@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.2

package/CHANGELOG.md

@@ -1,5 +1,279 @@
 # Changelog
 
+## 0.119.2 — plugin manifest validation fixes
+
+Manifest/packaging hotfix; no functional change to the scanner.
+
+- `commands/fix.md`: quoted the `description:` frontmatter value. The unquoted
+  colon-space (`Remediate findings: --one …`) parsed as a nested YAML mapping,
+  which `claude plugin validate` rejected — and would have caused the command to
+  load with all frontmatter fields silently dropped at runtime.
+- `.claude-plugin/plugin.json`: dropped the unknown `vendor` field (Claude Code
+  ignores it at load time; the company already lives in `author`).
+- Removed stray gitignored `.agentic-security/` runtime artifacts (regenerated
+  DPIA/threat-model output) from under `agents/` and `commands/`, where the
+  validator was mis-reading them as plugin agents/commands.
+
+`claude plugin validate` now passes; the two remaining warnings
+(`agents/_CONFINEMENT.md` and the root `CLAUDE.md`) are by-design per the
+underscore-doc convention enforced in `plugin-self-check.test.js`.
+
+## 0.119.1 — packaging: exclude internal scan-state from the npm tarball
+
+Packaging-only hotfix for the `@clear-capabilities/agentic-security-scanner` npm
+package; no functional change to the scanner or the plugin.
+
+- The published tarball had ballooned to 23.5 MB / 565 files because the `files`
+  allowlist pulled in `src/**/.agentic-security/` and `bin/.agentic-security/` —
+  the dogfooded self-scan state (findings.json, last-scan.json, scan-history,
+  threat-model). `npm pack` runs from `scanner/` and does not consult the
+  repo-root `.gitignore`, and a root `.npmignore` is ignored when a `files` field
+  is present, so the carve-out is done with negation entries in `files`
+  (`!**/.agentic-security`, `!**/.agentic-security/**`). The tarball is now
+  7.9 MB / 393 files with no scan-state.
+
+## 0.119.0 — SAST/SCA capability program (PRD R1–R25, ex-R14)
+
+Implements the `docs/SAST_SCA_IMPROVEMENT_PRD.md` backlog — 24 of 25
+recommendations (DAST-lite/R14 intentionally out). Every change shipped with a
+fixture + test and the corpus gate held at 185/185.
+
+**Core engine**
+- **R1**: deep interprocedural taint (IR + field-/value-context-sensitive) is now
+  ON by default for local/interactive CLI scans, budgeted, CI-off-by-default
+  (`--no-deep` / `AGENTIC_SECURITY_DEEP=0` opt-out).
+- **R23**: fixed the incremental cache cold-start no-op (it never persisted a
+  baseline), with an end-to-end regression test.
+- **R4**: collection-element taint (`arr.push(tainted); sink(arr[i])`) on by
+  default; implicit/control-dependence flow wired in opt-in
+  (`AGENTIC_SECURITY_IMPLICIT_FLOW=1`).
+- **R2**: bounded k=1 call-string context sensitivity, opt-in
+  (`AGENTIC_SECURITY_KCFA_CALLSTRING=1`); default-off keys are byte-identical.
+- **R3**: deep-flow parity extended to **Go + Kotlin** — call-shaped sources
+  (`r.FormValue()`), string callees (`db.Query`), Go string-concat lowering,
+  Go `database/sql` sinks. (PHP/Ruby/C# parser concat-lowering remains.)
+- **R17**: per-finding corroboration ("one issue, many signals") + rank tiebreak.
+- **R13**: "provably safe" is a first-class verdict (`--hide-proven-safe`).
+- **R5**: context-aware sanitizer adequacy (HTML-escape before a shell/SQL sink).
+- **R6**: non-HTTP entrypoint taint (queue consumers / scheduled tasks / serverless).
+
+**SCA / supply chain**
+- **R7**: import-aware function-level reachability (JS/TS + Python) — resolves
+  aliased/namespace imports, gated to files that import the package.
+- **R12**: deterministic decision-first verdict per dependency
+  (AUTO_MERGE_PATCH / WAIT_FOR_PATCH / MANUAL_REVIEW / ACCEPT_RISK / WONT_FIX).
+- **R11**: OpenVEX export (`--format vex`) from reachability verdicts.
+- **R9**: static malicious install-script analysis (download-exec / base64-exec /
+  env-exfil lifecycle hooks).
+- **R10**: Gradle transitive dependency graph.
+- **R8**: container-image OS-package inventory (dpkg/apk).
+
+**Detection surfaces, validation, workflow**
+- **R20**: agent-loop taint (untrusted RAG/tool content → high-privilege tool).
+- **R19**: route-level BOLA/BFLA over the API inventory.
+- **R21**: RBAC role-tier authorization consistency.
+- **R22**: cross-service dataflow (client-call → matched route edge inference).
+- **R18**: semantic IaC (Terraform with variable resolution).
+- **R16**: independent-eval harness (per-family precision/recall/F1 + gate).
+- **R24**: PR-native net-new CI gate (`--fail-on-new`).
+- **R15**: git-history secret sweep (`--secret-history`).
+- **R25**: auto-fix acceptance-rate metric (surfaced in `apply_fix`).
+
+Several latent bugs were found and fixed along the way (the dead `implicit-flow`
+module, an `Object.assign`-taint path silently dying on a `const` binding, the
+IR-TAINT conversion dropping the `implicit` flag). Each opt-in/partial item and
+its remainder is tracked in the PRD rollup.
+
+## 0.118.2 — Scanner F1 benchmark: restore F1 to 91.3% (3 FPs removed)
+
+The "Scanner F1 benchmark" CI job (`test/benchmark/bench.js`, separate from the
+cve-replay corpus) was failing. Root-caused three false positives and fixed all
+three at the detector level (no baseline edit):
+
+- **ReDoS double-flag** (introduced in v0.118.0): `scanRegexReDoS` (the
+  multi-language NFA detector) ran on all languages including JS, double-flagging
+  regexes already covered by `scanReDoS`. Restricted to the languages
+  `scanReDoS` misses string-form regexes in (java/cs/kt/py/php); js/rb stay with
+  `scanReDoS`.
+- **rule-library-shape SQLi-in-string** (pre-existing): `js-framework-structural`
+  matched a `db.query(\`…\`)` that was the *content* of a rule-definition string.
+  Added a same-line string-literal guard.
+- **secret double-count** (pre-existing): a split API key was reported twice —
+  once by `secret-concat` (CWE-798) and once as a High-Entropy Credential
+  Candidate. Drop the entropy candidate when a named secret detector already
+  flagged the same `file:line`.
+- **Measured: bench F1 90.3% → 91.3%, FP 20 → 17;** cve-replay corpus unchanged
+  at 185/185 F1=1.000; full gate green.
+
+## 0.118.1 — README: Language coverage section
+
+Documents the 8 first-class languages (JS/TS, Python, Java, Kotlin, Go, Ruby,
+PHP, C#) and the cross-language vuln-class coverage built out over v0.108–0.118
+(SQLi, command/code/LDAP/XPath injection, XSS, SSRF, XXE, deserialization,
+secrets, weak hashing/ciphers, static IV, CSRF, open redirect, response
+splitting, ReDoS), measured by the blind, regression-gated 185-entry CVE-replay
+corpus at F1=1.000. Docs + version only; no src/bundle/corpus change.
+
+## 0.118.0 — Multi-CWE gap fill: 167→185 corpus, matrix to 152/160 cells
+
+Closes the remaining detector-backed gaps across five CWEs in one batch, via
+detector extensions (each verified pre:TP post:TN; no corpus regression).
+
+- **`redos-nfa.js`** (CWE-1333): the multi-language NFA detector (was dormant)
+  now wired in for Java/C#/Kotlin, plus PHP/Ruby string-form regex extractors.
+  Go intentionally not scanned — its `regexp` package is RE2 (linear-time).
+- **`weak-password-hash.js`** (CWE-916): added Ruby, C#, Kotlin, PHP MD5/SHA1
+  forms. Password-context-gated; bcrypt/argon2 nearby suppresses.
+- **`open-redirect.js`** (CWE-601): added Go, Ruby, C#, Kotlin sinks, with
+  allow-list recognition and literal-target exemption.
+- **`ruby.js`** (CWE-502): `Marshal.load`/`YAML.load` on a non-literal arg.
+  **`go-structural.js`** (CWE-502): `encoding/gob` decode of untrusted bytes.
+  **`php.js`** (CWE-918): cURL / fopen-wrapper fetch of a `$_GET`-controlled URL.
+- **18 new corpus entries.** Not filled (intentional): CWE-1321 prototype
+  pollution in 7 non-JS languages, and CWE-1333 in Go (RE2) — 8 cells empty by
+  design. **Corpus 167 → 185; matrix 134 → 152/160 (95%).** F1=1.000; gate green.
+
+## 0.117.0 — Cross-language XPath injection (CWE-643) + 7 corpus entries
+
+Extends `xpath-injection.js` from Java/Python/JS to PHP, Go, Ruby, C#, Kotlin
+(`DOMXPath`, `SelectNodes`/interp, Nokogiri `.xpath`, xmlpath/htmlquery,
+`javax.xml.xpath`). All string-literal matching is embedded-quote-tolerant — an
+expression like `"//user[@name='" + x` embeds the attribute delimiter quote
+(also fixed a latent miss in the existing Java/Python patterns). Two issues
+caught pre-commit (a Kotlin post:FP, a test-author `${u}` JS-interpolated before
+the scanner). **Corpus 160 → 167; matrix 127 → 134/160.** F1=1.000; gate green.
+
+## 0.116.0 — Cross-language CSRF detection (CWE-352) + 3 corpus entries
+
+Extends `csrf.js` to Go (gin/echo/fiber/chi, net/http mux), Rails routes, and
+ASP.NET MVC `[HttpPost]` action attrs. Defence recognition added (gorilla/csrf,
+nosurf, `protect_from_forgery`, `[ValidateAntiForgeryToken]`/IAntiforgery).
+Token-auth exemption: `[ApiController]` + explicit Bearer is CSRF-safe; bare
+`[Authorize]` is not (cookie auth is the ASP.NET default). **Corpus 157 → 160;
+matrix 124 → 127/160.** F1=1.000; gate green.
+
+## 0.115.0 — Java reflected XSS (CWE-79): fills last XSS cell
+
+Adds Java to `xss-reflected-multilang.js` — servlet `response.getWriter()`
+write/print + `PrintWriter`, building an HTML string by concat. Static literals
+and OWASP/Commons/ESAPI encoders excluded. The reflected-XSS row (CWE-79) is now
+complete across all 8 languages. **Corpus 156 → 157; matrix 123 → 124/160.**
+F1=1.000; gate green.
+
+## 0.114.0 — Cross-language weak-cipher detection (CWE-327) + 3 corpus entries
+
+Extends `crypto-protocol.js` weak-cipher detection to the Go (`crypto/des`,
+`crypto/rc4`), PHP (`openssl_encrypt`/legacy `mcrypt_*` weak algos), and Ruby
+(`OpenSSL::Cipher` DES/RC4/Blowfish) idioms. AES-GCM stays clean. **Corpus
+153 → 156; matrix 120 → 123/160.** F1=1.000; gate green.
+
+## 0.113.0 — Cross-language static-IV detection (CWE-329) + 7 corpus entries
+
+Extends `crypto-protocol.js` static-IV detection to JVM (`IvParameterSpec`/
+`GCMParameterSpec` from a zero array), C# (zero `.IV`), PHP (empty/`str_repeat`
+IV), Ruby (fixed-literal IV), and Go (zero `make([]byte,…)` with a CBC/CTR mode,
+suppressed when filled from `crypto/rand`). CSPRNG-derived IVs stay clean across
+all languages. **Corpus 146 → 153; matrix 113 → 120/160.** F1=1.000; gate green.
+
+## 0.112.0 — Cross-language HTTP response splitting (CWE-113) + 7 corpus entries
+
+Extends `response-splitting.js` across all 8 languages (added Go, Ruby, C#,
+Kotlin header sinks) and fixes two latent bugs: the PHP value was read from the
+header-NAME capture group (never fired), and the request-scope param heuristic
+is generalized from Java to Java/Kotlin/C#. Sanitizer recognition extended
+(Python chained `.replace`, Ruby `gsub`/`delete`, Go `NewReplacer`/`ReplaceAll`,
+PHP `str_replace`) so fixed forms stay clean. Biggest single matrix gain this
+session. **Corpus 139 → 146; matrix 106 → 113/160.** F1=1.000; gate green.
+
+## 0.111.0 — Cross-language XXE detector (CWE-611) + 3 corpus entries
+
+Extends `xxe.js` (Java/Python) to PHP, Go, Ruby. Each non-JVM XML stack is
+XXE-safe by default, so the detector flags the explicit external-entity opt-in
+(PHP `LIBXML_NOENT`/`DTDLOAD`, Go `Strict=false`/custom Entity map, Nokogiri
+`noent`/`dtdload`/`replace_entities`) rather than the default-safe parse.
+**Corpus 136 → 139; matrix 103 → 106/160.** F1=1.000; gate green.
+
+## 0.110.0 — Cross-language code-injection detector (CWE-94) + 4 corpus entries
+
+New `code-injection-multilang.js` closes the CWE-94 gap in Java/C#/Go/Kotlin
+(JS/Python/Ruby `eval` stay with the flow engine). Flags dynamic
+code/expression evaluators on a non-literal argument — Java/Kotlin
+(`ScriptEngine.eval`, GroovyShell, SpEL, MVEL, OGNL), C# (Roslyn `CSharpScript`,
+`DataTable.Compute`), Go (yaegi/gomacro `interp.Eval`, `text/template` parse of a
+non-literal body). A literal argument does not match. **Corpus 132 → 136; matrix
+99 → 103/160.** F1=1.000; gate green.
+
+## 0.109.0 — Cross-language LDAP injection detector (CWE-90) + 6 corpus entries
+
+Extends `ldap-injection.js` from JS/Java/Python to PHP, Go, C#, Ruby, Kotlin.
+Per-language filter patterns gated by an LDAP attribute set (uid/cn/mail/…) so
+it doesn't fire on generic `key=value`. Two precision guards (both fix real FPs
+found while building): a backtrack-proof call-guard so an escaped call at the
+concat isn't flagged, and a file-level escape-API guard (`ldap_escape`,
+`EscapeFilter`, `escape_filter_chars`, …) for escape-then-use spanning lines.
+**Corpus 126 → 132; matrix 93 → 99/160.** F1=1.000; gate green.
+
+## 0.108.1 — Corpus scale-up batch 3 — 117→126, matrix 84→93 cells
+
+9 verified harvest entries across previously-empty cells the scanner already
+detects (no detector change): CWE-798 {java,go,ruby,php}, CWE-916 {java,go,php},
+CWE-918 {ruby}, CWE-601 {java}. Two discipline notes encoded in the generator so
+they don't recur: placeholder `AKIA…EXAMPLE` keys read as pre:FN (the secrets
+scanner correctly skips placeholders — regenerated with realistic keys), and a
+guarded open-redirect "fixed" variant read as post:FP (the detector doesn't yet
+recognize allow-list guards — post now uses literal targets). **126/126
+F1=1.000; gate exit 0.**
+
+## 0.108.0 — Corpus scale-up to 117 + baseline CI gate + cross-language XSS
+
+Squashes the v0.106.0–v0.107.3 development churn (7 commits, several corrective)
+into one coherent release.
+
+- **Corpus 101 → 117 entries**, all pre:TP post:TN, F1=1.000, verified blind
+  (manifest outside the scanned trees; identical under
+  `AGENTIC_SECURITY_BLIND_BENCH=1`). Batch 2 harvest (11) + cross-language
+  reflected XSS (5).
+- **`xss-reflected-multilang.js`** (new): taint-independent reflected XSS for
+  Go/Ruby/PHP/C#/Kotlin (input into an HTML response via concat/interp), each
+  with a per-language output-encoder exclusion. JS/Python XSS stays with the
+  flow engine.
+- **Corpus baseline CI gate** (the process fix): `corpus-baseline.json` records
+  the verdict for every entry; `runner.mjs --check-baseline`/`--update-baseline`
+  + npm scripts. The gate fails on any drift — a regressed entry, a removed
+  entry, or a new entry that does not pass. First `.github/workflows/ci.yml`
+  (repo had no CI): runs `npm test`, verifies the committed bundle matches
+  source, runs the corpus gate.
+- **CLAUDE.md gains the "Verification discipline" section.** 117/117, gate exit 0.
+
+## 0.105.0 — Corpus scale-up batch 1 (Tier 4) — 88→101, matrix 64→77 cells
+
+First batch of the cve-replay scale-up toward 500, prioritized by empty
+CWE×language cells. 13 new capability entries across 9 previously-empty cells
+(CWE-338 weak PRNG, CWE-94, CWE-352, CWE-22, CWE-502), each verified pre:TP
+post:TN. Two additive detector extensions unlock them: `weak-randomness.js`
+gains snake_case carriers + Java/Kotlin/C# PRNG patterns (CWE-338; SecureRandom
+stays clean), and `php.js`/`ruby.js` gain structural path traversal (CWE-22).
+**Corpus stays F1=1.000; matrix 64 → 77/160.**
+
+## 0.104.0 — Close remaining corpus FN/FP — cve-replay F1 0.929 → 1.000
+
+Implements the full remaining recall+precision backlog. Aggregate cve-replay now
+TP=88 FP=0 FN=0 TN=88 (F1=1.000); every language and CWE slice at F1=1.000.
+
+- **`secret-concat.js`** (new): language-agnostic hardcoded-secret split across
+  concatenated literals — reassembles `'AKIA'+'IOSF…'`/`'ghp'+'_…'`/`'sk'+'_live_…'`
+  and matches provider prefixes (CWE-798).
+- **`crypto-protocol.js`**: pyca/cryptography zero/static IV (CWE-329).
+  **`weak-randomness.js`**: camelCase security carrier; reclassified CWE-330 →
+  CWE-338. **`php.js`**: structural SQLi covers deprecated `mysql_query`.
+  **`js-framework-structural.js`**: libxmljs XXE (CWE-611).
+  **`python-structural.js`**: embedded-quote-tolerant literal matching +
+  `open()`/`send_file` path traversal (CWE-22). **`csrf.js`**: Symfony support.
+- **Precision (`engine.js` `dropGuardedFindings`)**: reflected-XSS
+  output-encoding guard (drop CWE-79 when the value passed through a *captured*
+  HTML escaper); `dedupeFindingsWithEvidence` prefers an interprocedural flow
+  finding over a flat structural match at the same sink.
+
 ## 0.103.0 — Go recall: structural detectors (PRD Tier 1)
 
 - **`go-structural.js`** (new): SQL injection via a `database/sql` query method

package/bin/agentic-security.js

@@ -9,7 +9,7 @@ const __require = createRequire(import.meta.url);
 const PKG_VERSION = __require('../package.json').version;
 import { signLastScan as _signLastScan, verifyLastScan as _verifyLastScanShared } from '../src/posture/integrity.js';
 import { runScan } from '../src/runScan.js';
-import { toJSON, toMarkdown, toSARIF, toSTIX, toCSV, toJUnit, toCLI, toCLIByProfile, toShipVerdict, toProTable, toHTML, toSummary, exitCodeFor, normalizeFindings } from '../src/report/index.js';
+import { toJSON, toMarkdown, toSARIF, toSTIX, toCSV, toJUnit, toCLI, toCLIByProfile, toShipVerdict, toProTable, toHTML, toSummary, toVex, exitCodeFor, normalizeFindings } from '../src/report/index.js';
 import { toCycloneDX, toSPDX } from '../src/posture/sbom.js';
 import { toPBOM } from '../src/sast/pipeline.js';
 import { buildAIBOM, aibomToMarkdown } from '../src/posture/aibom.js';
@@ -82,6 +82,8 @@ Options:
   --pack <name>                Focus on a curated rule pack (repeatable): owasp-top-10 | cwe-top-25 | llm-security | supply-chain
   --baseline <ref>             Diff against a git ref; only findings new vs. that ref count (ci subcommand)
   --fail-on critical|high|medium|low|none  ci-mode exit policy (default: critical)
+  --fail-on-new                (ci) block ONLY on findings this PR introduced vs
+                               the baseline ref — never the pre-existing backlog
   --policy <file.rego>         ci-mode policy-as-code gate; deny[] rules fail the build (FR-SDLC-9)
   --columns standard|mitre|capec|owasp  Pro-mode column set (default: standard)
   --confidence <0..1>          Override per-profile confidence threshold
@@ -109,6 +111,10 @@ Options:
   --incremental                Reuse taint summaries from prior scans (speeds up deep mode in CI)
   --set-baseline               Save current findings as baseline (suppresses pre-existing issues)
   --since-baseline             Only show findings NOT in the saved baseline
+  --hide-proven-safe           Drop findings discharged by a flow proof (provably safe)
+  --secret-history             Also sweep recent git history for committed secrets
+                               (removed from HEAD but recoverable from .git)
+  --history-depth <n>          Commits to sweep with --secret-history (default 50)
   --no-epss                    Skip EPSS exploit-prediction enrichment (default: enabled)
   --no-blast-radius            Skip blast-radius / cost framing (default: enabled)
   --verbose                    Include fix bodies + taxonomy in CLI output
@@ -330,6 +336,27 @@ async function cmdScan(args) {
     process.env.AGENTIC_SECURITY_INCREMENTAL = '1';
   }
 
+  // R1 (PRD §5): deep interprocedural taint (IR + field-sensitive, value-context-
+  // sensitive dataflow — src/dataflow/) is ON by default for local/interactive CLI
+  // scans, bounded by the existing wall-clock budget (AGENTIC_SECURITY_DEEP_TIMEOUT_MS,
+  // default 5 min) and function cap (AGENTIC_SECURITY_DEEP_FN_LIMIT, default 5000). It
+  // is the engine's strongest analysis and was previously gated off, so the default
+  // scan ran pattern/structural-only. Precedence (highest first):
+  //   --no-deep / AGENTIC_SECURITY_DEEP=0  → stays off (degrade to structural-only)
+  //   --deep    / AGENTIC_SECURITY_DEEP=1  → stays on (even in CI? no — see engine gate)
+  //   unset + not in CI                    → default ON here
+  //   unset + in CI                        → left unset; the engine keeps deep off in CI
+  //                                          unless AGENTIC_SECURITY_DEEP_IN_CI=1
+  // The in-process test/bench harnesses call runScan() directly (not this CLI entry),
+  // so they are unaffected and remain deterministic regression gates.
+  if (args.flags['no-deep']) process.env.AGENTIC_SECURITY_DEEP = '0';
+  else if (args.flags['deep']) process.env.AGENTIC_SECURITY_DEEP = '1';
+  else if (process.env.AGENTIC_SECURITY_DEEP == null || process.env.AGENTIC_SECURITY_DEEP === '') {
+    const inCi = !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
+                    process.env.BUILDKITE || process.env.CIRCLECI || process.env.JENKINS_URL);
+    if (!inCi) process.env.AGENTIC_SECURITY_DEEP = '1';
+  }
+
   // --pr [ref] : friendlier alias for --changed-since that auto-detects the PR
   // base ref (GitHub/GitLab/Buildkite/Bitbucket env vars) when no value is given.
   let changedSince = args.flags['changed-since'] || null;
@@ -374,6 +401,32 @@ async function cmdScan(args) {
     } catch { /* baseline file unreadable, skip */ }
   }
 
+  // R13 (PRD §5): --hide-proven-safe drops findings a flow proof discharged
+  // (parameterizer on every path / sanitizer excludes metacharacters) for a
+  // clean report. They are kept (demoted) by default so nothing is hidden silently.
+  if (args.flags['hide-proven-safe']) {
+    const before = (scan.findings || []).length;
+    scan.findings = (scan.findings || []).filter(f => !f.provablySafe);
+    process.stderr.write(`[proof] hid ${before - (scan.findings || []).length} provably-safe finding(s)\n`);
+  }
+
+  // R15 (PRD §5): --secret-history sweeps recent git history for secrets that
+  // may have been removed from HEAD but remain recoverable from .git.
+  if (args.flags['secret-history']) {
+    try {
+      const { sweepGitHistory } = await import('../src/posture/secret-history.js');
+      const { scanCredentials } = await import('../src/secrets/index.js');
+      const depth = parseInt(args.flags['history-depth'] || '50', 10);
+      const hist = sweepGitHistory(targetAbs, scanCredentials, { maxCommits: depth });
+      if (hist.length) {
+        scan.secrets = [...(scan.secrets || []), ...hist];
+        process.stderr.write(`[secret-history] ${hist.length} secret(s) found in the last ${depth} commits — rotate even if removed from HEAD\n`);
+      } else {
+        process.stderr.write(`[secret-history] no secrets found in the last ${depth} commits\n`);
+      }
+    } catch (e) { if (process.env.AGENTIC_SECURITY_DEBUG === '1') process.stderr.write(`[secret-history] ${e && e.message}\n`); }
+  }
+
   // 0.9.0 Feat-18: --scorecard flag enables OSSF Scorecard enrichment
   if (args.flags['scorecard']) process.env.AGENTIC_SECURITY_SCORECARD = '1';
 
@@ -481,6 +534,7 @@ async function cmdScan(args) {
   else if (format === 'html') body = toHTML(scan, meta);
   else if (format === 'cyclonedx' || format === 'sbom') body = JSON.stringify(toCycloneDX(scan, meta), null, 2);
   else if (format === 'spdx')                            body = JSON.stringify(toSPDX(scan, meta), null, 2);
+  else if (format === 'vex' || format === 'openvex')     body = JSON.stringify(toVex(scan, meta), null, 2);
   else if (format === 'pbom')                            body = JSON.stringify(toPBOM(scan.fc || {}, meta), null, 2);
   else if (format === 'aibom')                           body = JSON.stringify(buildAIBOM(scan, scan.fc || {}, meta), null, 2);
   else if (format === 'aibom-md')                        body = aibomToMarkdown(buildAIBOM(scan, scan.fc || {}, meta));
@@ -637,6 +691,29 @@ async function cmdCi(args) {
     }
     process.stderr.write(`[ci] policy gate PASSED (${r.runner}, 0 denials)\n`);
   }
+  // R24 (PRD §5): PR-native net-new gate. With --fail-on-new and a baseline
+  // ref, block ONLY on findings this PR INTRODUCED (vs the base ref), never on
+  // the pre-existing backlog — the posture teams actually leave enabled.
+  if (args.flags['fail-on-new']) {
+    const baseRef = baseline;
+    if (!baseRef) {
+      process.stderr.write('[ci] --fail-on-new requires a baseline ref (--baseline <ref> or a CI base-branch env var)\n');
+      return 1;
+    }
+    try {
+      const { computePrDelta, netNewGate } = await import('../src/pr-delta.js');
+      const delta = await computePrDelta(target, { baseRef });
+      const gate = netNewGate(delta, failOn);
+      process.stderr.write(
+        `[ci] net-new vs ${baseRef}: +${delta.introduced.length} introduced · -${delta.resolved.length} resolved · ${delta.persistent.length} pre-existing (not gated)\n` +
+        `[ci] net-new gate fail-on=${failOn} → ${gate.fail ? 'FAIL' : 'pass'}${gate.blocked.length ? ' (' + gate.blocked.length + ' blocking)' : ''}\n`);
+      for (const f of gate.blocked.slice(0, 20)) process.stderr.write(`  + [${(f.severity || '').toUpperCase()}] ${f.vuln || f.type} ${f.file}:${f.line}\n`);
+      return gate.fail ? 1 : 0;
+    } catch (e) {
+      process.stderr.write(`[ci] net-new gate error: ${(e && e.message) || e} — falling back to full --fail-on gate\n`);
+      // Fall through to the full gate rather than passing silently.
+    }
+  }
   return ciExitCode(scanCode, failOn);
 }
 

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4097);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5099);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(4097);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5099);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/415.index.js

@@ -0,0 +1,90 @@
+export const id = 415;
+export const ids = [415];
+export const modules = {
+
+/***/ 5796:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   extractImagePackages: () => (/* binding */ extractImagePackages)
+/* harmony export */ });
+/* unused harmony exports parseDpkgStatus, parseApkInstalled */
+// R8 (PRD §5) — container-image OS-package inventory.
+//
+// container.js reads the Dockerfile (FROM + apt/apk install lines). This reads
+// the ACTUAL installed-package databases from an extracted image filesystem
+// (or the host), catching packages baked into the base image that the
+// Dockerfile never names. Components flow into the existing OSV pipeline + SBOM.
+//
+// Pure parsers (unit-tested) + a path-matching extractor. No daemon; reads the
+// package-DB files that appear when an image layer/tarball is unpacked.
+
+// Debian/Ubuntu: /var/lib/dpkg/status — RFC822-style blocks separated by blank
+// lines. Only "install ok installed" entries count (not removed/config-files).
+function parseDpkgStatus(text) {
+  const out = [];
+  for (const block of String(text || '').split(/\n\s*\n/)) {
+    const name = (block.match(/^Package:\s*(.+)$/m) || [])[1];
+    const version = (block.match(/^Version:\s*(.+)$/m) || [])[1];
+    const status = (block.match(/^Status:\s*(.+)$/m) || [])[1] || '';
+    if (!name || !version) continue;
+    if (!/\binstalled\b/.test(status)) continue;
+    out.push({ name: name.trim(), version: version.trim(), ecosystem: 'Debian' });
+  }
+  return out;
+}
+
+// Alpine: /lib/apk/db/installed — blocks separated by blank lines; P:=name V:=version.
+function parseApkInstalled(text) {
+  const out = [];
+  for (const block of String(text || '').split(/\n\s*\n/)) {
+    const name = (block.match(/^P:(.+)$/m) || [])[1];
+    const version = (block.match(/^V:(.+)$/m) || [])[1];
+    if (!name || !version) continue;
+    out.push({ name: name.trim(), version: version.trim(), ecosystem: 'Alpine' });
+  }
+  return out;
+}
+
+const _PURL = { Debian: (n, v) => `pkg:deb/debian/${n}@${v}`, Alpine: (n, v) => `pkg:apk/alpine/${n}@${v}` };
+
+// File-path tells for an unpacked image. Match on path suffix so it works
+// whether the scan root is the rootfs or a subdirectory of it.
+function _dbKind(path) {
+  const p = path.replace(/\\/g, '/');
+  if (/(?:^|\/)var\/lib\/dpkg\/status$/.test(p)) return 'dpkg';
+  if (/(?:^|\/)lib\/apk\/db\/installed$/.test(p)) return 'apk';
+  return null;
+}
+
+/**
+ * Extract OS-package components from any image package-DBs present in the scanned
+ * files. Returns components in the engine's component shape so they ride the
+ * existing OSV/SBOM pipeline. De-dups by ecosystem:name:version.
+ */
+function extractImagePackages(fileContents) {
+  const comps = [];
+  const seen = new Set();
+  for (const [file, content] of Object.entries(fileContents || {})) {
+    const kind = _dbKind(file);
+    if (!kind) continue;
+    const pkgs = kind === 'dpkg' ? parseDpkgStatus(content) : parseApkInstalled(content);
+    for (const p of pkgs) {
+      const key = `${p.ecosystem}:${p.name}:${p.version}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      comps.push({
+        name: p.name, version: p.version, group: '', ecosystem: p.ecosystem,
+        purl: (_PURL[p.ecosystem] || (() => null))(p.name, p.version),
+        filePath: file, isUnpinned: false, isTransitive: false, isOsPackage: true,
+        scope: 'required', reachable: true,
+      });
+    }
+  }
+  return comps;
+}
+
+
+/***/ })
+
+};

package/dist/444.index.js

@@ -0,0 +1,89 @@
+export const id = 444;
+export const ids = [444];
+export const modules = {
+
+/***/ 1444:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   sweepGitHistory: () => (/* binding */ sweepGitHistory)
+/* harmony export */ });
+/* unused harmony exports extractAddedLines, scanHistoryDiff */
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
+// R15 (PRD §5) — git-history secret sweep.
+//
+// A secret removed from HEAD but present in any past commit is still
+// recoverable from `.git` and must be rotated — the most dangerous secret case,
+// and one a working-tree-only scan misses entirely. This sweeps recent history
+// (bounded), feeding the ADDED lines of each commit through the same credential
+// detector the file scan uses.
+//
+// The detector is INJECTED (detectFn) rather than imported, so this module has
+// no dependency back into engine.js (avoids a circular import) and the parsing
+// stays pure + unit-testable. Live-credential validation (is the key active?)
+// needs network and is deferred — see the rollup.
+
+
+
+// Pull the post-image (added) lines out of a unified diff: lines starting with
+// a single '+' (not the '+++' file header). Returns reconstructed text.
+function extractAddedLines(diffText) {
+  const out = [];
+  for (const line of String(diffText || '').split('\n')) {
+    if (line.startsWith('+') && !line.startsWith('+++')) out.push(line.slice(1));
+  }
+  return out.join('\n');
+}
+
+// Pure: run the injected credential detector over a commit's added lines.
+// detectFn has the scanCredentials(fp, raw) shape and returns Finding[].
+function scanHistoryDiff(diffText, commit, detectFn) {
+  if (typeof detectFn !== 'function') return [];
+  const added = extractAddedLines(diffText);
+  if (!added.trim()) return [];
+  let findings = [];
+  try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
+  return findings.map((f) => ({
+    ...f,
+    id: `secret-history:${commit}:${f.id || f.vuln || 'secret'}`,
+    file: `git-history@${commit}`,
+    line: 0,
+    commit,
+    _historical: true,
+    vuln: `${f.vuln || 'Hardcoded Secret'} (in git history)`,
+    description: `${f.description || 'A credential was committed.'} Found in commit ${commit}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
+    remediation: 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.',
+  }));
+}
+
+/**
+ * Sweep up to `maxCommits` of recent history for secrets. Best-effort: returns
+ * [] when `scanRoot` is not a git repo or git is unavailable. Dedups a secret
+ * that recurs across commits to its earliest sighting.
+ */
+function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000 } = {}) {
+  if (!scanRoot || typeof detectFn !== 'function') return [];
+  let out;
+  try {
+    out = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.execFileSync)('git', ['-C', scanRoot, 'log', '-p', '-n', String(maxCommits), '--no-color', '--no-merges', '--no-textconv'],
+      { encoding: 'utf8', maxBuffer: 96 * 1024 * 1024, timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch { return []; }
+  const parts = out.split(/^commit ([0-9a-f]{7,40})/m); // [pre, sha, body, sha, body, ...]
+  const findings = [];
+  const seen = new Set();
+  for (let i = 1; i < parts.length; i += 2) {
+    const sha = (parts[i] || '').slice(0, 12);
+    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn)) {
+      const key = `${f.vuln}:${(f.snippet || f.match || '').slice(0, 40)}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push(f);
+    }
+  }
+  return findings;
+}
+
+
+/***/ })
+
+};