@clear-capabilities/agentic-security-scanner 0.134.0 → 0.136.9

package/src/ir/parser-js.js

@@ -98,7 +98,22 @@ function lhsPath(n) {
   if (n.type === 'ThisExpression') return '_this_';
   if (n.type === 'MemberExpression') {
     const base = lhsPath(n.object);
-    const prop = n.computed ? '*' : (n.property?.name || '*');
+    // Stage 3 correctness audit (detection depth, path-feasibility): a
+    // computed WRITE with a literal key (`obj['secret'] = tainted`) used
+    // to collapse straight to the wildcard '*' — never trying to extract
+    // the literal, unlike exprOf's MemberExpression case just above,
+    // which DOES extract it for reads. That asymmetry meant a tainted
+    // write via bracket notation with a literal key produced access path
+    // "obj.*", while any later read of that same key (`obj.secret` or
+    // `obj['secret']`) resolves via exprOf to the specific path
+    // "obj.secret" — isCoveredBy has no wildcard semantics (`'*'` is a
+    // literal property name here, not a match-anything token), so the two
+    // paths never matched and the taint was silently unreachable from any
+    // correctly-computed read. Mirrors exprOf's extraction exactly so a
+    // write and a read of the same literal key always agree.
+    const prop = n.computed
+      ? (n.property?.value != null ? String(n.property.value) : '*')
+      : (n.property?.name || '*');
     if (!base) return null;
     return base + '.' + prop;
   }
@@ -138,16 +153,25 @@ export function parseJsFile(file, code) {
     const exitId  = nextNodeId();
     const fn = {
       qid, name: name || 'anon', line,
+      // Plain strings, per the IR shape contract (ir/CLAUDE.md: "params:
+      // ['arg1', 'arg2', ...]") — every other parser (py, cs, rb, cpp, ...)
+      // already emits this shape. This one used to emit {name,kind[,props]}
+      // objects instead, which every consumer (access-paths.js's
+      // isCoveredBy, summaries.js's paramNames.indexOf, entryStateFromCall,
+      // the k=2 pass's `new Set(fn.params)`) silently failed to match against
+      // — Set/string-equality checks against an object never succeed, so
+      // mutated-parameter taint and context-sensitive entry states were both
+      // unconditionally inert for every JS/TS function. Nothing in src/
+      // reads a param's .kind or .props, so the richer shape bought nothing.
       params: (params || []).map(p => {
         if (!p) return null;
-        if (p.type === 'Identifier') return { name: p.name, kind: 'ident' };
-        if (p.type === 'ObjectPattern') return { name: '<obj>', kind: 'object-pattern',
-          props: p.properties.map(pp => ({
-            key: pp.key?.name || (pp.key?.value != null ? String(pp.key.value) : '*'),
-            alias: lhsPath(pp.value),
-          })) };
-        if (p.type === 'AssignmentPattern' && p.left?.type === 'Identifier') return { name: p.left.name, kind: 'ident' };
-        if (p.type === 'RestElement' && p.argument?.type === 'Identifier') return { name: p.argument.name, kind: 'rest' };
+        if (p.type === 'Identifier') return p.name;
+        if (p.type === 'ObjectPattern') return '<obj>';
+        if (p.type === 'ArrayPattern') return '<arr>';
+        if (p.type === 'AssignmentPattern' && p.left?.type === 'Identifier') return p.left.name;
+        if (p.type === 'AssignmentPattern' && p.left?.type === 'ObjectPattern') return '<obj>';
+        if (p.type === 'AssignmentPattern' && p.left?.type === 'ArrayPattern') return '<arr>';
+        if (p.type === 'RestElement' && p.argument?.type === 'Identifier') return p.argument.name;
         return null;
       }).filter(Boolean),
       cfg: { entry: entryId, exit: exitId, nodes: new Map() },
@@ -189,6 +213,38 @@ export function parseJsFile(file, code) {
     return node.id;
   };
 
+  // Babel visits an IfStatement's consequent then its alternate as ordinary
+  // children of the same enter/exit pair, with no boundary hook between
+  // them — so fn._cursor was never reset before the alternate was
+  // traversed: the alternate's first node was linked as a successor of the
+  // CONSEQUENT's tail (a false predecessor edge corrupting any taint-state
+  // reasoning across the join) rather than a true second branch off the
+  // condition (also silently dropping the condition's "false" outgoing
+  // edge, which made applyPathFeasibility's constant-condition pruning
+  // treat the `if` as unconditional and delete its only edge).
+  //
+  // Called from the generic `Statement` visitor below AND from the top of
+  // every handler whose node type can itself be the direct (unbraced) root
+  // of an if's alternate (ReturnStatement, ThrowStatement, IfStatement for
+  // else-if chains, the loop statements, TryStatement) — Babel merges
+  // alias-derived and type-specific visitors for the same node but runs the
+  // type-specific one FIRST, so relying on the `Statement` alias alone
+  // misses every alternate root that also has its own specific handler.
+  // The one-shot flag makes the (redundant, second) `Statement` firing a
+  // safe no-op once the type-specific handler already did the reset.
+  const maybeResetAtAlternateBoundary = (fn, path) => {
+    const parent = path.parentPath && path.parentPath.node;
+    if (!parent || parent.type !== 'IfStatement' || parent.alternate !== path.node) return;
+    if (path.node._alternateBoundaryHandled) return;
+    path.node._alternateBoundaryHandled = true;
+    // fn._cursor is still the consequent's tail (or the condition node
+    // itself, if the consequent added none) — converge it into the join
+    // before abandoning it, then start the alternate from the condition,
+    // exactly like the consequent did.
+    linkCfg(fn, fn._cursor, parent._asJoin);
+    fn._cursor = parent._asCond;
+  };
+
   const recordWrite = (fn, target, source, nodeId) => {
     if (!target || typeof target !== 'string') return;
     if (!fn.writes.has(target)) fn.writes.set(target, []);
@@ -266,17 +322,45 @@ export function parseJsFile(file, code) {
           const id = lhsPath(path.node.id);
           if (!id) return;
           const initExpr = exprOf(path.node.init);
-          const nodeId = nextNodeId();
           const line = path.node.loc?.start?.line || 0;
-          addNode(fn, { id: nodeId, kind: 'assign', target: id, source: initExpr, line, succ: [], pred: [] });
-          if (typeof id === 'string') recordWrite(fn, id, initExpr, nodeId);
+          if (typeof id === 'string') {
+            const nodeId = nextNodeId();
+            addNode(fn, { id: nodeId, kind: 'assign', target: id, source: initExpr, line, succ: [], pred: [] });
+            recordWrite(fn, id, initExpr, nodeId);
+            return;
+          }
+          // Destructuring: `const {a, b: renamed} = obj;` / `const [a, b] = arr;`.
+          // Emit one REAL 'assign' CFG node per bound name — not just a
+          // recordWrite() bookkeeping entry — because the taint engine's
+          // step() 'assign' case reads `node.target` directly and requires
+          // a plain string (`typeof node.target === 'string'`); the single
+          // node this used to emit had target=the whole {kind:'object-
+          // pattern'|'array-pattern', ...} OBJECT, which step() always
+          // treated as `target=null` — so taint from `obj`/`arr` never
+          // reached ANY destructured binding, for every project that uses
+          // this extremely common pattern. fn.writes/recordWrite (used
+          // below too) is bookkeeping nothing in dataflow/ ever reads;
+          // only real CFG nodes matter to the walk.
           if (id && typeof id === 'object' && id.kind === 'object-pattern') {
-            // x = { foo: a, bar: b } — emit one write per property.
             for (const p of id.props) {
               const alias = typeof p.alias === 'string' ? p.alias : null;
               if (!alias) continue;
-              recordWrite(fn, alias, { kind: 'member', object: initExpr, prop: p.key }, nodeId);
+              const memberSrc = { kind: 'member', object: initExpr, prop: p.key };
+              const nodeId = nextNodeId();
+              addNode(fn, { id: nodeId, kind: 'assign', target: alias, source: memberSrc, line, succ: [], pred: [] });
+              recordWrite(fn, alias, memberSrc, nodeId);
             }
+            return;
+          }
+          if (id && typeof id === 'object' && id.kind === 'array-pattern') {
+            id.elements.forEach((el, i) => {
+              const alias = typeof el === 'string' ? el : null;
+              if (!alias) return; // elision (`const [, b] = arr`) or nested pattern — not modeled
+              const memberSrc = { kind: 'member', object: initExpr, prop: String(i) };
+              const nodeId = nextNodeId();
+              addNode(fn, { id: nodeId, kind: 'assign', target: alias, source: memberSrc, line, succ: [], pred: [] });
+              recordWrite(fn, alias, memberSrc, nodeId);
+            });
           }
         },
 
@@ -298,7 +382,29 @@ export function parseJsFile(file, code) {
           const parent = path.parent;
           if (parent && (parent.type === 'VariableDeclarator' || parent.type === 'AssignmentExpression')) return;
           const calleeExpr = exprOf(path.node.callee);
-          const args = (path.node.arguments || []).map(exprOf);
+          // An inline arrow/function-expression argument (`arr.map(x => ...)`)
+          // becomes {kind:'function-value', qid} instead of exprOf's generic
+          // {kind:'unknown'} fallback (exprOf has no case for either node
+          // type) — dataflow/higher-order.js's calleeIsResolvableCallback and
+          // engine.js's higher-order-invocation push site both special-case
+          // 'function-value', but nothing ever produced one for JS/TS, so
+          // higher-order taint flow only ever worked for a by-reference
+          // callback (`arr.map(processItem)`), never the far more common
+          // inline-callback shape. The qid is computed to match EXACTLY what
+          // this same node's own ArrowFunctionExpression/FunctionExpression
+          // visitor (below) will independently compute when Babel's
+          // traversal reaches it: for a function literal passed directly as
+          // a call argument, none of that visitor's naming heuristics
+          // (VariableDeclarator/AssignmentExpression/ObjectProperty parent)
+          // match, so it always resolves to name 'anon' scoped under the
+          // CURRENT function — exactly what's available here.
+          const args = (path.node.arguments || []).map(a => {
+            if (a && (a.type === 'ArrowFunctionExpression' || a.type === 'FunctionExpression')) {
+              const argLine = a.loc?.start?.line || 1; // matches enterFn's own fallback
+              return { kind: 'function-value', qid: fnQid(file, fn.name, 'anon', argLine) };
+            }
+            return exprOf(a);
+          });
           const line = path.node.loc?.start?.line || 0;
           const nodeId = nextNodeId();
           addNode(fn, { id: nodeId, kind: 'call', callee: calleeExpr, args, line, succ: [], pred: [] });
@@ -313,6 +419,7 @@ export function parseJsFile(file, code) {
 
         ReturnStatement(path) {
           const fn = currentFn(); if (!fn) return;
+          maybeResetAtAlternateBoundary(fn, path);
           const expr = path.node.argument ? exprOf(path.node.argument) : null;
           const nodeId = nextNodeId();
           const line = path.node.loc?.start?.line || 0;
@@ -322,12 +429,30 @@ export function parseJsFile(file, code) {
           linkCfg(fn, nodeId, fn.cfg.exit);
         },
 
+        // Fires for every statement node, via Babel's built-in "Statement"
+        // alias — the fallback path for whichever concrete type an if's
+        // `alternate` turns out to be when that type has no specific
+        // handler of its own (BlockStatement, ExpressionStatement,
+        // VariableDeclaration, ...). Types that DO have a specific handler
+        // below (ReturnStatement, IfStatement, the loop statements,
+        // TryStatement) call `maybeResetAtAlternateBoundary` themselves,
+        // since Babel runs a node's type-specific visitor BEFORE its
+        // alias-derived one for the same node — relying on this alone would
+        // miss those cases entirely.
+        Statement: {
+          enter(path) {
+            const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
+          },
+        },
+
         IfStatement: {
           enter(path) {
             // We model branches by inserting a noop "join" after the if; both
             // branches link to it. Without this, the linear cursor model would
             // miss that statements after the if are reachable from either branch.
             const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
             const condNodeId = nextNodeId();
             const joinId = nextNodeId();
             const line = path.node.loc?.start?.line || 0;
@@ -335,7 +460,6 @@ export function parseJsFile(file, code) {
             fn.cfg.nodes.set(joinId, { id: joinId, kind: 'noop', succ: [], pred: [], line });
             path.node._asJoin = joinId;
             path.node._asCond = condNodeId;
-            path.node._asBranchSavedCursor = fn._cursor; // == condNodeId
           },
           exit(path) {
             const fn = currentFn(); if (!fn) return;
@@ -344,9 +468,10 @@ export function parseJsFile(file, code) {
             if (!joinId || !condId) return;
             // The visitor visited the body of the if — Babel's body visit ran
             // *after* the enter(), so fn._cursor now points to the tail of the
-            // consequent. Connect it to the join, then if no else branch
-            // existed, connect the cond directly to the join (representing
-            // the "false" edge).
+            // consequent (or, thanks to maybeResetAtAlternateBoundary, of the
+            // alternate when one exists). Connect it to the join, then if no
+            // else branch existed, connect the cond directly to the join
+            // (representing the "false" edge).
             linkCfg(fn, fn._cursor, joinId);
             if (!path.node.alternate) linkCfg(fn, condId, joinId);
             fn._cursor = joinId;
@@ -359,6 +484,7 @@ export function parseJsFile(file, code) {
         'WhileStatement|ForStatement|DoWhileStatement|ForInStatement|ForOfStatement': {
           enter(path) {
             const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
             const headerId = nextNodeId();
             const exitId = nextNodeId();
             const line = path.node.loc?.start?.line || 0;
@@ -379,11 +505,16 @@ export function parseJsFile(file, code) {
         },
 
         TryStatement: {
-          enter() { /* approximate try/catch as sequential — taint flows through both */ },
+          enter(path) {
+            const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
+            /* approximate try/catch as sequential — taint flows through both */
+          },
         },
 
         ThrowStatement(path) {
           const fn = currentFn(); if (!fn) return;
+          maybeResetAtAlternateBoundary(fn, path);
           const expr = exprOf(path.node.argument);
           const nodeId = nextNodeId();
           const line = path.node.loc?.start?.line || 0;

package/src/ir/parser-php.js

@@ -19,6 +19,7 @@
 
 import * as crypto from 'node:crypto';
 import { callSitesFromCfg } from './call-sites.js';
+import { matchBalancedCall } from './balanced-call.js';
 
 const FUNC_RE = new RegExp(
   '(?:^|[\\n;{}]|<\\?php|<\\?)\\s*' +
@@ -66,6 +67,35 @@ function _splitStatements(body) {
 function _lowerExpr(text) {
   const s = String(text || '').trim();
   if (!s) return { kind: 'unknown' };
+  // Stage 3 correctness audit (detection depth, per-language-IR): PHP
+  // double-quoted strings interpolate variables directly
+  // ("SELECT ... WHERE id=$id", "hi {$user->name}") — single-quoted
+  // strings never do. This must run BEFORE the generic string-literal
+  // fallback just below, which otherwise treated ANY quoted string
+  // (including a double-quoted one containing a live variable) as an
+  // opaque clean literal — silently dropping the interpolated variable's
+  // taint. This is exactly `"SELECT ... WHERE id=$id"`, one of the most
+  // common real PHP SQL-injection shapes. Simple (`$var`, `$var->prop`,
+  // `$var[key]`) and complex (`{$expr}`) interpolation forms are both
+  // lowered into a template, same shape as the `.`-concat branch below.
+  if (/^"/.test(s) && s.includes('$')) {
+    const inner = s.slice(1, -1);
+    const re = /\{(\$[^}]+)\}|(\$[A-Za-z_]\w*(?:->[A-Za-z_]\w*|\[[^\]]+\])?)/g;
+    let lastIndex = 0;
+    const parts = [];
+    let matched = false;
+    let m;
+    while ((m = re.exec(inner)) !== null) {
+      matched = true;
+      if (m.index > lastIndex) parts.push({ kind: 'literal', value: inner.slice(lastIndex, m.index) });
+      parts.push(_lowerExpr(m[1] !== undefined ? m[1] : m[2]));
+      lastIndex = re.lastIndex;
+    }
+    if (matched) {
+      if (lastIndex < inner.length) parts.push({ kind: 'literal', value: inner.slice(lastIndex) });
+      return { kind: 'tpl', parts };
+    }
+  }
   if (/^"/.test(s) || /^'/.test(s)) return { kind: 'literal', value: s };
   if (/^\d/.test(s)) return { kind: 'literal', value: s };
   if (/^(true|false|null|NULL)\b/.test(s)) return { kind: 'literal', value: s };
@@ -81,17 +111,22 @@ function _lowerExpr(text) {
   }
   // Variable
   if (/^\$[A-Za-z_]\w*$/.test(s)) return { kind: 'ident', name: s };
-  // Method call: $obj->method(args) or ClassName::method(args)
-  const methodCall = s.match(/^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)\s*\((.*)\)\s*$/s);
+  // Method call: $obj->method(args) or ClassName::method(args).
+  // matchBalancedCall finds the paren that actually balances the FIRST
+  // '(' — not the greedy-to-end-of-string match the old `/\((.*)\)\s*$/`
+  // used, which corrupted the argument text for a chained call
+  // (`sanitize($x)->trim()` produced args="$x)->trim(", which then fell
+  // through to {kind:'unknown'} and silently dropped $x).
+  const methodCall = matchBalancedCall(s, /^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)/);
   if (methodCall) {
-    const callee = methodCall[1].replace(/->/g, '.').replace(/::/g, '.');
-    const args = _splitTopLevelCommas(methodCall[2]).map(_lowerExpr);
+    const callee = methodCall.callee.replace(/->/g, '.').replace(/::/g, '.');
+    const args = _splitTopLevelCommas(methodCall.argsText).map(_lowerExpr);
     return { kind: 'call', callee, args };
   }
   // Function call: func(args)
-  const funcCall = s.match(/^([A-Za-z_][\w]*)\s*\((.*)\)\s*$/s);
+  const funcCall = matchBalancedCall(s, /^([A-Za-z_][\w]*)/);
   if (funcCall) {
-    return { kind: 'call', callee: funcCall[1], args: _splitTopLevelCommas(funcCall[2]).map(_lowerExpr) };
+    return { kind: 'call', callee: funcCall.callee, args: _splitTopLevelCommas(funcCall.argsText).map(_lowerExpr) };
   }
   // Concat with .
   if (s.includes('.') && /["'\$]/.test(s)) {
@@ -170,10 +205,10 @@ function _lowerStmt(stmt, line) {
     return { kind: 'assign', line, target: assign[1], source: _lowerExpr(assign[2]) };
   }
   // Statement-form call
-  const call = s.match(/^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)\s*\((.*)\)\s*$/s);
+  const call = matchBalancedCall(s, /^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)/);
   if (call) {
-    const callee = call[1].replace(/->/g, '.').replace(/::/g, '.');
-    return { kind: 'call', line, callee, args: _splitTopLevelCommas(call[2]).map(_lowerExpr) };
+    const callee = call.callee.replace(/->/g, '.').replace(/::/g, '.');
+    return { kind: 'call', line, callee, args: _splitTopLevelCommas(call.argsText).map(_lowerExpr) };
   }
   return null;
 }

package/src/ir/parser-rb.js

@@ -21,8 +21,21 @@
 // failure (heredocs, multi-line strings can confuse the regex parser).
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
+import { matchBalancedCall } from './balanced-call.js';
 
-const DEF_RE = /(?:^|\n)\s*def\s+(?:self\.)?(\w+[?!=]?)\s*(?:\(([^)]*)\))?/g;
+// `[ \t]*` before the optional parameter list, NOT `\s*`.
+//
+// `\s*` crosses newlines, so for `def show\n  c = params[:c]` the match ran to
+// the next line's indentation. `parseRubyFile` then computes the body start as
+// `indexOf('\n', m.index + m[0].length)`, which landed on the newline at the END
+// of the first statement — so the body was sliced from after it and statement 1
+// of EVERY Ruby method was silently discarded (a single-statement body became
+// empty). In a Rails controller that first statement is almost always the
+// `params` read, i.e. the taint source, which is why `bench/layer-recall`
+// measured Ruby at 0/20 IR-TAINT recall while all 20 corpus entries passed on
+// the regex layer. A parameter list on the same line still matches.
+const DEF_RE = /(?:^|\n)[ \t]*def\s+(?:self\.)?(\w+[?!=]?)[ \t]*(?:\(([^)]*)\))?/g;
 
 function _extractRubyBody(src, defEnd) {
   let depth = 1;
@@ -110,10 +123,15 @@ function _lowerExpr(text) {
   if (/^(true|false|nil)\b/.test(s)) return { kind: 'literal', value: s };
   // Symbol
   if (/^:\w+/.test(s)) return { kind: 'literal', value: s };
-  // Call: obj.method(args) or method(args)
-  const callMatch = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  // Call: obj.method(args) or method(args). matchBalancedCall finds the
+  // paren that actually balances the FIRST '(' — not the greedy-to-end-of-
+  // string match the old `/\((.*)\)\s*$/` used, which corrupted the
+  // argument text for a chained call (`sanitize(x).strip` produced
+  // args="x).strip", which then fell through to {kind:'unknown'} and
+  // silently dropped x).
+  const callMatch = matchBalancedCall(s, /^([\w.]+)/);
   if (callMatch) {
-    return { kind: 'call', callee: callMatch[1], args: _splitTopLevelCommas(callMatch[2]).map(_lowerExpr) };
+    return { kind: 'call', callee: callMatch.callee, args: _splitTopLevelCommas(callMatch.argsText).map(_lowerExpr) };
   }
   // Method call without parens is very common in Ruby but hard to detect
   // reliably with regex. We handle the explicit-paren form above.
@@ -179,9 +197,9 @@ function _lowerStmt(stmt, line) {
     return { kind: 'assign', line, target: assign[1], source: _lowerExpr(assign[2]) };
   }
   // Statement-form call with parens
-  const call = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  const call = matchBalancedCall(s, /^([\w.]+)/);
   if (call) {
-    return { kind: 'call', line, callee: call[1], args: _splitTopLevelCommas(call[2]).map(_lowerExpr) };
+    return { kind: 'call', line, callee: call.callee, args: _splitTopLevelCommas(call.argsText).map(_lowerExpr) };
   }
   // Statement-form call without parens (common Ruby idiom): redirect_to expr
   const bareCall = s.match(/^([a-z_]\w*)\s+(.+)$/s);
@@ -298,10 +316,22 @@ export function parseRubyFile(file, code) {
     const exit = _addNode(nodes, { kind: 'exit', line: startLine });
     const tail = _buildCfg(extracted.body, nodes, entry, startLine + 1);
     _linkNodes(nodes, tail, exit);
+    const cfg = { entry, exit, nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry, exit, nodes },
+      cfg,
+      // Ruby never emitted `fn.calls` at all (ir/CLAUDE.md documents this
+      // as a known gap) — tabulation.js, dataflow/index.js and
+      // callgraph.js all read it to build call edges, so an absent array
+      // is indistinguishable from "calls nothing," disabling ALL Ruby
+      // interprocedural taint. call-sites.js's callSitesFromCfg is the
+      // same language-agnostic CFG walk parser-py-cst.js already uses for
+      // exactly this; Ruby's node shapes ('call' with callee/args,
+      // 'assign' with source, 'return'/'throw' with value, 'if' with
+      // cond) match its documented contract already, so no new lowering
+      // logic is needed here — only wiring the call.
+      calls: callSitesFromCfg(cfg),
     });
     DEF_RE.lastIndex = extracted.end;
   }

package/src/ir/ssa.js

@@ -43,7 +43,12 @@ export function isSSAEnabled() {
  *
  * Returns Map<nodeId, Set<nodeId>>  — dom[n] = set of nodes that dominate n.
  */
-function computeDominators(cfg) {
+// Exported (Stage 6 correctness audit) so dataflow/implicit-flow.js can
+// reuse this tested algorithm to correctly scope "is node N genuinely
+// inside branch B" (N is inside iff B dominates N — every path to N passes
+// through B) instead of a path-dependent DFS depth counter that had no way
+// to detect a branch's join point.
+export function computeDominators(cfg) {
   const nodes = Object.keys(cfg.nodes || {});
   const entry = cfg.entry;
   const dom = new Map();

package/src/leaderboard.js

@@ -27,6 +27,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { summarizeForBadge } from './badge.js';
 
+import { statePath } from './posture/state-dir.js';
 // Grade thresholds. Critical findings dominate; high/medium contribute
 // secondarily. These numbers are heuristic — calibrate against the
 // public leaderboard corpus once data lands.
@@ -90,7 +91,7 @@ function _deltaTrend(history) {
  */
 export function leaderboardRowFor({ scanRoot, repo, badgeBase = 'https://agentic-security.dev/badge' } = {}) {
   if (!repo) throw new Error('leaderboardRowFor: repo slug is required');
-  const lastScanPath = path.join(scanRoot || '.', '.agentic-security', 'last-scan.json');
+  const lastScanPath = statePath(scanRoot || '.', 'last-scan.json');
   let scan = null;
   try { scan = JSON.parse(fs.readFileSync(lastScanPath, 'utf8')); } catch {}
   const summary = summarizeForBadge(scan);
@@ -98,7 +99,7 @@ export function leaderboardRowFor({ scanRoot, repo, badgeBase = 'https://agentic
   const topCwe = _topCwe(scan);
 
   // Optional scan history for the trend signal.
-  const historyPath = path.join(scanRoot || '.', '.agentic-security', 'scan-history.jsonl');
+  const historyPath = statePath(scanRoot || '.', 'scan-history.jsonl');
   let history = [];
   if (fs.existsSync(historyPath)) {
     try {

package/src/llm-validator/consistency.js

@@ -24,6 +24,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { validateOne } from './index.js';
 
+import { statePath, stateWritesEnabled } from '../posture/state-dir.js';
 // Build a deterministic test finding from the project's last-scan.json,
 // or accept a hand-crafted one. Returns a clone safe to mutate per trial.
 export function makeTrialFinding(template) {
@@ -60,9 +61,12 @@ export async function measureConsistency({
       // If useCache is false, we want each trial to bypass the cache; we
       // simulate by mutating the finding's file in a way the cache key
       // hashes over. Simpler: clear the per-scanRoot cache before each trial.
-      if (!useCache && scanRoot) {
+      // `stateWritesEnabled()` gates the DELETE as well as any write: removing
+      // files from the scanned tree is a mutation like any other, and under a
+      // read-only scan there is no cache to clear anyway. (PRD M1)
+      if (!useCache && scanRoot && stateWritesEnabled()) {
         try {
-          const cacheDir = path.join(scanRoot, '.agentic-security', 'llm-cache');
+          const cacheDir = statePath(scanRoot, 'llm-cache');
           if (fs.existsSync(cacheDir)) {
             for (const e of fs.readdirSync(cacheDir)) fs.unlinkSync(path.join(cacheDir, e));
           }

package/src/llm-validator/index.js

@@ -64,7 +64,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
-import { statePath, ensureStateDir, safeWriteState } from '../posture/state-dir.js';
+import { ensureStateDir, safeWriteState, statePath } from '../posture/state-dir.js';
 import { redactSecrets } from './redact.js';
 import { signLastScan } from '../posture/integrity.js';
 
@@ -84,7 +84,6 @@ const MAX_OUTPUT_TOKENS = 512;
 let _localPresetRefusal = null;
 
 export const PROMPT_VERSION = 'v2.0-hardened';
-const CACHE_DIR = '.agentic-security/llm-cache';
 
 // System preamble — embeds a per-request challenge token the model MUST
 // echo, and a strict instruction-priority frame. {{challenge}} and {{nonce}}

package/src/lsp/server.js

@@ -18,6 +18,8 @@ import * as path from 'node:path';
 import * as readline from 'node:readline';
 import { runScan } from '../runScan.js';
 import { resetCustomRulesBudget } from '../posture/custom-rules.js';
+import { redactFinding } from '../mcp/redact.js';
+import { _remediationOf } from '../report/index.js';
 
 const PROTOCOL_VERSION = '3.17';
 const SERVER_NAME = 'agentic-security-lsp';
@@ -52,6 +54,13 @@ function sevToLsp(sev) {
 
 function findingToDiagnostic(f) {
   const line = Math.max(0, (f.line || 1) - 1);
+  // Stage 6 correctness audit: this read f.remediation directly, but raw
+  // scan.findings entries (what this consumes, pre-normalizeFindings) come
+  // from two conventions — most posture/*.js and newer sast/*.js modules
+  // set `remediation`, while ~127 of engine.js's own detectors set a `fix`
+  // STRING field instead. _remediationOf carries the same precedence
+  // report/index.js already established for this exact split (CMP-3).
+  const remediation = _remediationOf(f);
   return {
     range: {
       start: { line, character: 0 },
@@ -60,7 +69,7 @@ function findingToDiagnostic(f) {
     severity: sevToLsp(f.severity),
     source: 'agentic-security',
     code: f.cwe || f.family || 'finding',
-    message: `${f.vuln || 'Security finding'}${f.remediation ? '\n\n' + (typeof f.remediation === 'string' ? f.remediation : '') : ''}`.slice(0, 2000),
+    message: `${f.vuln || 'Security finding'}${remediation ? '\n\n' + remediation : ''}`.slice(0, 2000),
     tags: [],
   };
 }
@@ -142,7 +151,20 @@ async function scanFile(uri) {
     // and eventually start skipping custom rules.
     resetCustomRulesBudget(_rootDir);
     const { scan } = await runScan(_rootDir, { fileContents, depFileContents });
-    const findings = (scan.findings || []).filter(f => f.file === rel);
+    // Stage 6 correctness audit: this only ever read scan.findings (the SAST
+    // channel). scan.secrets and scan.logicVulns are separate arrays on the
+    // raw runScan() result — normalizeFindings is what merges all four
+    // channels, and that hasn't run here — so a saved file with a hardcoded
+    // credential got a clean problem pane, no diagnostic at all. Unlike the
+    // MCP surface, this server never applied redactFinding either (nothing
+    // here imported mcp/redact.js), which would have been a landmine the
+    // moment secrets/logicVulns were added without it: those channels are
+    // exactly where raw secret material shows up in `snippet`. Both fixed
+    // together — merge the channels AND redact — so the fix for one gap
+    // doesn't open the other.
+    const findings = [...(scan.findings || []), ...(scan.secrets || []), ...(scan.logicVulns || [])]
+      .filter(f => f.file === rel)
+      .map(f => redactFinding(f));
     await publishDiagnostics(uri, findings);
   } catch (e) {
     process.stderr.write(`agentic-security-lsp: scan failed: ${e.message}\n`);
@@ -273,3 +295,7 @@ export function startLspServer() {
 if (import.meta.url === `file://${process.argv[1]}`) {
   startLspServer();
 }
+
+function _setRootDir(dir) { _rootDir = dir; _depCache = { rootDir: null, depFileContents: {} }; }
+
+export const _internals = { findingToDiagnostic, scanFile, uriToPath, pathToUri, _diagnosticsByUri, _setRootDir };

package/src/mcp/CLAUDE.md

@@ -12,14 +12,21 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 | `find_rule_module` | ✓ | reads `scanner/src/{sast,posture}/` to answer "which file detects CWE-X / family Y" |
 | `lookup_cve` | ✓ | reads local OSV / KEV / EPSS cache; staleness-tiered |
 | `synthesize_fix` | ✓ | reads last-scan; returns the patch text |
-| `verify_fix` | ✓ | re-scans patched files in memory + runs lint; no writes |
+| `verify_fix` | ✗ | re-scans patched files in memory, runs lint + the project test suite + the fix-honesty gate + PoC re-check; does not touch the target project's own files, but appends a record to `.agentic-security/fix-metrics.jsonl` per attempt |
 | `apply_fix` | ✗ | writes via `posture/fix-history.js` (with backup) |
 | `append_scratchpad` | ✗ | writes under `.agentic-security/agent-scratchpad/<agent>/<session>/` only |
 | `read_scratchpad` | ✓ | paginated read of scratchpad files |
 | `append_agents_memory` | ✗ | appends to `.agentic-security/AGENTS.md` continual-learning file |
 | `read_agents_memory` | ✓ | tail of `.agentic-security/AGENTS.md` |
+| `synthesize_sca_upgrade` | ✓ | runs an ecosystem dry-run (`npm install --dry-run` etc.); returns the upgrade plan; no writes |
+| `apply_sca_upgrade` | ✗ | backs up manifests, runs the package manager, runs the project test command, restores manifests on test failure |
+| `query_triage_memory` | ✓ | reads past triage decisions (wont-fix/false-positive) by natural-language query |
+| `query_findings_memory` | ✓ | reads accumulated scan memory (findings + triage history + AGENTS.md) by natural-language query |
+| `query_cache_telemetry` | ✓ | reads prompt-cache economics from the current session transcript; no network |
 
-`apply_fix` is the only write tool. It requires `confirm:true` AND the last-scan HMAC to verify AND the target path not on the reserved-write list.
+**17 tools, not 12** — this table previously stopped at 12 and the count quoted elsewhere (root `CLAUDE.md`, the non-Claude plugin manifests) said "Six." Re-derive with `grep -c "name: '" scanner/src/mcp/tools.js` rather than trusting a hardcoded number here again.
+
+**Two write tools, not one.** `apply_fix` and `apply_sca_upgrade` both write; `verify_fix` also writes (see its row above) though not to the target project's own files. `apply_fix` additionally requires `confirm:true` AND the last-scan HMAC to verify AND the target path not on the reserved-write list; `apply_sca_upgrade` requires `confirm:true` and gates on its own test-restore cycle.
 
 ## Hardening posture (OWASP MCP Top 10)
 

package/src/mcp/audit.js

@@ -27,6 +27,7 @@ import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { redactArgsBlob } from './redact.js';
 
+import { stateDir } from '../posture/state-dir.js';
 const MAX_ARG_BYTES = 1024;
 const GENESIS = 'GENESIS';
 const REMOTE_TIMEOUT_MS = 1500;
@@ -87,7 +88,7 @@ export function auditCall({ sessionRoot, tool, args, outcome, reason }) {
     let hasMarker = false;
     for (const m of MARKERS) { try { if (fs.existsSync(path.join(sessionRoot, m))) { hasMarker = true; break; } } catch {} }
     if (!hasMarker) return;
-    const dir = path.join(sessionRoot, '.agentic-security');
+    const dir = stateDir(sessionRoot);
     fs.mkdirSync(dir, { recursive: true });
     const logFile = path.join(dir, 'mcp-audit.log');
     const entry = {