cycode 3.25.1.dev3__py3-none-any.whl → 3.25.1.dev4__py3-none-any.whl

cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.25.1.dev3'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.25.1.dev4'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

cycode/cli/files_collector/sca/npm/restore_bun_dependencies.py

@@ -6,15 +6,19 @@ from typing import Optional
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.files_collector.sca.npm.workspace import (
+    BUN_LOCK_FILE_NAME,
+    MANIFEST_FILE_NAME,
+    is_covered_workspace_member,
+)
 from cycode.cli.models import Document
-from cycode.cli.utils.path_utils import get_file_content
+from cycode.cli.utils.path_utils import get_file_content, get_scan_roots_from_context
 from cycode.cli.utils.shell_executor import shell
 from cycode.logger import get_logger
 
 logger = get_logger('Bun Restore Dependencies')
 
-BUN_MANIFEST_FILE_NAME = 'package.json'
-BUN_LOCK_FILE_NAME = 'bun.lock'
+BUN_MANIFEST_FILE_NAME = MANIFEST_FILE_NAME
 
 # Only Bun >=1.2 produces the text-based `bun.lock` lockfile that we parse.
 # Older Bun versions emit a binary `bun.lockb`, which is not supported.
@@ -61,6 +65,9 @@ class RestoreBunDependencies(BaseRestoreDependencies):
         if manifest_dir and (Path(manifest_dir) / BUN_LOCK_FILE_NAME).is_file():
             return True
 
+        if is_covered_workspace_member(manifest_dir, document.path, get_scan_roots_from_context(self.ctx)):
+            return False
+
         return _indicates_bun(document.content)
 
     def _is_supported_bun_version(self) -> bool:

cycode/cli/files_collector/sca/npm/restore_deno_dependencies.py

@@ -4,6 +4,7 @@ from typing import Optional
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.files_collector.sca.npm.workspace import DENO_LOCK_FILE_NAME
 from cycode.cli.models import Document
 from cycode.cli.utils.path_utils import get_file_content
 from cycode.logger import get_logger
@@ -11,7 +12,6 @@ from cycode.logger import get_logger
 logger = get_logger('Deno Restore Dependencies')
 
 DENO_MANIFEST_FILE_NAMES = ('deno.json', 'deno.jsonc')
-DENO_LOCK_FILE_NAME = 'deno.lock'
 
 
 class RestoreDenoDependencies(BaseRestoreDependencies):

cycode/cli/files_collector/sca/npm/restore_npm_dependencies.py

@@ -3,15 +3,25 @@ from pathlib import Path
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies
+from cycode.cli.files_collector.sca.npm.workspace import (
+    BUN_LOCK_FILE_NAME,
+    DENO_LOCK_FILE_NAME,
+    MANIFEST_FILE_NAME,
+    NPM_LOCK_FILE_NAME,
+    NPM_SHRINKWRAP_FILE_NAME,
+    PNPM_LOCK_FILE_NAME,
+    YARN_LOCK_FILE_NAME,
+    is_covered_workspace_member,
+)
 from cycode.cli.models import Document
+from cycode.cli.utils.path_utils import get_scan_roots_from_context
 from cycode.logger import get_logger
 
 logger = get_logger('NPM Restore Dependencies')
 
-NPM_MANIFEST_FILE_NAME = 'package.json'
-NPM_LOCK_FILE_NAME = 'package-lock.json'
+NPM_MANIFEST_FILE_NAME = MANIFEST_FILE_NAME
 # These lockfiles indicate another package manager owns the project — NPM should not run
-_ALTERNATIVE_LOCK_FILES = ('yarn.lock', 'pnpm-lock.yaml', 'deno.lock', 'bun.lock')
+_ALTERNATIVE_LOCK_FILES = (YARN_LOCK_FILE_NAME, PNPM_LOCK_FILE_NAME, DENO_LOCK_FILE_NAME, BUN_LOCK_FILE_NAME)
 
 
 class RestoreNpmDependencies(BaseRestoreDependencies):
@@ -24,6 +34,9 @@ class RestoreNpmDependencies(BaseRestoreDependencies):
         Yarn and pnpm projects are handled by their dedicated handlers, which run before
         this one in the handler list. This handler is the npm fallback.
 
+        A manifest is also declined when a lockfile further up already resolves it, whichever
+        package manager wrote that lockfile; see the workspace package for how that is decided.
+
         NOTE: this guard only excludes a project when an alternative lockfile is *physically
         present on disk*. It does not inspect the `packageManager`/`engines` signal in
         package.json. So a project that declares e.g. `packageManager: "bun@..."` (or pnpm)
@@ -37,16 +50,18 @@ class RestoreNpmDependencies(BaseRestoreDependencies):
             return False
 
         manifest_dir = self.get_manifest_dir(document)
-        if manifest_dir:
-            for lock_file in _ALTERNATIVE_LOCK_FILES:
-                if (Path(manifest_dir) / lock_file).is_file():
-                    logger.debug(
-                        'Skipping npm restore: alternative lockfile detected, %s',
-                        {'path': document.path, 'lockfile': lock_file},
-                    )
-                    return False
+        if not manifest_dir:
+            return True
+
+        for lock_file in _ALTERNATIVE_LOCK_FILES:
+            if (Path(manifest_dir) / lock_file).is_file():
+                logger.debug(
+                    'Skipping npm restore: alternative lockfile detected, %s',
+                    {'path': document.path, 'lockfile': lock_file},
+                )
+                return False
 
-        return True
+        return not is_covered_workspace_member(manifest_dir, document.path, get_scan_roots_from_context(self.ctx))
 
     def get_commands(self, manifest_file_path: str) -> list[list[str]]:
         return [
@@ -65,7 +80,11 @@ class RestoreNpmDependencies(BaseRestoreDependencies):
         return NPM_LOCK_FILE_NAME
 
     def get_lock_file_names(self) -> list[str]:
-        return [NPM_LOCK_FILE_NAME]
+        return [NPM_LOCK_FILE_NAME, NPM_SHRINKWRAP_FILE_NAME]
+
+    def get_restored_lock_file_name(self, restore_file_path: str) -> str:
+        name = Path(restore_file_path).name
+        return name if name in self.get_lock_file_names() else self.get_lock_file_name()
 
     @staticmethod
     def prepare_manifest_file_path_for_command(manifest_file_path: str) -> str:

cycode/cli/files_collector/sca/npm/restore_pnpm_dependencies.py

@@ -5,14 +5,18 @@ from typing import Optional
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.files_collector.sca.npm.workspace import (
+    MANIFEST_FILE_NAME,
+    PNPM_LOCK_FILE_NAME,
+    is_covered_workspace_member,
+)
 from cycode.cli.models import Document
-from cycode.cli.utils.path_utils import get_file_content
+from cycode.cli.utils.path_utils import get_file_content, get_scan_roots_from_context
 from cycode.logger import get_logger
 
 logger = get_logger('Pnpm Restore Dependencies')
 
-PNPM_MANIFEST_FILE_NAME = 'package.json'
-PNPM_LOCK_FILE_NAME = 'pnpm-lock.yaml'
+PNPM_MANIFEST_FILE_NAME = MANIFEST_FILE_NAME
 
 
 def _indicates_pnpm(package_json_content: Optional[str]) -> bool:
@@ -44,6 +48,9 @@ class RestorePnpmDependencies(BaseRestoreDependencies):
         if manifest_dir and (Path(manifest_dir) / PNPM_LOCK_FILE_NAME).is_file():
             return True
 
+        if is_covered_workspace_member(manifest_dir, document.path, get_scan_roots_from_context(self.ctx)):
+            return False
+
         return _indicates_pnpm(document.content)
 
     def try_restore_dependencies(self, document: Document) -> Optional[Document]:

cycode/cli/files_collector/sca/npm/restore_yarn_dependencies.py

@@ -5,14 +5,18 @@ from typing import Optional
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.files_collector.sca.npm.workspace import (
+    MANIFEST_FILE_NAME,
+    YARN_LOCK_FILE_NAME,
+    is_covered_workspace_member,
+)
 from cycode.cli.models import Document
-from cycode.cli.utils.path_utils import get_file_content
+from cycode.cli.utils.path_utils import get_file_content, get_scan_roots_from_context
 from cycode.logger import get_logger
 
 logger = get_logger('Yarn Restore Dependencies')
 
-YARN_MANIFEST_FILE_NAME = 'package.json'
-YARN_LOCK_FILE_NAME = 'yarn.lock'
+YARN_MANIFEST_FILE_NAME = MANIFEST_FILE_NAME
 
 
 def _indicates_yarn(package_json_content: Optional[str]) -> bool:
@@ -44,6 +48,9 @@ class RestoreYarnDependencies(BaseRestoreDependencies):
         if manifest_dir and (Path(manifest_dir) / YARN_LOCK_FILE_NAME).is_file():
             return True
 
+        if is_covered_workspace_member(manifest_dir, document.path, get_scan_roots_from_context(self.ctx)):
+            return False
+
         return _indicates_yarn(document.content)
 
     def try_restore_dependencies(self, document: Document) -> Optional[Document]:

cycode/cli/files_collector/sca/npm/workspace/__init__.py

@@ -0,0 +1,49 @@
+"""Deciding whether a lockfile above a manifest already resolves that manifest's dependencies.
+
+The lockfile is the authority wherever it can name its members; the manifest's workspaces globs
+are a fallback for the formats that cannot. See resolvers.py for the per-format readers.
+"""
+
+from cycode.cli.files_collector.sca.npm.workspace import coverage as _coverage
+from cycode.cli.files_collector.sca.npm.workspace import globs as _globs
+from cycode.cli.files_collector.sca.npm.workspace import resolvers as _resolvers
+from cycode.cli.files_collector.sca.npm.workspace.coverage import (
+    WorkspaceCoverage,
+    find_covering_workspace,
+    is_covered_workspace_member,
+)
+from cycode.cli.files_collector.sca.npm.workspace.names import (
+    BUN_BINARY_LOCK_FILE_NAME,
+    BUN_LOCK_FILE_NAME,
+    DENO_LOCK_FILE_NAME,
+    MANIFEST_FILE_NAME,
+    NPM_LOCK_FILE_NAME,
+    NPM_SHRINKWRAP_FILE_NAME,
+    PNPM_LOCK_FILE_NAME,
+    YARN_LOCK_FILE_NAME,
+)
+from cycode.cli.files_collector.sca.npm.workspace.resolvers import MEMBER_RESOLVERS
+
+
+def clear_cache() -> None:
+    """Drop every memo, so one scan never inherits another scan's view of the filesystem."""
+    _resolvers.clear_cache()
+    _globs.clear_cache()
+    _coverage.clear_cache()
+
+
+__all__ = [
+    'BUN_BINARY_LOCK_FILE_NAME',
+    'BUN_LOCK_FILE_NAME',
+    'DENO_LOCK_FILE_NAME',
+    'MANIFEST_FILE_NAME',
+    'MEMBER_RESOLVERS',
+    'NPM_LOCK_FILE_NAME',
+    'NPM_SHRINKWRAP_FILE_NAME',
+    'PNPM_LOCK_FILE_NAME',
+    'YARN_LOCK_FILE_NAME',
+    'WorkspaceCoverage',
+    'clear_cache',
+    'find_covering_workspace',
+    'is_covered_workspace_member',
+]

cycode/cli/files_collector/sca/npm/workspace/coverage.py

@@ -0,0 +1,142 @@
+"""Walking up from a manifest to the lockfile that already resolves it."""
+
+import os
+from pathlib import Path
+from typing import TYPE_CHECKING, NamedTuple, Optional
+
+from cycode.cli.files_collector.sca.npm.workspace.files import logger, resolved_path
+from cycode.cli.files_collector.sca.npm.workspace.globs import declares_workspace_member
+from cycode.cli.files_collector.sca.npm.workspace.resolvers import MEMBER_RESOLVERS
+from cycode.cli.utils.path_utils import is_sub_path
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+_GIT_DIR_NAME = '.git'
+
+_reported_unscanned_roots: set = set()
+
+
+def clear_cache() -> None:
+    _reported_unscanned_roots.clear()
+
+
+class WorkspaceCoverage(NamedTuple):
+    package_manager: str
+    lock_file: Path
+
+
+def _scan_root_directories(scan_roots: tuple) -> list:
+    """The directory each scanned path stands for; scanning a file scans its directory."""
+    directories = []
+    for scan_root in scan_roots:
+        resolved = resolved_path(scan_root)
+        if os.path.isfile(resolved):
+            resolved = os.path.dirname(resolved)
+
+        if resolved:
+            directories.append(resolved)
+
+    return directories
+
+
+def _containing_scan_roots(manifest_dir: Path, scan_roots: tuple) -> list:
+    resolved_manifest_dir = resolved_path(manifest_dir)
+    return [
+        Path(directory)
+        for directory in _scan_root_directories(scan_roots)
+        if is_sub_path(directory, resolved_manifest_dir)
+    ]
+
+
+def _resolve_walk_boundary(manifest_dir: Path, scan_roots: tuple) -> Optional[Path]:
+    for root_dir in manifest_dir.parents:
+        if (root_dir / _GIT_DIR_NAME).exists():
+            return root_dir
+
+    containing = _containing_scan_roots(manifest_dir, scan_roots)
+    if containing:
+        return min(containing, key=lambda scan_root: len(scan_root.parts))
+
+    if scan_roots:
+        return manifest_dir
+
+    return None
+
+
+def _workspace_root_candidates(manifest_dir: Path, scan_roots: tuple) -> 'Iterator[Path]':
+    boundary = _resolve_walk_boundary(manifest_dir, scan_roots)
+    resolved_boundary = resolved_path(boundary) if boundary is not None else None
+    if resolved_boundary == resolved_path(manifest_dir):
+        return
+
+    for root_dir in manifest_dir.parents:
+        yield root_dir
+        if resolved_boundary is not None and resolved_path(root_dir) == resolved_boundary:
+            return
+
+
+def _find_covering_workspace(manifest_dir: Path, scan_roots: tuple) -> Optional[WorkspaceCoverage]:
+    for root_dir in _workspace_root_candidates(manifest_dir, scan_roots):
+        member_path = manifest_dir.relative_to(root_dir).as_posix()
+
+        for resolver in MEMBER_RESOLVERS:
+            for lock_file_name in resolver.lock_file_names:
+                lock_file = root_dir / lock_file_name
+                if not lock_file.is_file():
+                    continue
+
+                member_names = resolver.resolve(lock_file)
+                if member_names is not None:
+                    if member_path in member_names:
+                        return WorkspaceCoverage(resolver.package_manager, lock_file)
+                    continue
+
+                if resolver.may_use_workspace_globs and declares_workspace_member(root_dir, member_path):
+                    return WorkspaceCoverage(resolver.package_manager, lock_file)
+
+    return None
+
+
+def find_covering_workspace(manifest_dir: Optional[str], scan_roots: tuple = ()) -> Optional[WorkspaceCoverage]:
+    if not manifest_dir:
+        return None
+
+    return _find_covering_workspace(Path(manifest_dir), scan_roots)
+
+
+def _is_inside_scanned_paths(scan_roots: tuple, root_dir: Path) -> bool:
+    directories = _scan_root_directories(scan_roots)
+    if not directories:
+        logger.debug('No scanned paths in context; treating the workspace root as scanned, %s', {'root': str(root_dir)})
+        return True
+
+    resolved_root_dir = resolved_path(root_dir)
+    return any(is_sub_path(directory, resolved_root_dir) for directory in directories)
+
+
+def is_covered_workspace_member(manifest_dir: Optional[str], document_path: str, scan_roots: tuple = ()) -> bool:
+    coverage = find_covering_workspace(manifest_dir, scan_roots)
+    if coverage is None:
+        return False
+
+    details = {
+        'path': document_path,
+        'root_lockfile': str(coverage.lock_file),
+        'workspace': coverage.package_manager,
+    }
+    if _is_inside_scanned_paths(scan_roots, coverage.lock_file.parent):
+        logger.debug('Skipping restore: the workspace root lockfile already covers this member, %s', details)
+        return True
+
+    report_key = (document_path, str(coverage.lock_file))
+    if report_key not in _reported_unscanned_roots:
+        _reported_unscanned_roots.add(report_key)
+        logger.warning(
+            'The workspace root lockfile is outside the scanned path and will not be collected, '
+            'so this member is restored on its own. Scan the workspace root for the versions it '
+            'actually installs, %s',
+            details,
+        )
+
+    return False

cycode/cli/files_collector/sca/npm/workspace/files.py

@@ -0,0 +1,38 @@
+"""Filesystem access shared by the readers: identity for caching, and tolerant parsing."""
+
+import json
+import os
+from pathlib import Path
+from typing import Optional
+
+from cycode.cli.utils.path_utils import get_absolute_path
+from cycode.logger import get_logger
+
+logger = get_logger('SCA NPM Workspace')
+
+FileStamp = tuple[str, int, int]
+
+
+def resolved_path(path: object) -> str:
+    return os.path.realpath(get_absolute_path(str(path)))
+
+
+def file_stamp(path: Path) -> Optional[FileStamp]:
+    try:
+        stat_result = path.stat()
+    except OSError:
+        return None
+
+    return str(path), stat_result.st_mtime_ns, stat_result.st_size
+
+
+def read_json_object(path: Path) -> Optional[dict]:
+    try:
+        content = json.loads(path.read_text(encoding='UTF-8'))
+    except FileNotFoundError:
+        return None
+    except (OSError, ValueError) as e:
+        logger.debug('Could not read an npm workspace file, %s', {'path': str(path), 'error': e})
+        return None
+
+    return content if isinstance(content, dict) else None

cycode/cli/files_collector/sca/npm/workspace/globs.py

@@ -0,0 +1,116 @@
+"""Matching a member against the manifest's workspaces globs.
+
+Only reached for lockfiles that cannot name their own members: classic yarn.lock and the
+binary bun.lockb. Every other format answers from the lockfile itself.
+"""
+
+import fnmatch
+from functools import lru_cache
+from pathlib import Path
+from typing import NamedTuple
+
+from cycode.cli.files_collector.sca.npm.workspace.files import FileStamp, file_stamp, read_json_object
+from cycode.cli.files_collector.sca.npm.workspace.names import MANIFEST_FILE_NAME
+
+_MANIFEST_WORKSPACES_SECTION = 'workspaces'
+_MANIFEST_WORKSPACE_PACKAGES_SECTION = 'packages'
+_NEGATION_PREFIX = '!'
+_GLOBSTAR = '**'
+_SEGMENT_MATCH_CACHE_SIZE = 4096
+
+
+class _WorkspacePatterns(NamedTuple):
+    included: tuple[str, ...]
+    excluded: tuple[str, ...]
+
+
+_EMPTY_WORKSPACE_PATTERNS = _WorkspacePatterns((), ())
+
+_workspace_patterns_cache: dict[FileStamp, _WorkspacePatterns] = {}
+
+
+def clear_cache() -> None:
+    _workspace_patterns_cache.clear()
+
+
+def _matches_workspace_pattern(pattern: str, member_path: str) -> bool:
+    """Match a workspace glob against a member path, one path segment at a time.
+
+    fnmatch is wrong for a whole path because its * crosses a separator, but inside one
+    segment there is no separator, so it is exactly right there - and it brings character
+    classes with it. Only ** needs handling here, because only ** spans segments.
+    """
+    return _match_segments(tuple(pattern.split('/')), tuple(member_path.split('/')))
+
+
+@lru_cache(maxsize=_SEGMENT_MATCH_CACHE_SIZE)
+def _match_segments(pattern_segments: tuple, path_segments: tuple) -> bool:
+    """Memoised so that several ** in one pattern cannot make this exponential.
+
+    Each ** tries every split of the remaining path, so without memoisation a pattern such as
+    **/**/**/x against a deep tree multiplies out. The arguments are plain tuples of strings,
+    so a result can never go stale.
+    """
+    if not pattern_segments:
+        return not path_segments
+
+    head, rest = pattern_segments[0], pattern_segments[1:]
+    if head == _GLOBSTAR:
+        # ** spans zero or more segments, and spanning zero is what makes dir/** match dir
+        return any(_match_segments(rest, path_segments[index:]) for index in range(len(path_segments) + 1))
+
+    if not path_segments:
+        return False
+
+    return fnmatch.fnmatchcase(path_segments[0], head) and _match_segments(rest, path_segments[1:])
+
+
+def _split_workspace_patterns(declared: list) -> _WorkspacePatterns:
+    included = []
+    excluded = []
+    for entry in declared:
+        stripped = entry.strip()
+        is_excluded = stripped.startswith(_NEGATION_PREFIX)
+        normalized = (stripped[1:] if is_excluded else stripped).strip()
+        if normalized.startswith('./'):
+            normalized = normalized[2:]
+
+        normalized = normalized.rstrip('/')
+        if not normalized:
+            continue
+
+        if is_excluded:
+            excluded.append(normalized)
+        else:
+            included.append(normalized)
+
+    return _WorkspacePatterns(tuple(included), tuple(excluded))
+
+
+def _read_manifest_workspace_patterns(root_dir: Path) -> _WorkspacePatterns:
+    manifest = root_dir / MANIFEST_FILE_NAME
+    stamp = file_stamp(manifest)
+    if stamp is None:
+        return _EMPTY_WORKSPACE_PATTERNS
+
+    cached = _workspace_patterns_cache.get(stamp)
+    if cached is not None:
+        return cached
+
+    content = read_json_object(manifest)
+    workspaces = content.get(_MANIFEST_WORKSPACES_SECTION) if content is not None else None
+    if isinstance(workspaces, dict):
+        workspaces = workspaces.get(_MANIFEST_WORKSPACE_PACKAGES_SECTION)
+
+    declared = [entry for entry in workspaces if isinstance(entry, str)] if isinstance(workspaces, list) else []
+    patterns = _split_workspace_patterns(declared)
+    _workspace_patterns_cache[stamp] = patterns
+    return patterns
+
+
+def declares_workspace_member(root_dir: Path, member_path: str) -> bool:
+    patterns = _read_manifest_workspace_patterns(root_dir)
+    if not any(_matches_workspace_pattern(pattern, member_path) for pattern in patterns.included):
+        return False
+
+    return not any(_matches_workspace_pattern(pattern, member_path) for pattern in patterns.excluded)

cycode/cli/files_collector/sca/npm/workspace/names.py

@@ -0,0 +1,16 @@
+"""File names and package-manager identifiers shared across the workspace package."""
+
+MANIFEST_FILE_NAME = 'package.json'
+
+NPM_PACKAGE_MANAGER = 'npm'
+YARN_PACKAGE_MANAGER = 'yarn'
+PNPM_PACKAGE_MANAGER = 'pnpm'
+BUN_PACKAGE_MANAGER = 'bun'
+
+NPM_LOCK_FILE_NAME = 'package-lock.json'
+NPM_SHRINKWRAP_FILE_NAME = 'npm-shrinkwrap.json'
+YARN_LOCK_FILE_NAME = 'yarn.lock'
+PNPM_LOCK_FILE_NAME = 'pnpm-lock.yaml'
+BUN_LOCK_FILE_NAME = 'bun.lock'
+BUN_BINARY_LOCK_FILE_NAME = 'bun.lockb'
+DENO_LOCK_FILE_NAME = 'deno.lock'

cycode/cli/files_collector/sca/npm/workspace/resolvers.py

@@ -0,0 +1,294 @@
+"""Reading the members a root lockfile resolves, one reader per lockfile format.
+
+A reader that returns a set is the authority on that lockfile, including when the set is empty.
+None means the format cannot name its members at all, and only then does may_use_workspace_globs
+decide whether the manifest globs get a say.
+"""
+
+import json
+import re
+from abc import ABC, abstractmethod
+from pathlib import Path
+from typing import Optional
+
+import yaml
+
+from cycode.cli.files_collector.sca.npm.workspace.files import FileStamp, file_stamp, logger, read_json_object
+from cycode.cli.files_collector.sca.npm.workspace.names import (
+    BUN_BINARY_LOCK_FILE_NAME,
+    BUN_LOCK_FILE_NAME,
+    BUN_PACKAGE_MANAGER,
+    NPM_LOCK_FILE_NAME,
+    NPM_PACKAGE_MANAGER,
+    NPM_SHRINKWRAP_FILE_NAME,
+    PNPM_LOCK_FILE_NAME,
+    PNPM_PACKAGE_MANAGER,
+    YARN_LOCK_FILE_NAME,
+    YARN_PACKAGE_MANAGER,
+)
+
+_LOCKFILE_PACKAGES_SECTION = 'packages'
+_NODE_MODULES_SEPARATOR = 'node_modules/'
+_PNPM_LOCKFILE_IMPORTERS_SECTION = 'importers'
+_PNPM_LOCKFILE_ROOT_IMPORTER = '.'
+_YAML_COMMENT_PREFIX = '#'
+_YARN_BERRY_MARKER = '__metadata'
+_YARN_RESOLUTION_PREFIX = 'resolution:'
+_YARN_WORKSPACE_PROTOCOL = re.compile(r'@workspace:([^"\',\s]+)')
+_BUN_LOCKFILE_WORKSPACES_SECTION = 'workspaces'
+_TRAILING_COMMA = re.compile(r',(\s*[}\]])')
+
+_member_names_cache: dict[FileStamp, Optional[frozenset[str]]] = {}
+
+
+def clear_cache() -> None:
+    _member_names_cache.clear()
+
+
+def _normalize_member_path(member_path: str) -> Optional[str]:
+    normalized = member_path.strip()
+    if normalized.startswith('./'):
+        normalized = normalized[2:]
+
+    normalized = normalized.rstrip('/')
+    if not normalized or normalized == _PNPM_LOCKFILE_ROOT_IMPORTER:
+        return None
+
+    return normalized
+
+
+def _npm_lockfile_member_names(lock_file: Path) -> Optional[frozenset]:
+    content = read_json_object(lock_file)
+    packages = content.get(_LOCKFILE_PACKAGES_SECTION) if content is not None else None
+    if not isinstance(packages, dict):
+        return None
+
+    return frozenset(name for name in packages if name and _NODE_MODULES_SEPARATOR not in name)
+
+
+def _read_pnpm_importers_section(lock_file: Path) -> str:
+    """Slice out the top-level importers block so a large lockfile is not parsed in full."""
+    section = []
+    inside = False
+    try:
+        with lock_file.open(encoding='UTF-8') as lock_file_lines:
+            for raw_line in lock_file_lines:
+                line = raw_line.rstrip('\n').rstrip('\r')
+                if not inside:
+                    if line.startswith(f'{_PNPM_LOCKFILE_IMPORTERS_SECTION}:'):
+                        inside = True
+                        section.append(line)
+                    continue
+
+                if line.startswith(_YAML_COMMENT_PREFIX):
+                    continue
+
+                if line and not line[0].isspace():
+                    break
+
+                section.append(line)
+    except FileNotFoundError:
+        return ''
+    except (OSError, ValueError) as e:
+        logger.debug('Could not read a pnpm lockfile, %s', {'path': str(lock_file), 'error': e})
+        return ''
+
+    return '\n'.join(section)
+
+
+def _pnpm_lockfile_member_names(lock_file: Path) -> Optional[frozenset]:
+    section = _read_pnpm_importers_section(lock_file)
+    if not section:
+        return None
+
+    try:
+        content = yaml.safe_load(section)
+    except (ValueError, yaml.YAMLError) as e:
+        logger.debug('Could not read a pnpm lockfile, %s', {'path': str(lock_file), 'error': e})
+        return None
+
+    importers = content.get(_PNPM_LOCKFILE_IMPORTERS_SECTION) if isinstance(content, dict) else None
+    if not isinstance(importers, dict):
+        return None
+
+    member_names = set()
+    for name in importers:
+        if not isinstance(name, str):
+            continue
+
+        normalized = _normalize_member_path(name)
+        if normalized:
+            member_names.add(normalized)
+
+    # a lockfile whose only importer is the root describes a single package, not a workspace
+    return frozenset(member_names) or None
+
+
+def _bun_lockfile_member_names(lock_file: Path) -> Optional[frozenset]:
+    """bun.lock is JSON with trailing commas, and names its members under "workspaces"."""
+    try:
+        text = lock_file.read_text(encoding='UTF-8')
+    except FileNotFoundError:
+        return None
+    except (OSError, ValueError) as e:
+        logger.debug('Could not read a bun lockfile, %s', {'path': str(lock_file), 'error': e})
+        return None
+
+    try:
+        content = json.loads(text)
+    except ValueError:
+        try:
+            content = json.loads(_TRAILING_COMMA.sub(r'\1', text))
+        except ValueError as e:
+            logger.debug('Could not read a bun lockfile, %s', {'path': str(lock_file), 'error': e})
+            return None
+
+    workspaces = content.get(_BUN_LOCKFILE_WORKSPACES_SECTION) if isinstance(content, dict) else None
+    if not isinstance(workspaces, dict):
+        return None
+
+    member_names = {normalized for normalized in map(_normalize_member_path, workspaces) if normalized}
+    return frozenset(member_names)
+
+
+def _yarn_lockfile_member_names(lock_file: Path) -> Optional[frozenset]:
+    """Yarn berry records every member as "<name>@workspace:<path>"; classic yarn records nothing."""
+    try:
+        text = lock_file.read_text(encoding='UTF-8', errors='replace')
+    except FileNotFoundError:
+        return None
+    except (OSError, ValueError) as e:
+        logger.debug('Could not read a yarn lockfile, %s', {'path': str(lock_file), 'error': e})
+        return None
+
+    if _YARN_BERRY_MARKER not in text:
+        return None  # classic: flat, so the manifest globs are the only remaining source
+
+    member_names = set()
+    for line in text.splitlines():
+        # every entry carries a resolution naming its real path; the dependency entries carry
+        # ranges instead (workspace:^, workspace:*), which are not paths
+        if not line.strip().startswith(_YARN_RESOLUTION_PREFIX):
+            continue
+
+        for declared_path in _YARN_WORKSPACE_PROTOCOL.findall(line):
+            normalized = _normalize_member_path(declared_path)
+            if normalized:
+                member_names.add(normalized)
+
+    # berry always records what it installed, so an empty result means this is not a workspace
+    return frozenset(member_names)
+
+
+class WorkspaceMemberResolver(ABC):
+    """Reads, from one root lockfile, the member directories that lockfile resolves."""
+
+    @property
+    @abstractmethod
+    def package_manager(self) -> str: ...
+
+    @property
+    @abstractmethod
+    def lock_file_names(self) -> tuple: ...
+
+    @property
+    def may_use_workspace_globs(self) -> bool:
+        """Whether an unanswerable lockfile may defer to the manifest's workspaces globs.
+
+        False means the silence is itself an answer: a v1 package-lock predates workspaces, so
+        its root is simply not one. True means the format has workspaces but does not record
+        them, leaving the globs as the only remaining source.
+        """
+        return False
+
+    def resolve(self, lock_file: Path) -> Optional[frozenset]:
+        """Member paths this lockfile resolves, or None when it cannot name them.
+
+        Caches on the file's identity so one scan parses each root lockfile once.
+        """
+        stamp = file_stamp(lock_file)
+        if stamp is None:
+            return None
+
+        if stamp in _member_names_cache:
+            return _member_names_cache[stamp]
+
+        member_names = self._read_member_names(lock_file)
+        _member_names_cache[stamp] = member_names
+        return member_names
+
+    @abstractmethod
+    def _read_member_names(self, lock_file: Path) -> Optional[frozenset]: ...
+
+
+class NpmLockfileResolver(WorkspaceMemberResolver):
+    package_manager = NPM_PACKAGE_MANAGER
+    lock_file_names = (NPM_LOCK_FILE_NAME, NPM_SHRINKWRAP_FILE_NAME)
+
+    def _read_member_names(self, lock_file: Path) -> Optional[frozenset]:
+        return _npm_lockfile_member_names(lock_file)
+
+
+class PnpmLockfileResolver(WorkspaceMemberResolver):
+    package_manager = PNPM_PACKAGE_MANAGER
+    lock_file_names = (PNPM_LOCK_FILE_NAME,)
+
+    def _read_member_names(self, lock_file: Path) -> Optional[frozenset]:
+        return _pnpm_lockfile_member_names(lock_file)
+
+
+class YarnLockfileResolver(WorkspaceMemberResolver):
+    """Berry names every member; classic is flat and names none, so only classic needs the globs."""
+
+    package_manager = YARN_PACKAGE_MANAGER
+    lock_file_names = (YARN_LOCK_FILE_NAME,)
+    may_use_workspace_globs = True
+
+    def _read_member_names(self, lock_file: Path) -> Optional[frozenset]:
+        return _yarn_lockfile_member_names(lock_file)
+
+
+class BunLockfileResolver(WorkspaceMemberResolver):
+    """Only the text bun.lock names members; the binary bun.lockb is handled as opaque."""
+
+    package_manager = BUN_PACKAGE_MANAGER
+    lock_file_names = (BUN_LOCK_FILE_NAME,)
+
+    def _read_member_names(self, lock_file: Path) -> Optional[frozenset]:
+        return _bun_lockfile_member_names(lock_file)
+
+
+class OpaqueLockfileResolver(WorkspaceMemberResolver):
+    """A lockfile we cannot read members from at all, so the manifest globs decide."""
+
+    may_use_workspace_globs = True
+
+    def __init__(self, package_manager: str, lock_file_names: tuple) -> None:
+        self._package_manager = package_manager
+        self._lock_file_names = lock_file_names
+
+    @property
+    def package_manager(self) -> str:
+        return self._package_manager
+
+    @property
+    def lock_file_names(self) -> tuple:
+        return self._lock_file_names
+
+    def _read_member_names(self, lock_file: Path) -> Optional[frozenset]:
+        return None
+
+
+# Order is precedence: the first lockfile that resolves the member wins.
+#
+# deno.lock is deliberately absent. The glob fallback reads the manifest's workspaces field,
+# which deno does not use - it declares members in deno.json - so a match there would be
+# meaningless. A deno.lock beside a manifest still stops the npm fallback, through the
+# alternative-lockfile guard in the npm handler.
+MEMBER_RESOLVERS = (
+    NpmLockfileResolver(),
+    YarnLockfileResolver(),
+    PnpmLockfileResolver(),
+    BunLockfileResolver(),
+    OpaqueLockfileResolver(BUN_PACKAGE_MANAGER, (BUN_BINARY_LOCK_FILE_NAME,)),
+)

cycode/cli/files_collector/sca/sca_file_collector.py

@@ -15,6 +15,7 @@ from cycode.cli.files_collector.sca.npm.restore_deno_dependencies import Restore
 from cycode.cli.files_collector.sca.npm.restore_npm_dependencies import RestoreNpmDependencies
 from cycode.cli.files_collector.sca.npm.restore_pnpm_dependencies import RestorePnpmDependencies
 from cycode.cli.files_collector.sca.npm.restore_yarn_dependencies import RestoreYarnDependencies
+from cycode.cli.files_collector.sca.npm.workspace import clear_cache as clear_npm_workspace_cache
 from cycode.cli.files_collector.sca.nuget.restore_nuget_dependencies import RestoreNugetDependencies
 from cycode.cli.files_collector.sca.php.restore_composer_dependencies import RestoreComposerDependencies
 from cycode.cli.files_collector.sca.python.restore_pip_dependencies import RestorePipDependencies
@@ -186,6 +187,8 @@ def _add_dependencies_tree_documents(
         {'documents_count': len(documents_to_scan), 'is_git_diff': is_git_diff},
     )
 
+    clear_npm_workspace_cache()
+
     documents_to_add: dict[str, Document] = {document.path: document for document in documents_to_scan}
     restore_dependencies_list = _get_restore_handlers(ctx, is_git_diff)
 

cycode/cli/utils/path_utils.py

@@ -152,11 +152,38 @@ def concat_unique_id(filename: str, unique_id: str) -> str:
     return str(PurePosixPath(unique_id, *_to_relative_posix_parts(filename)))
 
 
+def _as_scan_root(value: object) -> Optional[str]:
+    if isinstance(value, (str, os.PathLike)):
+        return os.fspath(value) or None
+
+    return None
+
+
+def get_scan_roots_from_context(ctx: typer.Context) -> tuple[str, ...]:
+    """Every path the user asked to scan, in the order they were given.
+
+    Typer declares these arguments as Path, so callers must not assume str.
+    """
+    params = getattr(ctx, 'params', None)
+    if not isinstance(params, dict):
+        return ()
+
+    scan_roots = []
+
+    single_root = _as_scan_root(params.get('path'))
+    if single_root:
+        scan_roots.append(single_root)
+
+    paths = params.get('paths')
+    if isinstance(paths, (list, tuple)):
+        scan_roots.extend(root for root in (_as_scan_root(entry) for entry in paths) if root)
+
+    return tuple(dict.fromkeys(scan_roots))
+
+
 def get_path_from_context(ctx: typer.Context) -> Optional[str]:
-    path = ctx.params.get('path')
-    if path is None and 'paths' in ctx.params:
-        path = ctx.params['paths'][0]
-    return path
+    scan_roots = get_scan_roots_from_context(ctx)
+    return scan_roots[0] if scan_roots else None
 
 
 def normalize_file_path(path: str) -> str:

{cycode-3.25.1.dev3.dist-info → cycode-3.25.1.dev4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.25.1.dev3
+Version: 3.25.1.dev4
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.25.1.dev3.dist-info → cycode-3.25.1.dev4.dist-info}/RECORD

@@ -1,4 +1,4 @@
-cycode/__init__.py,sha256=Uxh4lCeCfYefGh3r8cEeh8PoZoo57mzGAHTYnBAyU2c,396
+cycode/__init__.py,sha256=maSJqqkxg3160B3eJEs3M1LWs_m8n1e6k8181bbO1IA,396
 cycode/__main__.py,sha256=Z3bD5yrA7yPvAChcADQrqCaZd0ChGI1gdiwALwbWJ6U,104
 cycode/cli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/app.py,sha256=AlR2durAEbsa47PDfIj7JtMvJDWA_Dq6wPtVuMJYSCs,10250
@@ -124,11 +124,17 @@ cycode/cli/files_collector/sca/maven/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeu
 cycode/cli/files_collector/sca/maven/restore_gradle_dependencies.py,sha256=2W5Y8yrSIV7o4rCUtNsqO2YFImvcY5TnabzTbStiaBo,3261
 cycode/cli/files_collector/sca/maven/restore_maven_dependencies.py,sha256=zObNN8n6yUriNVB3ZdvAkoKXXrMvzU9Lpd5lNhVo_so,4003
 cycode/cli/files_collector/sca/npm/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-cycode/cli/files_collector/sca/npm/restore_bun_dependencies.py,sha256=HI0X_19wCM6B_vRpX6uD12dXsQbU6LCcLQdobPZDgAs,4580
-cycode/cli/files_collector/sca/npm/restore_deno_dependencies.py,sha256=XL0VXEPL0jf6ruZZkCpv99lkU8-MNc09CU1fgGgTbHs,1768
-cycode/cli/files_collector/sca/npm/restore_npm_dependencies.py,sha256=Uwoemv18PX2_9pSGzyYJ7wixQtgDZVOuuJuHIjdnF7M,3173
-cycode/cli/files_collector/sca/npm/restore_pnpm_dependencies.py,sha256=CcvJOox2JpWl_UeCjMP9I8fP85bPZXfhH7IwLzq2U8E,2708
-cycode/cli/files_collector/sca/npm/restore_yarn_dependencies.py,sha256=903Ra2YOKwlJnknG47embjPLQUajUb8_1j94GAVcnX0,2698
+cycode/cli/files_collector/sca/npm/restore_bun_dependencies.py,sha256=65mrzCwQTLpm7f5VUxLqIP_yiX5BFj66WM85Z4W2H9E,4857
+cycode/cli/files_collector/sca/npm/restore_deno_dependencies.py,sha256=II3JBROuh1cqPHHsFYU78ej-mUIgqN9iwVB-czWAtIo,1811
+cycode/cli/files_collector/sca/npm/restore_npm_dependencies.py,sha256=zRoXhkJnqaic3Bd7_3rqtzqP404kyP2NuJM8LpgfePk,4023
+cycode/cli/files_collector/sca/npm/restore_pnpm_dependencies.py,sha256=FkYpbA1cFKHHudhedAzxGIm1L2oBB-mtxQHAB6O0ATs,2979
+cycode/cli/files_collector/sca/npm/restore_yarn_dependencies.py,sha256=qy-5uEBkw5c4xmjb5r6Cvx84XeS7fxdWcWSHIixM38w,2974
+cycode/cli/files_collector/sca/npm/workspace/__init__.py,sha256=G0b_a6ZrgOnqpicf0ZvXZ4Zvs5LH-uBkqi8LzRigl7s,1611
+cycode/cli/files_collector/sca/npm/workspace/coverage.py,sha256=JLpsASXCiTgdFZX5xFN1jPqplFSGMU05qG28hJiXXTw,5039
+cycode/cli/files_collector/sca/npm/workspace/files.py,sha256=uEnqs0TBRfaQ0C_Elqj1lzoNIU-mG4hqN_fS3g3Y59Q,1035
+cycode/cli/files_collector/sca/npm/workspace/globs.py,sha256=TBh6UHHN4Z391Ap3TmANJ5HrPLWcOnQuitoCm2Amoz0,4231
+cycode/cli/files_collector/sca/npm/workspace/names.py,sha256=mL6lp73EFemCuHqeg1GoDHa6GR0cH52sjcfmkgpaXVs,510
+cycode/cli/files_collector/sca/npm/workspace/resolvers.py,sha256=5WhhlACE9NYaQRyfOfFM64ScruQ7bvORlbmuU7J8QQI,10295
 cycode/cli/files_collector/sca/nuget/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/files_collector/sca/nuget/restore_nuget_dependencies.py,sha256=wUsuO_JusyIPTBfocHAr48L7rdYtP1B86N0nS4FXdXg,1123
 cycode/cli/files_collector/sca/php/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -142,7 +148,7 @@ cycode/cli/files_collector/sca/ruby/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQ
 cycode/cli/files_collector/sca/ruby/restore_ruby_dependencies.py,sha256=Vqswcxte9YjGnvIm9oZ8r91jNyhuiYDf1mouaTaLg3U,694
 cycode/cli/files_collector/sca/sbt/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/files_collector/sca/sbt/restore_sbt_dependencies.py,sha256=cfBUR4iQcfplX_O2QPjYh2wSyBteze8wZcT_dG9d1d4,709
-cycode/cli/files_collector/sca/sca_file_collector.py,sha256=yqrWw_1FE3Q-KJJj756GTl36bcYa5pr7O6yByebyMng,10764
+cycode/cli/files_collector/sca/sca_file_collector.py,sha256=IKDV-rEXTse7bQuJapKWN_mWlGjug2mkAbb3KyFYpkE,10895
 cycode/cli/files_collector/walk_ignore.py,sha256=nvOM6oDmT2SxSI4pU-bLlc9LwTgkfTd2egse69ixf3g,2464
 cycode/cli/files_collector/zip_documents.py,sha256=FMzbA2Vog7Zl_ntizNQJK8AFqoGu0QlPIMIBpgmBiVI,1852
 cycode/cli/logger.py,sha256=mlaYEQGYd582fTCc3SC3cFMj0PKTB6EsaI12Q4VL1z8,65
@@ -183,7 +189,7 @@ cycode/cli/utils/git_proxy.py,sha256=FPHMBiyLFK9X9vKYpKySRKJH6Dc9Cb3nO241Q95dASE
 cycode/cli/utils/host_info.py,sha256=Clln3qCJR00rw6HndD0bAIv329n_bOEx42TKW6FqXFQ,6379
 cycode/cli/utils/ignore_utils.py,sha256=cODqhnOHA2kRo8rMY0YcmcKkmXNPOC9UTCmFu62RRqE,15567
 cycode/cli/utils/jwt_utils.py,sha256=EGI-0CKhCGY8hIcZ9b9diq9hqtOUf8Ha8ukeVJIf974,818
-cycode/cli/utils/path_utils.py,sha256=YlAUz2seaKT25ggqcnAjxqQd1oUlXTn1LIebBOht4nQ,5699
+cycode/cli/utils/path_utils.py,sha256=lRFVhmzW1XGoC7U-_-2Lx_vfiSgo1IhGCEfARW3Y6oQ,6493
 cycode/cli/utils/progress_bar.py,sha256=bKBWHHdZsVkdDdWMJLfgLGR0cBYeB44P_DpRM8pvWqU,9528
 cycode/cli/utils/scan_batch.py,sha256=5xKGVDVqoRxdKhuZkK11x4QrNqKmU20Q83E_fy8Nndk,5188
 cycode/cli/utils/scan_utils.py,sha256=_VkZ7maLVST6J8dsqDsKYWQj2EVfqI3iPPsA1QJOGEU,1259
@@ -217,8 +223,8 @@ cycode/cyclient/report_client.py,sha256=Scq30NeJPzgXv0hPLO1U05AdE9i_2iu6cIrSKpEJ
 cycode/cyclient/scan_client.py,sha256=DqAZ7u6Z_cvw9A9RlLkAQUgLRwPCCAsUq5U9umt4F7Y,16955
 cycode/cyclient/scan_config_base.py,sha256=mXsPZGYCtp85rv5GIige40yQZXuRcEKUW-VQJ0vgFzk,1201
 cycode/logger.py,sha256=EfZGRK6VC5rE_LAjIcRrHFiQCueylCDXoG6bvGkrIME,2111
-cycode-3.25.1.dev3.dist-info/METADATA,sha256=Y_14tHtp3UGIIHfm5FtvvPh-ZTgCDhhSgymB9KyNENQ,96824
-cycode-3.25.1.dev3.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
-cycode-3.25.1.dev3.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
-cycode-3.25.1.dev3.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
-cycode-3.25.1.dev3.dist-info/RECORD,,
+cycode-3.25.1.dev4.dist-info/METADATA,sha256=Lf-JTQlrq2jGCZcRrGL1uQJexg0UkInWT_mOjm7A5bk,96824
+cycode-3.25.1.dev4.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
+cycode-3.25.1.dev4.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
+cycode-3.25.1.dev4.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
+cycode-3.25.1.dev4.dist-info/RECORD,,