fix(python): filter packages by PEP 508 environment markers in uv and poetry providers

uv's universal resolver emits all platform variants with inline marker
specs. poetry show --tree includes marker-conditional deps without marker
info, requiring cross-reference with poetry.lock. Both providers now
evaluate markers against the current environment and exclude non-matching
packages from the SBOM.

Closes: TC-4042

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

src/providers/marker_evaluator.js

@@ -0,0 +1,146 @@
+import { execSync } from 'node:child_process'
+import os from 'node:os'
+
+let cachedPythonVersion = undefined
+
+function getPythonVersion() {
+	if (cachedPythonVersion !== undefined) { return cachedPythonVersion }
+	try {
+		let out = execSync('python3 -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')"',
+			{ timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim()
+		cachedPythonVersion = out
+	} catch {
+		cachedPythonVersion = null
+	}
+	return cachedPythonVersion
+}
+
+/** @returns {Record<string, string>} */
+export function getEnvironmentMarkers() {
+	let platform = process.platform
+	let systemMap = { win32: 'Windows', linux: 'Linux', darwin: 'Darwin' }
+	let machine = typeof os.machine === 'function' ? os.machine() : process.arch
+	let pyVer = getPythonVersion()
+	return {
+		sys_platform: platform,
+		platform_system: systemMap[platform] || platform,
+		os_name: platform === 'win32' ? 'nt' : 'posix',
+		platform_machine: machine,
+		platform_release: os.release(),
+		platform_version: os.version?.() || '',
+		python_version: pyVer || '',
+		python_full_version: pyVer || '',
+		implementation_name: 'cpython',
+	}
+}
+
+function compareVersions(left, right) {
+	let lParts = left.split('.').map(Number)
+	let rParts = right.split('.').map(Number)
+	let len = Math.max(lParts.length, rParts.length)
+	for (let i = 0; i < len; i++) {
+		let l = lParts[i] || 0
+		let r = rParts[i] || 0
+		if (l < r) { return -1 }
+		if (l > r) { return 1 }
+	}
+	return 0
+}
+
+function evaluateComparison(variable, op, value, env) {
+	let envVal = env[variable]
+	if (envVal === undefined || envVal === '') {
+		return variable.includes('version') ? true : false
+	}
+
+	let isVersion = variable.includes('version')
+	if (isVersion) {
+		let cmp = compareVersions(envVal, value)
+		switch (op) {
+		case '==': return cmp === 0
+		case '!=': return cmp !== 0
+		case '>=': return cmp >= 0
+		case '<=': return cmp <= 0
+		case '>': return cmp > 0
+		case '<': return cmp < 0
+		case '~=': {
+			let parts = value.split('.')
+			parts.pop()
+			let prefix = parts.join('.')
+			return envVal.startsWith(prefix) && cmp >= 0
+		}
+		default: return true
+		}
+	}
+
+	switch (op) {
+	case '==': return envVal === value
+	case '!=': return envVal !== value
+	case 'in': return value.split(',').map(s => s.trim()).includes(envVal)
+	case 'not in': return !value.split(',').map(s => s.trim()).includes(envVal)
+	default: return envVal === value
+	}
+}
+
+function parseAtom(expr) {
+	let m = expr.match(/^\s*([\w.]+)\s*(~=|!=|==|>=|<=|>|<|not\s+in|in)\s*["']([^"']*)["']\s*$/)
+	if (m) { return { variable: m[1], op: m[2].replace(/\s+/g, ' '), value: m[3] } }
+
+	let mReverse = expr.match(/^\s*["']([^"']*)['"]\s*(~=|!=|==|>=|<=|>|<|not\s+in|in)\s*([\w.]+)\s*$/)
+	if (mReverse) { return { variable: mReverse[3], op: mReverse[2].replace(/\s+/g, ' '), value: mReverse[1] } }
+
+	return null
+}
+
+/**
+ * @param {string} markerExpr
+ * @returns {boolean}
+ */
+export function evaluateMarker(markerExpr) {
+	if (!markerExpr || !markerExpr.trim()) { return true }
+	let env = getEnvironmentMarkers()
+	return evaluateExpr(markerExpr.trim(), env)
+}
+
+function evaluateExpr(expr, env) {
+	let orParts = splitLogical(expr, ' or ')
+	if (orParts.length > 1) {
+		return orParts.some(part => evaluateExpr(part, env))
+	}
+
+	let andParts = splitLogical(expr, ' and ')
+	if (andParts.length > 1) {
+		return andParts.every(part => evaluateExpr(part, env))
+	}
+
+	let trimmed = expr.trim()
+	if (trimmed.startsWith('(') && trimmed.endsWith(')')) {
+		return evaluateExpr(trimmed.slice(1, -1), env)
+	}
+
+	let atom = parseAtom(trimmed)
+	if (!atom) { return true }
+
+	return evaluateComparison(atom.variable, atom.op, atom.value, env)
+}
+
+function splitLogical(expr, sep) {
+	let parts = []
+	let depth = 0
+	let current = ''
+	let i = 0
+	while (i < expr.length) {
+		if (expr[i] === '(') { depth++ }
+		if (expr[i] === ')') { depth-- }
+		if (depth === 0 && expr.substring(i, i + sep.length) === sep) {
+			parts.push(current)
+			current = ''
+			i += sep.length
+			continue
+		}
+		current += expr[i]
+		i++
+	}
+	parts.push(current)
+	return parts.filter(p => p.trim())
+}

src/providers/python_poetry.js

@@ -1,9 +1,12 @@
 import fs from 'node:fs'
 import path from 'node:path'
 
+import { parse as parseToml } from 'smol-toml'
+
 import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from '../tools.js'
 
 import Base_pyproject from './base_pyproject.js'
+import { evaluateMarker } from './marker_evaluator.js'
 
 export default class Python_poetry extends Base_pyproject {
 
@@ -50,7 +53,9 @@ export default class Python_poetry extends Base_pyproject {
 		let treeOutput = this._getPoetryShowTreeOutput(manifestDir, hasDevGroup, opts)
 		let showAllOutput = this._getPoetryShowAllOutput(manifestDir, opts)
 		let versionMap = this._parsePoetryShowAll(showAllOutput)
-		return this._parsePoetryTree(treeOutput, versionMap)
+		let lockDir = this._findLockFileDir(manifestDir, opts)
+		let markerData = this._extractMarkerData(lockDir, parsed)
+		return this._parsePoetryTree(treeOutput, versionMap, markerData)
 	}
 
 	/**
@@ -107,16 +112,57 @@ export default class Python_poetry extends Base_pyproject {
 		return versions
 	}
 
+	/**
+	 * @param {string|null} lockDir
+	 * @param {object} parsed - parsed pyproject.toml
+	 * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}}
+	 */
+	_extractMarkerData(lockDir, parsed) {
+		let directMarkers = new Map()
+		let transitiveMarkers = new Map()
+
+		let deps = parsed.project?.dependencies || []
+		for (let dep of deps) {
+			let m = dep.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s*[^;]*;\s*(.+)$/)
+			if (m) {
+				directMarkers.set(this._canonicalize(m[1]), m[2].trim())
+			}
+		}
+
+		if (lockDir) {
+			let lockPath = path.join(lockDir, this._lockFileName())
+			if (fs.existsSync(lockPath)) {
+				let lockContent = fs.readFileSync(lockPath, 'utf-8')
+				let lock = parseToml(lockContent)
+				let packages = lock.package || []
+				for (let pkg of packages) {
+					let pkgKey = this._canonicalize(pkg.name)
+					let pkgDeps = pkg.dependencies || {}
+					for (let [depName, depSpec] of Object.entries(pkgDeps)) {
+						let markers = typeof depSpec === 'object' && depSpec != null ? depSpec.markers : null
+						if (markers) {
+							if (!transitiveMarkers.has(pkgKey)) {
+								transitiveMarkers.set(pkgKey, new Map())
+							}
+							transitiveMarkers.get(pkgKey).set(this._canonicalize(depName), markers)
+						}
+					}
+				}
+			}
+		}
+
+		return { directMarkers, transitiveMarkers }
+	}
+
 	/**
 	 * Parse poetry show --tree output into a dependency graph structure.
-	 * Top-level lines (no indentation/tree chars) are direct deps: "name version description"
-	 * Indented lines are transitive deps with tree chars: "├── name >=constraint"
 	 *
 	 * @param {string} treeOutput
 	 * @param {Map<string, string>} versionMap - canonical name -> resolved version
+	 * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}} markerData
 	 * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}}
 	 */
-	_parsePoetryTree(treeOutput, versionMap) {
+	_parsePoetryTree(treeOutput, versionMap, markerData) {
 		let lines = treeOutput.split(/\r?\n/)
 		let graph = new Map()
 		let directDeps = []
@@ -133,6 +179,14 @@ export default class Python_poetry extends Base_pyproject {
 				let name = topMatch[1]
 				let version = topMatch[2]
 				let key = this._canonicalize(name)
+
+				let marker = markerData.directMarkers.get(key)
+				if (marker && !evaluateMarker(marker)) {
+					currentDirectDep = null
+					stack = []
+					continue
+				}
+
 				directDeps.push(key)
 				if (!graph.has(key)) {
 					graph.set(key, { name, version, children: [] })
@@ -159,6 +213,22 @@ export default class Python_poetry extends Base_pyproject {
 			let prefix = line.substring(0, nameStart)
 			let depth = (prefix.match(/(?:[├└│ ][\s─]{2} ?)/g) || []).length
 
+			// pop stack back to find the parent at depth-1
+			while (stack.length > 0 && stack[stack.length - 1].depth >= depth) {
+				stack.pop()
+			}
+
+			let parentKey = stack.length > 0 ? stack[stack.length - 1].key : null
+			if (parentKey) {
+				let parentMarkers = markerData.transitiveMarkers.get(parentKey)
+				if (parentMarkers) {
+					let marker = parentMarkers.get(depKey)
+					if (marker && !evaluateMarker(marker)) {
+						continue
+					}
+				}
+			}
+
 			// resolve version from the version map
 			let version = versionMap.get(depKey) || null
 			if (!version) {
@@ -169,13 +239,7 @@ export default class Python_poetry extends Base_pyproject {
 				graph.set(depKey, { name: depName, version, children: [] })
 			}
 
-			// pop stack back to find the parent at depth-1
-			while (stack.length > 0 && stack[stack.length - 1].depth >= depth) {
-				stack.pop()
-			}
-
-			if (stack.length > 0) {
-				let parentKey = stack[stack.length - 1].key
+			if (parentKey) {
 				let parentEntry = graph.get(parentKey)
 				if (parentEntry && !parentEntry.children.includes(depKey)) {
 					parentEntry.children.push(depKey)

src/providers/python_uv.js

@@ -6,6 +6,7 @@ import { parse as parseToml } from 'smol-toml'
 import { environmentVariableIsPopulated, getCustomPath, invokeCommand } from '../tools.js'
 
 import Base_pyproject from './base_pyproject.js'
+import { evaluateMarker } from './marker_evaluator.js'
 import { getParser, getPinnedVersionQuery } from './requirements_parser.js'
 
 export default class Python_uv extends Base_pyproject {
@@ -98,6 +99,16 @@ export default class Python_uv extends Base_pyproject {
 				let nameNode = child.children.find(c => c.type === 'package')
 				if (!nameNode) { continue }
 
+				let markerNode = child.children.find(c => c.type === 'marker_spec')
+				if (markerNode) {
+					let markerText = markerNode.text.replace(/^\s*;\s*/, '')
+					if (!evaluateMarker(markerText)) {
+						currentPkg = null
+						collectingVia = false
+						continue
+					}
+				}
+
 				let name = nameNode.text
 				let version = null
 				let versionMatches = pinnedVersionQuery.matches(child)