cbom-tools 0.1.0 → 0.1.1

package/README.md

@@ -40,6 +40,19 @@ Exit codes:
 - `0` — no changes
 - `1` — changes detected
 - `2` — file not found or parse error
+- `3` — (reserved) quantum-vulnerable/weak algorithm detection (planned for 0.2.0)
+
+## Testing
+
+```
+npm test
+```
+
+17 CLI contract tests (Node built-in `node:test`, zero dependencies):
+both binaries are spawned as child processes and checked against edge
+inputs — empty directory, dependencies-only, source-only, an 800-file
+tree (occurrence cap, `node_modules` / `.git` / dotfile skipping),
+unreachable directories, missing argument values, and malformed JSON.
 
 ## Example (real output)
 

package/cbom-diff.js

@@ -17,7 +17,7 @@
  *   0 — 无变更
  *   1 — 有信息性变更（算法属性升级等）
  *   2 — 有警告性变更（算法删除、新经典算法引用等）
- *   3 — 有严重变更（量子脆弱算法被引入）
+ *   3 — (reserved) 量子脆弱/弱算法引入检测（0.2.0 规划）
  */
 
 const { execSync } = require('child_process');
@@ -55,7 +55,12 @@ function loadCBOM(hash) {
       console.error(`✕ cbom-diff: file not found: ${filePath}`);
       process.exit(2);
     }
-    return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+    try {
+      return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+    } catch (e) {
+      console.error(`✕ cbom-diff: invalid JSON in ${filePath}: ${e.message}`);
+      process.exit(2);
+    }
   }
   // 2. Git mode
   if (gitMode) {
@@ -121,7 +126,7 @@ if (oldCBOM && newCBOM) {
         ref,
         name: c.name,
         type: assetType,
-        risk: classifyRisk(assetType),
+        risk: classifyRisk(crypto),
       });
     }
   });
@@ -206,8 +211,8 @@ if (hasCriticalAdd) {
 // ════════════════════════════
 // 算法风险分类
 // ════════════════════════════
-function classifyRisk(assetType) {
-  const type = (assetType || '').toLowerCase();
+function classifyRisk(cryptoProps) {
+  const type = ((cryptoProps && cryptoProps.assetType) || '').toLowerCase();
   // PQC algorithms: safe additions
   if (/kem|sign|signature|post.quantum|pqc|mlkem|mldsa|slh/i.test(type)) return 'info';
   // Primitive/verification: neutral
@@ -216,6 +221,8 @@ function classifyRisk(assetType) {
   if (/ecc|ecdh|p-256|sm2|curve/i.test(type)) return 'warning';
   // Classic symmetric: info (still safe with large keys)
   if (/sym|sm4|aes|gcm/i.test(type)) return 'info';
+  // TODO(v0.2.0): add 'critical' exit code for quantum-vulnerable algorithms
+  // using cryptoProps.quantumSecurity?.level
   // Unknown: treat as warning
   return 'warning';
 }

package/cbom-scan.cjs

@@ -146,7 +146,16 @@ function toCycloneDX(algorithms) {
 
 function main() {
  const args = process.argv.slice(2);
- const dir = args.includes('--dir') ? args[args.indexOf('--dir') + 1] : process.cwd();
+ const dirFlag = args.indexOf('--dir');
+ let dir = process.cwd();
+ if (dirFlag !== -1) {
+   const v = args[dirFlag + 1];
+   if (!v || v.startsWith('--')) {
+     console.error('usage: cbom-scan [--dir <path>] [--out <file>]');
+     process.exit(2);
+   }
+   dir = v;
+ }
  const outPath = args.includes('--out') ? args[args.indexOf('--out') + 1] : null;
 
  const deps = loadPackageDeps(dir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cbom-tools",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Crypto Bill of Materials — scan, diff, report (CycloneDX 1.6 CBOM)",
   "license": "Apache-2.0",
   "author": "刘天赫 <research@fibemate.net>",
@@ -14,5 +14,8 @@
     "algo-metadata.json",
     "README.md",
     "LICENSE"
-  ]
+  ],
+  "scripts": {
+    "test": "node --test \"test/*.test.cjs\""
+  }
 }