@clear-capabilities/agentic-security-scanner 0.130.0 → 0.132.0

package/src/posture/custom-rules.js

@@ -30,7 +30,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as yaml from '../util/yaml.js';
-import fg from 'fast-glob';
+import { globFiles } from '../util/glob.js';
 import { loadTrustedKeys, verifyRulePack } from './rule-pack-signing.js';
 
 const LANG_EXTS = {
@@ -337,7 +337,7 @@ export async function runRuleTests(scanRoot, fixtureGlob) {
     console.log(`No custom rules found in ${rulesDir(scanRoot)}`);
     return { ok: true, rules: 0, fired: 0 };
   }
-  const files = await fg(fixtureGlob, { dot: false, onlyFiles: true });
+  const files = await globFiles(fixtureGlob);
   console.log(`Loaded ${rules.length} rule(s); testing against ${files.length} file(s).\n`);
   let fired = 0;
   for (const fp of files) {

package/src/posture/execution-proof.js

@@ -18,7 +18,40 @@ function _evidence(over = {}) {
   };
 }
 
-export async function proveFinding(finding, { timeoutMs = 10000 } = {}) {
+// A run that never got as far as executing the PoC. `ran:false` for these is
+// the whole point: 'proof-failed' asserts "the PoC ran and the predicted effect
+// did not appear", which is a triage signal about the FINDING. A sandbox that
+// could not start says nothing about the finding at all, and must leave it at
+// its static tier rather than manufacturing a failed exploit attempt.
+const _DID_NOT_EXECUTE = new Set(['disabled', 'error']);
+
+// Materialise caller-supplied files into the sandbox root so a PoC can import
+// the code it is supposed to exploit. Paths are confined to the root: an
+// absolute path or one that climbs out is refused rather than clamped, because
+// silently rewriting a path would put a file somewhere the caller did not ask
+// for and the PoC would then exercise the wrong code.
+function _materialise(root, files) {
+  for (const [rel, content] of Object.entries(files || {})) {
+    if (typeof content !== 'string') continue;
+    const abs = path.resolve(root, rel);
+    if (abs !== root && !abs.startsWith(root + path.sep)) {
+      return `refusing to write '${rel}': it resolves outside the sandbox root`;
+    }
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content, 'utf8');
+  }
+  return null;
+}
+
+/**
+ * @param {object} finding    carries `poc: {lang, code}`
+ * @param {object} [opts]
+ * @param {object} [opts.files]  rel→content written into the sandbox root before
+ *   the PoC runs. This is what lets the SAME PoC be run against a candidate
+ *   patch: pass the patched contents and a still-`execution-proven` verdict
+ *   means the fix did not close the hole.
+ */
+export async function proveFinding(finding, { timeoutMs = 10000, force, files } = {}) {
   const poc = finding?.poc;
   if (!poc?.code) {
     return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: 'no proof-of-concept attached' }));
@@ -32,16 +65,23 @@ export async function proveFinding(finding, { timeoutMs = 10000 } = {}) {
 
   const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'proof-')));
   try {
+    const badPath = _materialise(root, files);
+    if (badPath) {
+      return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: badPath }));
+    }
     fs.writeFileSync(path.join(root, 'poc.mjs'), poc.code, 'utf8');
-    const r = runConfined([process.execPath, 'poc.mjs'], { root, timeoutMs });
+    const r = runConfined([process.execPath, 'poc.mjs'], { root, timeoutMs, force });
     const proven = fs.existsSync(path.join(root, PROOF_MARKER));
+    const ran = !r.timedOut && !_DID_NOT_EXECUTE.has(r.status);
 
     return attachProofTier(finding, _evidence({
-      tier: proven ? 'execution-proven' : 'proof-failed',
+      tier: proven ? 'execution-proven' : ran ? 'proof-failed' : proofTierOf(finding),
       backend: r.backend,
-      ran: !r.timedOut && r.status !== 'disabled',
+      ran,
       observed: proven ? `proof marker '${PROOF_MARKER}' written by the proof-of-concept` : null,
       reason: proven ? null
+        : r.status === 'error' ? `the confinement sandbox could not start, so the proof-of-concept never executed (${r.backend} backend): ${String(r.stderr || '').trim() || 'no detail reported'}`
+        : r.status === 'disabled' ? 'confined execution is disabled; the proof-of-concept was refused and never executed'
         : r.timedOut ? 'proof-of-concept exceeded its time budget'
         : 'proof-of-concept ran but did not demonstrate the predicted effect',
       exitCode: r.exitCode, timedOut: r.timedOut,

package/src/posture/fix-metrics.js

@@ -0,0 +1,197 @@
+// Time-to-validated-fix (R5, the reporting half).
+//
+// `verifyFix` already RUNS the stages and `test-runner.js` already times the
+// slowest one. What did not exist was anything durable to read afterwards, so
+// "how long does a fix actually take to validate" had no answer from real runs
+// — only an estimate (`time-to-fix.js` guesses engineering hours from family
+// and patch shape, before anything runs). This module is the opposite: it
+// records what the pipeline observed and reports the distribution.
+//
+// THE HONESTY RULES, which are most of why this file is longer than a mean:
+//
+//  1. A failed attempt is NOT a data point about how long a fix takes. Fixes
+//     that fail verification fail fast (a re-scan that still sees the finding
+//     never reaches the test suite), so blending them into one average makes
+//     the pipeline look faster the worse it performs. Validated and failed
+//     attempts are summarised separately and never merged.
+//
+//  2. "Tests skipped" is not "tests passed". A project with no detectable
+//     suite can reach `ok:true` having run only the re-scan and the linter.
+//     That is a weaker claim than a fix whose suite executed, and it is also
+//     much faster, so counting the two together would quietly deflate the
+//     headline. They get their own bucket: `validated` means the suite ran and
+//     passed, `validatedWithoutTests` means there was no suite to run.
+//
+//  3. Every figure carries its `n`, and a percentile computed from too few
+//     samples is labelled unreliable rather than omitted or silently reported.
+//     Same precedent as the accuracy scorecard's `{n, d}` rates: a number
+//     without its denominator is not a measurement.
+//
+// Storage is append-only JSONL at `<scanRoot>/.agentic-security/fix-metrics.jsonl`,
+// one record per verification attempt. Nothing here throws (posture
+// convention) — an unwritable or corrupt log degrades to "no metrics", never
+// to a failed verification.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { isSafeStateDir } from './state-dir.js';
+
+const STATE_DIR = '.agentic-security';
+const LOG_FILE = 'fix-metrics.jsonl';
+
+// Below this many samples a percentile is an artifact of the sample, not a
+// property of the pipeline. Reported anyway (hiding it invites re-deriving it
+// wrong downstream) but flagged, so a caller cannot quote it as settled.
+const RELIABLE_N = 10;
+
+// The stages verifyFix runs, in execution order. Kept here so the recorder and
+// the summariser cannot drift apart on stage naming.
+export const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
+
+function _logPath(scanRoot) {
+  return path.join(scanRoot, STATE_DIR, LOG_FILE);
+}
+
+/**
+ * Append one verification attempt. Best-effort and silent on failure: metrics
+ * must never be able to fail a fix that otherwise verified.
+ *
+ * @returns {boolean} whether the record was written (for tests, not callers).
+ */
+export function recordFixAttempt(scanRoot, record) {
+  if (!scanRoot || !record || typeof record !== 'object') return false;
+  try {
+    const dir = path.join(scanRoot, STATE_DIR);
+    if (!isSafeStateDir(dir)) return false;
+    fs.mkdirSync(dir, { recursive: true });
+    // One writeSync of one newline-terminated line: a concurrent reader sees
+    // whole records or nothing, and a torn tail is dropped on read.
+    fs.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Read every well-formed attempt. A line that does not parse is skipped, not
+ * fatal — the last line of an interrupted write is the expected case.
+ */
+export function loadFixAttempts(scanRoot) {
+  try {
+    const raw = fs.readFileSync(_logPath(scanRoot), 'utf8');
+    const out = [];
+    for (const line of raw.split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const rec = JSON.parse(line);
+        if (rec && typeof rec === 'object' && typeof rec.totalMs === 'number') out.push(rec);
+      } catch { /* torn or hand-edited line — drop it, keep the rest */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
+// Nearest-rank percentile over an ascending array. Nearest-rank rather than
+// interpolated because these are observed durations, and an interpolated p50
+// reports a duration that no run actually took.
+function _pct(sorted, p) {
+  if (!sorted.length) return null;
+  const rank = Math.ceil((p / 100) * sorted.length);
+  return sorted[Math.min(sorted.length - 1, Math.max(0, rank - 1))];
+}
+
+function _dist(values) {
+  const v = values.filter(x => typeof x === 'number' && Number.isFinite(x) && x >= 0).sort((a, b) => a - b);
+  if (!v.length) return { n: 0, minMs: null, p50Ms: null, p90Ms: null, maxMs: null, meanMs: null, reliable: false };
+  const sum = v.reduce((a, b) => a + b, 0);
+  return {
+    n: v.length,
+    minMs: v[0],
+    p50Ms: _pct(v, 50),
+    p90Ms: _pct(v, 90),
+    maxMs: v[v.length - 1],
+    meanMs: Math.round(sum / v.length),
+    // Says whether the percentiles above may be quoted, not whether the count
+    // is real. n and min/max/mean are exact at any sample size.
+    reliable: v.length >= RELIABLE_N,
+  };
+}
+
+// Which bucket an attempt belongs to. Deliberately total: every attempt lands
+// in exactly one, so the bucket counts always sum to the attempt count and a
+// mis-shaped record cannot silently vanish from the denominator.
+export function bucketOf(a) {
+  if (!a?.ok) return 'failed';
+  return a.testsRan ? 'validated' : 'validatedWithoutTests';
+}
+
+/**
+ * Summarise a set of attempts into the reported distribution.
+ *
+ * `validated` is the headline: attempts that verified AND whose test suite
+ * actually ran and passed. The other two buckets exist so that headline cannot
+ * be inflated by counting weaker or faster outcomes inside it.
+ */
+export function summarizeFixDurations(attempts) {
+  const all = Array.isArray(attempts) ? attempts : [];
+  const buckets = { validated: [], validatedWithoutTests: [], failed: [] };
+  for (const a of all) buckets[bucketOf(a)].push(a);
+
+  const byStage = {};
+  for (const stage of FIX_STAGES) {
+    // Per-stage timings come from validated runs only. A stage's duration in a
+    // failed run is truncated by the failure (the pipeline stops), so mixing
+    // them in would understate every stage after the first failure point.
+    byStage[stage] = _dist(buckets.validated.map(a => a?.stages?.[stage]));
+  }
+
+  return {
+    attempts: all.length,
+    counts: {
+      validated: buckets.validated.length,
+      validatedWithoutTests: buckets.validatedWithoutTests.length,
+      failed: buckets.failed.length,
+    },
+    timeToValidatedFix: _dist(buckets.validated.map(a => a.totalMs)),
+    timeToValidatedFixWithoutTests: _dist(buckets.validatedWithoutTests.map(a => a.totalMs)),
+    timeToFailure: _dist(buckets.failed.map(a => a.totalMs)),
+    byStage,
+    reliableAtOrAbove: RELIABLE_N,
+  };
+}
+
+/** Read + summarise in one step. */
+export function fixDurationReport(scanRoot) {
+  return summarizeFixDurations(loadFixAttempts(scanRoot));
+}
+
+function _ms(v) {
+  if (v == null) return '—';
+  return v >= 1000 ? `${(v / 1000).toFixed(1)}s` : `${v}ms`;
+}
+
+/**
+ * One-paragraph human summary. Returns null when there is nothing measured —
+ * callers print nothing rather than printing an empty table.
+ */
+export function renderFixDurationSummary(sum) {
+  if (!sum || !sum.attempts) return null;
+  const d = sum.timeToValidatedFix;
+  const parts = [];
+  if (d.n) {
+    parts.push(
+      `time-to-validated-fix: median ${_ms(d.p50Ms)}, p90 ${_ms(d.p90Ms)} `
+      + `(n=${d.n}${d.reliable ? '' : `, below ${sum.reliableAtOrAbove} — percentiles not yet reliable`})`,
+    );
+  } else {
+    parts.push('time-to-validated-fix: no fix has both verified and had its test suite run yet');
+  }
+  if (sum.counts.validatedWithoutTests) {
+    parts.push(`${sum.counts.validatedWithoutTests} verified with no detectable test suite (excluded from the median above)`);
+  }
+  if (sum.counts.failed) {
+    parts.push(`${sum.counts.failed} failed verification, median ${_ms(sum.timeToFailure.p50Ms)} (counted separately)`);
+  }
+  return parts.join('; ') + '.';
+}
+
+export const _internals = { _dist, _pct, RELIABLE_N };

package/src/posture/fix-verify.js

@@ -21,6 +21,7 @@ import * as path from 'node:path';
 import { runFullScan } from '../engine.js';
 import { gateFixOutput } from './fix-honesty-gate.js';
 import { runProjectTests } from './test-runner.js';
+import { recordFixAttempt } from './fix-metrics.js';
 
 const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
 
@@ -164,10 +165,23 @@ export async function verifyFix({
   depFileContents,
   fixMeta,
   testTimeoutMs,
+  recordMetrics = true,
+  poc,
 } = {}) {
+  // R5 (reporting half) — time each stage as it runs. Measured here rather
+  // than inside each stage because only this function knows the boundaries of
+  // one verification ATTEMPT, which is the unit the distribution is over.
+  const stages = {};
+  const t0 = Date.now();
+  let mark = t0;
+  const _lap = (name) => { const now = Date.now(); stages[name] = now - mark; mark = now; };
+
   const rescan = await verifyPatch({ scanRoot, originalFindingStableId, files, depFileContents });
+  _lap('rescan');
   const lint = runProjectLinter(scanRoot, Object.keys(files || {}));
+  _lap('lint');
   const tests = runProjectTests(scanRoot, testTimeoutMs != null ? { timeoutMs: testTimeoutMs } : {});
+  _lap('tests');
   // True when a candidate patch was supplied but has not been written, so the
   // suite necessarily ran against the pre-patch tree. Surfaced in the summary
   // and on the result so a caller cannot mistake it for a verified patch.
@@ -177,7 +191,39 @@ export async function verifyFix({
   if (fixMeta && typeof fixMeta === 'object') {
     try { honesty = gateFixOutput(fixMeta); } catch { honesty = null; }
   }
-  const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && (honesty ? honesty.ok : true);
+  _lap('honesty');
+
+  // R5 — the PoC leg. Re-run the finding's proof-of-concept against the
+  // CANDIDATE patch inside R1's sandbox. A patch that still lets the PoC
+  // demonstrate the predicted effect has not fixed anything, however green the
+  // re-scan looks: the re-scan only proves the DETECTOR stopped firing, which
+  // a cosmetic edit can achieve. Execution is the stronger claim.
+  //
+  // Direction matters and is asymmetric on purpose. `execution-proven` after
+  // the patch is a hard FAIL. Anything else is NOT a pass — a PoC that failed
+  // to run, or a sandbox that could not start, is recorded as `inconclusive`
+  // and left out of the verdict entirely. Treating "could not prove it" as
+  // "fixed" is exactly the false confidence this leg exists to prevent.
+  let pocLeg = { status: 'not-requested', reason: null, tier: null };
+  if (poc?.code) {
+    try {
+      const { proveFinding } = await import('./execution-proof.js');
+      const proved = await proveFinding({ ...(poc.finding || {}), poc }, { files });
+      const tier = proved.proofTier;
+      pocLeg = tier === 'execution-proven'
+        ? { status: 'still-exploitable', tier, reason: proved.proofEvidence?.observed || null }
+        : proved.proofEvidence?.ran
+          ? { status: 'no-longer-proven', tier, reason: proved.proofEvidence?.reason || null }
+          : { status: 'inconclusive', tier, reason: proved.proofEvidence?.reason || null };
+    } catch (e) {
+      pocLeg = { status: 'inconclusive', tier: null, reason: `proof harness error: ${e.message}` };
+    }
+  }
+  _lap('poc');
+  const pocOk = pocLeg.status !== 'still-exploitable';
+
+  const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true);
+  const durations = { ...stages, totalMs: Date.now() - t0 };
   const summary = [
     `re-scan: ${rescan.ok ? 'PASS' : 'FAIL — ' + rescan.reason}`,
     `linter:  ${lint.runner === 'none' ? 'skipped (no linter config)'
@@ -193,6 +239,34 @@ export async function verifyFix({
               : tests.passed ? `PASS${_testedPrePatch ? ' — on the CURRENT on-disk tree, NOT the candidate patch' : ''}`
               : `FAIL (exit ${tests.exitCode})`}`,
     honesty ? `honesty: ${honesty.ok ? `PASS (${honesty.tier})` : 'FAIL — ' + honesty.violations.join('; ')}` : null,
+    // Never render `inconclusive` as a pass — say plainly that nothing was proven.
+    pocLeg.status === 'not-requested' ? null
+      : pocLeg.status === 'still-exploitable' ? `poc:     FAIL — the proof-of-concept still demonstrates the vulnerability against the patch`
+      : pocLeg.status === 'no-longer-proven' ? 'poc:     PASS (ran against the patch and no longer demonstrates the vulnerability)'
+      : `poc:     inconclusive — not counted either way (${pocLeg.reason || 'no detail reported'})`,
   ].filter(Boolean).join('\n');
-  return { ok, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, summary };
+  // Persist the attempt so the distribution can be reported from real runs.
+  // `testsRan` is the load-bearing field: it is what keeps "verified with no
+  // test suite to run" out of the headline time-to-validated-fix bucket.
+  // A patch that was never written to disk is recorded too, but flagged — its
+  // suite ran against the pre-patch tree, so its timing is real while its
+  // verdict is about a different tree.
+  if (recordMetrics && scanRoot) {
+    recordFixAttempt(scanRoot, {
+      at: new Date().toISOString(),
+      stableId: originalFindingStableId || null,
+      ok,
+      testsRan: !tests.skipped,
+      testsPassed: tests.skipped ? null : tests.passed === true,
+      testedPrePatch: _testedPrePatch,
+      lintRan: !(lint.skipped || lint.runner === 'none'),
+      honestyGated: honesty != null,
+      pocStatus: pocLeg.status,
+      files: Object.keys(files || {}).length,
+      stages,
+      totalMs: durations.totalMs,
+    });
+  }
+
+  return { ok, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
 }

package/src/runScan.js

@@ -3,7 +3,7 @@
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as cp from 'node:child_process';
-import fg from 'fast-glob';
+import { listFiles } from './util/glob.js';
 import { runFullScan, shouldScan } from './engine.js';
 import { appendScanSnapshot } from './posture/security-trend.js';
 import { recover as recoverFixHistory } from './posture/fix-history.js';
@@ -26,11 +26,7 @@ const DEFAULT_IGNORE = [
 ];
 
 export async function readTree(root, { ignore = [] } = {}) {
-  const entries = await fg('**/*', {
-    cwd: root, dot: true, onlyFiles: true,
-    ignore: [...DEFAULT_IGNORE, ...ignore], followSymbolicLinks: false,
-    suppressErrors: true,
-  });
+  const entries = await listFiles(root, { ignore: [...DEFAULT_IGNORE, ...ignore] });
   const fileContents = {};
   const depFileContents = {};
   for (const rel of entries) {