@clear-capabilities/agentic-security-scanner 0.124.1 → 0.127.0

package/CHANGELOG.md

@@ -1,5 +1,151 @@
 # Changelog
 
+## 0.127.0 — cost advisor: an actual choice, not just a tip
+
+The model-cost advisor (`hooks/model-cost-advisor.js`) has always been advisory
+only — a `systemMessage` tip you read and act on yourself, by design, because a
+`UserPromptSubmit` hook cannot pause for interactive input or change the model/
+effort (verified against the current Claude Code hooks reference before writing
+any of this, not assumed from the hook's own pre-existing comments). This
+release adds a real choice on top of that hard limit, without giving up the
+zero-token guarantee for anyone who doesn't opt in.
+
+- **New opt-in `"interactive": true`** (`.agentic-security/model-optimizer.json`,
+  default `false`). On a qualifying prompt, the hook now additionally emits
+  `hookSpecificOutput.additionalContext` — billed as input tokens, unlike the
+  free `systemMessage` — directing Claude to call `AskUserQuestion` with three
+  options: keep current defaults; get the exact `/model`/`/effort` command to
+  run yourself (Claude cannot switch its own running model — no exception
+  exists); or apply the cheaper model/effort to Claude's own delegated
+  Task/Agent-tool sub-agent dispatches for the rest of the session — the one
+  axis Claude can genuinely act on directly. Every other install keeps today's
+  zero-token behavior unchanged; only projects that explicitly opt in pay for
+  the interactive path, and only on prompts that already qualify for a tip.
+- The chosen sub-agent override is **sticky for the session** — persisted to
+  `.agentic-security/model-optimizer-state.json` (extending the existing state
+  file rather than adding a new one) and cleared at the next `SessionStart`,
+  which already does a bare overwrite of that file. A cooldown
+  (`interactiveCooldownTurns`, default 3) stops the directive from re-firing
+  its token cost if Claude doesn't act on it (e.g. a non-interactive/scripted
+  invocation).
+- Fixed a real bug the new shape would otherwise have hit: `dispatch-user-
+  prompt.js`'s `mergeOutputs` previously let the legacy-alias-redirect's
+  `additionalContext` and the advisor's new `additionalContext` clobber each
+  other if both fired on the same prompt (independent triggers, so this can
+  genuinely co-occur) — now joined instead of last-write-wins.
+- `commands/setup.md`'s `--model-optimizer` gained a matching `--interactive`
+  flag; `CLAUDE.md` documents the durable instruction for applying a saved
+  sub-agent override on future dispatches, respecting existing static
+  `model:` frontmatter pins (`security-triager.md`, `sca-triager.md`) and the
+  "task needs more capability" carve-out.
+
+Also added `SECURITY.md` (vulnerability disclosure policy).
+
+## 0.126.0 — closing the find→fix loop: verified auto-fix, CWE-434/306, Fable 5 pricing
+
+The largest remediation-side release to date. Prior to this, findings could be
+*found* at scale but not *fixed* at scale — of the 677 findings on this repo's own
+scan, zero could be mechanically applied. This release closes that loop end to end
+while adding the detection classes and workflow polish the closed loop needed.
+Full detail and rationale: `docs/FIND_AND_FIX_LOOP_PRD.md` (implemented; the file
+itself is removed post-implementation per its own instructions).
+
+**Remediation — a verified patch path for every finding, not just the ones with a
+stored replacement.**
+- `apply_fix` (MCP) now accepts a caller-supplied `patch` (a files map) and
+  **re-verifies it inline** — rescan-clean, no new ≥medium finding, lint-clean —
+  before writing. Previously `apply_fix` refused any finding without a stored
+  `fix.replacement`; now a template-only or description-only finding (the vast
+  majority) can be fixed, because the bytes are proven safe at write time instead
+  of trusted at synthesis time.
+- **Deterministic zero-LLM patch synthesis** (`posture/deterministic-fix.js`) for
+  safe, context-independent classes — weak hash (md5/sha1→sha256), TLS
+  verify-off→on — materialized on demand by `synthesize_fix` and still gated by
+  the same inline verifier before `apply_fix` writes it.
+- Regression tests are wired into the fix loop: `synthesize_fix` surfaces the
+  scan's existing PoC-derived `regression_test` so a fix ships with a test that
+  fails pre-fix and passes post-fix.
+- `/fix --all` and `/find-and-fix-everything` now run independent findings in
+  **parallel** (serializing only same-file findings), never halt on the first
+  test failure, and publish the running **auto-fix acceptance rate**.
+- `/fix --sca` surfaces its **upgrade break-rate** (build/test-verified upgrades
+  are the default; the break-rate is how often an "available" upgrade actually
+  wasn't safe to take).
+- MTTR / SLA tracking is now live: every scan stamps `firstSeenAt`/`ageDays` and
+  surfaces an SLA-breach summary (`critical` 7d / `high` 30d / …).
+- The Layer-3 LLM validator gained a first-class Anthropic preset
+  (`AGENTIC_SECURITY_LLM_PRESET=anthropic`) — previously BYO-endpoint only, so the
+  FP-suppression layer was reachable with just a key instead of a hand-built
+  endpoint.
+
+**Detection.**
+- New **CWE-434 unrestricted file-upload detector** (JS/Python) — a whole CWE
+  class that had zero coverage: unguarded Multer configs and writes that use the
+  client-supplied filename as the destination.
+- New **CWE-306 missing-authentication** rule: an unauthenticated destructive
+  route (DELETE, or id-taking PUT/PATCH) fires only when the app authenticates
+  elsewhere in the codebase — so auth-detection is proven to work before the rule
+  trusts a "no auth found" signal, keeping it high-precision even on all-public
+  files.
+- Corrected stale documentation in `scanner/src/ir/CLAUDE.md`: the Python CST
+  parser's `match`-case bodies, walrus bindings, destructuring, and comprehension
+  filters were already fully lowered and taint-propagating — verified end-to-end
+  with new flow tests, not just parser-shape tests.
+- The independent-eval gate (`bench/independent-eval/`) is now **active**
+  (`aggregateF1`/`perFamilyRecall` floors instead of `null`) — proven to fail on a
+  deliberate regression and pass at the current corpus result.
+
+**Hooks & cost.**
+- Pricing tables across all five rate-table copies now include **Fable 5
+  ($10/$50 per MTok)** and Sonnet 5 — previously a Fable 5 session wasn't even
+  priced by the cache-economics reporter, and the cost advisor couldn't reason
+  about the flagship model at all.
+- Two mechanical subagents (`security-triager`, `sca-triager`) pinned to Haiku.
+- The two `UserPromptSubmit` hooks and three `PreToolUse` (Edit) hooks were each
+  consolidated into a single dispatcher process — halving/thirding the per-turn
+  node spawns. The security-critical bodyguard block is proven to survive
+  consolidation (a dedicated regression test asserts the exit-2 deny still
+  fires first and short-circuits the advisory hooks).
+- The post-edit hook now offers a one-tap auto-fix inline when a fresh finding is
+  mechanically fixable, instead of only pointing at `/fix-all`.
+- The model-cost optimizer now ships **on by default** (`mode: "advise"`) with a
+  predicted-vs-realized savings ledger.
+
+**Workflow.**
+- `scan --watch` wires the existing (previously unwired) watch-mode daemon:
+  continuous incremental re-scan on file change with a risk-delta status line.
+- Opt-in, offline-degrading **live-secret validation**
+  (`--validate-secrets`) — labels a detected secret `live`/`dead`/`unknown` via a
+  read-only provider "whoami" check (GitHub, Stripe, OpenAI, SendGrid), so "this
+  key is LIVE" is distinguished from "you have a high-entropy string."
+  `--secret-history` (git-history sweep) was already wired; this release adds
+  the liveness half.
+- Diff-scoped scans (`--pr` / `--changed-since`) now default `--incremental` on,
+  since a changed-file set is exactly the incremental cache's designed case.
+
+## 0.125.0 — multi-provider LLM cost + prompt-cache linter (Cache Economics v2, phase 1)
+
+First slice of the Cache Economics v2 PRD (`docs/CACHE_ECONOMICS_V2_PRD.md`) — the
+foundation (P1 provider detection, P2 provider catalog) + the flagship analyzer (F1
+cache-hygiene + P3 per-provider model/depth recommendation). The optimizer now reaches
+beyond this Claude Code session into the user's **own AI-app code**, across providers.
+
+- **Provider catalog** (`scanner/src/posture/provider-catalog.js`): a dated, no-network
+  snapshot of Anthropic / OpenAI / Google Gemini / xAI — model ladder ($/1M rates), the
+  "depth" knob (effort / reasoning_effort / thinkingBudget), and the cache model
+  (explicit vs automatic vs implicit). Prices are sourced, not hardcoded-in-logic, with a
+  `SOURCED_AT` staleness date.
+- **LLM cost/cache detector** (`scanner/src/sast/llm-cost-advisor.js`, `scanLlmCost`):
+  provider-aware, gated on detecting an LLM SDK (low FP), emits **advisory** findings —
+  (1) *prompt-cache killer*: a timestamp/UUID/random value baked into a prompt prefix
+  that defeats caching; (2) *over-provisioned*: a flagship model at high depth, with the
+  catalog's cheaper model + lower depth **in that provider's framework** as the fix
+  (e.g. an OpenAI app → "gpt-5.4 at reasoning_effort=low"). Severity `low`/`info` so it
+  never inflates security counts.
+
+Remaining PRD phases (F2 measured cost, F3 TTL, F4 compaction, F5 pre-warm, F6 cross-
+session warmth, F7 self-tuning; full P4 per-provider economics) ship next.
+
 ## 0.124.1 — fix: narration no longer prints a broken location
 
 Now that v0.124.0 surfaces `narration` prominently inline, a pre-existing template

package/bin/agentic-security.js

@@ -113,6 +113,7 @@ Options:
   --since-baseline             Only show findings NOT in the saved baseline
   --hide-proven-safe           Drop findings discharged by a flow proof (provably safe)
   --secret-history             Also sweep recent git history for committed secrets
+  --validate-secrets           Label each detected secret live/dead/unknown (opt-in, network, offline-degrading)
                                (removed from HEAD but recoverable from .git)
   --history-depth <n>          Commits to sweep with --secret-history (default 50)
   --no-epss                    Skip EPSS exploit-prediction enrichment (default: enabled)
@@ -331,8 +332,40 @@ async function cmdScan(args) {
     }
   }
 
+  // #21 — --watch : continuous incremental re-scan on file change. Each change
+  // re-scans (incrementally) and writes a risk-delta to
+  // .agentic-security/watch-status.md that a statusline / /posture poll surfaces
+  // inline — so "did my edit add risk?" is answered without a manual re-scan.
+  // Blocks until Ctrl-C, like `jest --watch`. Opt-in, so it never affects a
+  // normal one-shot scan.
+  if (args.flags['watch']) {
+    process.env.AGENTIC_SECURITY_INCREMENTAL = '1';
+    const { watchProject, computeDelta, persistStatus, renderStatusLine } = await import('../src/posture/watch-mode.js');
+    process.stderr.write(`[watch] scanning ${targetAbs} on change — Ctrl-C to stop. Status → .agentic-security/watch-status.md\n`);
+    const seed = await runScan(targetAbs, {});
+    let prevFindings = seed.scan.findings || [];
+    await watchProject(targetAbs, async () => {
+      try {
+        const { scan } = await runScan(targetAbs, {});
+        const curr = scan.findings || [];
+        const delta = computeDelta(prevFindings, curr);
+        persistStatus(targetAbs, delta);
+        process.stderr.write('[watch] ' + renderStatusLine(delta) + '\n');
+        prevFindings = curr;
+      } catch (e) {
+        process.stderr.write(`[watch] rescan failed: ${e.message}\n`);
+      }
+    });
+    return 0; // watchProject blocks until aborted
+  }
+
   // --incremental : reuse taint summaries from prior scans for faster deep mode.
-  if (args.flags['incremental'] || process.env.AGENTIC_SECURITY_INCREMENTAL === '1') {
+  // #23 — default incremental ON for diff-scoped scans (--pr / --changed-since):
+  // that's the cache's designed use (small changed set → its callers), so the
+  // PR-native path is fast by default. A full-tree scan stays non-incremental
+  // unless explicitly requested (blanket-default flip needs broader validation).
+  const _diffScoped = !!(args.flags['pr'] || args.flags['changed-since']);
+  if (args.flags['incremental'] || process.env.AGENTIC_SECURITY_INCREMENTAL === '1' || _diffScoped) {
     process.env.AGENTIC_SECURITY_INCREMENTAL = '1';
   }
 
@@ -566,6 +599,46 @@ async function cmdScan(args) {
   if (_isSafeStateDir(stateDir)) {
     await fsp.mkdir(stateDir, { recursive: true });
     const persistedScan = toJSON(scan, meta);
+    // #10 — MTTR: stamp firstSeenAt/lastSeenAt/ageDays from the PREVIOUS scan so
+    // every finding carries an age, SLA breaches can be surfaced, and the fix
+    // loop can report time-to-clean. Best-effort; skipped under --deterministic
+    // so deterministic state stays byte-identical run-to-run.
+    if (!args.flags.deterministic) {
+      try {
+        const { stampFindingTimestamps, buildBaselineMap, renderSlaSummary } = await import('../src/posture/mttr.js');
+        let baselineMap = new Map();
+        try {
+          const prev = JSON.parse(await fsp.readFile(path.join(stateDir, 'last-scan.json'), 'utf8'));
+          baselineMap = buildBaselineMap(prev);
+        } catch { /* first run — empty baseline, everything is firstSeen now */ }
+        const now = Date.now();
+        stampFindingTimestamps(persistedScan.findings || [], baselineMap, now);
+        stampFindingTimestamps(persistedScan.secrets || [], baselineMap, now);
+        stampFindingTimestamps((persistedScan.supplyChain || []).filter(s => s.type === 'vulnerable_dep'), baselineMap, now);
+        // Surface the SLA-breach line on human-readable formats (not JSON/CI pipes).
+        const isJson = format === 'json' || format === 'sarif' || format === 'cyclonedx' || format === 'sbom' || format === 'spdx' || format === 'vex' || format === 'openvex' || format === 'pbom' || format === 'aibom';
+        if (!isJson) {
+          const sla = renderSlaSummary(persistedScan.findings || []);
+          if (sla) process.stderr.write(`⏰ agentic-security: ${sla}\n`);
+        }
+      } catch { /* MTTR is best-effort — never block a scan write */ }
+    }
+    // #22 — live-secret validation (opt-in, offline-degrading). Label each
+    // detected secret live | dead | unknown via a read-only provider "whoami".
+    // "This key is LIVE and was committed N commits ago" is the P0 that matters.
+    if (args.flags['validate-secrets'] || process.env.AGENTIC_SECURITY_VALIDATE_SECRETS === '1') {
+      try {
+        const { checkSecretLive } = await import('../src/posture/secret-live-check.js');
+        let live = 0;
+        for (const s of (persistedScan.secrets || [])) {
+          const { verdict, provider } = await checkSecretLive(s);
+          s.liveVerdict = verdict;
+          if (provider) s.liveProvider = provider;
+          if (verdict === 'live') live++;
+        }
+        if (live > 0) process.stderr.write(`🔴 agentic-security: ${live} LIVE secret(s) validated — rotate immediately (even if already removed from HEAD).\n`);
+      } catch { /* best-effort, offline-degrading — never block a scan */ }
+    }
     const lastScanBody = JSON.stringify(persistedScan, null, 2);
     await fsp.writeFile(path.join(stateDir, 'last-scan.json'), lastScanBody);
     try {
@@ -1535,7 +1608,7 @@ description: Remediate every finding at or above a severity threshold (default:
 argument-hint: "[--severity critical|high|medium]"
 ---
 
-Read \`.agentic-security/last-scan.json\`. For every finding at or above \`\${1:-critical}\` severity, dispatch the security-fixer subagent in sequence — not in parallel, as each fix may change subsequent findings. After each batch, re-run \`/security-scan-all\` to confirm. Stop and report if any test fails.
+Read \`.agentic-security/last-scan.json\`. For every finding at or above \`\${1:-critical}\` severity, dispatch the security-fixer subagent — independent findings in parallel, serializing only findings that share a file. Each fix is inline-verified by apply_fix before it lands (finding gone + no new ≥medium + lint). Do NOT halt on the first failure: record each finding's outcome and continue, then report the full list and the auto-fix acceptance rate. Re-run \`/security-scan-all\` to confirm.
 `,
     'security-report.md': `---
 description: Generate an HTML security report (or JSON / Markdown / SARIF).

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5099);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3793);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/220.index.js

@@ -0,0 +1,193 @@
+export const id = 220;
+export const ids = [220];
+export const modules = {
+
+/***/ 9220:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   computeDelta: () => (/* binding */ computeDelta),
+/* harmony export */   persistStatus: () => (/* binding */ persistStatus),
+/* harmony export */   renderStatusLine: () => (/* binding */ renderStatusLine),
+/* harmony export */   watchProject: () => (/* binding */ watchProject)
+/* harmony export */ });
+/* unused harmony exports readStatus, _internals */
+/* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1455);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
+// Watch mode — continuous incremental scan as the developer edits.
+//
+// Spawns a long-running scan watcher that:
+//   1. Subscribes to file-system events under the project root
+//   2. When a file matching the scan glob changes, re-scans incrementally
+//      using dataflow/incremental-cache.js (per-file cache hits avoid the
+//      full IR build)
+//   3. Diffs against the prior scan to compute a "risk delta" string
+//      (added/removed/changed criticals + highs)
+//   4. Writes the delta to .agentic-security/watch-status.{md,json}
+//
+// The Claude Code statusline / a chat command can poll watch-status.md
+// (cheap file read) to surface the delta inline without re-running anything.
+//
+// Implementation is deliberately node-only — no chokidar dep, uses
+// fs.promises.watch (Node ≥ 20). Debounces to 350ms.
+//
+// Lifecycle: start() returns an AbortController-like handle. The caller
+// (a /watch slash command or a long-running daemon spawn) is responsible
+// for keeping the process alive; this module is the pure logic.
+
+
+
+
+
+const STATE = '.agentic-security';
+const STATUS_MD   = 'watch-status.md';
+const STATUS_JSON = 'watch-status.json';
+const DEBOUNCE_MS = 350;
+const MAX_BURST   = 50; // ignore beyond this # of rapid events
+
+const SCAN_EXT_RE = /\.(?:[jt]sx?|mjs|cjs|py|java|kt|go|rb|php|cs|c|cc|cpp|h|hpp|rs|sol|vy|swift|dart|toml|yml|yaml|json|tf|tfvars|bicep)$/i;
+const IGNORE_DIR_RE = /(?:^|\/)(?:\.git|node_modules|\.bench-cache|dist|build|\.next|coverage|\.agentic-security)(?:$|\/)/;
+
+function _isScanable(rel) {
+  if (!rel || IGNORE_DIR_RE.test(rel)) return false;
+  return SCAN_EXT_RE.test(rel);
+}
+
+function _readJsonSafe(fp) {
+  try { return JSON.parse(fsSync.readFileSync(fp, 'utf8')); } catch { return null; }
+}
+
+function _sevRank(s) { return ['info', 'low', 'medium', 'high', 'critical'].indexOf(s) + 1; }
+
+/**
+ * Pure delta computation between two finding arrays. Same logic
+ * baseline-compare uses, surfaced as a single ASCII status line.
+ */
+function computeDelta(prevFindings, currFindings) {
+  const key = (f) => `${f.file || ''}::${f.line || 0}::${f.family || f.parser || ''}`;
+  const prev = new Map();
+  for (const f of prevFindings || []) prev.set(key(f), f);
+  const cur  = new Map();
+  for (const f of currFindings || []) cur.set(key(f), f);
+  const added = [], removed = [];
+  for (const [k, f] of cur) if (!prev.has(k)) added.push(f);
+  for (const [k, f] of prev) if (!cur.has(k)) removed.push(f);
+  const newCrit = added.filter(f => f.severity === 'critical').length;
+  const newHigh = added.filter(f => f.severity === 'high').length;
+  const fixedCrit = removed.filter(f => f.severity === 'critical').length;
+  const fixedHigh = removed.filter(f => f.severity === 'high').length;
+  return {
+    addedCount: added.length, removedCount: removed.length,
+    newCritical: newCrit, newHigh, fixedCritical: fixedCrit, fixedHigh,
+    added, removed,
+  };
+}
+
+/**
+ * Render a one-line status string for the Claude Code statusline.
+ */
+function renderStatusLine(delta) {
+  const parts = [];
+  if (delta.newCritical) parts.push(`🛑 +${delta.newCritical} crit`);
+  if (delta.newHigh)     parts.push(`⚠️  +${delta.newHigh} high`);
+  if (delta.fixedCritical) parts.push(`✅ -${delta.fixedCritical} crit`);
+  if (delta.fixedHigh)     parts.push(`✅ -${delta.fixedHigh} high`);
+  if (!parts.length && (delta.addedCount + delta.removedCount) === 0) return 'agentic-security: clean';
+  if (!parts.length) return `agentic-security: +${delta.addedCount} / -${delta.removedCount}`;
+  return 'agentic-security: ' + parts.join(' · ');
+}
+
+/**
+ * Persist watch-status.{md,json}. Cheap atomic write (write tmp, rename).
+ */
+function persistStatus(scanRoot, delta) {
+  const dir = node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, STATE);
+  try { node_fs__WEBPACK_IMPORTED_MODULE_1__.mkdirSync(dir, { recursive: true }); } catch {}
+  const status = {
+    ts: new Date().toISOString(),
+    line: renderStatusLine(delta),
+    delta: {
+      addedCount: delta.addedCount, removedCount: delta.removedCount,
+      newCritical: delta.newCritical, newHigh: delta.newHigh,
+      fixedCritical: delta.fixedCritical, fixedHigh: delta.fixedHigh,
+    },
+    addedTop5: (delta.added || []).slice(0, 5).map(f => ({
+      file: f.file, line: f.line, family: f.family, severity: f.severity, vuln: f.vuln,
+    })),
+  };
+  const jsonPath = node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, STATUS_JSON);
+  const mdPath   = node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, STATUS_MD);
+  try { node_fs__WEBPACK_IMPORTED_MODULE_1__.writeFileSync(jsonPath, JSON.stringify(status, null, 2)); } catch {}
+  const md = [
+    `# Watch status — ${status.ts.slice(11, 19)} UTC`,
+    '',
+    status.line,
+    '',
+  ];
+  if (status.addedTop5.length) {
+    md.push('## New findings');
+    for (const f of status.addedTop5) {
+      md.push(`- **[${(f.severity || '?').toUpperCase()}]** ${f.vuln || f.family || 'finding'} — \`${f.file}:${f.line}\``);
+    }
+  }
+  try { node_fs__WEBPACK_IMPORTED_MODULE_1__.writeFileSync(mdPath, md.join('\n')); } catch {}
+  return status;
+}
+
+/**
+ * Read the latest watch-status (returns null if none).
+ */
+function readStatus(scanRoot) {
+  return _readJsonSafe(path.join(scanRoot, STATE, STATUS_JSON));
+}
+
+/**
+ * Subscribe to FS events and call onChange(absPath, eventType) for each
+ * matching event. Debounces bursts. Returns a controller with stop().
+ *
+ * The actual incremental scan call lives in the caller — this module
+ * stays pure for testability.
+ */
+async function watchProject(scanRoot, onChange, opts = {}) {
+  if (process.env.AGENTIC_SECURITY_NO_WATCH === '1') return { stop: async () => {}, _disabled: true };
+  const recursive = opts.recursive !== false;
+  const ac = new AbortController();
+  let timer = null;
+  const pending = new Set();
+  const flush = () => {
+    timer = null;
+    if (pending.size > MAX_BURST) { pending.clear(); return; }
+    const batch = Array.from(pending);
+    pending.clear();
+    try { onChange(batch); } catch {}
+  };
+  let stopped = false;
+  (async () => {
+    try {
+      for await (const evt of node_fs_promises__WEBPACK_IMPORTED_MODULE_0__.watch(scanRoot, { recursive, signal: ac.signal })) {
+        if (stopped) break;
+        const rel = String(evt.filename || '').replace(/\\/g, '/');
+        if (!_isScanable(rel)) continue;
+        pending.add(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, rel));
+        if (timer) clearTimeout(timer);
+        timer = setTimeout(flush, DEBOUNCE_MS);
+      }
+    } catch (e) {
+      if (e && e.name !== 'AbortError') {
+        // Surface but don't crash — caller decides how to handle.
+        try { onChange([], e); } catch {}
+      }
+    }
+  })();
+  return {
+    stop: async () => { stopped = true; ac.abort(); if (timer) clearTimeout(timer); },
+  };
+}
+
+const _internals = { _isScanable, SCAN_EXT_RE, IGNORE_DIR_RE };
+
+
+/***/ })
+
+};

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5099);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3793);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.