@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.1

package/src/posture/fix-history.js

@@ -31,6 +31,30 @@ export function readLog(scanRoot) {
   if (!fs.existsSync(fp)) return [];
   try { return JSON.parse(fs.readFileSync(fp, 'utf8')); } catch { return []; }
 }
+// R25 (PRD §5): auto-fix acceptance rate. The closed loop (apply → verify →
+// re-scan for SAST; dry-run + test-gate + rollback for SCA upgrades) already
+// exists; this surfaces the OUTCOME metric the PRD asks to track — the fraction
+// of RESOLVED fix attempts that landed and stuck. Pure aggregation over the
+// fix-history log; still-'pending' entries are excluded from the denominator.
+export function acceptanceFromEntries(entries) {
+  const counts = { applied: 0, pending: 0, reverted: 0, failed: 0, other: 0 };
+  for (const e of (Array.isArray(entries) ? entries : [])) {
+    const s = (e && e.status) || 'other';
+    if (counts[s] != null) counts[s]++; else counts.other++;
+  }
+  const accepted = counts.applied;
+  const resolved = counts.applied + counts.reverted + counts.failed;
+  return {
+    acceptanceRate: resolved > 0 ? Number((accepted / resolved).toFixed(4)) : null,
+    accepted, resolved, pending: counts.pending,
+    total: Array.isArray(entries) ? entries.length : 0, counts,
+  };
+}
+
+export function fixAcceptanceRate(scanRoot) {
+  return acceptanceFromEntries(readLog(scanRoot));
+}
+
 function writeLog(scanRoot, log) {
   ensure(scanRoot);
   fs.writeFileSync(logPath(scanRoot), JSON.stringify(log, null, 2));

package/src/posture/provenance.js

@@ -0,0 +1,39 @@
+// R17 (PRD §5) — finding provenance: "one issue, many signals".
+//
+// dedupeFindingsWithEvidence() already collapses findings that share a
+// (file, sink-line, family) into ONE finding and accumulates the parsers that
+// fired into `evidence`. This annotator turns that into an explicit, queryable
+// corroboration signal on EVERY finding (not just merged ones):
+//
+//   finding.corroborationCount : number of DISTINCT independent analyses that
+//                                flagged this exact issue (≥1).
+//   finding.corroboration.by   : sorted list of those signal sources.
+//   finding.multiSignal        : true when ≥2 independent sources agree.
+//
+// Independent confirmation lowers the odds of a false positive, so the engine
+// ranks multi-signal findings above single-signal ones at equal severity. It
+// deliberately does NOT touch the calibrated `confidence` field — calibration
+// is fit/measured held-out (see posture/CLAUDE.md) and must not be perturbed by
+// a ranking heuristic.
+
+export function annotateFindingProvenance(findings) {
+  if (!Array.isArray(findings)) return findings;
+  for (const f of findings) {
+    if (!f || typeof f !== 'object') continue;
+    const sources = new Set();
+    if (f.parser) sources.add(f.parser);
+    // Parsers merged in by the dedup pass.
+    if (Array.isArray(f.evidence)) for (const e of f.evidence) if (e) sources.add(e);
+    // The Layer-3 LLM validator accepting a finding is an independent signal.
+    if (f.validator_verdict === 'accept') sources.add('llm-validator');
+    // A dynamically-confirmed finding (reserved for the DAST loop) is the
+    // strongest independent signal.
+    if (f.dynamicallyConfirmed === true) sources.add('dynamic');
+    if (sources.size === 0) sources.add(f.parser || 'UNKNOWN');
+    const by = [...sources].sort();
+    f.corroboration = { count: by.length, by };
+    f.corroborationCount = by.length;
+    if (by.length >= 2) f.multiSignal = true;
+  }
+  return findings;
+}

package/src/posture/sca-verdict.js

@@ -0,0 +1,130 @@
+// R12 (PRD §5) — deterministic SCA decision-first verdict.
+//
+// Turns the enrichment signals already on each `vulnerable_dep` finding
+// (compositeRiskTier, kev, epss, reachabilityTier, mitigationVerdict,
+// fixedVersions, policy suppression/freeze) into ONE verdict from a closed enum,
+// so the default SCA output is a decision ("fix these 5, auto-merge these 40,
+// ignore these 255 — here's why") rather than a CVE dump.
+//
+// This codifies the ordered procedure documented for the `sca-triager` agent so
+// it runs without an LLM. The agent remains for nuanced/uncertain cases; this
+// gives every dep a defensible default verdict deterministically.
+//
+// Verdict enum (must match the agent + downstream /fix --sca):
+//   AUTO_MERGE_PATCH · WAIT_FOR_PATCH · MANUAL_REVIEW · ACCEPT_RISK · WONT_FIX
+
+export const SCA_VERDICTS = ['AUTO_MERGE_PATCH', 'WAIT_FOR_PATCH', 'MANUAL_REVIEW', 'ACCEPT_RISK', 'WONT_FIX'];
+
+const REACHABLE_TIERS = new Set(['route-reachable-via-function', 'function-reachable', 'import-reachable']);
+const UNREACHABLE_TIERS = new Set(['unreachable', 'build-only', 'manifest-only', 'transitive-only']);
+
+// Parse a version into {major,minor,patch}. Tolerates leading 'v', ranges, and
+// pre-release/build suffixes. Returns null when no leading numeric core exists.
+export function parseVersion(v) {
+  if (v == null) return null;
+  const m = String(v).match(/(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+  if (!m) return null;
+  return { major: +m[1], minor: m[2] != null ? +m[2] : 0, patch: m[3] != null ? +m[3] : 0 };
+}
+
+// Classify the smallest bump from `current` to `fixed`: 'patch' | 'minor' |
+// 'major' | 'none' (fixed <= current) | 'unknown' (unparseable).
+export function bumpKind(current, fixed) {
+  const c = parseVersion(current);
+  const f = parseVersion(fixed);
+  if (!c || !f) return 'unknown';
+  if (f.major > c.major) return 'major';
+  if (f.major < c.major) return 'none';
+  if (f.minor > c.minor) return 'minor';
+  if (f.minor < c.minor) return 'none';
+  if (f.patch > c.patch) return 'patch';
+  return 'none';
+}
+
+function isReachable(sc) {
+  // Default to "reachable" when the tier is unknown — fail toward review, not
+  // toward auto-accept (never silently ACCEPT_RISK something we couldn't place).
+  if (sc.reachabilityTier == null) return true;
+  return REACHABLE_TIERS.has(sc.reachabilityTier);
+}
+
+/**
+ * Compute the verdict for one vulnerable_dep finding. Pure. Returns
+ * { verdict, reason, expiryDays? }. Follows the documented ordered procedure;
+ * the first matching rule wins.
+ */
+export function computeScaVerdict(sc, opts = {}) {
+  const testsDetected = !!opts.testsDetected;
+  const tier = sc.reachabilityTier;
+  const fixed = Array.isArray(sc.fixedVersions) ? sc.fixedVersions.filter(Boolean) : [];
+  const riskTier = sc.compositeRiskTier;
+  const bump = fixed.length ? bumpKind(sc.version, fixed[0]) : null;
+
+  // 1. Already suppressed by policy (accept-risk match) → pass-through.
+  if (sc.suppressed || sc.suppressionReason) {
+    return { verdict: 'ACCEPT_RISK', reason: sc.suppressionReason || 'matched existing accept-risk in sca-policy.yml' };
+  }
+  // 2. No fixed version exists → nothing to upgrade yet.
+  if (!fixed.length) {
+    return { verdict: 'WAIT_FOR_PATCH', reason: `no fixed version published${sc.osvId ? ` for ${sc.osvId}` : ''}` };
+  }
+  // 3. KEV-listed AND reachable → urgent. Same-major fix auto-merges; else review.
+  if ((sc.kev || sc.kevListed) && isReachable(sc)) {
+    if (bump === 'patch' || bump === 'minor') {
+      return { verdict: 'AUTO_MERGE_PATCH', reason: `KEV-listed and reachable; ${bump} bump to ${fixed[0]}` };
+    }
+    return { verdict: 'MANUAL_REVIEW', reason: 'KEV-listed but fix requires a major-version bump' };
+  }
+  // 4. Environment-mitigated in prod → accept with re-evaluation window.
+  if (sc.mitigationVerdict === 'mitigated-in-prod') {
+    return { verdict: 'ACCEPT_RISK', reason: 'mitigated in production (WAF / network policy / auth gate)', expiryDays: 90 };
+  }
+  // 5. Unreachable (in prod or by tier) → accept; low real exposure.
+  if (sc.mitigationVerdict === 'unreachable-in-prod' || (tier && UNREACHABLE_TIERS.has(tier))) {
+    return { verdict: 'ACCEPT_RISK', reason: `not reachable (${sc.mitigationVerdict || tier})`, expiryDays: 180 };
+  }
+  // 6. Major-version freeze policy → human decision.
+  if (sc.majorVersionFrozen) {
+    return { verdict: 'MANUAL_REVIEW', reason: 'package is on the major-version-freeze list' };
+  }
+  // 7. Fix requires a major bump → breaking-change review.
+  if (bump === 'major') {
+    return { verdict: 'MANUAL_REVIEW', reason: `fix requires a major-version bump (${sc.version} → ${fixed[0]}); review breaking changes` };
+  }
+  // 8. Patch-only bump at high/critical risk → safe auto-merge.
+  if (bump === 'patch' && (riskTier === 'high' || riskTier === 'critical')) {
+    return { verdict: 'AUTO_MERGE_PATCH', reason: `patch bump to ${fixed[0]} at ${riskTier} risk` };
+  }
+  // 9. EPSS says exploited-now + reachable + same-major → urgency overrides minor/patch distinction.
+  if ((sc.exploitedNow || (typeof sc.epssPercentile === 'number' && sc.epssPercentile >= 0.95)) && isReachable(sc) && (bump === 'patch' || bump === 'minor')) {
+    return { verdict: 'AUTO_MERGE_PATCH', reason: `high EPSS (exploited in the wild) and reachable; ${bump} bump to ${fixed[0]}` };
+  }
+  // 10. Minor bump at critical risk WITH tests present → auto-merge (tests catch breakage).
+  if (bump === 'minor' && riskTier === 'critical' && testsDetected) {
+    return { verdict: 'AUTO_MERGE_PATCH', reason: `minor bump to ${fixed[0]} at critical risk; project has tests` };
+  }
+  // 11. Anything else (minor bump at non-critical risk, 'none', unclear) → human.
+  return { verdict: 'MANUAL_REVIEW', reason: bump === 'none' ? 'no upgrade path resolves the advisory; review manually' : `${bump || 'unclear'} bump — defer to human triage` };
+}
+
+/**
+ * Annotate every vulnerable_dep in supplyChain with `scaVerdict` +
+ * `scaVerdictReason` (+ `scaVerdictExpiryDays` when applicable). Mutates and
+ * returns supplyChain. Returns a per-verdict count map on `supplyChain._scaVerdictCounts`.
+ */
+export function annotateScaVerdicts(supplyChain, opts = {}) {
+  if (!Array.isArray(supplyChain)) return supplyChain;
+  const counts = { AUTO_MERGE_PATCH: 0, WAIT_FOR_PATCH: 0, MANUAL_REVIEW: 0, ACCEPT_RISK: 0, WONT_FIX: 0 };
+  for (const sc of supplyChain) {
+    if (!sc || sc.type !== 'vulnerable_dep') continue;
+    const { verdict, reason, expiryDays } = computeScaVerdict(sc, opts);
+    sc.scaVerdict = verdict;
+    sc.scaVerdictReason = reason;
+    if (expiryDays) sc.scaVerdictExpiryDays = expiryDays;
+    if (counts[verdict] != null) counts[verdict]++;
+  }
+  try {
+    Object.defineProperty(supplyChain, '_scaVerdictCounts', { value: counts, enumerable: false, configurable: true });
+  } catch { /* frozen array — ignore */ }
+  return supplyChain;
+}

package/src/posture/secret-history.js

@@ -0,0 +1,72 @@
+// R15 (PRD §5) — git-history secret sweep.
+//
+// A secret removed from HEAD but present in any past commit is still
+// recoverable from `.git` and must be rotated — the most dangerous secret case,
+// and one a working-tree-only scan misses entirely. This sweeps recent history
+// (bounded), feeding the ADDED lines of each commit through the same credential
+// detector the file scan uses.
+//
+// The detector is INJECTED (detectFn) rather than imported, so this module has
+// no dependency back into engine.js (avoids a circular import) and the parsing
+// stays pure + unit-testable. Live-credential validation (is the key active?)
+// needs network and is deferred — see the rollup.
+
+import { execFileSync } from 'node:child_process';
+
+// Pull the post-image (added) lines out of a unified diff: lines starting with
+// a single '+' (not the '+++' file header). Returns reconstructed text.
+export function extractAddedLines(diffText) {
+  const out = [];
+  for (const line of String(diffText || '').split('\n')) {
+    if (line.startsWith('+') && !line.startsWith('+++')) out.push(line.slice(1));
+  }
+  return out.join('\n');
+}
+
+// Pure: run the injected credential detector over a commit's added lines.
+// detectFn has the scanCredentials(fp, raw) shape and returns Finding[].
+export function scanHistoryDiff(diffText, commit, detectFn) {
+  if (typeof detectFn !== 'function') return [];
+  const added = extractAddedLines(diffText);
+  if (!added.trim()) return [];
+  let findings = [];
+  try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
+  return findings.map((f) => ({
+    ...f,
+    id: `secret-history:${commit}:${f.id || f.vuln || 'secret'}`,
+    file: `git-history@${commit}`,
+    line: 0,
+    commit,
+    _historical: true,
+    vuln: `${f.vuln || 'Hardcoded Secret'} (in git history)`,
+    description: `${f.description || 'A credential was committed.'} Found in commit ${commit}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
+    remediation: 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.',
+  }));
+}
+
+/**
+ * Sweep up to `maxCommits` of recent history for secrets. Best-effort: returns
+ * [] when `scanRoot` is not a git repo or git is unavailable. Dedups a secret
+ * that recurs across commits to its earliest sighting.
+ */
+export function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000 } = {}) {
+  if (!scanRoot || typeof detectFn !== 'function') return [];
+  let out;
+  try {
+    out = execFileSync('git', ['-C', scanRoot, 'log', '-p', '-n', String(maxCommits), '--no-color', '--no-merges', '--no-textconv'],
+      { encoding: 'utf8', maxBuffer: 96 * 1024 * 1024, timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch { return []; }
+  const parts = out.split(/^commit ([0-9a-f]{7,40})/m); // [pre, sha, body, sha, body, ...]
+  const findings = [];
+  const seen = new Set();
+  for (let i = 1; i < parts.length; i += 2) {
+    const sha = (parts[i] || '').slice(0, 12);
+    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn)) {
+      const key = `${f.vuln}:${(f.snippet || f.match || '').slice(0, 40)}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push(f);
+    }
+  }
+  return findings;
+}

package/src/pr-delta.js

@@ -170,6 +170,19 @@ export async function computePrDelta(root, { baseRef, headRef = 'HEAD' } = {}) {
 /**
  * Lightweight text summary used as a CLI fallback when --json isn't set.
  */
+// R24 (PRD §5) — net-new CI gate. Blocks the build ONLY on findings the PR
+// INTRODUCED (delta.introduced), at or above `failOn` severity — never on the
+// pre-existing backlog. This is the only SAST CI posture teams tolerate
+// long-term. Pure + deterministic: takes a delta, returns the gate decision.
+const _NETNEW_SEV_RANK = { critical: 3, high: 2, medium: 1, low: 0, info: -1 };
+export function netNewGate(delta, failOn = 'critical') {
+  const introduced = (delta && Array.isArray(delta.introduced)) ? delta.introduced : [];
+  if (failOn === 'none') return { fail: false, failOn, introducedCount: introduced.length, blocked: [] };
+  const threshold = _NETNEW_SEV_RANK[failOn] ?? 3;
+  const blocked = introduced.filter((f) => (_NETNEW_SEV_RANK[f.severity] ?? -1) >= threshold);
+  return { fail: blocked.length > 0, failOn, introducedCount: introduced.length, blocked };
+}
+
 export function renderPrDeltaText(delta) {
   const i = delta.summary.introduced;
   const r = delta.summary.resolved;

package/src/report/index.js

@@ -44,6 +44,15 @@ export function normalizeFindings(scan){
       dataClasses: f.dataClasses || [],
       chain: Array.isArray(f.chain) ? f.chain : null,
       confidence: typeof f.confidence === 'number' ? f.confidence : null,
+      // R17: corroboration ("one issue, many signals") — count of independent
+      // analyses that agreed, and which ones.
+      corroborationCount: typeof f.corroborationCount === 'number' ? f.corroborationCount : null,
+      corroboration: f.corroboration || null,
+      multiSignal: f.multiSignal === true ? true : null,
+      // R13: proof verdict — `provablySafe` means a flow proof discharged this
+      // finding (parameterizer on every path / sanitizer excludes metachars).
+      proof: f.proof || null,
+      provablySafe: f.provablySafe === true ? true : null,
       // 0.6.0 Feat-2
       toxicity: f.toxicityScore ?? null,
       toxicityFactors: f.toxicityFactors || null,
@@ -630,6 +639,47 @@ function _esc(s) {
     .replace(/"/g, '"').replace(/'/g, ''');
 }
 
+// R11 (PRD §5) — OpenVEX export. Turns our reachability verdict (R7/R12) into a
+// standard interchange statement per CVE: unreachable tiers → not_affected with
+// the `vulnerable_code_not_in_execute_path` justification; reachable tiers →
+// affected with an action statement; unknown → under_investigation. Lets
+// downstream tools and auditors inherit "this CVE can't fire here" in a format
+// they accept, instead of re-triaging our transitive noise.
+const _VEX_REACHABLE = new Set(['route-reachable-via-function', 'function-reachable', 'import-reachable']);
+const _VEX_NOT_AFFECTED = new Set(['unreachable', 'build-only', 'manifest-only', 'transitive-only']);
+export function toVex(scan, meta = {}) {
+  const deps = (scan.supplyChain || []).filter(s => s && s.type === 'vulnerable_dep');
+  const statements = [];
+  for (const s of deps) {
+    const cves = (Array.isArray(s.cveAliases) && s.cveAliases.length ? s.cveAliases : [s.osvId]).filter(Boolean);
+    if (!cves.length) continue;
+    const purl = s.purl || `pkg:${s.ecosystem || 'generic'}/${s.name}@${s.version || '0'}`;
+    const stmt = {};
+    if (_VEX_NOT_AFFECTED.has(s.reachabilityTier)) {
+      stmt.status = 'not_affected';
+      stmt.justification = 'vulnerable_code_not_in_execute_path';
+      stmt.impact_statement = `agentic-security reachability: ${s.reachabilityTier}`;
+    } else if (_VEX_REACHABLE.has(s.reachabilityTier)) {
+      stmt.status = 'affected';
+      stmt.action_statement = s.scaVerdictReason || s.remediation ||
+        (Array.isArray(s.fixedVersions) && s.fixedVersions.length ? `upgrade ${s.name} to ${s.fixedVersions[0]}` : 'review and remediate');
+    } else {
+      stmt.status = 'under_investigation';
+    }
+    for (const cve of cves) {
+      statements.push({ vulnerability: { name: cve }, products: [{ '@id': purl }], ...stmt });
+    }
+  }
+  return {
+    '@context': 'https://openvex.dev/ns/v0.2.0',
+    '@id': `https://agentic-security/vex/${(meta && meta.scanId) || 'scan'}`,
+    author: 'agentic-security',
+    timestamp: (meta && meta.startedAt) || new Date().toISOString(),
+    version: 1,
+    statements,
+  };
+}
+
 export function toHTML(scan, meta = {}) {
   const findings = normalizeFindings(scan);
   const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };

package/src/sast/agent-untrusted-flow.js

@@ -0,0 +1,107 @@
+// R20 (PRD §5) — agent-loop taint: untrusted content → high-privilege tool.
+//
+// The agent threat that pattern matchers and ordinary taint both miss: content
+// the model does NOT control — a retrieved RAG document, a tool's output — is
+// fed into a side-effecting sink (shell/exec/eval). That's indirect prompt
+// injection escalating to code/command execution (OWASP LLM01 + Excessive
+// Agency). agent-tool-escalation.js flags the read+act tool COMBINATION; this
+// flags the actual DATA FLOW from an untrusted source into the sink, and only
+// when there is no mediation step (human approval, allow-list, sanitizer)
+// between them.
+//
+// Precision-first, like the other structural detectors: it runs only in
+// agent/LLM/RAG files, tracks untrusted source variables (+ one assignment
+// hop), and suppresses when a mediation token sits between source and sink.
+
+import { blankComments } from './_comment-strip.js';
+
+const AGENT_CONTEXT = /(retriever|vectorstore|vector_store|similarity_search|get_relevant_documents|langchain|llama_?index|page_content|@tool\b|tool_use|input_schema|ChatOpenAI|ChatAnthropic|create_react_agent|AgentExecutor|\.invoke\s*\()/i;
+
+// RHS APIs whose return value is attacker-influenceable retrieved content.
+const RETRIEVAL_API = /\b(get_relevant_documents|aget_relevant_documents|similarity_search(?:_with_score|_with_relevance_scores)?|max_marginal_relevance_search)\s*\(/;
+
+// A var assignment whose RHS calls a retrieval API → the LHS is untrusted.
+const SRC_ASSIGN = /(?:\b(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?[^\n;=]*?\b(?:get_relevant_documents|aget_relevant_documents|similarity_search(?:_with_score|_with_relevance_scores)?|max_marginal_relevance_search)\s*\(/g;
+
+// Untrusted member access that needs no variable tracking (the doc body).
+const UNTRUSTED_MEMBER = /\.(?:page_content|text)\b/;
+
+// High-privilege / side-effecting sinks (code + command execution).
+const SINKS = [
+  { re: /\b(?:exec|execSync|execFile|execFileSync|spawn|spawnSync)\s*\(/, label: 'child_process exec/spawn' },
+  { re: /\beval\s*\(/, label: 'eval()' },
+  { re: /\bnew\s+Function\s*\(/, label: 'new Function()' },
+  { re: /\bos\.system\s*\(/, label: 'os.system()' },
+  { re: /\bsubprocess\.(?:run|call|check_output|check_call|Popen)\s*\(/, label: 'subprocess' },
+  { re: /\b(?:Popen|check_output|getoutput|getstatusoutput)\s*\(/, label: 'subprocess' },
+];
+
+// A mediation/guard step between source and sink defuses the flow.
+// Substring match (NOT word-bounded): a guard token inside a compound
+// identifier — human_in_the_loop_approve, approveCommand, sanitizeInput,
+// isSafeCommand — must still count as mediation.
+const MEDIATION = /(approve|approval|confirm|human_in_the_loop|human_input|interrupt|require_consent|consent|allow_?list|whitelist|sanitiz|validate_command|validate_input|is_safe|safe_to_run|safeguard|deny|reject)/i;
+
+function lineOf(code, idx) { return code.slice(0, idx).split('\n').length; }
+
+export function scanAgentUntrustedFlow(fp, raw) {
+  if (typeof raw !== 'string' || !raw) return [];
+  if (!/\.(?:js|jsx|ts|tsx|mjs|cjs|py)$/i.test(fp)) return [];
+  const code = blankComments(raw);
+  if (!AGENT_CONTEXT.test(code)) return [];
+  const lines = code.split('\n');
+
+  // 1. Untrusted source variables (retrieval-API results) + one assignment hop.
+  const untrusted = new Map(); // varName -> defining line
+  let m;
+  SRC_ASSIGN.lastIndex = 0;
+  while ((m = SRC_ASSIGN.exec(code))) untrusted.set(m[1], lineOf(code, m.index));
+  // One hop: `X = <expr referencing an untrusted var or .page_content/.text>`.
+  const HOP = /(?:\b(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*([^\n;]+)/g;
+  for (let pass = 0; pass < 2; pass++) {
+    HOP.lastIndex = 0;
+    while ((m = HOP.exec(code))) {
+      const lhs = m[1], rhs = m[2];
+      if (untrusted.has(lhs)) continue;
+      if (UNTRUSTED_MEMBER.test(rhs) || [...untrusted.keys()].some((v) => new RegExp(`\\b${v}\\b`).test(rhs))) {
+        untrusted.set(lhs, lineOf(code, m.index));
+      }
+    }
+  }
+  if (!untrusted.size && !UNTRUSTED_MEMBER.test(code)) return [];
+
+  const findings = [];
+  const seen = new Set();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const sink of SINKS) {
+      if (!sink.re.test(line)) continue;
+      // Does the sink's argument reference untrusted content?
+      const argText = line.slice(line.search(sink.re));
+      const hitsMember = UNTRUSTED_MEMBER.test(argText);
+      const srcVar = [...untrusted.keys()].find((v) => new RegExp(`\\b${v}\\b`).test(argText));
+      if (!hitsMember && !srcVar) continue;
+      // Mediation between the source definition and this sink suppresses it.
+      const srcLine = srcVar ? untrusted.get(srcVar) : Math.max(1, i - 8);
+      const window = lines.slice(Math.max(0, srcLine - 1), i + 1).join('\n');
+      if (MEDIATION.test(window)) continue;
+      const key = `${i + 1}:${sink.label}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push({
+        id: `agent-untrusted-flow:${fp}:${i + 1}`,
+        severity: 'high',
+        file: fp,
+        line: i + 1,
+        vuln: 'Indirect Prompt Injection → Code/Command Execution (untrusted agent content reaches a high-privilege sink)',
+        cwe: '94',
+        owaspLlm: 'LLM01',
+        family: 'agent-untrusted-flow',
+        parser: 'AGENT-FLOW',
+        description: `Untrusted agent content (${srcVar ? `via \`${srcVar}\`` : 'a retrieved document body'}) flows into ${sink.label} with no mediation step. A poisoned document or tool output can drive code/command execution (indirect prompt injection → excessive agency).`,
+        remediation: 'Never pass retrieved/tool-derived content to a code/command sink. Require a human-approval/allow-list/sanitizer mediation step, or constrain the tool to a fixed, non-interpolated command.',
+      });
+    }
+  }
+  return findings;
+}

package/src/sast/api-authz.js

@@ -0,0 +1,71 @@
+// R19 (PRD §5) — OWASP API Top 10: Broken Object/Function Level Authorization.
+//
+// The data-layer IDOR detector (engine.js) catches `findById(req.params.id)`
+// without an ownership clause. This complements it at the ROUTE-INVENTORY
+// layer, where the highest-signal tell is INCONSISTENCY: a route registered in
+// a file whose siblings are authenticated, but which itself has no auth.
+//
+//   BFLA (API5): a state-changing route (POST/PUT/PATCH/DELETE) with no auth
+//                while sibling routes in the same file do enforce it.
+//   BOLA (API1): a route taking an object identifier (:id / {id} / <id>) with
+//                no auth, so object-level ownership cannot be enforced.
+//
+// Precision: we only fire inside files that DO authenticate some routes (an
+// authenticated API surface) — a fully-public API isn't flagged, and the
+// inconsistency is what makes a missing check a likely bug rather than intent.
+
+const STATE_CHANGING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+const ID_PARAM = /\/(?::\w*(?:id|key|uuid|guid|slug)\w*|\{\w*(?:id|key|uuid|guid|slug)\w*\}|<\w*(?:id|key|uuid|guid|slug)\w*>)/i;
+
+function mk(r, kind, api, cwe, why) {
+  return {
+    id: `api-authz:${kind}:${r.file}:${r.line}`,
+    severity: 'high',
+    file: r.file,
+    line: r.line || 0,
+    vuln: `Broken ${kind === 'BOLA' ? 'Object' : 'Function'} Level Authorization (${api})`,
+    cwe,
+    family: 'broken-access-control',
+    parser: 'API-AUTHZ',
+    description: why,
+    remediation: kind === 'BOLA'
+      ? 'Authenticate the route and verify the caller owns the referenced object (scope the lookup by req.user.id / tenantId), don\'t trust the id from the request alone.'
+      : 'Apply the same authentication/authorization middleware the sibling routes use; state-changing endpoints must enforce a role/permission check.',
+  };
+}
+
+/**
+ * Cross-route analysis over the aggregated route inventory (aR).
+ * Pure: takes routes[], returns Finding[].
+ */
+export function scanApiBrokenAuthz(routes) {
+  if (!Array.isArray(routes) || routes.length < 2) return [];
+  const byFile = new Map();
+  for (const r of routes) {
+    if (!r || r.path === '(file-based)' || !r.file) continue;
+    if (!byFile.has(r.file)) byFile.set(r.file, []);
+    byFile.get(r.file).push(r);
+  }
+  const findings = [];
+  const seen = new Set();
+  const push = (f) => { const k = `${f.file}:${f.line}`; if (seen.has(k)) return; seen.add(k); findings.push(f); };
+  for (const group of byFile.values()) {
+    if (group.length < 2) continue;
+    const authed = group.filter((r) => r.hasAuth).length;
+    // Only an authenticated API surface — at least one protected sibling, but
+    // not all (otherwise there's no inconsistency to flag).
+    if (authed < 1 || authed === group.length) continue;
+    for (const r of group) {
+      if (r.hasAuth) continue;
+      const idParam = ID_PARAM.test(r.path || '');
+      if (idParam) {
+        push(mk(r, 'BOLA', 'API1', '639',
+          `${r.method} ${r.path} takes an object identifier but enforces no authorization, while ${authed}/${group.length} sibling routes do. Object-level ownership cannot be enforced — an attacker can substitute another user's id.`));
+      } else if (STATE_CHANGING.has(r.method)) {
+        push(mk(r, 'BFLA', 'API5', '285',
+          `${r.method} ${r.path} is a state-changing route with no authorization, while ${authed}/${group.length} sibling routes in this file enforce it — a likely missing function-level access check.`));
+      }
+    }
+  }
+  return findings;
+}

package/src/sast/cross-service.js

@@ -0,0 +1,98 @@
+// R22 (PRD §5) — cross-service dataflow (contract-file-free).
+//
+// posture/cross-lang-* links services through a shared contract artifact
+// (OpenAPI/proto). This infers the edge directly from CODE: an HTTP client call
+// whose URL path matches a route registered in ANOTHER file is a service edge.
+// When the client sends user-controlled data over that edge — especially to an
+// UNAUTHENTICATED internal endpoint — data crosses a trust boundary unobserved.
+//
+// Pure cross-file analysis over the aggregated route inventory + file contents.
+// Path matching normalizes dynamic segments (/:id, /{id}, numeric) so a literal
+// client URL aligns with a parameterized route. Precision-first: requires a
+// real route match AND user-controlled data in the client call.
+
+const CLIENT_CALLS = [
+  /\bfetch\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+  /\baxios\s*\.\s*(?:get|post|put|patch|delete|request)\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+  /\baxios\s*\(\s*\{[^}]*?\burl\s*:\s*[`'"]([^`'"]+)[`'"]/g,
+  /\b(?:got|ky|superagent|needle)\s*(?:\.\s*\w+)?\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+  /\brequests\s*\.\s*(?:get|post|put|patch|delete)\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+  /\bhttpClient\s*\.\s*\w+\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+];
+const USER_DATA = /\b(?:req\.(?:body|params|query|headers)|request\.(?:data|json|args)|ctx\.request|params|\.body\b|userInput|user_input|formData)\b/;
+
+// Normalize a URL path: drop scheme+host, collapse dynamic segments to '*'.
+export function normalizePath(url) {
+  let p = String(url || '').trim();
+  p = p.replace(/^[a-z]+:\/\/[^/]+/i, '');            // strip scheme://host
+  p = p.replace(/[?#].*$/, '');                        // strip query/hash
+  if (!p.startsWith('/')) p = '/' + p;
+  const segs = p.split('/').map((s) => {
+    if (/^(?::\w+|\{\w+\}|<\w+>|\*|\$\{[^}]+\}|\d+)$/.test(s)) return '*';
+    return s.toLowerCase();
+  });
+  let out = segs.join('/').replace(/\/+$/, '');
+  return out || '/';
+}
+
+function lineOf(text, idx) { return text.slice(0, idx).split('\n').length; }
+
+/**
+ * routes: aggregated route inventory (aR). fileContents: { file: text }.
+ * Returns cross-service edge findings.
+ */
+export function scanCrossService(routes, fileContents) {
+  if (!Array.isArray(routes) || !routes.length) return [];
+  // Index server routes by normalized path → list of {route}.
+  const byPath = new Map();
+  for (const r of routes) {
+    if (!r || r.path === '(file-based)' || !r.path || !r.path.startsWith('/')) continue;
+    const np = normalizePath(r.path);
+    if (!byPath.has(np)) byPath.set(np, []);
+    byPath.get(np).push(r);
+  }
+  if (!byPath.size) return [];
+
+  const findings = [];
+  const seen = new Set();
+  for (const [file, content] of Object.entries(fileContents || {})) {
+    if (typeof content !== 'string') continue;
+    for (const re of CLIENT_CALLS) {
+      const rx = new RegExp(re.source, re.flags);
+      let m;
+      while ((m = rx.exec(content))) {
+        const url = m[1];
+        const np = normalizePath(url);
+        const targets = byPath.get(np);
+        if (!targets) continue;
+        // Only a cross-FILE edge is interesting (same-file is a local call).
+        const remote = targets.find((t) => t.file !== file);
+        if (!remote) continue;
+        const line = lineOf(content, m.index);
+        // Is user-controlled data in the call's vicinity?
+        const ctx = content.slice(m.index, m.index + 240);
+        const carriesUserData = USER_DATA.test(ctx);
+        if (!carriesUserData) continue; // precision: only flag tainted edges
+        const key = `${file}:${line}:${np}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        const unauthed = remote.hasAuth === false;
+        findings.push({
+          id: `cross-service:${file}:${line}`,
+          severity: unauthed ? 'high' : 'medium',
+          file, line,
+          vuln: `Cross-service flow: user-controlled data sent to ${remote.method} ${remote.path}${unauthed ? ' (unauthenticated internal endpoint)' : ''}`,
+          cwe: unauthed ? 'CWE-862' : 'CWE-668',
+          family: 'cross-service',
+          parser: 'XSERVICE',
+          description: `This client call carries user-controlled data to ${remote.method} ${remote.path}, defined in ${remote.file}. Data crosses a service boundary here${unauthed ? ', and the target route enforces no authentication — an attacker-reachable internal endpoint' : ''}. Inferred from code (no shared contract file).`,
+          remediation: unauthed
+            ? 'Authenticate/authorize the internal endpoint and validate the forwarded payload at the receiving service; never trust cross-service input implicitly.'
+            : 'Validate and authorize the forwarded payload at the receiving service; treat cross-service input as untrusted.',
+          _edge: { from: file, to: remote.file, route: `${remote.method} ${remote.path}` },
+        });
+      }
+    }
+  }
+  return findings;
+}