@clear-capabilities/agentic-security-scanner 0.124.0 → 0.127.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-a89f9898e9c186c99eef3e08ab7a5bf886af031eb068aff011ff617d3a12a08e  agentic-security.mjs
+424585bd11f792465c48ad4fcf7bcb61be3b3351b80f3fdb500eb7f89cb6755c  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.124.0",
+  "version": "0.127.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -60,13 +60,13 @@
     "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs",
     "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
     "test:smoke": "node --test test/smoke.test.js",
-    "test:sast": "node --test test/llm.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
-    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js",
-    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js",
+    "test:sast": "node --test test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
+    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js",
+    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js",
     "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js",
-    "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js && node ../scripts/lint-command-descriptions.mjs",
+    "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js && node ../scripts/lint-command-descriptions.mjs",
     "test:eval": "node --test test/independent-eval.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
     "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",

package/src/engine.js

@@ -11,6 +11,7 @@ import { createRequire } from 'node:module';
 const _require = createRequire(import.meta.url);
 import { scanLLM } from './sast/llm.js';
 import { scanLLMOwasp } from './sast/llm-owasp.js';
+import { scanLlmCost } from './sast/llm-cost-advisor.js';
 import { scanBusinessLogic } from './sast/logic.js';
 import { scanPipeline } from './sast/pipeline.js';
 import { scanMCP } from './sast/mcp-audit.js';
@@ -52,6 +53,7 @@ import { deadBranchRanges as _deadBranchRanges, isLineInDeadRange as _isLineInDe
 import { scanJavaDeserialization } from './sast/java-deserialization.js';
 import { scanJwtExp } from './sast/jwt-exp.js';
 import { scanZipSlip } from './sast/zip-slip.js';
+import { scanFileUpload } from './sast/file-upload.js';
 import { scanHostHeader } from './sast/host-header.js';
 import { scanPythonSinks } from './sast/python-sinks.js';
 import { scanCSharp } from './sast/csharp.js';
@@ -7396,6 +7398,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));aF.push(...scanTerraform(p,c));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
+      aF.push(...scanLlmCost(p,c));
       aLogic.push(...scanBusinessLogic(p,c));
       aF.push(...scanPipeline(p,c));
       aF.push(...scanContainer(p,c));
@@ -7429,6 +7432,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
       aF.push(...scanJavaDeserialization(p,c));
       aF.push(...scanJwtExp(p,c));
       aF.push(...scanZipSlip(p,c));
+      aF.push(...scanFileUpload(p,c));
       aF.push(...scanHostHeader(p,c));
       aF.push(...scanPythonSinks(p,c));
       aF.push(...scanCSharp(p,c));

package/src/ir/CLAUDE.md

@@ -76,23 +76,28 @@ topLevel}`) as the regex parser. The CFG is built from the real AST, so:
 Each of these is a real failure mode; the regex fallback keeps the scan
 producing findings instead of returning empty.
 
-### What CST still doesn't model
-
-The helper builds a CFG only for shapes the dataflow engine actually
-consumes. The following still emit `kind: 'noop'` nodes (future work):
-
-- `match` case bodies (the function is captured; the per-case taint flow
-  isn't lowered)
-- destructuring assignment (`a, b = req.body`) — only single-target
-  assignments get a precise `target` field
-- comprehension generators (`for x in iter`) — the iter expression is
-  visible via the elt, but the generator's own `if` filters aren't yet
-  modeled
-- walrus `:=` at expression position — the RHS flows forward, but the
-  named binding isn't tracked as a separate variable
-
-These are deliberate to keep the CFG bounded; the regex parser's behavior
-was strictly worse (it dropped the entire function).
+### What CST models (and the one remaining limit)
+
+The helper now lowers — and the dataflow engine propagates taint through — all
+of the constructs this section once listed as unmodeled. Verified end-to-end in
+`test/parser-py-cst.test.js` (`#16` flow tests):
+
+- `match` case bodies — each `case` arm lowers to an `if` (the pattern) plus its
+  body block; a capture pattern (`case Foo(x)`) emits an assign for the binding.
+  Taint flows source → through a case body → sink.
+- walrus `:=` — the named binding is tracked as its own assign, both at statement
+  position and inside `if`/`while` tests (`_emit_walrus_assigns`).
+- comprehension generators — the loop-var assign from the iter AND the
+  generator's own `if` filters are emitted (`for x in iter if cond`).
+- destructuring assignment (`a, b = expr`) — one assign per target, sourced from
+  the element (`member[]`) of the RHS.
+
+**Remaining limit (a deep-engine collection-element trait, NOT a dropped CFG
+node):** taint carried through the *element* of a destructured tuple or a
+comprehension result — `a, b = src1, src2; sink(a)` or `xs = [src…]; sink(xs[0])`
+— does not always reach a finding. That's the collection-element-taint limitation
+tracked in `../dataflow/CLAUDE.md`; the CFG nodes are present, the element-level
+propagation is the open item.
 
 ## IR shape contract
 

package/src/llm-validator/index.js

@@ -92,10 +92,45 @@ Reply now with the JSON object on the last line of your response. Nothing else a
 `;
 
 function endpointConfig() {
+  // Explicit BYO endpoint always wins (unchanged behaviour).
   const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
-  const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY;
-  const model = process.env.AGENTIC_SECURITY_LLM_MODEL || 'unknown';
-  return endpoint ? { endpoint, apiKey, model } : null;
+  if (endpoint) {
+    return { endpoint, apiKey: process.env.AGENTIC_SECURITY_LLM_API_KEY, model: process.env.AGENTIC_SECURITY_LLM_MODEL || 'unknown', preset: null };
+  }
+  // #18 — first-class Anthropic preset. Opt-in via AGENTIC_SECURITY_LLM_PRESET=anthropic
+  // + a key (AGENTIC_SECURITY_LLM_API_KEY or ANTHROPIC_API_KEY): makes the FP-suppression
+  // validator reachable with just a key — no BYO endpoint URL or request-shape wrangling.
+  // Offline-degrading: no key → null (validator no-ops; no runtime cloud call by default).
+  if ((process.env.AGENTIC_SECURITY_LLM_PRESET || '').toLowerCase() === 'anthropic') {
+    const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY || process.env.ANTHROPIC_API_KEY;
+    if (!apiKey) return null;
+    return {
+      endpoint: 'https://api.anthropic.com/v1/messages',
+      apiKey,
+      model: process.env.AGENTIC_SECURITY_LLM_MODEL || 'claude-haiku-4-5',
+      preset: 'anthropic',
+    };
+  }
+  return null;
+}
+
+// Shape the request for the target: the Anthropic Messages API needs an
+// x-api-key header (added by the caller), an anthropic-version header, and a
+// {model, max_tokens, messages:[…]} body with the reply in content[].text. The
+// generic path posts {prompt, model} with a Bearer header. Pure — no I/O.
+function buildRequest(model, prompt, preset) {
+  if (preset === 'anthropic') {
+    return {
+      headers: { 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01' },
+      body: { model, max_tokens: 512, messages: [{ role: 'user', content: prompt }] },
+      extractText: (j) => (Array.isArray(j?.content) ? j.content.filter(b => b?.type === 'text').map(b => b.text || '').join('') : ''),
+    };
+  }
+  return {
+    headers: { 'Content-Type': 'application/json' },
+    body: { prompt, model },
+    extractText: (j) => (j && (j.response || j.text || j.content || j.output || j.choices?.[0]?.message?.content || j.message?.content)) || '',
+  };
 }
 
 function ensureCacheDir(scanRoot) {
@@ -179,17 +214,17 @@ function renderPrompt(finding, fileContents, challenge, nonce) {
     .replace('{{context}}', sterileContext || '(no surrounding code available)');
 }
 
-async function callEndpoint(endpoint, apiKey, model, prompt) {
-  const headers = { 'Content-Type': 'application/json' };
-  if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`;
-  const body = { prompt, model };
+async function callEndpoint(endpoint, apiKey, model, prompt, preset = null) {
+  const { headers, body, extractText } = buildRequest(model, prompt, preset);
+  if (apiKey) {
+    if (preset === 'anthropic') headers['x-api-key'] = apiKey;
+    else headers['Authorization'] = `Bearer ${apiKey}`;
+  }
   try {
     const r = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body) });
     if (!r.ok) return { ok: false, error: `HTTP ${r.status}` };
     const j = await r.json().catch(() => null);
-    const text = (j && (j.response || j.text || j.content || j.output ||
-      j.choices?.[0]?.message?.content || j.message?.content)) || '';
-    return { ok: true, text: String(text) };
+    return { ok: true, text: String(extractText(j) || '') };
   } catch (e) {
     return { ok: false, error: e.message };
   }
@@ -329,7 +364,7 @@ export async function validateOne(finding, fileContents, scanRoot) {
   const challenge = crypto.randomBytes(8).toString('hex');
   const nonce     = crypto.randomBytes(8).toString('hex');
   const prompt = renderPrompt(finding, fileContents, challenge, nonce);
-  const resp = await callEndpoint(cfg.endpoint, cfg.apiKey, cfg.model, prompt);
+  const resp = await callEndpoint(cfg.endpoint, cfg.apiKey, cfg.model, prompt, cfg.preset);
   if (!resp.ok) {
     finding.validator_verdict = 'unvalidated';
     finding.unvalidated = true;
@@ -436,4 +471,4 @@ export function applyValidatorVerdicts(findings) {
   return { kept, dropped };
 }
 
-export const _internal = { PROMPT_VERSION, renderPrompt, parseLastJsonObject, validateResponse, sanitizeReasoning, cacheKey };
+export const _internal = { PROMPT_VERSION, renderPrompt, parseLastJsonObject, validateResponse, sanitizeReasoning, cacheKey, endpointConfig, buildRequest };

package/src/mcp/tools.js

@@ -17,6 +17,7 @@ import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { applyFix as applyFixHistory, fixAcceptanceRate } from '../posture/fix-history.js';
+import { synthesizeDeterministicPatch } from '../posture/deterministic-fix.js';
 import { verifyLastScan } from '../posture/integrity.js';
 import { analyzeTranscript, formatCacheReport, renderCacheStatusLine } from '../posture/cache-economics.js';
 import { redactString, redactFinding } from './redact.js';
@@ -491,7 +492,7 @@ export const explain_finding = {
 // ─── apply_fix ───────────────────────────────────────────────────────────────
 export const apply_fix = {
   name: 'apply_fix',
-  description: 'Apply the stored replacement fix for a finding. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if its file path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing.',
+  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -499,10 +500,15 @@ export const apply_fix = {
       finding_id: { type: 'string', minLength: 1, maxLength: 256 },
       confirm: { type: 'boolean' },
       dry_run: { type: 'boolean' },
+      patch: {
+        type: 'object',
+        additionalProperties: { type: 'string', maxLength: 500_000 },
+        minProperties: 1, maxProperties: 8,
+      },
     },
     required: ['finding_id', 'confirm'],
   },
-  async handler({ finding_id, confirm, dry_run = false }, ctx) {
+  async handler({ finding_id, confirm, dry_run = false, patch = null }, ctx) {
     if (confirm !== true) {
       return { _meta: META, applied: false, reason: 'apply_fix requires confirm: true.' };
     }
@@ -515,6 +521,74 @@ export const apply_fix = {
     if (f._shadow === true) {
       return { _meta: META, applied: false, reason: 'shadow findings cannot be auto-applied' };
     }
+
+    // #3 — verifier-approved patch path. When the caller supplies `patch` (a
+    // files map, same shape as verify_fix), apply_fix re-runs the verifier
+    // INLINE and writes only if it passes: the original finding's stableId is
+    // gone, no new ≥medium finding was introduced, and lint is clean. This lets
+    // a deterministic OR LLM-synthesized patch be applied for the ~100% of
+    // findings that ship only a template/description (no stored fix.replacement).
+    // Security: all existing gates hold (confirm, last-scan HMAC, reserved
+    // paths, confinement, fix-history backup + attempt budget); the write is
+    // additionally gated on a FRESH verification, so a stale/forged patch can't
+    // slip through — there is no token to replay, the verify runs here and now.
+    if (patch && typeof patch === 'object' && Object.keys(patch).length) {
+      if (!f.stableId) {
+        return { _meta: META, applied: false, reason: 'finding has no stableId — cannot verify a patch against it' };
+      }
+      const confinedAbs = {};
+      for (const [rel, content] of Object.entries(patch)) {
+        let abs;
+        try { abs = _confine(ctx.sessionRoot, rel, 'patch key'); }
+        catch (e) { return { _meta: META, applied: false, reason: `path-escape refused: ${e.message}` }; }
+        if (_isReservedWritePath(ctx.sessionRoot, abs)) {
+          return { _meta: META, applied: false, reason: `reserved path refused: ${rel}` };
+        }
+        confinedAbs[rel] = { abs, content: String(content) };
+      }
+      // Inline re-verify — the load-bearing gate. Must pass to write.
+      let verdict;
+      try {
+        const verifyFixCore = await getVerifyFixCore();
+        verdict = await verifyFixCore({
+          scanRoot: ctx.sessionRoot,
+          originalFindingStableId: f.stableId,
+          files: Object.fromEntries(Object.entries(confinedAbs).map(([rel, v]) => [rel, v.content])),
+        });
+      } catch (e) {
+        return { _meta: META, applied: false, reason: `patch verification failed: ${e.message}` };
+      }
+      if (!verdict.ok) {
+        return {
+          _meta: META, applied: false,
+          reason: `patch rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
+          verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok } },
+        };
+      }
+      if (dry_run) {
+        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary };
+      }
+      const written = [];
+      try {
+        for (const [rel, v] of Object.entries(confinedAbs)) {
+          const originalContent = fs.existsSync(v.abs) ? await fsp.readFile(v.abs, 'utf8') : '';
+          const entry = await applyFixHistory({
+            scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content,
+            findingId: f.id, stableId: f.stableId, ruleId: f.rule || null, vuln: f.vuln || f.title || null,
+          });
+          written.push({ file: rel, historyId: entry.id, backupPath: entry.backupPath });
+        }
+      } catch (e) {
+        if (e && e.name === 'FixAttemptBudgetExceededError') {
+          return { _meta: META, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key };
+        }
+        throw e;
+      }
+      let acceptance = null;
+      try { acceptance = fixAcceptanceRate(ctx.sessionRoot); } catch { /* best-effort */ }
+      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance };
+    }
+
     if (typeof f.fix?.replacement !== 'string') {
       // Premortem #2: templates are patch-shaped text. Same reasoning as
       // the replacement path — do NOT pass through redactString here.
@@ -678,6 +752,20 @@ export const synthesize_fix = {
       locDelta = Math.abs(fix.replacement.split('\n').length - orig.split('\n').length);
     }
     const oversized = touchedFiles > 3 || locDelta > 100;
+    // #1 — deterministic autofix: for classes with a safe context-independent
+    // swap (weak hash, TLS verify-off), materialize a full-file patch from the
+    // live file. The agent passes `autofix.patch` straight to apply_fix, which
+    // re-verifies it (rescan-clean + no new ≥medium + lint) before writing — so
+    // even a mis-attributed swap can't land a bad edit. No stored replacement,
+    // no per-finding bloat in last-scan.json.
+    let autofix = null;
+    if (!hasReplacement) {
+      try {
+        const abs = _confine(ctx.sessionRoot, f.file, 'finding.file');
+        const det = synthesizeDeterministicPatch(f, fs.readFileSync(abs, 'utf8'));
+        if (det) autofix = { deterministic: true, ruleId: det.ruleId, patch: det.patch };
+      } catch { /* best-effort — no file / no rule → no autofix */ }
+    }
     // Premortem #2: `replacement` is a *patch* (the code we'll write to disk),
     // not a finding excerpt. Running it through redactString silently corrupts
     // valid patches whose content happens to match a secret-shape (e.g. a
@@ -694,9 +782,15 @@ export const synthesize_fix = {
       hasReplacement,
       replacement: hasReplacement ? fix.replacement : null,
       template: fix.code || null,
+      autofix,
+      // #15 — the regression test the scan annotator already generated for this
+      // finding (present when a PoC was built). Surfaced here so the fix flow
+      // writes the test alongside the patch; fix-verify-loop then runs it, so an
+      // applied fix ships with a test that fails pre-fix and passes post-fix.
+      regression_test: f.regression_test || null,
       remediation: typeof fix.description === 'string' ? fix.description : (typeof fix === 'string' ? fix : null),
       patchBounds: { touchedFiles, locDelta, oversized },
-      recommendsFixPlan: oversized && !hasReplacement,
+      recommendsFixPlan: oversized && !hasReplacement && !autofix,
     };
   },
 };

package/src/posture/CLAUDE.md

@@ -13,9 +13,11 @@ Annotators that run **after** every detector has emitted, plus state stores read
 
 **Risk amplification** — `epss.js`, `kev` (in `version.js`), `blast-radius.js`, `crown-jewels.js`, `exploitability.js`, `bounty-prediction.js`, `risk-in-dollars` (lives in `scripts/`, not here).
 
+**Secrets lifecycle** — `secret-history.js` (git-history blob sweep for committed-then-removed secrets, behind `--secret-history`), `secret-live-check.js` (opt-in, offline-degrading live/dead/unknown labeling via a read-only provider "whoami"; behind `--validate-secrets`).
+
 **Production-posture ingest** — `auth-posture-import.js`, `network-policy-import.js`, `telemetry-ingest.js`, `waf-ingest.js`, `feature-flags.js`. These read customer-side YAML and convert to mitigation flags consumed by `mitigation-composite.js`.
 
-**Fix lifecycle** — `fix-history.js` (apply + backup + recover), `fix-verify.js` (closed-loop re-scan + lint), `fix-plan.js` (oversized-patch fallback), `regression-test-gen.js`.
+**Fix lifecycle** — `fix-history.js` (apply + backup + recover), `fix-verify.js` (closed-loop re-scan + lint), `fix-plan.js` (oversized-patch fallback), `regression-test-gen.js`, `deterministic-fix.js` (safe context-independent literal-swap patch synthesis — md5/sha1→sha256, TLS verify-off→on — materialized on demand by `mcp/synthesize_fix`; every patch still passes through `apply_fix`'s inline verify before it lands).
 
 **Agentic verification** — `verifier.js`, `verifier-target.js`, `verifier-ephemeral.js`, `harness-discovery.js`, `adversary-agent.js`, `defender-agent.js`, `auditor-agent.js`, `three-agent-pipeline.js`.
 

package/src/posture/cache-economics.js

@@ -26,9 +26,11 @@ function money(n) {
 
 // Per-1M-token rates (input / output). Mirror hooks/model-cost-advisor.js MODELS.
 const MODEL_RATES = {
-  opus:   { label: 'Opus 4.8',   in: 5, out: 25 },
-  sonnet: { label: 'Sonnet 4.6', in: 3, out: 15 },
-  haiku:  { label: 'Haiku 4.5',  in: 1, out: 5 },
+  fable:   { label: 'Fable 5',    in: 10, out: 50 },
+  opus:    { label: 'Opus 4.8',   in: 5,  out: 25 },
+  sonnet5: { label: 'Sonnet 5',   in: 3,  out: 15 },
+  sonnet:  { label: 'Sonnet 4.6', in: 3,  out: 15 },
+  haiku:   { label: 'Haiku 4.5',  in: 1,  out: 5 },
 };
 const CACHE_READ_MULT = 0.1;   // cache read ≈ 0.1× input
 const CACHE_WRITE_MULT = 1.25; // 5-minute cache write ≈ 1.25× input
@@ -40,8 +42,9 @@ const TTL_MS = 5 * 60 * 1000;
 function rateFor(model) {
   if (typeof model !== 'string') return null;
   const s = model.toLowerCase();
+  if (s.includes('fable') || s.includes('mythos')) return MODEL_RATES.fable;
   if (s.includes('haiku')) return MODEL_RATES.haiku;
-  if (s.includes('sonnet')) return MODEL_RATES.sonnet;
+  if (s.includes('sonnet')) return (s.includes('sonnet-5') || s.includes('sonnet 5')) ? MODEL_RATES.sonnet5 : MODEL_RATES.sonnet;
   if (s.includes('opus')) return MODEL_RATES.opus;
   return null;
 }

package/src/posture/deterministic-fix.js

@@ -0,0 +1,65 @@
+// Deterministic fix synthesis (#1) — for the narrow set of vulnerability classes
+// where a context-INDEPENDENT literal swap is a safe, correct fix, produce a
+// full-file replacement from the current file content. No LLM, no guessing, no
+// per-finding bloat in last-scan.json (the patch is materialized on demand by
+// synthesize_fix from the live file, not stored on every finding).
+//
+// Safety: every patch this produces is still gated by verify_fix before apply_fix
+// writes it (original finding gone + no new ≥medium + lint clean). So a swap that
+// a rule mis-attributed simply fails verification instead of landing a bad edit —
+// this module widens the deterministic-fix surface without weakening the gate.
+//
+// Returns { patch: { [relFile]: newContent }, ruleId } or null when no
+// deterministic fix applies to the finding.
+
+const JS_EXT = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const PY_EXT = /\.py$/i;
+
+// Each rule gates on the finding's cwe/family, then rewrites the whole-file
+// content. transform() returns the new content, or null when nothing changed
+// (e.g. the vulnerable token isn't literally present — then we don't claim a fix).
+const RULES = [
+  {
+    id: 'weak-hash-sha256',
+    // md5 / sha1 → sha256. Every occurrence in the file is a weak hash, so
+    // swapping them all is safe; the verifier confirms the weak-hash finding is
+    // gone and nothing worse appeared.
+    applies: (f) => /CWE-(?:327|328|916)/.test(f.cwe || '') || /weak.?hash/i.test(f.family || ''),
+    transform: (content, file) => {
+      let out = content;
+      if (JS_EXT.test(file)) {
+        out = out.replace(/(\bcreateHash\s*\(\s*['"`])(?:md5|sha1)(['"`])/gi, '$1sha256$2');
+      } else if (PY_EXT.test(file)) {
+        out = out.replace(/\bhashlib\.(?:md5|sha1)\s*\(/g, 'hashlib.sha256(');
+      }
+      return out !== content ? out : null;
+    },
+  },
+  {
+    id: 'tls-verify-on',
+    // Disabled TLS verification → enabled. rejectUnauthorized:false → true (JS),
+    // verify=False → verify=True (Python requests).
+    applies: (f) => /CWE-295/.test(f.cwe || '') || /tls.?no.?verify|cert.?(?:none|verify)/i.test(f.family || ''),
+    transform: (content, file) => {
+      let out = content;
+      if (JS_EXT.test(file)) {
+        out = out.replace(/(\brejectUnauthorized\s*:\s*)false\b/g, '$1true');
+      } else if (PY_EXT.test(file)) {
+        out = out.replace(/(\bverify\s*=\s*)False\b/g, '$1True');
+      }
+      return out !== content ? out : null;
+    },
+  },
+];
+
+export function synthesizeDeterministicPatch(finding, fileContent) {
+  if (!finding || typeof fileContent !== 'string' || !finding.file) return null;
+  for (const rule of RULES) {
+    try {
+      if (!rule.applies(finding)) continue;
+      const next = rule.transform(fileContent, finding.file);
+      if (next && next !== fileContent) return { patch: { [finding.file]: next }, ruleId: rule.id };
+    } catch { /* a single rule failing must never break synthesis */ }
+  }
+  return null;
+}

package/src/posture/flow-narration.js

@@ -15,9 +15,9 @@
 
 const TEMPLATES = {
   'sql-injection': (f) =>
-    `An unauthenticated attacker sends a crafted request to ${_routeOf(f)} containing UNION-style SQL syntax in the ${f.source?.variable || 'tainted'} field. The server's database driver executes the injected query verbatim, returning rows from any table the connection has read access to. Typical impact: full table dump of users (emails, password hashes), bypass of authentication via boolean-blind exfiltration. If the DB role has write privileges, the attacker can also INSERT/UPDATE arbitrary rows. Recovery cost: incident response, customer notification, password reset, regulatory reporting if PII leaked.`,
+    `An unauthenticated attacker sends a crafted request containing UNION-style SQL syntax in the ${f.source?.variable || 'tainted'} field. The server's database driver executes the injected query verbatim, returning rows from any table the connection has read access to. Typical impact: full table dump of users (emails, password hashes), bypass of authentication via boolean-blind exfiltration. If the DB role has write privileges, the attacker can also INSERT/UPDATE arbitrary rows. Recovery cost: incident response, customer notification, password reset, regulatory reporting if PII leaked.`,
   'command-injection': (f) =>
-    `The handler at ${f.file}:${f.line} passes user-controlled input to a shell-spawning function. An attacker can append shell metacharacters (";", "$(...)", backticks) to execute arbitrary commands as the application's UID. Typical impact: read of /etc/passwd, /proc/self/environ (env vars including secrets), outbound connections to attacker-controlled hosts (data exfil). On unprivileged containers the blast radius is limited to that container; on privileged or root-owned processes, the attacker can pivot to the host.`,
+    `The handler passes user-controlled input to a shell-spawning function. An attacker can append shell metacharacters (";", "$(...)", backticks) to execute arbitrary commands as the application's UID. Typical impact: read of /etc/passwd, /proc/self/environ (env vars including secrets), outbound connections to attacker-controlled hosts (data exfil). On unprivileged containers the blast radius is limited to that container; on privileged or root-owned processes, the attacker can pivot to the host.`,
   'xss': (f) =>
     `An attacker injects HTML/JS markup into user-controllable input. The server reflects (or stores) it without encoding, so when a victim browser renders the page, the attacker's script executes in the victim's session origin. Typical impact: session cookie theft, CSRF-bypass on internal endpoints, account takeover via API calls executed under the victim's auth. Cost: incident response, customer notification, potential data egress depending on what the victim's session can access.`,
   'ssrf': (f) =>
@@ -27,18 +27,23 @@ const TEMPLATES = {
   'code-injection': (f) =>
     `User input is fed into a code-evaluation function (eval, new Function, exec). An attacker supplies arbitrary code that executes in the application's runtime context, with full access to the application's data, env, and outbound network. Typical impact: equivalent to remote code execution; same recovery cost as command-injection.`,
   'csrf': (f) =>
-    `The state-changing endpoint at ${f.file}:${f.line} doesn't validate that the request originated from your own application. An attacker hosts a page that issues a same-shape request from a logged-in victim's browser. Typical impact: state changes performed under the victim's identity — password change, money movement, role escalation. Cost: depends on what state can change; for billing endpoints, this is fraud-level.`,
+    `The state-changing endpoint doesn't validate that the request originated from your own application. An attacker hosts a page that issues a same-shape request from a logged-in victim's browser. Typical impact: state changes performed under the victim's identity — password change, money movement, role escalation. Cost: depends on what state can change; for billing endpoints, this is fraud-level.`,
   'open-redirect': (f) =>
     `The endpoint redirects to a URL the attacker controls. Used as part of phishing chains: victim clicks a legitimate-looking link to your domain, gets redirected to attacker.example, enters credentials thinking they're still on your site. Typical impact: phishing-amplified credential theft; reputational damage if your domain ends up on a phish-tracking list.`,
   'insecure-deserialization': (f) =>
     `The handler deserializes attacker-controlled bytes via pickle/yaml-load/Marshal. The deserialization callback invokes arbitrary code from class constructors / __reduce__ / __wakeup__. Typical impact: equivalent to remote code execution. Cost: full incident response, including investigating whether the attacker established persistence.`,
   'xxe': (f) =>
-    `The XML parser at ${f.file}:${f.line} resolves external entities. An attacker submits XML referencing file:///etc/passwd or http://internal/. Typical impact: file disclosure, SSRF, blind out-of-band exfiltration of secrets. Cost: similar to SSRF + path-traversal combined.`,
+    `The XML parser resolves external entities. An attacker submits XML referencing file:///etc/passwd or http://internal/. Typical impact: file disclosure, SSRF, blind out-of-band exfiltration of secrets. Cost: similar to SSRF + path-traversal combined.`,
 };
 
 function _routeOf(f) {
-  if (!f) return '<endpoint>';
-  return `${f.file || '?'}:${f.line || '?'}`;
+  if (!f) return 'this endpoint';
+  // Narration may run before the line is finalised; fall back to the file alone
+  // (or a generic phrase) rather than emitting "file:undefined" / "file:?".
+  const line = Number(f.line) || Number(f.source?.line) || 0;
+  if (f.file && line) return `${f.file}:${line}`;
+  if (f.file) return f.file;
+  return 'this endpoint';
 }
 
 function _templateFor(f) {
@@ -65,7 +70,7 @@ async function _renderLlm(f) {
 Vuln: ${f.vuln}
 CWE: ${f.cwe}
 Severity: ${f.severity}
-Location: ${f.file}:${f.line}
+Location: ${_routeOf(f)}
 Snippet: ${(f.snippet || '').slice(0, 200)}
 
 Write ONE paragraph (5-7 sentences) covering: (1) how an attacker reaches this code, (2) what they get if exploited, (3) typical recovery cost. Plain English, no marketing language, no emoji.`;

package/src/posture/mttr.js

@@ -63,6 +63,31 @@ export function findingsExceedingSLA(findings, slaDays = null) {
   });
 }
 
+// Median age (days) of the currently-open findings — a single-scan proxy for
+// "how long has this debt been sitting". True MTTR (computeMTTR) needs the set
+// of findings that were FIXED; this reports the open backlog's median age so a
+// scan can show whether debt is getting older. Returns null on empty input.
+// Local — surfaced only through renderSlaSummary (its sole consumer).
+function medianOpenAgeDays(findings) {
+  const ages = (findings || []).map(f => f.ageDays || 0).sort((a, b) => a - b);
+  if (!ages.length) return null;
+  return ages[Math.floor(ages.length / 2)];
+}
+
+// One-line SLA-breach summary for surfacing after a scan (#10). Returns null
+// when nothing is past its per-severity SLA. Pairs with medianOpenAgeDays for a
+// "is my security debt aging" readout that the vibecoder can act on.
+export function renderSlaSummary(findings, slaDays = null) {
+  const breached = findingsExceedingSLA(findings || [], slaDays);
+  if (!breached.length) return null;
+  const bySev = {};
+  for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
+  const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
+  const median = medianOpenAgeDays(findings);
+  const ageNote = median != null ? ` (median open age ${median}d)` : '';
+  return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
+}
+
 // Compute MTTR statistics from a series of saved scans (each with firstSeen/lastSeen).
 // Useful for trend reporting.
 export function computeMTTR(removedFindings) {