@clear-capabilities/agentic-security-scanner 0.124.1 → 0.128.1

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-c162f0538727ff2cce518e33cd577b95521e9a1926abe63d7ed89afc3d21c21c  agentic-security.mjs
+2d630902bbb9bebbd5557bce1c7db106cd81fdf975cf18c5273b1e46716103a7  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.124.1",
+  "version": "0.128.1",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -60,14 +60,14 @@
     "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs",
     "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
     "test:smoke": "node --test test/smoke.test.js",
-    "test:sast": "node --test test/llm.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
-    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js",
-    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js",
+    "test:sast": "node --test test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
+    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js",
+    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js",
     "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js",
-    "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js && node ../scripts/lint-command-descriptions.mjs",
-    "test:eval": "node --test test/independent-eval.test.js",
+    "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js && node ../scripts/lint-command-descriptions.mjs",
+    "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
     "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",
     "smoke": "node bin/agentic-security.js scan test/fixtures/vulnerable-js",

package/src/engine.js

@@ -11,6 +11,7 @@ import { createRequire } from 'node:module';
 const _require = createRequire(import.meta.url);
 import { scanLLM } from './sast/llm.js';
 import { scanLLMOwasp } from './sast/llm-owasp.js';
+import { scanLlmCost } from './sast/llm-cost-advisor.js';
 import { scanBusinessLogic } from './sast/logic.js';
 import { scanPipeline } from './sast/pipeline.js';
 import { scanMCP } from './sast/mcp-audit.js';
@@ -52,6 +53,7 @@ import { deadBranchRanges as _deadBranchRanges, isLineInDeadRange as _isLineInDe
 import { scanJavaDeserialization } from './sast/java-deserialization.js';
 import { scanJwtExp } from './sast/jwt-exp.js';
 import { scanZipSlip } from './sast/zip-slip.js';
+import { scanFileUpload } from './sast/file-upload.js';
 import { scanHostHeader } from './sast/host-header.js';
 import { scanPythonSinks } from './sast/python-sinks.js';
 import { scanCSharp } from './sast/csharp.js';
@@ -172,6 +174,10 @@ import { applyLearnedCalibration } from './posture/triage-learning.js';
 import { annotateFormalVerification } from './dataflow/formal-verify.js';
 import { annotatePathFeasibility } from './dataflow/smt-feasibility.js';
 import { annotateProofGate } from './dataflow/proof-gate.js';
+import { annotateFalsification } from './posture/falsification.js';
+import { routeModelForFinding } from './posture/model-routing.js';
+import { buildEntrypointInventory } from './posture/entrypoint-inventory.js';
+import { sweepRootCauses } from './posture/root-cause-sweep.js';
 import { computeAnalysisTiers, countUnmodeledSinkCandidates } from './posture/coverage-report.js';
 import { annotatePrivacyTaint, emitDpiaArtifact } from './dataflow/privacy-taint.js';
 import { buildThreatModel as buildAutoThreatModel, persistThreatModel as persistAutoThreatModel } from './posture/threat-model-auto.js';
@@ -7396,6 +7402,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));aF.push(...scanTerraform(p,c));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
+      aF.push(...scanLlmCost(p,c));
       aLogic.push(...scanBusinessLogic(p,c));
       aF.push(...scanPipeline(p,c));
       aF.push(...scanContainer(p,c));
@@ -7429,6 +7436,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
       aF.push(...scanJavaDeserialization(p,c));
       aF.push(...scanJwtExp(p,c));
       aF.push(...scanZipSlip(p,c));
+      aF.push(...scanFileUpload(p,c));
       aF.push(...scanHostHeader(p,c));
       aF.push(...scanPythonSinks(p,c));
       aF.push(...scanCSharp(p,c));
@@ -7908,6 +7916,23 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   if (process.env.AGENTIC_SECURITY_NO_PROOF_GATE !== '1') {
     _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
   }
+  // Addition #1 — default falsification pass. Actively tries to DISPROVE each
+  // taint-style finding by locating a context-matched control on the path, and
+  // demotes + quarantines the ones it can block. Recall-preserving (never
+  // removes a finding, never touches severity — like the proof gate). Runs
+  // AFTER proof-gate so it layers on the same demotion channel. Deterministic by
+  // default; the LLM tier is only wired when an endpoint is configured. Opt out
+  // with AGENTIC_SECURITY_NO_FALSIFICATION=1.
+  if (process.env.AGENTIC_SECURITY_NO_FALSIFICATION !== '1') {
+    _runAnnotator("annotateFalsification", () => { annotateFalsification(finalFindings, fc); });
+  }
+  // Addition #5 — capability-based model routing. Stamp each finding with the
+  // model tier a cost-sensitive fixer/triager/PoC subagent should be dispatched
+  // on for THIS vuln class (crypto/auth/critical → strongest; injection → mid;
+  // low-sev hardening → cheapest). Advisory metadata consumed at dispatch time.
+  _runAnnotator("annotateDispatchModel", () => {
+    for (const f of finalFindings) { try { f.dispatchModel = routeModelForFinding(f).model; } catch { /* advisory only */ } }
+  });
   // v3 next-gen: production-aware context ingest (Pillar 9). Must run BEFORE
   // the mitigation composite, persona prioritization, and final why-fired
   // record so those see the demotion signals.
@@ -8538,7 +8563,12 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   try { _analysisTier = computeAnalysisTiers(Object.keys(fc)); } catch {}
   try { _unmodeledSinks = countUnmodeledSinkCandidates(fc, finalFindings); } catch {}
   const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length}};
-  return{routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,threatModel:_threatModel,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
+  // Addition #2 — attack-surface completeness inventory (entry points → dispositions).
+  let _entrypointInventory = {}; try { _entrypointInventory = buildEntrypointInventory(fc, { routes: aR, findings: finalFindings }); } catch { _entrypointInventory = {}; }
+  // Addition #3 — root-cause sweep: from confirmed findings, find sibling instances
+  // detectors missed, with total-count accounting. Confirmed-only (cheap by default).
+  let _rootCauseSweep = null; try { _rootCauseSweep = sweepRootCauses(finalFindings, fc); } catch { _rootCauseSweep = null; }
+  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,threatModel:_threatModel,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".
 // Orphans (no finding linkage) are bucketed by file-local heuristic so the UI shows binary states only.

package/src/integrations/tickets.js

@@ -17,6 +17,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as cp from 'node:child_process';
 import { buildJiraIssue } from './index.js';
+import { escapeMarkdown } from '../util/untrusted.js';
 
 function statePath(scanRoot) {
   return path.join(scanRoot, '.agentic-security', 'tickets.json');
@@ -32,7 +33,10 @@ function writeState(scanRoot, state) {
 }
 
 function findingTitle(f) {
-  return `[${(f.severity || 'medium').toUpperCase()}] ${f.vuln || f.title || 'security finding'} at ${f.file}:${f.line}`;
+  // vuln/title are lifted from the (untrusted) scanned code — escape before
+  // they land in an issue title. See docs/AGENT_THREAT_MODEL.md path #1.
+  const label = escapeMarkdown(f.vuln) || escapeMarkdown(f.title) || 'security finding';
+  return `[${(f.severity || 'medium').toUpperCase()}] ${label} at ${f.file}:${f.line}`;
 }
 function findingBody(f) {
   const br = f.blastRadius;
@@ -43,9 +47,11 @@ function findingBody(f) {
     f.cwe ? `**CWE:** ${f.cwe}` : null,
     f.epss != null ? `**EPSS:** ${f.epss.toFixed(4)} (percentile ${(f.epssPercentile * 100).toFixed(1)}%)` : null,
     exploited,
-    f.description ? `\n${f.description}` : null,
+    f.description ? `\n${escapeMarkdown(f.description)}` : null,
     br?.narrative ? `\n**Blast radius:** ${br.narrative}` : null,
-    f.snippet ? `\n\`\`\`\n${f.snippet}\n\`\`\`` : null,
+    // snippet is attacker-authored code; escape so a crafted ``` fence or
+    // <img>/[x](url) inside it cannot break out of the code block.
+    f.snippet ? `\n\`\`\`\n${escapeMarkdown(f.snippet)}\n\`\`\`` : null,
     f.remediation ? `\n**Remediation:** ${f.remediation}` : null,
     `\n---\n_Surfaced by agentic-security · finding id: ${f.id}_`,
   ].filter(Boolean).join('\n');

package/src/ir/CLAUDE.md

@@ -76,23 +76,28 @@ topLevel}`) as the regex parser. The CFG is built from the real AST, so:
 Each of these is a real failure mode; the regex fallback keeps the scan
 producing findings instead of returning empty.
 
-### What CST still doesn't model
-
-The helper builds a CFG only for shapes the dataflow engine actually
-consumes. The following still emit `kind: 'noop'` nodes (future work):
-
-- `match` case bodies (the function is captured; the per-case taint flow
-  isn't lowered)
-- destructuring assignment (`a, b = req.body`) — only single-target
-  assignments get a precise `target` field
-- comprehension generators (`for x in iter`) — the iter expression is
-  visible via the elt, but the generator's own `if` filters aren't yet
-  modeled
-- walrus `:=` at expression position — the RHS flows forward, but the
-  named binding isn't tracked as a separate variable
-
-These are deliberate to keep the CFG bounded; the regex parser's behavior
-was strictly worse (it dropped the entire function).
+### What CST models (and the one remaining limit)
+
+The helper now lowers — and the dataflow engine propagates taint through — all
+of the constructs this section once listed as unmodeled. Verified end-to-end in
+`test/parser-py-cst.test.js` (`#16` flow tests):
+
+- `match` case bodies — each `case` arm lowers to an `if` (the pattern) plus its
+  body block; a capture pattern (`case Foo(x)`) emits an assign for the binding.
+  Taint flows source → through a case body → sink.
+- walrus `:=` — the named binding is tracked as its own assign, both at statement
+  position and inside `if`/`while` tests (`_emit_walrus_assigns`).
+- comprehension generators — the loop-var assign from the iter AND the
+  generator's own `if` filters are emitted (`for x in iter if cond`).
+- destructuring assignment (`a, b = expr`) — one assign per target, sourced from
+  the element (`member[]`) of the RHS.
+
+**Remaining limit (a deep-engine collection-element trait, NOT a dropped CFG
+node):** taint carried through the *element* of a destructured tuple or a
+comprehension result — `a, b = src1, src2; sink(a)` or `xs = [src…]; sink(xs[0])`
+— does not always reach a finding. That's the collection-element-taint limitation
+tracked in `../dataflow/CLAUDE.md`; the CFG nodes are present, the element-level
+propagation is the open item.
 
 ## IR shape contract
 

package/src/llm-validator/index.js

@@ -92,10 +92,45 @@ Reply now with the JSON object on the last line of your response. Nothing else a
 `;
 
 function endpointConfig() {
+  // Explicit BYO endpoint always wins (unchanged behaviour).
   const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
-  const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY;
-  const model = process.env.AGENTIC_SECURITY_LLM_MODEL || 'unknown';
-  return endpoint ? { endpoint, apiKey, model } : null;
+  if (endpoint) {
+    return { endpoint, apiKey: process.env.AGENTIC_SECURITY_LLM_API_KEY, model: process.env.AGENTIC_SECURITY_LLM_MODEL || 'unknown', preset: null };
+  }
+  // #18 — first-class Anthropic preset. Opt-in via AGENTIC_SECURITY_LLM_PRESET=anthropic
+  // + a key (AGENTIC_SECURITY_LLM_API_KEY or ANTHROPIC_API_KEY): makes the FP-suppression
+  // validator reachable with just a key — no BYO endpoint URL or request-shape wrangling.
+  // Offline-degrading: no key → null (validator no-ops; no runtime cloud call by default).
+  if ((process.env.AGENTIC_SECURITY_LLM_PRESET || '').toLowerCase() === 'anthropic') {
+    const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY || process.env.ANTHROPIC_API_KEY;
+    if (!apiKey) return null;
+    return {
+      endpoint: 'https://api.anthropic.com/v1/messages',
+      apiKey,
+      model: process.env.AGENTIC_SECURITY_LLM_MODEL || 'claude-haiku-4-5',
+      preset: 'anthropic',
+    };
+  }
+  return null;
+}
+
+// Shape the request for the target: the Anthropic Messages API needs an
+// x-api-key header (added by the caller), an anthropic-version header, and a
+// {model, max_tokens, messages:[…]} body with the reply in content[].text. The
+// generic path posts {prompt, model} with a Bearer header. Pure — no I/O.
+function buildRequest(model, prompt, preset) {
+  if (preset === 'anthropic') {
+    return {
+      headers: { 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01' },
+      body: { model, max_tokens: 512, messages: [{ role: 'user', content: prompt }] },
+      extractText: (j) => (Array.isArray(j?.content) ? j.content.filter(b => b?.type === 'text').map(b => b.text || '').join('') : ''),
+    };
+  }
+  return {
+    headers: { 'Content-Type': 'application/json' },
+    body: { prompt, model },
+    extractText: (j) => (j && (j.response || j.text || j.content || j.output || j.choices?.[0]?.message?.content || j.message?.content)) || '',
+  };
 }
 
 function ensureCacheDir(scanRoot) {
@@ -179,17 +214,17 @@ function renderPrompt(finding, fileContents, challenge, nonce) {
     .replace('{{context}}', sterileContext || '(no surrounding code available)');
 }
 
-async function callEndpoint(endpoint, apiKey, model, prompt) {
-  const headers = { 'Content-Type': 'application/json' };
-  if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`;
-  const body = { prompt, model };
+async function callEndpoint(endpoint, apiKey, model, prompt, preset = null) {
+  const { headers, body, extractText } = buildRequest(model, prompt, preset);
+  if (apiKey) {
+    if (preset === 'anthropic') headers['x-api-key'] = apiKey;
+    else headers['Authorization'] = `Bearer ${apiKey}`;
+  }
   try {
     const r = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body) });
     if (!r.ok) return { ok: false, error: `HTTP ${r.status}` };
     const j = await r.json().catch(() => null);
-    const text = (j && (j.response || j.text || j.content || j.output ||
-      j.choices?.[0]?.message?.content || j.message?.content)) || '';
-    return { ok: true, text: String(text) };
+    return { ok: true, text: String(extractText(j) || '') };
   } catch (e) {
     return { ok: false, error: e.message };
   }
@@ -329,7 +364,7 @@ export async function validateOne(finding, fileContents, scanRoot) {
   const challenge = crypto.randomBytes(8).toString('hex');
   const nonce     = crypto.randomBytes(8).toString('hex');
   const prompt = renderPrompt(finding, fileContents, challenge, nonce);
-  const resp = await callEndpoint(cfg.endpoint, cfg.apiKey, cfg.model, prompt);
+  const resp = await callEndpoint(cfg.endpoint, cfg.apiKey, cfg.model, prompt, cfg.preset);
   if (!resp.ok) {
     finding.validator_verdict = 'unvalidated';
     finding.unvalidated = true;
@@ -436,4 +471,4 @@ export function applyValidatorVerdicts(findings) {
   return { kept, dropped };
 }
 
-export const _internal = { PROMPT_VERSION, renderPrompt, parseLastJsonObject, validateResponse, sanitizeReasoning, cacheKey };
+export const _internal = { PROMPT_VERSION, renderPrompt, parseLastJsonObject, validateResponse, sanitizeReasoning, cacheKey, endpointConfig, buildRequest };

package/src/mcp/tools.js

@@ -17,6 +17,7 @@ import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { applyFix as applyFixHistory, fixAcceptanceRate } from '../posture/fix-history.js';
+import { synthesizeDeterministicPatch } from '../posture/deterministic-fix.js';
 import { verifyLastScan } from '../posture/integrity.js';
 import { analyzeTranscript, formatCacheReport, renderCacheStatusLine } from '../posture/cache-economics.js';
 import { redactString, redactFinding } from './redact.js';
@@ -491,7 +492,7 @@ export const explain_finding = {
 // ─── apply_fix ───────────────────────────────────────────────────────────────
 export const apply_fix = {
   name: 'apply_fix',
-  description: 'Apply the stored replacement fix for a finding. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if its file path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing.',
+  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -499,10 +500,15 @@ export const apply_fix = {
       finding_id: { type: 'string', minLength: 1, maxLength: 256 },
       confirm: { type: 'boolean' },
       dry_run: { type: 'boolean' },
+      patch: {
+        type: 'object',
+        additionalProperties: { type: 'string', maxLength: 500_000 },
+        minProperties: 1, maxProperties: 8,
+      },
     },
     required: ['finding_id', 'confirm'],
   },
-  async handler({ finding_id, confirm, dry_run = false }, ctx) {
+  async handler({ finding_id, confirm, dry_run = false, patch = null }, ctx) {
     if (confirm !== true) {
       return { _meta: META, applied: false, reason: 'apply_fix requires confirm: true.' };
     }
@@ -515,6 +521,85 @@ export const apply_fix = {
     if (f._shadow === true) {
       return { _meta: META, applied: false, reason: 'shadow findings cannot be auto-applied' };
     }
+
+    // #3 — verifier-approved patch path. When the caller supplies `patch` (a
+    // files map, same shape as verify_fix), apply_fix re-runs the verifier
+    // INLINE and writes only if it passes: the original finding's stableId is
+    // gone, no new ≥medium finding was introduced, and lint is clean. This lets
+    // a deterministic OR LLM-synthesized patch be applied for the ~100% of
+    // findings that ship only a template/description (no stored fix.replacement).
+    // Security: all existing gates hold (confirm, last-scan HMAC, reserved
+    // paths, confinement, fix-history backup + attempt budget); the write is
+    // additionally gated on a FRESH verification, so a stale/forged patch can't
+    // slip through — there is no token to replay, the verify runs here and now.
+    if (patch && typeof patch === 'object' && Object.keys(patch).length) {
+      if (!f.stableId) {
+        return { _meta: META, applied: false, reason: 'finding has no stableId — cannot verify a patch against it' };
+      }
+      const confinedAbs = {};
+      for (const [rel, content] of Object.entries(patch)) {
+        let abs;
+        try { abs = _confine(ctx.sessionRoot, rel, 'patch key'); }
+        catch (e) { return { _meta: META, applied: false, reason: `path-escape refused: ${e.message}` }; }
+        if (_isReservedWritePath(ctx.sessionRoot, abs)) {
+          return { _meta: META, applied: false, reason: `reserved path refused: ${rel}` };
+        }
+        confinedAbs[rel] = { abs, content: String(content) };
+      }
+      // Inline re-verify — the load-bearing gate. Must pass to write.
+      let verdict;
+      try {
+        const _files = Object.fromEntries(Object.entries(confinedAbs).map(([rel, v]) => [rel, v.content]));
+        if (process.env.AGENTIC_SECURITY_FIX_RUN_TESTS === '1') {
+          // Addition #7 — connect the closed-loop verifier: add the project test
+          // suite as a fourth verification leg (scan + lint + tests). Opt-in
+          // because many repos have no runner and we must not fail-closed by
+          // default. Normalized to the scan+lint verdict shape used below.
+          const { verifyFixWithTests } = await import('../posture/fix-verify-loop.js');
+          const t = await verifyFixWithTests({ scanRoot: ctx.sessionRoot, originalFindingStableId: f.stableId, files: _files });
+          verdict = { ok: t.ok, summary: t.summary, rescan: t.legs?.scan?.detail, lint: t.legs?.lint?.detail, tests: t.legs?.tests, testVerdict: t.verdict };
+        } else {
+          const verifyFixCore = await getVerifyFixCore();
+          verdict = await verifyFixCore({
+            scanRoot: ctx.sessionRoot,
+            originalFindingStableId: f.stableId,
+            files: _files,
+          });
+        }
+      } catch (e) {
+        return { _meta: META, applied: false, reason: `patch verification failed: ${e.message}` };
+      }
+      if (!verdict.ok) {
+        return {
+          _meta: META, applied: false,
+          reason: `patch rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
+          verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok } },
+        };
+      }
+      if (dry_run) {
+        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary };
+      }
+      const written = [];
+      try {
+        for (const [rel, v] of Object.entries(confinedAbs)) {
+          const originalContent = fs.existsSync(v.abs) ? await fsp.readFile(v.abs, 'utf8') : '';
+          const entry = await applyFixHistory({
+            scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content,
+            findingId: f.id, stableId: f.stableId, ruleId: f.rule || null, vuln: f.vuln || f.title || null,
+          });
+          written.push({ file: rel, historyId: entry.id, backupPath: entry.backupPath });
+        }
+      } catch (e) {
+        if (e && e.name === 'FixAttemptBudgetExceededError') {
+          return { _meta: META, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key };
+        }
+        throw e;
+      }
+      let acceptance = null;
+      try { acceptance = fixAcceptanceRate(ctx.sessionRoot); } catch { /* best-effort */ }
+      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance };
+    }
+
     if (typeof f.fix?.replacement !== 'string') {
       // Premortem #2: templates are patch-shaped text. Same reasoning as
       // the replacement path — do NOT pass through redactString here.
@@ -678,6 +763,20 @@ export const synthesize_fix = {
       locDelta = Math.abs(fix.replacement.split('\n').length - orig.split('\n').length);
     }
     const oversized = touchedFiles > 3 || locDelta > 100;
+    // #1 — deterministic autofix: for classes with a safe context-independent
+    // swap (weak hash, TLS verify-off), materialize a full-file patch from the
+    // live file. The agent passes `autofix.patch` straight to apply_fix, which
+    // re-verifies it (rescan-clean + no new ≥medium + lint) before writing — so
+    // even a mis-attributed swap can't land a bad edit. No stored replacement,
+    // no per-finding bloat in last-scan.json.
+    let autofix = null;
+    if (!hasReplacement) {
+      try {
+        const abs = _confine(ctx.sessionRoot, f.file, 'finding.file');
+        const det = synthesizeDeterministicPatch(f, fs.readFileSync(abs, 'utf8'));
+        if (det) autofix = { deterministic: true, ruleId: det.ruleId, patch: det.patch };
+      } catch { /* best-effort — no file / no rule → no autofix */ }
+    }
     // Premortem #2: `replacement` is a *patch* (the code we'll write to disk),
     // not a finding excerpt. Running it through redactString silently corrupts
     // valid patches whose content happens to match a secret-shape (e.g. a
@@ -694,9 +793,15 @@ export const synthesize_fix = {
       hasReplacement,
       replacement: hasReplacement ? fix.replacement : null,
       template: fix.code || null,
+      autofix,
+      // #15 — the regression test the scan annotator already generated for this
+      // finding (present when a PoC was built). Surfaced here so the fix flow
+      // writes the test alongside the patch; fix-verify-loop then runs it, so an
+      // applied fix ships with a test that fails pre-fix and passes post-fix.
+      regression_test: f.regression_test || null,
       remediation: typeof fix.description === 'string' ? fix.description : (typeof fix === 'string' ? fix : null),
       patchBounds: { touchedFiles, locDelta, oversized },
-      recommendsFixPlan: oversized && !hasReplacement,
+      recommendsFixPlan: oversized && !hasReplacement && !autofix,
     };
   },
 };

package/src/posture/CLAUDE.md

@@ -13,12 +13,21 @@ Annotators that run **after** every detector has emitted, plus state stores read
 
 **Risk amplification** — `epss.js`, `kev` (in `version.js`), `blast-radius.js`, `crown-jewels.js`, `exploitability.js`, `bounty-prediction.js`, `risk-in-dollars` (lives in `scripts/`, not here).
 
+**Secrets lifecycle** — `secret-history.js` (git-history blob sweep for committed-then-removed secrets, behind `--secret-history`), `secret-live-check.js` (opt-in, offline-degrading live/dead/unknown labeling via a read-only provider "whoami"; behind `--validate-secrets`).
+
 **Production-posture ingest** — `auth-posture-import.js`, `network-policy-import.js`, `telemetry-ingest.js`, `waf-ingest.js`, `feature-flags.js`. These read customer-side YAML and convert to mitigation flags consumed by `mitigation-composite.js`.
 
-**Fix lifecycle** — `fix-history.js` (apply + backup + recover), `fix-verify.js` (closed-loop re-scan + lint), `fix-plan.js` (oversized-patch fallback), `regression-test-gen.js`.
+**Fix lifecycle** — `fix-history.js` (apply + backup + recover), `fix-verify.js` (closed-loop re-scan + lint), `fix-plan.js` (oversized-patch fallback), `regression-test-gen.js`, `deterministic-fix.js` (safe context-independent literal-swap patch synthesis — md5/sha1→sha256, TLS verify-off→on — materialized on demand by `mcp/synthesize_fix`; every patch still passes through `apply_fix`'s inline verify before it lands).
 
 **Agentic verification** — `verifier.js`, `verifier-target.js`, `verifier-ephemeral.js`, `harness-discovery.js`, `adversary-agent.js`, `defender-agent.js`, `auditor-agent.js`, `three-agent-pipeline.js`.
 
+**Methodology additions (`docs/AGENTIC_METHODOLOGY_PRD.md`)** — default-on annotators/artifacts that layer the agentic-hunter methodology on the deterministic engine:
+- `falsification.js` — default falsification pass. For each taint-style finding, tries to DISPROVE it (locate a context-matched control on the path, reusing `dataflow/sanitizer-proof.js`'s shape rules read-only); a blocked finding is demoted + `quarantined`, never removed and never severity-touched (recall-preserving, like `proof-gate`). Wired after `annotateProofGate`. Opt out: `AGENTIC_SECURITY_NO_FALSIFICATION=1`. Optional LLM tier over survivors when an endpoint is configured.
+- `entrypoint-inventory.js` — attack-surface completeness ledger. Enumerates every entry point (HTTP/queue/cron/CLI/env/upload/webhook) with a disposition each; on `scan.entrypointInventory`.
+- `root-cause-sweep.js` — from confirmed findings, finds sibling instances detectors missed with total-count accounting (`found === candidates + mitigated`); on `scan.rootCauseSweep`.
+- `model-routing.js` — capability-based CWE/severity→model policy; stamps `finding.dispatchModel` (strongest for crypto/auth/critical, mid for injection, cheapest for low-sev hardening) for cost-sensitive subagent dispatch.
+- `fix-honesty-gate.js` — deterministic honesty gates on fix output: a residual-risk hand-wave guard, a cited-file:line requirement for any FP/safe verdict, and FULL/MITIGATION/WORKAROUND completeness tiers. Consumed by `fix-verify.js` when the caller supplies fix metadata; the closed-loop test leg (`fix-verify-loop.js`) is wired into `mcp/apply_fix` behind `AGENTIC_SECURITY_FIX_RUN_TESTS=1`.
+
 **Integrity + signing** — `integrity.js` (per-install HMAC for `last-scan.json`), `rule-pack-signing.js`. The HMAC key lives at `$XDG_CONFIG_HOME/agentic-security/scan-key`; override via `$AGENTIC_SECURITY_HMAC_KEY`. Premortem-derived; do not regress to hostname-derived.
 
 **Rule lifecycle** — `custom-rules.js` (YAML pattern DSL), `rule-overrides.js` (`disable:` gated on signature), `rule-packs.js`, `rule-synthesis.js` (proposes suppressions from triage feedback), `ruleset-version.js`.

package/src/posture/cache-economics.js

@@ -26,9 +26,11 @@ function money(n) {
 
 // Per-1M-token rates (input / output). Mirror hooks/model-cost-advisor.js MODELS.
 const MODEL_RATES = {
-  opus:   { label: 'Opus 4.8',   in: 5, out: 25 },
-  sonnet: { label: 'Sonnet 4.6', in: 3, out: 15 },
-  haiku:  { label: 'Haiku 4.5',  in: 1, out: 5 },
+  fable:   { label: 'Fable 5',    in: 10, out: 50 },
+  opus:    { label: 'Opus 4.8',   in: 5,  out: 25 },
+  sonnet5: { label: 'Sonnet 5',   in: 3,  out: 15 },
+  sonnet:  { label: 'Sonnet 4.6', in: 3,  out: 15 },
+  haiku:   { label: 'Haiku 4.5',  in: 1,  out: 5 },
 };
 const CACHE_READ_MULT = 0.1;   // cache read ≈ 0.1× input
 const CACHE_WRITE_MULT = 1.25; // 5-minute cache write ≈ 1.25× input
@@ -40,8 +42,9 @@ const TTL_MS = 5 * 60 * 1000;
 function rateFor(model) {
   if (typeof model !== 'string') return null;
   const s = model.toLowerCase();
+  if (s.includes('fable') || s.includes('mythos')) return MODEL_RATES.fable;
   if (s.includes('haiku')) return MODEL_RATES.haiku;
-  if (s.includes('sonnet')) return MODEL_RATES.sonnet;
+  if (s.includes('sonnet')) return (s.includes('sonnet-5') || s.includes('sonnet 5')) ? MODEL_RATES.sonnet5 : MODEL_RATES.sonnet;
   if (s.includes('opus')) return MODEL_RATES.opus;
   return null;
 }

package/src/posture/deterministic-fix.js

@@ -0,0 +1,65 @@
+// Deterministic fix synthesis (#1) — for the narrow set of vulnerability classes
+// where a context-INDEPENDENT literal swap is a safe, correct fix, produce a
+// full-file replacement from the current file content. No LLM, no guessing, no
+// per-finding bloat in last-scan.json (the patch is materialized on demand by
+// synthesize_fix from the live file, not stored on every finding).
+//
+// Safety: every patch this produces is still gated by verify_fix before apply_fix
+// writes it (original finding gone + no new ≥medium + lint clean). So a swap that
+// a rule mis-attributed simply fails verification instead of landing a bad edit —
+// this module widens the deterministic-fix surface without weakening the gate.
+//
+// Returns { patch: { [relFile]: newContent }, ruleId } or null when no
+// deterministic fix applies to the finding.
+
+const JS_EXT = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const PY_EXT = /\.py$/i;
+
+// Each rule gates on the finding's cwe/family, then rewrites the whole-file
+// content. transform() returns the new content, or null when nothing changed
+// (e.g. the vulnerable token isn't literally present — then we don't claim a fix).
+const RULES = [
+  {
+    id: 'weak-hash-sha256',
+    // md5 / sha1 → sha256. Every occurrence in the file is a weak hash, so
+    // swapping them all is safe; the verifier confirms the weak-hash finding is
+    // gone and nothing worse appeared.
+    applies: (f) => /CWE-(?:327|328|916)/.test(f.cwe || '') || /weak.?hash/i.test(f.family || ''),
+    transform: (content, file) => {
+      let out = content;
+      if (JS_EXT.test(file)) {
+        out = out.replace(/(\bcreateHash\s*\(\s*['"`])(?:md5|sha1)(['"`])/gi, '$1sha256$2');
+      } else if (PY_EXT.test(file)) {
+        out = out.replace(/\bhashlib\.(?:md5|sha1)\s*\(/g, 'hashlib.sha256(');
+      }
+      return out !== content ? out : null;
+    },
+  },
+  {
+    id: 'tls-verify-on',
+    // Disabled TLS verification → enabled. rejectUnauthorized:false → true (JS),
+    // verify=False → verify=True (Python requests).
+    applies: (f) => /CWE-295/.test(f.cwe || '') || /tls.?no.?verify|cert.?(?:none|verify)/i.test(f.family || ''),
+    transform: (content, file) => {
+      let out = content;
+      if (JS_EXT.test(file)) {
+        out = out.replace(/(\brejectUnauthorized\s*:\s*)false\b/g, '$1true');
+      } else if (PY_EXT.test(file)) {
+        out = out.replace(/(\bverify\s*=\s*)False\b/g, '$1True');
+      }
+      return out !== content ? out : null;
+    },
+  },
+];
+
+export function synthesizeDeterministicPatch(finding, fileContent) {
+  if (!finding || typeof fileContent !== 'string' || !finding.file) return null;
+  for (const rule of RULES) {
+    try {
+      if (!rule.applies(finding)) continue;
+      const next = rule.transform(fileContent, finding.file);
+      if (next && next !== fileContent) return { patch: { [finding.file]: next }, ruleId: rule.id };
+    } catch { /* a single rule failing must never break synthesis */ }
+  }
+  return null;
+}