feat(sca): discovery-source provenance + ecosystem-locked matching

- Lock SCA findings to the ecosystem of their source: the manifest walker prunes
  ecosystem install dirs (single source of truth in internal/ecosystems) so a
  foreign manifest bundled in an install dir is not mis-attributed.
- Capture per-package discovery provenance — declared in a manifest vs found only
  in an install directory (SourceType/InstalledPath) — and send it to /v2/cli.sca
  so the Introduced Via tab can show it.
- Extend install-directory discovery (npm node_modules, python site-packages) and
  pip requirements detection.

Author: 0x73746F66

cmd/cli_sca.go

@@ -530,6 +530,8 @@ func buildCliPackages(pkgs []scan.ScopedPackage, manifestGroups []scan.ManifestG
 			Scope:         scope,
 			License:       licenseByKey[key],
 			IntroducedVia: [][]string{chain},
+			SourceType:    p.SourceType,
+			InstalledPath: p.InstalledPath,
 		}
 
 		if len(p.Checksums) > 0 {

cmd/scan.go

@@ -898,9 +898,34 @@ func runLocalScan(
 				pkgs = resolved
 			}
 
-			// Replace absolute path with relative path in each package.
+			// Python build-or-lock gate: an unpinned pip manifest (requirements
+			// files, pyproject.toml, Pipfile) with no sibling lock must resolve
+			// against the installed environment. A confident file that can't be
+			// resolved is a fatal error (build the app or generate a lock file); a
+			// tentatively-detected file (bare names, ambiguous) that can't be
+			// confirmed against installed packages is silently disregarded.
+			if scan.IsPythonGatedManifest(f.ManifestInfo.Type) && len(pkgs) > 0 &&
+				!scan.RequirementsFullyLocked(pkgs) && !scan.PyLockfilePresent(filepath.Dir(f.Path)) {
+				confident := f.ManifestInfo.Confidence != scan.ConfidenceTentative
+				resolved, rerr := scan.ResolvePythonRequirementsFromSitePackages(f.Path, f.RelPath, pkgs, confident)
+				if rerr != nil {
+					if confident {
+						return rerr
+					}
+					continue // tentative + unconfirmed → not a requirements file
+				}
+				pkgs = resolved
+			}
+
+			// Replace absolute path with relative path in each package, and tag
+			// manifest-declared packages. The npm node_modules resolver may have
+			// already flagged install-only packages as "installed" — don't clobber
+			// that; only default the unset (manifest-parsed) packages.
 			for i := range pkgs {
 				pkgs[i].SourceFile = f.RelPath
+				if pkgs[i].SourceType == "" {
+					pkgs[i].SourceType = scan.SourceTypeManifest
+				}
 			}
 
 			// Count by scope for the per-file summary line.

internal/cdx/local.go

@@ -507,16 +507,36 @@ func PopulateLicenses(bom *BOM, licenseMap map[string]string) {
 // BuildDependencies creates the CycloneDX dependencies array from ManifestGroup edges.
 // compRefs maps "name@version" → bom-ref for cross-referencing.
 func BuildDependencies(groups []scan.ManifestGroup, compRefs map[string]string) []CDXDependency {
-	// Build name → bom-ref index (without version, since edges use bare names).
+	// normName folds PyPI naming quirks (case, dash/underscore/dot) so edges keyed
+	// in normalised form still resolve to components keyed by their literal name.
+	normName := func(s string) string {
+		return strings.ToLower(strings.NewReplacer("-", "_", ".", "_").Replace(s))
+	}
+
+	// Build name → bom-ref indexes (without version, since edges use bare names):
+	// one raw, one normalised. Raw wins; the normalised index is a fallback.
 	nameToRef := map[string]string{}
+	normToRef := map[string]string{}
 	for key, ref := range compRefs {
 		// key is "name@version"; extract name.
 		if idx := strings.LastIndex(key, "@"); idx > 0 {
 			name := key[:idx]
 			if _, exists := nameToRef[name]; !exists {
 				nameToRef[name] = ref
 			}
+			if nk := normName(name); nk != "" {
+				if _, exists := normToRef[nk]; !exists {
+					normToRef[nk] = ref
+				}
+			}
+		}
+	}
+	resolveRef := func(name string) (string, bool) {
+		if ref, ok := nameToRef[name]; ok {
+			return ref, true
 		}
+		ref, ok := normToRef[normName(name)]
+		return ref, ok
 	}
 
 	seen := map[string]bool{}
@@ -527,7 +547,7 @@ func BuildDependencies(groups []scan.ManifestGroup, compRefs map[string]string)
 			continue
 		}
 		for parent, children := range mg.Graph.Edges {
-			parentRef, ok := nameToRef[parent]
+			parentRef, ok := resolveRef(parent)
 			if !ok {
 				continue
 			}
@@ -539,7 +559,7 @@ func BuildDependencies(groups []scan.ManifestGroup, compRefs map[string]string)
 			seenChild := map[string]bool{}
 			var childRefs []string
 			for _, child := range children {
-				if childRef, ok := nameToRef[child]; ok && !seenChild[childRef] {
+				if childRef, ok := resolveRef(child); ok && !seenChild[childRef] {
 					seenChild[childRef] = true
 					childRefs = append(childRefs, childRef)
 				}

internal/filetree/collector.go

@@ -31,9 +31,10 @@ var lockfileAssociations = map[string][]string{
 	"package.json":     {"package-lock.json", "yarn.lock", "pnpm-lock.yaml"},
 	"go.mod":           {"go.sum"},
 	"Cargo.toml":       {"Cargo.lock"},
-	"requirements.txt": {"Pipfile.lock", "poetry.lock", "uv.lock"},
+	"requirements.txt": {"Pipfile.lock", "poetry.lock", "uv.lock", "pylock.toml"},
+	"requirements.in":  {"requirements.txt", "poetry.lock", "uv.lock", "pylock.toml"},
 	"Pipfile":          {"Pipfile.lock"},
-	"pyproject.toml":   {"poetry.lock", "uv.lock"},
+	"pyproject.toml":   {"poetry.lock", "uv.lock", "pylock.toml"},
 	"Gemfile":          {"Gemfile.lock"},
 	"composer.json":    {"composer.lock"},
 	"pubspec.yaml":     {"pubspec.lock"},

internal/scan/depgraph.go

@@ -6,6 +6,8 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strings"
+
+	"github.com/BurntSushi/toml"
 )
 
 // DepGraph tracks direct vs transitive dependency relationships for a manifest group.
@@ -283,6 +285,150 @@ func (g *DepGraph) PopulateNpmLockEdges(lockFilePath string) error {
 	return nil
 }
 
+// PopulatePypiLockEdges builds dependency-tree edges for a pypi manifest group
+// from the lock files in dir. Edge keys/values are normalised (normPypi) so the
+// lock, `# via`, and installed-METADATA sources all merge on one key form;
+// BuildDependencies resolves SBOM component names against the same normalisation.
+// uv.lock and pylock.toml carry an explicit dependency tree; a `pip/uv compile`
+// requirements.txt carries it as inverted `# via` comments. All present sources
+// are merged.
+func (g *DepGraph) PopulatePypiLockEdges(dir string) {
+	if g == nil {
+		return
+	}
+	if g.Edges == nil {
+		g.Edges = make(map[string][]string)
+	}
+
+	// uv.lock — richest tree (explicit dependencies + optional-dependencies).
+	if data, err := os.ReadFile(filepath.Join(dir, "uv.lock")); err == nil {
+		var lock uvLockFile
+		if _, derr := toml.Decode(string(data), &lock); derr == nil {
+			for _, p := range lock.Package {
+				var children []string
+				for _, d := range p.Dependencies {
+					if d.Name != "" {
+						children = append(children, d.Name)
+					}
+				}
+				for _, deps := range p.OptionalDependencies {
+					for _, d := range deps {
+						if d.Name != "" {
+							children = append(children, d.Name)
+						}
+					}
+				}
+				g.addPypiEdges(normPypi(p.Name), normPypiList(children))
+			}
+		}
+	}
+
+	// pylock.toml — PEP 751 per-package dependencies, when the generator emits them.
+	if data, err := os.ReadFile(filepath.Join(dir, "pylock.toml")); err == nil {
+		var lock pylockFile
+		if _, derr := toml.Decode(string(data), &lock); derr == nil {
+			for _, p := range lock.Packages {
+				var children []string
+				for _, d := range p.Dependencies {
+					if d.Name != "" {
+						children = append(children, d.Name)
+					}
+				}
+				g.addPypiEdges(normPypi(p.Name), normPypiList(children))
+			}
+		}
+	}
+
+	// requirements.txt — invert the `# via` comments (only tree source when no
+	// lock file exists alongside a compiled, hashed requirements.txt).
+	if data, err := os.ReadFile(filepath.Join(dir, "requirements.txt")); err == nil {
+		for parent, children := range parseRequirementsViaEdges(string(data)) {
+			g.addPypiEdges(normPypi(parent), normPypiList(children))
+		}
+	}
+}
+
+// normPypiList normalises a list of PyPI package names (dropping empties).
+func normPypiList(names []string) []string {
+	out := make([]string, 0, len(names))
+	for _, n := range names {
+		if n != "" {
+			out = append(out, normPypi(n))
+		}
+	}
+	return out
+}
+
+// addPypiEdges appends children under parent, de-duplicating existing edges.
+func (g *DepGraph) addPypiEdges(parent string, children []string) {
+	if parent == "" || len(children) == 0 {
+		return
+	}
+	existing := make(map[string]bool, len(g.Edges[parent]))
+	for _, c := range g.Edges[parent] {
+		existing[c] = true
+	}
+	for _, c := range children {
+		if c != "" && !existing[c] {
+			g.Edges[parent] = append(g.Edges[parent], c)
+			existing[c] = true
+		}
+	}
+}
+
+// parseRequirementsViaEdges inverts the `# via` annotations of a compiled
+// requirements.txt into forward edges (parent → child). A `# via -r file`
+// reference is an include, not a parent package, and is skipped.
+func parseRequirementsViaEdges(content string) map[string][]string {
+	edges := map[string][]string{}
+	curName := ""
+	curVia := false
+	for _, ll := range joinReqContinuations(content) {
+		line := strings.TrimSpace(ll)
+		if line == "" {
+			continue
+		}
+		if strings.HasPrefix(line, "#") {
+			if curName == "" {
+				continue
+			}
+			body := strings.TrimSpace(strings.TrimPrefix(line, "#"))
+			if rest, ok := strings.CutPrefix(body, "via"); ok {
+				curVia = true
+				body = strings.TrimSpace(rest)
+			}
+			if !curVia || body == "" || isRequirementsInclude(body) {
+				continue
+			}
+			if parent, _, _, ok := parsePEP508(body); ok && parent != "" {
+				edges[parent] = append(edges[parent], curName)
+			}
+			continue
+		}
+		curVia = false
+		if strings.HasPrefix(line, "-") {
+			curName = ""
+			continue
+		}
+		if ci := strings.Index(line, " #"); ci >= 0 {
+			line = strings.TrimSpace(line[:ci])
+		}
+		var specParts []string
+		for _, tok := range strings.Fields(line) {
+			if strings.HasPrefix(tok, "--hash=") {
+				continue
+			}
+			specParts = append(specParts, tok)
+		}
+		if name, _, _, ok := parsePEP508(strings.Join(specParts, " ")); ok {
+			curName = name
+		} else {
+			curName = ""
+		}
+	}
+	return edges
+}
+
 // BuildGoDepGraph correlates go.mod (direct) and go.sum (all) packages from the
 // same directory to determine which dependencies are direct vs transitive.
 func BuildGoDepGraph(goModPkgs, goSumPkgs []ScopedPackage) *DepGraph {
@@ -425,9 +571,9 @@ func BuildManifestGroups(filePackages map[string][]ScopedPackage, fileEcosystems
 			for relPath, pkgs := range gd.files {
 				base := strings.ToLower(filepath.Base(relPath))
 				switch base {
-				case "pyproject.toml":
-					directPkgs = pkgs
-				case "uv.lock", "pipfile.lock", "poetry.lock", "requirements.txt":
+				case "pyproject.toml", "requirements.in":
+					directPkgs = append(directPkgs, pkgs...)
+				case "uv.lock", "pipfile.lock", "poetry.lock", "pylock.toml", "requirements.txt":
 					lockPkgs = append(lockPkgs, pkgs...)
 				}
 			}