@clear-capabilities/agentic-security-scanner 0.124.1 → 0.128.1

package/dist/449.index.js

@@ -0,0 +1,135 @@
+export const id = 449;
+export const ids = [449];
+export const modules = {
+
+/***/ 5830:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   buildBaselineMap: () => (/* binding */ buildBaselineMap),
+/* harmony export */   renderSlaSummary: () => (/* binding */ renderSlaSummary),
+/* harmony export */   stampFindingTimestamps: () => (/* binding */ stampFindingTimestamps)
+/* harmony export */ });
+/* unused harmony exports findingsExceedingSLA, computeMTTR */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
+// 0.8.0 Feat-11: MTTR / finding-age tracking — per-finding firstSeenAt/lastSeenAt with SLA breach detection.
+//
+// Stamps every finding with `firstSeenAt` (preserved from the baseline if the
+// finding existed previously) and `lastSeenAt` (the current scan time). Surfaces
+// findings exceeding an SLA threshold per severity.
+//
+// Pure function — does not write to disk. The caller (CLI / fix workflow) decides
+// when to persist firstSeenAt back into the baseline.
+
+
+
+// Stable fingerprint for cross-scan finding identity. Mirrors the dedupe key.
+function _fingerprint(f) {
+  const file = (f.file || '').split(' -> ').pop();
+  const line = f.line || f.source?.line || f.sink?.line || 0;
+  const vuln = (f.vuln || f.type || '').replace(/\W+/g, '_').toLowerCase();
+  const cwe = (f.cwe || '').toUpperCase();
+  return node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(`${file}:${line}:${vuln}:${cwe}`).digest('hex').slice(0, 16);
+}
+
+// Stamp findings in-place with firstSeenAt / lastSeenAt / ageDays.
+// `findings` — current scan findings (will be mutated).
+// `baselineMap` — optional Map of fingerprint → { firstSeenAt }. Pass an empty Map for first run.
+// `now` — Date.now() at scan time (allow injection for tests).
+function stampFindingTimestamps(findings, baselineMap = new Map(), now = Date.now()) {
+  const nowIso = new Date(now).toISOString();
+  for (const f of findings) {
+    const fp = _fingerprint(f);
+    f._fp = fp;
+    const prev = baselineMap.get(fp);
+    f.firstSeenAt = prev?.firstSeenAt || nowIso;
+    f.lastSeenAt = nowIso;
+    const firstMs = Date.parse(f.firstSeenAt);
+    f.ageDays = Math.max(0, Math.floor((now - firstMs) / 86400000));
+  }
+  return findings;
+}
+
+// Build a baseline map from an existing baseline JSON (or scan JSON shape).
+// Recognised top-level: { findings, secrets, supplyChain }. Each entry retains
+// firstSeenAt if it had one previously.
+function buildBaselineMap(baselineJson) {
+  const map = new Map();
+  const all = [
+    ...(baselineJson?.findings || []),
+    ...(baselineJson?.secrets || []),
+    ...(baselineJson?.supplyChain || []).filter(s => s.type === 'vulnerable_dep'),
+  ];
+  for (const f of all) {
+    const fp = _fingerprint(f);
+    if (f.firstSeenAt) map.set(fp, { firstSeenAt: f.firstSeenAt });
+  }
+  return map;
+}
+
+// Identify findings exceeding an SLA threshold.
+// slaDays: { critical: 7, high: 30, medium: 60, low: 90, info: 180 } (default).
+function findingsExceedingSLA(findings, slaDays = null) {
+  const SLA = slaDays || { critical: 7, high: 30, medium: 60, low: 90, info: 180 };
+  return findings.filter(f => {
+    const limit = SLA[f.severity] ?? 90;
+    return (f.ageDays || 0) > limit;
+  });
+}
+
+// Median age (days) of the currently-open findings — a single-scan proxy for
+// "how long has this debt been sitting". True MTTR (computeMTTR) needs the set
+// of findings that were FIXED; this reports the open backlog's median age so a
+// scan can show whether debt is getting older. Returns null on empty input.
+// Local — surfaced only through renderSlaSummary (its sole consumer).
+function medianOpenAgeDays(findings) {
+  const ages = (findings || []).map(f => f.ageDays || 0).sort((a, b) => a - b);
+  if (!ages.length) return null;
+  return ages[Math.floor(ages.length / 2)];
+}
+
+// One-line SLA-breach summary for surfacing after a scan (#10). Returns null
+// when nothing is past its per-severity SLA. Pairs with medianOpenAgeDays for a
+// "is my security debt aging" readout that the vibecoder can act on.
+function renderSlaSummary(findings, slaDays = null) {
+  const breached = findingsExceedingSLA(findings || [], slaDays);
+  if (!breached.length) return null;
+  const bySev = {};
+  for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
+  const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
+  const median = medianOpenAgeDays(findings);
+  const ageNote = median != null ? ` (median open age ${median}d)` : '';
+  return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
+}
+
+// Compute MTTR statistics from a series of saved scans (each with firstSeen/lastSeen).
+// Useful for trend reporting.
+function computeMTTR(removedFindings) {
+  // removedFindings: findings that existed in baseline but no longer in current
+  // (i.e., were fixed). Each carries firstSeenAt and lastSeenAt from the baseline.
+  if (!removedFindings.length) return { count: 0, meanDays: null, medianDays: null, perSeverity: {} };
+  const ages = removedFindings.map(f => {
+    const first = Date.parse(f.firstSeenAt || 0);
+    const last = Date.parse(f.lastSeenAt || 0);
+    return Math.max(0, (last - first) / 86400000);
+  }).sort((a, b) => a - b);
+  const meanDays = ages.reduce((s, x) => s + x, 0) / ages.length;
+  const medianDays = ages[Math.floor(ages.length / 2)];
+  const perSeverity = {};
+  for (const f of removedFindings) {
+    const sev = f.severity || 'medium';
+    (perSeverity[sev] = perSeverity[sev] || []).push(
+      Math.max(0, (Date.parse(f.lastSeenAt || 0) - Date.parse(f.firstSeenAt || 0)) / 86400000)
+    );
+  }
+  for (const k of Object.keys(perSeverity)) {
+    const a = perSeverity[k];
+    perSeverity[k] = { count: a.length, meanDays: a.reduce((s,x)=>s+x,0)/a.length };
+  }
+  return { count: removedFindings.length, meanDays, medianDays, perSeverity };
+}
+
+
+/***/ })
+
+};

package/dist/637.index.js

@@ -11,7 +11,7 @@ export const modules = {
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(5099);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8215);
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings

package/dist/752.index.js

@@ -42,9 +42,11 @@ function money(n) {
 
 // Per-1M-token rates (input / output). Mirror hooks/model-cost-advisor.js MODELS.
 const MODEL_RATES = {
-  opus:   { label: 'Opus 4.8',   in: 5, out: 25 },
-  sonnet: { label: 'Sonnet 4.6', in: 3, out: 15 },
-  haiku:  { label: 'Haiku 4.5',  in: 1, out: 5 },
+  fable:   { label: 'Fable 5',    in: 10, out: 50 },
+  opus:    { label: 'Opus 4.8',   in: 5,  out: 25 },
+  sonnet5: { label: 'Sonnet 5',   in: 3,  out: 15 },
+  sonnet:  { label: 'Sonnet 4.6', in: 3,  out: 15 },
+  haiku:   { label: 'Haiku 4.5',  in: 1,  out: 5 },
 };
 const CACHE_READ_MULT = 0.1;   // cache read ≈ 0.1× input
 const CACHE_WRITE_MULT = 1.25; // 5-minute cache write ≈ 1.25× input
@@ -56,8 +58,9 @@ const TTL_MS = 5 * 60 * 1000;
 function rateFor(model) {
   if (typeof model !== 'string') return null;
   const s = model.toLowerCase();
+  if (s.includes('fable') || s.includes('mythos')) return MODEL_RATES.fable;
   if (s.includes('haiku')) return MODEL_RATES.haiku;
-  if (s.includes('sonnet')) return MODEL_RATES.sonnet;
+  if (s.includes('sonnet')) return (s.includes('sonnet-5') || s.includes('sonnet 5')) ? MODEL_RATES.sonnet5 : MODEL_RATES.sonnet;
   if (s.includes('opus')) return MODEL_RATES.opus;
   return null;
 }

package/dist/801.index.js

@@ -0,0 +1,87 @@
+export const id = 801;
+export const ids = [801];
+export const modules = {
+
+/***/ 9801:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   checkSecretLive: () => (/* binding */ checkSecretLive)
+/* harmony export */ });
+/* unused harmony export _internal */
+// Live-secret validation (#22) — label a detected secret live | dead | unknown.
+//
+// "This Stripe/GitHub key is LIVE and was committed 40 commits ago" is a P0 the
+// vibecoder must rotate now; "you have a high-entropy string" is noise. This
+// closes that gap for the providers with a cheap, read-only "whoami" check.
+//
+// STRICTLY opt-in (a --validate-secrets flag / AGENTIC_SECURITY_VALIDATE_SECRETS)
+// and OFFLINE-DEGRADING: any network error, timeout, or unrecognized provider
+// yields 'unknown' — never a false 'dead'. No runtime cloud calls by default,
+// per the scanner's no-network-by-default convention. The request builder is
+// pure (no I/O) so it's testable without hitting a provider.
+
+// Map a detected secret to a read-only validation request, or null when we have
+// no safe check for that provider. Only providers whose token is a self-
+// contained bearer/token credential (no signing, no extra params) are covered.
+function buildLiveCheckRequest(secret) {
+  const val = (secret && (secret.match || secret.value || secret.secret || secret.token)) || '';
+  if (typeof val !== 'string' || val.length < 8) return null;
+
+  // GitHub PAT / OAuth token → GET /user (200 = live, 401 = dead).
+  if (/^gh[posru]_[A-Za-z0-9]{20,}$/.test(val) || /^github_pat_[A-Za-z0-9_]{20,}$/.test(val)) {
+    return { provider: 'github', method: 'GET', url: 'https://api.github.com/user',
+      headers: { Authorization: `token ${val}`, 'User-Agent': 'agentic-security', Accept: 'application/vnd.github+json' } };
+  }
+  // Stripe secret key → GET /v1/account (200 = live, 401 = dead).
+  if (/^sk_live_[A-Za-z0-9]{16,}$/.test(val) || /^rk_live_[A-Za-z0-9]{16,}$/.test(val)) {
+    return { provider: 'stripe', method: 'GET', url: 'https://api.stripe.com/v1/account',
+      headers: { Authorization: `Bearer ${val}` } };
+  }
+  // OpenAI key → GET /v1/models.
+  if (/^sk-[A-Za-z0-9]{20,}$/.test(val) && !/^sk_live_/.test(val)) {
+    return { provider: 'openai', method: 'GET', url: 'https://api.openai.com/v1/models',
+      headers: { Authorization: `Bearer ${val}` } };
+  }
+  // SendGrid key → GET /v3/scopes.
+  if (/^SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}$/.test(val)) {
+    return { provider: 'sendgrid', method: 'GET', url: 'https://api.sendgrid.com/v3/scopes',
+      headers: { Authorization: `Bearer ${val}` } };
+  }
+  return null;
+}
+
+// Classify an HTTP status into a liveness verdict. 200-2xx = live; 401/403 =
+// dead (rejected credential); anything else = unknown (rate-limit, 5xx, etc. —
+// we don't know, so don't claim dead).
+function classifyStatus(status) {
+  if (status >= 200 && status < 300) return 'live';
+  if (status === 401 || status === 403) return 'dead';
+  return 'unknown';
+}
+
+// Perform the validation. Returns { verdict: 'live'|'dead'|'unknown', provider }.
+// Offline-degrading: on any error/timeout, verdict is 'unknown'.
+async function checkSecretLive(secret, { timeoutMs = 4000 } = {}) {
+  const req = buildLiveCheckRequest(secret);
+  if (!req) return { verdict: 'unknown', provider: null };
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const r = await fetch(req.url, { method: req.method, headers: req.headers, signal: ctrl.signal });
+    return { verdict: classifyStatus(r.status), provider: req.provider };
+  } catch {
+    return { verdict: 'unknown', provider: req.provider };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// Pure surfaces exposed for tests (no network) — kept off the public API so the
+// dead-module guard doesn't flag them; `checkSecretLive` is the wired entry.
+const _internal = { buildLiveCheckRequest, classifyStatus };
+
+
+/***/ })
+
+};

package/dist/826.index.js

@@ -9,6 +9,7 @@ export const modules = {
 /* harmony export */   renderPrComment: () => (/* binding */ renderPrComment)
 /* harmony export */ });
 /* unused harmony export _internal */
+/* harmony import */ var _util_untrusted_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7097);
 // Advisor-tone PR comment renderer (v0.72).
 //
 // Replaces the typical "12 findings detected, see SARIF" wall of text
@@ -36,6 +37,8 @@ export const modules = {
 // route through an LLM for richer prose when AGENTIC_SECURITY_LLM_ENDPOINT
 // is configured.
 
+
+
 const SEVERITY_GLYPH = {
   critical: '🟥',
   high:     '🟧',
@@ -147,7 +150,7 @@ function renderPrComment(delta, { repoName, prNumber, prTitle } = {}) {
     const sev = SEVERITY_GLYPH[f.severity] || '⬜';
     const route = _route(f);
     const where = route ? `\`${route}\` (\`${f.file}:${f.line}\`)` : `\`${f.file}:${f.line}\``;
-    lines.push(`${sev} **${meta?.name || f.vuln}** — ${where}`);
+    lines.push(`${sev} **${meta?.name || (0,_util_untrusted_js__WEBPACK_IMPORTED_MODULE_0__/* .escapeMarkdown */ .FV)(f.vuln)}** — ${where}`);
     if (meta) lines.push(`  > ${meta.why}`);
     if (f.remediation) {
       const onelineFix = String(f.remediation).split('\n')[0].slice(0, 240);

package/dist/838.index.js

@@ -14,7 +14,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5099);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3793);
 // Closed-loop /fix verification (Sentinel-parity FR-L4-4, FR-L4-5).
 //
 // Given a candidate patch (the new file content + the finding stableId being