@clear-capabilities/agentic-security-scanner 0.133.0 → 0.134.0

package/CHANGELOG.md

@@ -1,5 +1,108 @@
 # Changelog
 
+## 0.134.0 — the loop closes, and the logic tier learns how to be wrong
+
+The remaining PRD epics. Two of them are new capability; the other two are the
+same idea applied twice — a claim nobody can disagree with is the weakest thing
+this engine emits, so both new tiers ship with the machinery to refute
+themselves.
+
+### Two more proof classes, and neither needed a running application
+
+`sql-injection` and `path-traversal` join the three existing classes. The PRD
+assumed both would wait on a running-app harness; they did not, because the
+harness was never where the proof lived.
+
+- **SQL injection is settled at the driver boundary.** Either the payload
+  arrives inside the query TEXT or it arrives as a bound parameter — the first
+  is the vulnerability by definition and the second is the fix by definition,
+  and no schema, rows or live server are needed to tell them apart. The PoC
+  stubs the driver with a recorder and writes the marker only when the payload
+  shows up inside something recognisably SQL. A parameterised query reaches
+  `proof-failed` by **execution**, not by reading the source.
+- **Path traversal is settled by what comes back.** A sentinel is planted
+  outside the served directory and the marker is written only if its content —
+  or, for `sendFile`, its resolved path — comes back out of the handler. A
+  `basename` guard is refuted by running it.
+
+Both directions are pinned by tests that execute in the real sandbox. Classes
+still absent (IDOR, SSRF, XSS) are now documented as decisions with reasons
+rather than gaps: a PoC built on invented application state proves something
+about the invention.
+
+Fixed along the way: the webhook PoC wrote its marker after a top-level `await`
+guarded by an **unref'd** timer, so a handler that never replied let Node exit
+with the promise pending and the marker check never ran. The test asserting
+"no decision writes no marker" had been passing without reaching the line it
+was testing. Timer is now ref'd and cleared, with a positive control asserting
+the process reaches exit 0.
+
+### The autonomous loop, wired to real stages
+
+`scripts/autopilot.mjs` connects the loop to a real scan, a real sandboxed
+exploit, a deterministic-then-model fix, and the real gate. End-to-end tests run
+the whole thing against a live HTTP endpoint, including the one that matters: a
+patch that changes the file, reads like a fix, and would satisfy any "did the
+scanner go quiet?" check is **refused and never written**, because the exploit
+still fires against it.
+
+The CLI refuses to start without a confinement backend (the verdict requires
+executing something) and refuses a dirty git tree by default (the test leg
+writes the candidate patch to disk and restores it in a `finally`; a clean tree
+is what makes a crash recoverable). A verified fix reached with no test runner
+detected is counted and reported separately — the exploit stopped firing, but
+nothing checked the application still works.
+
+### The business-logic tier learns how to be wrong
+
+The deterministic half already existed. The reviewing agent's half was prose:
+it asserted that a handler lets one user act on another's resource, and nothing
+in the finding gave a second party anything to disagree with. It was the only
+tier in this engine with no way to be wrong.
+
+`posture/logic-claims.js` adds three offline lenses that can refute one —
+citation (the file exists and the line is inside it), quotation (the quoted
+snippet is at the cited line), corroboration (a "no authentication" claim
+against a handler that plainly authenticates). Verdicts go through the existing
+producer/verifier separation, so a lens can never vote on a claim it produced;
+that is why the lenses are deterministic code and not another prompt. Refuted
+claims are quarantined, never deleted and never severity-touched.
+
+### A comparison harness that ships no opinion about who the competition is
+
+`posture/comparison.js` + `scripts/comparison.mjs` score this engine
+head-to-head against participants **the operator supplies**. The repository
+ships the harness and the answer key and names no tool — a test enforces that.
+
+Two properties are the entire module. Every rate is computed over the
+**intersection** of corpus entries *all* participants completed, because a tool
+that crashed on the forty hardest entries and was scored over the remaining
+hundred and seventy looks like it beat one that completed everything, and the
+difference is invisible in the output. And an entry a participant could not run
+is **unscored**, never counted as a miss: counting a crash as a false negative
+penalises a tool for a harness problem, counting it as a pass rewards it for
+one. Matching is CWE-only so nobody is scored on this engine's vocabulary.
+
+No comparison figures are published in this repository. Running other vendors'
+tools and publishing the numbers is the operator's call, not the harness's.
+
+### The suppression pragma never worked
+
+Found while suppressing a false positive in this release's own new code.
+`// agentic-security-ignore: <rule-id>` is documented in `CLAUDE.md` and
+`pr-comment.js` tells every reviewer to use it — and **nothing implemented it**.
+It has been advertised and inert. A dead suppression mechanism is worse than an
+absent one: the developer writes the pragma, sees the finding again, and
+concludes the scanner is noisy rather than that the pragma is dead.
+
+Now implemented in `engine.js`, applied after dedupe and after every cross-file
+pass so it covers a finding whichever analysis produced it. Line-scoped, matched
+against the finding's id / vuln / CWE / family, and **logged** to the same
+ledger custom rules use so `--include-suppressed` can show it. Every test
+carries a positive control — the same file without the pragma must still
+produce the finding, or "0 findings" would prove the suppression works and
+equally prove the detector stopped firing.
+
 ## 0.133.0 — two ways findings could be silently deleted, both closed
 
 Four rounds of adversarial premortem against this repository's own artifacts.

package/bin/agentic-security.js

@@ -1485,6 +1485,88 @@ async function cmdReset(args) {
 // FR-LEARN-6: read triage-feedback.json, group repeated FP verdicts by
 // (family, dir prefix), and propose a suppression YAML when ≥ threshold
 // (default 5) verdicts cluster. Writes to .agentic-security/rules-proposed/.
+// Languages the Layer-1 IR parses. Anything else cannot be partitioned into a
+// call-graph focus area, so feeding it to a hunter would spend tokens on files
+// the confirmation gate can never corroborate.
+const HUNT_EXTS = /\.(?:js|jsx|mjs|cjs|ts|tsx|py|java|cs|kt|go|php|rb)$/i;
+const HUNT_IGNORE = ['node_modules/**', '.git/**', 'dist/**', 'build/**', 'vendor/**', '**/.agentic-security/**'];
+const HUNT_MAX_FILES = 2000;
+
+async function cmdHunt(args) {
+  const scanRoot = path.resolve(args.flags.root || args._[0] || '.');
+  const { listFiles } = await import('../src/util/glob.js');
+  const { buildProjectIR } = await import('../src/ir/index.js');
+  const { runDiscovery } = await import('../src/discovery/index.js');
+  const { LENSES } = await import('../src/discovery/lenses.js');
+
+  const rels = (await listFiles(scanRoot, { ignore: HUNT_IGNORE })).filter(f => HUNT_EXTS.test(f));
+  if (rels.length > HUNT_MAX_FILES) {
+    console.error(`agentic-security: ${rels.length} source files exceeds the ${HUNT_MAX_FILES}-file hunt cap.`);
+    console.error('Narrow the scope with --root <subdir>. Discovery is token-expensive and');
+    console.error('unbounded fan-out on a large repository is the wrong default.');
+    return 2;
+  }
+
+  const fileContents = {};
+  for (const rel of rels) {
+    try { fileContents[rel] = fs.readFileSync(path.join(scanRoot, rel), 'utf8'); } catch { /* unreadable — skip */ }
+  }
+
+  const { perFile, callGraph } = buildProjectIR(fileContents);
+
+  // Prior scan and triage verdicts feed the judge so a hunt does not re-report
+  // what the rule engine already found or what a human already dismissed.
+  let priorScan = null, triageFeedback = null;
+  try { priorScan = JSON.parse(fs.readFileSync(path.join(scanRoot, '.agentic-security', 'last-scan.json'), 'utf8')); } catch {}
+  try { triageFeedback = JSON.parse(fs.readFileSync(path.join(scanRoot, '.agentic-security', 'triage-feedback.json'), 'utf8')); } catch {}
+
+  const lenses = args.flags.lens ? String(args.flags.lens).split(',').map(s => s.trim()).filter(Boolean) : undefined;
+  const report = await runDiscovery(
+    { perFileIR: perFile, callGraph, fileContents, priorScan, triageFeedback },
+    { lenses, maxAreas: args.flags['max-areas'] ? parseInt(args.flags['max-areas'], 10) : undefined },
+  );
+
+  const c = report.coverage;
+  console.log('');
+  console.log(`Discovery — ${rels.length} file(s), ${c.areasPlanned} focus area(s), ${c.lensesPerArea} lens(es) each`);
+  console.log(`  areas hunted: ${c.areasHunted}/${c.areasPlanned} (fully: ${c.areasFullyHunted})   degraded runs: ${c.degradedRuns}/${report.runs.length}`);
+  console.log(`  confirmation: ${JSON.stringify(c.confirmedByTier)}   panels: ${c.panelsRun} (undecided ${c.undecidedPanels})`);
+  console.log('');
+
+  if (report.fresh.length === 0) {
+    console.log('No new candidates survived confirmation and refutation.');
+  } else {
+    console.log(`${report.fresh.length} new candidate finding(s):`);
+    for (const f of report.fresh) {
+      console.log(`  [${f.severity}] ${f.file}:${f.line}  ${f.vuln}`);
+      console.log(`      lens=${f.discovery.lens} confirmation=${f.discovery.confirmation?.tier || 'unknown'}`);
+    }
+  }
+  if (report.duplicates.length || report.suppressed.length || report.refutedCandidates.length) {
+    console.log('');
+    console.log(`  (${report.duplicates.length} already known, ${report.suppressed.length} previously marked false positive, ` +
+      `${report.refutedCandidates.length} refuted by the panel)`);
+  }
+
+  // Degradation is part of the output. A half-failed hunt must never read as a
+  // clean one, so every reason is printed rather than summarised away.
+  if (c.reasons.length) {
+    console.log('');
+    console.log('Coverage gaps:');
+    for (const r of c.reasons) console.log(`  · ${r}`);
+  }
+  if (report.runs.length && c.degradedRuns === report.runs.length) {
+    console.log('');
+    console.log('EVERY hunter run degraded — this result says nothing about the code.');
+    console.log('Set AGENTIC_SECURITY_LLM_ENDPOINT to enable discovery.');
+  }
+
+  // Advisory by design: discovery never gates. Exit 0 unless the scope was bad.
+  console.log('');
+  console.log(`Lenses available: ${LENSES.map(l => l.key).join(', ')}  (--lens a,b to narrow)`);
+  return 0;
+}
+
 async function cmdRuleSynth(args) {
   const scanRoot = path.resolve(args.flags.root || '.');
   const { synthesizeRules } = await import('../src/posture/rule-synthesis.js');
@@ -1777,6 +1859,7 @@ async function main() {
       case 'validator-cache': process.exit(await cmdValidatorCache(args));
       case 'verify':   process.exit(await cmdVerify(args));
       case 'reset':    process.exit(await cmdReset(args));
+      case 'hunt':     process.exit(await cmdHunt(args));
       case 'rule-synth': process.exit(await cmdRuleSynth(args));
       case 'digest':   process.exit(await cmdDigest(args));
       case 'setup':    process.exit(await cmdSetup(args));

package/dist/113.index.js

@@ -406,8 +406,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 600 modules
-var engine = __webpack_require__(5865);
+// EXTERNAL MODULE: ./src/engine.js + 501 modules
+var engine = __webpack_require__(5695);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5865);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5695);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5865);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5695);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/499.index.js

@@ -0,0 +1,86 @@
+export const id = 499;
+export const ids = [499];
+export const modules = {
+
+/***/ 3499:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   H: () => (/* binding */ lensByKey),
+/* harmony export */   LENSES: () => (/* binding */ LENSES),
+/* harmony export */   j: () => (/* binding */ buildHunterPrompt)
+/* harmony export */ });
+//
+// The seven hunting lenses. Each hunter run is one (focus area × lens) pair.
+//
+// WHY DIVERSE LENSES RATHER THAN N IDENTICAL HUNTERS: redundancy raises
+// confidence in what was already found and adds nothing to coverage. A lens
+// that is told to look only at authorization asks different questions of the
+// same code than one told to look at crypto, so the union covers failure modes
+// no single prompt reaches. `wildcard` exists because a fixed taxonomy is a
+// ceiling, and the classes worth finding are the ones not on the list.
+const LENSES = Object.freeze([
+  { key: 'injection', title: 'Injection', family: 'injection', cwe: 'CWE-74',
+    brief: 'Untrusted input reaching an interpreter: SQL, shell, template, XPath, LDAP, or deserialization. Follow the value, not the function name.' },
+  { key: 'authz', title: 'Authorization', family: 'access-control', cwe: 'CWE-285',
+    brief: 'Missing, partial, or bypassable authorization: object references not scoped to the caller, tier checks applied on one path but not another, checks performed after the effect.' },
+  { key: 'crypto', title: 'Cryptography', family: 'crypto', cwe: 'CWE-327',
+    brief: 'Misuse rather than choice of primitive: reused nonces, unauthenticated ciphertext, comparisons that are not constant time, keys derived from guessable material.' },
+  { key: 'business-logic', title: 'Business logic', family: 'business-logic', cwe: 'CWE-840',
+    brief: 'The code does what it says and what it says is wrong: state machines that accept out-of-order transitions, quantities that may be negative, refunds that exceed charges, limits enforced client side.' },
+  { key: 'feature-abuse', title: 'Feature abuse', family: 'abuse', cwe: 'CWE-799',
+    brief: 'A working feature used as a weapon: unbounded fan-out, expensive endpoints with no cost to the caller, invitations or exports that leak across tenants.' },
+  { key: 'chained', title: 'Chained', family: 'attack-chain', cwe: 'CWE-1173',
+    brief: 'Two behaviours that are each acceptable alone and unacceptable together. State the chain as an ordered sequence of steps with the attacker capability required at each.' },
+  { key: 'wildcard', title: 'Wildcard', family: 'other', cwe: 'CWE-710',
+    brief: 'Anything the other lenses do not cover. Prefer the surprising and specific over the generic; report nothing rather than something already obvious.' },
+]);
+
+function lensByKey(key) {
+  if (typeof key !== 'string') return null;
+  return LENSES.find(l => l.key === key) || null;
+}
+
+const DEFAULT_MAX_CHARS = 60_000;
+
+function buildHunterPrompt(focusArea, lens, ctx = {}) {
+  const maxChars = Number.isInteger(ctx.maxChars) && ctx.maxChars > 0 ? ctx.maxChars : DEFAULT_MAX_CHARS;
+  const contents = ctx.fileContents || {};
+  const files = (focusArea?.files || []).filter(f => typeof contents[f] === 'string');
+
+  let budget = maxChars;
+  const blocks = [];
+  for (const f of files) {
+    const src = contents[f];
+    const slice = src.length > budget ? src.slice(0, Math.max(0, budget)) : src;
+    const truncated = slice.length < src.length;
+    blocks.push(`--- ${f}${truncated ? ' (truncated)' : ''} ---\n${slice}`);
+    budget -= slice.length;
+    if (budget <= 0) break;
+  }
+  const omitted = files.length - blocks.length;
+
+  return [
+    `You are hunting for security vulnerabilities in one area of a codebase.`,
+    `Area: ${focusArea?.label ?? 'unknown'} (${files.length} files)`,
+    ``,
+    `Your lens is ${lens.title}. ${lens.brief}`,
+    `Report ONLY through this lens. Another hunter covers the others.`,
+    ``,
+    `Rules:`,
+    `- Report a candidate only if you can name the entry point an attacker controls and the effect they achieve.`,
+    `- Do not report defence-in-depth gaps, style, or "could be hardened". Those are not candidates.`,
+    `- Cite a real file and line from the source below. A candidate with no location is discarded.`,
+    ``,
+    `Return JSON: {"candidates":[{"title","file","line","rationale","entryPoint","sink"}]}`,
+    `Return {"candidates":[]} if you find nothing. An empty result is a valid and useful answer.`,
+    ``,
+    omitted > 0 ? `NOTE: ${omitted} file(s) omitted, prompt budget exhausted (truncated context).\n` : ``,
+    ...blocks,
+  ].join('\n');
+}
+
+
+/***/ })
+
+};

package/dist/526.index.js

@@ -234,8 +234,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 600 modules
-var engine = __webpack_require__(5865);
+// EXTERNAL MODULE: ./src/engine.js + 501 modules
+var engine = __webpack_require__(5695);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //