@clear-capabilities/agentic-security-scanner 0.124.1 → 0.128.1

package/CHANGELOG.md

@@ -1,5 +1,211 @@
 # Changelog
 
+## 0.128.1 — patch dependency vulnerabilities (11 Dependabot alerts → 0)
+
+Security maintenance. Cleared all 11 open Dependabot alerts by updating the two lockfiles to
+patched versions (all within-major bumps, no breakage):
+
+- **`scanner/`** — `js-yaml` 4.1 → 4.3.0 (GHSA-h67p-54hq-rp68, quadratic-complexity DoS via merge
+  keys). `js-yaml` is inlined into the shipped bundle, so `dist/agentic-security.mjs` was rebuilt;
+  full gate re-run green (`npm test` 1695/0, cve-replay 185/185).
+- **`ide/vscode/`** — `undici` → 7.28.0 (incl. one high), `form-data` → 4.0.6 (high),
+  `markdown-it` → 14.3.0, `esbuild` → 0.28.1, `js-yaml` → 4.3.0. All transitive under
+  `@vscode/vsce`/`esbuild`; lockfile-only, `npm audit` now reports 0.
+
+`npm audit` is clean (0 vulnerabilities) in both packages.
+
+## 0.128.0 — the agentic methodology layer + a simpler command surface
+
+Two things landed together this release: a set of default-on **methodology annotators** that
+layer agentic-hunter discipline on top of the deterministic engine, and a **consolidation** of
+the command and skill surface so there's less to remember.
+
+**Methodology layer (7 additions, all v1, all tested — see `docs/AGENTIC_METHODOLOGY_PRD.md`):**
+
+- **Default falsification pass** (`posture/falsification.js`) — for each taint finding it tries
+  to *disprove* the finding by locating a context-matched control on the path, and demotes +
+  quarantines the ones it can block. Recall-preserving (never removes a finding, never touches
+  severity — like the proof gate); genuine cve-replay `pre` vulns still fire (0 false blocks,
+  corpus 185/185 intact). Opt out with `AGENTIC_SECURITY_NO_FALSIFICATION=1`.
+- **Attack-surface completeness inventory** (`posture/entrypoint-inventory.js`) — enumerates
+  every entry point (HTTP / queue / cron / CLI / env / upload / webhook) with a disposition
+  each, on `scan.entrypointInventory`.
+- **Root-cause sweep** (`posture/root-cause-sweep.js`) — from a confirmed finding, searches the
+  repo for sibling instances detectors missed, with a `found = candidates + mitigated`
+  accounting invariant, on `scan.rootCauseSweep`.
+- **Meta-security hardening** (`util/untrusted.js` + `docs/AGENT_THREAT_MODEL.md`) — a tested
+  threat model treating attacker-authored finding text as untrusted input; escaping wired into
+  the PR/issue/ticket render paths.
+- **Capability-based model routing** (`posture/model-routing.js`) — stamps `finding.dispatchModel`
+  (strongest for crypto/auth/critical, mid for injection, cheapest for low-sev hardening) for
+  cost-sensitive subagent dispatch.
+- **Self-improving recall harness** (`bench/realworld-recall/`) — LLM-judged (offline-degrading)
+  recall on real repos + a miss-analyzer that names the pipeline stage that dropped a finding
+  and proposes the fix. Bench-only; never in the product scan path.
+- **Deterministic fix-honesty gates** (`posture/fix-honesty-gate.js`) — a residual-risk
+  hand-wave guard, a cited-file:line requirement for FP/safe verdicts, and FULL/MITIGATION/
+  WORKAROUND completeness tiers; the previously-orphaned test loop is now wired into
+  `apply_fix` behind `AGENTIC_SECURITY_FIX_RUN_TESTS=1`.
+
+**Simpler surface (no functionality removed — everything folds to a mode + alias):**
+
+- Commands **12 → 10**: `/ci` folded into `/setup --ci` (+ new `/setup --predeploy`), and
+  `/three-agent-review` into `/triage --deep`. Old names still resolve via the
+  legacy-alias-redirect hook.
+- Skills **11 → 7**: the four write-time guards merged into `secure-coding-guard`, and the two
+  explainers into `security-explain`.
+
+**Docs:** README + ARCHITECTURE + HARNESS_COMPATIBILITY refreshed with accurate surface counts
+(17 MCP tools, 10 commands, 7 skills, 5 hook events, 9 sub-agents); the SAST/SCA improvement PRD
+audited and marked (16 of 25 shipped, 9 partial). Full `npm test` green (1695 tests); cve-replay
+corpus 185/185, no drift.
+
+## 0.127.0 — cost advisor: an actual choice, not just a tip
+
+The model-cost advisor (`hooks/model-cost-advisor.js`) has always been advisory
+only — a `systemMessage` tip you read and act on yourself, by design, because a
+`UserPromptSubmit` hook cannot pause for interactive input or change the model/
+effort (verified against the current Claude Code hooks reference before writing
+any of this, not assumed from the hook's own pre-existing comments). This
+release adds a real choice on top of that hard limit, without giving up the
+zero-token guarantee for anyone who doesn't opt in.
+
+- **New opt-in `"interactive": true`** (`.agentic-security/model-optimizer.json`,
+  default `false`). On a qualifying prompt, the hook now additionally emits
+  `hookSpecificOutput.additionalContext` — billed as input tokens, unlike the
+  free `systemMessage` — directing Claude to call `AskUserQuestion` with three
+  options: keep current defaults; get the exact `/model`/`/effort` command to
+  run yourself (Claude cannot switch its own running model — no exception
+  exists); or apply the cheaper model/effort to Claude's own delegated
+  Task/Agent-tool sub-agent dispatches for the rest of the session — the one
+  axis Claude can genuinely act on directly. Every other install keeps today's
+  zero-token behavior unchanged; only projects that explicitly opt in pay for
+  the interactive path, and only on prompts that already qualify for a tip.
+- The chosen sub-agent override is **sticky for the session** — persisted to
+  `.agentic-security/model-optimizer-state.json` (extending the existing state
+  file rather than adding a new one) and cleared at the next `SessionStart`,
+  which already does a bare overwrite of that file. A cooldown
+  (`interactiveCooldownTurns`, default 3) stops the directive from re-firing
+  its token cost if Claude doesn't act on it (e.g. a non-interactive/scripted
+  invocation).
+- Fixed a real bug the new shape would otherwise have hit: `dispatch-user-
+  prompt.js`'s `mergeOutputs` previously let the legacy-alias-redirect's
+  `additionalContext` and the advisor's new `additionalContext` clobber each
+  other if both fired on the same prompt (independent triggers, so this can
+  genuinely co-occur) — now joined instead of last-write-wins.
+- `commands/setup.md`'s `--model-optimizer` gained a matching `--interactive`
+  flag; `CLAUDE.md` documents the durable instruction for applying a saved
+  sub-agent override on future dispatches, respecting existing static
+  `model:` frontmatter pins (`security-triager.md`, `sca-triager.md`) and the
+  "task needs more capability" carve-out.
+
+Also added `SECURITY.md` (vulnerability disclosure policy).
+
+## 0.126.0 — closing the find→fix loop: verified auto-fix, CWE-434/306, Fable 5 pricing
+
+The largest remediation-side release to date. Prior to this, findings could be
+*found* at scale but not *fixed* at scale — of the 677 findings on this repo's own
+scan, zero could be mechanically applied. This release closes that loop end to end
+while adding the detection classes and workflow polish the closed loop needed.
+Full detail and rationale: `docs/FIND_AND_FIX_LOOP_PRD.md` (implemented; the file
+itself is removed post-implementation per its own instructions).
+
+**Remediation — a verified patch path for every finding, not just the ones with a
+stored replacement.**
+- `apply_fix` (MCP) now accepts a caller-supplied `patch` (a files map) and
+  **re-verifies it inline** — rescan-clean, no new ≥medium finding, lint-clean —
+  before writing. Previously `apply_fix` refused any finding without a stored
+  `fix.replacement`; now a template-only or description-only finding (the vast
+  majority) can be fixed, because the bytes are proven safe at write time instead
+  of trusted at synthesis time.
+- **Deterministic zero-LLM patch synthesis** (`posture/deterministic-fix.js`) for
+  safe, context-independent classes — weak hash (md5/sha1→sha256), TLS
+  verify-off→on — materialized on demand by `synthesize_fix` and still gated by
+  the same inline verifier before `apply_fix` writes it.
+- Regression tests are wired into the fix loop: `synthesize_fix` surfaces the
+  scan's existing PoC-derived `regression_test` so a fix ships with a test that
+  fails pre-fix and passes post-fix.
+- `/fix --all` and `/find-and-fix-everything` now run independent findings in
+  **parallel** (serializing only same-file findings), never halt on the first
+  test failure, and publish the running **auto-fix acceptance rate**.
+- `/fix --sca` surfaces its **upgrade break-rate** (build/test-verified upgrades
+  are the default; the break-rate is how often an "available" upgrade actually
+  wasn't safe to take).
+- MTTR / SLA tracking is now live: every scan stamps `firstSeenAt`/`ageDays` and
+  surfaces an SLA-breach summary (`critical` 7d / `high` 30d / …).
+- The Layer-3 LLM validator gained a first-class Anthropic preset
+  (`AGENTIC_SECURITY_LLM_PRESET=anthropic`) — previously BYO-endpoint only, so the
+  FP-suppression layer was reachable with just a key instead of a hand-built
+  endpoint.
+
+**Detection.**
+- New **CWE-434 unrestricted file-upload detector** (JS/Python) — a whole CWE
+  class that had zero coverage: unguarded Multer configs and writes that use the
+  client-supplied filename as the destination.
+- New **CWE-306 missing-authentication** rule: an unauthenticated destructive
+  route (DELETE, or id-taking PUT/PATCH) fires only when the app authenticates
+  elsewhere in the codebase — so auth-detection is proven to work before the rule
+  trusts a "no auth found" signal, keeping it high-precision even on all-public
+  files.
+- Corrected stale documentation in `scanner/src/ir/CLAUDE.md`: the Python CST
+  parser's `match`-case bodies, walrus bindings, destructuring, and comprehension
+  filters were already fully lowered and taint-propagating — verified end-to-end
+  with new flow tests, not just parser-shape tests.
+- The independent-eval gate (`bench/independent-eval/`) is now **active**
+  (`aggregateF1`/`perFamilyRecall` floors instead of `null`) — proven to fail on a
+  deliberate regression and pass at the current corpus result.
+
+**Hooks & cost.**
+- Pricing tables across all five rate-table copies now include **Fable 5
+  ($10/$50 per MTok)** and Sonnet 5 — previously a Fable 5 session wasn't even
+  priced by the cache-economics reporter, and the cost advisor couldn't reason
+  about the flagship model at all.
+- Two mechanical subagents (`security-triager`, `sca-triager`) pinned to Haiku.
+- The two `UserPromptSubmit` hooks and three `PreToolUse` (Edit) hooks were each
+  consolidated into a single dispatcher process — halving/thirding the per-turn
+  node spawns. The security-critical bodyguard block is proven to survive
+  consolidation (a dedicated regression test asserts the exit-2 deny still
+  fires first and short-circuits the advisory hooks).
+- The post-edit hook now offers a one-tap auto-fix inline when a fresh finding is
+  mechanically fixable, instead of only pointing at `/fix-all`.
+- The model-cost optimizer now ships **on by default** (`mode: "advise"`) with a
+  predicted-vs-realized savings ledger.
+
+**Workflow.**
+- `scan --watch` wires the existing (previously unwired) watch-mode daemon:
+  continuous incremental re-scan on file change with a risk-delta status line.
+- Opt-in, offline-degrading **live-secret validation**
+  (`--validate-secrets`) — labels a detected secret `live`/`dead`/`unknown` via a
+  read-only provider "whoami" check (GitHub, Stripe, OpenAI, SendGrid), so "this
+  key is LIVE" is distinguished from "you have a high-entropy string."
+  `--secret-history` (git-history sweep) was already wired; this release adds
+  the liveness half.
+- Diff-scoped scans (`--pr` / `--changed-since`) now default `--incremental` on,
+  since a changed-file set is exactly the incremental cache's designed case.
+
+## 0.125.0 — multi-provider LLM cost + prompt-cache linter (Cache Economics v2, phase 1)
+
+First slice of the Cache Economics v2 PRD (`docs/CACHE_ECONOMICS_V2_PRD.md`) — the
+foundation (P1 provider detection, P2 provider catalog) + the flagship analyzer (F1
+cache-hygiene + P3 per-provider model/depth recommendation). The optimizer now reaches
+beyond this Claude Code session into the user's **own AI-app code**, across providers.
+
+- **Provider catalog** (`scanner/src/posture/provider-catalog.js`): a dated, no-network
+  snapshot of Anthropic / OpenAI / Google Gemini / xAI — model ladder ($/1M rates), the
+  "depth" knob (effort / reasoning_effort / thinkingBudget), and the cache model
+  (explicit vs automatic vs implicit). Prices are sourced, not hardcoded-in-logic, with a
+  `SOURCED_AT` staleness date.
+- **LLM cost/cache detector** (`scanner/src/sast/llm-cost-advisor.js`, `scanLlmCost`):
+  provider-aware, gated on detecting an LLM SDK (low FP), emits **advisory** findings —
+  (1) *prompt-cache killer*: a timestamp/UUID/random value baked into a prompt prefix
+  that defeats caching; (2) *over-provisioned*: a flagship model at high depth, with the
+  catalog's cheaper model + lower depth **in that provider's framework** as the fix
+  (e.g. an OpenAI app → "gpt-5.4 at reasoning_effort=low"). Severity `low`/`info` so it
+  never inflates security counts.
+
+Remaining PRD phases (F2 measured cost, F3 TTL, F4 compaction, F5 pre-warm, F6 cross-
+session warmth, F7 self-tuning; full P4 per-provider economics) ship next.
+
 ## 0.124.1 — fix: narration no longer prints a broken location
 
 Now that v0.124.0 surfaces `narration` prominently inline, a pre-existing template

package/bin/agentic-security.js

@@ -113,6 +113,7 @@ Options:
   --since-baseline             Only show findings NOT in the saved baseline
   --hide-proven-safe           Drop findings discharged by a flow proof (provably safe)
   --secret-history             Also sweep recent git history for committed secrets
+  --validate-secrets           Label each detected secret live/dead/unknown (opt-in, network, offline-degrading)
                                (removed from HEAD but recoverable from .git)
   --history-depth <n>          Commits to sweep with --secret-history (default 50)
   --no-epss                    Skip EPSS exploit-prediction enrichment (default: enabled)
@@ -331,8 +332,40 @@ async function cmdScan(args) {
     }
   }
 
+  // #21 — --watch : continuous incremental re-scan on file change. Each change
+  // re-scans (incrementally) and writes a risk-delta to
+  // .agentic-security/watch-status.md that a statusline / /posture poll surfaces
+  // inline — so "did my edit add risk?" is answered without a manual re-scan.
+  // Blocks until Ctrl-C, like `jest --watch`. Opt-in, so it never affects a
+  // normal one-shot scan.
+  if (args.flags['watch']) {
+    process.env.AGENTIC_SECURITY_INCREMENTAL = '1';
+    const { watchProject, computeDelta, persistStatus, renderStatusLine } = await import('../src/posture/watch-mode.js');
+    process.stderr.write(`[watch] scanning ${targetAbs} on change — Ctrl-C to stop. Status → .agentic-security/watch-status.md\n`);
+    const seed = await runScan(targetAbs, {});
+    let prevFindings = seed.scan.findings || [];
+    await watchProject(targetAbs, async () => {
+      try {
+        const { scan } = await runScan(targetAbs, {});
+        const curr = scan.findings || [];
+        const delta = computeDelta(prevFindings, curr);
+        persistStatus(targetAbs, delta);
+        process.stderr.write('[watch] ' + renderStatusLine(delta) + '\n');
+        prevFindings = curr;
+      } catch (e) {
+        process.stderr.write(`[watch] rescan failed: ${e.message}\n`);
+      }
+    });
+    return 0; // watchProject blocks until aborted
+  }
+
   // --incremental : reuse taint summaries from prior scans for faster deep mode.
-  if (args.flags['incremental'] || process.env.AGENTIC_SECURITY_INCREMENTAL === '1') {
+  // #23 — default incremental ON for diff-scoped scans (--pr / --changed-since):
+  // that's the cache's designed use (small changed set → its callers), so the
+  // PR-native path is fast by default. A full-tree scan stays non-incremental
+  // unless explicitly requested (blanket-default flip needs broader validation).
+  const _diffScoped = !!(args.flags['pr'] || args.flags['changed-since']);
+  if (args.flags['incremental'] || process.env.AGENTIC_SECURITY_INCREMENTAL === '1' || _diffScoped) {
     process.env.AGENTIC_SECURITY_INCREMENTAL = '1';
   }
 
@@ -566,6 +599,46 @@ async function cmdScan(args) {
   if (_isSafeStateDir(stateDir)) {
     await fsp.mkdir(stateDir, { recursive: true });
     const persistedScan = toJSON(scan, meta);
+    // #10 — MTTR: stamp firstSeenAt/lastSeenAt/ageDays from the PREVIOUS scan so
+    // every finding carries an age, SLA breaches can be surfaced, and the fix
+    // loop can report time-to-clean. Best-effort; skipped under --deterministic
+    // so deterministic state stays byte-identical run-to-run.
+    if (!args.flags.deterministic) {
+      try {
+        const { stampFindingTimestamps, buildBaselineMap, renderSlaSummary } = await import('../src/posture/mttr.js');
+        let baselineMap = new Map();
+        try {
+          const prev = JSON.parse(await fsp.readFile(path.join(stateDir, 'last-scan.json'), 'utf8'));
+          baselineMap = buildBaselineMap(prev);
+        } catch { /* first run — empty baseline, everything is firstSeen now */ }
+        const now = Date.now();
+        stampFindingTimestamps(persistedScan.findings || [], baselineMap, now);
+        stampFindingTimestamps(persistedScan.secrets || [], baselineMap, now);
+        stampFindingTimestamps((persistedScan.supplyChain || []).filter(s => s.type === 'vulnerable_dep'), baselineMap, now);
+        // Surface the SLA-breach line on human-readable formats (not JSON/CI pipes).
+        const isJson = format === 'json' || format === 'sarif' || format === 'cyclonedx' || format === 'sbom' || format === 'spdx' || format === 'vex' || format === 'openvex' || format === 'pbom' || format === 'aibom';
+        if (!isJson) {
+          const sla = renderSlaSummary(persistedScan.findings || []);
+          if (sla) process.stderr.write(`⏰ agentic-security: ${sla}\n`);
+        }
+      } catch { /* MTTR is best-effort — never block a scan write */ }
+    }
+    // #22 — live-secret validation (opt-in, offline-degrading). Label each
+    // detected secret live | dead | unknown via a read-only provider "whoami".
+    // "This key is LIVE and was committed N commits ago" is the P0 that matters.
+    if (args.flags['validate-secrets'] || process.env.AGENTIC_SECURITY_VALIDATE_SECRETS === '1') {
+      try {
+        const { checkSecretLive } = await import('../src/posture/secret-live-check.js');
+        let live = 0;
+        for (const s of (persistedScan.secrets || [])) {
+          const { verdict, provider } = await checkSecretLive(s);
+          s.liveVerdict = verdict;
+          if (provider) s.liveProvider = provider;
+          if (verdict === 'live') live++;
+        }
+        if (live > 0) process.stderr.write(`🔴 agentic-security: ${live} LIVE secret(s) validated — rotate immediately (even if already removed from HEAD).\n`);
+      } catch { /* best-effort, offline-degrading — never block a scan */ }
+    }
     const lastScanBody = JSON.stringify(persistedScan, null, 2);
     await fsp.writeFile(path.join(stateDir, 'last-scan.json'), lastScanBody);
     try {
@@ -1535,7 +1608,7 @@ description: Remediate every finding at or above a severity threshold (default:
 argument-hint: "[--severity critical|high|medium]"
 ---
 
-Read \`.agentic-security/last-scan.json\`. For every finding at or above \`\${1:-critical}\` severity, dispatch the security-fixer subagent in sequence — not in parallel, as each fix may change subsequent findings. After each batch, re-run \`/security-scan-all\` to confirm. Stop and report if any test fails.
+Read \`.agentic-security/last-scan.json\`. For every finding at or above \`\${1:-critical}\` severity, dispatch the security-fixer subagent — independent findings in parallel, serializing only findings that share a file. Each fix is inline-verified by apply_fix before it lands (finding gone + no new ≥medium + lint). Do NOT halt on the first failure: record each finding's outcome and continue, then report the full list and the auto-fix acceptance rate. Re-run \`/security-scan-all\` to confirm.
 `,
     'security-report.md': `---
 description: Generate an HTML security report (or JSON / Markdown / SARIF).

package/dist/11.index.js

@@ -0,0 +1,353 @@
+export const id = 11;
+export const ids = [11];
+export const modules = {
+
+/***/ 11:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+// ESM COMPAT FLAG
+__webpack_require__.r(__webpack_exports__);
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  runProjectLinter: () => (/* binding */ runProjectLinter),
+  verifyFix: () => (/* binding */ verifyFix),
+  verifyPatch: () => (/* binding */ verifyPatch)
+});
+
+// EXTERNAL MODULE: external "node:child_process"
+var external_node_child_process_ = __webpack_require__(1421);
+// EXTERNAL MODULE: external "node:fs"
+var external_node_fs_ = __webpack_require__(3024);
+// EXTERNAL MODULE: external "node:path"
+var external_node_path_ = __webpack_require__(6760);
+// EXTERNAL MODULE: ./src/engine.js + 524 modules
+var engine = __webpack_require__(8215);
+;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
+// Deterministic honesty gates on fix / finding output (#7).
+//
+// The project's verification discipline (scanner/CLAUDE.md) exists because
+// several releases shipped broken or false because work was reported as done
+// without confirming the artifact changed. Two of those failure modes are
+// *textual* — they live in the prose an agent emits alongside a fix — and can
+// be caught deterministically, with no LLM and no network:
+//
+//   1. Hand-wave residual-risk prose. "The input is adequately handled",
+//      "future work", "tbd", "later" — vague assurances that claim safety
+//      without naming a concrete remaining vector. A residual you can't name
+//      is a residual you're guessing about; reject the guess.
+//
+//   2. An unbacked "this is a false positive / provably safe" verdict. Marking
+//      a finding safe is a coverage *reduction* — it must cite a `file:line`
+//      that shows why, exactly like the rules-override gate refuses to silently
+//      shrink coverage.
+//
+// Plus a conservative fix-tier classifier so a partial remediation can never be
+// labelled FULL: any workaround-only signal (rate-limit, docs, log-without-
+// reject) is WORKAROUND; anything short of (sink signature changed + all callers
+// routed + a discriminating test) is at most MITIGATION; only the full set with
+// no partial-sanitization caveat earns FULL.
+//
+// Pure functions, no side effects, no throwing — safe to call from a command,
+// a hook, or the MCP verify_fix path.
+
+// Vague-assurance phrases that a real residual must never hide behind. Matched
+// case-insensitively with word boundaries so "later" doesn't trip on
+// "collateral" and "tbd" doesn't trip on a longer token.
+const BANNED_RESIDUAL_PHRASES = Object.freeze([
+  'adequately handled',
+  'adequately handles',
+  'properly validated',
+  'properly handled',
+  'handled properly',
+  'handled safely',
+  'future work',
+  'more work needed',
+  'to be done',
+  'tbd',
+  'later',
+]);
+
+// A citation shaped like `file:line` — one or more non-space, non-colon chars,
+// a colon, then digits. Unanchored: it need only appear somewhere in the item.
+const CITATION_RE = /[^\s:]+:\d+/;
+
+// Verdicts that assert the finding is not real and therefore demand a citation.
+// Compared after normalizing separators (`_`/space → `-`) and lowercasing, so
+// FALSE_POSITIVE, false-positive, and "provably safe" all land here.
+const FP_VERDICTS = Object.freeze(new Set(['false-positive', 'provably-safe', 'safe']));
+
+function _escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Reject vague-assurance / hand-wave residual-risk prose.
+ *
+ * An empty or whitespace-only residual is ok — there is no residual to lie
+ * about. A non-empty residual is rejected when it contains any banned phrase;
+ * each match yields one violation naming the offending phrase.
+ *
+ * @param {string} residualText
+ * @returns {{ ok: boolean, violations: string[] }}
+ */
+function checkResidualHonesty(residualText) {
+  const text = typeof residualText === 'string' ? residualText : '';
+  if (text.trim() === '') return { ok: true, violations: [] };
+
+  const violations = [];
+  for (const phrase of BANNED_RESIDUAL_PHRASES) {
+    const re = new RegExp(`\\b${_escapeRe(phrase)}\\b`, 'i');
+    if (re.test(text)) {
+      violations.push(`vague-assurance phrase: "${phrase}"`);
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+
+function _isCitation(item) {
+  if (typeof item === 'string') return CITATION_RE.test(item);
+  if (item && typeof item === 'object' && typeof item.location === 'string') {
+    return CITATION_RE.test(item.location);
+  }
+  return false;
+}
+
+function _normalizeVerdict(verdict) {
+  return String(verdict).trim().toLowerCase().replace(/[_\s]+/g, '-');
+}
+
+/**
+ * Require a file:line citation behind a "this is not real" verdict.
+ *
+ * For a false-positive / provably-safe / safe verdict (case-insensitive; also
+ * accepts FALSE_POSITIVE), at least one evidence item must be a `file:line`
+ * citation — either a string matching /[^\s:]+:\d+/ or an object
+ * `{ location: "file:line" }`. Any other verdict passes unconditionally.
+ *
+ * @param {string} verdict
+ * @param {Array|string|object} evidence
+ * @returns {{ ok: boolean, violations: string[] }}
+ */
+function requireCitedEvidence(verdict, evidence) {
+  if (typeof verdict !== 'string' || !FP_VERDICTS.has(_normalizeVerdict(verdict))) {
+    return { ok: true, violations: [] };
+  }
+  const items = Array.isArray(evidence)
+    ? evidence
+    : evidence == null
+      ? []
+      : [evidence];
+  if (items.some(_isCitation)) return { ok: true, violations: [] };
+  return {
+    ok: false,
+    violations: ['false-positive/safe verdict requires a file:line citation'],
+  };
+}
+
+/**
+ * Classify a fix into FULL | MITIGATION | WORKAROUND, conservative-first.
+ *
+ * @param {object} signals
+ * @param {boolean} signals.sinkSignatureChanged
+ * @param {boolean} signals.allCallersRouted
+ * @param {boolean} signals.testDiscriminates - a test that fails pre-fix, passes post-fix
+ * @param {boolean} [signals.rateLimitOnly]
+ * @param {boolean} [signals.docsOnly]
+ * @param {boolean} [signals.logOnlyNoReject]
+ * @param {boolean} [signals.partialSanitization]
+ * @returns {'FULL'|'MITIGATION'|'WORKAROUND'}
+ */
+function computeFixTier(signals) {
+  const s = signals && typeof signals === 'object' ? signals : {};
+  if (s.rateLimitOnly || s.docsOnly || s.logOnlyNoReject) return 'WORKAROUND';
+  const complete = s.sinkSignatureChanged && s.allCallersRouted && s.testDiscriminates;
+  if (s.partialSanitization || !complete) return 'MITIGATION';
+  return 'FULL';
+}
+
+/**
+ * Compose the three gates for a single fix's output.
+ *
+ * ok = residual-honesty ok AND evidence-citation ok, further constrained by the
+ * tier/residual consistency invariant:
+ *   - a FULL tier must NOT carry a residual (a full fix has nothing left);
+ *   - a non-FULL tier MUST document a residual (say what's still open).
+ *
+ * @param {{ residual?: string, verdict?: string, evidence?: any, signals?: object }} input
+ * @returns {{ ok: boolean, tier: string, violations: string[] }}
+ */
+function gateFixOutput({ residual, verdict, evidence, signals } = {}) {
+  const tier = computeFixTier(signals);
+  const residualCheck = checkResidualHonesty(residual);
+  const evidenceCheck = requireCitedEvidence(verdict, evidence);
+
+  const violations = [...residualCheck.violations, ...evidenceCheck.violations];
+  let ok = residualCheck.ok && evidenceCheck.ok;
+
+  const residualEmpty = typeof residual !== 'string' || residual.trim() === '';
+  if (tier === 'FULL' && !residualEmpty) {
+    violations.push('FULL tier cannot carry a residual');
+    ok = false;
+  }
+  if (tier !== 'FULL' && residualEmpty) {
+    violations.push('non-FULL tier must document a residual');
+    ok = false;
+  }
+
+  return { ok, tier, violations };
+}
+
+const _internals = Object.freeze({ BANNED_RESIDUAL_PHRASES, CITATION_RE, FP_VERDICTS });
+
+;// CONCATENATED MODULE: ./src/posture/fix-verify.js
+// Closed-loop /fix verification (Sentinel-parity FR-L4-4, FR-L4-5).
+//
+// Given a candidate patch (the new file content + the finding stableId being
+// fixed), verify it:
+//
+//   1. The original finding's stableId no longer fires on the patched file.
+//   2. No new findings at severity ≥ medium were introduced by the patch.
+//   3. The project's existing linter (when present) passes on the patched file.
+//
+// If any of those fail, the caller is expected to NOT apply the patch and
+// instead surface a "fix plan" — a numbered list of steps the engineer can
+// follow — rather than dump a broken patch on the user.
+
+
+
+
+
+
+
+const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+
+// Run a focused re-scan over just the patched file(s) using the in-memory
+// engine. No filesystem write needed — we hand the new content in via the
+// fileContents map.
+async function verifyPatch({
+  scanRoot,
+  originalFindingStableId,
+  files,   // { [relPath]: newContent }
+  depFileContents = {},
+} = {}) {
+  if (!files || typeof files !== 'object') return { ok: false, reason: 'no-files-provided' };
+  const fileContents = { ...files };
+  let scan;
+  try {
+    scan = await (0,engine/* runFullScan */.wW)({ fileContents, depFileContents, scanRoot }, () => {});
+  } catch (e) {
+    return { ok: false, reason: 'rescan-failed', error: e.message };
+  }
+  const findings = (scan && scan.findings) || [];
+  const stillHasOriginal = !!originalFindingStableId &&
+    findings.some(f => f.stableId === originalFindingStableId);
+  if (stillHasOriginal) {
+    return { ok: false, reason: 'original-finding-still-present', stableId: originalFindingStableId };
+  }
+  const introducedHighOrAbove = findings.filter(f =>
+    (SEVERITY_RANK[f.severity] ?? 9) <= SEVERITY_RANK.medium);
+  // Don't count findings on lines outside the patched files — but our
+  // fileContents map IS the patched files, so every finding is in-scope.
+  return {
+    ok: introducedHighOrAbove.length === 0,
+    reason: introducedHighOrAbove.length === 0 ? 'verified' : 'introduced-new-findings',
+    introduced: introducedHighOrAbove.map(f => ({
+      vuln: f.vuln, file: f.file, line: f.line, severity: f.severity,
+      stableId: f.stableId,
+    })),
+  };
+}
+
+// Detect which linter the project uses and run it on the patched files.
+// Returns { ok, runner, output } or { ok: true, runner: 'none' } when no
+// linter is configured (silent pass).
+function runProjectLinter(scanRoot, filePaths) {
+  if (!scanRoot || !Array.isArray(filePaths) || filePaths.length === 0) {
+    return { ok: true, runner: 'none' };
+  }
+  const has = (p) => { try { return external_node_fs_.existsSync(external_node_path_.join(scanRoot, p)); } catch { return false; } };
+  // Pick the linter by config file present in the repo root.
+  const jsFiles = filePaths.filter(f => /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(f));
+  const pyFiles = filePaths.filter(f => /\.py$/i.test(f));
+  const goFiles = filePaths.filter(f => /\.go$/i.test(f));
+  const javaFiles = filePaths.filter(f => /\.java$/i.test(f));
+
+  if (jsFiles.length && (has('.eslintrc') || has('.eslintrc.json') || has('.eslintrc.js') || has('eslint.config.js') || has('eslint.config.mjs'))) {
+    return runLinter(scanRoot, 'eslint', ['--no-error-on-unmatched-pattern', ...jsFiles]);
+  }
+  if (pyFiles.length && (has('pyproject.toml') || has('ruff.toml') || has('.ruff.toml'))) {
+    return runLinter(scanRoot, 'ruff', ['check', ...pyFiles]);
+  }
+  if (pyFiles.length && has('.flake8')) {
+    return runLinter(scanRoot, 'flake8', pyFiles);
+  }
+  if (goFiles.length && (has('.golangci.yml') || has('.golangci.yaml'))) {
+    return runLinter(scanRoot, 'golangci-lint', ['run', ...goFiles]);
+  }
+  if (javaFiles.length && has('checkstyle.xml')) {
+    return runLinter(scanRoot, 'checkstyle', ['-c', 'checkstyle.xml', ...javaFiles]);
+  }
+  return { ok: true, runner: 'none' };
+}
+
+function runLinter(cwd, cmd, args) {
+  let r;
+  try {
+    r = (0,external_node_child_process_.spawnSync)(cmd, args, { cwd, encoding: 'utf8', timeout: 60_000 });
+  } catch (e) {
+    return { ok: true, runner: cmd, skipped: true, reason: 'binary-missing', error: e.message };
+  }
+  if (r.error && r.error.code === 'ENOENT') {
+    return { ok: true, runner: cmd, skipped: true, reason: 'binary-missing' };
+  }
+  if (r.status === null) {
+    return { ok: false, runner: cmd, reason: 'timed-out', output: (r.stderr || r.stdout || '').slice(-2000) };
+  }
+  return {
+    ok: r.status === 0,
+    runner: cmd,
+    exitCode: r.status,
+    output: ((r.stderr || '') + (r.stdout || '')).slice(-2000),
+  };
+}
+
+// Top-level verify: re-scan + lint. Returns the combined verdict + a
+// human-readable summary string suitable for surfacing to the user.
+// Addition #7 — deterministic honesty gates on fix output. When the caller
+// supplies `fixMeta` ({ residual, verdict, evidence, signals }) — e.g. the
+// security-fixer agent's residual-risk text + completeness signals — the fix's
+// claims are checked mechanically (no hand-wave residual prose, a cited
+// file:line for any FP/safe verdict, and a FULL/MITIGATION/WORKAROUND tier). A
+// dishonest or over-claiming fix fails the gate. When `fixMeta` is absent
+// (the deterministic MCP write path, which has no claims to check) the honesty
+// gate is skipped and behavior is unchanged.
+async function verifyFix({
+  scanRoot,
+  originalFindingStableId,
+  files,
+  depFileContents,
+  fixMeta,
+} = {}) {
+  const rescan = await verifyPatch({ scanRoot, originalFindingStableId, files, depFileContents });
+  const lint = runProjectLinter(scanRoot, Object.keys(files || {}));
+  let honesty = null;
+  if (fixMeta && typeof fixMeta === 'object') {
+    try { honesty = gateFixOutput(fixMeta); } catch { honesty = null; }
+  }
+  const ok = rescan.ok && (lint.ok || lint.skipped) && (honesty ? honesty.ok : true);
+  const summary = [
+    `re-scan: ${rescan.ok ? 'PASS' : 'FAIL — ' + rescan.reason}`,
+    `linter:  ${lint.runner === 'none' ? 'skipped (no linter config)'
+              : lint.skipped ? `${lint.runner} not installed`
+              : lint.ok ? `${lint.runner} PASS`
+              : `${lint.runner} FAIL (exit ${lint.exitCode})`}`,
+    honesty ? `honesty: ${honesty.ok ? `PASS (${honesty.tier})` : 'FAIL — ' + honesty.violations.join('; ')}` : null,
+  ].filter(Boolean).join('\n');
+  return { ok, rescan, lint, honesty, summary };
+}
+
+
+/***/ })
+
+};