@clear-capabilities/agentic-security-scanner 0.130.0 → 0.133.0

package/src/sandbox/result.js

@@ -63,7 +63,7 @@ export function buildResult({ backend, spawnResult, unsupported = [] }) {
     status,
     denied,
     stdout: r.stdout ?? '',
-    stderr: rawStderr + (unsupported.length ? `\n[sandbox] limits not enforceable here: ${unsupported.join(', ')}` : ''),
+    stderr: rawStderr + (unsupported.length ? `\n[sandbox] not enforceable here: ${unsupported.join(', ')}` : ''),
     exitCode: r.status ?? null,
     timedOut,
     backend,

package/src/sast/CLAUDE.md

@@ -25,6 +25,10 @@ SAST detector modules. Each file exports one or more `scan*()` functions returni
 
 **Cross-cutting vuln classes** — `authz.js`, `csrf.js` (POST/PUT/PATCH/DELETE state-changing routes without CSRF defence; defence-aware suppression covers Express/Fastify/Flask/Django/FastAPI/Spring/Symfony **and Go (gin/echo/mux), Rails routes, ASP.NET MVC** — recognizes `gorilla/csrf`/`protect_from_forgery`/`[ValidateAntiForgeryToken]` defences and exempts token-auth (`[ApiController]`, Bearer scheme); bare ASP.NET `[Authorize]` still flags as cookie auth is CSRF-vulnerable), `code-injection-multilang.js` (CWE-94 for Java/C#/Go/Kotlin — dynamic code/expression evaluators on a NON-LITERAL argument: javax.script `eval`, GroovyShell, Spring SpEL `parseExpression`, MVEL/OGNL, Roslyn `CSharpScript`, `DataTable.Compute`, yaegi `interp.Eval`, `text/template` Parse of a user-controlled body; literal arguments don't match. JS/Python/Ruby eval stay with the flow engine + per-language modules), `csv-injection.js` (formula injection into spreadsheet cells, CWE-1236), `secret-concat.js` (language-agnostic hardcoded-secret SPLIT across concatenated literals — `'AKIA' + 'IOSF…'` / `'ghp' + '_…'` / `'sk' + '_live_…'` — reassembled and matched against provider prefixes; complements the contiguous-token secrets scanner and the C#-only split-concat rule), `host-header.js`, `jndi.js`, `jwt-exp.js`, `ldap-injection.js` (CWE-90 across JS/Java/Python **and** PHP/Go/C#/Ruby/Kotlin — filter built by concat/interpolation; an inline call-guard and a file-level escape-API guard suppress `ldap_escape`/`EscapeFilter`/`escape_filter_chars`/`Net::LDAP::Filter`/`EqualityFilter` forms), `xpath-injection.js` (CWE-643 across Java/Python/JS **and** PHP/Go/Ruby/C#/Kotlin — XPath expression built by concat/interpolation: `DOMXPath->query`, `SelectNodes`, Nokogiri `.xpath`, htmlquery/xmlpath, `XPath.compile`; embedded-quote-tolerant literal matching; parameterized/variable-bound APIs and static literals don't match), `mass-assignment.js`, `mutation-xss.js`, `nosql-injection.js`, `prototype-pollution.js`, `response-splitting.js` (CWE-113 CRLF/header injection across JS/Python/Java/PHP/Go/Ruby/C#/Kotlin — a response header value set from a request source without stripping CR/LF; recognizes CRLF-strip sanitizers — `.replace(/[\r\n]/)`, chained `.replace("\r")`, Ruby `gsub`/`delete`, Go `strings.NewReplacer`, PHP `str_replace` — and a request-scope param heuristic for the JVM/C# single-file shape), `ssrf-cloud-metadata.js`, `xss-reflected-multilang.js` (cross-language reflected XSS for Go/Ruby/PHP/C#/Kotlin/Java — user input written into an HTML response via concat/interpolation, e.g. Java servlet `response.getWriter().write("<…" + q)`, with a per-language escaper exclusion so `htmlspecialchars`/`HtmlEncode`/`template.HTMLEscapeString`/ERB `<%= %>`/OWASP `Encode.forHtml` forms don't match; JS/Python XSS stays with the flow engine + framework structural detectors), `stored-taint.js` (second-order / stored injection — **opt-in** via `AGENTIC_SECURITY_STORED_TAINT=1`), `toctou.js`, `wrong-context-sanitizer.js` (HTML-entity encoder used in a URL context — wrong-context output encoding, CWE-79), `zip-slip.js`, `file-upload.js` (CWE-434 unrestricted file upload for JS/Python — Multer configured with no `fileFilter`/`limits`, and a write whose destination is built from the client-supplied filename (`originalname`/`req.files.*.name`/`.filename`); suppressed by a `basename`/uuid/`secure_filename`/sanitizer in the window).
 
+**Specialist audit classes (R16)** — `crypto-specialist.js`. Narrow, high-credibility crypto-hygiene rules that no injection detector will ever find, because nothing is tainted: every value is already trusted and the defect is in how it is *handled*. Two classes, each chosen because it has an unambiguous correct form to point at. **CWE-208 non-constant-time comparison** — a secret compared with `===`/`.equals()`/`memcmp` short-circuits on the first differing byte, leaking how many leading bytes matched; silent whenever the line already uses `timingSafeEqual`/`compare_digest`/`ConstantTimeCompare`/`hash_equals`/`MessageDigest.isEqual`/`FixedTimeEquals`/`CRYPTO_memcmp`. **CWE-316 non-zeroizable secret material** — a Java `String` password (immutable, so it survives in the heap until GC and lands in heap dumps), and a C `memset(secret, 0, …)` that nothing reads afterwards (a dead store an optimiser may delete, which is why `explicit_bzero`/`memset_s` exist); a file already using a guaranteed wipe is left alone.
+
+Both key on the SECRET-NESS of the identifier, never on the comparison or the type alone — `if (a === b)` and `String name` are not findings. Length checks (`sig.length === 64`) and sentinel presence checks (`apiKey === null`) are excluded: the first leaks nothing an attacker cannot already measure, and the second is not a secret comparison at all. Keep it that way. A noisy specialist rule is worse than none, because it teaches people to ignore the whole class.
+
 **Cloud/infra** — `db-rls.js` (Supabase RLS), `env-hygiene.js` (NEXT_PUBLIC_ leaks, .env.example real values), `mobile-manifest.js`, `pipeline.js` (CI/CD integrity), `rate-limit.js`, `webhook.js`.
 
 **LLM / agent** — `llm.js`, `llm-owasp.js`, `llm-trading-agent.js`, `mcp-audit.js`, `model-load.js`, `prompt-firewall.js`, `prompt-template.js`.

package/src/sast/crypto-specialist.js

@@ -0,0 +1,247 @@
+// R16 — specialist audit classes.
+//
+// Narrow, high-credibility crypto-hygiene checks that a general injection
+// detector will never find, because nothing about the code is "tainted": every
+// value here is already trusted, and the defect is in HOW it is handled.
+//
+// Two classes, chosen because each has an unambiguous correct form to point at,
+// which is what keeps a specialist rule credible:
+//
+//   1. TIMING-UNSAFE COMPARISON (CWE-208). Comparing a secret with `===`,
+//      `.equals()` or `memcmp` short-circuits on the first differing byte, so
+//      the time taken leaks how many leading bytes were right. Repeated across
+//      requests that recovers the secret a byte at a time. Every language here
+//      ships a constant-time comparison; the fix is to call it.
+//
+//   2. NON-ZEROIZABLE SECRET MATERIAL (CWE-316). A secret in immutable storage
+//      cannot be erased after use, so it lingers in memory until GC and lands
+//      in heap dumps, core files and swap. Java's `String` is the classic case
+//      — the reason `char[]` exists in the JCA password APIs.
+//
+// PRECISION DISCIPLINE. Both rules key on the SECRET-NESS of the identifier,
+// not on the comparison or the type alone: `if (a === b)` is not a finding, and
+// neither is every `String`. That keeps the rules narrow enough to be worth
+// believing. The correct constant-time form must never match — each detector
+// checks for the safe API first and stays silent when it is present.
+
+import { blankComments } from './_comment-strip.js';
+
+// Identifiers that denote a secret worth constant-time treatment. Deliberately
+// specific: "token"/"key" alone are too common in ordinary code (a map key, a
+// pagination token), so they are only counted with a qualifying prefix.
+const SECRET_IDENT = /\b(?:hmac|signature|sig|mac|digest|password|passwd|pwd|secret|api_?key|apikey|auth_?token|access_?token|session_?token|csrf_?token|otp|totp|nonce_?hash|password_?hash|expected_?hash|challenge_?response)\b/i;
+
+// Constant-time comparison APIs, per ecosystem. Presence of any of these on a
+// line means the author already did the right thing.
+const CONSTANT_TIME = /\b(?:timingSafeEqual|compare_digest|ConstantTimeCompare|hash_equals|MessageDigest\.isEqual|CryptographicOperations\.FixedTimeEquals|secure_compare|sodium_memcmp|CRYPTO_memcmp|NSData.*isEqualToData|constantTimeAreEqual|slowEquals)\b/;
+
+// An unsafe comparison of two expressions, where at least one names a secret.
+const UNSAFE_COMPARE = [
+  // JS/TS, Python, Go, PHP, Ruby: ==, ===, !=, !==
+  { re: /([A-Za-z_$][\w$.\[\]'"]*)\s*(?:===|==|!==|!=)\s*([A-Za-z_$][\w$.\[\]'"()]*)/g, form: 'equality operator' },
+  // Java/C#/Kotlin/Scala: a.equals(b) / a.Equals(b). The capital form is the
+  // .NET spelling and was a real miss — a C# fixture scored pre:FN on it.
+  { re: /([A-Za-z_$][\w$.]*)\s*\.\s*[Ee]quals\s*\(\s*([A-Za-z_$][\w$.()]*)\s*\)/g, form: '.equals()' },
+  // C/C++: memcmp / strcmp / strncmp
+  { re: /\b(?:mem|str|strn)cmp\s*\(\s*([A-Za-z_][\w.\->\[\]]*)\s*,\s*([A-Za-z_][\w.\->\[\]]*)/g, form: 'memcmp/strcmp' },
+];
+
+const REMEDIATION = {
+  js: 'Use crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b)) — it compares in constant time. Guard the length first, since it throws on a length mismatch.',
+  py: 'Use hmac.compare_digest(a, b).',
+  go: 'Use subtle.ConstantTimeCompare([]byte(a), []byte(b)) == 1.',
+  java: 'Use MessageDigest.isEqual(a, b) on byte[].',
+  cs: 'Use CryptographicOperations.FixedTimeEquals(a, b).',
+  php: 'Use hash_equals($known, $user).',
+  rb: 'Use ActiveSupport::SecurityUtils.secure_compare(a, b), or OpenSSL.secure_compare.',
+  c: 'Use CRYPTO_memcmp (OpenSSL) or sodium_memcmp — never memcmp/strcmp on secrets.',
+};
+
+const EXT_LANG = {
+  '.js': 'js', '.mjs': 'js', '.cjs': 'js', '.ts': 'js', '.tsx': 'js', '.jsx': 'js',
+  '.py': 'py', '.go': 'go', '.java': 'java', '.kt': 'java', '.scala': 'java',
+  '.cs': 'cs', '.php': 'php', '.rb': 'rb',
+  '.c': 'c', '.h': 'c', '.cc': 'c', '.cpp': 'c', '.cxx': 'c', '.hpp': 'c',
+};
+
+function _lang(file) {
+  const m = String(file).toLowerCase().match(/\.[a-z]+$/);
+  return m ? EXT_LANG[m[0]] || null : null;
+}
+
+function _lineAt(text, index) {
+  return text.slice(0, index).split('\n').length;
+}
+
+/**
+ * CWE-208 — comparison of secret material in non-constant time.
+ */
+// JavaScript is already covered TWICE — by `sast/comparison-safety.js` and by
+// the `Timing Oracle` rule in engine.js — so firing here made a third finding
+// on the same line. The synthetic F1 bench counted the duplicates as false
+// positives and the strict gate failed on a 0.34pp F1 regression. That is the
+// mistake this module's own header warns about: a noisy specialist rule is
+// worse than none.
+//
+// Excluded for JS ONLY, and the scope was checked rather than assumed. The
+// first attempt also excluded Python and Go on the theory that
+// `comparison-safety.js` covers them — it nominally does, but its
+// TIMING_SENSITIVE vocabulary uses word boundaries (`\btoken\b`), so
+// `access_token == secret` matches nothing: `token` is not on a word boundary
+// inside `access_token`, and bare `secret` is not in its list at all. Excluding
+// Python would therefore have removed the ONLY coverage of that shape. Verified
+// by scanning the fixture: zero findings without this rule.
+const ALREADY_COVERED_LANGS = new Set(['js']);
+
+export function scanTimingUnsafeComparison(file, content) {
+  const lang = _lang(file);
+  if (!lang || typeof content !== 'string') return [];
+  if (ALREADY_COVERED_LANGS.has(lang)) return [];
+  const body = blankComments(content, file);
+  const out = [];
+  const seen = new Set();
+
+  for (const { re, form } of UNSAFE_COMPARE) {
+    const rx = new RegExp(re.source, re.flags);
+    let m;
+    while ((m = rx.exec(body))) {
+      const [whole, left, right] = m;
+      if (!SECRET_IDENT.test(left || '') && !SECRET_IDENT.test(right || '')) continue;
+
+      const line = _lineAt(body, m.index);
+      const lineText = body.split('\n')[line - 1] || '';
+      // Already constant-time on this line: the author did it right.
+      if (CONSTANT_TIME.test(lineText)) continue;
+      // A length check is not a secret comparison — `sig.length === 64` leaks
+      // nothing an attacker cannot already measure.
+      if (/\.(?:length|size|len)\b/i.test(whole) || /\blen\s*\(/i.test(whole)) continue;
+      // Comparisons against a null/undefined/empty sentinel are presence
+      // checks, not secret comparisons. Tested on the OPERANDS, not on the
+      // whole match: the right-hand capture can swallow a trailing paren, and
+      // an end-anchored test against the raw match then silently misses.
+      const _sentinel = (x) => /^(?:null|nil|None|undefined|""|''|0|false|true)$/i
+        .test(String(x || '').replace(/[)\s;,]+$/, '').trim());
+      if (_sentinel(left) || _sentinel(right)) continue;
+
+      const key = `${file}:${line}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+
+      out.push({
+        id: `timing-unsafe-compare-${file}-${line}`,
+        severity: 'medium',
+        file,
+        line,
+        vuln: 'Non-Constant-Time Comparison of Secret',
+        cwe: 'CWE-208',
+        family: 'timing-side-channel',
+        parser: 'REGEX',
+        description:
+          `A secret is compared with ${form}, which returns as soon as two bytes differ. `
+          + 'The time taken therefore depends on how many leading bytes matched, and an attacker '
+          + 'who can measure it recovers the value one byte at a time.',
+        remediation: REMEDIATION[lang],
+      });
+    }
+  }
+  return out;
+}
+
+// Java-family immutable secret storage. `String` cannot be overwritten, so a
+// password held in one survives until GC and appears in heap dumps.
+//
+// NARROWED after the real-world bench measured the cost of the broad form. The
+// first version matched ANY `String <secretish> = …`, including a hardcoded
+// literal — which is the single most common shape in a large public Java
+// vulnerability corpus (its hard-coded-password cases number in the thousands).
+// Every one produced a CWE-316 finding, dropping that corpus's F1 to 89.2%
+// against a 95% floor. A Java-heavy benchmark WITHOUT that shape scored 99.6%
+// in the same run, which is what isolated the cause.
+//
+// Two reasons the literal case must not fire here. It is already the
+// hardcoded-secret detectors' job, so this was a duplicate — the same mistake
+// as the JS timing rule. And the CWE-316 claim is about secret material living
+// in memory that cannot be wiped; a literal is in the class file either way, so
+// `char[]` buys nothing. The defect only exists when a RUNTIME secret is loaded
+// into an immutable String.
+const JAVA_STRING_SECRET = /\bString\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+);/g;
+
+// Initializers that actually load a secret at runtime.
+const RUNTIME_SECRET_SOURCE = /\b(?:System\s*\.\s*getenv|System\s*\.\s*getProperty|readPassword|readLine|getPassword|getSecret|getToken|getApiKey|getCredential|vault|keystore|getConnectionPassword)\b/i;
+
+// C-family zeroization that the compiler is permitted to delete. A `memset`
+// whose buffer is never read afterwards is a dead store, and optimisers remove
+// it — the canonical reason `explicit_bzero`/`memset_s` exist.
+const C_MEMSET_SECRET = /\bmemset\s*\(\s*([A-Za-z_][\w.\->\[\]]*)\s*,\s*0\s*,/g;
+const C_SAFE_ZERO = /\b(?:explicit_bzero|memset_s|SecureZeroMemory|sodium_memzero|OPENSSL_cleanse)\b/;
+
+/**
+ * CWE-316 — secret material that cannot be erased after use.
+ */
+export function scanMissingZeroization(file, content) {
+  const lang = _lang(file);
+  if (!lang || typeof content !== 'string') return [];
+  const body = blankComments(content, file);
+  const out = [];
+
+  if (lang === 'java') {
+    let m;
+    const rx = new RegExp(JAVA_STRING_SECRET.source, JAVA_STRING_SECRET.flags);
+    while ((m = rx.exec(body))) {
+      const name = m[1];
+      const init = m[2] || '';
+      if (!SECRET_IDENT.test(name)) continue;
+      // A literal is the hardcoded-secret detectors' finding, not this one.
+      if (!RUNTIME_SECRET_SOURCE.test(init)) continue;
+      const line = _lineAt(body, m.index);
+      out.push({
+        id: `non-zeroizable-secret-${file}-${line}`,
+        severity: 'low',
+        file,
+        line,
+        vuln: 'Secret Held in Non-Zeroizable Storage',
+        cwe: 'CWE-316',
+        family: 'key-hygiene',
+        parser: 'REGEX',
+        description:
+          `'${name}' holds secret material in a String. Strings are immutable, so the value cannot be `
+          + 'overwritten after use: it stays readable in the heap until garbage collection and can '
+          + 'surface in heap dumps, core files and swap. This is why the JCA password APIs take char[].',
+        remediation: 'Hold the secret in a char[] or byte[] and overwrite it with java.util.Arrays.fill(buf, (char) 0) in a finally block once it is no longer needed.',
+      });
+    }
+  }
+
+  if (lang === 'c') {
+    if (C_SAFE_ZERO.test(body)) return out; // the author already uses a guaranteed wipe
+    let m;
+    const rx = new RegExp(C_MEMSET_SECRET.source, C_MEMSET_SECRET.flags);
+    while ((m = rx.exec(body))) {
+      const name = m[1];
+      if (!SECRET_IDENT.test(name)) continue;
+      const line = _lineAt(body, m.index);
+      out.push({
+        id: `removable-zeroization-${file}-${line}`,
+        severity: 'medium',
+        file,
+        line,
+        vuln: 'Secret Wipe Removable by the Optimiser',
+        cwe: 'CWE-316',
+        family: 'key-hygiene',
+        parser: 'REGEX',
+        description:
+          `'${name}' is zeroed with memset, but nothing reads the buffer afterwards. That makes the `
+          + 'write a dead store, which an optimising compiler is entitled to delete outright — so the '
+          + 'secret is left in memory in exactly the build where it matters most.',
+        remediation: 'Use explicit_bzero (BSD/glibc), memset_s (C11 Annex K), SecureZeroMemory (Windows), sodium_memzero or OPENSSL_cleanse — each is guaranteed not to be optimised away.',
+      });
+    }
+  }
+
+  return out;
+}
+
+/** Both specialist classes in one call, for the engine. */
+export function scanCryptoSpecialist(file, content) {
+  return [...scanTimingUnsafeComparison(file, content), ...scanMissingZeroization(file, content)];
+}

package/src/util/glob.js

@@ -0,0 +1,173 @@
+// File discovery on top of the Node standard library only.
+//
+// Two entry points, both replacing a third-party glob package that used to be a
+// production dependency:
+//
+//   listFiles(root, {ignore})  — the scan-tree walk behind readScan/readTree.
+//   globFiles(pattern, {cwd})  — resolve a user-supplied glob to regular files.
+//
+// `globFiles` is a thin wrapper: `fs.promises.glob` matches the old behaviour
+// for the way those call sites used it (dot:false, onlyFiles:true, symlinks
+// followed), so all it adds is the files-only filter.
+//
+// `listFiles` cannot be a thin wrapper, and the reasons are worth stating
+// precisely, because each one is a way file discovery could silently change:
+//
+//   * dot — the built-in glob (like every minimatch-derived matcher) will not
+//     let `*` or `**` match a path segment starting with `.`, and exposes no
+//     option to change that. The scan tree must include hidden files and must
+//     descend into hidden directories, so the walk is done with fs.readdir
+//     instead, where visibility is simply not a concept.
+//   * onlyFiles — a glob walk yields directories as well; only regular files
+//     are wanted. readdir's Dirent gives that directly, with no extra stat.
+//   * followSymbolicLinks:false — the built-in glob follows symlinked
+//     directories with no option to stop it, which would let a link inside the
+//     tree pull unrelated content (or content outside the scan root) into the
+//     scan. readdir's Dirent is lstat-derived: a symlink reports isSymbolicLink
+//     and neither isDirectory nor isFile, so links are skipped by construction
+//     and their targets are never reached.
+//   * suppressErrors — an unreadable directory must not abort the walk. Each
+//     readdir is individually guarded.
+//   * ignore — patterns are still matched with the built-in path.matchesGlob;
+//     only the dot-blindness above is compensated for (see unhide()).
+//
+// Ordering matches the previous implementation's breadth-first shape: every
+// entry of one depth is emitted before any entry of the next.
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+
+// Two properties of path.matchesGlob have to be corrected, and both are
+// corrected the same way: by rewriting the subject *and* the pattern through
+// the same injective transform, so the built-in matcher does the actual glob
+// work while the transform carries the semantics it will not.
+//
+//  1. Dot-blindness. A wildcard will not match a path segment starting with
+//     `.`, and there is no option to change that. Rewriting a segment's leading
+//     dot to a control character makes wildcards dot-permissive while keeping
+//     an explicitly-named segment literal: pattern `.git` becomes `<1>git`,
+//     which still matches a directory named `.git` and still does not match one
+//     named `git`. Only applied where dot-permissive matching is wanted.
+//  2. Partial case-folding. The matcher folds case in some positions — e.g.
+//     `UPPER/MiXeD.JS` matches `**/*.js` — while `Test/a.js` does not match
+//     `**/test/**`. That inconsistency is worse than either rule on its own,
+//     and case-folding is not what the previous implementation did. Encoding
+//     each upper-case letter as a control character plus its lower-case form
+//     makes matching case-sensitive everywhere: no folded comparison can
+//     reintroduce the marker.
+//
+// Neither control character can appear in a filename produced by any of the
+// filesystems this runs on, so the transform cannot collide with real content.
+const DOT = String.fromCharCode(1);
+const UP = String.fromCharCode(2);
+const HAS_UPPER = /[A-Z]/;
+const ALL_UPPER = /[A-Z]/g;
+const foldUp = c => UP + c.toLowerCase();
+
+function prepPath(p, dot) {
+  let s = p;
+  if (dot && s.includes('.')) {
+    const segs = s.split('/');
+    for (let i = 0; i < segs.length; i++) {
+      if (segs[i].charCodeAt(0) === 46) segs[i] = DOT + segs[i].slice(1);
+    }
+    s = segs.join('/');
+  }
+  return HAS_UPPER.test(s) ? s.replace(ALL_UPPER, foldUp) : s;
+}
+
+/**
+ * True when `rel` (a '/'-separated relative path) matches any of `patterns`.
+ * Case-sensitive; wildcards match hidden segments.
+ */
+export function matchesAnyGlob(rel, patterns) {
+  if (!patterns || patterns.length === 0) return false;
+  const subject = prepPath(rel, true);
+  for (const pat of patterns) {
+    if (path.matchesGlob(subject, prepPath(pat, true))) return true;
+  }
+  return false;
+}
+
+// A directory may be skipped wholesale only when a pattern provably excludes
+// every possible descendant. `<prefix>/**` is exactly that shape: `**` absorbs
+// any number of trailing segments, so if the directory matches `<prefix>` then
+// nothing beneath it can survive. Anything else (`<prefix>/*`, `**/*.min.js`)
+// may exclude some descendants and keep others, so those directories are walked
+// and their files filtered individually. Pruning is therefore only ever a
+// speed-up: correctness comes from the per-file check.
+function prunable(subject, prepared) {
+  for (const p of prepared) {
+    if (p.subtree && path.matchesGlob(subject, p.subtree)) return true;
+  }
+  return false;
+}
+
+function prepare(patterns) {
+  return patterns.map(pat => {
+    const glob = prepPath(pat, true);
+    return { glob, subtree: glob.endsWith('/**') ? glob.slice(0, -3) : null };
+  });
+}
+
+/**
+ * Every regular file under `root`, as '/'-separated paths relative to `root`.
+ * Hidden entries included; directories and symlinks excluded; unreadable
+ * directories skipped; `ignore` globs applied to each file path.
+ */
+export async function listFiles(root, { ignore = [] } = {}) {
+  const prepared = prepare(ignore);
+  const out = [];
+  let level = [''];
+  while (level.length) {
+    const next = [];
+    for (const dir of level) {
+      let entries;
+      try {
+        entries = await fs.readdir(dir ? path.join(root, dir) : root, { withFileTypes: true });
+      } catch {
+        continue; // unreadable or vanished — skip it, keep walking
+      }
+      for (const e of entries) {
+        const rel = dir ? `${dir}/${e.name}` : e.name;
+        const subject = prepared.length ? prepPath(rel, true) : '';
+        if (e.isDirectory()) {
+          if (!prunable(subject, prepared)) next.push(rel);
+        } else if (e.isFile()) {
+          let skip = false;
+          for (const p of prepared) {
+            if (path.matchesGlob(subject, p.glob)) { skip = true; break; }
+          }
+          if (!skip) out.push(rel);
+        }
+        // symlinks, sockets, fifos and block/char devices are not files
+      }
+    }
+    level = next;
+  }
+  return out;
+}
+
+/**
+ * Resolve a user-supplied glob to regular files, relative to `cwd`. Hidden
+ * paths are not matched (the built-in default) and symlinks are followed, both
+ * matching the previous behaviour at these call sites.
+ *
+ * Two corrections are layered on the built-in walk: results are narrowed to
+ * regular files (a glob yields directories too), and the partial case-folding
+ * described above is undone by re-checking each result against the pattern
+ * case-sensitively — a `.SARIF` file must not answer to `*.sarif`. Symlink
+ * cycles are the one place this is deliberately not bug-compatible: the
+ * built-in stops at a cycle instead of re-enumerating the tree through it.
+ */
+export async function globFiles(pattern, { cwd = process.cwd() } = {}) {
+  const strict = prepPath(pattern, false);
+  const out = [];
+  for await (const p of fs.glob(pattern, { cwd })) {
+    if (!path.matchesGlob(prepPath(p, false), strict)) continue;
+    try {
+      const st = await fs.stat(path.isAbsolute(p) ? p : path.join(cwd, p));
+      if (st.isFile()) out.push(p);
+    } catch { /* vanished or dangling link — not a file */ }
+  }
+  return out;
+}