penthera 1.8.0-rc.1 → 1.8.1

package/CHANGELOG.md

@@ -4,6 +4,152 @@ All notable changes to Penthera are documented here. Versioning follows [SemVer]
 
 ## [Unreleased]
 
+## [1.8.1] - 2026-10-22
+
+A fixes-only release. Runtime advisories are more careful: pre-release builds
+are never reported as having the fix, a banner without a distribution token is
+at most `potential`, release lines older than a flaw are not reported as
+affected, and two more banner formats are read. `penthera ui` now stops
+cleanly under `npx`.
+
+### Fixed
+
+- Runtime advisories no longer claim `likely` for a banner that may be a
+  patched distribution package. Debian 11 to 13, Ubuntu 24.04 and later, and
+  RHEL print plain upstream PHP versions, so a patched Ubuntu 24.04
+  `X-Powered-By: PHP/8.3.6` behind nginx or a CDN was reported as critical
+  and likely affected. For PHP, Apache httpd, nginx, Python and OpenSSL,
+  "affected" and "end of life" findings from a banner with no distribution
+  token are now `potential`, with a "check on server" note and the check
+  command. Severity is unchanged. Official images and version files are
+  upstream builds and stay `likely`. Found by the runtime-strings test set
+  (L1 in [#97](https://github.com/danoszz/penthera/pull/97)).
+
+- Runtime advisories resolve Node.js LTS codenames to their release line:
+  nvm's `lts/iron` in `.nvmrc` and the node image's `iron`, `jod-alpine`
+  and `hydrogen` tags. They read as no version before, so `lts/iron` (Node.js
+  20, end of life 30 April 2026) went unreported. Found by the
+  runtime-strings test set (B4 in
+  [#97](https://github.com/danoszz/penthera/pull/97)).
+- Runtime advisories read aiohttp's `Server: Python/3.9 aiohttp/3.8.6`.
+  aiohttp prints only the Python release line, and the banner pattern needed
+  x.y.z, so an end-of-life Python behind aiohttp went unreported. Found by
+  the runtime-strings test set (B3 in
+  [#97](https://github.com/danoszz/penthera/pull/97)).
+- Runtime advisories honour `introduced` on older release lines. CVE-2021-41773
+  and CVE-2021-42013 exist only in httpd 2.4.49 and 2.4.50. Yet
+  `Apache/2.2.34` and `httpd:2.2` were reported critical, "end of life, no
+  fix", and CentOS 6's `Apache/2.2.15 (CentOS)` was "check on server". A line
+  older than the one the flaw was introduced on now gets no verdict for it.
+  The end-of-life finding stays. Found by the runtime-strings test set (B1 in
+  [#97](https://github.com/danoszz/penthera/pull/97)).
+- Runtime advisories read pre-releases correctly. `PHP/8.4.27-dev`, a PHP-8.4
+  branch build from before 8.4.27, was taken for a distribution build of
+  8.4.27 and reported as having the 21 October fix. Now `-dev`, alpha, beta
+  and RC builds (`8.5.0RC1`, `3.15.0rc1`, `4.1.0-beta2`, `php:8.6.0RC4-fpm`)
+  sort below their release, so a pre-release of the fixed version is
+  affected. A pre-release of the version after the fix (`8.4.28-dev`) is
+  "check on server", never "has the fix". Found by the runtime-strings test set
+  (B2 in [#97](https://github.com/danoszz/penthera/pull/97)).
+- **`npx penthera ui` stops cleanly on Ctrl-C and SIGTERM.** npm forwards
+  the signal to penthera right after the terminal delivered it, and the
+  second copy could kill the dashboard before it printed "Stopped." and
+  closed its server. Repeated signals are now ignored while it stops. This
+  was the intermittent macOS failure in the install-matrix smoke check.
+
+### Site
+
+- penthera.org counts anonymous page views and load times with Vercel Web
+  Analytics and Speed Insights (cookieless, served from the same origin). The
+  CSP now allows connections only to those two paths on penthera.org; the
+  browser check still sends nothing, and the page says so. The CLI, the
+  dashboard and the npm package have no telemetry, unchanged.
+
+### Docs
+
+- The PHP case study and `docs/runtime-advisories.md` cite OpenAI's
+  php2shell-checker as an independent cross-check. A test pins that Penthera
+  agrees with its table on all 14 PHP branches.
+- The website is live at [penthera.org](https://penthera.org): the README links
+  it, and the npm package's homepage points to it from the next release.
+
+## [1.8.0] - 2026-10-21
+
+1.8.0 is 1.8.0-rc.1 plus the changes below; there was no separate rc.2
+release. Highlights across both: fixes from a second independent security
+review, a fix loop that cannot edit the tests that judge it, the redesigned
+dashboard (Simple and Advanced mode), release checks on Linux, macOS and
+Windows, and now runtime advisories, starting with PHP's critical security
+release of 21 October 2026, in a new signed `advisories` rule pack (1.8.0-rc.1
+cannot load it). The benchmark gained two PHP cases: precision 0.88 (95% CI
+0.69 to 0.96) and recall 0.91 (0.73 to 0.98) on 24 scored findings.
+
+### Added
+
+- **Runtime advisories: is the PHP, Apache, nginx, Node.js, Python or OpenSSL
+  you run affected?** URL scans read `Server` and `X-Powered-By` banners, the
+  `PHPSESSID` cookie name and `.php` pages. Repo scans read Dockerfile and
+  compose images, `.tool-versions`, `.php-version`, `.nvmrc`,
+  `.python-version`, `runtime.txt` and `composer.json`. Each product and
+  version gets one answer: affected, end of life with no fix, check on server,
+  or has the fix (as advertised). A hidden version is never reported as safe.
+  A distribution build (`8.1.2-1ubuntu2.19`, or any version behind a `Server`
+  header that names a distribution) is never reported as affected, because
+  distributions backport fixes under the same version number. Advisories that
+  need more than a version (Windows, CGI) stay `potential`. See
+  [docs/runtime-advisories.md](docs/runtime-advisories.md).
+- **Two rule-pack kinds, `runtime-advisory` and `runtime-eol`**, so a new
+  advisory ships as a signed data pack (`--rules`) the same day, without a
+  release. End of life is judged by the pack's date, not the scan's clock.
+- **A bundled `advisories` pack** with the PHP security release of 21 October
+  2026 (CVE-2026-109618 and CVE-2026-109619, both Critical, CVSS 4.0 9.2,
+  fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, from the php-src advisories),
+  vendor-checked worked examples (CVE-2024-4577 and CVE-2024-8926 for PHP-CGI on Windows, CVE-2021-41773 and
+  CVE-2021-42013 for Apache HTTP Server 2.4.49 and 2.4.50) and end-of-life
+  release lines. Benchmark cases for both URL and repo scans.
+
+### Site
+
+- **A landing page in `site/`**, a static site for Vercel: the positioning,
+  `npx penthera`, prompts for Claude Code, Cursor and Codex, the hero loop and
+  the walkthrough, the limits and the research plan. No third-party scripts,
+  analytics or cookies; fonts are self-hosted or system fonts.
+- **A check in the browser.** Drop or paste a `package.json`, `.mcp.json`,
+  `.claude/settings.json`, `CLAUDE.md` or `AGENTS.md` and Penthera's own
+  `lib/` code runs in the tab: the agent-config rules, the secret patterns,
+  install scripts, typosquats against the vendored popular list, and the
+  bundled IOC pack. `site/build.mjs` bundles `lib/` at build time, so the site
+  and the CLI run the same rules; `tests/site.test.js` holds the page to the
+  CLI on the agents and deps fixtures. The page is served with
+  `connect-src 'none'`, so it cannot send the files anywhere.
+- **Runtime advisories in the browser check.** Drop a `Dockerfile`,
+  `compose.yaml`, `.php-version`, `.tool-versions` or `composer.json`, or
+  paste the response headers `curl -sI` printed for your site (the page never
+  contacts it), and `lib/advisories` runs on them: the same findings and
+  confidence as the CLI, with "check on the server: distributions backport
+  fixes" next to every version-only verdict. `tests/site.test.js` compares
+  pasted headers with a URL scan of a loopback server sending the same
+  headers, and runtime pins with `runtimeAdvisoriesForRepo`.
+- `penthera deps` findings are built in `lib/deps/findings.js` (moved from
+  `lib/deps/index.js`, no behaviour change), so the browser check uses the
+  same wording.
+- `scripts/docs-commands.mjs` also checks every command the site shows.
+
+### Docs
+
+- **New title for the launch:** "Penthera: your open-source cyber security
+  agent", in the README, docs index, `penthera --help`, the GitHub Action name
+  (which renames its Marketplace listing), the dashboard and the report
+  footer.
+
+- **README hero is a 12-second loop** of the terminal and the dashboard
+  (setup, an offline scan, Simple and Advanced mode, a fix approved), cut from
+  the walkthrough video by `scripts/media/hero-gif.sh`, and it loops without a
+  jump. The terminal-only scan clip is now `assets/demo-scan.gif`. The Demo
+  media workflow re-cuts the loop on every release.
+- **The README diagram is back**, updated: what Penthera checks, where the
+  findings go, and that the fix loop asks first and cannot edit its own tests.
+
 ## [1.8.0-rc.1] - 2026-10-20
 
 Release candidate for 1.8.0, published on npm's `next` dist-tag

package/README.md

@@ -1,10 +1,14 @@
 <div align="center">
 
-<img src="assets/penthera-social.jpg" alt="Penthera: Cyber Security Agent" width="840">
+<img src="assets/penthera-social.jpg" alt="Penthera: your open-source cyber security agent" width="840">
 
 <br/><br/>
 
-**Penthera: an open-source cyber security agent you can use today, and verify yourself.**
+**Penthera: your open-source cyber security agent**
+
+The security review you never had time for. Offline, rule-based, and you can verify every finding yourself.
+
+**[penthera.org](https://penthera.org)**: try the check in your browser. Nothing you paste leaves the page.
 
 <br/>
 
@@ -16,7 +20,7 @@
 
 <br/>
 
-<img src="assets/demo.gif" alt="Penthera running an interactive security scan in the terminal" width="760">
+<img src="assets/demo.gif" alt="A 12-second loop: npx penthera sets up a project, an offline scan runs in the terminal, the dashboard shows the verdict in Simple mode and the triage matrix in Advanced mode, and a fix is approved" width="760">
 
 <br/><br/>
 
@@ -89,6 +93,29 @@ Penthera needs Node.js 22 or later. To run it in a container:
 
 ## What it does
 
+```mermaid
+flowchart LR
+    U["You or your AI agent"] --> P(("Penthera<br/>on your machine"))
+
+    P --> APP["Your app<br/>URL scan, repo scan"]
+    P --> DEP["Your dependencies<br/>capabilities, install firewall<br/>typosquats, upgrade diff"]
+    P --> AI["Your AI tooling<br/>skills, MCP, hooks<br/>plugins, rule files"]
+
+    APP --> F[["Findings<br/>severity, confidence<br/>evidence at file:line"]]
+    DEP --> F
+    AI --> F
+
+    F --> FIX["Fix loop<br/>asks first, local branch<br/>cannot edit its own tests"]
+    FIX -. "re-scan proves it" .-> F
+    F --> R["Reports and dashboard<br/>terminal, Markdown, SARIF<br/>penthera ui"]
+    F --> E["Evidence<br/>signed bundle<br/>NIS2 and CRA drafts"]
+
+    classDef core fill:#0000ed,stroke:#0000ed,color:#ffffff
+    classDef box fill:#ffffff,stroke:#000000,color:#000000
+    class P core
+    class U,APP,DEP,AI,F,FIX,R,E box
+```
+
 ### Before you deploy
 
 | Job | What Penthera does | Command |
@@ -127,7 +154,7 @@ Each feature goes through the same path: **method → evidence → tool.**
 - **Method.** The [methodology](docs/METHODOLOGY.md) states the threat model,
   what black-box (HTTP) and white-box (source) analysis can and cannot see, the
   confidence model, and the false-positive controls on each probe. Each design
-  choice cites the research or standard it rests on: 57 verified references, in
+  choice cites the research or standard it rests on: 92 verified references, in
   APA style, in [docs/references.md](docs/references.md).
 - **Evidence.** A benchmark runs on every release, and the release gate fails
   if precision or recall drops by more than 0.02. Experiments that decide what
@@ -138,17 +165,17 @@ Each feature goes through the same path: **method → evidence → tool.**
 
 | Measure | Result today |
 |---|---|
-| Precision on the bundled benchmark | 0.86, 95% CI 0.67 to 0.95 (19 true positives, 3 false positives) |
-| Recall on the bundled benchmark | 0.90, 95% CI 0.71 to 0.97 (2 misses, [each one explained](bench/RESULTS.md)) |
+| Precision on the bundled benchmark | 0.88, 95% CI 0.69 to 0.96 (21 true positives, 3 false positives) |
+| Recall on the bundled benchmark | 0.91, 95% CI 0.73 to 0.98 (2 misses, [each one explained](bench/RESULTS.md)) |
 | Requests to non-loopback hosts during the benchmark | 0 |
 | Detection rules, all readable | 14 URL scan templates, 20 secret and AI-key patterns, 15 dependency capabilities, 39 AI-tooling rules, 5 fix recipes |
 
-These numbers come from 22 findings in small labs that we wrote ourselves, so
+These numbers come from 24 findings in small labs that we wrote ourselves, so
 they catch regressions; they do not measure real-world accuracy. Measuring that
 on real projects is experiment E1, the first step of the
 [research plan](docs/vision-2.0.md). Intervals are Wilson. What Penthera cannot
 see is listed under [Known limitations](docs/METHODOLOGY.md#known-limitations).
-Counts as of 2026-10-20; refresh them with `npm run docs:numbers` and
+Counts as of 2026-10-21; refresh them with `npm run docs:numbers` and
 `npm run bench`.
 
 **Cite this repository** with the button on GitHub or
@@ -240,9 +267,9 @@ What changed, what we are measuring, and what comes next, in one place.
 
 | | Where it stands | Read more |
 |---|---|---|
-| **Latest release** | 1.7.0 (2026-10-19): one-command setup (`npx penthera`), the dashboard, signed rule packs | [CHANGELOG](CHANGELOG.md) |
-| **On main, unreleased** | Fixes from a second independent security review, a fix loop that cannot edit the tests that judge it, release checks on Linux, macOS and Windows, docs tested as code | [Unreleased](CHANGELOG.md#unreleased) |
-| **Now** | 1.8.0 feature freeze: fixes only, a release candidate on npm's `next` tag first | [Roadmap: now](ROADMAP.md#now-180-feature-freeze) |
+| **Latest release** | 1.8.1 (2026-10-22): more careful runtime advisories (pre-releases, distribution builds, older lines) on top of 1.8.0's runtime advisories, security-review fixes and redesigned dashboard | [CHANGELOG](CHANGELOG.md) |
+| **On main, unreleased** | Toward 1.9: AI mode (opt-in, local model, rules verify), new detection rules, the E10 benchmark | [Unreleased](CHANGELOG.md#unreleased) |
+| **Now** | Toward 1.9: accuracy on real code (E1) and an MCP server, so coding agents can call Penthera | [Roadmap](ROADMAP.md#next) |
 | **Research** | E1, accuracy on real code, is pre-registered; the benchmark tooling is in review. After the 2026 agent incidents: a checklist for running agents safely and a draft experiment (E8) | [E1 pre-registration](docs/research/prereg/E1-real-world-accuracy.md), [agents safely](docs/agents-safely.md), [what the incidents mean](docs/research/agent-incidents-2026.md) |
 | **Next** | Real-world precision and recall with intervals, published whatever the result | [Roadmap: next](ROADMAP.md#next), [research plan](docs/vision-2.0.md) |
 

package/SECURITY.md

@@ -9,8 +9,8 @@ Security fixes land on the latest minor release only. Upgrade to get them.
 
 | Version | Supported |
 | ------- | --------- |
-| 1.7.x   | Yes       |
-| < 1.7   | No        |
+| 1.8.x   | Yes       |
+| < 1.8   | No        |
 
 ## Reporting a vulnerability
 

package/lib/advisories/evidence.js

@@ -0,0 +1,260 @@
+/**
+ * Evidence that a runtime or server is in use, and at which version.
+ *
+ * Black-box: what one HTTP response says about itself (Server, X-Powered-By,
+ * a PHPSESSID cookie, links to .php pages). White-box: what the repository
+ * pins (Dockerfile and compose images, .tool-versions, .php-version, .nvmrc,
+ * .python-version, runtime.txt, composer.json).
+ *
+ * Every item is `{ product, version, kind, where, raw, distro? }`:
+ *   version  the parsed version (lib/advisories/versions.js) or null
+ *   kind     "exact"   an upstream x.y.z
+ *            "branch"  only x.y (a floating Docker tag, `.python-version: 3.12`)
+ *            "distro"  a version with a distribution build string, or on a
+ *                      response whose Server header names a distribution
+ *            "present" the product is in use, the version is not visible
+ *   where    the header, cookie or file it came from
+ *   raw      the text it was read from (a header value, a line), for the report
+ *   banner   true for black-box evidence (a header), which may come from a
+ *            distribution package even without a distribution token
+ *
+ * Nothing here decides whether anything is vulnerable; that is index.js.
+ */
+import { readdirSync, lstatSync, openSync, fstatSync, readSync, closeSync, constants } from "node:fs";
+import { join, relative, basename } from "node:path";
+import { PRODUCTS, DISTRO_HINT } from "./products.js";
+import { parseVersion } from "./versions.js";
+
+const clip = (s, n = 200) => (s.length > n ? `${s.slice(0, n)}…` : s);
+
+function kindOf(product, v, distro) {
+  if (!v) return "present";
+  // A pre-release is an upstream build, not a distribution one.
+  if (v.patch !== null) return distro || v.suffix ? "distro" : "exact";
+  // "php:8" spans release lines; "php:8.3" and "node:20" name one.
+  return PRODUCTS[product].branchOf(v) ? "branch" : "present";
+}
+
+// ── Black-box ─────────────────────────────────────────────────────────────
+
+/**
+ * Evidence from one response's headers, cookies and page links.
+ * @param {{ headers?: Record<string,string>, cookieNames?: string[], phpLink?: string|null }} fp
+ *   what lib/crawler.js fingerprint() collected for the homepage
+ * @param {{ phpPaths?: string[] }} [more]  .php paths the endpoint discovery found reachable
+ */
+export function evidenceFromResponse(fp = {}, more = {}) {
+  const headers = fp.headers || {};
+  const out = [];
+  const server = String(headers.server || "");
+  const poweredBy = String(headers["x-powered-by"] || "");
+  const distro = DISTRO_HINT.test(server);
+
+  for (const [id, p] of Object.entries(PRODUCTS)) {
+    let found = false;
+    for (const [name, value] of [["server", server], ["x-powered-by", poweredBy]]) {
+      if (!value) continue;
+      const m = p.banner && p.banner.exec(value);
+      if (m) {
+        const v = parseVersion(m[1]);
+        if (v) {
+          out.push({ product: id, version: v, kind: kindOf(id, v, distro), where: `${name} header`, raw: clip(`${name}: ${value}`), banner: true });
+          found = true;
+          continue;
+        }
+      }
+      if (p.present && p.present.test(value)) {
+        out.push({ product: id, version: null, kind: "present", where: `${name} header`, raw: clip(`${name}: ${value}`) });
+        found = true;
+      }
+    }
+    if (id === "php" && !found) {
+      if ((fp.cookieNames || []).some((n) => n.toUpperCase() === "PHPSESSID")) {
+        out.push({ product: id, version: null, kind: "present", where: "Set-Cookie", raw: "PHPSESSID cookie (PHP's default session cookie name)" });
+        found = true;
+      }
+    }
+    if (id === "php" && !found) {
+      const link = fp.phpLink || (more.phpPaths || [])[0];
+      if (link) out.push({ product: id, version: null, kind: "present", where: fp.phpLink ? "homepage links" : "endpoint discovery", raw: clip(`.php page: ${link}`) });
+    }
+  }
+  return dedupe(out);
+}
+
+// ── White-box ─────────────────────────────────────────────────────────────
+
+const SKIP_DIRS = new Set([
+  "node_modules", ".git", "dist", "build", ".next", "coverage", "reports", "vendor",
+  "venv", ".venv", "site-packages", "__pycache__", ".tox", ".nox", ".obsidian",
+]);
+const MAX_DEPTH = 4;
+const MAX_FILE_BYTES = 256 * 1024;
+
+const isDockerfile = (n) => /^(?:Dockerfile|Containerfile)(?:\..+)?$/i.test(n) || /\.(?:dockerfile|containerfile)$/i.test(n);
+const isCompose = (n) => /^(?:docker-)?compose(?:\.[\w-]+)?\.ya?ml$/i.test(n);
+const VERSION_FILES = new Set(Object.values(PRODUCTS).flatMap((p) => p.versionFiles));
+const ROOT_ONLY = new Set([".tool-versions", "runtime.txt", "composer.json"]);
+
+function wanted(name, depth) {
+  if (isDockerfile(name) || isCompose(name) || VERSION_FILES.has(name)) return true;
+  return depth === 0 && ROOT_ONLY.has(name);
+}
+
+function readSmall(path) {
+  let fd;
+  try {
+    fd = openSync(path, constants.O_RDONLY | (constants.O_NONBLOCK || 0) | (constants.O_NOFOLLOW || 0));
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.size > MAX_FILE_BYTES) return null;
+    const buf = Buffer.alloc(st.size);
+    const n = st.size ? readSync(fd, buf, 0, st.size, 0) : 0;
+    return buf.subarray(0, n).toString("utf-8");
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+function walk(dir, depth, files) {
+  if (depth > MAX_DEPTH) return;
+  let entries;
+  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+  for (const e of entries) {
+    if (SKIP_DIRS.has(e.name)) continue;
+    const full = join(dir, e.name);
+    if (e.isFile()) {
+      if (wanted(e.name, depth)) files.push({ full, depth });
+      continue;
+    }
+    if (!e.isDirectory()) continue;
+    // Not a symlinked folder, and not a nested repo or worktree.
+    let st;
+    try { st = lstatSync(full); } catch { continue; }
+    if (!st.isDirectory()) continue;
+    try { lstatSync(join(full, ".git")); continue; } catch { /* no nested .git */ }
+    walk(full, depth + 1, files);
+  }
+}
+
+/** The release line a codename stands for (`lts/iron`, `iron` → "20"), or null. */
+function aliasLine(product, value) {
+  const name = value.toLowerCase().replace(/^lts\//, "");
+  return Object.hasOwn(PRODUCTS[product].lineAliases || {}, name) ? PRODUCTS[product].lineAliases[name] : null;
+}
+
+const imageProduct = new Map(Object.entries(PRODUCTS).flatMap(([id, p]) => p.dockerImages.map((img) => [img, id])));
+
+/**
+ * `php:8.3.12-fpm-alpine`, `docker.io/library/node:20`, `python@sha256:…`.
+ * Official images are upstream builds, so a variant after the version
+ * (`-fpm-alpine`, `-slim-bookworm`) is not a distro build string.
+ */
+export function parseImageRef(ref) {
+  const noDigest = ref.split("@")[0];
+  const slash = noDigest.lastIndexOf("/");
+  const colon = noDigest.indexOf(":", slash + 1);
+  const repo = colon === -1 ? noDigest : noDigest.slice(0, colon);
+  const tag = colon === -1 ? "" : noDigest.slice(colon + 1);
+  const path = repo.toLowerCase().replace(/^(?:docker\.io\/)?(?:library\/)?/, "");
+  const product = imageProduct.get(path);
+  if (!product) return null;
+  // `8.6.0RC4-fpm` and `3.15.0rc1-slim` are pre-release images; `iron` and
+  // `jod-alpine` are Node.js LTS codenames.
+  const m = /^(\d+(?:\.\d+){0,2}(?:(?:RC|rc|a|b)\d+)?)(?:$|-)/.exec(tag);
+  const alias = m ? null : aliasLine(product, tag.split("-")[0]);
+  const v = m ? parseVersion(m[1]) : alias ? parseVersion(alias) : null;
+  return { product, version: v, kind: kindOf(product, v, false), tag: tag || "latest" };
+}
+
+function fromDockerfile(text, where) {
+  const out = [];
+  for (const line of text.split(/\r?\n/)) {
+    const m = /^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)/i.exec(line);
+    if (!m || m[1].includes("$")) continue;
+    const img = parseImageRef(m[1]);
+    if (img) out.push({ product: img.product, version: img.version, kind: img.kind, where, raw: clip(line.trim()) });
+  }
+  return out;
+}
+
+function fromCompose(text, where) {
+  const out = [];
+  for (const line of text.split(/\r?\n/)) {
+    const m = /^\s*image:\s*["']?([^\s"'#]+)/.exec(line);
+    if (!m || m[1].includes("$")) continue;
+    const img = parseImageRef(m[1]);
+    if (img) out.push({ product: img.product, version: img.version, kind: img.kind, where, raw: clip(line.trim()) });
+  }
+  return out;
+}
+
+function versionLine(product, value, where, raw) {
+  const v = parseVersion(aliasLine(product, value) ?? value);
+  return { product, version: v, kind: kindOf(product, v, false), where, raw: clip(raw) };
+}
+
+function fromToolVersions(text, where) {
+  const out = [];
+  for (const line of text.split(/\r?\n/)) {
+    const [tool, value] = line.trim().split(/\s+/);
+    if (!tool || !value || tool.startsWith("#")) continue;
+    const id = Object.keys(PRODUCTS).find((k) => PRODUCTS[k].toolVersions.includes(tool));
+    if (id) out.push(versionLine(id, value, where, line.trim()));
+  }
+  return out;
+}
+
+function fromVersionFile(name, text, where) {
+  const id = Object.keys(PRODUCTS).find((k) => PRODUCTS[k].versionFiles.includes(name));
+  const value = text.split(/\r?\n/).map((l) => l.trim()).find((l) => l && !l.startsWith("#"));
+  if (!id || !value) return [];
+  return [versionLine(id, value, where, `${name}: ${value}`)];
+}
+
+function fromComposer(text, where) {
+  let j;
+  try { j = JSON.parse(text); } catch { return []; }
+  if (!j || typeof j !== "object") return [];
+  // `require.php` is a constraint and `config.platform.php` a version Composer
+  // pretends to have while resolving; neither is the PHP that runs. Both only
+  // say PHP is in use.
+  const constraint = typeof j.require?.php === "string" ? ` (require.php: ${clip(j.require.php, 60)})` : "";
+  return [{ product: "php", version: null, kind: "present", where, raw: `composer.json${constraint}` }];
+}
+
+/**
+ * Evidence from a repository's pins.
+ * @param {string} root
+ */
+export function evidenceFromRepo(root) {
+  const files = [];
+  walk(root, 0, files);
+  const out = [];
+  for (const { full } of files) {
+    const text = readSmall(full);
+    if (text === null) continue;
+    const name = basename(full);
+    const where = relative(root, full).split("\\").join("/");
+    if (isDockerfile(name)) out.push(...fromDockerfile(text, where));
+    else if (isCompose(name)) out.push(...fromCompose(text, where));
+    else if (name === ".tool-versions") out.push(...fromToolVersions(text, where));
+    else if (name === "runtime.txt") {
+      const m = /^\s*python-(\d+\.\d+(?:\.\d+)?)\s*$/m.exec(text);
+      if (m) out.push(versionLine("python", m[1], where, `runtime.txt: python-${m[1]}`));
+    } else if (name === "composer.json") out.push(...fromComposer(text, where));
+    else out.push(...fromVersionFile(name, text, where));
+  }
+  return dedupe(out);
+}
+
+function dedupe(items) {
+  const seen = new Set();
+  return items.filter((e) => {
+    const k = `${e.product}|${e.version?.raw ?? ""}|${e.kind}|${e.where}`;
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+}