@clear-capabilities/agentic-security-scanner 0.133.0 → 0.136.2

package/dist/220.index.js

@@ -15,6 +15,7 @@ export const modules = {
 /* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1455);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(1174);
 // Watch mode — continuous incremental scan as the developer edits.
 //
 // Spawns a long-running scan watcher that:
@@ -40,7 +41,7 @@ export const modules = {
 
 
 
-const STATE = '.agentic-security';
+
 const STATUS_MD   = 'watch-status.md';
 const STATUS_JSON = 'watch-status.json';
 const DEBOUNCE_MS = 350;
@@ -102,7 +103,8 @@ function renderStatusLine(delta) {
  * Persist watch-status.{md,json}. Cheap atomic write (write tmp, rename).
  */
 function persistStatus(scanRoot, delta) {
-  const dir = node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, STATE);
+  const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_3__/* .stateDir */ .Pn)(scanRoot);
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_3__.stateWritesEnabled)()) return;
   try { node_fs__WEBPACK_IMPORTED_MODULE_1__.mkdirSync(dir, { recursive: true }); } catch {}
   const status = {
     ts: new Date().toISOString(),
@@ -139,7 +141,7 @@ function persistStatus(scanRoot, delta) {
  * Read the latest watch-status (returns null if none).
  */
 function readStatus(scanRoot) {
-  return _readJsonSafe(path.join(scanRoot, STATE, STATUS_JSON));
+  return _readJsonSafe(statePath(scanRoot, STATUS_JSON));
 }
 
 /**

package/dist/238.index.js

@@ -52,7 +52,6 @@ export const modules = {
 
 
 
-const STATE_DIR = '.agentic-security';
 const LOG_FILE = 'fix-metrics.jsonl';
 
 // Below this many samples a percentile is an artifact of the sample, not a
@@ -65,7 +64,7 @@ const RELIABLE_N = 10;
 const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
 
 function _logPath(scanRoot) {
-  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR, LOG_FILE);
+  return (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, LOG_FILE);
 }
 
 /**
@@ -77,9 +76,10 @@ function _logPath(scanRoot) {
 function recordFixAttempt(scanRoot, record) {
   if (!scanRoot || !record || typeof record !== 'object') return false;
   try {
-    const dir = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR);
+    const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
     if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return;
+  node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
     // One writeSync of one newline-terminated line: a concurrent reader sees
     // whole records or nothing, and a torn tail is dropped on read.
     node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');

package/dist/317.index.js

@@ -0,0 +1,270 @@
+export const id = 317;
+export const ids = [317];
+export const modules = {
+
+/***/ 8317:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   buildEvidenceBundle: () => (/* binding */ buildEvidenceBundle),
+/* harmony export */   ensureKeyPair: () => (/* binding */ ensureKeyPair),
+/* harmony export */   keyPaths: () => (/* binding */ keyPaths),
+/* harmony export */   signEvidenceBundle: () => (/* binding */ signEvidenceBundle),
+/* harmony export */   verifyEvidenceBundle: () => (/* binding */ verifyEvidenceBundle)
+/* harmony export */ });
+/* unused harmony exports BUNDLE_SCHEMA, canonicalBytes, canonicalJson */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8161);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7598);
+// Per-finding evidence bundles, signed so a THIRD PARTY can verify them.
+// PRD Phase 2 / D2.
+//
+// WHAT WAS MISSING
+// ----------------
+// `attestation.js` already turns a run into a checkable digest, and it is
+// explicit about its own ceiling: the signature is a per-install SYMMETRIC HMAC,
+// so it is "tamper-evidence for the operator, not third-party non-repudiation."
+// Anyone who can verify it can also forge it. That is fine for detecting local
+// corruption and useless for handing a finding to somebody else.
+//
+// This module closes that gap for the artefact that actually travels: a single
+// finding plus the evidence behind it. A buyer, an auditor, or a downstream
+// consumer can check the bundle with the PUBLIC key alone, having never had
+// access to ours.
+//
+// WHY A SEPARATE MODULE RATHER THAN EXTENDING attestation.js
+// ----------------------------------------------------------
+// They answer different questions and must not be conflated. A run attestation
+// says "this set of findings came from this engine, ruleset and bundle". An
+// evidence bundle says "THIS finding is backed by THIS evidence, and here is
+// proof the claim was not edited after the fact." One is about reproducibility,
+// the other about portability. Merging them would produce an artefact that is
+// worse at both.
+//
+// WHAT A BUNDLE PROVES, AND WHAT IT DOES NOT
+// -------------------------------------------
+// PROVES — the bundle's contents are exactly what the holder of the signing key
+// attested, unmodified. Nothing in it has been added, removed, or edited since.
+//
+// DOES NOT PROVE — that the finding is real. A signature is an integrity claim,
+// never a correctness claim. An `unproven` finding in a signed bundle is still
+// an unproven finding; the signature only stops someone silently upgrading the
+// word `unproven` to `execution-proven` in transit. Both statements are carried
+// INSIDE the bundle so they travel with it and cannot be dropped by a
+// summariser.
+//
+// The evidence chain is deliberately the honest one this engine already
+// computes: the proof tier, what the sandbox observed, which backend ran it, the
+// taint path if there is one. A bundle for a regex finding says so plainly
+// rather than dressing it up.
+
+
+
+
+
+
+const BUNDLE_SCHEMA = 'agentic-security/finding-evidence@1';
+
+/** Where the Ed25519 signing key lives. Mirrors integrity.js's key handling. */
+function keyDir() {
+  const xdg = process.env.XDG_CONFIG_HOME || node_path__WEBPACK_IMPORTED_MODULE_2__.join(node_os__WEBPACK_IMPORTED_MODULE_1__.homedir(), '.config');
+  return node_path__WEBPACK_IMPORTED_MODULE_2__.join(xdg, 'agentic-security');
+}
+const PRIVATE_KEY_FILE = 'attest-key.pem';
+const PUBLIC_KEY_FILE = 'attest-key.pub.pem';
+
+function keyPaths(dir = keyDir()) {
+  return {
+    privateKey: node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, PRIVATE_KEY_FILE),
+    publicKey: node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, PUBLIC_KEY_FILE),
+  };
+}
+
+/**
+ * Load the signing key pair, generating one on first use.
+ *
+ * Ed25519 from node:crypto — no new dependency, and deliberately not a
+ * transparency-log scheme: those need a network round trip, and this project
+ * does not make runtime cloud calls. A log-backed option can layer on later
+ * without changing the bundle format.
+ */
+function ensureKeyPair(dir = keyDir()) {
+  const p = keyPaths(dir);
+
+  // NO existsSync-then-read. This project's own scanner flagged the first
+  // version of this function for TOCTOU (CWE-367) and it was right: between an
+  // existence check and the read, an attacker who can write this directory can
+  // swap the file, and the thing being swapped is a SIGNING KEY. Winning that
+  // race means we sign with a key the attacker controls, which defeats the
+  // entire point of the module. Read first and treat absence as the exceptional
+  // case — there is then no window between the check and the use, because there
+  // is no check.
+  try {
+    const privateKeyPem = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.privateKey, 'utf8');
+    const publicKeyPem = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.publicKey, 'utf8');
+    if (privateKeyPem && publicKeyPem) {
+      return { privateKeyPem, publicKeyPem, created: false, ...p };
+    }
+  } catch { /* missing or unreadable — fall through and generate */ }
+
+  const { privateKey, publicKey } = node_crypto__WEBPACK_IMPORTED_MODULE_3__.generateKeyPairSync('ed25519');
+  const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+  const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' });
+  node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  // `wx` — exclusive create. If another process generated a key between our
+  // failed read and this write, we must NOT clobber it: every bundle already
+  // signed with that key would silently stop verifying. On collision, re-read
+  // and use the winner's key.
+  try {
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(p.privateKey, privateKeyPem, { mode: 0o600, flag: 'wx' });
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(p.publicKey, publicKeyPem, { mode: 0o644, flag: 'w' });
+    return { privateKeyPem, publicKeyPem, created: true, ...p };
+  } catch (e) {
+    if (e.code !== 'EEXIST') throw e;
+    return {
+      privateKeyPem: node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.privateKey, 'utf8'),
+      publicKeyPem: node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.publicKey, 'utf8'),
+      created: false,
+      ...p,
+    };
+  }
+}
+
+/**
+ * Canonical bytes for signing.
+ *
+ * An ALLOWLIST, exactly as attestation.js canonicalises: a field that is not
+ * named here is not signed, so a future addition cannot silently enter the
+ * signed surface. Sorted keys, so serialisation order cannot change the
+ * signature.
+ */
+function canonicalBytes(bundle) {
+  const signed = {
+    schema: bundle.schema,
+    finding: bundle.finding,
+    evidence: bundle.evidence,
+    engine: bundle.engine,
+    proves: bundle.proves,
+    doesNotProve: bundle.doesNotProve,
+  };
+  return Buffer.from(canonicalJson(signed), 'utf8');
+}
+
+/**
+ * Deterministic JSON: keys sorted at EVERY level, arrays order-preserving.
+ *
+ * Written by hand rather than using JSON.stringify's replacer argument, and the
+ * reason matters. The first version of this function did
+ * `JSON.stringify(signed, Object.keys(signed).sort())`, believing the array
+ * argument was a top-level field allowlist. It is not — a replacer ARRAY is a
+ * key filter applied at every nesting depth, so every nested object serialised
+ * as `{}` and the signature covered nothing but the two prose strings. A bundle
+ * whose severity was edited from `high` to `critical` verified as authentic.
+ *
+ * That is the worst possible failure for this module: a security feature that
+ * appears to work, produces a valid-looking signature, and protects nothing. It
+ * was caught by tampering with a bundle and expecting verification to fail —
+ * which is why the tamper cases in the test file are not optional extras.
+ */
+function canonicalJson(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value ?? null);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  const keys = Object.keys(value).sort();
+  return `{${keys.map(k => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(',')}}`;
+}
+
+const PROVES =
+  'The contents of this bundle are exactly what the signer attested, unmodified.';
+const DOES_NOT_PROVE =
+  'That the finding is real. A signature is an integrity claim, never a correctness ' +
+  'claim — read `evidence.proofTier` for how well-supported the finding actually is. ' +
+  'An unproven finding in a signed bundle is still an unproven finding.';
+
+/**
+ * Build an unsigned bundle from a finding.
+ *
+ * Everything here is copied from what the engine already computed. Nothing is
+ * inferred, and a missing field stays missing rather than being defaulted into
+ * something more confident-looking than the truth.
+ */
+function buildEvidenceBundle(finding, { engineVersion, rulesetVersion, bundleSha, commit } = {}) {
+  if (!finding || typeof finding !== 'object') return null;
+  return {
+    schema: BUNDLE_SCHEMA,
+    finding: {
+      id: finding.id ?? null,
+      stableId: finding.stableId ?? null,
+      severity: finding.severity ?? null,
+      file: finding.file ?? null,
+      line: finding.line ?? null,
+      vuln: finding.vuln ?? null,
+      cwe: finding.cwe ?? null,
+      family: finding.family ?? null,
+      parser: finding.parser ?? null,
+    },
+    evidence: {
+      // The honest chain, in the vocabulary the engine already uses.
+      proofTier: finding.proofTier ?? null,
+      proofEvidence: finding.proofEvidence ?? null,
+      confidence: finding.confidence ?? null,
+      exploitability: finding.exploitability ?? null,
+      unreachable: finding.unreachable ?? null,
+      // Present only for the layers that produce them; absent means absent.
+      taintPath: finding.pathSteps ?? finding.exampleFlows ?? null,
+      discovery: finding.discovery ?? null,
+    },
+    engine: {
+      engineVersion: engineVersion ?? null,
+      rulesetVersion: rulesetVersion ?? null,
+      bundleSha: bundleSha ?? null,
+      commit: commit ?? null,
+    },
+    proves: PROVES,
+    doesNotProve: DOES_NOT_PROVE,
+  };
+}
+
+/** Sign a bundle. Returns a new object; the input is not mutated. */
+function signEvidenceBundle(bundle, privateKeyPem) {
+  const sig = node_crypto__WEBPACK_IMPORTED_MODULE_3__.sign(null, canonicalBytes(bundle), privateKeyPem);
+  return {
+    ...bundle,
+    signature: {
+      algorithm: 'ed25519',
+      canonicalisation: BUNDLE_SCHEMA,
+      value: sig.toString('base64'),
+    },
+  };
+}
+
+/**
+ * Verify a bundle with a PUBLIC key. This is the whole point: the verifier
+ * never needs, and never had, the signing key.
+ *
+ * Returns {ok, reason}. Never throws — a malformed bundle from an untrusted
+ * source is an expected input, not an exceptional one.
+ */
+function verifyEvidenceBundle(bundle, publicKeyPem) {
+  if (!bundle || typeof bundle !== 'object') return { ok: false, reason: 'bundle is not an object' };
+  if (bundle.schema !== BUNDLE_SCHEMA) return { ok: false, reason: `unrecognised schema: ${bundle.schema}` };
+  const sig = bundle.signature;
+  if (!sig?.value) return { ok: false, reason: 'bundle is unsigned' };
+  if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };
+  if (!publicKeyPem) return { ok: false, reason: 'no public key supplied' };
+  let ok = false;
+  try {
+    ok = node_crypto__WEBPACK_IMPORTED_MODULE_3__.verify(null, canonicalBytes(bundle), publicKeyPem, Buffer.from(sig.value, 'base64'));
+  } catch (e) {
+    return { ok: false, reason: `verification error: ${e.message}` };
+  }
+  return ok
+    ? { ok: true, reason: null }
+    : { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
+}
+
+
+/***/ })
+
+};

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5865);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2912);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/435.index.js

@@ -171,6 +171,8 @@ function redactArgsBlob(s) {
   return redactString(s);
 }
 
+// EXTERNAL MODULE: ./src/posture/state-dir.js
+var state_dir = __webpack_require__(1174);
 ;// CONCATENATED MODULE: ./src/posture/agents-memory.js
 // AGENTS.md — writable continual-learning memory (harness-anatomy #2).
 //
@@ -203,6 +205,7 @@ function redactArgsBlob(s) {
 
 
 
+
 const MEMORY_FILE = '.agentic-security/AGENTS.md';
 const ARCHIVE_FILE = '.agentic-security/AGENTS.md.archive';
 const MAX_BYTES = 20 * 1024;
@@ -210,8 +213,8 @@ const MAX_ENTRY_BYTES = 2 * 1024;
 const ARCHIVE_MAX_BYTES = 200 * 1024;
 const HEADER = '# AGENTS.md\n\nAgent-authored continual-learning notes. Each entry: timestamp + agent name + one short paragraph. New entries appended at the bottom; oldest entries rotate to AGENTS.md.archive when this file exceeds 20 KB.\n\n';
 
-function _resolve(scanRoot) { return external_node_path_.join(scanRoot, MEMORY_FILE); }
-function _archivePath(scanRoot) { return external_node_path_.join(scanRoot, ARCHIVE_FILE); }
+function _resolve(scanRoot) { return (0,state_dir/* statePath */.BQ)(scanRoot, 'AGENTS.md'); }
+function _archivePath(scanRoot) { return (0,state_dir/* statePath */.BQ)(scanRoot, 'AGENTS.md.archive'); }
 
 function readAgentsMemory(scanRoot) {
   const fp = _resolve(scanRoot);
@@ -239,7 +242,8 @@ function appendAgentsMemory(scanRoot, { agent, body }) {
   const entry = `\n## ${ts}  agent: ${agent}\n\n${snippet}\n`;
   try {
     const fp = _resolve(scanRoot);
-    external_node_fs_.mkdirSync(external_node_path_.dirname(fp), { recursive: true });
+    if (!(0,state_dir.stateWritesEnabled)()) return;
+  external_node_fs_.mkdirSync(external_node_path_.dirname(fp), { recursive: true });
     if (!external_node_fs_.existsSync(fp)) external_node_fs_.writeFileSync(fp, HEADER);
     external_node_fs_.appendFileSync(fp, entry);
     _maybeRotate(scanRoot);
@@ -601,7 +605,7 @@ function _scratchpadAbs(sessionRoot, relPath) {
 }
 
 function _scratchpadTotalBytes(sessionRoot) {
-  const base = external_node_path_.join(sessionRoot, '.agentic-security', 'agent-scratchpad');
+  const base = (0,state_dir/* statePath */.BQ)(sessionRoot, 'agent-scratchpad');
   if (!external_node_fs_.existsSync(base)) return 0;
   let total = 0;
   const walk = (dir) => {
@@ -666,8 +670,8 @@ function _confine(sessionRoot, candidate, label) {
 }
 
 function _readLastScanVerified(sessionRoot, { allowUnsigned = false } = {}) {
-  const stateDir = external_node_path_.join(sessionRoot, '.agentic-security');
-  const scanFile = external_node_path_.join(stateDir, 'last-scan.json');
+  const stateDirPath = (0,state_dir/* stateDir */.Pn)(sessionRoot);
+  const scanFile = external_node_path_.join(stateDirPath, 'last-scan.json');
   const sigFile = scanFile + '.sig';
   if (!external_node_fs_.existsSync(scanFile)) return { scan: null, status: 'missing' };
   const body = external_node_fs_.readFileSync(scanFile, 'utf8');
@@ -1457,6 +1461,7 @@ const read_scratchpad = {
 
 
 
+
 const append_agents_memory = {
   name: 'append_agents_memory',
   description: 'Append a short narrative entry to AGENTS.md — agent-authored continual-learning notes. Use at session end to record "what worked / what didn\'t / what I\'d try differently next time" so the next agent can pick up the lesson. Bounded: 2 KB per entry, 20 KB total before rotation to AGENTS.md.archive. Use sparingly — narrative, not structured data.',
@@ -1754,6 +1759,7 @@ function validate(schema, value, path = 'arguments') {
 
 
 
+
 const MAX_ARG_BYTES = 1024;
 const GENESIS = 'GENESIS';
 const REMOTE_TIMEOUT_MS = 1500;
@@ -1814,7 +1820,7 @@ function auditCall({ sessionRoot, tool, args, outcome, reason }) {
     let hasMarker = false;
     for (const m of MARKERS) { try { if (external_node_fs_.existsSync(external_node_path_.join(sessionRoot, m))) { hasMarker = true; break; } } catch {} }
     if (!hasMarker) return;
-    const dir = external_node_path_.join(sessionRoot, '.agentic-security');
+    const dir = (0,state_dir/* stateDir */.Pn)(sessionRoot);
     external_node_fs_.mkdirSync(dir, { recursive: true });
     const logFile = external_node_path_.join(dir, 'mcp-audit.log');
     const entry = {

package/dist/499.index.js

@@ -0,0 +1,86 @@
+export const id = 499;
+export const ids = [499];
+export const modules = {
+
+/***/ 3499:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   H: () => (/* binding */ lensByKey),
+/* harmony export */   LENSES: () => (/* binding */ LENSES),
+/* harmony export */   j: () => (/* binding */ buildHunterPrompt)
+/* harmony export */ });
+//
+// The seven hunting lenses. Each hunter run is one (focus area × lens) pair.
+//
+// WHY DIVERSE LENSES RATHER THAN N IDENTICAL HUNTERS: redundancy raises
+// confidence in what was already found and adds nothing to coverage. A lens
+// that is told to look only at authorization asks different questions of the
+// same code than one told to look at crypto, so the union covers failure modes
+// no single prompt reaches. `wildcard` exists because a fixed taxonomy is a
+// ceiling, and the classes worth finding are the ones not on the list.
+const LENSES = Object.freeze([
+  { key: 'injection', title: 'Injection', family: 'injection', cwe: 'CWE-74',
+    brief: 'Untrusted input reaching an interpreter: SQL, shell, template, XPath, LDAP, or deserialization. Follow the value, not the function name.' },
+  { key: 'authz', title: 'Authorization', family: 'access-control', cwe: 'CWE-285',
+    brief: 'Missing, partial, or bypassable authorization: object references not scoped to the caller, tier checks applied on one path but not another, checks performed after the effect.' },
+  { key: 'crypto', title: 'Cryptography', family: 'crypto', cwe: 'CWE-327',
+    brief: 'Misuse rather than choice of primitive: reused nonces, unauthenticated ciphertext, comparisons that are not constant time, keys derived from guessable material.' },
+  { key: 'business-logic', title: 'Business logic', family: 'business-logic', cwe: 'CWE-840',
+    brief: 'The code does what it says and what it says is wrong: state machines that accept out-of-order transitions, quantities that may be negative, refunds that exceed charges, limits enforced client side.' },
+  { key: 'feature-abuse', title: 'Feature abuse', family: 'abuse', cwe: 'CWE-799',
+    brief: 'A working feature used as a weapon: unbounded fan-out, expensive endpoints with no cost to the caller, invitations or exports that leak across tenants.' },
+  { key: 'chained', title: 'Chained', family: 'attack-chain', cwe: 'CWE-1173',
+    brief: 'Two behaviours that are each acceptable alone and unacceptable together. State the chain as an ordered sequence of steps with the attacker capability required at each.' },
+  { key: 'wildcard', title: 'Wildcard', family: 'other', cwe: 'CWE-710',
+    brief: 'Anything the other lenses do not cover. Prefer the surprising and specific over the generic; report nothing rather than something already obvious.' },
+]);
+
+function lensByKey(key) {
+  if (typeof key !== 'string') return null;
+  return LENSES.find(l => l.key === key) || null;
+}
+
+const DEFAULT_MAX_CHARS = 60_000;
+
+function buildHunterPrompt(focusArea, lens, ctx = {}) {
+  const maxChars = Number.isInteger(ctx.maxChars) && ctx.maxChars > 0 ? ctx.maxChars : DEFAULT_MAX_CHARS;
+  const contents = ctx.fileContents || {};
+  const files = (focusArea?.files || []).filter(f => typeof contents[f] === 'string');
+
+  let budget = maxChars;
+  const blocks = [];
+  for (const f of files) {
+    const src = contents[f];
+    const slice = src.length > budget ? src.slice(0, Math.max(0, budget)) : src;
+    const truncated = slice.length < src.length;
+    blocks.push(`--- ${f}${truncated ? ' (truncated)' : ''} ---\n${slice}`);
+    budget -= slice.length;
+    if (budget <= 0) break;
+  }
+  const omitted = files.length - blocks.length;
+
+  return [
+    `You are hunting for security vulnerabilities in one area of a codebase.`,
+    `Area: ${focusArea?.label ?? 'unknown'} (${files.length} files)`,
+    ``,
+    `Your lens is ${lens.title}. ${lens.brief}`,
+    `Report ONLY through this lens. Another hunter covers the others.`,
+    ``,
+    `Rules:`,
+    `- Report a candidate only if you can name the entry point an attacker controls and the effect they achieve.`,
+    `- Do not report defence-in-depth gaps, style, or "could be hardened". Those are not candidates.`,
+    `- Cite a real file and line from the source below. A candidate with no location is discarded.`,
+    ``,
+    `Return JSON: {"candidates":[{"title","file","line","rationale","entryPoint","sink"}]}`,
+    `Return {"candidates":[]} if you find nothing. An empty result is a valid and useful answer.`,
+    ``,
+    omitted > 0 ? `NOTE: ${omitted} file(s) omitted, prompt budget exhausted (truncated context).\n` : ``,
+    ...blocks,
+  ].join('\n');
+}
+
+
+/***/ })
+
+};

package/dist/513.index.js

@@ -12,6 +12,7 @@ export const modules = {
 /* unused harmony exports badgeFromScanRoot, renderSvg, _internal */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
 // Live SVG badge generator (v0.72).
 //
 // Every repo can drop a badge in its README pulling from the latest scan:
@@ -42,6 +43,7 @@ export const modules = {
 
 
 
+
 const COLORS = {
   critical:    '#e05d44',  // red
   high:        '#fe7d37',  // orange
@@ -56,7 +58,7 @@ const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
 
 function _readLastScan(scanRoot) {
   if (!scanRoot) return null;
-  const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, '.agentic-security', 'last-scan.json');
+  const fp = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'last-scan.json');
   if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return null;
   try { return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8')); }
   catch { return null; }
@@ -214,6 +216,7 @@ const _internal = { COLORS, _ageString, _readLastScan };
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
 /* harmony import */ var _badge_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(3117);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(1174);
 // Leaderboard backend (v0.72).
 //
 // Generates the data shape that powers the future public leaderboard at
@@ -243,6 +246,7 @@ const _internal = { COLORS, _ageString, _readLastScan };
 
 
 
+
 // Grade thresholds. Critical findings dominate; high/medium contribute
 // secondarily. These numbers are heuristic — calibrate against the
 // public leaderboard corpus once data lands.
@@ -306,7 +310,7 @@ function _deltaTrend(history) {
  */
 function leaderboardRowFor({ scanRoot, repo, badgeBase = 'https://agentic-security.dev/badge' } = {}) {
   if (!repo) throw new Error('leaderboardRowFor: repo slug is required');
-  const lastScanPath = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot || '.', '.agentic-security', 'last-scan.json');
+  const lastScanPath = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__/* .statePath */ .BQ)(scanRoot || '.', 'last-scan.json');
   let scan = null;
   try { scan = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(lastScanPath, 'utf8')); } catch {}
   const summary = (0,_badge_js__WEBPACK_IMPORTED_MODULE_2__/* .summarizeForBadge */ .iI)(scan);
@@ -314,7 +318,7 @@ function leaderboardRowFor({ scanRoot, repo, badgeBase = 'https://agentic-securi
   const topCwe = _topCwe(scan);
 
   // Optional scan history for the trend signal.
-  const historyPath = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot || '.', '.agentic-security', 'scan-history.jsonl');
+  const historyPath = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__/* .statePath */ .BQ)(scanRoot || '.', 'scan-history.jsonl');
   let history = [];
   if (node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(historyPath)) {
     try {

package/dist/526.index.js

@@ -52,7 +52,6 @@ export const modules = {
 
 
 
-const STATE_DIR = '.agentic-security';
 const LOG_FILE = 'fix-metrics.jsonl';
 
 // Below this many samples a percentile is an artifact of the sample, not a
@@ -65,7 +64,7 @@ const RELIABLE_N = 10;
 const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
 
 function _logPath(scanRoot) {
-  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR, LOG_FILE);
+  return (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, LOG_FILE);
 }
 
 /**
@@ -77,9 +76,10 @@ function _logPath(scanRoot) {
 function recordFixAttempt(scanRoot, record) {
   if (!scanRoot || !record || typeof record !== 'object') return false;
   try {
-    const dir = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR);
+    const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
     if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return;
+  node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
     // One writeSync of one newline-terminated line: a concurrent reader sees
     // whole records or nothing, and a torn tail is dropped on read.
     node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
@@ -234,8 +234,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 600 modules
-var engine = __webpack_require__(5865);
+// EXTERNAL MODULE: ./src/engine.js + 499 modules
+var engine = __webpack_require__(2912);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //