@clear-capabilities/agentic-security-scanner 0.132.0 → 0.134.0

package/CHANGELOG.md

@@ -1,5 +1,233 @@
 # Changelog
 
+## 0.134.0 — the loop closes, and the logic tier learns how to be wrong
+
+The remaining PRD epics. Two of them are new capability; the other two are the
+same idea applied twice — a claim nobody can disagree with is the weakest thing
+this engine emits, so both new tiers ship with the machinery to refute
+themselves.
+
+### Two more proof classes, and neither needed a running application
+
+`sql-injection` and `path-traversal` join the three existing classes. The PRD
+assumed both would wait on a running-app harness; they did not, because the
+harness was never where the proof lived.
+
+- **SQL injection is settled at the driver boundary.** Either the payload
+  arrives inside the query TEXT or it arrives as a bound parameter — the first
+  is the vulnerability by definition and the second is the fix by definition,
+  and no schema, rows or live server are needed to tell them apart. The PoC
+  stubs the driver with a recorder and writes the marker only when the payload
+  shows up inside something recognisably SQL. A parameterised query reaches
+  `proof-failed` by **execution**, not by reading the source.
+- **Path traversal is settled by what comes back.** A sentinel is planted
+  outside the served directory and the marker is written only if its content —
+  or, for `sendFile`, its resolved path — comes back out of the handler. A
+  `basename` guard is refuted by running it.
+
+Both directions are pinned by tests that execute in the real sandbox. Classes
+still absent (IDOR, SSRF, XSS) are now documented as decisions with reasons
+rather than gaps: a PoC built on invented application state proves something
+about the invention.
+
+Fixed along the way: the webhook PoC wrote its marker after a top-level `await`
+guarded by an **unref'd** timer, so a handler that never replied let Node exit
+with the promise pending and the marker check never ran. The test asserting
+"no decision writes no marker" had been passing without reaching the line it
+was testing. Timer is now ref'd and cleared, with a positive control asserting
+the process reaches exit 0.
+
+### The autonomous loop, wired to real stages
+
+`scripts/autopilot.mjs` connects the loop to a real scan, a real sandboxed
+exploit, a deterministic-then-model fix, and the real gate. End-to-end tests run
+the whole thing against a live HTTP endpoint, including the one that matters: a
+patch that changes the file, reads like a fix, and would satisfy any "did the
+scanner go quiet?" check is **refused and never written**, because the exploit
+still fires against it.
+
+The CLI refuses to start without a confinement backend (the verdict requires
+executing something) and refuses a dirty git tree by default (the test leg
+writes the candidate patch to disk and restores it in a `finally`; a clean tree
+is what makes a crash recoverable). A verified fix reached with no test runner
+detected is counted and reported separately — the exploit stopped firing, but
+nothing checked the application still works.
+
+### The business-logic tier learns how to be wrong
+
+The deterministic half already existed. The reviewing agent's half was prose:
+it asserted that a handler lets one user act on another's resource, and nothing
+in the finding gave a second party anything to disagree with. It was the only
+tier in this engine with no way to be wrong.
+
+`posture/logic-claims.js` adds three offline lenses that can refute one —
+citation (the file exists and the line is inside it), quotation (the quoted
+snippet is at the cited line), corroboration (a "no authentication" claim
+against a handler that plainly authenticates). Verdicts go through the existing
+producer/verifier separation, so a lens can never vote on a claim it produced;
+that is why the lenses are deterministic code and not another prompt. Refuted
+claims are quarantined, never deleted and never severity-touched.
+
+### A comparison harness that ships no opinion about who the competition is
+
+`posture/comparison.js` + `scripts/comparison.mjs` score this engine
+head-to-head against participants **the operator supplies**. The repository
+ships the harness and the answer key and names no tool — a test enforces that.
+
+Two properties are the entire module. Every rate is computed over the
+**intersection** of corpus entries *all* participants completed, because a tool
+that crashed on the forty hardest entries and was scored over the remaining
+hundred and seventy looks like it beat one that completed everything, and the
+difference is invisible in the output. And an entry a participant could not run
+is **unscored**, never counted as a miss: counting a crash as a false negative
+penalises a tool for a harness problem, counting it as a pass rewards it for
+one. Matching is CWE-only so nobody is scored on this engine's vocabulary.
+
+No comparison figures are published in this repository. Running other vendors'
+tools and publishing the numbers is the operator's call, not the harness's.
+
+### The suppression pragma never worked
+
+Found while suppressing a false positive in this release's own new code.
+`// agentic-security-ignore: <rule-id>` is documented in `CLAUDE.md` and
+`pr-comment.js` tells every reviewer to use it — and **nothing implemented it**.
+It has been advertised and inert. A dead suppression mechanism is worse than an
+absent one: the developer writes the pragma, sees the finding again, and
+concludes the scanner is noisy rather than that the pragma is dead.
+
+Now implemented in `engine.js`, applied after dedupe and after every cross-file
+pass so it covers a finding whichever analysis produced it. Line-scoped, matched
+against the finding's id / vuln / CWE / family, and **logged** to the same
+ledger custom rules use so `--include-suppressed` can show it. Every test
+carries a positive control — the same file without the pragma must still
+produce the finding, or "0 findings" would prove the suppression works and
+equally prove the detector stopped firing.
+
+## 0.133.0 — two ways findings could be silently deleted, both closed
+
+Four rounds of adversarial premortem against this repository's own artifacts.
+Two rounds found working exploits in shipped code; both are fixed and both are
+pinned by tests that run the original attack. The rest is measurement honesty —
+several gates turned out to prove less than they claimed, including one defect
+this effort introduced and then caught.
+
+### Security
+
+- **A signature anyone could forge could disable any detector.**
+  `verifyLastScan` accepted a second key derived as
+  `sha256(<constant salt> + ':' + hostname)`. The salt is a constant in
+  published, npm-shipped source and a hostname is not a secret. Because the
+  `disable:` list in `rules.yml` is gated on that verification, a signature
+  forged from public information alone switched off arbitrary detectors and the
+  scan reported clean. Demonstrated end to end: a command-injection finding went
+  from 1 reported to 0, and back to 1 after the fix.
+
+  This had been known and fixed once already. The 0.62.0 entry below introduced
+  the per-install key precisely because the old one was "hostname-derived and
+  publicly forgeable in CI / containers", and kept legacy verification "for one
+  release to migrate existing signed scans". It was still accepted **seventy
+  minor releases later**. A migration window nobody closes is not a migration
+  window; it is the vulnerability, kept. Verification now accepts exactly one
+  key. Signatures made under the legacy key stop verifying — intended, and it
+  fails closed.
+
+- **The LLM validator cache was a finding-deletion primitive.** A cache hit
+  assigned a verdict directly, and a `reject` verdict drops a finding. The cache
+  was read with a bare `JSON.parse(readFileSync(...))`, so planting one file
+  under `.agentic-security/llm-cache/` deleted a critical finding with no model
+  call and no network. The key is derivable by anyone with repo access, and CI
+  restoring a cache directory between runs delivers it without a repo write at
+  all. Cache entries are now HMAC-signed with the same mechanism `last-scan.json`
+  already used; an unsigned, tampered or foreign-keyed entry is a MISS, never a
+  verdict.
+
+- **A `reject` can no longer delete a strongly-provenanced finding.** The code
+  asserted that prompt-injecting the validator was harmless because "the worst
+  an attacker can produce is escalate". That was false: the challenge/nonce
+  cross-check defends against forged and replayed responses, not against a model
+  persuaded by source it legitimately read. Findings from real analysis
+  (taint-proven, multi-sink, execution-proven) are now demoted to `escalate`
+  rather than dropped, so the guarantee is structural instead of asserted.
+
+- **Coverage reduction is now visible in the artifact.** A `disable:` that took
+  effect produced findings that were simply absent — indistinguishable from
+  clean code to whoever reads the report. `suppressedRules` now carries the
+  count, per-rule severity breakdown, example locations and the AUTHORITY the
+  suppression ran under, so a signed suppression reads differently from an
+  env-var opt-out. Authorised suppressions are reported too: a signature proves
+  who asked, not that the hidden findings stopped existing.
+
+- **Signatures carry key provenance** (`env` / `per-install` / `ephemeral`).
+  `env` means whoever set the environment could have signed the run; `ephemeral`
+  means the key could not be persisted and the signature will never verify
+  again. Neither was inferable from the digest.
+
+- **The suppression quorum has a floor of 2.** `AGENTIC_SECURITY_LEARN_QUORUM=1`
+  was honoured, so a single triage verdict could suppress a finding — and with
+  family+path matching, a whole family across a path. The root guidance warned
+  about exactly this; the code did not enforce it.
+
+### Measurement honesty
+
+- **The corpus is fitted to the detectors it measures, and now says so.** 98% of
+  entries are self-authored synthetic fixtures and none come from the
+  disclosed-PoC tier. `npm run corpus:provenance` prints the composition on every
+  run and fails a commit that lands a detector together with the corpus entries
+  exercising it — caught against real history, including one such commit in this
+  very effort. This stops the loop tightening; it does not make the corpus
+  independent, and the docs no longer imply otherwise.
+
+- **The precision gate covered 6% of the source.** It ran over `hooks/` and
+  `scripts/` — 22 files — while `scanner/src` (383 files, the entire product) sat
+  outside it. Now 240 files. The `scanner/src` count is published as a DRIFT
+  TRIPWIRE, explicitly not hand-reviewed and explicitly not a precision figure,
+  because a scanner's own source contains sink patterns as data.
+
+- **The determinism gate exercised only the layer that cannot vary.** The
+  original fixture produced findings from regex and structural detectors alone. A
+  second fixture now drives the interprocedural taint engine and the Python
+  parser, digests are compared per fixture so a divergence names the layer, and
+  the comparator fails if the deep fixture degraded to the syntactic layer on any
+  machine.
+
+- **The scorecard gate could not detect a stale scorecard.** It compared only the
+  engine version, so a document measured over 200 corpus entries passed while the
+  corpus held 210 — every published rate computed over a population that no
+  longer existed. It now compares the population too.
+
+- **The independent-evaluation gate passed on a 4-sample smoke fixture** its own
+  README says must never be cited, because its thresholds had been calibrated to
+  pass. It now uses the README's own figures, treats exceeded calibration targets
+  as violations rather than notes, and refuses to emit a pass over the built-in
+  fixture however the thresholds are set. It fails today, correctly.
+
+- **Claims re-scoped to what is measured.** The roadmap carries a "What the gates
+  do not prove" section, states outright that the false-positive-rate goal is not
+  met, and points at the two harnesses built for that gap — both of which need
+  data, not code. R13 is downgraded from "landed" to "mechanism landed, no
+  observation pipeline": nothing constructs its ledger, so it can never downgrade
+  anything.
+
+### Fixed along the way
+
+- **The validator cache had never persisted a single entry.** `safeWriteState`
+  refused every directory nested under `.agentic-security/`, so `llm-cache/`,
+  `fix-history/` and `sbom-history/` were all unwritable while a
+  `validator-cache stats|gc` subcommand managed a cache that was always empty.
+  Found by a positive-control test asserting a legitimately written entry
+  round-trips.
+
+- **Sandbox timeouts now use SIGKILL.** The kernel does not deliver
+  default-action signals to a PID namespace's pid 1 from outside it, so SIGTERM
+  was dropped and a payload ran to completion against a 1200 ms budget — measured
+  in CI at 30057 ms. Proof execution also gained its own aggregate wall-clock
+  budget, because a count cap bounds nothing in time.
+
+- **Cost reporting stopped presenting an estimate as spend.** The endpoint's
+  usage report was discarded, so the ledger always booked the pre-call worst
+  case. Usage is now plumbed through, and any estimated component renders as
+  "at most $X" with the reason.
+
 ## 0.132.0 — a proven exploit becomes a permanent regression test
 
 The corpus stops being only a regression net and starts being fed by the engine

package/bin/agentic-security.js

@@ -17,7 +17,7 @@ import { recordScan, formatStreakLine, formatGradeDelta } from '../src/posture/s
 import { ingestAndMerge } from '../src/sca/sarif-ingest.js';
 import { loadProfile, saveProfile, detectProfile, renderAttributionLine, ATTRIBUTION, ATTRIBUTION_URL } from '../src/posture/profile.js';
 import { applySuppressions, addSoftAcceptance, expiredSoftAcceptances } from '../src/posture/suppressions.js';
-import { applyOverrides, validateOverrides } from '../src/posture/rule-overrides.js';
+import { applyOverrides, validateOverrides, suppressionReport, renderSuppressionSummary } from '../src/posture/rule-overrides.js';
 import { listPacks, loadPack, applyPacks } from '../src/posture/rule-packs.js';
 import { writeLockfile, verifyLockfile, makeDeterministic, isDeterministic } from '../src/posture/deterministic.js';
 import { enrichWithEPSS } from '../src/posture/epss.js';
@@ -512,6 +512,19 @@ async function cmdScan(args) {
   scan.findings    = applyOverrides(scan.findings    || [], targetAbs);
   scan.secrets     = applyOverrides(scan.secrets     || [], targetAbs);
   scan.logicVulns  = applyOverrides(scan.logicVulns  || [], targetAbs);
+  // Coverage reduction belongs in the ARTIFACT, not only in a log line. A
+  // `disable:` that takes effect otherwise produces findings that are simply
+  // absent, which is indistinguishable from clean code to whoever reads the
+  // report. Recorded whether the suppression was authorised or not — an
+  // authorised one still hides results.
+  try {
+    const _sup = suppressionReport(targetAbs);
+    if (_sup) {
+      scan.suppressedRules = _sup;
+      const _line = renderSuppressionSummary(_sup);
+      if (_line) process.stderr.write(`⚠️  agentic-security: ${_line}\n`);
+    }
+  } catch { /* reporting must never fail a scan */ }
 
   // Curated rule packs: --pack <name> (repeatable). Narrows findings to the
   // CWEs covered by the requested pack(s).
@@ -575,6 +588,7 @@ async function cmdScan(args) {
   // only — a failure here must never fail a scan.
   try {
     const { computeRunAttestation } = await import('../src/posture/attestation.js');
+    const { keyProvenance } = await import('../src/posture/integrity.js');
     const { effectiveVersion } = await import('../src/posture/ruleset-version.js');
     scan.attestation = computeRunAttestation({
       findings: normalizeFindings(scan),
@@ -584,6 +598,11 @@ async function cmdScan(args) {
       root: targetAbs,
       sign: true,
     });
+    // P1-3 — a signature is only as meaningful as the key behind it.
+    // `env` means whoever set the environment could have signed this;
+    // `ephemeral` means the key could not be persisted, so this signature will
+    // never verify on any later run. Neither is inferable from the digest.
+    if (scan.attestation) scan.attestation.keyProvenance = keyProvenance();
   } catch { /* attestation is metadata; never fail a scan over it */ }
 
   // R2: Always emit machine-readable artifacts to .agentic-security/.
@@ -1466,6 +1485,88 @@ async function cmdReset(args) {
 // FR-LEARN-6: read triage-feedback.json, group repeated FP verdicts by
 // (family, dir prefix), and propose a suppression YAML when ≥ threshold
 // (default 5) verdicts cluster. Writes to .agentic-security/rules-proposed/.
+// Languages the Layer-1 IR parses. Anything else cannot be partitioned into a
+// call-graph focus area, so feeding it to a hunter would spend tokens on files
+// the confirmation gate can never corroborate.
+const HUNT_EXTS = /\.(?:js|jsx|mjs|cjs|ts|tsx|py|java|cs|kt|go|php|rb)$/i;
+const HUNT_IGNORE = ['node_modules/**', '.git/**', 'dist/**', 'build/**', 'vendor/**', '**/.agentic-security/**'];
+const HUNT_MAX_FILES = 2000;
+
+async function cmdHunt(args) {
+  const scanRoot = path.resolve(args.flags.root || args._[0] || '.');
+  const { listFiles } = await import('../src/util/glob.js');
+  const { buildProjectIR } = await import('../src/ir/index.js');
+  const { runDiscovery } = await import('../src/discovery/index.js');
+  const { LENSES } = await import('../src/discovery/lenses.js');
+
+  const rels = (await listFiles(scanRoot, { ignore: HUNT_IGNORE })).filter(f => HUNT_EXTS.test(f));
+  if (rels.length > HUNT_MAX_FILES) {
+    console.error(`agentic-security: ${rels.length} source files exceeds the ${HUNT_MAX_FILES}-file hunt cap.`);
+    console.error('Narrow the scope with --root <subdir>. Discovery is token-expensive and');
+    console.error('unbounded fan-out on a large repository is the wrong default.');
+    return 2;
+  }
+
+  const fileContents = {};
+  for (const rel of rels) {
+    try { fileContents[rel] = fs.readFileSync(path.join(scanRoot, rel), 'utf8'); } catch { /* unreadable — skip */ }
+  }
+
+  const { perFile, callGraph } = buildProjectIR(fileContents);
+
+  // Prior scan and triage verdicts feed the judge so a hunt does not re-report
+  // what the rule engine already found or what a human already dismissed.
+  let priorScan = null, triageFeedback = null;
+  try { priorScan = JSON.parse(fs.readFileSync(path.join(scanRoot, '.agentic-security', 'last-scan.json'), 'utf8')); } catch {}
+  try { triageFeedback = JSON.parse(fs.readFileSync(path.join(scanRoot, '.agentic-security', 'triage-feedback.json'), 'utf8')); } catch {}
+
+  const lenses = args.flags.lens ? String(args.flags.lens).split(',').map(s => s.trim()).filter(Boolean) : undefined;
+  const report = await runDiscovery(
+    { perFileIR: perFile, callGraph, fileContents, priorScan, triageFeedback },
+    { lenses, maxAreas: args.flags['max-areas'] ? parseInt(args.flags['max-areas'], 10) : undefined },
+  );
+
+  const c = report.coverage;
+  console.log('');
+  console.log(`Discovery — ${rels.length} file(s), ${c.areasPlanned} focus area(s), ${c.lensesPerArea} lens(es) each`);
+  console.log(`  areas hunted: ${c.areasHunted}/${c.areasPlanned} (fully: ${c.areasFullyHunted})   degraded runs: ${c.degradedRuns}/${report.runs.length}`);
+  console.log(`  confirmation: ${JSON.stringify(c.confirmedByTier)}   panels: ${c.panelsRun} (undecided ${c.undecidedPanels})`);
+  console.log('');
+
+  if (report.fresh.length === 0) {
+    console.log('No new candidates survived confirmation and refutation.');
+  } else {
+    console.log(`${report.fresh.length} new candidate finding(s):`);
+    for (const f of report.fresh) {
+      console.log(`  [${f.severity}] ${f.file}:${f.line}  ${f.vuln}`);
+      console.log(`      lens=${f.discovery.lens} confirmation=${f.discovery.confirmation?.tier || 'unknown'}`);
+    }
+  }
+  if (report.duplicates.length || report.suppressed.length || report.refutedCandidates.length) {
+    console.log('');
+    console.log(`  (${report.duplicates.length} already known, ${report.suppressed.length} previously marked false positive, ` +
+      `${report.refutedCandidates.length} refuted by the panel)`);
+  }
+
+  // Degradation is part of the output. A half-failed hunt must never read as a
+  // clean one, so every reason is printed rather than summarised away.
+  if (c.reasons.length) {
+    console.log('');
+    console.log('Coverage gaps:');
+    for (const r of c.reasons) console.log(`  · ${r}`);
+  }
+  if (report.runs.length && c.degradedRuns === report.runs.length) {
+    console.log('');
+    console.log('EVERY hunter run degraded — this result says nothing about the code.');
+    console.log('Set AGENTIC_SECURITY_LLM_ENDPOINT to enable discovery.');
+  }
+
+  // Advisory by design: discovery never gates. Exit 0 unless the scope was bad.
+  console.log('');
+  console.log(`Lenses available: ${LENSES.map(l => l.key).join(', ')}  (--lens a,b to narrow)`);
+  return 0;
+}
+
 async function cmdRuleSynth(args) {
   const scanRoot = path.resolve(args.flags.root || '.');
   const { synthesizeRules } = await import('../src/posture/rule-synthesis.js');
@@ -1758,6 +1859,7 @@ async function main() {
       case 'validator-cache': process.exit(await cmdValidatorCache(args));
       case 'verify':   process.exit(await cmdVerify(args));
       case 'reset':    process.exit(await cmdReset(args));
+      case 'hunt':     process.exit(await cmdHunt(args));
       case 'rule-synth': process.exit(await cmdRuleSynth(args));
       case 'digest':   process.exit(await cmdDigest(args));
       case 'setup':    process.exit(await cmdSetup(args));

package/dist/113.index.js

@@ -406,8 +406,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 595 modules
-var engine = __webpack_require__(4660);
+// EXTERNAL MODULE: ./src/engine.js + 501 modules
+var engine = __webpack_require__(5695);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //
@@ -946,7 +946,7 @@ async function verifyFix({
   let pocLeg = { status: 'not-requested', reason: null, tier: null };
   if (poc?.code) {
     try {
-      const { proveFinding } = await __webpack_require__.e(/* import() */ 259).then(__webpack_require__.bind(__webpack_require__, 8259));
+      const { proveFinding } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 1291));
       const proved = await proveFinding({ ...(poc.finding || {}), poc }, { files });
       const tier = proved.proofTier;
       pocLeg = tier === 'execution-proven'

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4660);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5695);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(4660);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5695);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/499.index.js

@@ -0,0 +1,86 @@
+export const id = 499;
+export const ids = [499];
+export const modules = {
+
+/***/ 3499:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   H: () => (/* binding */ lensByKey),
+/* harmony export */   LENSES: () => (/* binding */ LENSES),
+/* harmony export */   j: () => (/* binding */ buildHunterPrompt)
+/* harmony export */ });
+//
+// The seven hunting lenses. Each hunter run is one (focus area × lens) pair.
+//
+// WHY DIVERSE LENSES RATHER THAN N IDENTICAL HUNTERS: redundancy raises
+// confidence in what was already found and adds nothing to coverage. A lens
+// that is told to look only at authorization asks different questions of the
+// same code than one told to look at crypto, so the union covers failure modes
+// no single prompt reaches. `wildcard` exists because a fixed taxonomy is a
+// ceiling, and the classes worth finding are the ones not on the list.
+const LENSES = Object.freeze([
+  { key: 'injection', title: 'Injection', family: 'injection', cwe: 'CWE-74',
+    brief: 'Untrusted input reaching an interpreter: SQL, shell, template, XPath, LDAP, or deserialization. Follow the value, not the function name.' },
+  { key: 'authz', title: 'Authorization', family: 'access-control', cwe: 'CWE-285',
+    brief: 'Missing, partial, or bypassable authorization: object references not scoped to the caller, tier checks applied on one path but not another, checks performed after the effect.' },
+  { key: 'crypto', title: 'Cryptography', family: 'crypto', cwe: 'CWE-327',
+    brief: 'Misuse rather than choice of primitive: reused nonces, unauthenticated ciphertext, comparisons that are not constant time, keys derived from guessable material.' },
+  { key: 'business-logic', title: 'Business logic', family: 'business-logic', cwe: 'CWE-840',
+    brief: 'The code does what it says and what it says is wrong: state machines that accept out-of-order transitions, quantities that may be negative, refunds that exceed charges, limits enforced client side.' },
+  { key: 'feature-abuse', title: 'Feature abuse', family: 'abuse', cwe: 'CWE-799',
+    brief: 'A working feature used as a weapon: unbounded fan-out, expensive endpoints with no cost to the caller, invitations or exports that leak across tenants.' },
+  { key: 'chained', title: 'Chained', family: 'attack-chain', cwe: 'CWE-1173',
+    brief: 'Two behaviours that are each acceptable alone and unacceptable together. State the chain as an ordered sequence of steps with the attacker capability required at each.' },
+  { key: 'wildcard', title: 'Wildcard', family: 'other', cwe: 'CWE-710',
+    brief: 'Anything the other lenses do not cover. Prefer the surprising and specific over the generic; report nothing rather than something already obvious.' },
+]);
+
+function lensByKey(key) {
+  if (typeof key !== 'string') return null;
+  return LENSES.find(l => l.key === key) || null;
+}
+
+const DEFAULT_MAX_CHARS = 60_000;
+
+function buildHunterPrompt(focusArea, lens, ctx = {}) {
+  const maxChars = Number.isInteger(ctx.maxChars) && ctx.maxChars > 0 ? ctx.maxChars : DEFAULT_MAX_CHARS;
+  const contents = ctx.fileContents || {};
+  const files = (focusArea?.files || []).filter(f => typeof contents[f] === 'string');
+
+  let budget = maxChars;
+  const blocks = [];
+  for (const f of files) {
+    const src = contents[f];
+    const slice = src.length > budget ? src.slice(0, Math.max(0, budget)) : src;
+    const truncated = slice.length < src.length;
+    blocks.push(`--- ${f}${truncated ? ' (truncated)' : ''} ---\n${slice}`);
+    budget -= slice.length;
+    if (budget <= 0) break;
+  }
+  const omitted = files.length - blocks.length;
+
+  return [
+    `You are hunting for security vulnerabilities in one area of a codebase.`,
+    `Area: ${focusArea?.label ?? 'unknown'} (${files.length} files)`,
+    ``,
+    `Your lens is ${lens.title}. ${lens.brief}`,
+    `Report ONLY through this lens. Another hunter covers the others.`,
+    ``,
+    `Rules:`,
+    `- Report a candidate only if you can name the entry point an attacker controls and the effect they achieve.`,
+    `- Do not report defence-in-depth gaps, style, or "could be hardened". Those are not candidates.`,
+    `- Cite a real file and line from the source below. A candidate with no location is discarded.`,
+    ``,
+    `Return JSON: {"candidates":[{"title","file","line","rationale","entryPoint","sink"}]}`,
+    `Return {"candidates":[]} if you find nothing. An empty result is a valid and useful answer.`,
+    ``,
+    omitted > 0 ? `NOTE: ${omitted} file(s) omitted, prompt budget exhausted (truncated context).\n` : ``,
+    ...blocks,
+  ].join('\n');
+}
+
+
+/***/ })
+
+};

package/dist/526.index.js

@@ -234,8 +234,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 595 modules
-var engine = __webpack_require__(4660);
+// EXTERNAL MODULE: ./src/engine.js + 501 modules
+var engine = __webpack_require__(5695);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //
@@ -774,7 +774,7 @@ async function verifyFix({
   let pocLeg = { status: 'not-requested', reason: null, tier: null };
   if (poc?.code) {
     try {
-      const { proveFinding } = await __webpack_require__.e(/* import() */ 259).then(__webpack_require__.bind(__webpack_require__, 8259));
+      const { proveFinding } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 1291));
       const proved = await proveFinding({ ...(poc.finding || {}), poc }, { files });
       const tier = proved.proofTier;
       pocLeg = tier === 'execution-proven'