@clear-capabilities/agentic-security-scanner 0.134.0 → 0.136.9

package/src/engine.js

@@ -71,6 +71,8 @@ import { scanWebhook } from './sast/webhook.js';
 import { scanClientSide } from './sast/client-side.js';
 import { scanPromptFirewall } from './sast/prompt-firewall.js';
 import { scanLlmRedteam } from './posture/llm-redteam.js';
+import { assessPrivacyFramework, persistPrivacyFramework } from './posture/privacy-framework.js';
+import { safeWriteState as _safeWriteState, statePath, statePath as _statePath } from './posture/state-dir.js';
 import { scanContainer } from './sca/container.js';
 import { detectDepConfusion } from './sca/dep-confusion.js';
 import { loadLicensePolicy, evaluateLicensePolicy } from './posture/license-policy.js';
@@ -119,7 +121,7 @@ import { scanRuby } from './sast/ruby.js';
 import { scanPhp } from './sast/php.js';
 import { classifySecretCandidate as _entropyClassifySecret } from './sast/_secret-entropy.js';
 // Phase 1 — precision-engineering posture modules.
-import { annotateConfidence } from './posture/confidence.js';
+import { annotateConfidence, applyUnvalidatedPenalty } from './posture/confidence.js';
 import { backfillFindingDefaults } from './posture/finding-defaults.js';
 import { annotatePocs } from './posture/poc-generator.js';
 import { annotateExecutionProofs } from './posture/prove-findings.js';
@@ -146,7 +148,7 @@ import { ingestLogicClaims } from './posture/logic-claims.js';
 import { annotateNarration } from './posture/flow-narration.js';
 import { applyPathConstraints } from './posture/path-predicates.js';
 // Phase 3 (Sentinel-parity Layer 1 + 2) — IR + interprocedural taint engine.
-import { buildProjectIR } from './ir/index.js';
+import { buildProjectIR, buildProjectIRAsync } from './ir/index.js';
 import { collectIrStats, irStatsTarget, writeIrStats } from './ir/ir-stats.js';
 import { runDeepAnalysis } from './dataflow/index.js';
 // v3 next-gen — Pillars 1, 4, 5, 6, 8, 9.
@@ -585,7 +587,16 @@ const SANITIZER_PATTERNS=[{regex:/(?:escape|escapeHtml|htmlspecialchars|encodeUR
 {regex:/(?:re\.escape|preg_quote|Regexp\.escape)\s*\(/g,type:"Regex Escaping"}];
 const ROUTE_PATTERNS=[{regex:/(?:app|router)\s*\.\s*(get|post|put|patch|delete|all|options|head)\s*\(\s*['"`]([^'"`]+)['"`]/g,fw:"Express",mI:1,pI:2},{regex:/@(?:app|blueprint|bp)\s*\.\s*route\s*\(\s*['"]([^'"]+)['"]\s*(?:,\s*methods\s*=\s*\[([^\]]+)\])?/g,fw:"Flask",pI:1,mtI:2},{regex:/path\s*\(\s*['"]([^'"]+)['"]/g,fw:"Django",pI:1},{regex:/@(?:app|router)\s*\.\s*(get|post|put|patch|delete)\s*\(\s*['"]([^'"]+)['"]/g,fw:"FastAPI",mI:1,pI:2},{regex:/Route\s*::\s*(get|post|put|patch|delete|any)\s*\(\s*['"]([^'"]+)['"]/g,fw:"Laravel",mI:1,pI:2},{regex:/router\s*\.\s*(get|post|put|patch|delete)\s*\(\s*['"]([^'"]+)['"]/g,fw:"Koa/Express",mI:1,pI:2},{regex:/\[Http(Get|Post|Put|Delete|Patch)\s*\(\s*["']?([^"'\]]*)/g,fw:"ASP.NET",mI:1,pI:2},{regex:/['"`](\/api\/[a-zA-Z0-9\/:_\-{}]+)['"`]/g,fw:"API",pI:1}];
 const AUTH_PATTERNS=[/(?:authenticate|isAuthenticated|requireAuth|passport\.authenticate|jwt\.verify|verifyToken|authMiddleware|checkAuth|protect|authorize)\s*[\(,]/gi,/(?:middleware|use)\s*\(\s*(?:auth|jwt|token|session)/gi,/(?:isAuthorized|expressJwt|security\.isAuthorized|denyAll)\s*[\(]/gi,/passport\.(?:authenticate|initialize|session)\s*\(/gi];
-const IGNORE_DIRS=new Set(["node_modules",".git","__pycache__","vendor","dist","build",".next","venv","env",".venv","target","bin","obj",".cache","coverage","bower_components","tests","test","__tests__","spec","mocks"]);
+// `.agentic-security` is OUR OWN OUTPUT and must never be scanned input.
+// (NON_MUTATING_SCAN_PRD S4.) A scan writes threat-model.json,
+// exploit-bundles.json and scan-history.json into the tree it scanned, and those
+// files contain CWE identifiers. Without this, the second scan of any directory
+// reads the first scan's conclusions as source code — measured on the
+// independent benchmark as 220 polluted trees and 544 state files carrying
+// `CWE-` strings, which silently turned an accuracy measurement into the engine
+// grading itself. Scanning our own state is never useful and is exactly how
+// output becomes input.
+const IGNORE_DIRS=new Set(["node_modules",".git","__pycache__","vendor","dist","build",".next","venv","env",".venv","target","bin","obj",".cache","coverage","bower_components","tests","test","__tests__","spec","mocks",".agentic-security"]);
 const CODE_EXTS=new Set(["js","jsx","ts","tsx","mjs","cjs","py","rb","php","java","go","cs","rs","vue","svelte","html","htm","ejs","hbs","pug","erb","twig","graphql","gql","kt","scala","swift","dart","ex","exs","tf","tfvars","dockerfile","c","cc","cpp","cxx","h","hh","hpp","hxx","sol"]);
 // Feat-2: IaC manifest filenames that aren't extension-based.
 const IAC_FILENAMES = new Set(['Dockerfile', 'Containerfile', 'docker-compose.yml', 'docker-compose.yaml', 'Chart.yaml']);
@@ -2203,7 +2214,13 @@ const IAC_PATTERNS = [
   { match: /\$\{\{\s*github\.event\.(?:issue|pull_request)\.title|\$\{\{\s*github\.event\.comment\.body/i,
     fileTypes: /\.github\/workflows\/.*\.ya?ml$/i,
     severity: 'high', cwe: 'CWE-78', vuln: 'GitHub Actions: untrusted github.event input interpolated into shell',
-    fix: 'Pass user-controlled fields via env vars and reference them as $VARNAME in the script body, not via ${{ }} interpolation.' },
+    fix: 'Pass user-controlled fields via env vars and reference them as $VARNAME in the script body, not via ${{ }} interpolation.',
+    // Same false-positive as src/sast/pipeline.js's overlapping rule: a pure
+    // `KEY: ${{ github.event.… }}` mapping line assigns to an env var at the
+    // workflow-engine level (the fix's own recommended pattern), not into a
+    // shell command string — only a match embedded in a larger line (a run:
+    // script body) is actually dangerous.
+    lineSafeRe: /^[\w.-]+\s*:\s*\$\{\{[^}]*\}\}\s*$/ },
 ];
 
 function scanIaC(fp, raw){
@@ -2216,6 +2233,7 @@ function scanIaC(fp, raw){
     let m;
     while ((m = re.exec(raw))) {
       const line = raw.substring(0, m.index).split('\n').length;
+      if (p.lineSafeRe && p.lineSafeRe.test((lines[line - 1] || '').trim())) continue;
       findings.push({
         id: `iac:${fp}:${line}:${p.vuln.replace(/\s/g, '_').slice(0, 60)}`,
         kind: 'iac', severity: p.severity, vuln: p.vuln,
@@ -2401,7 +2419,7 @@ async function _loadCustomRules(scanRoot){
   _customIgnorePaths = [];
   let raw = null, parsedObj = null;
   for (const ext of ['rules.yml', 'rules.yaml', 'rules.json']) {
-    const p = path.join(scanRoot, '.agentic-security', ext);
+    const p = statePath(scanRoot, ext);
     try { raw = fs.readFileSync(p, 'utf8'); } catch { continue; }
     try {
       if (ext.endsWith('.json')) parsedObj = JSON.parse(raw);
@@ -2736,10 +2754,24 @@ function scanLogicVulns(fp,raw){
     while((m=re.exec(haystack))){
       const line=lineAt(haystack,m.index);
       const snippet=lines[line-1]?.trim()||"";
+      let outSnippet=snippet;
       // FP-2: credential FP filter
       if(pat.vuln==='Hardcoded Secret'||pat.vuln==='Hardcoded Credential Check'){
         const fpCheck=_isFalsePositiveCredential(fp,snippet,m[0]);
         if(fpCheck.skip){_suppressionLog.push({vuln:pat.vuln,file:fp,line,snippet,reason:fpCheck.reason});continue;}
+        // Stage 4 correctness audit (coverage breadth, secrets): same
+        // unredacted-snippet leak found in engine.js's scanEntropySecrets/
+        // scanCredentials and sast/secret-concat.js — this is a THIRD,
+        // separate detector (LOGIC_PATTERNS' own "Hardcoded Secret" rule)
+        // that also stored the raw source line, with no masking at all.
+        // The regex captures the quoted value inside `m[0]`; mask just
+        // that value within the reported snippet.
+        const valMatch=m[0].match(/['"]([^'"]{3,})['"]/);
+        if(valMatch){
+          const val=valMatch[1];
+          const masked=val.length>8?val.substring(0,4)+"…"+val.substring(val.length-4):"••••";
+          outSnippet=snippet.split(val).join(masked);
+        }
       }
       // FP-6: operational-context gate for selected logic patterns
       if (predicate) {
@@ -2749,7 +2781,7 @@ function scanLogicVulns(fp,raw){
           continue;
         }
       }
-      results.push({vuln:pat.vuln,severity:pat.severity,cwe:pat.cwe,stride:pat.stride,kind:pat.kind,fix:pat.fix,code:pat.code,file:fp,line,snippet});
+      results.push({vuln:pat.vuln,severity:pat.severity,cwe:pat.cwe,stride:pat.stride,kind:pat.kind,fix:pat.fix,code:pat.code,file:fp,line,snippet:outSnippet});
     }
   }
   const routeRe=/(?:app|router)\s*\.\s*(?:get|post|all)\s*\(\s*['"`](\/(?:debug|admin|test|internal|__)[^'"`]*)/gi;let rm;
@@ -5398,17 +5430,29 @@ function scanEntropySecrets(fp,raw){
     // FP-5: structural / doc-context suppression
     const surrounding=lines.slice(Math.max(0,line-3),Math.min(lines.length,line+1)).join("\n");
     const nonSecretReason=_isLikelyNonSecret(v, ctx, surrounding);
+    const masked=v.substring(0,4)+"…"+v.substring(v.length-4);
     if (nonSecretReason) {
-      _suppressionLog.push({vuln:"High-Entropy Credential Candidate",file:fp,line,snippet:ctx.trim(),reason:'entropy-'+nonSecretReason});
+      // Same redaction concern as the main finding below applies to the
+      // suppression log — it's exposed via --include-suppressed, and a
+      // heuristic "probably not a real secret" call can be wrong.
+      _suppressionLog.push({vuln:"High-Entropy Credential Candidate",file:fp,line,snippet:ctx.trim().split(v).join(masked),reason:'entropy-'+nonSecretReason});
       continue;
     }
-    const masked=v.substring(0,4)+"…"+v.substring(v.length-4);
+    // Stage 4 correctness audit (coverage breadth, secrets): `snippet` used
+    // to carry the RAW, unmasked source line — including the full secret
+    // value — even though `masked` right next to it was correctly
+    // redacted. Nothing downstream (normalizeFindings, toHTML, toCSV,
+    // toJUnit) ever redacts `snippet` again, so the plaintext credential
+    // this detector exists to find flowed straight into every report
+    // format this scanner emits, including last-scan.json. Redact the
+    // exact matched value out of the snippet at the source, the same way
+    // `masked` already is.
     out.push({
       vuln:"High-Entropy Credential Candidate",
       severity:"high",cwe:"CWE-798",stride:"Information Disclosure",
       fix:"Replace with environment variable or secrets manager reference; rotate the value immediately.",
       code:`// BEFORE\nconst secret = "${masked}";\n\n// AFTER\nconst secret = process.env.APP_SECRET;`,
-      file:fp,line,snippet:ctx.trim(),masked,entropy:e.toFixed(2)
+      file:fp,line,snippet:ctx.trim().split(v).join(masked),masked,entropy:e.toFixed(2)
     });
   }
   return out;
@@ -5448,12 +5492,21 @@ function scanConfigFiles(fc){
         const[,k,v]=m;
         if(!v||v==='""'||v==="''"||/^(?:change.?me|your[_-]|placeholder|example|xxx+|todo|<|\$\{)/i.test(v))continue;
         if(/(?:password|secret|key|token|api)/i.test(k)){
+          // Stage 6 correctness audit: this was the one secrets-adjacent
+          // detector still shipping the RAW, unmasked source line as
+          // `snippet` — its siblings (scanCredentials/scanEntropySecrets)
+          // were already fixed for this exact leak in the Stage 4 audit.
+          // Nothing downstream re-redacts `snippet`, and the MCP redact.js
+          // catch-all requires a QUOTED value, which standard `.env`
+          // KEY=value syntax never has — so the plaintext committed
+          // secret flowed straight through explain_finding unredacted.
+          const masked=v.length>8?v.substring(0,4)+"…"+v.substring(v.length-4):"…";
           out.push({
             vuln:`Committed .env with Real-Looking ${k}`,
             severity:"high",cwe:"CWE-538",stride:"Information Disclosure",
             fix:`Remove ${k} from committed env files. Use .env.example with placeholders and ignore .env in VCS.`,
             code:`# In .gitignore\n.env\n\n# .env.example (commit)\n${k}=<your-${k.toLowerCase()}>`,
-            file:fp,line:i+1,snippet:ln
+            file:fp,line:i+1,snippet:ln.split(v).join(masked),masked
           });
         }
       }
@@ -6358,7 +6411,11 @@ function scanCredentials(fp,raw){
       if(seen.has(key))continue;seen.add(key);
       const severity=pat.s==="c"?"critical":pat.s==="h"?"high":"medium";
       const masked=val.length>12?val.substring(0,6)+"••••••"+val.substring(val.length-4):val.substring(0,3)+"•••";
-      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,snippet,masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
+      // Stage 4 correctness audit (coverage breadth, secrets): same
+      // unredacted-snippet leak as scanEntropySecrets — `snippet` carried
+      // the raw source line (full credential value) straight through to
+      // every report format. Redact the exact matched value here too.
+      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,snippet:snippet.split(val).join(masked),masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
     }
   }
   return results;
@@ -6523,7 +6580,7 @@ function _makePurl(ecosystem,name,version,group){
   const t={npm:'npm',pypi:'pypi'}[ecosystem]||ecosystem;
   if(!t)return'';
   const ns=group?`${encodeURIComponent(group)}/`:'';
-  return`pkg:${t}/${ns}${encodeURIComponent(name)}${version?'@'+version:''}`;
+  return`pkg:${t}/${ns}${encodeURIComponent(name)}${version?'@'+encodeURIComponent(version):''}`;
 }
 
 function _parsePackageJson(text,filePath){
@@ -7497,7 +7554,7 @@ async function queryRegistries(components){
 
 // Node port: takes { fileContents, depFileContents } maps directly instead of a JSZip object.
 // fileContents = code files keyed by relative path; depFileContents = manifest/lockfiles keyed by relative path.
-async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null, resume=undefined}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
+async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null, resume=undefined, deep=undefined, deepInCi=undefined}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
   // Pre-pass: build cross-file Java tainted-method index so per-file taint
   // analysis can recognize calls to user-input-returning helper methods
   // defined in OTHER files (Juliet's DataflowThruInnerClass / Vector / Stream
@@ -7843,6 +7900,11 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // R8 (PRD §5): OS packages from an extracted container image's package DBs
   // (dpkg/apk) — baked-in deps the Dockerfile never names. Feed the OSV/SBOM pipeline.
   try{const{extractImagePackages}=await import('./sca/image-packages.js');for(const ip of extractImagePackages(allFileContents)){if(!components.some(c=>c.ecosystem===ip.ecosystem&&c.name===ip.name&&c.version===ip.version))components.push(ip);}}catch(_){}
+  // Dockerfile-declared apt/apk install-line packages — complementary to
+  // extractImagePackages above (which reads an actually scanned filesystem's
+  // installed-package DB, a different signal: build-time-declared vs.
+  // actually-installed).
+  try{const{extractContainerPackages}=await import('./sca/container.js');for(const cp of extractContainerPackages(allFileContents)){if(!components.some(c=>c.ecosystem===cp.ecosystem&&c.name===cp.name&&c.version===cp.version))components.push(cp);}}catch(_){}
   try{const{detectVendoredLibraries}=await import('./sca/vendor-detect.js');const vendored=detectVendoredLibraries(fc);for(const v of vendored){const key=`${v.ecosystem}:${v.name}:${v.version}`;if(!components.some(c=>`${c.ecosystem}:${c.name}:${c.version}`===key))components.push({...v,group:'',purl:`pkg:${v.ecosystem}/${v.name}@${v.version}`,filePath:v.file,isUnpinned:false,reachable:true});}}catch(_){}
   const reach=buildReachabilitySet(fc);
   const reachabilitySet=reach.imported;
@@ -8093,7 +8155,13 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   };
   _runAnnotator('annotateStableIds', () => annotateStableIds(finalFindings));
   _runAnnotator("clusterByRootCause", () => { finalFindings = clusterByRootCause(finalFindings); });
-  _runAnnotator("demoteUnreachable", () => { demoteUnreachable(finalFindings, { routes: aR }); });
+  _runAnnotator("demoteUnreachable", () => {
+    demoteUnreachable(finalFindings, { routes: aR });
+    // `type: 'vulnerable_dep'` findings live in supplyChain, not finalFindings
+    // (src/sca/CLAUDE.md) — demoteUnreachable's SCA-tier branch needs this
+    // array passed explicitly or it never sees an SCA finding at all.
+    demoteUnreachable(supplyChain, { routes: aR });
+  });
   // Premortem #8: backfill parser/family BEFORE confidence and calibration,
   // because both consume those fields and silently no-op when they're null.
   _runAnnotator("backfillFindingDefaults", () => { backfillFindingDefaults(finalFindings); });
@@ -8113,22 +8181,25 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
     // Generalised sanitizer consumption (dataflow/sanitizer-gate.js): labels
     // findings whose flow passes a catalog sanitizer matching their family
     // (xss/url/cmd, not just sql) so the proof gate below can demote them the
-    // same way it demotes proven-clean SQL. `sanitizersOnPath` would need to
-    // be `{ [findingId]: string[] of sanitizer callees observed on that
-    // finding's flow }`. There is nothing to build that map from: the live
-    // taint walk in dataflow/engine.js does NOT consult sanitizer catalog
-    // entries at all. `matchSinkOrSanitizer()` returns every catalog hit for
-    // a callee, but every consumer in dataflow/*.js selects only
-    // `e.kind === 'sink'` — there is no `'sanitizer'` branch anywhere in that
-    // tree. Taint is killed only by clean re-assignment of a variable
-    // (removePathAndDescendants, engine.js:374), which happens regardless of
-    // whether the RHS call is a catalog sanitizer.
-    // So this is `{}` and the gate below is INERT — not "awaiting plumbing"
-    // but awaiting the sanitizer walk itself. Making it live needs two things:
-    // (1) dataflow/engine.js honouring `kind === 'sanitizer'` at a call site,
-    // and (2) that call site's callee name threaded onto the finding
-    // alongside the trace/chain that proven-clean.js already reads.
+    // same way it demotes proven-clean SQL.
+    //
+    // The taint walk now records the sanitizer callees observed on the value
+    // reaching each sink argument (`dataflow/engine.js` `_sanitizersForExpr`)
+    // and stamps them on the finding as `_sanitizersOnPath`. This rebuilds the
+    // `{ [findingId]: string[] }` shape the gate wants. Both `id` and
+    // `stableId` are keyed because the gate accepts either and stable ids are
+    // assigned by an earlier annotator.
+    //
+    // The sanitizer never kills the taint in the walk itself: a mislabelled
+    // sanitizer would then hide a real vulnerability outright, whereas a label
+    // only demotes confidence here. Recall-preserving, on purpose.
     const sanitizersOnPath = {};
+    for (const f of finalFindings) {
+      const names = f && f._sanitizersOnPath;
+      if (!Array.isArray(names) || !names.length) continue;
+      if (f.id) sanitizersOnPath[f.id] = names;
+      if (f.stableId) sanitizersOnPath[f.stableId] = names;
+    }
     _runAnnotator("applySanitizerGate", () => { applySanitizerGate(finalFindings, { sanitizersOnPath }); });
     _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
   }
@@ -8211,7 +8282,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
         if (r && r.piiFields) {
           try {
             const dpia = emitDpiaArtifact(r.piiFields, r.findings || []);
-            fs.writeFileSync(path.join(scanRoot, '.agentic-security', 'dpia.md'), dpia);
+            _safeWriteState(_statePath(scanRoot, 'dpia.md'), dpia);
           } catch (_) {}
         }
       });
@@ -8277,8 +8348,10 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // v3 next-gen: per-attacker-persona score matrix (FR-ADV-2). Must run AFTER
   // crown-jewels + mitigation composite so it sees those signals.
   _runAnnotator("annotatePersonaScores", () => { annotatePersonaScores(finalFindings); });
-  // v3 next-gen: SCA reverse-blast-radius enrichment (FR-ADV-5).
-  _runAnnotator("annotateScaReverseBlast", () => { annotateScaReverseBlast(finalFindings, fc); });
+  // v3 next-gen: SCA reverse-blast-radius enrichment (FR-ADV-5). Annotates
+  // SCA findings (package-name-keyed) — must run against supplyChain, not
+  // finalFindings (SAST), which has no package-name field at all.
+  _runAnnotator("annotateScaReverseBlast", () => { annotateScaReverseBlast(supplyChain, fc); });
   // v3 next-gen: bug-bounty payout prediction (FR-ADV-3). Composes with the
   // mitigation composite — gated/unreachable findings get the bounty scaled
   // down rather than zeroed.
@@ -8409,10 +8482,25 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // gets strictly more wall-clock for the taint analysis itself than an
   // uninstrumented run with the same budget.
   let _sharedIR = null;
+  // Java IR requires the ASYNC builder. `parser-java.js` exports an async
+  // `parseJavaFile` (java-parser needs a dynamic import), so the sync
+  // `buildProjectIR` has no Java branch at all — and both deep-path call sites
+  // used it. The result was that no .java file had ever produced an IR function
+  // in deep mode: `bench/layer-recall` measured java at 0/25 while the catalog
+  // carried 7 Java sources and 15 Java sinks that had nothing to run against.
+  // `buildProjectIRAsync` is a full mirror plus Java and had zero callers.
+  //
+  // Gated on the presence of .java rather than always awaiting: the async
+  // builder is a superset, but switching every scan in the product to it to fix
+  // one language would change the execution shape (and attempt the java-parser
+  // import) for projects that contain no Java. `runFullScan` is already async,
+  // so the await costs nothing structurally.
+  const _hasJava = Object.keys(fc || {}).some(f => /\.java$/i.test(f));
+  const _buildIR = async () => (_hasJava ? await buildProjectIRAsync(fc) : buildProjectIR(fc));
   const _irStatsTarget = irStatsTarget();
   if (_irStatsTarget) {
     try {
-      _sharedIR = buildProjectIR(fc);
+      _sharedIR = await _buildIR();
       writeIrStats(_irStatsTarget, collectIrStats(fc, _sharedIR.perFile, _sharedIR.callGraph));
     } catch (e) {
       // Instrumentation must never fail a scan. Surface only when debugging.
@@ -8421,16 +8509,27 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       }
     }
   }
-  const _deepRequested = process.env.AGENTIC_SECURITY_DEEP === '1';
+  // `deep`/`deepInCi` come from runScan()'s options object (threaded through
+  // unchanged from runScan.js) — an explicit-opt-in override alongside the
+  // env vars, not a replacement for them. Added because `runScan(dir,
+  // {deep:true})` was a silent, total no-op: this options object was
+  // destructured for fileContents/depFileContents/scanRoot/resume only, so
+  // `deep` was dropped on the floor and deep mode stayed off regardless.
+  // Several interprocedural test files (interproc-k2.test.js,
+  // parser-cs-kt.test.js, points-to.test.js) pass exactly this option
+  // believing it enables deep mode — it never did, so those tests were
+  // exercising whatever coincidentally fires without the deep engine, not
+  // the interprocedural machinery they're named for.
+  const _deepRequested = deep === true || process.env.AGENTIC_SECURITY_DEEP === '1';
   const _inCi = !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
                    process.env.BUILDKITE || process.env.CIRCLECI || process.env.JENKINS_URL);
-  const _deepInCiAllowed = process.env.AGENTIC_SECURITY_DEEP_IN_CI === '1';
+  const _deepInCiAllowed = deepInCi === true || process.env.AGENTIC_SECURITY_DEEP_IN_CI === '1';
   const _deepEnabled = _deepRequested && (!_inCi || _deepInCiAllowed);
   if (_deepEnabled) {
     const budgetMs = parseInt(process.env.AGENTIC_SECURITY_DEEP_TIMEOUT_MS || '300000', 10);
     const t0 = Date.now();
     try {
-      const { perFile, callGraph } = _sharedIR || (_sharedIR = buildProjectIR(fc));
+      const { perFile, callGraph } = _sharedIR || (_sharedIR = await _buildIR());
       // The runDeepAnalysis call is synchronous in this codebase; we can't
       // truly interrupt it without re-architecting the worklist. We pass a
       // deadlineMs hint that the inner loops check; if absent, we still cap
@@ -8460,6 +8559,29 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
         f.validator_verdict = 'unvalidated';
       }
       finalFindings.push(...irFindings);
+      // Sanitizer + proof gate, pass 2 of 2 — same ordering trap as the
+      // ignore-pragma double pass below, and for the same reason: pass 1 runs
+      // ~2300 lines above, long before deep-mode IR findings exist, so a
+      // sanitized IR-TAINT flow was never labelled and a proven-clean one was
+      // never demoted. Deep mode is what the CLI uses outside CI, so that was
+      // the case that mattered most.
+      //
+      // Scoped to `irFindings` rather than re-running over `finalFindings`:
+      // annotateProofGate demotes confidence, so a second pass over findings
+      // pass 1 already handled would demote them twice.
+      if (process.env.AGENTIC_SECURITY_NO_PROOF_GATE !== '1') {
+        const _irSanitizers = {};
+        for (const f of irFindings) {
+          const names = f && f._sanitizersOnPath;
+          if (!Array.isArray(names) || !names.length) continue;
+          if (f.id) _irSanitizers[f.id] = names;
+          if (f.stableId) _irSanitizers[f.stableId] = names;
+        }
+        _runAnnotator("applySanitizerGate:deep", () => {
+          applySanitizerGate(irFindings, { sanitizersOnPath: _irSanitizers });
+        });
+        _runAnnotator("annotateProofGate:deep", () => { annotateProofGate(irFindings); });
+      }
       // Pragma pass 2 of 2 — see the pass-1 comment far above. Deep-mode IR
       // findings land here, long after pass 1 ran, so without this an
       // `agentic-security-ignore` on an ir-taint finding is inert. Deep mode is
@@ -8515,11 +8637,18 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       confidence: 1.0,
     });
   }
-  // Phase 2 (Sentinel-parity): LLM validator stage. No-op unless the operator
-  // sets AGENTIC_SECURITY_LLM_VALIDATE=1 AND AGENTIC_SECURITY_LLM_ENDPOINT. When
-  // disabled, every finding gets unvalidated:true and the existing confidence
-  // pipeline accounts for that. When enabled, the validator emits accept/reject
-  // /escalate per finding; rejects are dropped into the suppression log.
+  // Phase 2 (Sentinel-parity): LLM validator stage. DEFAULT-ON whenever
+  // AGENTIC_SECURITY_LLM_ENDPOINT is configured — not gated on
+  // AGENTIC_SECURITY_LLM_VALIDATE=1 as this comment previously (and wrongly)
+  // said. Opt OUT with AGENTIC_SECURITY_LLM_VALIDATE=0; the legacy
+  // AGENTIC_SECURITY_LLM_VALIDATE=1 still works as an explicit-on no-op. With
+  // no endpoint configured the validator stays a no-op regardless — no
+  // surprise network calls from an unrelated env var. See
+  // llm-validator/index.js's own header, which states this correctly; this
+  // comment was the one that had drifted. When disabled, every finding gets
+  // unvalidated:true and the existing confidence pipeline accounts for that.
+  // When enabled, the validator emits accept/reject/escalate per finding;
+  // rejects are dropped into the suppression log.
   try {
     // Concurrency defaults to 1 (the validator's deterministic-default).
     // Operators raise via AGENTIC_SECURITY_LLM_CONCURRENCY at the cost of
@@ -8532,7 +8661,23 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       vuln: d.vuln, file: d.file, line: d.line, snippet: d.snippet,
       reason: 'llm-validator:reject:' + (d.validator_reasoning || '').slice(0, 80),
     });
+    // Re-run: annotateVerifierVerdicts ran (~8335) before validator_verdict
+    // existed on any finding (set here, hundreds of lines later), so its
+    // 'verified-by-llm' verdict — documented as one of five possible
+    // outcomes in verifier.js's own header — could never be produced by the
+    // real pipeline. Cheap and idempotent; re-running is the fix, not
+    // moving the original call (confidence/exploitability annotators
+    // upstream of it still need to run before validation, same as before).
+    try { annotateVerifierVerdicts(finalFindings, { fileContents: fc }); } catch (_) {}
   } catch(_) {}
+  // Same ordering fix as annotateVerifierVerdicts above: annotateConfidence
+  // (~8111) computes f.confidence before f.unvalidated exists on any
+  // finding, so its 0.85x "LLM validator unavailable" penalty could never
+  // apply in the real pipeline. Runs unconditionally (outside the
+  // llmValidateMany try-block above) because f.unvalidated is also set
+  // directly on deep-mode IR findings appended earlier in this function,
+  // independent of whether the LLM validator itself ran.
+  try { applyUnvalidatedPenalty(finalFindings); } catch (_) {}
   try {
     const { kept, suppressed } = applyLearnedFeedback(scanRoot, finalFindings);
     finalFindings = kept;
@@ -8574,7 +8719,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // second party could corroborate it.
   try {
     if (scanRoot) {
-      const raw = fs.readFileSync(path.join(scanRoot, '.agentic-security', 'logic-claims.json'), 'utf8');
+      const raw = fs.readFileSync(statePath(scanRoot, 'logic-claims.json'), 'utf8');
       const parsed = JSON.parse(raw);
       const incoming = Array.isArray(parsed) ? parsed : (parsed && parsed.claims) || [];
       if (incoming.length) {
@@ -8599,8 +8744,11 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       /(?:^|\/)test_[^/]*\.py$/i.test(f) || /_test\.(?:py|go)$/i.test(f));
     annotateScaVerdicts(supplyChain, { testsDetected: _testsDetected });
   } catch (_) {}
-  // 0.9.0 Feat-15: dep confusion
-  try{const dc=detectDepConfusion(annotatedComponents,scanRoot);aF.push(...dc);}catch(_){}
+  // 0.9.0 Feat-15: dep confusion. These are supply-chain findings (kind:'sca',
+  // derived from `components` not source code) and belong in supplyChain, not
+  // aF — aF was already snapshotted into finalFindings at dedupeFindingsWithEvidence
+  // above, so pushing into aF here silently discards every result.
+  try{const dc=detectDepConfusion(annotatedComponents,scanRoot);supplyChain.push(...dc);}catch(_){}
   // Deployment-platform security checklist
   try{const dpf=scanDeployPlatform(scanRoot);aLogic.push(...dpf);}catch(_){}
   // Stack-specific security playbook
@@ -8770,6 +8918,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // Each is opt-in via env var. They produce machine-readable artifacts
   // (threat-model.json/.md, dpia.md, compliance-evidence.json/.md,
   // sbom-history/<sha>.json, exploit-bundles/) under .agentic-security/.
+  let _privacyFramework = null;
   let _threatModel = null, _apiContractFindings = [], _sbomDiff = null,
       _complianceReport = null, _exploitBundles = null, _pqcPlan = null,
       _licenseGraph = null, _attributions = null, _taxonomySummary = null;
@@ -8802,8 +8951,22 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
     if (process.env.AGENTIC_SECURITY_NO_COMPLIANCE !== '1') {
       try {
         const policy = loadCompliancePolicy(scanRoot);
-        if (policy && !policy._error) {
+        if (policy && policy._error) {
+          // CMP-5: a malformed policy used to be silently treated the same
+          // as "no policy file" — the parse error (which names the exact
+          // problem) was computed and then discarded. verifyPolicy now
+          // reports it as a distinct 'error' status rather than staying
+          // silent, and it is surfaced here too so an interactive scan
+          // shows it.
           _complianceReport = verifyCompliancePolicy(policy, { scanRoot, findings: finalFindings });
+          process.stderr.write(`[compliance] ${policy._error}\n`);
+        } else if (policy) {
+          // CMP-5: pass every channel a real scan produces, not just SAST —
+          // a finding-family check for hardcoded-secret or vulnerable-dep
+          // was previously invisible to secrets/SCA findings entirely.
+          _complianceReport = verifyCompliancePolicy(policy, {
+            scanRoot, findings: finalFindings, secrets: aSecrets, logicVulns: aLogic, supplyChain,
+          });
           emitComplianceJsonLd(_complianceReport, scanRoot);
           emitComplianceMarkdown(_complianceReport, scanRoot);
         }
@@ -8837,6 +9000,29 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
         if (_pqcPlan) persistPqcPlan(scanRoot, _pqcPlan);
       } catch (_) {}
     }
+    // NIST Privacy Framework 1.1 assessment.
+    //
+    // The ASSESSMENT is default-on and lands on `scan.privacyFramework`, like
+    // every other posture artifact. Its FINDINGS are opt-in
+    // (AGENTIC_SECURITY_PRIVACY_FRAMEWORK=1), because appending them to
+    // scan.findings would change every severity count, gate verdict and
+    // baseline in every downstream consumer — a compliance opinion should not
+    // silently become a build failure for projects that never asked for it.
+    // Turn them on and they flow through triage and /fix like any finding.
+    if (process.env.AGENTIC_SECURITY_NO_PRIVACY_FRAMEWORK !== '1') {
+      try {
+        _privacyFramework = assessPrivacyFramework(scanRoot, {
+          findings: finalFindings, components: annotatedComponents,
+          // filesScanned feeds the vacuous-satisfaction guard: a clean signal
+          // from a run that read no files is not evidence of compliance.
+          filesScanned: files.length,
+        });
+        if (_privacyFramework) persistPrivacyFramework(scanRoot, _privacyFramework);
+        if (_privacyFramework && process.env.AGENTIC_SECURITY_PRIVACY_FRAMEWORK === '1') {
+          finalFindings.push(..._privacyFramework.findings);
+        }
+      } catch (_) {}
+    }
     // Exploit bundles — per-family PoC + Jest + pytest + remediation for
     // top-N critical/high findings.
     if (process.env.AGENTIC_SECURITY_NO_EXPLOIT_BUNDLES !== '1') {
@@ -8845,9 +9031,11 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
         if (bundles.size) {
           _exploitBundles = {};
           for (const [id, b] of bundles) _exploitBundles[id] = b;
-          const bundlePath = path.join(scanRoot, '.agentic-security', 'exploit-bundles.json');
-          try { fs.mkdirSync(path.dirname(bundlePath), { recursive: true }); } catch {}
-          try { fs.writeFileSync(bundlePath, JSON.stringify(_exploitBundles, null, 2)); } catch {}
+          // Through the seam, so `--no-state` withholds the artifact. The
+          // bundles stay on the scan result either way — a read-only scan must
+          // report the same thing, it just must not leave it behind.
+          _safeWriteState(_statePath(scanRoot, 'exploit-bundles.json'),
+            JSON.stringify(_exploitBundles, null, 2));
         }
       } catch (_) {}
     }
@@ -8858,7 +9046,16 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   let _analysisTier = null, _unmodeledSinks = null;
   try { _analysisTier = computeAnalysisTiers(Object.keys(fc)); } catch {}
   try { _unmodeledSinks = countUnmodeledSinkCandidates(fc, finalFindings); } catch {}
-  const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
+  // filesScanned counts files actually analyzed (Object.keys(fc), the same
+  // set computeAnalysisTiers above reads) — NOT files.length, the candidate
+  // list before the per-file loop's size/density skips run. Using the
+  // candidate count here double-counted skipped files: they were included
+  // in filesScanned AND separately reported in filesSkipped/filesDenseSkipped,
+  // so coverage-report.js's "scanned=N skipped=M" line implied N+M files were
+  // seen when only N-of-those-candidates were actually analyzed.
+  // checkpoint.total intentionally keeps files.length — that field means the
+  // full candidate set for resume bookkeeping, a different, correct meaning.
+  const _scanMeta={filesScanned:Object.keys(fc).length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
   // R8: the scan completed, so the checkpoint has been fully consumed — remove
   // it. Anything that threw before this point leaves it in place to resume from.
   try { closeCheckpoint(_ckpt, { complete: true }); } catch (_) {}
@@ -8881,7 +9078,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // Addition #3 — root-cause sweep: from confirmed findings, find sibling instances
   // detectors missed, with total-count accounting. Confirmed-only (cheap by default).
   let _rootCauseSweep = null; try { _rootCauseSweep = sweepRootCauses(finalFindings, fc); } catch { _rootCauseSweep = null; }
-  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
+  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".
 // Orphans (no finding linkage) are bucketed by file-local heuristic so the UI shows binary states only.

package/src/integrations/tickets.js

@@ -19,17 +19,18 @@ import * as cp from 'node:child_process';
 import { buildJiraIssue } from './index.js';
 import { escapeMarkdown } from '../util/untrusted.js';
 
-function statePath(scanRoot) {
-  return path.join(scanRoot, '.agentic-security', 'tickets.json');
+import { statePath } from '../posture/state-dir.js';
+function _ticketsPath(scanRoot) {
+  return statePath(scanRoot, 'tickets.json');
 }
 export function readState(scanRoot) {
-  const fp = statePath(scanRoot);
+  const fp = _ticketsPath(scanRoot);
   if (!fs.existsSync(fp)) return {};
   try { return JSON.parse(fs.readFileSync(fp, 'utf8')); } catch { return {}; }
 }
 function writeState(scanRoot, state) {
-  fs.mkdirSync(path.dirname(statePath(scanRoot)), { recursive: true });
-  fs.writeFileSync(statePath(scanRoot), JSON.stringify(state, null, 2));
+  fs.mkdirSync(path.dirname(_ticketsPath(scanRoot)), { recursive: true });
+  fs.writeFileSync(_ticketsPath(scanRoot), JSON.stringify(state, null, 2));
 }
 
 function findingTitle(f) {
@@ -148,7 +149,7 @@ const SEV_RANK = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
 
 export async function syncTickets({ scanRoot, provider, severity = 'high', repo, teamId, dryRun = false }) {
   const minRank = SEV_RANK[severity] ?? 3;
-  const lastScanPath = path.join(scanRoot, '.agentic-security', 'last-scan.json');
+  const lastScanPath = statePath(scanRoot, 'last-scan.json');
   if (!fs.existsSync(lastScanPath)) return { ok: false, error: 'no last-scan.json — run a scan first' };
   const last = JSON.parse(fs.readFileSync(lastScanPath, 'utf8'));
   const allFindings = [...(last.findings || []), ...(last.secrets || []), ...(last.supplyChain || [])];

package/src/ir/CLAUDE.md

@@ -10,7 +10,10 @@ consumed by `scanner/src/dataflow/` for taint analysis.
 | JS / TS  | `parser-js.js`        | `@babel/parser`                                  |
 | Python   | `parser-py-cst.js`    | Python 3.8+ stdlib `ast` via subprocess (default when available) |
 | Python   | `parser-py.js`        | Hand-rolled regex parser (fallback when python3 missing) |
-| Java     | `parser-java.js`      | `java-parser` npm package (async)                |
+| Java     | `parser-java.js`      | `java-parser` npm package (**async only** — the deep path in `engine.js` therefore awaits `buildProjectIRAsync` when any `.java` file is present, and uses the sync builder otherwise).
+⚠ Three defects made Java taint impossible until v0.136.3+: the sync-only call site; a CST walk looking for `blockStatement` on a `block` (java-parser nests `block → blockStatements → blockStatement`), which emptied every method CFG; and `exprFromCst` missing the `primary → primaryPrefix + primarySuffix` form that models **every** method call. Guarded by `test/java-taint-flow.test.js`. **Params are still not extracted** (`params: []`, marked "deferred" in the source), so Java interprocedural summaries are limited. |
+| Ruby     | `parser-rb.js`        | Hand-rolled. **`DEF_RE` must not let `\s*` cross a newline** — it did, and the body slice then started after the method's first statement, silently dropping it from every method (a one-statement body became empty). Measured as Ruby 0/20 IR-TAINT recall in `bench/layer-recall`. Guarded by `test/parser-php-rb.test.js`. ⚠ Also emitted no `fn.calls` at all (every OTHER parser does) — `callgraph.js`'s edges/callersOf/resolveKnownCallee are built entirely from `fn.calls`, so this left dead-code demotion and any interprocedural signal that depends on real call-graph resolution (rather than engine.js's generic tainted-call-argument fallback) permanently blind to Ruby. Fixed by deriving `fn.calls` from the CFG via the shared `call-sites.js#callSitesFromCfg` (the same helper `parser-py-cst.js` uses) — Ruby's node shapes already matched its documented contract. Guarded by `test/parser-rb-calls.test.js`. |
+| C#       | `parser-cs.js`        | Hand-rolled. ⚠ `_lowerExpr`'s string-concat branch **must** guard on `_splitTopLevelPlus` returning more than one part — when the `+` is nested inside parens the splitter returns the input unchanged and the branch recurses on the identical string (stack overflow, swallowed by `buildProjectIR`'s per-file catch, surfacing only as "no IR"). `new Type(args)` is lowered to a call so taint reaches constructor sinks such as `new SqlCommand`. Guarded by `test/parser-cs-kt.test.js`. |
 | C / C++  | `parser-cpp.js`       | Hand-rolled parser (functions, qualified names, CFG lowering). Dispatched by extension (`c/cc/cpp/cxx/h/hh/hpp/hxx`) in both `buildProjectIR` and `buildProjectIRAsync`. |
 | Long-tail (rust/solidity/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. |