feat(tools): generate_sbom — lockfile-to-CycloneDX SBOM converter + CLI subcommand (+104 tests)

[manus-use]

Summary

Adds generate_sbom — a lockfile-to-CycloneDX 1.5 SBOM converter tool + manus-agent generate-sbom CLI subcommand, with 104 fully-mocked tests.

What it does

Parses common dependency lockfile formats and produces structured CycloneDX 1.5 JSON suitable for vulnerability scanning with sbom-scan, Grype, Trivy, or any CDXA-compliant tool.

Supported lockfile formats

Format	Filename	Ecosystem
npm v1/v2/v3	package-lock.json	npm
Yarn v1	yarn.lock	npm
pnpm v5/v6/v9	pnpm-lock.yaml	npm
Poetry	poetry.lock	PyPI
pip (pinned)	requirements.txt	PyPI
Go modules	go.sum	Go
Cargo	Cargo.lock	crates.io
Bundler	Gemfile.lock	RubyGems

CLI usage

# Auto-detect format from filename, output CycloneDX JSON
manus-agent generate-sbom package-lock.json

# Override type for non-standard filenames
manus-agent generate-sbom deps.txt --type requirements

# Write to file
manus-agent generate-sbom poetry.lock --out-file bom.json

# Text summary
manus-agent generate-sbom Cargo.lock --output text

# Custom project name
manus-agent generate-sbom go.sum --project-name my-service

Strands tool API

generate_sbom(tool, lockfile_path="/app/poetry.lock")
generate_sbom(tool, lockfile_content="...", lockfile_type="cargo")

Design decisions

• Zero new dependencies — uses only stdlib + existing requests (for the tool interface contract; the tool itself is pure-stdlib)
• Package URL (purl) generation per ecosystem for accurate OSV/Grype vulnerability matching
• Deterministic output — sorted components, stable UUID serial numbers via namespace hashing
• Graceful degradation — malformed/partial lockfiles produce best-effort extraction rather than crashes
• Auto-detection from filename with explicit --type override

Duplicate check

Checked all 50 open PRs (#145–#194) and 30 most recent merged PRs. No existing open or merged PR implements lockfile-to-SBOM generation. Closest related work:

• feat(tools): scan_sbom — SBOM vulnerability scanner + sbom-scan CLI subcommand (+107 tests) #64 (my prior PR, scan_sbom — consumes SBOMs for vulnerability scanning, does not generate them)
• feat(tools): export_sarif — SARIF v2.1.0 vulnerability report exporter + CLI subcommand #183 (export_sarif — SARIF output format, different domain)
• feat(tools): dep_audit — dependency vulnerability auditor + CLI subcommand (+60 tests) #194 (dep_audit — VulnCheck-based auditing, doesn't generate SBOMs)

Test coverage

104 new tests covering:

• All 8 lockfile parsers (npm v1/v3, yarn, pnpm v6/v9, poetry, requirements, go.sum, Cargo, Gemfile)
• Purl generation and encoding
• Format auto-detection
• CycloneDX builder (determinism, structure, metadata)
• Tool function (file I/O, error handling, content mode)
• CLI subcommand (all flags, error paths)
• End-to-end integration per ecosystem

All tests are fully mocked (no real filesystem I/O beyond tmp_path, no HTTP calls).

Test results: 1262 passed, 0 failures (baseline 1158 + 104 new)