@clear-capabilities/agentic-security-scanner 0.127.0 → 0.130.0

package/src/engine.js

@@ -6,7 +6,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import * as crypto from 'node:crypto';
-import * as yaml from 'js-yaml';
+import * as yaml from './util/yaml.js';
 import { createRequire } from 'node:module';
 const _require = createRequire(import.meta.url);
 import { scanLLM } from './sast/llm.js';
@@ -143,6 +143,7 @@ import { annotateNarration } from './posture/flow-narration.js';
 import { applyPathConstraints } from './posture/path-predicates.js';
 // Phase 3 (Sentinel-parity Layer 1 + 2) — IR + interprocedural taint engine.
 import { buildProjectIR } from './ir/index.js';
+import { collectIrStats, irStatsTarget, writeIrStats } from './ir/ir-stats.js';
 import { runDeepAnalysis } from './dataflow/index.js';
 // v3 next-gen — Pillars 1, 4, 5, 6, 8, 9.
 import { annotateCloneClusters, findCloneOutliers } from './posture/semantic-clone.js';
@@ -174,6 +175,12 @@ import { applyLearnedCalibration } from './posture/triage-learning.js';
 import { annotateFormalVerification } from './dataflow/formal-verify.js';
 import { annotatePathFeasibility } from './dataflow/smt-feasibility.js';
 import { annotateProofGate } from './dataflow/proof-gate.js';
+import { applySanitizerGate } from './dataflow/sanitizer-gate.js';
+import { annotateFalsification } from './posture/falsification.js';
+import { routeModelForFinding } from './posture/model-routing.js';
+import { buildEntrypointInventory } from './posture/entrypoint-inventory.js';
+import { annotateRelevance } from './posture/relevance.js';
+import { sweepRootCauses } from './posture/root-cause-sweep.js';
 import { computeAnalysisTiers, countUnmodeledSinkCandidates } from './posture/coverage-report.js';
 import { annotatePrivacyTaint, emitDpiaArtifact } from './dataflow/privacy-taint.js';
 import { buildThreatModel as buildAutoThreatModel, persistThreatModel as persistAutoThreatModel } from './posture/threat-model-auto.js';
@@ -208,6 +215,13 @@ import { buildTrustBoundaryDiagram } from './posture/trust-boundary-diagram.js';
 import { scanConcurrency } from './posture/concurrency-checker.js';
 import { annotateBountyPrediction } from './posture/bounty-prediction.js';
 import { annotateAttackPlaybooks } from './posture/attack-playbooks.js';
+// R8: opt-in scan checkpointing/resume for the per-file loop.
+import {
+  openCheckpoint, recordFileDone, completedFiles, resumeFindings, closeCheckpoint,
+  computeRunKey, bundleShaForRunKey,
+} from './posture/scan-checkpoint.js';
+import { SCANNER_VERSION as _ENGINE_VERSION } from './posture/version.js';
+import { effectiveVersion as _effectiveRulesetVersion } from './posture/ruleset-version.js';
 
 // Disk-backed cache replacing browser sessionStorage. One JSON blob per key under ~/.claude/agentic-security/osv-cache/.
 const _CACHE_DIR = path.join(os.homedir(), '.claude', 'agentic-security', 'osv-cache');
@@ -981,7 +995,7 @@ function performASTAnalysis(fp, code) {
     try {
         babelTransformSync(code, {
             filename: fp,
-            presets: [presetReact, [presetTypescript, { isTSX: true, allExtensions: true }]],
+            presets: [presetReact, [presetTypescript, { ignoreExtensions: true }]],
             plugins: [astTaintTrackerPlugin],
             ast: false, code: false,
             babelrc: false, configFile: false,
@@ -2262,6 +2276,10 @@ function _isFalsePositiveCredential(fp, snippet, fullMatch){
 // Module-level suppression log; cleared at the start of each runFullScan invocation.
 const _suppressionLog = [];
 function _resetSuppressions(){ _suppressionLog.length = 0; }
+// R8: the per-file taint result minus the four arrays that are also appended
+// wholesale to the aggregates. Resume rebuilds those from the aggregate slices
+// so pfr[p] and the aggregates share object identity, exactly as in a normal run.
+function _pfrMetaOnly(ta){ if(!ta||typeof ta!=='object')return {}; const o={}; for(const k of Object.keys(ta)){ if(k==='findings'||k==='sources'||k==='sinks'||k==='sanitizers')continue; o[k]=ta[k]; } return o; }
 function _getSuppressions(){ return [..._suppressionLog]; }
 
 // FP-9 / Feat-4: custom rules loaded from .agentic-security/rules.{yml,yaml,json}
@@ -4627,7 +4645,7 @@ function _buildCallGraphAST(fp, code){
 
     babelTransformSync(code, {
       filename: fp,
-      presets: [presetReact, [presetTypescript, { isTSX: true, allExtensions: true }]],
+      presets: [presetReact, [presetTypescript, { ignoreExtensions: true }]],
       plugins: [callTrackerPlugin],
       ast: false, code: false,
       babelrc: false, configFile: false,
@@ -7385,7 +7403,7 @@ async function queryRegistries(components){
 
 // Node port: takes { fileContents, depFileContents } maps directly instead of a JSZip object.
 // fileContents = code files keyed by relative path; depFileContents = manifest/lockfiles keyed by relative path.
-async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
+async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null, resume=undefined}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
   // Pre-pass: build cross-file Java tainted-method index so per-file taint
   // analysis can recognize calls to user-input-returning helper methods
   // defined in OTHER files (Juliet's DataflowThruInnerClass / Vector / Stream
@@ -7395,7 +7413,75 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   const _perFileTimeoutMs = parseInt(process.env.AGENTIC_SECURITY_PER_FILE_TIMEOUT_MS || '10000', 10);
   const _fileTimings = [];
   let _filesSkipped = 0, _filesTimedOut = 0, _filesDenseSkipped = 0;
-  const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));aF.push(...scanTerraform(p,c));
+  const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];
+  // ---- R8: opt-in per-file checkpointing (AGENTIC_SECURITY_RESUME=1, or
+  // runScan({resume:true})). Default OFF, so existing behaviour is untouched.
+  // Only this loop is checkpointed; every cross-file pass below re-runs, so
+  // nothing that depends on the whole tree can be stale on resume.
+  const _ckptEnabled = (resume === undefined ? process.env.AGENTIC_SECURITY_RESUME === '1' : !!resume) && !!scanRoot;
+  let _ckpt = null; const _ckptPayloads = new Map(); let _ckptDone = new Set(); let _ckptResumed = 0, _ckptWrites = 0;
+  const _ckptAbortAfter = parseInt(process.env.AGENTIC_SECURITY_CHECKPOINT_ABORT_AFTER || '0', 10) || 0;
+  if (_ckptEnabled) {
+    try {
+      const _runKey = computeRunKey({
+        engineVersion: _ENGINE_VERSION,
+        rulesetVersion: (_effectiveRulesetVersion(scanRoot) || {}).version,
+        bundleSha: bundleShaForRunKey(),
+        fileContents, depFileContents,
+      });
+      _ckpt = openCheckpoint(scanRoot, { runKey: _runKey });
+      for (const r of resumeFindings(_ckpt)) { if (r && r.findings) _ckptPayloads.set(r.file, r.findings); }
+      _ckptDone = completedFiles(_ckpt);
+    } catch (_) { _ckpt = null; }
+  }
+  // Replay a checkpointed file's ENTIRE contribution, in the same array order
+  // and with the same object identities between pfr[p] and the aggregate arrays
+  // that an uninterrupted run would have produced.
+  const _ckptReplay = (p) => {
+    const d = _ckptPayloads.get(p);
+    if (!d) return false;
+    const c = fileContents[p]; if (!c) return false;
+    fc[p] = c;
+    const f0 = aF.length, s0 = aSrc.length, k0 = aSink.length, n0 = aSan.length;
+    for (const x of (d.findings || [])) aF.push(x);
+    for (const x of (d.routes || [])) aR.push(x);
+    for (const x of (d.sources || [])) aSrc.push(x);
+    for (const x of (d.sinks || [])) aSink.push(x);
+    for (const x of (d.sanitizers || [])) aSan.push(x);
+    for (const x of (d.logic || [])) aLogic.push(x);
+    for (const x of (d.secrets || [])) aSecrets.push(x);
+    for (const x of (d.ciphersRest || [])) aCiphersRest.push(x);
+    for (const x of (d.ciphersTransit || [])) aCiphersTransit.push(x);
+    for (const x of (d.suppressions || [])) _suppressionLog.push(x);
+    const ta = Object.assign({}, d.pfr || {});
+    ta.findings = aF.slice(f0, f0 + (d.pfrFindings || 0));
+    ta.sources = aSrc.slice(s0); ta.sinks = aSink.slice(k0); ta.sanitizers = aSan.slice(n0);
+    pfr[p] = ta;
+    _fileTimings.push({ file: p, ms: d.ms || 0 });
+    _ckptResumed++;
+    return true;
+  };
+  const _ckptRecord = (p, mk, ms, ta) => {
+    if (!_ckpt || !_ckpt.enabled) return;
+    recordFileDone(_ckpt, p, {
+      routes: aR.slice(mk.aR), findings: aF.slice(mk.aF),
+      sources: aSrc.slice(mk.aSrc), sinks: aSink.slice(mk.aSink), sanitizers: aSan.slice(mk.aSan),
+      logic: aLogic.slice(mk.aLogic), secrets: aSecrets.slice(mk.aSecrets),
+      ciphersRest: aCiphersRest.slice(mk.aCR), ciphersTransit: aCiphersTransit.slice(mk.aCT),
+      suppressions: _suppressionLog.slice(mk.sup),
+      pfr: _pfrMetaOnly(ta),
+      pfrFindings: (ta && Array.isArray(ta.findings)) ? ta.findings.length : 0,
+      ms,
+    });
+    _ckptWrites++;
+    // Fault injection for the resume test: a hard exit with no unwinding, which
+    // is what the checkpoint format has to survive. Never set in normal use.
+    if (_ckptAbortAfter > 0 && _ckptWrites >= _ckptAbortAfter) process.exit(137);
+  };
+  let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});
+    if(_ckptDone.has(p)&&_ckptReplay(p))continue;
+    const _mk={aR:aR.length,aF:aF.length,aSrc:aSrc.length,aSink:aSink.length,aSan:aSan.length,aLogic:aLogic.length,aSecrets:aSecrets.length,aCR:aCiphersRest.length,aCT:aCiphersTransit.length,sup:_suppressionLog.length};
+    try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));aF.push(...scanTerraform(p,c));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
       aF.push(...scanLlmCost(p,c));
@@ -7500,6 +7586,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
       const _ftElapsed=Date.now()-_ft0;
       if(_ftElapsed>_perFileTimeoutMs){aF.push({id:`file-timeout:${p}`,file:p,line:0,vuln:`File analysis exceeded ${_perFileTimeoutMs}ms (${_ftElapsed}ms)`,severity:'info',parser:'ENGINE',confidence:0.5,_timeout:true});_filesTimedOut++;}
       _fileTimings.push({file:p,ms:_ftElapsed});
+      _ckptRecord(p,_mk,_ftElapsed,ta);
       }catch(_){_fileTimings.push({file:p,ms:Date.now()-_ft0,error:true});}if(i%5===0)await new Promise(r=>setTimeout(r,0));}
   // Deserialization-gadget detector runs once with full-tree context (it needs
   // manifest contents to know which gadget libs are on the classpath).
@@ -7910,8 +7997,45 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   // on; opt out with AGENTIC_SECURITY_NO_PROOF_GATE=1. Demotes proven-clean /
   // proven-infeasible flows (confidence + tiers only, never severity).
   if (process.env.AGENTIC_SECURITY_NO_PROOF_GATE !== '1') {
+    // Generalised sanitizer consumption (dataflow/sanitizer-gate.js): labels
+    // findings whose flow passes a catalog sanitizer matching their family
+    // (xss/url/cmd, not just sql) so the proof gate below can demote them the
+    // same way it demotes proven-clean SQL. `sanitizersOnPath` would need to
+    // be `{ [findingId]: string[] of sanitizer callees observed on that
+    // finding's flow }`. There is nothing to build that map from: the live
+    // taint walk in dataflow/engine.js does NOT consult sanitizer catalog
+    // entries at all. `matchSinkOrSanitizer()` returns every catalog hit for
+    // a callee, but every consumer in dataflow/*.js selects only
+    // `e.kind === 'sink'` — there is no `'sanitizer'` branch anywhere in that
+    // tree. Taint is killed only by clean re-assignment of a variable
+    // (removePathAndDescendants, engine.js:374), which happens regardless of
+    // whether the RHS call is a catalog sanitizer.
+    // So this is `{}` and the gate below is INERT — not "awaiting plumbing"
+    // but awaiting the sanitizer walk itself. Making it live needs two things:
+    // (1) dataflow/engine.js honouring `kind === 'sanitizer'` at a call site,
+    // and (2) that call site's callee name threaded onto the finding
+    // alongside the trace/chain that proven-clean.js already reads.
+    const sanitizersOnPath = {};
+    _runAnnotator("applySanitizerGate", () => { applySanitizerGate(finalFindings, { sanitizersOnPath }); });
     _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
   }
+  // Addition #1 — default falsification pass. Actively tries to DISPROVE each
+  // taint-style finding by locating a context-matched control on the path, and
+  // demotes + quarantines the ones it can block. Recall-preserving (never
+  // removes a finding, never touches severity — like the proof gate). Runs
+  // AFTER proof-gate so it layers on the same demotion channel. Deterministic by
+  // default; the LLM tier is only wired when an endpoint is configured. Opt out
+  // with AGENTIC_SECURITY_NO_FALSIFICATION=1.
+  if (process.env.AGENTIC_SECURITY_NO_FALSIFICATION !== '1') {
+    _runAnnotator("annotateFalsification", () => { annotateFalsification(finalFindings, fc); });
+  }
+  // Addition #5 — capability-based model routing. Stamp each finding with the
+  // model tier a cost-sensitive fixer/triager/PoC subagent should be dispatched
+  // on for THIS vuln class (crypto/auth/critical → strongest; injection → mid;
+  // low-sev hardening → cheapest). Advisory metadata consumed at dispatch time.
+  _runAnnotator("annotateDispatchModel", () => {
+    for (const f of finalFindings) { try { f.dispatchModel = routeModelForFinding(f).model; } catch { /* advisory only */ } }
+  });
   // v3 next-gen: production-aware context ingest (Pillar 9). Must run BEFORE
   // the mitigation composite, persona prioritization, and final why-fired
   // record so those see the demotion signals.
@@ -8135,6 +8259,33 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   //   - Global timeout via AGENTIC_SECURITY_DEEP_TIMEOUT_MS (default 300_000 = 5 min)
   //   - Auto-disabled in CI unless AGENTIC_SECURITY_DEEP_IN_CI=1 is also set,
   //     so a pathological file can't hang the whole pipeline.
+  // ── IR parse-coverage sidecar (proof-corpus instrumentation, default off) ──
+  // Built ahead of the deep-mode gate so coverage is measurable without paying
+  // for taint analysis, and stashed in _sharedIR so the deep block below reuses
+  // it rather than parsing the project twice.
+  //
+  // NOTE (affects instrumented runs only, i.e. AGENTIC_SECURITY_IR_STATS set):
+  // when this block runs, buildProjectIR() happens here, BEFORE the deep-mode
+  // budget timer (t0) below is started. On an uninstrumented run, IR
+  // construction instead happens inside the timed block via the
+  // `_sharedIR || (_sharedIR = buildProjectIR(fc))` line, so its cost counts
+  // against AGENTIC_SECURITY_DEEP_TIMEOUT_MS. That means the deep budget does
+  // NOT account for parse time when stats are enabled — an instrumented run
+  // gets strictly more wall-clock for the taint analysis itself than an
+  // uninstrumented run with the same budget.
+  let _sharedIR = null;
+  const _irStatsTarget = irStatsTarget();
+  if (_irStatsTarget) {
+    try {
+      _sharedIR = buildProjectIR(fc);
+      writeIrStats(_irStatsTarget, collectIrStats(fc, _sharedIR.perFile, _sharedIR.callGraph));
+    } catch (e) {
+      // Instrumentation must never fail a scan. Surface only when debugging.
+      if (process.env.AGENTIC_SECURITY_IR_STATS_DEBUG === '1') {
+        process.stderr.write(`ir-stats: ${e && e.message}\n`);
+      }
+    }
+  }
   const _deepRequested = process.env.AGENTIC_SECURITY_DEEP === '1';
   const _inCi = !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
                    process.env.BUILDKITE || process.env.CIRCLECI || process.env.JENKINS_URL);
@@ -8144,7 +8295,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
     const budgetMs = parseInt(process.env.AGENTIC_SECURITY_DEEP_TIMEOUT_MS || '300000', 10);
     const t0 = Date.now();
     try {
-      const { perFile, callGraph } = buildProjectIR(fc);
+      const { perFile, callGraph } = _sharedIR || (_sharedIR = buildProjectIR(fc));
       // The runDeepAnalysis call is synchronous in this codebase; we can't
       // truly interrupt it without re-architecting the worklist. We pass a
       // deadlineMs hint that the inner loops check; if absent, we still cap
@@ -8541,8 +8692,30 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   let _analysisTier = null, _unmodeledSinks = null;
   try { _analysisTier = computeAnalysisTiers(Object.keys(fc)); } catch {}
   try { _unmodeledSinks = countUnmodeledSinkCandidates(fc, finalFindings); } catch {}
-  const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length}};
-  return{routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,threatModel:_threatModel,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
+  const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
+  // R8: the scan completed, so the checkpoint has been fully consumed — remove
+  // it. Anything that threw before this point leaves it in place to resume from.
+  try { closeCheckpoint(_ckpt, { complete: true }); } catch (_) {}
+  // Addition #2 — attack-surface completeness inventory (entry points → dispositions).
+  let _entrypointInventory = {}; try { _entrypointInventory = buildEntrypointInventory(fc, { routes: aR, findings: finalFindings }); } catch { _entrypointInventory = {}; }
+  // R9 + R6 — relevance scoping. Runs HERE, after every finding has been
+  // appended (multi-sink chains, cross-language chains) and after the
+  // entry-point inventory exists, so no finding escapes annotation and the
+  // attack surface it is scored against is the complete one. Recall-
+  // preserving: never removes a finding, never touches severity, and only
+  // asserts `unreachable` on positive evidence (see posture/relevance.js).
+  _runAnnotator("annotateRelevance", () => {
+    annotateRelevance(finalFindings, {
+      fileContents: fc,
+      entrypointInventory: _entrypointInventory,
+      routes: aR,
+      threatModel: _v3 && _v3.threatModel,
+    });
+  });
+  // Addition #3 — root-cause sweep: from confirmed findings, find sibling instances
+  // detectors missed, with total-count accounting. Confirmed-only (cheap by default).
+  let _rootCauseSweep = null; try { _rootCauseSweep = sweepRootCauses(finalFindings, fc); } catch { _rootCauseSweep = null; }
+  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,threatModel:_threatModel,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".
 // Orphans (no finding linkage) are bucketed by file-local heuristic so the UI shows binary states only.

package/src/integrations/index.js

@@ -12,7 +12,7 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import * as yaml from 'js-yaml';
+import * as yaml from '../util/yaml.js';
 import { statePath } from '../posture/state-dir.js';
 
 function _configPath(scanRoot) {

package/src/integrations/tickets.js

@@ -17,6 +17,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as cp from 'node:child_process';
 import { buildJiraIssue } from './index.js';
+import { escapeMarkdown } from '../util/untrusted.js';
 
 function statePath(scanRoot) {
   return path.join(scanRoot, '.agentic-security', 'tickets.json');
@@ -32,7 +33,10 @@ function writeState(scanRoot, state) {
 }
 
 function findingTitle(f) {
-  return `[${(f.severity || 'medium').toUpperCase()}] ${f.vuln || f.title || 'security finding'} at ${f.file}:${f.line}`;
+  // vuln/title are lifted from the (untrusted) scanned code — escape before
+  // they land in an issue title. See docs/AGENT_THREAT_MODEL.md path #1.
+  const label = escapeMarkdown(f.vuln) || escapeMarkdown(f.title) || 'security finding';
+  return `[${(f.severity || 'medium').toUpperCase()}] ${label} at ${f.file}:${f.line}`;
 }
 function findingBody(f) {
   const br = f.blastRadius;
@@ -43,9 +47,11 @@ function findingBody(f) {
     f.cwe ? `**CWE:** ${f.cwe}` : null,
     f.epss != null ? `**EPSS:** ${f.epss.toFixed(4)} (percentile ${(f.epssPercentile * 100).toFixed(1)}%)` : null,
     exploited,
-    f.description ? `\n${f.description}` : null,
+    f.description ? `\n${escapeMarkdown(f.description)}` : null,
     br?.narrative ? `\n**Blast radius:** ${br.narrative}` : null,
-    f.snippet ? `\n\`\`\`\n${f.snippet}\n\`\`\`` : null,
+    // snippet is attacker-authored code; escape so a crafted ``` fence or
+    // <img>/[x](url) inside it cannot break out of the code block.
+    f.snippet ? `\n\`\`\`\n${escapeMarkdown(f.snippet)}\n\`\`\`` : null,
     f.remediation ? `\n**Remediation:** ${f.remediation}` : null,
     `\n---\n_Surfaced by agentic-security · finding id: ${f.id}_`,
   ].filter(Boolean).join('\n');

package/src/ir/CLAUDE.md

@@ -11,7 +11,8 @@ consumed by `scanner/src/dataflow/` for taint analysis.
 | Python   | `parser-py-cst.js`    | Python 3.8+ stdlib `ast` via subprocess (default when available) |
 | Python   | `parser-py.js`        | Hand-rolled regex parser (fallback when python3 missing) |
 | Java     | `parser-java.js`      | `java-parser` npm package (async)                |
-| Long-tail (rust/solidity/cpp/c/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. |
+| C / C++  | `parser-cpp.js`       | Hand-rolled parser (functions, qualified names, CFG lowering). Dispatched by extension (`c/cc/cpp/cxx/h/hh/hpp/hxx`) in both `buildProjectIR` and `buildProjectIRAsync`. |
+| Long-tail (rust/solidity/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. |
 
 ## Python parser — dual-path with auto fallback
 
@@ -42,8 +43,9 @@ every dropped function.
 The CST parser (`parser-py-cst.js`) shells out to a small Python helper
 script (`parser-py.helper.py`) that uses the stdlib `ast` module — zero
 external dependencies, ships with every Python 3.8+ install. The helper
-emits the same IR shape (`{functions[{qid,name,line,params,cfg,file}],
-topLevel}`) as the regex parser. The CFG is built from the real AST, so:
+emits the same core IR shape (`{functions[{qid,name,line,params,cfg,file}],
+topLevel}`) as the regex parser, **with one exception below.** The CFG is
+built from the real AST, so:
 
 - decorators don't drop the function record
 - async def is recognized
@@ -53,6 +55,16 @@ topLevel}`) as the regex parser. The CFG is built from the real AST, so:
   `[x for x in untrusted]`
 - nested function defs become separate entries in `functions[]`
 - `def f(x=Foo(1,2))` and `db.execute(sanitize(x))` parse correctly
+- **`fn.calls` (CST path only)** — `parser-py-cst.js` derives
+  `calls: [{site, callee, args, line}]` from the CFG after parsing (statement-
+  position calls, plus calls embedded in an assign's RHS, a return/throw
+  value, or an if condition). **The regex parser (`parser-py.js`) does not
+  emit `fn.calls` at all.** In practice: a scan that falls back to the regex
+  parser (no `python3` on PATH, too old, or the helper failing) still
+  produces findings, but Python loses cross-function (interprocedural) taint
+  tracking for that run — `tabulation.js`, `dataflow/index.js` and
+  `callgraph.js` all read `fn.calls`, and an absent/empty array there means a
+  function's call sites are invisible to them, same as if it called nothing.
 
 ### Cost
 
@@ -70,12 +82,41 @@ topLevel}`) as the regex parser. The CFG is built from the real AST, so:
 - `python3` / `python` not on PATH
 - Python version < 3.8
 - helper script's stdin JSON corruption
-- helper subprocess timeout (10 s for the whole batch — generous)
+- helper subprocess timeout (30 s for the whole batch — generous;
+  `AGENTIC_SECURITY_PY_BATCH_TIMEOUT_MS`)
+- capability probe timeout (5 s; `AGENTIC_SECURITY_PY_PROBE_TIMEOUT_MS`)
 - helper output isn't parseable JSON
 
 Each of these is a real failure mode; the regex fallback keeps the scan
 producing findings instead of returning empty.
 
+### Fallbacks are recorded, not silent
+
+Every fallback above calls `noteParserDegradation(reason)`. Read it with
+`pythonParserDegradation()` and clear it with `resetPythonParserDegradation()`
+(both re-exported from `./index.js`).
+
+This exists because a silent fallback is indistinguishable from a detection
+regression: no `fn.calls` means no interprocedural Python taint, so a test
+that *depends* on interprocedural analysis just stops finding anything. The
+CVE-replay corpus gate (`bench/cve-replay/runner.mjs`) resets the record
+before each deep Python entry and checks it after, reporting `env-error` and
+exiting 3 instead of scoring a phantom `pre:FN`. It had already produced a
+real flake: exit 1 `REGRESSED` then exit 0 on the same clean tree, minutes
+apart, purely from machine load.
+
+Two hardening changes back this:
+- The probe timeout is **not cached**. `spawnSync` reports a timeout via
+  `r.error.code === 'ETIMEDOUT'` with a null status — that is a load symptom,
+  not "python is missing", so it does not poison `_capability` for the rest
+  of the process. Only a genuine `no-python3-on-path` is cached.
+- Budgets were raised (1.5 s → 5 s probe, 10 s → 30 s batch) and made
+  env-tunable for constrained runners.
+
+If you add a new caller that requires the CST path, check
+`pythonParserDegradation()` rather than assuming the parse you got is the
+parse you asked for.
+
 ### What CST models (and the one remaining limit)
 
 The helper now lowers — and the dataflow engine propagates taint through — all
@@ -176,3 +217,7 @@ down enterprise runners sometimes don't. Targets for retirement:
   via the optional telemetry surface.
 - Or, the `AGENTIC_SECURITY_PY_PARSER` env defaults to `cst` (strict
   mode) for one release with no customer complaint tickets filed.
+- The `fn.calls` gap above is a concrete, ongoing argument for retirement:
+  every fallback to the regex parser is now also a silent loss of Python
+  interprocedural analysis, not just the older, vaguer "some constructs get
+  dropped" cost.

package/src/ir/call-sites.js

@@ -0,0 +1,66 @@
+// Shared call-site extraction.
+//
+// Reads only the IR contract documented in ./CLAUDE.md — it walks cfg.nodes and
+// collects call expressions from `call`, `assign`, `return`, `throw` and `if`
+// nodes — so nothing here is language-specific.
+//
+// It lives in one place deliberately. Phase 1 put a resolver guard at a single
+// call site; the next task re-broke it and it had to be moved into callgraph.js.
+// Five copies of this would recreate that exactly.
+
+// Recursively collect every 'call' subexpression inside a lowered expr tree
+// (a call's own args can themselves contain calls, e.g. `foo(bar(x))`).
+// `elements` (array literals) and `props` (object literals) are walked too —
+// added when parser-py-cst.js's own copy of this walker was folded in here,
+// so that e.g. `xs = [foo(x), bar(y)]` still surfaces both call sites for
+// Python. Harmless for other languages: those fields are simply absent from
+// their expr shapes.
+function _collectCallExprs(expr, out) {
+  if (!expr || typeof expr !== 'object') return;
+  if (expr.kind === 'call') {
+    out.push(expr);
+    for (const a of expr.args || []) _collectCallExprs(a, out);
+    return;
+  }
+  if (Array.isArray(expr.parts)) for (const p of expr.parts) _collectCallExprs(p, out);
+  if (Array.isArray(expr.branches)) for (const b of expr.branches) _collectCallExprs(b, out);
+  if (Array.isArray(expr.elements)) for (const e of expr.elements) _collectCallExprs(e, out);
+  if (Array.isArray(expr.props)) for (const p of expr.props) _collectCallExprs(p && p.value, out);
+  if (expr.left) _collectCallExprs(expr.left, out);
+  if (expr.right) _collectCallExprs(expr.right, out);
+  if (expr.object) _collectCallExprs(expr.object, out);
+}
+
+// Build the `fn.calls` list documented at parser-js.js:19 —
+// `[{ site, callee, args, line }]` — from the CFG. A call can appear at
+// statement position (its own 'call' node) or embedded in another node's
+// expression (an assignment's RHS, a return/throw value, an if condition —
+// `char* p = getenv("CMD")` is exactly the source-introducing shape the
+// taint engine needs to see and must not be missed just because it isn't a
+// bare statement).
+//
+// Known boundaries (not modeled): a call in a `for`-loop's step expression
+// (`for (;; advance(p))`) is not surfaced — the CFG only lowers the loop's
+// test into the `if` node's `cond`; a call as an assignment's LHS/target
+// (not a real C++ shape but a malformed one a fuzz input could produce) is
+// never inspected, only `source`; and a `kind: 'unknown'` statement (a
+// construct `_lowerStmt` couldn't classify) contributes no call sites even
+// if it textually contains one.
+export function callSitesFromCfg(cfg) {
+  const sites = [];
+  for (const [nodeId, node] of Object.entries((cfg && cfg.nodes) || {})) {
+    if (!node) continue;
+    let root = null;
+    if (node.kind === 'call') root = { kind: 'call', callee: node.callee, args: node.args };
+    else if (node.kind === 'assign') root = node.source;
+    else if (node.kind === 'return' || node.kind === 'throw') root = node.value;
+    else if (node.kind === 'if') root = node.cond;
+    if (!root) continue;
+    const found = [];
+    _collectCallExprs(root, found);
+    for (const c of found) {
+      sites.push({ site: nodeId, callee: c.callee, args: c.args, line: node.line });
+    }
+  }
+  return sites;
+}