fad-checker 2.2.0 → 2.2.2

package/lib/retire.js

@@ -36,15 +36,38 @@ const RETIRE_SIG_DIR = path.join(os.homedir(), ".fad-checker", "retire-signature
 const RETIRE_SIG_FILE = path.join(RETIRE_SIG_DIR, "jsrepository-v5.json");
 const RETIRE_REPO_URL = "https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository-v5.json";
 
+// retire always emits ABSOLUTE file paths (it resolves --jspath). Make them
+// relative to the scan root robustly — resolving BOTH sides so it works whether
+// the caller passed -s as a relative ("./proj") or absolute path. The old
+// `file.startsWith(srcDir)` guard silently left paths absolute for a relative -s.
+function relToSrc(srcDir, file) {
+	if (!file) return file;
+	if (!srcDir) return file;
+	try {
+		const rel = path.relative(path.resolve(srcDir), path.resolve(file));
+		return rel && !rel.startsWith("..") ? rel : file;
+	} catch { return file; }
+}
+
 function cacheKey(srcDir) {
 	return crypto.createHash("md5").update(path.resolve(srcDir)).digest("hex") + ".json";
 }
 
+// Cache schema version. Bumped to 2 when retire started running with `--verbose`
+// (so the cached body carries the FULL vendored-JS inventory, not just vulnerable
+// hits). A cached entry without `_schema >= 2` was written by a pre-verbose build
+// (e.g. 1.0.6) and its body holds vuln-only data — trusting it would silently empty
+// the inventory chapter (1D) on an offline re-run. We treat such an entry as a
+// cache MISS so the normal path re-scans (online, or offline with local signatures)
+// and the offline report reproduces the online one.
+const RETIRE_CACHE_SCHEMA = 2;
+
 function readCache(srcDir) {
 	const p = path.join(RETIRE_CACHE_DIR, cacheKey(srcDir));
 	if (!fs.existsSync(p)) return null;
 	try {
 		const data = JSON.parse(fs.readFileSync(p, "utf8"));
+		if (!(data._schema >= RETIRE_CACHE_SCHEMA)) return null; // legacy / pre-verbose → re-scan
 		if (Date.now() - data._fetchedAt < RETIRE_CACHE_TTL_MS) return data.body;
 	} catch { /* ignore */ }
 	return null;
@@ -53,7 +76,7 @@ function readCache(srcDir) {
 function writeCache(srcDir, body) {
 	fs.mkdirSync(RETIRE_CACHE_DIR, { recursive: true });
 	fs.writeFileSync(path.join(RETIRE_CACHE_DIR, cacheKey(srcDir)),
-		JSON.stringify({ _fetchedAt: Date.now(), body }));
+		JSON.stringify({ _schema: RETIRE_CACHE_SCHEMA, _fetchedAt: Date.now(), body }));
 }
 
 function findRetireBin() {
@@ -62,6 +85,28 @@ function findRetireBin() {
 	return "retire"; // fall back to PATH
 }
 
+// Decide HOW to launch retire. The compiled (bun) binary has no node_modules to
+// spawn the retire CLI from and the air-gapped box has no `retire` on PATH — so it
+// re-execs ITSELF with __FAD_RETIRE__ set, and the entry point (fad-checker.js)
+// hands off to the statically-bundled retire CLI. Pure for testability.
+//   - localBin present (node dev / node_modules) → run it directly.
+//   - else running under bun (compiled binary)   → self-invoke this executable.
+//   - else                                       → `retire` on PATH (last resort).
+function chooseRetireLauncher({ localBin, isBun, execPath }) {
+	if (localBin) return { cmd: localBin, env: null };
+	if (isBun) return { cmd: execPath, env: { __FAD_RETIRE__: "1" } };
+	return { cmd: "retire", env: null };
+}
+
+function findRetireLauncher() {
+	const local = path.join(__dirname, "..", "node_modules", ".bin", "retire");
+	return chooseRetireLauncher({
+		localBin: fs.existsSync(local) ? local : null,
+		isBun: !!(process.versions && process.versions.bun),
+		execPath: process.execPath,
+	});
+}
+
 /**
  * Fetch retire's signature DB to a stable file inside ~/.fad-checker/ so it can
  * be bundled by --export-cache and reused offline via --jsrepo. Network call —
@@ -117,6 +162,19 @@ function buildRetireArgs({ srcDir, outPath, ignoredDirs, jsRepo }) {
 
 const SEV_RANK = { critical: 5, high: 4, medium: 3, low: 2, none: 1 };
 
+// Pick the human-meaningful line out of retire's stderr for a failure message.
+// retire dumps a multi-line stack trace; the useful part is the first non-empty,
+// non-stack-frame line (preferring an ENOENT / "no such file" / permission line).
+function retireFailureReason(stderr, fallback) {
+	const lines = String(stderr || "")
+		.split("\n")
+		.map(l => l.trim())
+		.filter(l => l && !/^at\s/.test(l));
+	if (!lines.length) return fallback;
+	const hot = lines.find(l => /ENOENT|no such file|permission denied|EACCES/i.test(l));
+	return hot || lines[0];
+}
+
 /**
  * Extract the full inventory of identified vendored JS libraries (vulnerable or
  * not) from retire's --verbose output. Each entry: the standalone library, where
@@ -131,7 +189,7 @@ function extractVendoredInventory(raw, srcDir) {
 	const files = Array.isArray(raw) ? raw : (raw.data || []);
 	for (const f of files) {
 		const file = f.file;
-		const relFile = srcDir && file?.startsWith(srcDir) ? path.relative(srcDir, file) : file;
+		const relFile = relToSrc(srcDir, file);
 		for (const res of f.results || []) {
 			if (!res.component) continue;
 			const vulns = res.vulnerabilities || [];
@@ -169,6 +227,10 @@ function extractVendoredInventory(raw, srcDir) {
  */
 async function runRetire(srcDir, opts = {}) {
 	const { verbose, force, offline } = opts;
+	// Optional diagnostics collector: callers (scanWithRetireFull) read diag.error to
+	// surface a genuine SCAN FAILURE (retire crashed / produced no parseable output)
+	// as a report warning — instead of letting it masquerade as "no vendored JS found".
+	const diag = opts.diag || {};
 	// No source tree (e.g. --import-anonymized) → nothing to scan for vendored JS.
 	if (!srcDir) { if (verbose) console.warn("retire: no source dir — skipped"); return null; }
 	// Findings-cache fast path (path-keyed). Works online and offline.
@@ -189,7 +251,7 @@ async function runRetire(srcDir, opts = {}) {
 		return null;
 	}
 
-	const bin = findRetireBin();
+	const launcher = findRetireLauncher();
 	const ignoredDirs = [
 		"node_modules", "bower_components", "jspm_packages",
 		".git", ".idea", ".vscode", ".gradle", ".mvn",
@@ -202,15 +264,27 @@ async function runRetire(srcDir, opts = {}) {
 	const args = buildRetireArgs({ srcDir, outPath: tmpOut, ignoredDirs, jsRepo: haveSig ? RETIRE_SIG_FILE : null });
 	if (verbose) console.log(`retire: scanning ${srcDir}…${haveSig ? " (local signatures)" : ""}`);
 
+	let execErr = null;
 	try {
 		// retire.js exits with code 13 when it finds vulnerabilities — that's
 		// expected. Catch and ignore the non-zero exit; the JSON file is still
 		// produced.
-		await execFileP(bin, args, { maxBuffer: 1024 * 1024 * 64 });
+		await execFileP(launcher.cmd, args, {
+			maxBuffer: 1024 * 1024 * 64,
+			env: launcher.env ? { ...process.env, ...launcher.env } : process.env,
+		});
 	} catch (err) {
-		// exit code 13 (or anything where the output file exists) is OK
-		if (!fs.existsSync(tmpOut)) {
-			if (verbose) console.warn(`retire: failed to run — ${err.message}`);
+		execErr = err;
+		// exit code 13 (or anything where a non-empty output file exists) is OK.
+		// A missing OR empty (0-byte) output file means retire crashed mid-walk
+		// (e.g. ENOENT on the source path, an unreadable file) — a real failure.
+		let size = -1;
+		try { size = fs.statSync(tmpOut).size; } catch { /* missing */ }
+		if (size <= 0) {
+			const reason = retireFailureReason(err.stderr, err.message);
+			diag.error = `retire.js scan failed: ${reason}`;
+			if (verbose) console.warn(`retire: failed to run — ${reason}`);
+			try { fs.unlinkSync(tmpOut); } catch { /* best effort */ }
 			return null;
 		}
 	}
@@ -220,6 +294,8 @@ async function runRetire(srcDir, opts = {}) {
 		const body = fs.readFileSync(tmpOut, "utf8");
 		parsed = JSON.parse(body);
 	} catch (err) {
+		const reason = retireFailureReason(execErr && execErr.stderr, err.message);
+		diag.error = `retire.js scan failed: ${reason}`;
 		if (verbose) console.warn(`retire: could not parse output — ${err.message}`);
 		return null;
 	} finally {
@@ -262,7 +338,7 @@ function normaliseRetireResults(raw, srcDir) {
 	const files = Array.isArray(raw) ? raw : (raw.data || []);
 	for (const f of files) {
 		const file = f.file;
-		const relFile = srcDir && file?.startsWith(srcDir) ? path.relative(srcDir, file) : file;
+		const relFile = relToSrc(srcDir, file);
 		for (const res of f.results || []) {
 			const component = res.component;
 			const version = res.version;
@@ -319,11 +395,13 @@ async function scanWithRetire(srcDir, opts = {}) {
  * JavaScript"). One retire run feeds both.
  */
 async function scanWithRetireFull(srcDir, opts = {}) {
-	const raw = await runRetire(srcDir, opts);
-	if (!raw) return { matches: [], inventory: [] };
+	const diag = {};
+	const raw = await runRetire(srcDir, { ...opts, diag });
+	if (!raw) return { matches: [], inventory: [], error: diag.error || null };
 	return {
 		matches: normaliseRetireResults(raw, srcDir),
 		inventory: extractVendoredInventory(raw, srcDir),
+		error: null,
 	};
 }
 
@@ -334,9 +412,16 @@ module.exports = {
 	runRetire,
 	normaliseRetireResults,
 	findRetireBin,
+	findRetireLauncher,
+	chooseRetireLauncher,
 	warmRetireSignatures,
 	ensureSignatures,
 	buildRetireArgs,
+	retireFailureReason,
+	readCache,
+	writeCache,
+	cacheKey,
+	RETIRE_CACHE_SCHEMA,
 	RETIRE_CACHE_DIR,
 	RETIRE_SIG_DIR,
 	RETIRE_SIG_FILE,

package/lib/scan-completeness.js

@@ -53,15 +53,24 @@ function detectScanCompletenessWarnings(resolvedDeps, opts = {}) {
 	}
 
 	if (unresolved.length) {
-		// Dedupe by g:a (same coord may appear in several modules)
-		const seenKeys = new Set();
-		const items = [];
+		// Dedupe by g:a (same coord may appear in several modules), MERGING the
+		// manifest paths so the report can show WHERE each unresolved dep is declared.
+		// Items are objects ({ id, manifestPaths }) — renderWarningItems() renders the
+		// "defined in: <pom.xml>" line for that shape (same as the private-libs warning).
+		const byKey = new Map();
 		for (const d of unresolved) {
 			const k = `${d.groupId}:${d.artifactId}`;
-			if (seenKeys.has(k)) continue;
-			seenKeys.add(k);
-			items.push(`${k}${d.version ? " (" + d.version + ")" : " (no version resolved)"}`);
+			const paths = (d.manifestPaths && d.manifestPaths.length) ? d.manifestPaths
+				: (d.pomPaths && d.pomPaths.length) ? d.pomPaths
+				: [];
+			let entry = byKey.get(k);
+			if (!entry) {
+				entry = { id: `${k}${d.version ? " (" + d.version + ")" : " (no version resolved)"}`, manifestPaths: [] };
+				byKey.set(k, entry);
+			}
+			for (const p of paths) if (!entry.manifestPaths.includes(p)) entry.manifestPaths.push(p);
 		}
+		const items = [...byKey.values()];
 		warnings.push({
 			type: "unresolved-versions",
 			count: items.length,

package/lib/transitive.js

@@ -183,12 +183,18 @@ function resolveProps(value, props, builtins, depth = 0) {
 async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
 	const key = `${g}:${a}:${v}`;
 	if (seen.has(key)) return null;
+	// Opt-in cross-call memo (used by the per-module overlay, which resolves the
+	// same shared parents/BOMs once per module). Immutable POMs → the effective
+	// result for a g:a:v is stable, so caching the finished object is safe; callers
+	// only READ eff.depMgmt/eff.deps. Only active when opts.effCache is supplied,
+	// so existing single-shot callers are byte-for-byte unchanged.
+	if (opts.effCache && opts.effCache.has(key)) return opts.effCache.get(key);
 	seen.add(key);
 
 	const xml = await fetchPom(g, a, v, opts);
-	if (!xml) return null;
+	if (!xml) { if (opts.effCache) opts.effCache.set(key, null); return null; }
 	const pom = await parsePomXml(xml);
-	if (!pom) return null;
+	if (!pom) { if (opts.effCache) opts.effCache.set(key, null); return null; }
 
 	let merged = {
 		groupId: pom.groupId,
@@ -243,6 +249,7 @@ async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
 	}
 	merged.depMgmt = expanded;
 
+	if (opts.effCache) opts.effCache.set(key, merged);
 	return merged;
 }
 

package/lib/ui.js

@@ -17,11 +17,12 @@ const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇",
 const TITLE_A = "fad-checker";
 const TITLE_B = "Autonomous Dependency Checker";
 
-function banner() {
-	const raw = `${TITLE_A} · ${TITLE_B}`;
+function banner(version) {
+	const ver = version ? `v${version}` : "";
+	const raw = `${TITLE_A} ${ver} · ${TITLE_B}`.replace("  ", " ");
 	const bar = "─".repeat(raw.length + 2);
 	console.log(chalk.cyan(`\n╭${bar}╮`));
-	console.log(chalk.cyan("│ ") + chalk.bold.white(TITLE_A) + chalk.cyan(" · ") + chalk.whiteBright(TITLE_B) + chalk.cyan(" │"));
+	console.log(chalk.cyan("│ ") + chalk.bold.white(TITLE_A) + (ver ? " " + chalk.dim(ver) : "") + chalk.cyan(" · ") + chalk.whiteBright(TITLE_B) + chalk.cyan(" │"));
 	console.log(chalk.cyan(`╰${bar}╯`));
 }
 

package/lib/version-overlay.js

@@ -0,0 +1,193 @@
+/**
+ * lib/version-overlay.js — recover transitive dependency versions that Maven's
+ * PER-MODULE mediation keeps but fad's GLOBAL transitive pass masks.
+ *
+ * The problem: `expandWithTransitives` (cve-match.js) resolves the whole reactor as
+ * ONE tree with ONE global `rootDepMgmt` (the highest version of every coord seen
+ * anywhere). So a `<dependencyManagement>` pin in module A is force-applied to a
+ * transitive of the unrelated module B — e.g. `controller` pins poi 5.4.1 and the
+ * stress-tests island's `jmeter → poi 3.11` gets rewritten to 5.4.1, hiding
+ * CVE-2017-12626. Maven applies depMgmt only inside the subtree that declares it.
+ *
+ * The fix (additive overlay): keep the global pass UNCHANGED as the base (no
+ * regression), then re-resolve EACH module independently with ONLY that module's
+ * own effective depMgmt (its local parent chain + its external parent/import-BOMs),
+ * and APPEND any (g:a, version) it finds that isn't already in the coord's
+ * `versions[]`. Never removes, never reseeds — so it can only ADD coverage, and the
+ * per-module version it finds is the one genuinely on that module's classpath
+ * (so it's a true positive, not a force-elevated one).
+ *
+ * Offline-aware (cache-first via transitive.js#fetchPom) and memoised across modules
+ * with a shared `effCache` so 25 modules stay fast.
+ */
+const core = require("./core");
+const { resolveTransitiveDeps, effectivePom } = require("./transitive");
+const { resolveDepVersion } = require("./cve-match");
+
+const coord = core.coord;
+const isConcrete = v => v != null && !/\$\{/.test(String(v));
+
+/** xml2js dependency node → flat descriptor (groupId/artifactId/version/scope/…). */
+function flattenDep(d) {
+	return {
+		groupId: coord(d.groupId?.[0]),
+		artifactId: coord(d.artifactId?.[0]),
+		rawVersion: coord(d.version?.[0]),
+		scope: coord(d.scope?.[0]) || "compile",
+		optional: d.optional?.[0] === "true",
+		isImport: d.scope?.[0] === "import",
+		exclusions: (d.exclusions?.[0]?.exclusion || []).map(e => ({
+			groupId: coord(e.groupId?.[0]),
+			artifactId: coord(e.artifactId?.[0]),
+		})),
+	};
+}
+
+/**
+ * Walk a module's LOCAL parent chain (child first). Stops at the first external
+ * parent (one not present in the source tree) and reports it separately, so the
+ * caller can resolve its managed table from Maven Central.
+ * @returns { chain: [pomPath, parentPath, …], externalParent: {groupId,artifactId,version}|null }
+ */
+function localChain(pomPath, store) {
+	const chain = [];
+	const seen = new Set();
+	let cur = pomPath;
+	let externalParent = null;
+	while (cur && !seen.has(cur)) {
+		seen.add(cur);
+		chain.push(cur);
+		const meta = store.byPath[cur];
+		if (!meta) break;
+		const parentPath = core.resolveParentPath(cur, meta.parentInfo, store);
+		if (!parentPath) {
+			const p = meta.parentInfo;
+			if (p?.groupId && p?.artifactId && p?.version) externalParent = { groupId: p.groupId, artifactId: p.artifactId, version: p.version };
+			break;
+		}
+		cur = parentPath;
+	}
+	return { chain, externalParent };
+}
+
+/**
+ * Build the EFFECTIVE managed-version map for ONE module — exactly the depMgmt that
+ * Maven would apply when resolving THIS module's dependencies, and no other module's.
+ * Closest-declared pin wins (set-if-absent while climbing child → parent).
+ *
+ * Sources, in precedence order:
+ *   1. each local pom in the parent chain's own <dependencyManagement> (local
+ *      scope=import BOMs are already expanded inline by core.getAllInheritedProps);
+ *   2. the chain's external <parent> (e.g. spring-boot-starter-parent) managed table;
+ *   3. external scope=import BOMs (e.g. spring-boot-dependencies) declared in the chain.
+ * @returns Map<"g:a", version>
+ */
+async function buildModuleManagement(pomPath, store, propsByPom, opts = {}) {
+	const map = new Map();
+	const setIf = (k, v) => { if (k && isConcrete(v) && !map.has(k)) map.set(k, String(v)); };
+	const { chain, externalParent } = localChain(pomPath, store);
+	const externalBoms = [];
+
+	for (const pom of chain) {
+		const entry = propsByPom[pom];
+		if (!entry) continue;
+		const props = entry.properties || {};
+		for (const node of entry.dependencyManagement || []) {
+			const g = coord(node.groupId?.[0]);
+			const a = coord(node.artifactId?.[0]);
+			if (!g || !a) continue;
+			const v = resolveDepVersion(coord(node.version?.[0]), props);
+			if (node.scope?.[0] === "import") {
+				// Local import BOMs are already expanded inline by getAllInheritedProps;
+				// only chase EXTERNAL ones (not present in the source tree).
+				const local = (v && store.byId[`${g}:${a}:${v}`]) || store.byId[`${g}:${a}`];
+				if (!local && isConcrete(v)) externalBoms.push({ groupId: g, artifactId: a, version: v });
+				continue;
+			}
+			setIf(`${g}:${a}`, v);
+		}
+	}
+
+	// External parent + external import BOMs: pull their managed tables from Maven
+	// Central (cache-first, memoised). Closest local pins already set win.
+	const externals = externalParent ? [externalParent, ...externalBoms] : externalBoms;
+	for (const ext of externals) {
+		let eff = null;
+		try { eff = await effectivePom(ext.groupId, ext.artifactId, ext.version, opts); } catch { eff = null; }
+		if (eff?.depMgmt) for (const d of eff.depMgmt) setIf(`${d.groupId}:${d.artifactId}`, d.version);
+	}
+	return map;
+}
+
+/**
+ * The direct dependencies declared by ONE module, with concrete versions resolved
+ * (own ${properties} → module's managed map → the global resolved version). These
+ * seed the per-module transitive walk.
+ */
+function buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, opts = {}) {
+	const entry = propsByPom[pomPath];
+	if (!entry) return [];
+	const props = entry.properties || {};
+	const out = [];
+	for (const node of entry.dependencies || []) {
+		const d = flattenSafe(node);
+		if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
+		if (d.scope === "test" && !opts.includeTestDeps) continue;
+		if (d.scope === "system" || d.scope === "import") continue;
+		let v = resolveDepVersion(d.rawVersion, props);
+		if (!isConcrete(v)) v = moduleMgmt.get(`${d.groupId}:${d.artifactId}`) || resolvedDeps.get(`${d.groupId}:${d.artifactId}`)?.version || null;
+		if (!isConcrete(v)) continue;
+		out.push({ groupId: d.groupId, artifactId: d.artifactId, version: String(v), scope: d.scope, exclusions: d.exclusions });
+	}
+	return out;
+}
+// flattenSafe guards against malformed nodes (xml2js can yield odd shapes).
+function flattenSafe(node) { try { return flattenDep(node); } catch { return null; } }
+
+/**
+ * Additive per-module overlay. Mutates `resolvedDeps`: for every coord already in
+ * the scan set, appends any concrete version found by a faithful per-module
+ * resolution that the global pass masked. Returns a small diagnostics object incl.
+ * the (g:a, version) pairs recovered (used for the false-positive measurement).
+ */
+async function expandPerModuleOverlay(resolvedDeps, store, propsByPom, opts = {}) {
+	if (!store || !propsByPom) return { appended: 0, modules: 0, recovered: [] };
+	const effCache = opts.effCache || new Map();
+	const tOpts = { ...opts, effCache };
+	const recovered = [];
+	let modules = 0;
+
+	for (const pomPath of Object.keys(propsByPom)) {
+		const moduleMgmt = await buildModuleManagement(pomPath, store, propsByPom, tOpts);
+		const directs = buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, tOpts);
+		if (!directs.length) continue;
+		modules++;
+
+		let trans;
+		try {
+			trans = await resolveTransitiveDeps(directs, {
+				...tOpts,
+				rootDepMgmt: moduleMgmt,
+				maxDepth: opts.maxDepth || 6,
+				includedScopes: ["compile", "runtime", "provided"],
+			});
+		} catch { continue; }
+
+		for (const [key, t] of trans) {
+			const v = t.version;
+			if (!isConcrete(v)) continue;
+			const existing = resolvedDeps.get(key);
+			if (!existing) continue;                               // additive to coords already scanned
+			if (existing.provenance === "embedded" || existing.provenance === "binary") continue;
+			if (!Array.isArray(existing.versions)) existing.versions = isConcrete(existing.version) ? [existing.version] : [];
+			if (existing.versions.includes(String(v))) continue;   // already scanned this version
+			existing.versions.push(String(v));
+			existing.maskedVersions = existing.maskedVersions || [];
+			existing.maskedVersions.push({ version: String(v), via: t.via, viaPaths: t.viaPaths, module: pomPath, depth: t.depth });
+			recovered.push({ coord: key, version: String(v), module: pomPath, had: existing.version });
+		}
+	}
+	return { appended: recovered.length, modules, recovered };
+}
+
+module.exports = { expandPerModuleOverlay, buildModuleManagement, buildModuleDirects, localChain };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",