
+    return result.stdout
+
+
+def load_stack(ctx: core.Context, max_age_hours: int = 24, rebuild: bool = False) -> dict:
+    """The current stack.json, rebuilt from the project when missing, stale or asked."""
+    path = ctx.state.path("inventory", "stack.json")
+    if path.is_file() and not rebuild:
+        stack = core.read_json(path)
+        age = core.utcnow() - core.parse_time(stack.get("collected_at", "1970-01-01T00:00:00Z"))
+        if age.total_seconds() < max_age_hours * 3600:
+            return stack
+    import argparse
+
+    fake = argparse.Namespace(site_type=None, no_scan=False, lockfile=[], wordpress=None, wp_cli_json=None, host_evidence=[], ssh=[],
+                              domain=[], watch_product=[], print=False)
+    previous = core.read_json(path) if path.is_file() else None
+    sub = core.Context.__new__(core.Context)
+    sub.__dict__.update(ctx.__dict__)
+    sub.args = fake
+    try:
+        build(sub)
+    except core.UsageError:
+        if not previous:
+            raise
+    stack = core.read_json(path) if path.is_file() else previous
+    if previous and previous is not stack:
+        # Host-derived parts need SSH or an evidence file to refresh; keep the last ones.
+        hosts = {h["id"] for h in previous.get("hosts") or []}
+        if hosts:
+            stack["hosts"] = previous["hosts"] + [h for h in stack.get("hosts") or [] if h["id"] not in hosts]
+            stack["runtimes"] += [r for r in previous.get("runtimes") or [] if r.get("host") in hosts and r not in stack["runtimes"]]
+            stack["components"] += [c for c in previous.get("components") or [] if c.get("scope") == "os" and c not in stack["components"]]
+            stack["images"] += [i for i in previous.get("images") or [] if i.get("host") in hosts and i not in stack["images"]]
+            stack["sources"] += [s for s in previous.get("sources") or [] if s["kind"] == "runtime-inventory" and s not in stack["sources"]]
+            stack["hash"] = "sha256:" + core.sha256_bytes(core.canonical_json([stack["components"], stack["runtimes"], stack.get("wordpress"), stack["images"]]).encode())
+            core.write_json(path, stack)
+    return stack
+
+
+def configure(parser) -> None:
+    parser.add_argument("--lockfile", action="append", help="extra lockfile/manifest outside the scanned tree (repeatable)")
+    parser.add_argument("--wordpress", help="WordPress root when not under the project")
+    parser.add_argument("--wp-cli-json", help="output of `wp plugin list --format=json` for active state")
+    parser.add_argument("--host-evidence", action="append",
+                        help="ALIAS=FILE: output of --print-collector, runtime-inventory JSON, or a copied dpkg status file (repeatable)")
+    parser.add_argument("--ssh", action="append", help="ALIAS=user@host: run the read-only collector over SSH (needs ssh-read consent)")
+    parser.add_argument("--site-type", choices=["static", "wordpress", "node-app", "php-app", "python-app", "java-app", "go-app", "ruby-app",
+                                                "dotnet-app", "astro", "workers", "unknown"])
+    parser.add_argument("--domain", action="append", help="site domain (repeatable)")
+    parser.add_argument("--watch-product", action="append", help="extra product name for CVE records without a package id")
+    parser.add_argument("--no-scan", action="store_true", help="only use the explicit inputs, do not scan the project tree")
+    parser.add_argument("--print", action="store_true", help="print the stack instead of writing stack.json")
+    parser.add_argument("--print-collector", action="store_true", help="print the read-only host collector script and exit")
+    parser.add_argument("--export-upload", help="also write the stack-upload payload for the hosted daily watch to this file (names and versions only)")
+    parser.add_argument("--workspace", help="CMO.so workspace (domain) for --export-upload")
+
+
+def upload_payload(stack: dict, workspace: str) -> dict:
+    """Only names and versions leave the machine (PRD 11 section 9): no paths, hostnames, lockfiles or logs."""
+    components = [{"ecosystem": c["ecosystem"], "name": c["name"], "version": c["version"], "scope": c.get("scope") or "runtime",
+                   "direct": c.get("direct")} for c in stack["components"]]
+    runtimes = [{"name": r["name"], "version": r["version"], "host": r.get("host") if r.get("host") and re.fullmatch(r"[a-z0-9-]{1,40}", r["host"]) else None}
+                for r in stack["runtimes"]]
+    wordpress = None
+    if stack.get("wordpress"):
+        wp = stack["wordpress"]
+        wordpress = {"core": wp.get("core"), "plugins": [{"slug": p["slug"], "version": p.get("version"), "active": p.get("active")} for p in wp.get("plugins") or []],
+                     "themes": [{"slug": t["slug"], "version": t.get("version"), "active": t.get("active")} for t in wp.get("themes") or []]}
+    body = {"components": components, "runtimes": runtimes, "wordpress": wordpress}
+    return {"schema": "maggie-security-stack-upload.v1", "workspace": workspace, "site_type": stack["site"].get("type") or "unknown",
+            "created_at": core.iso(), "hash": "sha256:" + core.sha256_bytes(core.canonical_json(body).encode()), **body,
+            "watch": (stack.get("watch") or {}).get("products") or []}
+
+
+def run(ctx: core.Context) -> dict:
+    if ctx.args.print_collector:
+        return {"_raw": SECURITY_COLLECTOR}
+    result = build(ctx)
+    if ctx.args.export_upload:
+        stack = result.get("stack") or core.read_json(ctx.state.path("inventory", "stack.json"))
+        workspace = ctx.args.workspace or (ctx.state.config().get("domains") or [ctx.site])[0]
+        payload = upload_payload(stack, workspace)
+        errors = core.validate_contract(payload, "stack-upload-v1")
+        if errors:
+            raise core.UsageError("upload payload failed its contract: " + "; ".join(errors[:5]))
+        out = Path(ctx.args.export_upload)
+        core.write_json(out, payload)
+        result["upload"] = {"path": str(out), "components": len(payload["components"]), "runtimes": len(payload["runtimes"]),
+                            "sends": "package, runtime and WordPress plugin/theme names and versions only",
+                            "never_sends": ["file paths", "host names or IPs", "lockfile contents", "logs", "secrets", "findings"]}
+    return result