apisec-code-bolt 0.1.7__tar.gz → 0.1.8__tar.gz

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apisec-code-bolt
-Version: 0.1.7
+Version: 0.1.8
 Summary: Static analysis probe for extracting architectural metadata from codebases
 Project-URL: Homepage, https://apisec.ai
 Project-URL: Documentation, https://docs.apisec.ai/code-bolt
@@ -291,8 +291,8 @@ Options:
 
 ### telemetry
 
-Manage anonymous, opt-in usage telemetry (disabled by default; never includes
-code, paths, or credentials).
+Manage anonymous usage telemetry (opt-out; on by default, disable any time with
+`telemetry off`; never includes code, paths, or credentials).
 
 ```bash
 apisec-code-bolt telemetry on|off|status

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/README.md

@@ -244,8 +244,8 @@ Options:
 
 ### telemetry
 
-Manage anonymous, opt-in usage telemetry (disabled by default; never includes
-code, paths, or credentials).
+Manage anonymous usage telemetry (opt-out; on by default, disable any time with
+`telemetry off`; never includes code, paths, or credentials).
 
 ```bash
 apisec-code-bolt telemetry on|off|status

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "apisec-code-bolt"
-version = "0.1.7"
+version = "0.1.8"
 description = "Static analysis probe for extracting architectural metadata from codebases"
 readme = "README.md"
 license = {text = "Proprietary"}

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/analysis/analyzer.py

@@ -790,16 +790,16 @@ class ProjectAnalyzer:
                             changed = True
 
             # Group-level auth: RequireAuthorization chained on the group
-            has_group_auth = any(
-                call.callee_name.split(".")[-1] == "RequireAuthorization"
-                and (call.receiver_expression or "").startswith("line:")
-                and (
-                    lambda rv=call.receiver_expression: (
-                        rv[5:].isdigit() and int(rv[5:]) in chain_lines
-                    )
-                )()
-                for call in parsed_file.call_sites
-            )
+            has_group_auth = False
+            for call in parsed_file.call_sites:
+                if call.callee_name.split(".")[-1] != "RequireAuthorization":
+                    continue
+                recv = call.receiver_expression or ""
+                if not recv.startswith("line:"):
+                    continue
+                if recv[5:].isdigit() and int(recv[5:]) in chain_lines:
+                    has_group_auth = True
+                    break
 
             # Find calls to custom Map* extension methods (non-standard, non-chained).
             # These are calls like ``group.MapCreateBrandEndpoint()`` where the method

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/analysis/dependency_extractor.py

@@ -26,6 +26,25 @@ from ..parsing.base import ParsedFile
 logger = logging.getLogger(__name__)
 
 
+def _maven_bom_resolution_enabled() -> bool:
+    """Whether to resolve parent/imported Maven BOM versions from Maven Central.
+
+    Defaults ON: without it, deps whose versions are managed by a parent POM or
+    imported BOM (Spring Boot's jackson-databind, hsqldb, …) come back
+    version=None and are invisible to CVE matching. Resolution fetches those POMs
+    (network egress) and degrades cleanly to None on any failure.
+
+    Opt out for air-gapped / no-egress runs with ``--offline`` (sets
+    ``APISEC_OFFLINE``) or ``APISEC_RESOLVE_MAVEN_BOMS=0``.
+    """
+    if os.environ.get("APISEC_OFFLINE", "").strip().lower() in ("1", "true", "yes"):
+        return False
+    flag = os.environ.get("APISEC_RESOLVE_MAVEN_BOMS")
+    if flag is not None:
+        return flag.strip().lower() not in ("0", "false", "no", "")
+    return True
+
+
 class DependencyExtractor:
     """Extracts package dependencies and internal imports from a project."""
 
@@ -854,27 +873,75 @@ class DependencyExtractor:
 
     _MAVEN_CENTRAL = "https://repo1.maven.org/maven2"
     _bom_pom_cache: dict[str, bytes | None] = {}
+    _BOM_FETCH_ATTEMPTS = 3
+
+    def _bom_cache_dir(self) -> Path:
+        base = os.environ.get("APISEC_BOM_CACHE_DIR") or os.path.join(
+            os.path.expanduser("~"), ".cache", "apisec-code-bolt", "maven-boms"
+        )
+        return Path(base)
 
     def _fetch_pom(self, group: str, artifact: str, version: str) -> bytes | None:
-        """Fetch a POM from Maven Central (cached). None on any failure/offline."""
+        """Fetch a POM from Maven Central, resiliently. None on definitive miss
+        (404) or offline; a transient network failure is retried and NOT cached,
+        so a blip can't silently null out a managed version for the whole run.
+
+        Two cache tiers: an in-process dict and an on-disk cache. Version-pinned
+        POMs are immutable, so a cached copy is always valid — and it makes
+        resolution resilient to a flaky network (once fetched, reused forever).
+        """
         key = f"{group}:{artifact}:{version}"
         if key in self._bom_pom_cache:
             return self._bom_pom_cache[key]
+
+        cache_file = self._bom_cache_dir() / group.replace(".", "/") / artifact / f"{version}.pom"
+        try:
+            if cache_file.is_file():
+                data = cache_file.read_bytes()
+                self._bom_pom_cache[key] = data
+                return data
+        except Exception:  # unreadable cache file → fall through to fetch
+            pass
+
         url = (
             f"{self._MAVEN_CENTRAL}/{group.replace('.', '/')}/"
             f"{artifact}/{version}/{artifact}-{version}.pom"
         )
-        data: bytes | None = None
-        try:
-            import httpx
+        import time
+
+        for attempt in range(1, self._BOM_FETCH_ATTEMPTS + 1):
+            try:
+                import httpx
+
+                resp = httpx.get(url, timeout=8.0, follow_redirects=True)
+                if resp.status_code == 200:
+                    data = resp.content
+                    self._bom_pom_cache[key] = data
+                    try:  # best-effort persist; immutable so safe to keep
+                        cache_file.parent.mkdir(parents=True, exist_ok=True)
+                        cache_file.write_bytes(data)
+                    except Exception:
+                        pass
+                    return data
+                if resp.status_code == 404:
+                    self._bom_pom_cache[key] = None  # definitive miss; don't retry
+                    return None
+                # other statuses (5xx, 429, …) are transient → retry
+            except Exception as exc:  # network/transport → retry
+                logger.debug(
+                    "BOM POM fetch attempt %d/%d failed for %s: %s",
+                    attempt,
+                    self._BOM_FETCH_ATTEMPTS,
+                    key,
+                    exc,
+                )
+            if attempt < self._BOM_FETCH_ATTEMPTS:
+                time.sleep(0.5 * attempt)  # linear backoff
 
-            resp = httpx.get(url, timeout=8.0, follow_redirects=True)
-            if resp.status_code == 200:
-                data = resp.content
-        except Exception as exc:  # network/transport/anything → degrade to None
-            logger.debug("BOM POM fetch failed for %s: %s", key, exc)
-        self._bom_pom_cache[key] = data
-        return data
+        # Transient failure exhausted retries. Degrade to None but do NOT cache it,
+        # so a later call (or run) can retry rather than being poisoned to null.
+        logger.debug("BOM POM fetch exhausted retries for %s", key)
+        return None
 
     def _remote_managed_versions(
         self, seeds: list[tuple[str, str, str]], seed_props: dict[str, str]
@@ -921,7 +988,7 @@ class DependencyExtractor:
             pe = el.find(q("properties"))
             if pe is not None:
                 for c in pe:
-                    k = c.tag[len(ns):] if ns else c.tag
+                    k = c.tag[len(ns) :] if ns else c.tag
                     if c.text:
                         own[k] = c.text.strip()
             own.setdefault("project.version", v)
@@ -1100,15 +1167,16 @@ class DependencyExtractor:
             if parent_group and parent_artifact and parent_version:
                 parent_coord = (parent_group, parent_artifact, parent_version)
 
-        # Imported-BOM resolution (opt-in): third-party deps (h2, mysql, jackson…)
+        # Imported-BOM resolution (default ON): third-party deps (h2, mysql, jackson…)
         # get their versions from the parent chain / imported BOMs (e.g.
         # spring-boot-dependencies), NOT this file, so they'd otherwise be
-        # version=None → silently treated downstream as "not affected". When
-        # APISEC_RESOLVE_MAVEN_BOMS is set, fetch those POMs from Maven Central and
-        # resolve their pins; default off keeps the extractor offline/no-egress.
-        # Degrades cleanly to None on any fetch/parse failure.
+        # version=None → silently treated downstream as "not affected", hiding
+        # real CVEs. Fetch those POMs from Maven Central and resolve their pins;
+        # opt out for air-gapped runs via --offline (see
+        # _maven_bom_resolution_enabled). Degrades cleanly to None on any
+        # fetch/parse failure.
         remote_managed: dict[str, str] = {}
-        if os.environ.get("APISEC_RESOLVE_MAVEN_BOMS"):
+        if _maven_bom_resolution_enabled():
             seeds = ([parent_coord] if parent_coord else []) + import_boms
             if seeds:
                 remote_managed = self._remote_managed_versions(seeds, props)

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/cli/main.py

@@ -6,6 +6,8 @@ This module defines the CLI commands using Click.
 
 from __future__ import annotations
 
+import contextlib
+import os
 import sys
 from pathlib import Path
 from typing import Any
@@ -150,7 +152,11 @@ def cli(ctx: click.Context, verbose: bool, quiet: bool, debug: bool, log_format:
 @click.option(
     "--timeout",
     type=int,
-    help="Analysis timeout in seconds.",
+    help=(
+        "Timeout in seconds for local analysis and, on upload, for waiting on "
+        "cloud verification. Large apps may need a higher value; a client "
+        "timeout never stops the analysis, which continues server-side."
+    ),
 )
 @click.option(
     "--dry-run",
@@ -163,6 +169,13 @@ def cli(ctx: click.Context, verbose: bool, quiet: bool, debug: bool, log_format:
     is_flag=True,
     help="Write manifest JSON to stdout instead of a file (for pipeline use).",
 )
+@click.option(
+    "--offline",
+    is_flag=True,
+    help="No network egress during extraction. Disables Maven BOM version "
+    "resolution (managed deps stay version=None, so their CVEs can't be matched). "
+    "Use for air-gapped runs.",
+)
 @click.pass_context
 def analyze(
     ctx: click.Context,
@@ -181,8 +194,14 @@ def analyze(
     timeout: int | None,
     dry_run: bool = False,
     output_stdout: bool = False,
+    offline: bool = False,
 ) -> None:
     log_format: str = ctx.obj.get("log_format", "text")
+    # Maven BOM version resolution is ON by default (resolves parent/BOM-managed
+    # dep versions so their CVEs are matchable). --offline opts out for
+    # no-egress environments; the extractor reads APISEC_OFFLINE.
+    if offline:
+        os.environ["APISEC_OFFLINE"] = "1"
     """
     Analyze a codebase and generate a manifest.
 
@@ -250,8 +269,6 @@ def analyze(
     )
 
     if needs_registration():
-        import os
-
         env_code = os.environ.get("APISEC_REGISTRATION_CODE", "").strip()
         if env_code:
             code = env_code
@@ -364,7 +381,7 @@ def analyze(
             output_path = apisec_dir / "manifest.json"
         manifest_json = result.manifest.to_json(pretty=True)
         output_path.parent.mkdir(parents=True, exist_ok=True)
-        output_path.write_text(manifest_json)
+        output_path.write_text(manifest_json, encoding="utf-8")
 
         if log_format == "json":
             _emit_json_summary(path, result, output_path=output_path)
@@ -428,6 +445,7 @@ def analyze(
                 api_url_override,
                 reasoning_url,
                 quiet,
+                verify_timeout=timeout,
             )
         elif cloud_url:
             # Legacy: direct connection to reasoning engine (for local dev)
@@ -517,6 +535,7 @@ def _run_authenticated_upload(
     api_url_override: str | None,
     reasoning_url_override: str | None,
     quiet: bool,
+    verify_timeout: int | None = None,
 ) -> None:
     """Register surface with applicationsservice (PAT), then upload manifest to the reasoning engine (same PAT + app_id)."""
     import json
@@ -580,11 +599,14 @@ def _run_authenticated_upload(
         write_state(project_path, RepoState(application_id=registration.app_id))
 
         manifest_data = json.loads(result.manifest.to_json())
+        upload_kwargs: dict[str, Any] = {"reasoning_engine_url": reasoning_url_override}
+        if verify_timeout:
+            upload_kwargs["max_wait"] = verify_timeout
         upload_result = client.upload_and_verify(
             registration,
             manifest_data,
             project_path,
-            reasoning_engine_url=reasoning_url_override,
+            **upload_kwargs,
         )
 
         if not quiet:
@@ -601,6 +623,14 @@ def _run_authenticated_upload(
                 vtable.add_row("Error", f"[red]{upload_result['error']}[/red]")
             console.print(vtable)
 
+            if upload_result.get("status") == "timeout":
+                console.print(
+                    "[yellow]Stopped waiting for verification, but the analysis is "
+                    "still running server-side[/yellow] — results will appear at the "
+                    "console link below shortly. This is common for large apps; pass "
+                    "[cyan]--timeout <seconds>[/cyan] to wait longer."
+                )
+
             console.print()
             view_url = _resolve_console_url(registration.console_url, registration.app_id)
             panel_body = view_url
@@ -1097,6 +1127,14 @@ cloud:
 
 def main() -> None:
     """Main entry point."""
+    # Force UTF-8 on stdio so non-ASCII manifest/JSON output (e.g. the U+2192
+    # arrow in data-flow output) does not crash on Windows consoles that
+    # default to cp1252.
+    for stream in (sys.stdout, sys.stderr):
+        reconfigure = getattr(stream, "reconfigure", None)
+        if reconfigure is not None:
+            with contextlib.suppress(ValueError, OSError):
+                reconfigure(encoding="utf-8")
     cli(obj={})
 
 

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/cloud/apisec_client.py

@@ -106,8 +106,15 @@ class ApisecClient:
         manifest_data: dict[str, Any],
         project_root: Path,
         reasoning_engine_url: str | None = None,
+        max_wait: int = 900,
     ) -> dict[str, Any]:
-        """Upload manifest to reasoning engine with Bearer PAT and app_id; run verification."""
+        """Upload manifest to reasoning engine with Bearer PAT and app_id; run verification.
+
+        ``max_wait`` bounds how long the client polls for verification to
+        finish. Large apps (many endpoints / LLM verification) can legitimately
+        take several minutes, so this defaults generously; a client-side
+        timeout does not stop the analysis, which continues server-side.
+        """
         engine_url = reasoning_engine_url or self._api_url
         with CloudClient(
             api_url=engine_url,
@@ -120,7 +127,7 @@ class ApisecClient:
 
             maybe_enrich_manifest(manifest_data, project_root, client)
 
-            executor = QueryExecutor(project_root=project_root)
+            executor = QueryExecutor(project_root=project_root, max_wait=max_wait)
             result = executor.run_connected(client, manifest_data)
 
         return {

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/core/telemetry.py

@@ -17,6 +17,7 @@ PII GUARD:
 from __future__ import annotations
 
 import logging
+import os
 import threading
 from pathlib import Path
 from typing import Any
@@ -267,8 +268,6 @@ def get_registration_code() -> str:
     Checks APISEC_REGISTRATION_CODE env var first so CI/automated environments
     can bypass the interactive first-run prompt without writing a config file.
     """
-    import os
-
     env_code = os.environ.get("APISEC_REGISTRATION_CODE", "").strip()
     if env_code:
         return env_code
@@ -335,7 +334,11 @@ def emit_install_event(*, probe_version: str = "") -> None:
     threading.Thread(target=_send, daemon=True).start()
 
 
-_TELEMETRY_ENDPOINT = "https://api.apisec.ai/v1/surface/telemetry/events"
+# Overridable for non-prod testing (staging/dev receivers), mirroring the
+# analyze path's --api-url. Defaults to prod, so unset means no change.
+_TELEMETRY_ENDPOINT = os.environ.get(
+    "APISEC_TELEMETRY_ENDPOINT", "https://api.apisec.ai/v1/surface/telemetry/events"
+)
 
 
 def emit_analyze_event(

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/parsing/jvm/parser.py

@@ -52,7 +52,6 @@ class JavaExtractor:
         self.lines = source.splitlines()
 
     def extract(self) -> ParsedFile:
-
         start = time.perf_counter()
 
         module_name = self._get_package_name()

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/query/executor.py

@@ -246,7 +246,7 @@ class QueryExecutor:
             }
 
             output_file.parent.mkdir(parents=True, exist_ok=True)
-            output_file.write_text(json.dumps(output, indent=2, default=str))
+            output_file.write_text(json.dumps(output, indent=2, default=str), encoding="utf-8")
 
             result.final_status = "complete"
             logger.info(

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/tests/integration/test_cli.py

@@ -1,11 +1,14 @@
 """CLI smoke tests using Click's CliRunner."""
 
+import json
+from pathlib import Path
 from unittest.mock import patch
 
 import pytest
 from click.testing import CliRunner
 
 from apisec_code_bolt.cli.main import cli
+from apisec_code_bolt.core.manifest import Manifest
 
 
 @pytest.fixture
@@ -64,11 +67,52 @@ class TestAnalyzeCommand:
         )
         assert result.exit_code == 0
         assert output.exists()
-        import json
 
         data = json.loads(output.read_text())
         assert "entry_points" in data
 
+    def test_analyze_writes_non_ascii_manifest_on_cp1252_locale(
+        self, runner, sample_project, tmp_path, monkeypatch
+    ):
+        """Regression: the manifest must be written UTF-8 even when the OS
+        locale default is cp1252 (Windows), so non-ASCII data-flow output such
+        as the U+2192 arrow does not crash `analyze`. See BMO support issue.
+        """
+        # The tool emits U+2192 in data-flow output; force it into the manifest
+        # so the test does not depend on what the analyzer naturally produces.
+        monkeypatch.setattr(
+            Manifest,
+            "to_json",
+            lambda self, pretty=False: '{"note": "source \u2192 sink"}',
+        )
+
+        # Reproduce the Windows behaviour on any platform: a write_text() call
+        # with no explicit encoding falls back to cp1252, which cannot encode
+        # the arrow. The fix passes encoding="utf-8" explicitly, bypassing this.
+        real_write_text = Path.write_text
+
+        def cp1252_default_write_text(self, data, encoding=None, **kwargs):
+            if encoding is None:
+                encoding = "cp1252"
+            return real_write_text(self, data, encoding=encoding, **kwargs)
+
+        monkeypatch.setattr(Path, "write_text", cp1252_default_write_text)
+
+        output = tmp_path / "out.json"
+        result = runner.invoke(
+            cli,
+            [
+                "analyze",
+                str(sample_project),
+                "--no-upload",
+                "--output",
+                str(output),
+            ],
+        )
+        assert result.exit_code == 0, result.output
+        assert output.exists()
+        assert "\u2192" in output.read_text(encoding="utf-8")
+
     def test_analyze_nonexistent_path(self, runner, tmp_path):
         result = runner.invoke(
             cli,

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.8}/tests/unit/test_dependency_parsing.py

@@ -404,13 +404,16 @@ class TestPomXml:
         assert by_name["org.springframework.boot:spring-boot-starter-web"].version is None
 
     def test_parent_bom_version_inherited_for_parent_groupid(
-        self, analyzer: DependencyExtractor, tmp_path: Path
+        self, analyzer: DependencyExtractor, tmp_path: Path, monkeypatch
     ) -> None:
         # Spring Boot starters omit <version> and inherit it from the <parent>
         # (spring-boot-starter-parent). The parent's own-groupId artifacts must
         # resolve to the parent version; third-party deps must NOT (their versions
         # come from the imported BOM, not the parent). Regression for the
         # null-version → "VERSION_NOT_AFFECTED" false-clean.
+        # Offline so this isolates the LOCAL parent-group logic; with BOM
+        # resolution on (the default) h2 would resolve from the remote BOM.
+        monkeypatch.setenv("APISEC_OFFLINE", "1")
         pom = tmp_path / "pom.xml"
         pom.write_text(
             """<?xml version="1.0"?>
@@ -501,8 +504,9 @@ class TestPomXml:
     def test_imported_bom_not_resolved_when_opted_out(
         self, analyzer: DependencyExtractor, tmp_path: Path, monkeypatch
     ) -> None:
-        # Default (flag unset): stays offline, no fetch, version None.
+        # Opted out (--offline / APISEC_OFFLINE): stays offline, no fetch, version None.
         monkeypatch.delenv("APISEC_RESOLVE_MAVEN_BOMS", raising=False)
+        monkeypatch.setenv("APISEC_OFFLINE", "1")
 
         def boom(self, *a, **k):  # _fetch_pom must NOT be called when opted out
             raise AssertionError("network fetch attempted while opted out")
@@ -558,8 +562,9 @@ class TestPomXml:
 </project>"""
 
         def fake_fetch(self, group, artifact, version):  # noqa: ANN001
-            return {"starter-parent": parent_pom, "deps-bom": deps_bom,
-                    "jackson-bom": j3_bom}.get(artifact)
+            return {"starter-parent": parent_pom, "deps-bom": deps_bom, "jackson-bom": j3_bom}.get(
+                artifact
+            )
 
         monkeypatch.setattr(DependencyExtractor, "_fetch_pom", fake_fetch)
         monkeypatch.setenv("APISEC_RESOLVE_MAVEN_BOMS", "1")
@@ -762,3 +767,119 @@ class TestGemfileLock:
         by_name = {p.name: p for p in DependencyExtractor(tmp_path, {})._parse_gemfile_lock(lock)}
         assert by_name["cool-gem"].version == "1.2.3"
         assert by_name["my-local"].version == "0.1.0"
+
+
+# --- Maven BOM resolution default (--offline opt-out) -----------------------
+
+from apisec_code_bolt.analysis.dependency_extractor import (  # noqa: E402
+    _maven_bom_resolution_enabled,
+)
+
+
+class TestMavenBomResolutionGate:
+    """BOM version resolution defaults ON; opt out via --offline / env."""
+
+    def test_default_on(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("APISEC_OFFLINE", raising=False)
+        monkeypatch.delenv("APISEC_RESOLVE_MAVEN_BOMS", raising=False)
+        assert _maven_bom_resolution_enabled() is True
+
+    def test_offline_disables(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("APISEC_RESOLVE_MAVEN_BOMS", raising=False)
+        for val in ("1", "true", "YES"):
+            monkeypatch.setenv("APISEC_OFFLINE", val)
+            assert _maven_bom_resolution_enabled() is False
+
+    def test_env_explicit_disable(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("APISEC_OFFLINE", raising=False)
+        for val in ("0", "false", "no", ""):
+            monkeypatch.setenv("APISEC_RESOLVE_MAVEN_BOMS", val)
+            assert _maven_bom_resolution_enabled() is False
+
+    def test_env_explicit_enable(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("APISEC_OFFLINE", raising=False)
+        monkeypatch.setenv("APISEC_RESOLVE_MAVEN_BOMS", "1")
+        assert _maven_bom_resolution_enabled() is True
+
+    def test_offline_wins_over_resolve_flag(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setenv("APISEC_OFFLINE", "1")
+        monkeypatch.setenv("APISEC_RESOLVE_MAVEN_BOMS", "1")
+        assert _maven_bom_resolution_enabled() is False
+
+
+# --- BOM POM fetch: retry + cache resilience --------------------------------
+
+
+class TestBomPomFetchResilience:
+    def _extractor(self, tmp_path, monkeypatch):
+        monkeypatch.setenv("APISEC_BOM_CACHE_DIR", str(tmp_path / "bomcache"))
+        e = DependencyExtractor(tmp_path, {})
+        e._bom_pom_cache.clear()  # class-level; isolate per test
+        return e
+
+    def test_retries_transient_failure_then_succeeds(self, tmp_path, monkeypatch):
+        e = self._extractor(tmp_path, monkeypatch)
+        calls = {"n": 0}
+
+        class Resp:
+            status_code = 200
+            content = b"<project/>"
+
+        def flaky_get(url, **kw):
+            calls["n"] += 1
+            if calls["n"] < 3:
+                raise RuntimeError("connection reset")
+            return Resp()
+
+        import httpx
+
+        monkeypatch.setattr(httpx, "get", flaky_get)
+        monkeypatch.setattr("time.sleep", lambda *_: None)
+        assert e._fetch_pom("g", "a", "1.0") == b"<project/>"
+        assert calls["n"] == 3  # retried twice, succeeded on the third
+
+    def test_transient_failure_not_cached(self, tmp_path, monkeypatch):
+        e = self._extractor(tmp_path, monkeypatch)
+        import httpx
+
+        monkeypatch.setattr(
+            httpx, "get", lambda *a, **k: (_ for _ in ()).throw(RuntimeError("down"))
+        )
+        monkeypatch.setattr("time.sleep", lambda *_: None)
+        assert e._fetch_pom("g", "a", "1.0") is None
+        assert "g:a:1.0" not in e._bom_pom_cache  # not poisoned → retriable later
+
+    def test_404_is_definitive_and_not_retried(self, tmp_path, monkeypatch):
+        e = self._extractor(tmp_path, monkeypatch)
+        calls = {"n": 0}
+
+        class Resp404:
+            status_code = 404
+            content = b""
+
+        def get(url, **kw):
+            calls["n"] += 1
+            return Resp404()
+
+        import httpx
+
+        monkeypatch.setattr(httpx, "get", get)
+        assert e._fetch_pom("g", "a", "1.0") is None
+        assert calls["n"] == 1  # not retried
+        assert e._bom_pom_cache["g:a:1.0"] is None  # cached as definitive miss
+
+    def test_disk_cache_avoids_refetch(self, tmp_path, monkeypatch):
+        e = self._extractor(tmp_path, monkeypatch)
+        import httpx
+
+        monkeypatch.setattr(
+            httpx, "get", lambda *a, **k: type("R", (), {"status_code": 200, "content": b"<p/>"})()
+        )
+        assert e._fetch_pom("g", "a", "1.0") == b"<p/>"
+        # new extractor (fresh in-mem cache), network now hard-fails → must serve from disk
+        e2 = DependencyExtractor(tmp_path, {})
+        e2._bom_pom_cache.clear()
+        monkeypatch.setattr(
+            httpx, "get", lambda *a, **k: (_ for _ in ()).throw(AssertionError("should not fetch"))
+        )
+        assert e2._fetch_pom("g", "a", "1.0") == b"<p/>"