@clear-capabilities/agentic-security-scanner 0.133.0 → 0.136.2

package/src/posture/state-dir.js

@@ -111,9 +111,42 @@ export function isSafeStateDir(dir) {
   return false;
 }
 
+// --- Read-only scanning (NON_MUTATING_SCAN_PRD S1) ---------------------------
+//
+// A scan is an OBSERVATION. Pointing the engine at a directory should not
+// change it. Until this switch existed, `scan .` wrote seven-plus files into the
+// scanned tree, which breaks CI that asserts a clean worktree, leaves artefacts
+// in third-party code the user does not own, and — measured on this project's
+// own benchmark — let a second scan read the first scan's conclusions as source.
+//
+// This is deliberately a KILL SWITCH AT THE SEAM rather than a parameter
+// threaded through 72 call sites. Threading it would mean 72 chances to forget,
+// and the module this lives in exists precisely because that kind of
+// per-caller discipline already failed once: its header records a user who
+// uninstalled the plugin after stray state directories broke their build.
+let _stateWritesEnabled = true;
+
+/** Turn all state writing off (or back on) for this process. */
+export function setStateWritesEnabled(enabled) {
+  _stateWritesEnabled = Boolean(enabled);
+}
+
+/**
+ * False when writing is disabled by the CLI flag or the environment.
+ *
+ * The env var is read at CALL time, not captured at import, so a test or a
+ * caller can set it after the module is loaded — the same mistake that made the
+ * gate verdict cache silently never engage.
+ */
+export function stateWritesEnabled() {
+  if (process.env.AGENTIC_SECURITY_NO_STATE === '1') return false;
+  return _stateWritesEnabled;
+}
+
 // Safe mkdir: only creates .agentic-security/ if the parent has a project marker.
 // Returns the dir on success, null if refused. Logs a warning when refused.
 export function ensureStateDir(scanRoot) {
+  if (!stateWritesEnabled()) return null;
   const dir = stateDir(scanRoot);
   if (!isSafeStateDir(dir)) {
     if (process.env.AGENTIC_SECURITY_DEBUG === '1') {
@@ -132,6 +165,7 @@ export function ensureStateDir(scanRoot) {
 // Safe write: only writes if isSafeStateDir(parent) returns true.
 // Returns true on success, false if refused or errored.
 export function safeWriteState(filePath, content) {
+  if (!stateWritesEnabled()) return false;
   const dir = path.dirname(filePath);
   if (!isSafeStateDir(dir)) {
     if (process.env.AGENTIC_SECURITY_DEBUG === '1') {

package/src/posture/telemetry-ingest.js

@@ -26,9 +26,10 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { statePath } from './state-dir.js';
 const CANDIDATE_PATHS = [
-  '.agentic-security/telemetry.json',
-  '.agentic-security/prod-telemetry.json',
+  'telemetry.json',
+  'prod-telemetry.json',
 ];
 
 const HOT_THRESHOLD = 1000;     // requests / window — promotes to hot
@@ -37,7 +38,7 @@ const COLD_THRESHOLD = 0;       // exactly zero requests → cold
 export function loadTelemetry(scanRoot) {
   const root = scanRoot || process.cwd();
   for (const rel of CANDIDATE_PATHS) {
-    const fp = path.join(root, rel);
+    const fp = statePath(root, rel);
     if (!fs.existsSync(fp)) continue;
     try {
       const data = JSON.parse(fs.readFileSync(fp, 'utf8'));

package/src/posture/threat-model-auto.js

@@ -23,6 +23,7 @@
 // .agentic-security/threat-model.md (human-readable).
 
 import * as fs from 'node:fs';
+import { stateDir, stateWritesEnabled } from './state-dir.js';
 import * as path from 'node:path';
 
 // STRIDE category descriptors
@@ -211,7 +212,9 @@ function _mid(id) { return String(id).replace(/[^A-Za-z0-9]/g, '_').slice(0, 60)
  * Persist threat model to disk: JSON for tooling, Markdown for review.
  */
 export function persistThreatModel(scanRoot, model) {
-  const dir = path.join(scanRoot, '.agentic-security');
+  // NON_MUTATING_SCAN_PRD S1 — a scan must not modify the tree it scans.
+  if (!stateWritesEnabled()) return;
+  const dir = stateDir(scanRoot);
   try { fs.mkdirSync(dir, { recursive: true }); } catch {}
   try { fs.writeFileSync(path.join(dir, 'threat-model.json'), JSON.stringify(model, null, 2)); } catch {}
   try { fs.writeFileSync(path.join(dir, 'threat-model.md'), renderMarkdown(model)); } catch {}

package/src/posture/threat-model-grounding.js

@@ -21,6 +21,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { statePath } from './state-dir.js';
 const DOC_PATHS = [
   'CLAUDE.md',
   'docs/THREAT-MODEL.md',
@@ -31,7 +32,16 @@ const DOC_PATHS = [
 ];
 
 function _readDoc(scanRoot, rel) {
-  try { return fs.readFileSync(path.join(scanRoot, rel), 'utf8'); } catch { return ''; }
+  // DOC_PATHS is a MIXED list: most entries are ordinary repository paths
+  // (CLAUDE.md, docs/THREAT-MODEL.md) and exactly one lives under the state
+  // directory. Routing the whole list through statePath() made every document
+  // resolve to `.agentic-security/<name>` and broke threat-model loading
+  // entirely — five tests caught it. Only the state entry uses the seam.
+  const STATE_PREFIX = '.agentic-security/';
+  const fp = rel.startsWith(STATE_PREFIX)
+    ? statePath(scanRoot, rel.slice(STATE_PREFIX.length))
+    : path.join(scanRoot, rel);
+  try { return fs.readFileSync(fp, 'utf8'); } catch { return ''; }
 }
 
 function _allDocs(scanRoot) {

package/src/posture/time-to-fix.js

@@ -13,7 +13,8 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-const STATE = '.agentic-security';
+
+import { statePath } from './state-dir.js';
 const HISTORY_FILE = 'fix-history/log.json';
 
 // Family base estimates (hours). Tuned from typical patch shapes.
@@ -50,7 +51,7 @@ const FAMILY_BASE_HOURS = {
 };
 
 function _loadFixHistory(scanRoot) {
-  const fp = path.join(scanRoot, STATE, HISTORY_FILE);
+  const fp = statePath(scanRoot, HISTORY_FILE);
   if (!fs.existsSync(fp)) return [];
   try {
     const arr = JSON.parse(fs.readFileSync(fp, 'utf8'));

package/src/posture/triage-memory.js

@@ -21,11 +21,11 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-const STATE_DIR = '.agentic-security';
+import { stateDir, stateWritesEnabled } from './state-dir.js';
 const MEMORY_FILE = 'triage-memory.jsonl';
 const AGENTS_FILE = 'AGENTS.md';
 
-function _stateDir(scanRoot) { return path.join(scanRoot, STATE_DIR); }
+function _stateDir(scanRoot) { return stateDir(scanRoot); }
 function _memPath(scanRoot)  { return path.join(_stateDir(scanRoot), MEMORY_FILE); }
 function _agentsPath(scanRoot) { return path.join(_stateDir(scanRoot), AGENTS_FILE); }
 
@@ -43,6 +43,7 @@ function _bucketKey(finding) {
 export function recordDecision(scanRoot, finding, decision, reason) {
   if (!scanRoot || !finding || !decision) return null;
   if (!['wont-fix', 'false-positive'].includes(decision)) return null;
+  if (!stateWritesEnabled()) return false;
   try { fs.mkdirSync(_stateDir(scanRoot), { recursive: true }); } catch {}
 
   const entry = {

package/src/posture/waf-ingest.js

@@ -36,11 +36,12 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { statePath } from './state-dir.js';
 const CANDIDATE_PATHS = [
-  '.agentic-security/waf-rules.json',
-  '.agentic-security/waf-rules.yml',
-  '.agentic-security/waf-rules.yaml',
-  '.agentic-security/waf-rules.conf',
+  'waf-rules.json',
+  'waf-rules.yml',
+  'waf-rules.yaml',
+  'waf-rules.conf',
   'waf/rules.json',
   'cloudflare-rules.json',
   'aws-waf.json',
@@ -134,7 +135,7 @@ function parseScalar(s) {
 export function loadWafRules(scanRoot) {
   const root = scanRoot || process.cwd();
   for (const rel of CANDIDATE_PATHS) {
-    const fp = path.join(root, rel);
+    const fp = statePath(root, rel);
     if (!fs.existsSync(fp)) continue;
     let text;
     try { text = fs.readFileSync(fp, 'utf8'); } catch { continue; }

package/src/posture/watch-mode.js

@@ -23,7 +23,7 @@ import * as fs from 'node:fs/promises';
 import * as fsSync from 'node:fs';
 import * as path from 'node:path';
 
-const STATE = '.agentic-security';
+import { stateDir, statePath, stateWritesEnabled } from './state-dir.js';
 const STATUS_MD   = 'watch-status.md';
 const STATUS_JSON = 'watch-status.json';
 const DEBOUNCE_MS = 350;
@@ -85,7 +85,8 @@ export function renderStatusLine(delta) {
  * Persist watch-status.{md,json}. Cheap atomic write (write tmp, rename).
  */
 export function persistStatus(scanRoot, delta) {
-  const dir = path.join(scanRoot, STATE);
+  const dir = stateDir(scanRoot);
+  if (!stateWritesEnabled()) return;
   try { fsSync.mkdirSync(dir, { recursive: true }); } catch {}
   const status = {
     ts: new Date().toISOString(),
@@ -122,7 +123,7 @@ export function persistStatus(scanRoot, delta) {
  * Read the latest watch-status (returns null if none).
  */
 export function readStatus(scanRoot) {
-  return _readJsonSafe(path.join(scanRoot, STATE, STATUS_JSON));
+  return _readJsonSafe(statePath(scanRoot, STATUS_JSON));
 }
 
 /**

package/src/report/index.js

@@ -3,6 +3,7 @@ import * as crypto from 'node:crypto';
 import { _isCustomSuppressed } from '../engine.js';
 import { alertFace, approveFace } from './mascot.js';
 import { SCANNER_VERSION } from '../posture/version.js';
+import { proofBlock } from '../posture/proof-artifact.js';
 
 const SEV_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
 const SEV_TO_SARIF = { critical: 'error', high: 'error', medium: 'warning', low: 'note', info: 'none' };
@@ -709,6 +710,14 @@ export function toSARIF(scan, meta={}){
           // (verified | unsigned | pass-through). The legacy bool flags are
           // emitted alongside for one release of grace so existing dashboards
           // don't break; new integrations should switch to signatureStatus.
+          // PRD Epic 1.4 / 7.4 — the proof block. `proofLevel` is the
+          // reader-facing vocabulary (PROVEN / PROBABLE_FP / REACHABLE /
+          // PATTERN); `proofArtifactSha256` commits to the evidence that
+          // justified it, so a fix PR can reference the artifact it was
+          // reviewed against. Omitted entirely when the proof stage did not
+          // run — labelling every finding PATTERN would assert each was
+          // considered and found unprovable.
+          ...(proofBlock(f) || {}),
           signatureStatus: f.signatureStatus || (f._passThroughSigning ? 'pass-through' : (f._unsigned ? 'unsigned' : 'verified')),
           ...(f._unsigned ? { unsigned: true } : {}),
           ...(f._passThroughSigning ? { passThroughSigning: true } : {}),

package/src/sast/code-injection-multilang.js

@@ -64,6 +64,34 @@ function patternsFor(lang) {
         gate: /\b(?:DataTable|DataColumn|DataView)\b/ },
     ];
   }
+  if (lang === 'js') {
+    // Server-side JS code injection. Measured gap, not a speculative one: on the
+    // independent population CWE-94 scored 0/6, and the missed sink in
+    // GHSA-3769-jgqc-cxm7 was `vm.run(\`...${code}...\`)` — the NodeVM / vm2
+    // sandbox family. `eval` and `new Function` were already covered elsewhere
+    // (client-side.js, agent-untrusted-flow.js); a library whose entire purpose
+    // is executing supplied code was not covered anywhere.
+    //
+    // A SANDBOX IS NOT A CONTROL HERE. vm/vm2 are routinely reached for as the
+    // "safe" way to run untrusted code, and both have a long history of escapes.
+    // Running attacker-influenced source inside one is still code injection, so
+    // these fire on a non-literal argument exactly like every other sink in this
+    // module.
+    return [
+      // vm.run / NodeVM#run / VM#run — the vm2 and @n8n/vm2 family.
+      { key: 'vm-run', re: new RegExp(String.raw`\.\s*run\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:NodeVM|VM|vm2|createContext|new\s+VM\b)\b/ },
+      // node:vm's own evaluators. runInNewContext takes the code first.
+      { key: 'vm-run-in-context',
+        re: new RegExp(String.raw`\.\s*(?:runInNewContext|runInThisContext|runInContext)\s*\(\s*${notLiteral}`, 'g') },
+      // new vm.Script(src) compiles before it runs; the injection is here.
+      { key: 'vm-script', re: new RegExp(String.raw`\bnew\s+(?:vm\s*\.\s*)?Script\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:vm|node:vm)\b/ },
+      // Server-side eval / Function, which client-side.js only covers for browsers.
+      { key: 'js-eval', re: new RegExp(String.raw`(?:^|[^.\w])eval\s*\(\s*${notLiteral}`, 'gm') },
+      { key: 'js-new-function', re: new RegExp(String.raw`\bnew\s+Function\s*\(\s*${notLiteral}`, 'g') },
+    ];
+  }
   if (lang === 'go') {
     return [
       // yaegi / gomacro interpreter eval of a non-literal.
@@ -82,6 +110,7 @@ function _lang(fp) {
   if (/\.kt$/i.test(fp)) return 'kt';
   if (/\.cs$/i.test(fp)) return 'cs';
   if (/\.go$/i.test(fp)) return 'go';
+  if (/\.(?:js|jsx|mjs|cjs|ts|tsx)$/i.test(fp)) return 'js';
   return null;
 }
 

package/src/sca/dep-confusion.js

@@ -12,6 +12,7 @@ import * as path from 'node:path';
 import * as yaml from '../util/yaml.js';
 import { createRequire } from 'node:module';
 
+import { statePath } from '../posture/state-dir.js';
 const _require = createRequire(import.meta.url);
 const _POPULAR = (() => {
   try {
@@ -52,7 +53,7 @@ export function levenshtein(a, b, maxDistance = 2) {
 function _loadInternalScopes(scanRoot) {
   if (!scanRoot) return [];
   for (const name of ['internal-scopes.yml', 'internal-scopes.yaml']) {
-    const p = path.join(scanRoot, '.agentic-security', name);
+    const p = statePath(scanRoot, name);
     if (!fs.existsSync(p)) continue;
     try {
       const doc = yaml.load(fs.readFileSync(p, 'utf8'));