@clear-capabilities/agentic-security-scanner 0.128.1 → 0.132.0

package/src/ir/parser-cs.js

@@ -26,6 +26,7 @@
 // parser-py-cst.js) once we have a dotnet capability probe.
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
 
 const METHOD_RE = new RegExp(
   '(?:^|[\\s;{}])(?:public|private|protected|internal|static|virtual|override|async|sealed|abstract|new|readonly|partial)' +
@@ -249,10 +250,12 @@ export function parseCSharpFile(file, code) {
     }
     nodes[prev].succ.push('exit');
     nodes.exit.pred.push(prev);
+    const cfg = { entry: 'entry', exit: 'exit', nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry: 'entry', exit: 'exit', nodes },
+      cfg,
+      calls: callSitesFromCfg(cfg),
     });
     METHOD_RE.lastIndex = extracted.end + 1;
   }

package/src/ir/parser-go.js

@@ -21,6 +21,7 @@
 //   - struct field assignments (x.Field = val) beyond simple dotted targets
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
 
 const FUNC_RE = new RegExp(
   '(?:^|[\\n;{}])\\s*func\\s+' +
@@ -400,10 +401,12 @@ export function parseGoFile(file, code) {
     const exit = _addNode(nodes, { kind: 'exit', line: startLine });
     const tail = _buildCfg(extracted.body, nodes, entry, startLine + 1);
     _link(nodes, tail, exit);
+    const cfg = { entry, exit, nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry, exit, nodes },
+      cfg,
+      calls: callSitesFromCfg(cfg),
     });
     FUNC_RE.lastIndex = extracted.end + 1;
   }

package/src/ir/parser-js.js

@@ -397,7 +397,19 @@ export function parseJsFile(file, code) {
   try {
     babelTransformSync(code, {
       filename: file,
-      presets: [presetReact, [presetTypescript, { isTSX: true, allExtensions: true }]],
+      // Babel 8 removed preset-typescript's .isTSX/.allExtensions. ignoreExtensions
+      // is the documented replacement: parse every file with the same TS grammar
+      // regardless of extension. JSX stays enabled via preset-react, so .js files
+      // containing JSX still parse — which .isTSX/.allExtensions guaranteed before.
+      presets: [presetReact, [presetTypescript, { ignoreExtensions: true }]],
+      // Decorators are SYNTAX we must accept, never transform — without them the
+      // parser rejects the whole file and every finding in it silently disappears.
+      // Measured on one real target: 201 JS files unparseable, all decorator-using
+      // framework code. 'decorators-legacy' covers the framework and TypeScript
+      // parameter forms; 'decoratorAutoAccessors' adds the modern `accessor` field.
+      // The modern 'decorators' variant was rejected: it cannot parse TS parameter
+      // decorators, so it would trade one blind spot for another.
+      parserOpts: { plugins: ['decorators-legacy', 'decoratorAutoAccessors'] },
       plugins: [plugin],
       ast: false, code: false, babelrc: false, configFile: false,
     });

package/src/ir/parser-kt.js

@@ -21,6 +21,7 @@
 // gradle helper) is the upgrade path.
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
 
 const FUN_RE = new RegExp(
   '(?:^|[\\s;{}])(?:public|private|internal|protected|inline|suspend|tailrec|operator|infix|open|abstract|override|final|external)?' +
@@ -247,10 +248,12 @@ export function parseKotlinFile(file, code) {
     }
     nodes[prev].succ.push('exit');
     nodes.exit.pred.push(prev);
+    const cfg = { entry: 'entry', exit: 'exit', nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry: 'entry', exit: 'exit', nodes },
+      cfg,
+      calls: callSitesFromCfg(cfg),
     });
     FUN_RE.lastIndex = extracted.end + 1;
   }

package/src/ir/parser-php.js

@@ -18,9 +18,10 @@
 //   - control flow (if/for/while/switch) — body is straight-line
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
 
 const FUNC_RE = new RegExp(
-  '(?:^|[\\n;{}])\\s*' +
+  '(?:^|[\\n;{}]|<\\?php|<\\?)\\s*' +
   '(?:(?:public|private|protected|static|abstract|final)\\s+)*' +
   'function\\s+' +
   '([A-Za-z_]\\w*)' +                  // function name (g1)
@@ -319,12 +320,18 @@ export function parsePhpFile(file, code) {
     const exit = _addNode(nodes, { kind: 'exit', line: startLine });
     const tail = _buildCfg(extracted.body, nodes, entry, startLine + 1);
     _linkNodes(nodes, tail, exit);
+    const cfg = { entry, exit, nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry, exit, nodes },
+      cfg,
+      calls: callSitesFromCfg(cfg),
     });
-    FUNC_RE.lastIndex = extracted.end + 1;
+    // Don't skip past the closing brace: for `<?php function h(){...} function m(){...}`
+    // that brace is the only boundary character available to anchor the next
+    // function's match (there's no newline/semicolon between them), and advancing
+    // past it here would make the following function declaration unmatchable.
+    FUNC_RE.lastIndex = extracted.end;
   }
   return functions.length ? { file, functions, topLevel: null } : null;
 }

package/src/ir/parser-py-cst.js

@@ -32,6 +32,7 @@ import * as cp from 'node:child_process';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { callSitesFromCfg } from './call-sites.js';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const HELPER_PATH = path.join(HERE, 'parser-py.helper.py');
@@ -41,15 +42,39 @@ const HELPER_PATH = path.join(HERE, 'parser-py.helper.py');
 //   { ok: false, reason: '...' }                                   on failure
 let _capability = null;
 
+// Degradation record (BLOCKER 1 — corpus-gate flakiness).
+//
+// A CST→regex fallback is invisible to callers but silently removes Python
+// interprocedural analysis for that run (`parser-py.js` emits no `fn.calls`
+// — see ./CLAUDE.md). That turned a loaded machine into a phantom detection
+// regression in the CVE-replay gate. Callers that care (the corpus runner)
+// reset this before a scan and check it after, so a degraded parser is
+// reported as an ENVIRONMENT error rather than scored as a false negative.
+let _degradation = null;
+export function noteParserDegradation(reason) { if (!_degradation) _degradation = reason; }
+export function pythonParserDegradation() { return _degradation; }
+export function resetPythonParserDegradation() { _degradation = null; }
+
+// Probe timeout. 1500 ms was too tight: on a machine still busy from a prior
+// test run, `python3 --version` genuinely took >1.5 s, the probe failed, and
+// because the result is cached process-wide EVERY later scan in that process
+// silently used the regex parser. Timeouts are also no longer cached (see
+// below), so a transient spike can't poison the whole process.
+const PROBE_TIMEOUT_MS = Number(process.env.AGENTIC_SECURITY_PY_PROBE_TIMEOUT_MS || 5000);
+
 export function probePythonAvailable() {
   if (_capability) return _capability;
+  let sawTimeout = false;
   // Try the canonical names in order. macOS / most Linux have python3;
   // some Linuxes only have python. We don't accept python2 (no f-strings).
   for (const bin of ['python3', 'python']) {
     let r;
     try {
-      r = cp.spawnSync(bin, ['--version'], { encoding: 'utf8', timeout: 1500 });
+      r = cp.spawnSync(bin, ['--version'], { encoding: 'utf8', timeout: PROBE_TIMEOUT_MS });
     } catch { continue; }
+    // spawnSync sets .error (ETIMEDOUT) and a null status when the timeout
+    // fires. That is a load symptom, not "python is missing" — don't cache it.
+    if (r.error && (r.error.code === 'ETIMEDOUT' || r.signal)) { sawTimeout = true; continue; }
     if (r.status !== 0) continue;
     // Output format: "Python 3.12.2" (or 2.x — reject those).
     const m = /Python\s+(\d+)\.(\d+)\.(\d+)/.exec(r.stdout || r.stderr || '');
@@ -60,6 +85,10 @@ export function probePythonAvailable() {
     _capability = { ok: true, python: bin, version: `${m[1]}.${m[2]}.${m[3]}` };
     return _capability;
   }
+  if (sawTimeout) {
+    // Uncached: the next call re-probes once the machine is less busy.
+    return { ok: false, reason: 'probe-timeout', transient: true };
+  }
   _capability = { ok: false, reason: 'no-python3-on-path' };
   return _capability;
 }
@@ -87,8 +116,8 @@ export function parsePythonFile(file, raw) {
 export function parsePythonFilesBatch(entries) {
   if (!Array.isArray(entries) || entries.length === 0) return [];
   const cap = probePythonAvailable();
-  if (!cap.ok) return null;
-  if (!fs.existsSync(HELPER_PATH)) return null;
+  if (!cap.ok) { noteParserDegradation(`python-unavailable:${cap.reason}`); return null; }
+  if (!fs.existsSync(HELPER_PATH)) { noteParserDegradation('helper-script-missing'); return null; }
   const filtered = entries.filter(e =>
     e && typeof e.file === 'string' && /\.py$/i.test(e.file) &&
     typeof e.content === 'string' && e.content.length <= 1_000_000
@@ -96,29 +125,34 @@ export function parsePythonFilesBatch(entries) {
   if (filtered.length === 0) return [];
   let payload;
   try { payload = JSON.stringify(filtered); }
-  catch { return null; }
+  catch { noteParserDegradation('payload-serialize-failed'); return null; }
   let r;
   try {
     r = cp.spawnSync(cap.python, [HELPER_PATH], {
       input: payload,
       encoding: 'utf8',
-      // 10 s for a whole batch. The helper itself processes files in a
-      // simple linear loop; on a 100-file repo a single-digit-second
-      // budget is plenty. If a customer hits the timeout, the regex
-      // parser fallback catches them.
-      timeout: 10_000,
+      // 30 s for a whole batch. The helper processes files in a simple
+      // linear loop; single-digit seconds is plenty on a 100-file repo, but
+      // the budget has to survive a machine that is busy with something else
+      // (this was one half of the corpus-gate flakiness — a loaded box blew
+      // the old 10 s budget and silently dropped to the regex parser).
+      // Tunable for constrained runners.
+      timeout: Number(process.env.AGENTIC_SECURITY_PY_BATCH_TIMEOUT_MS || 30_000),
       maxBuffer: 64 * 1024 * 1024,
     });
   } catch (e) {
     if (process.env.AGENTIC_SECURITY_PY_PARSER_DEBUG === '1') {
       process.stderr.write(`parser-py-cst: spawn failed — ${e.message}\n`);
     }
+    noteParserDegradation(`helper-spawn-failed:${e.message}`);
     return null;
   }
   if (r.status !== 0 || !r.stdout) {
     if (process.env.AGENTIC_SECURITY_PY_PARSER_DEBUG === '1') {
       process.stderr.write(`parser-py-cst: helper exit=${r.status} stderr=${r.stderr || ''}\n`);
     }
+    noteParserDegradation(r.error && (r.error.code === 'ETIMEDOUT' || r.signal)
+      ? 'helper-batch-timeout' : `helper-exit-${r.status}`);
     return null;
   }
   let out;
@@ -127,9 +161,27 @@ export function parsePythonFilesBatch(entries) {
     if (process.env.AGENTIC_SECURITY_PY_PARSER_DEBUG === '1') {
       process.stderr.write(`parser-py-cst: helper output not JSON — ${e.message}\n`);
     }
+    noteParserDegradation('helper-output-not-json');
     return null;
   }
-  return out;
+  return _annotateCalls(out);
+}
+
+// Populate `fn.calls` (post-parse, from the CFG) on every function of every
+// file entry the helper returned. Done here rather than in the helper
+// itself. Uses the shared `callSitesFromCfg` (./call-sites.js) — this used
+// to be a second, drifted copy of that walker; folded into the shared module
+// (which gained `elements`/`props` traversal to match) once the two were
+// verified to produce identical output for Python.
+function _annotateCalls(entries) {
+  if (!Array.isArray(entries)) return entries;
+  for (const entry of entries) {
+    if (!entry || !Array.isArray(entry.functions)) continue;
+    for (const fn of entry.functions) {
+      if (fn && fn.cfg) fn.calls = callSitesFromCfg(fn.cfg);
+    }
+  }
+  return entries;
 }
 
 // Reset the cache — for tests.

package/src/ir/tree-sitter-loader.js

@@ -1,7 +1,19 @@
 // Tree-sitter parser loader (roadmap #8) — OPTIONAL, runtime-lazy, degrades.
 //
 // web-tree-sitter + tree-sitter-wasms are OPTIONAL dependencies (pinned to an
-// ABI-matched pair: web-tree-sitter 0.20.8 ↔ tree-sitter-wasms 0.1.13). They
+// ABI-matched pair: web-tree-sitter 0.20.8 ↔ tree-sitter-wasms 0.1.13).
+//
+// DO NOT bump web-tree-sitter on its own. Verified 2026-07-27 against 0.26.11:
+// every grammar in tree-sitter-wasms 0.1.13 fails to instantiate (empty Error
+// from Language.load), because the prebuilt grammars target the older grammar
+// ABI. 0.1.13 is the newest tree-sitter-wasms published, so there is no matched
+// pair to upgrade TO — bumping the runtime silently drops all tree-sitter
+// language support (rust, solidity, go, swift, cpp, c) rather than failing loudly.
+// Revisit only when tree-sitter-wasms publishes grammars built for the newer ABI.
+//
+// 0.25+ also moved Language off the Parser class to a top-level named export, so
+// that migration needs _ensureRuntime/getParserFor updated together with the pin.
+// They
 // are NOT bundled into dist (the build marks them `--external`), so the
 // committed bundle stays self-contained and small; this loader requires them
 // lazily at runtime and returns null when they're absent. That keeps the

package/src/llm-validator/index.js

@@ -45,6 +45,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { statePath, ensureStateDir, safeWriteState } from '../posture/state-dir.js';
+import { redactSecrets } from './redact.js';
 
 // Bump on every prompt change so the cache invalidates. Exported as a
 // stable public symbol (premortem 4R-15) so the validator-cache GC subcommand
@@ -195,12 +196,18 @@ function renderPrompt(finding, fileContents, challenge, nonce) {
     : `${finding.file}:${finding.line} [single-point detection, no cross-file path]`;
   // Defensive: strip the delimiter literally from the untrusted excerpt so
   // an attacker can't close it early by embedding our token.
-  const sterileContext = String(context || '')
+  let sterileContext = String(context || '')
     .replace(/BEGIN-UNTRUSTED-CODE-EXCERPT-[a-f0-9]+/gi, '[stripped-delimiter]')
     .replace(/END-UNTRUSTED-CODE-EXCERPT-[a-f0-9]+/gi, '[stripped-delimiter]');
-  const sterileSnippet = String(finding.snippet || '')
+  let sterileSnippet = String(finding.snippet || '')
     .replace(/[\r\n]+/g, ' ')
     .slice(0, 400);
+  // R10 — redact likely live credentials (API keys, tokens, private keys,
+  // connection-string passwords, ...) out of BOTH excerpts before anything
+  // leaves the machine. This is the last choke point before the prompt is
+  // assembled — everything downstream sees only redacted text.
+  sterileContext = redactSecrets(sterileContext).text;
+  sterileSnippet = redactSecrets(sterileSnippet).text;
   return PROMPT_TEMPLATE
     .replace(/\{\{nonce\}\}/g, nonce)
     .replace(/\{\{challenge\}\}/g, challenge)

package/src/llm-validator/redact.js

@@ -0,0 +1,157 @@
+// R10 — secret redaction for the Layer-3 LLM validator prompt.
+//
+// The validator sends real source-code excerpts to a model API. Those
+// excerpts can contain live credentials that were hardcoded in the scanned
+// project (API keys, tokens, private keys, connection-string passwords).
+// This module strips likely secret VALUES while preserving the surrounding
+// code STRUCTURE (variable name, operator, quotes, call shape) so the
+// validator can still reason about the finding.
+//
+// Design tension (this is the point of the module): redact too little and a
+// live key leaves the machine; redact too aggressively and the validator
+// loses the context it needs to judge a finding. We resolve it by only
+// touching values that match a specific credential shape — never whole
+// lines, never identifiers, never ordinary string literals — and by biasing
+// every heuristic toward leaving normal code alone (see the exclusions on
+// the entropy pass below).
+//
+// Pure function, no I/O, no logging of the redacted material itself (only a
+// count is returned) — callers must not print the input/output around this
+// call in a way that defeats the point.
+
+const REDACTED_PLACEHOLDER = '[REDACTED-SECRET]';
+
+// Case-insensitive names that, when assigned a quoted string, are treated as
+// carrying a credential. Exact identifiers only (word-boundary matched) —
+// e.g. `password_field` does NOT match `password` because `_` is a word
+// character and blocks the trailing \b.
+const SECRET_KEY_NAMES = [
+  'apiKey',
+  'api_key',
+  'secret',
+  'token',
+  'password',
+  'passwd',
+  'client_secret',
+  'access_key',
+  'private_key',
+  'authorization',
+];
+
+const KEY_VALUE_RE = new RegExp(
+  '(\\b(?:' + SECRET_KEY_NAMES.join('|') + ')\\b)(\\s*[:=]\\s*)([\'"`])([^\'"`]+)\\3',
+  'gi'
+);
+
+// `Authorization: Bearer <blob>` — the blob only, scheme word survives.
+const BEARER_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
+
+// PEM private-key blocks, any key type (`RSA PRIVATE KEY`, `EC PRIVATE KEY`,
+// `PRIVATE KEY`, …). BEGIN/END markers are preserved so the excerpt still
+// reads as "a private key was here"; the body is collapsed to one placeholder.
+const PEM_RE = /-----BEGIN\s+[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END\s+[A-Z0-9 ]*PRIVATE KEY-----/gi;
+
+// `scheme://user:PASSWORD@host` — only the password segment is replaced;
+// scheme, user, and host/path survive.
+const CONN_STRING_RE = /(:\/\/[^:/\s'"@]+:)([^@/\s'"]+)(@)/g;
+
+// Quoted string literals (single/double/backtick), escape-aware, so the
+// entropy pass below can inspect literal contents without being fooled by
+// an escaped quote inside the literal.
+const QUOTED_STRING_RE = /'(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*"|`(?:\\.|[^`\\])*`/g;
+
+// Minimum length before a bare string literal is even considered for the
+// entropy pass. Conservative on purpose — short strings are indistinguishable
+// from ordinary code tokens.
+const ENTROPY_MIN_LENGTH = 24;
+const ENTROPY_MIN_BITS_PER_CHAR = 4.0;
+// base64url-ish charset only. Anything outside this (colons, slashes,
+// semicolons, spaces, commas — e.g. a `data:...;base64,...` URI or a
+// sentence) is left alone by construction, not by a special-cased exclusion.
+const ENTROPY_CHARSET_RE = /^[A-Za-z0-9+/_=-]+$/;
+// Pure-hex strings (git SHAs, color codes, hash digests) are common in
+// ordinary code and have materially lower entropy-per-symbol than a random
+// base64 secret at the same bit strength; treat them as non-secret.
+const HEX_ONLY_RE = /^[0-9a-fA-F]+$/;
+
+function shannonEntropy(str) {
+  const freq = new Map();
+  for (const ch of str) freq.set(ch, (freq.get(ch) || 0) + 1);
+  const len = str.length;
+  let entropy = 0;
+  for (const count of freq.values()) {
+    const p = count / len;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+
+function looksLikeHighEntropySecret(inner) {
+  if (inner === REDACTED_PLACEHOLDER) return false; // already redacted upstream
+  if (inner.length < ENTROPY_MIN_LENGTH) return false;
+  if (!ENTROPY_CHARSET_RE.test(inner)) return false;
+  if (HEX_ONLY_RE.test(inner)) return false; // e.g. git SHA — leave alone
+  return shannonEntropy(inner) >= ENTROPY_MIN_BITS_PER_CHAR;
+}
+
+// redactSecrets(text) -> { text, redactions }
+//
+// Runs a fixed sequence of passes, most-specific first (PEM blocks and
+// connection strings have unambiguous shapes; the entropy pass is the most
+// general and runs last so it never fights with a more specific rule over
+// the same span). Order does not affect whether a real secret is caught —
+// only how many passes independently flag it — so a slight redaction-count
+// overlap on an already-redacted span is harmless (the value is still gone
+// exactly once; see KEY_VALUE_RE + BEARER_RE interaction for the one case
+// where both can fire on the same literal).
+export function redactSecrets(text) {
+  if (typeof text !== 'string' || text.length === 0) {
+    return { text: typeof text === 'string' ? text : '', redactions: 0 };
+  }
+
+  let redactions = 0;
+  let out = text;
+
+  // 1. PEM private-key blocks.
+  out = out.replace(PEM_RE, (m) => {
+    redactions++;
+    const begin = (m.match(/^-----BEGIN\s+[A-Z0-9 ]*PRIVATE KEY-----/i) || [])[0] || '-----BEGIN PRIVATE KEY-----';
+    const end = (m.match(/-----END\s+[A-Z0-9 ]*PRIVATE KEY-----$/i) || [])[0] || '-----END PRIVATE KEY-----';
+    return `${begin}\n${REDACTED_PLACEHOLDER}\n${end}`;
+  });
+
+  // 2. Connection-string passwords.
+  out = out.replace(CONN_STRING_RE, (_m, pre, _pass, at) => {
+    redactions++;
+    return `${pre}${REDACTED_PLACEHOLDER}${at}`;
+  });
+
+  // 3. Bearer tokens.
+  out = out.replace(BEARER_RE, () => {
+    redactions++;
+    return `Bearer ${REDACTED_PLACEHOLDER}`;
+  });
+
+  // 4. `secretName = "value"` / `secretName: "value"` assignments.
+  //
+  // Special case: `authorization: "Bearer <blob>"` — keep the `Bearer `
+  // scheme word (already handled generically by BEARER_RE above; this just
+  // keeps this pass from re-swallowing it when it runs on the same span).
+  out = out.replace(KEY_VALUE_RE, (_m, keyName, opWs, quote, value) => {
+    redactions++;
+    const bearer = /^(Bearer\s+)(.+)$/i.exec(value);
+    if (bearer) return `${keyName}${opWs}${quote}${bearer[1]}${REDACTED_PLACEHOLDER}${quote}`;
+    return `${keyName}${opWs}${quote}${REDACTED_PLACEHOLDER}${quote}`;
+  });
+
+  // 5. Long high-entropy string literals not caught by a more specific rule.
+  out = out.replace(QUOTED_STRING_RE, (m) => {
+    const q = m[0];
+    const inner = m.slice(1, -1);
+    if (!looksLikeHighEntropySecret(inner)) return m;
+    redactions++;
+    return `${q}${REDACTED_PLACEHOLDER}${q}`;
+  });
+
+  return { text: out, redactions };
+}

package/src/mcp/tools.js

@@ -22,8 +22,8 @@ import { verifyLastScan } from '../posture/integrity.js';
 import { analyzeTranscript, formatCacheReport, renderCacheStatusLine } from '../posture/cache-economics.js';
 import { redactString, redactFinding } from './redact.js';
 
-// Lazy-loaded: these transitively pull in npm packages (fast-glob,
-// @babel/core) that aren't available in the plugin-cache install path
+// Lazy-loaded: these transitively pull in npm packages (@babel/core and
+// friends) that aren't available in the plugin-cache install path
 // (no node_modules). Deferring keeps the MCP server bootable everywhere;
 // the import only runs when a tool that needs them is actually called.
 let _runScan;