@clear-capabilities/agentic-security-scanner 0.128.1 → 0.132.0

package/dist/207.index.js

@@ -0,0 +1,220 @@
+export const id = 207;
+export const ids = [207];
+export const modules = {
+
+/***/ 9207:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   computeRunAttestation: () => (/* binding */ computeRunAttestation)
+/* harmony export */ });
+/* unused harmony exports ATTESTATION_CANONICALISATION, verifyRunAttestation */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
+/* harmony import */ var _integrity_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1130);
+// R4 — determinism as a contract.
+//
+// Determinism has been an implementation property of this engine (stable sorts,
+// no Date.now() in ids, `--deterministic`) with no way for a third party to
+// VERIFY it. This module turns it into something checkable: a stable digest
+// over the finding set, bound to the engine version, ruleset version, and
+// bundle hash that produced it.
+//
+// WHAT THE DIGEST IS INDEPENDENT OF (by construction):
+//   - the ORDER findings were emitted in (entries are canonicalised, then sorted)
+//   - run ids, timestamps, durations, and every other field not on the
+//     identity allowlist below — canonicalisation is an ALLOWLIST, not a
+//     denylist, so a new non-deterministic field cannot silently leak in
+//   - path separator style, and the absolute prefix when `root` is supplied
+//
+// WHAT IT IS NOT INDEPENDENT OF (all of these are real differences):
+//   - a changed severity, file, line, rule id, cwe, or vuln title
+//   - a finding appearing or disappearing (including a duplicate — multiplicity
+//     is preserved; two identical findings are not collapsed into one)
+//   - the engine version, ruleset version, or bundle sha
+//
+// WHAT THIS PROVES, AND WHAT IT DOES NOT (read before quoting it at anyone):
+//   PROVES — two finding sets carrying the same digest under the same
+//   canonicalisation are the same set of findings, modulo emission order and
+//   the excluded volatile fields; and (when signed) that the attestation was
+//   produced on an install holding this HMAC key.
+//   DOES NOT PROVE — cross-machine reproducibility. Nothing here demonstrates
+//   that a different host, OS, Node version, or toolchain produces the same
+//   finding set; several detectors are environment-sensitive (e.g. the Python
+//   AST path is used when python3 is available and falls back to regex when it
+//   is not, which can change what is found). Two runs on two machines agreeing
+//   would be evidence FOR reproducibility, but that experiment has not been
+//   run here and this module does not assert its outcome. The signature is a
+//   symmetric per-install HMAC, so it is tamper-evidence for the operator, not
+//   third-party non-repudiation.
+//
+// Identity fields deliberately EXCLUDE `parser` and `family`: `parser` records
+// which analysis engine fired, which is environment-sensitive (see the python3
+// case above), so including it would make the digest report an environment
+// difference as a findings difference. The finding's identity — where it is
+// and what it is — is fully captured without it.
+//
+// SIGNING: reuses `integrity.js`'s per-install HMAC key handling verbatim
+// (`signLastScan`, keyed from $AGENTIC_SECURITY_HMAC_KEY or the 0600 key file
+// at $XDG_CONFIG_HOME/agentic-security/scan-key). No second key mechanism is
+// introduced. `integrity.verifyLastScan` is NOT reused because it verifies a
+// body against a sibling `.sig` FILE; an attestation carries its signature
+// inline, so verification re-signs and compares in constant time here.
+//
+// NO THROWING (posture/CLAUDE.md convention): malformed input yields an empty
+// canonical set or an `{ok:false, reason}` refusal, never an exception.
+
+
+
+
+const ATTESTATION_CANONICALISATION = 'agentic-security/run-attestation-canon-v1';
+
+const PROVES =
+  'Two finding sets with this digest, under this canonicalisation, are the same findings ' +
+  '(same rule id, severity, file, line, cwe, vuln, and multiplicity) produced by the same ' +
+  'engine version, ruleset version, and bundle — regardless of emission order.';
+const DOES_NOT_PROVE =
+  'It does not prove cross-machine reproducibility: this attestation is one run on one machine, ' +
+  'nothing here compares a second machine, OS, or Node version, and some detectors are ' +
+  'environment-sensitive. That property is tested separately by the determinism-attest / ' +
+  'determinism-compare CI jobs, which run the same commit on two operating systems and fail ' +
+  'unless the digests match — evidence about the ENGINE, not about this attestation. ' +
+  'A signature, when present, is a symmetric per-install HMAC — tamper-evidence for this ' +
+  'install, not third-party non-repudiation.';
+
+function _str(v) { return v === undefined || v === null ? '' : String(v); }
+
+// Normalise a file path: separators to '/', drop a supplied absolute root,
+// drop a leading './'. Everything else is left alone — guessing at a root we
+// were not given would make two genuinely different files collide.
+function _normPath(file, root) {
+  let p = _str(file).replace(/\\/g, '/');
+  if (root) {
+    let r = String(root).replace(/\\/g, '/').replace(/\/+$/, '');
+    if (r && p.startsWith(r + '/')) p = p.slice(r.length + 1);
+    else if (r && p === r) p = '';
+  }
+  return p.replace(/^\.\//, '');
+}
+
+/**
+ * The canonical, order-independent representation of a finding set: one
+ * tab-joined record per finding over the identity allowlist, sorted.
+ * Multiplicity is preserved (duplicates are NOT deduped).
+ */
+function canonicaliseFindings(findings, { root } = {}) {
+  const list = Array.isArray(findings) ? findings : [];
+  const rows = [];
+  for (const f of list) {
+    if (!f || typeof f !== 'object') continue;
+    rows.push([
+      _str(f.id),
+      _str(f.severity),
+      _normPath(f.file, root),
+      _str(f.line),
+      _str(f.cwe),
+      _str(f.vuln),
+    ].join('\t'));
+  }
+  return rows.sort();
+}
+
+/**
+ * Compute the run attestation.
+ *
+ * @param {object[]} findings     the finding set (any order)
+ * @param {string}   engineVersion
+ * @param {string}   rulesetVersion
+ * @param {string}   bundleSha
+ * @param {string}  [root]        scan root, used to relativise absolute paths
+ * @param {boolean} [sign]        attach a per-install HMAC over the digest
+ */
+function computeRunAttestation({
+  findings, engineVersion, rulesetVersion, bundleSha, root, sign = false,
+} = {}) {
+  const entries = canonicaliseFindings(findings, { root });
+  const payload = JSON.stringify({
+    canonicalisation: ATTESTATION_CANONICALISATION,
+    engineVersion: _str(engineVersion),
+    rulesetVersion: _str(rulesetVersion),
+    bundleSha: _str(bundleSha),
+    findingCount: entries.length,
+    entries,
+  });
+  const digest = node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(payload).digest('hex');
+  const att = {
+    digest,
+    algorithm: 'sha256',
+    findingCount: entries.length,
+    engineVersion: _str(engineVersion),
+    rulesetVersion: _str(rulesetVersion),
+    bundleSha: _str(bundleSha),
+    canonicalisation: ATTESTATION_CANONICALISATION,
+    proves: PROVES,
+    doesNotProve: DOES_NOT_PROVE,
+  };
+  if (sign) {
+    try {
+      att.signature = (0,_integrity_js__WEBPACK_IMPORTED_MODULE_1__/* .signLastScan */ .lU)(digest);
+      att.signatureScope = 'per-install-hmac';
+    } catch { /* signing is best-effort; an unsigned attestation is still valid */ }
+  }
+  return att;
+}
+
+/**
+ * Re-derive the attestation from a finding set and compare.
+ * @returns {{ok: boolean, reason: string}}
+ */
+function verifyRunAttestation(attestation, inputs = {}) {
+  if (!attestation || typeof attestation !== 'object') {
+    return { ok: false, reason: 'no attestation supplied' };
+  }
+  if (attestation.canonicalisation !== ATTESTATION_CANONICALISATION) {
+    return {
+      ok: false,
+      reason: `unknown canonicalisation "${_str(attestation.canonicalisation)}" — ` +
+              `this build verifies "${ATTESTATION_CANONICALISATION}" only`,
+    };
+  }
+  if (typeof attestation.digest !== 'string' || !/^[0-9a-f]{64}$/.test(attestation.digest)) {
+    return { ok: false, reason: 'attestation carries no sha256 digest' };
+  }
+  for (const k of ['engineVersion', 'rulesetVersion', 'bundleSha']) {
+    if (_str(inputs[k]) !== _str(attestation[k])) {
+      return { ok: false, reason: `${k} mismatch: attested "${_str(attestation[k])}", got "${_str(inputs[k])}"` };
+    }
+  }
+  const recomputed = computeRunAttestation({
+    findings: inputs.findings,
+    engineVersion: inputs.engineVersion,
+    rulesetVersion: inputs.rulesetVersion,
+    bundleSha: inputs.bundleSha,
+    root: inputs.root,
+  });
+  if (recomputed.findingCount !== attestation.findingCount) {
+    return {
+      ok: false,
+      reason: `finding count mismatch: attested ${attestation.findingCount}, got ${recomputed.findingCount}`,
+    };
+  }
+  if (recomputed.digest !== attestation.digest) {
+    return { ok: false, reason: 'digest mismatch — the finding set is not the one attested' };
+  }
+  if (attestation.signature) {
+    let expected;
+    try { expected = signLastScan(attestation.digest); }
+    catch { return { ok: false, reason: 'signature present but no key material available to check it' }; }
+    const a = Buffer.from(String(attestation.signature), 'hex');
+    const b = Buffer.from(expected, 'hex');
+    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+      return { ok: false, reason: 'signature does not verify under this install key' };
+    }
+    return { ok: true, reason: 'digest and per-install signature verify' };
+  }
+  return { ok: true, reason: 'digest verifies (unsigned attestation)' };
+}
+
+
+/***/ })
+
+};

package/dist/238.index.js

@@ -0,0 +1,218 @@
+export const id = 238;
+export const ids = [238];
+export const modules = {
+
+/***/ 2238:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   I3: () => (/* binding */ recordFixAttempt),
+/* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
+/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
+/* harmony export */ });
+/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+// Time-to-validated-fix (R5, the reporting half).
+//
+// `verifyFix` already RUNS the stages and `test-runner.js` already times the
+// slowest one. What did not exist was anything durable to read afterwards, so
+// "how long does a fix actually take to validate" had no answer from real runs
+// — only an estimate (`time-to-fix.js` guesses engineering hours from family
+// and patch shape, before anything runs). This module is the opposite: it
+// records what the pipeline observed and reports the distribution.
+//
+// THE HONESTY RULES, which are most of why this file is longer than a mean:
+//
+//  1. A failed attempt is NOT a data point about how long a fix takes. Fixes
+//     that fail verification fail fast (a re-scan that still sees the finding
+//     never reaches the test suite), so blending them into one average makes
+//     the pipeline look faster the worse it performs. Validated and failed
+//     attempts are summarised separately and never merged.
+//
+//  2. "Tests skipped" is not "tests passed". A project with no detectable
+//     suite can reach `ok:true` having run only the re-scan and the linter.
+//     That is a weaker claim than a fix whose suite executed, and it is also
+//     much faster, so counting the two together would quietly deflate the
+//     headline. They get their own bucket: `validated` means the suite ran and
+//     passed, `validatedWithoutTests` means there was no suite to run.
+//
+//  3. Every figure carries its `n`, and a percentile computed from too few
+//     samples is labelled unreliable rather than omitted or silently reported.
+//     Same precedent as the accuracy scorecard's `{n, d}` rates: a number
+//     without its denominator is not a measurement.
+//
+// Storage is append-only JSONL at `<scanRoot>/.agentic-security/fix-metrics.jsonl`,
+// one record per verification attempt. Nothing here throws (posture
+// convention) — an unwritable or corrupt log degrades to "no metrics", never
+// to a failed verification.
+
+
+
+
+
+const STATE_DIR = '.agentic-security';
+const LOG_FILE = 'fix-metrics.jsonl';
+
+// Below this many samples a percentile is an artifact of the sample, not a
+// property of the pipeline. Reported anyway (hiding it invites re-deriving it
+// wrong downstream) but flagged, so a caller cannot quote it as settled.
+const RELIABLE_N = 10;
+
+// The stages verifyFix runs, in execution order. Kept here so the recorder and
+// the summariser cannot drift apart on stage naming.
+const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
+
+function _logPath(scanRoot) {
+  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR, LOG_FILE);
+}
+
+/**
+ * Append one verification attempt. Best-effort and silent on failure: metrics
+ * must never be able to fail a fix that otherwise verified.
+ *
+ * @returns {boolean} whether the record was written (for tests, not callers).
+ */
+function recordFixAttempt(scanRoot, record) {
+  if (!scanRoot || !record || typeof record !== 'object') return false;
+  try {
+    const dir = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR);
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    // One writeSync of one newline-terminated line: a concurrent reader sees
+    // whole records or nothing, and a torn tail is dropped on read.
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Read every well-formed attempt. A line that does not parse is skipped, not
+ * fatal — the last line of an interrupted write is the expected case.
+ */
+function loadFixAttempts(scanRoot) {
+  try {
+    const raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(_logPath(scanRoot), 'utf8');
+    const out = [];
+    for (const line of raw.split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const rec = JSON.parse(line);
+        if (rec && typeof rec === 'object' && typeof rec.totalMs === 'number') out.push(rec);
+      } catch { /* torn or hand-edited line — drop it, keep the rest */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
+// Nearest-rank percentile over an ascending array. Nearest-rank rather than
+// interpolated because these are observed durations, and an interpolated p50
+// reports a duration that no run actually took.
+function _pct(sorted, p) {
+  if (!sorted.length) return null;
+  const rank = Math.ceil((p / 100) * sorted.length);
+  return sorted[Math.min(sorted.length - 1, Math.max(0, rank - 1))];
+}
+
+function _dist(values) {
+  const v = values.filter(x => typeof x === 'number' && Number.isFinite(x) && x >= 0).sort((a, b) => a - b);
+  if (!v.length) return { n: 0, minMs: null, p50Ms: null, p90Ms: null, maxMs: null, meanMs: null, reliable: false };
+  const sum = v.reduce((a, b) => a + b, 0);
+  return {
+    n: v.length,
+    minMs: v[0],
+    p50Ms: _pct(v, 50),
+    p90Ms: _pct(v, 90),
+    maxMs: v[v.length - 1],
+    meanMs: Math.round(sum / v.length),
+    // Says whether the percentiles above may be quoted, not whether the count
+    // is real. n and min/max/mean are exact at any sample size.
+    reliable: v.length >= RELIABLE_N,
+  };
+}
+
+// Which bucket an attempt belongs to. Deliberately total: every attempt lands
+// in exactly one, so the bucket counts always sum to the attempt count and a
+// mis-shaped record cannot silently vanish from the denominator.
+function bucketOf(a) {
+  if (!a?.ok) return 'failed';
+  return a.testsRan ? 'validated' : 'validatedWithoutTests';
+}
+
+/**
+ * Summarise a set of attempts into the reported distribution.
+ *
+ * `validated` is the headline: attempts that verified AND whose test suite
+ * actually ran and passed. The other two buckets exist so that headline cannot
+ * be inflated by counting weaker or faster outcomes inside it.
+ */
+function summarizeFixDurations(attempts) {
+  const all = Array.isArray(attempts) ? attempts : [];
+  const buckets = { validated: [], validatedWithoutTests: [], failed: [] };
+  for (const a of all) buckets[bucketOf(a)].push(a);
+
+  const byStage = {};
+  for (const stage of FIX_STAGES) {
+    // Per-stage timings come from validated runs only. A stage's duration in a
+    // failed run is truncated by the failure (the pipeline stops), so mixing
+    // them in would understate every stage after the first failure point.
+    byStage[stage] = _dist(buckets.validated.map(a => a?.stages?.[stage]));
+  }
+
+  return {
+    attempts: all.length,
+    counts: {
+      validated: buckets.validated.length,
+      validatedWithoutTests: buckets.validatedWithoutTests.length,
+      failed: buckets.failed.length,
+    },
+    timeToValidatedFix: _dist(buckets.validated.map(a => a.totalMs)),
+    timeToValidatedFixWithoutTests: _dist(buckets.validatedWithoutTests.map(a => a.totalMs)),
+    timeToFailure: _dist(buckets.failed.map(a => a.totalMs)),
+    byStage,
+    reliableAtOrAbove: RELIABLE_N,
+  };
+}
+
+/** Read + summarise in one step. */
+function fixDurationReport(scanRoot) {
+  return summarizeFixDurations(loadFixAttempts(scanRoot));
+}
+
+function _ms(v) {
+  if (v == null) return '—';
+  return v >= 1000 ? `${(v / 1000).toFixed(1)}s` : `${v}ms`;
+}
+
+/**
+ * One-paragraph human summary. Returns null when there is nothing measured —
+ * callers print nothing rather than printing an empty table.
+ */
+function renderFixDurationSummary(sum) {
+  if (!sum || !sum.attempts) return null;
+  const d = sum.timeToValidatedFix;
+  const parts = [];
+  if (d.n) {
+    parts.push(
+      `time-to-validated-fix: median ${_ms(d.p50Ms)}, p90 ${_ms(d.p90Ms)} `
+      + `(n=${d.n}${d.reliable ? '' : `, below ${sum.reliableAtOrAbove} — percentiles not yet reliable`})`,
+    );
+  } else {
+    parts.push('time-to-validated-fix: no fix has both verified and had its test suite run yet');
+  }
+  if (sum.counts.validatedWithoutTests) {
+    parts.push(`${sum.counts.validatedWithoutTests} verified with no detectable test suite (excluded from the median above)`);
+  }
+  if (sum.counts.failed) {
+    parts.push(`${sum.counts.failed} failed verification, median ${_ms(sum.timeToFailure.p50Ms)} (counted separately)`);
+  }
+  return parts.join('; ') + '.';
+}
+
+const _internals = { _dist, _pct, RELIABLE_N };
+
+
+/***/ })
+
+};