@clear-capabilities/agentic-security-scanner 0.128.1 → 0.132.0

package/dist/113.index.js

@@ -1,7 +1,220 @@
 export const id = 113;
-export const ids = [113,11];
+export const ids = [113,238,526];
 export const modules = {
 
+/***/ 2238:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   I3: () => (/* binding */ recordFixAttempt),
+/* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
+/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
+/* harmony export */ });
+/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+// Time-to-validated-fix (R5, the reporting half).
+//
+// `verifyFix` already RUNS the stages and `test-runner.js` already times the
+// slowest one. What did not exist was anything durable to read afterwards, so
+// "how long does a fix actually take to validate" had no answer from real runs
+// — only an estimate (`time-to-fix.js` guesses engineering hours from family
+// and patch shape, before anything runs). This module is the opposite: it
+// records what the pipeline observed and reports the distribution.
+//
+// THE HONESTY RULES, which are most of why this file is longer than a mean:
+//
+//  1. A failed attempt is NOT a data point about how long a fix takes. Fixes
+//     that fail verification fail fast (a re-scan that still sees the finding
+//     never reaches the test suite), so blending them into one average makes
+//     the pipeline look faster the worse it performs. Validated and failed
+//     attempts are summarised separately and never merged.
+//
+//  2. "Tests skipped" is not "tests passed". A project with no detectable
+//     suite can reach `ok:true` having run only the re-scan and the linter.
+//     That is a weaker claim than a fix whose suite executed, and it is also
+//     much faster, so counting the two together would quietly deflate the
+//     headline. They get their own bucket: `validated` means the suite ran and
+//     passed, `validatedWithoutTests` means there was no suite to run.
+//
+//  3. Every figure carries its `n`, and a percentile computed from too few
+//     samples is labelled unreliable rather than omitted or silently reported.
+//     Same precedent as the accuracy scorecard's `{n, d}` rates: a number
+//     without its denominator is not a measurement.
+//
+// Storage is append-only JSONL at `<scanRoot>/.agentic-security/fix-metrics.jsonl`,
+// one record per verification attempt. Nothing here throws (posture
+// convention) — an unwritable or corrupt log degrades to "no metrics", never
+// to a failed verification.
+
+
+
+
+
+const STATE_DIR = '.agentic-security';
+const LOG_FILE = 'fix-metrics.jsonl';
+
+// Below this many samples a percentile is an artifact of the sample, not a
+// property of the pipeline. Reported anyway (hiding it invites re-deriving it
+// wrong downstream) but flagged, so a caller cannot quote it as settled.
+const RELIABLE_N = 10;
+
+// The stages verifyFix runs, in execution order. Kept here so the recorder and
+// the summariser cannot drift apart on stage naming.
+const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
+
+function _logPath(scanRoot) {
+  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR, LOG_FILE);
+}
+
+/**
+ * Append one verification attempt. Best-effort and silent on failure: metrics
+ * must never be able to fail a fix that otherwise verified.
+ *
+ * @returns {boolean} whether the record was written (for tests, not callers).
+ */
+function recordFixAttempt(scanRoot, record) {
+  if (!scanRoot || !record || typeof record !== 'object') return false;
+  try {
+    const dir = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR);
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    // One writeSync of one newline-terminated line: a concurrent reader sees
+    // whole records or nothing, and a torn tail is dropped on read.
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Read every well-formed attempt. A line that does not parse is skipped, not
+ * fatal — the last line of an interrupted write is the expected case.
+ */
+function loadFixAttempts(scanRoot) {
+  try {
+    const raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(_logPath(scanRoot), 'utf8');
+    const out = [];
+    for (const line of raw.split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const rec = JSON.parse(line);
+        if (rec && typeof rec === 'object' && typeof rec.totalMs === 'number') out.push(rec);
+      } catch { /* torn or hand-edited line — drop it, keep the rest */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
+// Nearest-rank percentile over an ascending array. Nearest-rank rather than
+// interpolated because these are observed durations, and an interpolated p50
+// reports a duration that no run actually took.
+function _pct(sorted, p) {
+  if (!sorted.length) return null;
+  const rank = Math.ceil((p / 100) * sorted.length);
+  return sorted[Math.min(sorted.length - 1, Math.max(0, rank - 1))];
+}
+
+function _dist(values) {
+  const v = values.filter(x => typeof x === 'number' && Number.isFinite(x) && x >= 0).sort((a, b) => a - b);
+  if (!v.length) return { n: 0, minMs: null, p50Ms: null, p90Ms: null, maxMs: null, meanMs: null, reliable: false };
+  const sum = v.reduce((a, b) => a + b, 0);
+  return {
+    n: v.length,
+    minMs: v[0],
+    p50Ms: _pct(v, 50),
+    p90Ms: _pct(v, 90),
+    maxMs: v[v.length - 1],
+    meanMs: Math.round(sum / v.length),
+    // Says whether the percentiles above may be quoted, not whether the count
+    // is real. n and min/max/mean are exact at any sample size.
+    reliable: v.length >= RELIABLE_N,
+  };
+}
+
+// Which bucket an attempt belongs to. Deliberately total: every attempt lands
+// in exactly one, so the bucket counts always sum to the attempt count and a
+// mis-shaped record cannot silently vanish from the denominator.
+function bucketOf(a) {
+  if (!a?.ok) return 'failed';
+  return a.testsRan ? 'validated' : 'validatedWithoutTests';
+}
+
+/**
+ * Summarise a set of attempts into the reported distribution.
+ *
+ * `validated` is the headline: attempts that verified AND whose test suite
+ * actually ran and passed. The other two buckets exist so that headline cannot
+ * be inflated by counting weaker or faster outcomes inside it.
+ */
+function summarizeFixDurations(attempts) {
+  const all = Array.isArray(attempts) ? attempts : [];
+  const buckets = { validated: [], validatedWithoutTests: [], failed: [] };
+  for (const a of all) buckets[bucketOf(a)].push(a);
+
+  const byStage = {};
+  for (const stage of FIX_STAGES) {
+    // Per-stage timings come from validated runs only. A stage's duration in a
+    // failed run is truncated by the failure (the pipeline stops), so mixing
+    // them in would understate every stage after the first failure point.
+    byStage[stage] = _dist(buckets.validated.map(a => a?.stages?.[stage]));
+  }
+
+  return {
+    attempts: all.length,
+    counts: {
+      validated: buckets.validated.length,
+      validatedWithoutTests: buckets.validatedWithoutTests.length,
+      failed: buckets.failed.length,
+    },
+    timeToValidatedFix: _dist(buckets.validated.map(a => a.totalMs)),
+    timeToValidatedFixWithoutTests: _dist(buckets.validatedWithoutTests.map(a => a.totalMs)),
+    timeToFailure: _dist(buckets.failed.map(a => a.totalMs)),
+    byStage,
+    reliableAtOrAbove: RELIABLE_N,
+  };
+}
+
+/** Read + summarise in one step. */
+function fixDurationReport(scanRoot) {
+  return summarizeFixDurations(loadFixAttempts(scanRoot));
+}
+
+function _ms(v) {
+  if (v == null) return '—';
+  return v >= 1000 ? `${(v / 1000).toFixed(1)}s` : `${v}ms`;
+}
+
+/**
+ * One-paragraph human summary. Returns null when there is nothing measured —
+ * callers print nothing rather than printing an empty table.
+ */
+function renderFixDurationSummary(sum) {
+  if (!sum || !sum.attempts) return null;
+  const d = sum.timeToValidatedFix;
+  const parts = [];
+  if (d.n) {
+    parts.push(
+      `time-to-validated-fix: median ${_ms(d.p50Ms)}, p90 ${_ms(d.p90Ms)} `
+      + `(n=${d.n}${d.reliable ? '' : `, below ${sum.reliableAtOrAbove} — percentiles not yet reliable`})`,
+    );
+  } else {
+    parts.push('time-to-validated-fix: no fix has both verified and had its test suite run yet');
+  }
+  if (sum.counts.validatedWithoutTests) {
+    parts.push(`${sum.counts.validatedWithoutTests} verified with no detectable test suite (excluded from the median above)`);
+  }
+  if (sum.counts.failed) {
+    parts.push(`${sum.counts.failed} failed verification, median ${_ms(sum.timeToFailure.p50Ms)} (counted separately)`);
+  }
+  return parts.join('; ') + '.';
+}
+
+const _internals = { _dist, _pct, RELIABLE_N };
+
+
+/***/ }),
+
 /***/ 4113:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
@@ -12,7 +225,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _fix_verify_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(11);
+/* harmony import */ var _fix_verify_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3526);
 // Closed-loop fix verification (v0.68).
 //
 // Existing `fix-verify.js` does scan + lint. This module adds the third
@@ -174,7 +387,7 @@ function _summarize(legs, verdict) {
 
 /***/ }),
 
-/***/ 11:
+/***/ 3526:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 // ESM COMPAT FLAG
@@ -193,8 +406,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 524 modules
-var engine = __webpack_require__(8215);
+// EXTERNAL MODULE: ./src/engine.js + 595 modules
+var engine = __webpack_require__(4660);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //
@@ -372,6 +585,157 @@ function gateFixOutput({ residual, verdict, evidence, signals } = {}) {
 
 const _internals = Object.freeze({ BANNED_RESIDUAL_PHRASES, CITATION_RE, FP_VERDICTS });
 
+;// CONCATENATED MODULE: ./src/posture/test-runner.js
+// R5 (partial, roadmap) — the project's own test suite as a verification
+// stage for `verifyFix()` (see `fix-verify.js`). Closes the gap where a
+// "verified" fix only proved a finding's stableId stopped firing — a patch
+// that deletes the feature entirely would satisfy that just as well as a
+// real fix. Running the project's own tests is the cheapest available check
+// that the application still works.
+//
+// Execution-safety note: this spawns the TARGET PROJECT's own test command
+// in the target project's own directory. That is deliberately NOT routed
+// through the R1 confinement sandbox (`../sandbox/`). That sandbox exists to
+// contain untrusted proof-of-concept exploit code the scanner itself
+// synthesizes — code nobody has vetted, being run for the first time. A
+// project's pre-existing test suite is the opposite case: it is the
+// project's own trusted source, already sitting on disk, and running it is
+// exactly what a human developer does by hand before trusting a fix.
+// Wrapping "npm test" / "pytest" / "go test" in the PoC sandbox's
+// syscall/network/filesystem restrictions would break the large majority of
+// real test suites (they bind local ports, spawn child processes, write temp
+// fixtures, etc.) for no corresponding security benefit.
+
+
+
+
+
+const DEFAULT_TIMEOUT_MS = 300_000;
+const NPM_PLACEHOLDER = /Error: no test specified/i;
+
+function _exists(scanRoot, rel) {
+  try { return external_node_fs_.existsSync(external_node_path_.join(scanRoot, rel)); } catch { return false; }
+}
+
+function _isDir(scanRoot, rel) {
+  try { return external_node_fs_.statSync(external_node_path_.join(scanRoot, rel)).isDirectory(); } catch { return false; }
+}
+
+function _binaryAvailable(cmd) {
+  try {
+    const r = (0,external_node_child_process_.spawnSync)(cmd, ['--version'], { timeout: 5_000, stdio: 'ignore' });
+    return !(r.error && r.error.code === 'ENOENT');
+  } catch {
+    return false;
+  }
+}
+
+// Detect the project's test command. Read-only — never spawns the actual
+// test run, only (optionally) a cheap `--version` probe to confirm a tool
+// like `pytest` is actually installed before committing to it. Returns
+// `null` when nothing detectable is found — most scanned repos will hit
+// this path, and that must not be treated as a failure by callers.
+function detectTestCommand(scanRoot) {
+  if (!scanRoot) return null;
+
+  // JS/TS — package.json with a real (non-placeholder) `scripts.test`.
+  let pkg = null;
+  try { pkg = JSON.parse(external_node_fs_.readFileSync(external_node_path_.join(scanRoot, 'package.json'), 'utf8')); } catch { pkg = null; }
+  const testScript = pkg && pkg.scripts && pkg.scripts.test;
+  if (testScript && !NPM_PLACEHOLDER.test(String(testScript))) {
+    if (_exists(scanRoot, 'pnpm-lock.yaml')) return { cmd: 'pnpm', args: ['test'], kind: 'pnpm' };
+    if (_exists(scanRoot, 'yarn.lock')) return { cmd: 'yarn', args: ['test'], kind: 'yarn' };
+    if (_exists(scanRoot, 'bun.lockb') || _exists(scanRoot, 'bun.lock')) return { cmd: 'bun', args: ['test'], kind: 'bun' };
+    return { cmd: 'npm', args: ['test', '--silent'], kind: 'npm' };
+  }
+
+  // Python — pytest.ini / pyproject.toml / tox.ini / a tests/ dir, and the
+  // `pytest` binary actually available. If pytest isn't installed we do NOT
+  // report a python test command — falling through lets a later language
+  // marker (e.g. go.mod in a polyglot repo) still be detected.
+  const pyMarker = _exists(scanRoot, 'pytest.ini') || _exists(scanRoot, 'pyproject.toml') ||
+    _exists(scanRoot, 'tox.ini') || _isDir(scanRoot, 'tests');
+  if (pyMarker && _binaryAvailable('pytest')) {
+    return { cmd: 'pytest', args: ['-q'], kind: 'pytest' };
+  }
+
+  // Go
+  if (_exists(scanRoot, 'go.mod')) {
+    return { cmd: 'go', args: ['test', './...'], kind: 'go' };
+  }
+
+  return null;
+}
+
+// Run the detected test command with a walltime budget. Always returns a
+// result object — never throws. Distinguishes four outcomes:
+//   - no detectable/runnable command  -> status: 'skipped'  (does NOT fail)
+//   - ran and exited 0                -> status: 'passed'
+//   - ran and exited non-zero         -> status: 'failed'
+//   - ran past the timeout budget     -> status: 'failed', timedOut: true
+function runProjectTests(scanRoot, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  const startedAt = Date.now();
+  const command = detectTestCommand(scanRoot);
+  if (!command) {
+    return {
+      status: 'skipped', passed: null, skipped: true,
+      reason: 'no-test-command-detected', exitCode: null, timedOut: false,
+      durationMs: Date.now() - startedAt,
+    };
+  }
+
+  let r;
+  try {
+    r = (0,external_node_child_process_.spawnSync)(command.cmd, command.args, {
+      cwd: scanRoot,
+      encoding: 'utf8',
+      timeout: timeoutMs,
+      env: { ...process.env, CI: '1' },
+    });
+  } catch (e) {
+    // The spawn call itself threw (rare — e.g. cwd vanished). Treat as
+    // "could not run", not "ran and failed".
+    return {
+      status: 'skipped', passed: null, skipped: true,
+      reason: `spawn-error: ${e.message}`, exitCode: null, timedOut: false,
+      durationMs: Date.now() - startedAt,
+    };
+  }
+  const durationMs = Date.now() - startedAt;
+
+  if (r.error && r.error.code === 'ENOENT') {
+    // The detected tool isn't actually installed on this machine. Not a
+    // test failure — the suite never ran.
+    return {
+      status: 'skipped', passed: null, skipped: true,
+      reason: `${command.kind}-not-installed`, exitCode: null, timedOut: false, durationMs,
+    };
+  }
+
+  if (r.status === null) {
+    // spawnSync sets status:null both on timeout-kill and on being killed by
+    // another signal; either way the run did not complete, which is a
+    // verification failure, never a skip — we asked for a result and the
+    // process was terminated before producing one.
+    return {
+      status: 'failed', passed: false, skipped: false,
+      reason: 'timed-out', exitCode: null, timedOut: true, durationMs,
+    };
+  }
+
+  return {
+    status: r.status === 0 ? 'passed' : 'failed',
+    passed: r.status === 0,
+    skipped: false,
+    reason: r.status === 0 ? null : 'test-failures',
+    exitCode: r.status,
+    timedOut: false,
+    durationMs,
+  };
+}
+
+// EXTERNAL MODULE: ./src/posture/fix-metrics.js
+var fix_metrics = __webpack_require__(2238);
 ;// CONCATENATED MODULE: ./src/posture/fix-verify.js
 // Closed-loop /fix verification (Sentinel-parity FR-L4-4, FR-L4-5).
 //
@@ -381,6 +745,10 @@ const _internals = Object.freeze({ BANNED_RESIDUAL_PHRASES, CITATION_RE, FP_VERD
 //   1. The original finding's stableId no longer fires on the patched file.
 //   2. No new findings at severity ≥ medium were introduced by the patch.
 //   3. The project's existing linter (when present) passes on the patched file.
+//   4. The project's own test suite (when detectable) still passes. This is
+//      the R5 gap-closer: a patch that silently deletes the feature would
+//      satisfy (1) and (2) just as well as a real fix — only running the
+//      tests catches that. See `test-runner.js` for detection + execution.
 //
 // If any of those fail, the caller is expected to NOT apply the patch and
 // instead surface a "fix plan" — a numbered list of steps the engineer can
@@ -392,6 +760,8 @@ const _internals = Object.freeze({ BANNED_RESIDUAL_PHRASES, CITATION_RE, FP_VERD
 
 
 
+
+
 const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
 
 // Run a focused re-scan over just the patched file(s) using the in-memory
@@ -494,29 +864,150 @@ function runLinter(cwd, cmd, args) {
 // dishonest or over-claiming fix fails the gate. When `fixMeta` is absent
 // (the deterministic MCP write path, which has no claims to check) the honesty
 // gate is skipped and behavior is unchanged.
+// R5 (partial) — the test-suite stage. Runs the target project's own tests,
+// in the target project's own directory, against whatever is currently on
+// disk there. See `test-runner.js`'s header comment for why that run is
+// deliberately NOT routed through the R1 PoC-confinement sandbox: this is
+// the project's own already-trusted suite, not untrusted synthesized code.
+//
+// Caveat that matters for callers: `verifyPatch` above re-scans the
+// candidate patch purely in memory (no write to disk), but a test runner
+// needs real files — there is no cheap way to hand a runner an in-memory
+// overlay. So this leg reports on the CURRENT on-disk tree, not the
+// candidate `files` map, when `verifyFix` is used as a pre-write preview
+// (e.g. the `verify_fix` MCP tool). Callers that apply the patch first and
+// then re-verify get the strongest signal; that ordering is not enforced
+// here — it's the caller's responsibility, same as it already is for the
+// closed-loop `fix-verify-loop.js` path.
+// Does the caller's candidate patch differ from what is on disk right now?
+// If so, any test run necessarily exercised the pre-patch tree. Compared by
+// content so a patch that happens to match disk (already applied) is correctly
+// treated as NOT pre-patch.
+function _candidateDiffersFromDisk(scanRoot, files) {
+  if (!files || typeof files !== 'object') return false;
+  for (const [rel, content] of Object.entries(files)) {
+    if (typeof content !== 'string') continue;
+    try {
+      const abs = external_node_path_.resolve(scanRoot, rel);
+      if (external_node_fs_.readFileSync(abs, 'utf8') !== content) return true;
+    } catch {
+      return true; // candidate file absent on disk -> definitely not applied
+    }
+  }
+  return false;
+}
+
 async function verifyFix({
   scanRoot,
   originalFindingStableId,
   files,
   depFileContents,
   fixMeta,
+  testTimeoutMs,
+  recordMetrics = true,
+  poc,
 } = {}) {
+  // R5 (reporting half) — time each stage as it runs. Measured here rather
+  // than inside each stage because only this function knows the boundaries of
+  // one verification ATTEMPT, which is the unit the distribution is over.
+  const stages = {};
+  const t0 = Date.now();
+  let mark = t0;
+  const _lap = (name) => { const now = Date.now(); stages[name] = now - mark; mark = now; };
+
   const rescan = await verifyPatch({ scanRoot, originalFindingStableId, files, depFileContents });
+  _lap('rescan');
   const lint = runProjectLinter(scanRoot, Object.keys(files || {}));
+  _lap('lint');
+  const tests = runProjectTests(scanRoot, testTimeoutMs != null ? { timeoutMs: testTimeoutMs } : {});
+  _lap('tests');
+  // True when a candidate patch was supplied but has not been written, so the
+  // suite necessarily ran against the pre-patch tree. Surfaced in the summary
+  // and on the result so a caller cannot mistake it for a verified patch.
+  const _testedPrePatch = !tests.skipped && _candidateDiffersFromDisk(scanRoot, files);
+  const testsOk = tests.skipped ? true : tests.passed === true;
   let honesty = null;
   if (fixMeta && typeof fixMeta === 'object') {
     try { honesty = gateFixOutput(fixMeta); } catch { honesty = null; }
   }
-  const ok = rescan.ok && (lint.ok || lint.skipped) && (honesty ? honesty.ok : true);
+  _lap('honesty');
+
+  // R5 — the PoC leg. Re-run the finding's proof-of-concept against the
+  // CANDIDATE patch inside R1's sandbox. A patch that still lets the PoC
+  // demonstrate the predicted effect has not fixed anything, however green the
+  // re-scan looks: the re-scan only proves the DETECTOR stopped firing, which
+  // a cosmetic edit can achieve. Execution is the stronger claim.
+  //
+  // Direction matters and is asymmetric on purpose. `execution-proven` after
+  // the patch is a hard FAIL. Anything else is NOT a pass — a PoC that failed
+  // to run, or a sandbox that could not start, is recorded as `inconclusive`
+  // and left out of the verdict entirely. Treating "could not prove it" as
+  // "fixed" is exactly the false confidence this leg exists to prevent.
+  let pocLeg = { status: 'not-requested', reason: null, tier: null };
+  if (poc?.code) {
+    try {
+      const { proveFinding } = await __webpack_require__.e(/* import() */ 259).then(__webpack_require__.bind(__webpack_require__, 8259));
+      const proved = await proveFinding({ ...(poc.finding || {}), poc }, { files });
+      const tier = proved.proofTier;
+      pocLeg = tier === 'execution-proven'
+        ? { status: 'still-exploitable', tier, reason: proved.proofEvidence?.observed || null }
+        : proved.proofEvidence?.ran
+          ? { status: 'no-longer-proven', tier, reason: proved.proofEvidence?.reason || null }
+          : { status: 'inconclusive', tier, reason: proved.proofEvidence?.reason || null };
+    } catch (e) {
+      pocLeg = { status: 'inconclusive', tier: null, reason: `proof harness error: ${e.message}` };
+    }
+  }
+  _lap('poc');
+  const pocOk = pocLeg.status !== 'still-exploitable';
+
+  const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true);
+  const durations = { ...stages, totalMs: Date.now() - t0 };
   const summary = [
     `re-scan: ${rescan.ok ? 'PASS' : 'FAIL — ' + rescan.reason}`,
     `linter:  ${lint.runner === 'none' ? 'skipped (no linter config)'
               : lint.skipped ? `${lint.runner} not installed`
               : lint.ok ? `${lint.runner} PASS`
               : `${lint.runner} FAIL (exit ${lint.exitCode})`}`,
+    // Say which tree the suite actually ran against. `files` is a candidate
+    // patch held in memory; the runner needs real files, so it sees whatever is
+    // on disk. Reporting a bare "PASS" here would let a caller believe the
+    // PATCH passed the tests when the suite may have run on unpatched code.
+    `tests:   ${tests.skipped ? `skipped (${tests.reason})`
+              : tests.timedOut ? 'FAIL (timed out)'
+              : tests.passed ? `PASS${_testedPrePatch ? ' — on the CURRENT on-disk tree, NOT the candidate patch' : ''}`
+              : `FAIL (exit ${tests.exitCode})`}`,
     honesty ? `honesty: ${honesty.ok ? `PASS (${honesty.tier})` : 'FAIL — ' + honesty.violations.join('; ')}` : null,
+    // Never render `inconclusive` as a pass — say plainly that nothing was proven.
+    pocLeg.status === 'not-requested' ? null
+      : pocLeg.status === 'still-exploitable' ? `poc:     FAIL — the proof-of-concept still demonstrates the vulnerability against the patch`
+      : pocLeg.status === 'no-longer-proven' ? 'poc:     PASS (ran against the patch and no longer demonstrates the vulnerability)'
+      : `poc:     inconclusive — not counted either way (${pocLeg.reason || 'no detail reported'})`,
   ].filter(Boolean).join('\n');
-  return { ok, rescan, lint, honesty, summary };
+  // Persist the attempt so the distribution can be reported from real runs.
+  // `testsRan` is the load-bearing field: it is what keeps "verified with no
+  // test suite to run" out of the headline time-to-validated-fix bucket.
+  // A patch that was never written to disk is recorded too, but flagged — its
+  // suite ran against the pre-patch tree, so its timing is real while its
+  // verdict is about a different tree.
+  if (recordMetrics && scanRoot) {
+    (0,fix_metrics/* recordFixAttempt */.I3)(scanRoot, {
+      at: new Date().toISOString(),
+      stableId: originalFindingStableId || null,
+      ok,
+      testsRan: !tests.skipped,
+      testsPassed: tests.skipped ? null : tests.passed === true,
+      testedPrePatch: _testedPrePatch,
+      lintRan: !(lint.skipped || lint.runner === 'none'),
+      honestyGated: honesty != null,
+      pocStatus: pocLeg.status,
+      files: Object.keys(files || {}).length,
+      stages,
+      totalMs: durations.totalMs,
+    });
+  }
+
+  return { ok, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
 }
 
 

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8215);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4660);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan: