@clear-capabilities/agentic-security-scanner 0.124.1 → 0.127.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-c162f0538727ff2cce518e33cd577b95521e9a1926abe63d7ed89afc3d21c21c  agentic-security.mjs
+424585bd11f792465c48ad4fcf7bcb61be3b3351b80f3fdb500eb7f89cb6755c  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.124.1",
+  "version": "0.127.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -60,13 +60,13 @@
     "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs",
     "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
     "test:smoke": "node --test test/smoke.test.js",
-    "test:sast": "node --test test/llm.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
-    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js",
-    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js",
+    "test:sast": "node --test test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
+    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js",
+    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js",
     "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js",
-    "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js && node ../scripts/lint-command-descriptions.mjs",
+    "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js && node ../scripts/lint-command-descriptions.mjs",
     "test:eval": "node --test test/independent-eval.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
     "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",

package/src/engine.js

@@ -11,6 +11,7 @@ import { createRequire } from 'node:module';
 const _require = createRequire(import.meta.url);
 import { scanLLM } from './sast/llm.js';
 import { scanLLMOwasp } from './sast/llm-owasp.js';
+import { scanLlmCost } from './sast/llm-cost-advisor.js';
 import { scanBusinessLogic } from './sast/logic.js';
 import { scanPipeline } from './sast/pipeline.js';
 import { scanMCP } from './sast/mcp-audit.js';
@@ -52,6 +53,7 @@ import { deadBranchRanges as _deadBranchRanges, isLineInDeadRange as _isLineInDe
 import { scanJavaDeserialization } from './sast/java-deserialization.js';
 import { scanJwtExp } from './sast/jwt-exp.js';
 import { scanZipSlip } from './sast/zip-slip.js';
+import { scanFileUpload } from './sast/file-upload.js';
 import { scanHostHeader } from './sast/host-header.js';
 import { scanPythonSinks } from './sast/python-sinks.js';
 import { scanCSharp } from './sast/csharp.js';
@@ -7396,6 +7398,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));aF.push(...scanTerraform(p,c));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
+      aF.push(...scanLlmCost(p,c));
       aLogic.push(...scanBusinessLogic(p,c));
       aF.push(...scanPipeline(p,c));
       aF.push(...scanContainer(p,c));
@@ -7429,6 +7432,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
       aF.push(...scanJavaDeserialization(p,c));
       aF.push(...scanJwtExp(p,c));
       aF.push(...scanZipSlip(p,c));
+      aF.push(...scanFileUpload(p,c));
       aF.push(...scanHostHeader(p,c));
       aF.push(...scanPythonSinks(p,c));
       aF.push(...scanCSharp(p,c));

package/src/ir/CLAUDE.md

@@ -76,23 +76,28 @@ topLevel}`) as the regex parser. The CFG is built from the real AST, so:
 Each of these is a real failure mode; the regex fallback keeps the scan
 producing findings instead of returning empty.
 
-### What CST still doesn't model
-
-The helper builds a CFG only for shapes the dataflow engine actually
-consumes. The following still emit `kind: 'noop'` nodes (future work):
-
-- `match` case bodies (the function is captured; the per-case taint flow
-  isn't lowered)
-- destructuring assignment (`a, b = req.body`) — only single-target
-  assignments get a precise `target` field
-- comprehension generators (`for x in iter`) — the iter expression is
-  visible via the elt, but the generator's own `if` filters aren't yet
-  modeled
-- walrus `:=` at expression position — the RHS flows forward, but the
-  named binding isn't tracked as a separate variable
-
-These are deliberate to keep the CFG bounded; the regex parser's behavior
-was strictly worse (it dropped the entire function).
+### What CST models (and the one remaining limit)
+
+The helper now lowers — and the dataflow engine propagates taint through — all
+of the constructs this section once listed as unmodeled. Verified end-to-end in
+`test/parser-py-cst.test.js` (`#16` flow tests):
+
+- `match` case bodies — each `case` arm lowers to an `if` (the pattern) plus its
+  body block; a capture pattern (`case Foo(x)`) emits an assign for the binding.
+  Taint flows source → through a case body → sink.
+- walrus `:=` — the named binding is tracked as its own assign, both at statement
+  position and inside `if`/`while` tests (`_emit_walrus_assigns`).
+- comprehension generators — the loop-var assign from the iter AND the
+  generator's own `if` filters are emitted (`for x in iter if cond`).
+- destructuring assignment (`a, b = expr`) — one assign per target, sourced from
+  the element (`member[]`) of the RHS.
+
+**Remaining limit (a deep-engine collection-element trait, NOT a dropped CFG
+node):** taint carried through the *element* of a destructured tuple or a
+comprehension result — `a, b = src1, src2; sink(a)` or `xs = [src…]; sink(xs[0])`
+— does not always reach a finding. That's the collection-element-taint limitation
+tracked in `../dataflow/CLAUDE.md`; the CFG nodes are present, the element-level
+propagation is the open item.
 
 ## IR shape contract
 

package/src/llm-validator/index.js

@@ -92,10 +92,45 @@ Reply now with the JSON object on the last line of your response. Nothing else a
 `;
 
 function endpointConfig() {
+  // Explicit BYO endpoint always wins (unchanged behaviour).
   const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
-  const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY;
-  const model = process.env.AGENTIC_SECURITY_LLM_MODEL || 'unknown';
-  return endpoint ? { endpoint, apiKey, model } : null;
+  if (endpoint) {
+    return { endpoint, apiKey: process.env.AGENTIC_SECURITY_LLM_API_KEY, model: process.env.AGENTIC_SECURITY_LLM_MODEL || 'unknown', preset: null };
+  }
+  // #18 — first-class Anthropic preset. Opt-in via AGENTIC_SECURITY_LLM_PRESET=anthropic
+  // + a key (AGENTIC_SECURITY_LLM_API_KEY or ANTHROPIC_API_KEY): makes the FP-suppression
+  // validator reachable with just a key — no BYO endpoint URL or request-shape wrangling.
+  // Offline-degrading: no key → null (validator no-ops; no runtime cloud call by default).
+  if ((process.env.AGENTIC_SECURITY_LLM_PRESET || '').toLowerCase() === 'anthropic') {
+    const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY || process.env.ANTHROPIC_API_KEY;
+    if (!apiKey) return null;
+    return {
+      endpoint: 'https://api.anthropic.com/v1/messages',
+      apiKey,
+      model: process.env.AGENTIC_SECURITY_LLM_MODEL || 'claude-haiku-4-5',
+      preset: 'anthropic',
+    };
+  }
+  return null;
+}
+
+// Shape the request for the target: the Anthropic Messages API needs an
+// x-api-key header (added by the caller), an anthropic-version header, and a
+// {model, max_tokens, messages:[…]} body with the reply in content[].text. The
+// generic path posts {prompt, model} with a Bearer header. Pure — no I/O.
+function buildRequest(model, prompt, preset) {
+  if (preset === 'anthropic') {
+    return {
+      headers: { 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01' },
+      body: { model, max_tokens: 512, messages: [{ role: 'user', content: prompt }] },
+      extractText: (j) => (Array.isArray(j?.content) ? j.content.filter(b => b?.type === 'text').map(b => b.text || '').join('') : ''),
+    };
+  }
+  return {
+    headers: { 'Content-Type': 'application/json' },
+    body: { prompt, model },
+    extractText: (j) => (j && (j.response || j.text || j.content || j.output || j.choices?.[0]?.message?.content || j.message?.content)) || '',
+  };
 }
 
 function ensureCacheDir(scanRoot) {
@@ -179,17 +214,17 @@ function renderPrompt(finding, fileContents, challenge, nonce) {
     .replace('{{context}}', sterileContext || '(no surrounding code available)');
 }
 
-async function callEndpoint(endpoint, apiKey, model, prompt) {
-  const headers = { 'Content-Type': 'application/json' };
-  if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`;
-  const body = { prompt, model };
+async function callEndpoint(endpoint, apiKey, model, prompt, preset = null) {
+  const { headers, body, extractText } = buildRequest(model, prompt, preset);
+  if (apiKey) {
+    if (preset === 'anthropic') headers['x-api-key'] = apiKey;
+    else headers['Authorization'] = `Bearer ${apiKey}`;
+  }
   try {
     const r = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body) });
     if (!r.ok) return { ok: false, error: `HTTP ${r.status}` };
     const j = await r.json().catch(() => null);
-    const text = (j && (j.response || j.text || j.content || j.output ||
-      j.choices?.[0]?.message?.content || j.message?.content)) || '';
-    return { ok: true, text: String(text) };
+    return { ok: true, text: String(extractText(j) || '') };
   } catch (e) {
     return { ok: false, error: e.message };
   }
@@ -329,7 +364,7 @@ export async function validateOne(finding, fileContents, scanRoot) {
   const challenge = crypto.randomBytes(8).toString('hex');
   const nonce     = crypto.randomBytes(8).toString('hex');
   const prompt = renderPrompt(finding, fileContents, challenge, nonce);
-  const resp = await callEndpoint(cfg.endpoint, cfg.apiKey, cfg.model, prompt);
+  const resp = await callEndpoint(cfg.endpoint, cfg.apiKey, cfg.model, prompt, cfg.preset);
   if (!resp.ok) {
     finding.validator_verdict = 'unvalidated';
     finding.unvalidated = true;
@@ -436,4 +471,4 @@ export function applyValidatorVerdicts(findings) {
   return { kept, dropped };
 }
 
-export const _internal = { PROMPT_VERSION, renderPrompt, parseLastJsonObject, validateResponse, sanitizeReasoning, cacheKey };
+export const _internal = { PROMPT_VERSION, renderPrompt, parseLastJsonObject, validateResponse, sanitizeReasoning, cacheKey, endpointConfig, buildRequest };

package/src/mcp/tools.js

@@ -17,6 +17,7 @@ import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { applyFix as applyFixHistory, fixAcceptanceRate } from '../posture/fix-history.js';
+import { synthesizeDeterministicPatch } from '../posture/deterministic-fix.js';
 import { verifyLastScan } from '../posture/integrity.js';
 import { analyzeTranscript, formatCacheReport, renderCacheStatusLine } from '../posture/cache-economics.js';
 import { redactString, redactFinding } from './redact.js';
@@ -491,7 +492,7 @@ export const explain_finding = {
 // ─── apply_fix ───────────────────────────────────────────────────────────────
 export const apply_fix = {
   name: 'apply_fix',
-  description: 'Apply the stored replacement fix for a finding. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if its file path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing.',
+  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -499,10 +500,15 @@ export const apply_fix = {
       finding_id: { type: 'string', minLength: 1, maxLength: 256 },
       confirm: { type: 'boolean' },
       dry_run: { type: 'boolean' },
+      patch: {
+        type: 'object',
+        additionalProperties: { type: 'string', maxLength: 500_000 },
+        minProperties: 1, maxProperties: 8,
+      },
     },
     required: ['finding_id', 'confirm'],
   },
-  async handler({ finding_id, confirm, dry_run = false }, ctx) {
+  async handler({ finding_id, confirm, dry_run = false, patch = null }, ctx) {
     if (confirm !== true) {
       return { _meta: META, applied: false, reason: 'apply_fix requires confirm: true.' };
     }
@@ -515,6 +521,74 @@ export const apply_fix = {
     if (f._shadow === true) {
       return { _meta: META, applied: false, reason: 'shadow findings cannot be auto-applied' };
     }
+
+    // #3 — verifier-approved patch path. When the caller supplies `patch` (a
+    // files map, same shape as verify_fix), apply_fix re-runs the verifier
+    // INLINE and writes only if it passes: the original finding's stableId is
+    // gone, no new ≥medium finding was introduced, and lint is clean. This lets
+    // a deterministic OR LLM-synthesized patch be applied for the ~100% of
+    // findings that ship only a template/description (no stored fix.replacement).
+    // Security: all existing gates hold (confirm, last-scan HMAC, reserved
+    // paths, confinement, fix-history backup + attempt budget); the write is
+    // additionally gated on a FRESH verification, so a stale/forged patch can't
+    // slip through — there is no token to replay, the verify runs here and now.
+    if (patch && typeof patch === 'object' && Object.keys(patch).length) {
+      if (!f.stableId) {
+        return { _meta: META, applied: false, reason: 'finding has no stableId — cannot verify a patch against it' };
+      }
+      const confinedAbs = {};
+      for (const [rel, content] of Object.entries(patch)) {
+        let abs;
+        try { abs = _confine(ctx.sessionRoot, rel, 'patch key'); }
+        catch (e) { return { _meta: META, applied: false, reason: `path-escape refused: ${e.message}` }; }
+        if (_isReservedWritePath(ctx.sessionRoot, abs)) {
+          return { _meta: META, applied: false, reason: `reserved path refused: ${rel}` };
+        }
+        confinedAbs[rel] = { abs, content: String(content) };
+      }
+      // Inline re-verify — the load-bearing gate. Must pass to write.
+      let verdict;
+      try {
+        const verifyFixCore = await getVerifyFixCore();
+        verdict = await verifyFixCore({
+          scanRoot: ctx.sessionRoot,
+          originalFindingStableId: f.stableId,
+          files: Object.fromEntries(Object.entries(confinedAbs).map(([rel, v]) => [rel, v.content])),
+        });
+      } catch (e) {
+        return { _meta: META, applied: false, reason: `patch verification failed: ${e.message}` };
+      }
+      if (!verdict.ok) {
+        return {
+          _meta: META, applied: false,
+          reason: `patch rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
+          verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok } },
+        };
+      }
+      if (dry_run) {
+        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary };
+      }
+      const written = [];
+      try {
+        for (const [rel, v] of Object.entries(confinedAbs)) {
+          const originalContent = fs.existsSync(v.abs) ? await fsp.readFile(v.abs, 'utf8') : '';
+          const entry = await applyFixHistory({
+            scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content,
+            findingId: f.id, stableId: f.stableId, ruleId: f.rule || null, vuln: f.vuln || f.title || null,
+          });
+          written.push({ file: rel, historyId: entry.id, backupPath: entry.backupPath });
+        }
+      } catch (e) {
+        if (e && e.name === 'FixAttemptBudgetExceededError') {
+          return { _meta: META, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key };
+        }
+        throw e;
+      }
+      let acceptance = null;
+      try { acceptance = fixAcceptanceRate(ctx.sessionRoot); } catch { /* best-effort */ }
+      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance };
+    }
+
     if (typeof f.fix?.replacement !== 'string') {
       // Premortem #2: templates are patch-shaped text. Same reasoning as
       // the replacement path — do NOT pass through redactString here.
@@ -678,6 +752,20 @@ export const synthesize_fix = {
       locDelta = Math.abs(fix.replacement.split('\n').length - orig.split('\n').length);
     }
     const oversized = touchedFiles > 3 || locDelta > 100;
+    // #1 — deterministic autofix: for classes with a safe context-independent
+    // swap (weak hash, TLS verify-off), materialize a full-file patch from the
+    // live file. The agent passes `autofix.patch` straight to apply_fix, which
+    // re-verifies it (rescan-clean + no new ≥medium + lint) before writing — so
+    // even a mis-attributed swap can't land a bad edit. No stored replacement,
+    // no per-finding bloat in last-scan.json.
+    let autofix = null;
+    if (!hasReplacement) {
+      try {
+        const abs = _confine(ctx.sessionRoot, f.file, 'finding.file');
+        const det = synthesizeDeterministicPatch(f, fs.readFileSync(abs, 'utf8'));
+        if (det) autofix = { deterministic: true, ruleId: det.ruleId, patch: det.patch };
+      } catch { /* best-effort — no file / no rule → no autofix */ }
+    }
     // Premortem #2: `replacement` is a *patch* (the code we'll write to disk),
     // not a finding excerpt. Running it through redactString silently corrupts
     // valid patches whose content happens to match a secret-shape (e.g. a
@@ -694,9 +782,15 @@ export const synthesize_fix = {
       hasReplacement,
       replacement: hasReplacement ? fix.replacement : null,
       template: fix.code || null,
+      autofix,
+      // #15 — the regression test the scan annotator already generated for this
+      // finding (present when a PoC was built). Surfaced here so the fix flow
+      // writes the test alongside the patch; fix-verify-loop then runs it, so an
+      // applied fix ships with a test that fails pre-fix and passes post-fix.
+      regression_test: f.regression_test || null,
       remediation: typeof fix.description === 'string' ? fix.description : (typeof fix === 'string' ? fix : null),
       patchBounds: { touchedFiles, locDelta, oversized },
-      recommendsFixPlan: oversized && !hasReplacement,
+      recommendsFixPlan: oversized && !hasReplacement && !autofix,
     };
   },
 };

package/src/posture/CLAUDE.md

@@ -13,9 +13,11 @@ Annotators that run **after** every detector has emitted, plus state stores read
 
 **Risk amplification** — `epss.js`, `kev` (in `version.js`), `blast-radius.js`, `crown-jewels.js`, `exploitability.js`, `bounty-prediction.js`, `risk-in-dollars` (lives in `scripts/`, not here).
 
+**Secrets lifecycle** — `secret-history.js` (git-history blob sweep for committed-then-removed secrets, behind `--secret-history`), `secret-live-check.js` (opt-in, offline-degrading live/dead/unknown labeling via a read-only provider "whoami"; behind `--validate-secrets`).
+
 **Production-posture ingest** — `auth-posture-import.js`, `network-policy-import.js`, `telemetry-ingest.js`, `waf-ingest.js`, `feature-flags.js`. These read customer-side YAML and convert to mitigation flags consumed by `mitigation-composite.js`.
 
-**Fix lifecycle** — `fix-history.js` (apply + backup + recover), `fix-verify.js` (closed-loop re-scan + lint), `fix-plan.js` (oversized-patch fallback), `regression-test-gen.js`.
+**Fix lifecycle** — `fix-history.js` (apply + backup + recover), `fix-verify.js` (closed-loop re-scan + lint), `fix-plan.js` (oversized-patch fallback), `regression-test-gen.js`, `deterministic-fix.js` (safe context-independent literal-swap patch synthesis — md5/sha1→sha256, TLS verify-off→on — materialized on demand by `mcp/synthesize_fix`; every patch still passes through `apply_fix`'s inline verify before it lands).
 
 **Agentic verification** — `verifier.js`, `verifier-target.js`, `verifier-ephemeral.js`, `harness-discovery.js`, `adversary-agent.js`, `defender-agent.js`, `auditor-agent.js`, `three-agent-pipeline.js`.
 

package/src/posture/cache-economics.js

@@ -26,9 +26,11 @@ function money(n) {
 
 // Per-1M-token rates (input / output). Mirror hooks/model-cost-advisor.js MODELS.
 const MODEL_RATES = {
-  opus:   { label: 'Opus 4.8',   in: 5, out: 25 },
-  sonnet: { label: 'Sonnet 4.6', in: 3, out: 15 },
-  haiku:  { label: 'Haiku 4.5',  in: 1, out: 5 },
+  fable:   { label: 'Fable 5',    in: 10, out: 50 },
+  opus:    { label: 'Opus 4.8',   in: 5,  out: 25 },
+  sonnet5: { label: 'Sonnet 5',   in: 3,  out: 15 },
+  sonnet:  { label: 'Sonnet 4.6', in: 3,  out: 15 },
+  haiku:   { label: 'Haiku 4.5',  in: 1,  out: 5 },
 };
 const CACHE_READ_MULT = 0.1;   // cache read ≈ 0.1× input
 const CACHE_WRITE_MULT = 1.25; // 5-minute cache write ≈ 1.25× input
@@ -40,8 +42,9 @@ const TTL_MS = 5 * 60 * 1000;
 function rateFor(model) {
   if (typeof model !== 'string') return null;
   const s = model.toLowerCase();
+  if (s.includes('fable') || s.includes('mythos')) return MODEL_RATES.fable;
   if (s.includes('haiku')) return MODEL_RATES.haiku;
-  if (s.includes('sonnet')) return MODEL_RATES.sonnet;
+  if (s.includes('sonnet')) return (s.includes('sonnet-5') || s.includes('sonnet 5')) ? MODEL_RATES.sonnet5 : MODEL_RATES.sonnet;
   if (s.includes('opus')) return MODEL_RATES.opus;
   return null;
 }

package/src/posture/deterministic-fix.js

@@ -0,0 +1,65 @@
+// Deterministic fix synthesis (#1) — for the narrow set of vulnerability classes
+// where a context-INDEPENDENT literal swap is a safe, correct fix, produce a
+// full-file replacement from the current file content. No LLM, no guessing, no
+// per-finding bloat in last-scan.json (the patch is materialized on demand by
+// synthesize_fix from the live file, not stored on every finding).
+//
+// Safety: every patch this produces is still gated by verify_fix before apply_fix
+// writes it (original finding gone + no new ≥medium + lint clean). So a swap that
+// a rule mis-attributed simply fails verification instead of landing a bad edit —
+// this module widens the deterministic-fix surface without weakening the gate.
+//
+// Returns { patch: { [relFile]: newContent }, ruleId } or null when no
+// deterministic fix applies to the finding.
+
+const JS_EXT = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const PY_EXT = /\.py$/i;
+
+// Each rule gates on the finding's cwe/family, then rewrites the whole-file
+// content. transform() returns the new content, or null when nothing changed
+// (e.g. the vulnerable token isn't literally present — then we don't claim a fix).
+const RULES = [
+  {
+    id: 'weak-hash-sha256',
+    // md5 / sha1 → sha256. Every occurrence in the file is a weak hash, so
+    // swapping them all is safe; the verifier confirms the weak-hash finding is
+    // gone and nothing worse appeared.
+    applies: (f) => /CWE-(?:327|328|916)/.test(f.cwe || '') || /weak.?hash/i.test(f.family || ''),
+    transform: (content, file) => {
+      let out = content;
+      if (JS_EXT.test(file)) {
+        out = out.replace(/(\bcreateHash\s*\(\s*['"`])(?:md5|sha1)(['"`])/gi, '$1sha256$2');
+      } else if (PY_EXT.test(file)) {
+        out = out.replace(/\bhashlib\.(?:md5|sha1)\s*\(/g, 'hashlib.sha256(');
+      }
+      return out !== content ? out : null;
+    },
+  },
+  {
+    id: 'tls-verify-on',
+    // Disabled TLS verification → enabled. rejectUnauthorized:false → true (JS),
+    // verify=False → verify=True (Python requests).
+    applies: (f) => /CWE-295/.test(f.cwe || '') || /tls.?no.?verify|cert.?(?:none|verify)/i.test(f.family || ''),
+    transform: (content, file) => {
+      let out = content;
+      if (JS_EXT.test(file)) {
+        out = out.replace(/(\brejectUnauthorized\s*:\s*)false\b/g, '$1true');
+      } else if (PY_EXT.test(file)) {
+        out = out.replace(/(\bverify\s*=\s*)False\b/g, '$1True');
+      }
+      return out !== content ? out : null;
+    },
+  },
+];
+
+export function synthesizeDeterministicPatch(finding, fileContent) {
+  if (!finding || typeof fileContent !== 'string' || !finding.file) return null;
+  for (const rule of RULES) {
+    try {
+      if (!rule.applies(finding)) continue;
+      const next = rule.transform(fileContent, finding.file);
+      if (next && next !== fileContent) return { patch: { [finding.file]: next }, ruleId: rule.id };
+    } catch { /* a single rule failing must never break synthesis */ }
+  }
+  return null;
+}

package/src/posture/mttr.js

@@ -63,6 +63,31 @@ export function findingsExceedingSLA(findings, slaDays = null) {
   });
 }
 
+// Median age (days) of the currently-open findings — a single-scan proxy for
+// "how long has this debt been sitting". True MTTR (computeMTTR) needs the set
+// of findings that were FIXED; this reports the open backlog's median age so a
+// scan can show whether debt is getting older. Returns null on empty input.
+// Local — surfaced only through renderSlaSummary (its sole consumer).
+function medianOpenAgeDays(findings) {
+  const ages = (findings || []).map(f => f.ageDays || 0).sort((a, b) => a - b);
+  if (!ages.length) return null;
+  return ages[Math.floor(ages.length / 2)];
+}
+
+// One-line SLA-breach summary for surfacing after a scan (#10). Returns null
+// when nothing is past its per-severity SLA. Pairs with medianOpenAgeDays for a
+// "is my security debt aging" readout that the vibecoder can act on.
+export function renderSlaSummary(findings, slaDays = null) {
+  const breached = findingsExceedingSLA(findings || [], slaDays);
+  if (!breached.length) return null;
+  const bySev = {};
+  for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
+  const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
+  const median = medianOpenAgeDays(findings);
+  const ageNote = median != null ? ` (median open age ${median}d)` : '';
+  return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
+}
+
 // Compute MTTR statistics from a series of saved scans (each with firstSeen/lastSeen).
 // Useful for trend reporting.
 export function computeMTTR(removedFindings) {

package/src/posture/provider-catalog.js

@@ -0,0 +1,108 @@
+// Multi-provider model + pricing + cache catalog (PRD CACHE_ECONOMICS_V2, P2).
+//
+// One abstraction over four very different frameworks so the cost/cache advisor
+// (sast/llm-cost-advisor.js) and the economics modules work uniformly. Captures,
+// per provider: the model ladder (cheap→capable, with $/1M rates), the "depth"
+// knob (Anthropic effort / OpenAI+xAI reasoning_effort / Gemini thinkingBudget),
+// and the cache model (explicit vs automatic vs implicit; read/write economics).
+//
+// ⚠️ PRICES + MODEL NAMES DRIFT MONTHLY — this is a DATED snapshot, not truth.
+// Anything that needs a live number must read it here and treat `sourcedAt` as
+// the staleness signal; refresh from each provider's pricing/models API (or the
+// claude-api skill for Anthropic) at implementation time. No network at runtime.
+export const SOURCED_AT = '2026-07-05';
+
+// $/1M tokens. `cached` = effective cached-input rate (Anthropic = read multiplier
+// applied to `in`; others publish a cached-input price directly).
+export const PROVIDERS = {
+  anthropic: {
+    label: 'Anthropic (Claude)',
+    importMarkers: [/@anthropic-ai\b/, /\banthropic\b/, /\bClaude\b/],
+    modelMarkers: [/\bclaude-/i, /\bfable\b/i, /\bopus\b/i, /\bsonnet\b/i, /\bhaiku\b/i],
+    depth: { knob: 'effort', cheap: 'low', expensive: ['high', 'xhigh', 'max'], levels: ['low', 'medium', 'high', 'xhigh', 'max'] },
+    cache: { kind: 'explicit', readMult: 0.1, writeMult: 1.25, minPrefixTokens: 1024, modelScoped: true, manualControl: true },
+    // The /sonnet/i row prices both Sonnet 4.6 and Sonnet 5 ($3/$15). Fable 5 is
+    // the current flagship (above Opus) at $10/$50 — a distinct rate, so it gets
+    // its own top-tier row so the over-provisioned rule can suggest Opus/Sonnet.
+    models: [
+      { id: 'claude-haiku-4-5',  match: /haiku/i,        tier: 0, in: 1,  out: 5,  cached: 0.10 },
+      { id: 'claude-sonnet-4-6', match: /sonnet/i,       tier: 1, in: 3,  out: 15, cached: 0.30 },
+      { id: 'claude-opus-4-8',   match: /opus/i,         tier: 2, in: 5,  out: 25, cached: 0.50 },
+      { id: 'claude-fable-5',    match: /fable|mythos/i, tier: 3, in: 10, out: 50, cached: 1.00 },
+    ],
+  },
+  openai: {
+    label: 'OpenAI',
+    importMarkers: [/\bfrom openai\b/, /\bimport openai\b/, /@?openai\b/, /\bAzureOpenAI\b/],
+    modelMarkers: [/\bgpt-/i, /\bo[34]-?mini\b/i, /\bo3\b/i],
+    depth: { knob: 'reasoning_effort', cheap: 'low', expensive: ['high'], levels: ['minimal', 'low', 'medium', 'high'] },
+    cache: { kind: 'automatic', cachedDiscount: 0.90, minPrefixTokens: 1024, modelScoped: true, manualControl: false },
+    models: [
+      { id: 'gpt-4.1-nano', match: /gpt-4\.1-nano/i, tier: 0, in: 0.10, out: 0.40, cached: 0.025 },
+      { id: 'gpt-5-mini',   match: /gpt-5[.\d]*-mini/i, tier: 1, in: 0.60, out: 2.40, cached: 0.06 },
+      { id: 'gpt-5.4',      match: /gpt-5\.4(?!-mini)/i, tier: 2, in: 2.50, out: 15, cached: 0.25 },
+      { id: 'gpt-5.5',      match: /gpt-5\.5/i, tier: 3, in: 5, out: 30, cached: 0.50 },
+    ],
+    reasoningModels: [/\bo3\b/i, /\bo4-?mini\b/i],
+  },
+  google: {
+    label: 'Google (Gemini)',
+    importMarkers: [/google\.generativeai/, /\bgenai\b/, /@google\/genai/, /\bGenerativeModel\b/],
+    modelMarkers: [/\bgemini-/i],
+    depth: { knob: 'thinkingBudget', cheap: 'low budget', expensive: ['high budget'], levels: ['0', 'low', 'high', 'dynamic'] },
+    cache: { kind: 'implicit-explicit', cachedDiscount: 0.90, minPrefixTokens: 1024, modelScoped: true, manualControl: 'optional', storagePriced: true },
+    models: [
+      { id: 'gemini-flash-lite',  match: /flash-lite/i, tier: 0, in: 0.10, out: 0.40, cached: 0.025 },
+      { id: 'gemini-3.5-flash',   match: /3\.5-flash|2\.5-flash(?!-lite)/i, tier: 1, in: 1.50, out: 9, cached: 0.15 },
+      { id: 'gemini-3.1-pro',     match: /3\.1-pro|2\.5-pro/i, tier: 2, in: 2, out: 12, cached: 0.30 },
+    ],
+  },
+  xai: {
+    label: 'xAI (Grok)',
+    importMarkers: [/\bxai\b/i, /api\.x\.ai/, /\bGROK\b/i],
+    modelMarkers: [/\bgrok-/i],
+    depth: { knob: 'reasoning_effort', cheap: 'low', expensive: ['high'], levels: ['none', 'low', 'medium', 'high'] },
+    cache: { kind: 'automatic', cachedDiscount: 0.85, minPrefixTokens: 1024, modelScoped: true, manualControl: false },
+    models: [
+      { id: 'grok-4.1-fast', match: /grok-4\.1-fast/i, tier: 0, in: 0.20, out: 0.50, cached: 0.05 },
+      { id: 'grok-4.3',      match: /grok-4\.(3|20)/i, tier: 1, in: 1.25, out: 2.50, cached: 0.20 },
+    ],
+  },
+};
+
+// Detect the provider a file targets, from SDK import markers (preferred) then
+// model-string markers. Returns a provider key or null.
+export function detectProvider(raw) {
+  if (typeof raw !== 'string' || !raw) return null;
+  for (const [key, p] of Object.entries(PROVIDERS)) {
+    if (p.importMarkers.some(re => re.test(raw))) return key;
+  }
+  for (const [key, p] of Object.entries(PROVIDERS)) {
+    if (p.modelMarkers.some(re => re.test(raw))) return key;
+  }
+  return null;
+}
+
+// Which model-ladder entry does a model string map to (within a provider)?
+export function modelEntry(provider, modelStr) {
+  const p = PROVIDERS[provider];
+  if (!p || typeof modelStr !== 'string') return null;
+  return p.models.find(m => m.match.test(modelStr)) || null;
+}
+
+// A cheaper model in the same provider's ladder (one tier down), or null if the
+// model is already the cheapest / unknown.
+export function cheaperModel(provider, modelStr) {
+  const p = PROVIDERS[provider];
+  const cur = modelEntry(provider, modelStr);
+  if (!p || !cur || cur.tier === 0) return null;
+  const below = p.models.filter(m => m.tier < cur.tier).sort((a, b) => b.tier - a.tier)[0];
+  return below || null;
+}
+
+export function depthAxis(provider) {
+  return PROVIDERS[provider]?.depth || null;
+}
+export function cacheModel(provider) {
+  return PROVIDERS[provider]?.cache || null;
+}