@clear-capabilities/agentic-security-scanner 0.132.0 → 0.133.0

package/CHANGELOG.md

@@ -1,5 +1,130 @@
 # Changelog
 
+## 0.133.0 — two ways findings could be silently deleted, both closed
+
+Four rounds of adversarial premortem against this repository's own artifacts.
+Two rounds found working exploits in shipped code; both are fixed and both are
+pinned by tests that run the original attack. The rest is measurement honesty —
+several gates turned out to prove less than they claimed, including one defect
+this effort introduced and then caught.
+
+### Security
+
+- **A signature anyone could forge could disable any detector.**
+  `verifyLastScan` accepted a second key derived as
+  `sha256(<constant salt> + ':' + hostname)`. The salt is a constant in
+  published, npm-shipped source and a hostname is not a secret. Because the
+  `disable:` list in `rules.yml` is gated on that verification, a signature
+  forged from public information alone switched off arbitrary detectors and the
+  scan reported clean. Demonstrated end to end: a command-injection finding went
+  from 1 reported to 0, and back to 1 after the fix.
+
+  This had been known and fixed once already. The 0.62.0 entry below introduced
+  the per-install key precisely because the old one was "hostname-derived and
+  publicly forgeable in CI / containers", and kept legacy verification "for one
+  release to migrate existing signed scans". It was still accepted **seventy
+  minor releases later**. A migration window nobody closes is not a migration
+  window; it is the vulnerability, kept. Verification now accepts exactly one
+  key. Signatures made under the legacy key stop verifying — intended, and it
+  fails closed.
+
+- **The LLM validator cache was a finding-deletion primitive.** A cache hit
+  assigned a verdict directly, and a `reject` verdict drops a finding. The cache
+  was read with a bare `JSON.parse(readFileSync(...))`, so planting one file
+  under `.agentic-security/llm-cache/` deleted a critical finding with no model
+  call and no network. The key is derivable by anyone with repo access, and CI
+  restoring a cache directory between runs delivers it without a repo write at
+  all. Cache entries are now HMAC-signed with the same mechanism `last-scan.json`
+  already used; an unsigned, tampered or foreign-keyed entry is a MISS, never a
+  verdict.
+
+- **A `reject` can no longer delete a strongly-provenanced finding.** The code
+  asserted that prompt-injecting the validator was harmless because "the worst
+  an attacker can produce is escalate". That was false: the challenge/nonce
+  cross-check defends against forged and replayed responses, not against a model
+  persuaded by source it legitimately read. Findings from real analysis
+  (taint-proven, multi-sink, execution-proven) are now demoted to `escalate`
+  rather than dropped, so the guarantee is structural instead of asserted.
+
+- **Coverage reduction is now visible in the artifact.** A `disable:` that took
+  effect produced findings that were simply absent — indistinguishable from
+  clean code to whoever reads the report. `suppressedRules` now carries the
+  count, per-rule severity breakdown, example locations and the AUTHORITY the
+  suppression ran under, so a signed suppression reads differently from an
+  env-var opt-out. Authorised suppressions are reported too: a signature proves
+  who asked, not that the hidden findings stopped existing.
+
+- **Signatures carry key provenance** (`env` / `per-install` / `ephemeral`).
+  `env` means whoever set the environment could have signed the run; `ephemeral`
+  means the key could not be persisted and the signature will never verify
+  again. Neither was inferable from the digest.
+
+- **The suppression quorum has a floor of 2.** `AGENTIC_SECURITY_LEARN_QUORUM=1`
+  was honoured, so a single triage verdict could suppress a finding — and with
+  family+path matching, a whole family across a path. The root guidance warned
+  about exactly this; the code did not enforce it.
+
+### Measurement honesty
+
+- **The corpus is fitted to the detectors it measures, and now says so.** 98% of
+  entries are self-authored synthetic fixtures and none come from the
+  disclosed-PoC tier. `npm run corpus:provenance` prints the composition on every
+  run and fails a commit that lands a detector together with the corpus entries
+  exercising it — caught against real history, including one such commit in this
+  very effort. This stops the loop tightening; it does not make the corpus
+  independent, and the docs no longer imply otherwise.
+
+- **The precision gate covered 6% of the source.** It ran over `hooks/` and
+  `scripts/` — 22 files — while `scanner/src` (383 files, the entire product) sat
+  outside it. Now 240 files. The `scanner/src` count is published as a DRIFT
+  TRIPWIRE, explicitly not hand-reviewed and explicitly not a precision figure,
+  because a scanner's own source contains sink patterns as data.
+
+- **The determinism gate exercised only the layer that cannot vary.** The
+  original fixture produced findings from regex and structural detectors alone. A
+  second fixture now drives the interprocedural taint engine and the Python
+  parser, digests are compared per fixture so a divergence names the layer, and
+  the comparator fails if the deep fixture degraded to the syntactic layer on any
+  machine.
+
+- **The scorecard gate could not detect a stale scorecard.** It compared only the
+  engine version, so a document measured over 200 corpus entries passed while the
+  corpus held 210 — every published rate computed over a population that no
+  longer existed. It now compares the population too.
+
+- **The independent-evaluation gate passed on a 4-sample smoke fixture** its own
+  README says must never be cited, because its thresholds had been calibrated to
+  pass. It now uses the README's own figures, treats exceeded calibration targets
+  as violations rather than notes, and refuses to emit a pass over the built-in
+  fixture however the thresholds are set. It fails today, correctly.
+
+- **Claims re-scoped to what is measured.** The roadmap carries a "What the gates
+  do not prove" section, states outright that the false-positive-rate goal is not
+  met, and points at the two harnesses built for that gap — both of which need
+  data, not code. R13 is downgraded from "landed" to "mechanism landed, no
+  observation pipeline": nothing constructs its ledger, so it can never downgrade
+  anything.
+
+### Fixed along the way
+
+- **The validator cache had never persisted a single entry.** `safeWriteState`
+  refused every directory nested under `.agentic-security/`, so `llm-cache/`,
+  `fix-history/` and `sbom-history/` were all unwritable while a
+  `validator-cache stats|gc` subcommand managed a cache that was always empty.
+  Found by a positive-control test asserting a legitimately written entry
+  round-trips.
+
+- **Sandbox timeouts now use SIGKILL.** The kernel does not deliver
+  default-action signals to a PID namespace's pid 1 from outside it, so SIGTERM
+  was dropped and a payload ran to completion against a 1200 ms budget — measured
+  in CI at 30057 ms. Proof execution also gained its own aggregate wall-clock
+  budget, because a count cap bounds nothing in time.
+
+- **Cost reporting stopped presenting an estimate as spend.** The endpoint's
+  usage report was discarded, so the ledger always booked the pre-call worst
+  case. Usage is now plumbed through, and any estimated component renders as
+  "at most $X" with the reason.
+
 ## 0.132.0 — a proven exploit becomes a permanent regression test
 
 The corpus stops being only a regression net and starts being fed by the engine

package/bin/agentic-security.js

@@ -17,7 +17,7 @@ import { recordScan, formatStreakLine, formatGradeDelta } from '../src/posture/s
 import { ingestAndMerge } from '../src/sca/sarif-ingest.js';
 import { loadProfile, saveProfile, detectProfile, renderAttributionLine, ATTRIBUTION, ATTRIBUTION_URL } from '../src/posture/profile.js';
 import { applySuppressions, addSoftAcceptance, expiredSoftAcceptances } from '../src/posture/suppressions.js';
-import { applyOverrides, validateOverrides } from '../src/posture/rule-overrides.js';
+import { applyOverrides, validateOverrides, suppressionReport, renderSuppressionSummary } from '../src/posture/rule-overrides.js';
 import { listPacks, loadPack, applyPacks } from '../src/posture/rule-packs.js';
 import { writeLockfile, verifyLockfile, makeDeterministic, isDeterministic } from '../src/posture/deterministic.js';
 import { enrichWithEPSS } from '../src/posture/epss.js';
@@ -512,6 +512,19 @@ async function cmdScan(args) {
   scan.findings    = applyOverrides(scan.findings    || [], targetAbs);
   scan.secrets     = applyOverrides(scan.secrets     || [], targetAbs);
   scan.logicVulns  = applyOverrides(scan.logicVulns  || [], targetAbs);
+  // Coverage reduction belongs in the ARTIFACT, not only in a log line. A
+  // `disable:` that takes effect otherwise produces findings that are simply
+  // absent, which is indistinguishable from clean code to whoever reads the
+  // report. Recorded whether the suppression was authorised or not — an
+  // authorised one still hides results.
+  try {
+    const _sup = suppressionReport(targetAbs);
+    if (_sup) {
+      scan.suppressedRules = _sup;
+      const _line = renderSuppressionSummary(_sup);
+      if (_line) process.stderr.write(`⚠️  agentic-security: ${_line}\n`);
+    }
+  } catch { /* reporting must never fail a scan */ }
 
   // Curated rule packs: --pack <name> (repeatable). Narrows findings to the
   // CWEs covered by the requested pack(s).
@@ -575,6 +588,7 @@ async function cmdScan(args) {
   // only — a failure here must never fail a scan.
   try {
     const { computeRunAttestation } = await import('../src/posture/attestation.js');
+    const { keyProvenance } = await import('../src/posture/integrity.js');
     const { effectiveVersion } = await import('../src/posture/ruleset-version.js');
     scan.attestation = computeRunAttestation({
       findings: normalizeFindings(scan),
@@ -584,6 +598,11 @@ async function cmdScan(args) {
       root: targetAbs,
       sign: true,
     });
+    // P1-3 — a signature is only as meaningful as the key behind it.
+    // `env` means whoever set the environment could have signed this;
+    // `ephemeral` means the key could not be persisted, so this signature will
+    // never verify on any later run. Neither is inferable from the digest.
+    if (scan.attestation) scan.attestation.keyProvenance = keyProvenance();
   } catch { /* attestation is metadata; never fail a scan over it */ }
 
   // R2: Always emit machine-readable artifacts to .agentic-security/.

package/dist/113.index.js

@@ -406,8 +406,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 595 modules
-var engine = __webpack_require__(4660);
+// EXTERNAL MODULE: ./src/engine.js + 600 modules
+var engine = __webpack_require__(5865);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //
@@ -946,7 +946,7 @@ async function verifyFix({
   let pocLeg = { status: 'not-requested', reason: null, tier: null };
   if (poc?.code) {
     try {
-      const { proveFinding } = await __webpack_require__.e(/* import() */ 259).then(__webpack_require__.bind(__webpack_require__, 8259));
+      const { proveFinding } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 1291));
       const proved = await proveFinding({ ...(poc.finding || {}), poc }, { files });
       const tier = proved.proofTier;
       pocLeg = tier === 'execution-proven'

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4660);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5865);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(4660);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5865);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/526.index.js

@@ -234,8 +234,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 595 modules
-var engine = __webpack_require__(4660);
+// EXTERNAL MODULE: ./src/engine.js + 600 modules
+var engine = __webpack_require__(5865);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //
@@ -774,7 +774,7 @@ async function verifyFix({
   let pocLeg = { status: 'not-requested', reason: null, tier: null };
   if (poc?.code) {
     try {
-      const { proveFinding } = await __webpack_require__.e(/* import() */ 259).then(__webpack_require__.bind(__webpack_require__, 8259));
+      const { proveFinding } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 1291));
       const proved = await proveFinding({ ...(poc.finding || {}), poc }, { files });
       const tier = proved.proofTier;
       pocLeg = tier === 'execution-proven'

package/dist/637.index.js

@@ -11,7 +11,7 @@ export const modules = {
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(4660);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(5865);
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings