@clear-capabilities/agentic-security-scanner 0.134.0 → 0.136.9

package/src/sast/claude-md-prompt-injection.js

@@ -64,14 +64,25 @@ function _line(raw, idx) {
   return raw.slice(0, idx).split('\n').length;
 }
 
+// Zero-width / invisible Unicode characters: zero-width space, ZWNJ, ZWJ,
+// word joiner, BOM/zero-width no-break space. Interspersing these between
+// every character renders/executes identically to a human or LLM reader
+// (most tokenizers treat them as no-ops) while breaking literal-word regex
+// matching — a documented real-world prompt-injection evasion technique
+// against exactly this kind of pattern-matching defense. None of these are
+// '\n', so removing them never shifts _line()'s line-count computation.
+const _ZERO_WIDTH_RE = /[​‌‍⁠]/g;
+
 export function scanClaudeMdPromptInjection(file, raw) {
   if (!file || !raw || typeof raw !== 'string') return [];
   if (!_INSTRUCTION_FILE_RE.test(file)) return [];
   if (raw.length > 1_000_000) return [];
 
+  const cleaned = raw.replace(_ZERO_WIDTH_RE, '');
+
   // Strip fenced code blocks so example snippets in docs don't trip the
   // detector. Replace with same-length whitespace to preserve line offsets.
-  const stripped = raw.replace(/```[\s\S]*?```/g, (m) => m.replace(/[^\n]/g, ' '));
+  const stripped = cleaned.replace(/```[\s\S]*?```/g, (m) => m.replace(/[^\n]/g, ' '));
 
   const findings = [];
 
@@ -149,12 +160,12 @@ export function scanClaudeMdPromptInjection(file, raw) {
 
   // Hardcoded credentials in CLAUDE.md / AGENTS.md.
   for (const { re, label } of _CRED_RE) {
-    const m = re.exec(raw);
+    const m = re.exec(cleaned);
     if (!m) continue;
     findings.push({
       id: `claude-md:hardcoded-cred:${file}:${m.index}`,
       file,
-      line: _line(raw, m.index),
+      line: _line(cleaned, m.index),
       vuln: `Instruction file contains a hardcoded ${label}`,
       severity: 'critical',
       family: 'harness-config-secrets',

package/src/sast/cloud-iam.js

@@ -90,20 +90,68 @@ function _actionList(a) {
   return Array.isArray(a) ? a : [a];
 }
 
+// Finds every balanced {...} substring in `raw` that parses as valid JSON
+// and itself contains a "Statement" key. Recovers the case _isAwsPolicy
+// already promises to route here: an AWS policy document embedded as a
+// JSON-quoted string inside a non-JSON host file — most commonly a
+// Terraform heredoc (`policy = <<EOF ... EOF`). Does not attempt to parse
+// native-HCL jsonencode({...}) blocks (bare identifiers, no quotes) — that
+// shape doesn't match _isAwsPolicy's own quoted-key detection regex either,
+// so it's already outside this detector's claimed scope.
+function _extractJsonPolicyBlocks(raw) {
+  const blocks = [];
+  for (let i = 0; i < raw.length; i++) {
+    if (raw[i] !== '{') continue;
+    let depth = 0, inStr = false, strCh = '', esc = false, j = i;
+    for (; j < raw.length; j++) {
+      const c = raw[j];
+      if (inStr) {
+        if (esc) esc = false;
+        else if (c === '\\') esc = true;
+        else if (c === strCh) inStr = false;
+        continue;
+      }
+      if (c === '"') { inStr = true; strCh = c; continue; }
+      if (c === '{') depth++;
+      else if (c === '}') { depth--; if (depth === 0) break; }
+    }
+    if (depth !== 0 || j >= raw.length) continue;
+    const candidate = raw.slice(i, j + 1);
+    if (!/"Statement"\s*:/.test(candidate)) continue;
+    try { blocks.push(JSON.parse(candidate)); } catch { /* not valid JSON on its own */ }
+  }
+  return blocks;
+}
+
 function detectAws(file, raw, out, seen) {
-  let parsed;
-  try { parsed = JSON.parse(raw); } catch { return; }
-  const ss = _statements(parsed);
+  let ss;
+  try {
+    ss = _statements(JSON.parse(raw));
+  } catch {
+    // Non-JSON host file (e.g. Terraform HCL) — fall back to locating
+    // embedded JSON policy-document blocks instead of giving up outright.
+    ss = _extractJsonPolicyBlocks(raw).flatMap(_statements);
+    if (!ss.length) return;
+  }
+  // _line() takes a raw-text offset, not a substring — a monotonically
+  // advancing cursor lets successive statements (JSON.parse preserves
+  // source order) each locate their OWN occurrence of a shared marker
+  // like `"Principal"` instead of every statement resolving to the same
+  // (first) occurrence in the file.
+  let _cursor = 0;
   for (const s of ss) {
     if ((s.Effect || 'Allow') !== 'Allow') continue;
     const actions = _actionList(s.Action);
     const isStarAction = actions.includes('*') || actions.some(a => /^[a-z]+:\*$/.test(a));
     const hasCondition = s.Condition && Object.keys(s.Condition).length > 0;
     const principalStar = _principalIsWildcard(s.Principal);
+    let _advanceTo = _cursor;
 
     // aws-public-s3-policy
     if (principalStar && actions.some(a => /^s3:/.test(a))) {
-      const ln = _line(raw, `"Principal"`);
+      const idx = raw.indexOf('"Principal"', _cursor);
+      const ln = _line(raw, idx >= 0 ? idx : _cursor);
+      if (idx >= 0) _advanceTo = Math.max(_advanceTo, idx + 1);
       const id = `aws-public-s3-policy:${file}:${ln}`;
       if (!seen.has(id)) {
         seen.add(id);
@@ -118,7 +166,9 @@ function detectAws(file, raw, out, seen) {
 
     // aws-public-trust-policy (Principal:* on AssumeRole)
     if (principalStar && actions.includes('sts:AssumeRole')) {
-      const ln = _line(raw, 'AssumeRole');
+      const idx = raw.indexOf('AssumeRole', _cursor);
+      const ln = _line(raw, idx >= 0 ? idx : _cursor);
+      if (idx >= 0) _advanceTo = Math.max(_advanceTo, idx + 1);
       const id = `aws-public-trust-policy:${file}:${ln}`;
       if (!seen.has(id)) {
         seen.add(id);
@@ -136,7 +186,9 @@ function detectAws(file, raw, out, seen) {
       if (_HIGH_RISK_AWS_ACTIONS.includes(a) || a === '*') {
         const conditionStr = JSON.stringify(s.Condition || {});
         if (!/MultiFactorAuthPresent|MultiFactorAuthAge/.test(conditionStr)) {
-          const ln = _line(raw, `"${a}"`);
+          const idx = raw.indexOf(`"${a}"`, _cursor);
+          const ln = _line(raw, idx >= 0 ? idx : _cursor);
+          if (idx >= 0) _advanceTo = Math.max(_advanceTo, idx + 1);
           const id = `aws-no-mfa-condition:${file}:${a}:${ln}`;
           if (!seen.has(id)) {
             seen.add(id);
@@ -153,12 +205,13 @@ function detectAws(file, raw, out, seen) {
 
     // (iam:PassRole with Resource:* is detected by posture/iam-policy.js —
     // not duplicated here.)
+    _cursor = _advanceTo;
   }
 
   // aws-overbroad-managed-policy
   if (/"AdministratorAccess"|"PowerUserAccess"/.test(raw) && !/root\b|Bootstrap\b/.test(raw)) {
     const m = /"(AdministratorAccess|PowerUserAccess)"/.exec(raw);
-    const ln = _line(raw, m[0]);
+    const ln = _line(raw, m.index);
     const id = `aws-overbroad-managed-policy:${file}:${ln}`;
     if (!seen.has(id)) {
       seen.add(id);

package/src/sast/code-injection-multilang.js

@@ -64,6 +64,34 @@ function patternsFor(lang) {
         gate: /\b(?:DataTable|DataColumn|DataView)\b/ },
     ];
   }
+  if (lang === 'js') {
+    // Server-side JS code injection. Measured gap, not a speculative one: on the
+    // independent population CWE-94 scored 0/6, and the missed sink in
+    // GHSA-3769-jgqc-cxm7 was `vm.run(\`...${code}...\`)` — the NodeVM / vm2
+    // sandbox family. `eval` and `new Function` were already covered elsewhere
+    // (client-side.js, agent-untrusted-flow.js); a library whose entire purpose
+    // is executing supplied code was not covered anywhere.
+    //
+    // A SANDBOX IS NOT A CONTROL HERE. vm/vm2 are routinely reached for as the
+    // "safe" way to run untrusted code, and both have a long history of escapes.
+    // Running attacker-influenced source inside one is still code injection, so
+    // these fire on a non-literal argument exactly like every other sink in this
+    // module.
+    return [
+      // vm.run / NodeVM#run / VM#run — the vm2 and @n8n/vm2 family.
+      { key: 'vm-run', re: new RegExp(String.raw`\.\s*run\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:NodeVM|VM|vm2|createContext|new\s+VM\b)\b/ },
+      // node:vm's own evaluators. runInNewContext takes the code first.
+      { key: 'vm-run-in-context',
+        re: new RegExp(String.raw`\.\s*(?:runInNewContext|runInThisContext|runInContext)\s*\(\s*${notLiteral}`, 'g') },
+      // new vm.Script(src) compiles before it runs; the injection is here.
+      { key: 'vm-script', re: new RegExp(String.raw`\bnew\s+(?:vm\s*\.\s*)?Script\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:vm|node:vm)\b/ },
+      // Server-side eval / Function, which client-side.js only covers for browsers.
+      { key: 'js-eval', re: new RegExp(String.raw`(?:^|[^.\w])eval\s*\(\s*${notLiteral}`, 'gm') },
+      { key: 'js-new-function', re: new RegExp(String.raw`\bnew\s+Function\s*\(\s*${notLiteral}`, 'g') },
+    ];
+  }
   if (lang === 'go') {
     return [
       // yaegi / gomacro interpreter eval of a non-literal.
@@ -82,6 +110,7 @@ function _lang(fp) {
   if (/\.kt$/i.test(fp)) return 'kt';
   if (/\.cs$/i.test(fp)) return 'cs';
   if (/\.go$/i.test(fp)) return 'go';
+  if (/\.(?:js|jsx|mjs|cjs|ts|tsx)$/i.test(fp)) return 'js';
   return null;
 }
 

package/src/sast/cpp-bench-extras.js

@@ -82,7 +82,7 @@ function familyOf(finding) {
 }
 
 // Return the primary-CWE family for a Juliet C/C++ test path, or null.
-export function julietPrimaryFamily(file) {
+function julietPrimaryFamily(file) {
   const m = JULIET_DIR_RE.exec(String(file).replace(/\\/g, '/'));
   if (!m) return null;
   return CWE_TO_FAMILY[parseInt(m[1], 10)] || null;

package/src/sast/csrf.js

@@ -63,11 +63,13 @@ export function scanCSRF(fp, raw) {
   if (!langSel) return [];
 
   const code = blankComments(raw, (ext === 'py' || ext === 'rb') ? 'py' : undefined);
-  // Project-wide-ish: if the file shows CSRF defence anywhere or only handles
-  // token-authenticated routes, we suppress.
-  const csrfInScope = CSRF_DEFENCE_RE.test(code);
-  const tokenAuthInScope = TOKEN_AUTH_RE.test(code);
-  if (csrfInScope || tokenAuthInScope) return [];
+  // Per-route defence is checked below (±15-line window around each route).
+  // There used to also be a whole-file gate here ("if the file shows CSRF
+  // defence ANYWHERE, suppress every route in it") — by regex-substring
+  // monotonicity that gate always fires whenever the per-route window would
+  // have matched too (the window is a substring of the file), so it made the
+  // per-route check provably unreachable: one protected route silently
+  // suppressed every OTHER route in the same file, however unprotected.
 
   const findings = [];
   const seen = new Set();

package/src/sast/env-hygiene.js

@@ -4,12 +4,15 @@
 // NEXT_PUBLIC_ vars that expose private values, .env.example with real
 // credentials, and hardcoded fallback values that look real.
 //
-// Findings:
+// Findings (4 implemented; ENV_MISSING_GITIGNORE was documented here but has
+// no implementation anywhere in this file — found via Stage-0 doc audit,
+// 2026. Either implement it or drop it from this list; left as a gap, not
+// silently removed, so the missing coverage stays visible):
 //   ENV_NEXT_PUBLIC_SECRET     — NEXT_PUBLIC_ variable whose name implies it's secret
 //   ENV_EXAMPLE_REAL_VALUE     — .env.example / .env.sample with a real-looking value
 //   ENV_HARDCODED_FALLBACK     — process.env.X || "looks-real" fallback in source
-//   ENV_MISSING_GITIGNORE      — .env / .env.local present but not in .gitignore
 //   ENV_DOTENV_IN_SOURCE       — .env file content loaded via require/import in prod code
+//   NOT IMPLEMENTED: ENV_MISSING_GITIGNORE — .env / .env.local present but not in .gitignore
 
 const _ENV_FILE_RE = /^\.env(?:\.(?:local|development|production|test|staging))?$/i;
 const _NONPROD_RE = /(?:^|\/)(?:tests?|__tests__|spec|fixtures?|examples?|node_modules)\//i;

package/src/sast/iac-terraform.js

@@ -42,6 +42,23 @@ function buildResolver(text) {
 
 function lineOf(text, idx) { return text.slice(0, idx).split('\n').length; }
 
+// AWS security-group `cidr_blocks` lives inside either an `ingress { }` or
+// `egress { }` block. Egress-to-anywhere (0.0.0.0/0 outbound) is the
+// standard default for nearly every security group and is not itself a
+// finding; only the same value on an ingress (inbound) rule is an exposure.
+// Finds the nearest enclosing block by walking back to the last occurrence
+// of either keyword before the match position — security-group ingress/
+// egress blocks don't nest another ingress/egress block inside themselves,
+// so the closest preceding one is the enclosing one.
+const _BLOCK_KEYWORD_RE = /\b(ingress|egress)\s*\{/g;
+function _enclosingBlockType(raw, idx) {
+  let last = null;
+  _BLOCK_KEYWORD_RE.lastIndex = 0;
+  let m;
+  while ((m = _BLOCK_KEYWORD_RE.exec(raw)) && m.index < idx) last = m[1];
+  return last;
+}
+
 const CHECKS = [
   {
     id: 'open-ingress', cwe: 'CWE-284', sev: 'high',
@@ -49,6 +66,13 @@ const CHECKS = [
     bad: (val) => /\b0\.0\.0\.0\/0\b|::\/0\b/.test(val),
     vuln: 'Terraform: security-group ingress open to the world (0.0.0.0/0)',
     fix: 'Restrict cidr_blocks to known networks; never default an ingress CIDR to 0.0.0.0/0.',
+    // Only ingress (inbound) exposure is a finding — egress-to-anywhere is
+    // the standard, expected default. A cidr_blocks outside any
+    // ingress/egress block (no enclosing keyword found) is kept: that's
+    // the standalone `aws_security_group_rule` resource shape, which needs
+    // a separate `type = "ingress"` attribute this module doesn't parse —
+    // erring toward reporting rather than silently dropping it.
+    blockGate: (blockType) => blockType !== 'egress',
   },
   {
     id: 'public-bucket', cwe: 'CWE-732', sev: 'high',
@@ -76,6 +100,7 @@ export function scanTerraform(fp, raw) {
     const re = new RegExp(check.attr.source, check.attr.flags);
     let m;
     while ((m = re.exec(raw))) {
+      if (check.blockGate && !check.blockGate(_enclosingBlockType(raw, m.index))) continue;
       const rawVal = m[1];
       // A literal list may hold several entries; resolve each token.
       const tokens = rawVal.replace(/^\[|\]$/g, '').split(',').map(t => t.trim()).filter(Boolean);

package/src/sast/java-bench-extras.js

@@ -671,7 +671,7 @@ const REQUEST_WRAPPER_CLASS_RE = /\b(?:public\s+|private\s+|protected\s+|static\
 
 /** Parse a Java file and return the names of any classes that wrap an
  *  HttpServletRequest and expose String-returning getters. */
-export function findRequestWrapperGetters(file, raw) {
+function findRequestWrapperGetters(file, raw) {
   if (!JAVA_EXT.test(file) || !raw || raw.length > 500_000) return [];
   const content = blankComments(raw);
   const out = [];

package/src/sast/java-constant-fold.js

@@ -68,7 +68,7 @@ function intLocals(raw) {
 // Pattern 1: Constant ternary assigning to bar.
 //   bar = (<expr> [+-*]) num <cmp> <literal> ? "<safe>" : param;
 // where `num` is a local int constant and the comparison folds to a known bool.
-export function hasConstantTernaryBarSafe(raw) {
+function hasConstantTernaryBarSafe(raw) {
   const ints = intLocals(raw);
   // Try a few common shape variants. The first looks for the (lhs ± num) > N pattern.
   // We allow either order — `bar = literal ? ... : ...` style.
@@ -105,7 +105,7 @@ export function hasConstantTernaryBarSafe(raw) {
 }
 
 // Pattern 2: Constant if/else assigning to bar — same idea.
-export function hasConstantIfBarSafe(raw) {
+function hasConstantIfBarSafe(raw) {
   const ints = intLocals(raw);
   // `if ((N op M) op2 num cmp K) bar = "<literal>"; else bar = param;`
   const re = /\bif\s*\(\s*\((-?\d+)\s*([+\-*])\s*(-?\d+)\)\s*([+\-])\s*(\w+)\s*([><=!]=?|==)\s*(-?\d+)\s*\)\s*bar\s*=\s*"[^"]*"\s*;\s*else\s+bar\s*=\s*(\w+)\s*;/g;
@@ -143,7 +143,7 @@ export function hasConstantIfBarSafe(raw) {
 //   map.put("keyB-XXX", param);
 //   bar = map.get("keyB-XXX");
 //   bar = map.get("keyA-XXX");   // overwrites with safe
-export function hasMapDoubleGetSafe(raw) {
+function hasMapDoubleGetSafe(raw) {
   // Use a tolerant regex — we don't need to bind every put to every get.
   // The presence of these three lines in this order suffices.
   const re = /\.\s*put\s*\(\s*("[^"]+")\s*,\s*"[^"]*"\s*\)\s*;[\s\S]{0,400}?\.\s*put\s*\(\s*("[^"]+")\s*,\s*\w+\s*\)[\s\S]{0,500}?\bbar\s*=\s*(?:\(String\)\s*)?\w+\.get\(\s*\2\s*\)[\s\S]{0,200}?\bbar\s*=\s*(?:\(String\)\s*)?\w+\.get\(\s*\1\s*\)/;
@@ -203,7 +203,7 @@ function _simulateListBar(raw) {
   return anyResolved;
 }
 
-export function hasListGetIndex0Safe(raw) {
+function hasListGetIndex0Safe(raw) {
   return _simulateListBar(raw);
 }
 
@@ -217,7 +217,7 @@ export function hasListGetIndex0Safe(raw) {
 //     case 'B': bar = "literal";   break;   // TAKEN
 //     ...
 //   }
-export function hasSwitchCharAtConstantSafe(raw) {
+function hasSwitchCharAtConstantSafe(raw) {
   // 1. Find `String <var> = "<lit>";` then `char <other> = <var>.charAt(<idx>);`.
   const decl = /\bString\s+(\w+)\s*=\s*"([^"]+)"\s*;\s*(?:\/\/[^\n]*\n)?\s*char\s+\w+\s*=\s*\1\s*\.\s*charAt\s*\(\s*(\d+)\s*\)\s*;/g;
   let m;

package/src/sast/llm-owasp.js

@@ -369,7 +369,10 @@ export function scanLLMOwasp(fp, raw) {
     if (!USER_INJECTED_RAG_RE.test(lines[li])) continue;
     // Suppress if there's an obvious auth or provenance check in the surrounding context
     const ctx20 = _windowText(lines, Math.max(0, li - 10), 20);
-    if (/\b(?:require_auth|is_admin|check_permission|verified_source|provenance|signed|hmac)\b/i.test(ctx20)) break;
+    // continue, not break: a guard near THIS match says nothing about a
+    // later, unrelated match elsewhere in the file — stopping the loop here
+    // would hide every subsequent unguarded instance.
+    if (/\b(?:require_auth|is_admin|check_permission|verified_source|provenance|signed|hmac)\b/i.test(ctx20)) continue;
     push({
       id: `llm-owasp:${fp}:${li + 1}:llm03-user-injected-rag`,
       kind: 'sast', severity: 'high',
@@ -379,7 +382,6 @@ export function scanLLMOwasp(fp, raw) {
       fix: 'Authenticate the submitter and validate content before it enters the knowledge base. Tag each chunk with source, owner, and trust_level metadata at ingest time. At retrieval, filter or down-rank chunks from unverified sources. Scan injected content for prompt-injection markers before storing.',
       confidence: 0.88,
     });
-    break;
   }
 
   // --- LLM03: auto-ingested third-party feed that may be compromised ---

package/src/sast/mcp-audit.js

@@ -101,10 +101,17 @@ export function scanMCP(fp, raw) {
 
   const findings = [];
   const seen = new Set();
+  // CMP-1 (Stage 6 follow-up): no call site here ever set `family`, so every
+  // finding fell through to a generic backfilled value — invisible to any
+  // compliance control mapped to `family:agent-tool-exec` (owasp-llm-top-10's
+  // LLM07), and to the family-keyed cost tables in risk-dollars.js/
+  // time-to-fix.js, which both already carry an 'agent-tool-exec' entry with
+  // nothing in the codebase that could ever produce a matching finding.
   const push = (f) => {
     const key = `${f.file}:${f.line}:${f.vuln}`;
     if (seen.has(key)) return;
     seen.add(key);
+    if (!f.family) f.family = 'agent-tool-exec';
     findings.push(f);
   };
 

package/src/sast/pipeline.js

@@ -43,6 +43,13 @@ const PIPELINE_PATTERNS = [
     vuln: 'Pipeline: untrusted github.event input interpolated into shell context',
     sev: 'critical', cwe: 'CWE-78',
     fix: 'Pipe untrusted github.event values through an environment variable instead of interpolating into the shell, e.g. `env: TITLE: ${{ github.event.issue.title }}` then use `"$TITLE"` in the run script.',
+    // Suppress the exact pattern this fix recommends: a pure YAML mapping
+    // entry (`KEY: ${{ github.event.… }}`) assigns the value to an env var
+    // at the workflow-engine level, not into a shell command string — the
+    // shell later reads it as an ordinary env-var reference ("$KEY"), which
+    // is safe. A match embedded inside a larger line (a run: script body)
+    // does not have this shape and is still flagged.
+    lineSafeRe: /^[\w.-]+\s*:\s*\$\{\{[^}]*\}\}\s*$/,
   },
   {
     re: /\bid-token\s*:\s*write\b/g,
@@ -70,6 +77,7 @@ export function scanPipeline(fp, raw) {
     let m;
     while ((m = re.exec(raw))) {
       const line = raw.substring(0, m.index).split('\n').length;
+      if (p.lineSafeRe && p.lineSafeRe.test((lines[line - 1] || '').trim())) continue;
       const id = `pipeline:${fp}:${line}:${p.vuln.replace(/\s/g, '_').slice(0, 48)}`;
       if (seen.has(id)) continue;
       seen.add(id);

package/src/sast/prompt-template.js

@@ -92,11 +92,6 @@ export function scanPromptTemplate(fp, raw) {
   const seen = new Set();
   const push = (f) => { if (!seen.has(f.id)) { seen.add(f.id); findings.push(f); } };
 
-  // Strong negative for code files: a proper role-separated messages array anywhere
-  // in the file means the developer is using the framework correctly. Suppress
-  // inline-string findings in this case (still scan prompt template files).
-  const hasRoleSeparation = isCodeFile && ROLE_SEPARATION_RE.test(raw);
-
   // CASE 1 — Prompt template files: scan the entire file content for
   // user-input interpolations without isolation markers nearby.
   if (isPromptFile) {
@@ -120,7 +115,7 @@ export function scanPromptTemplate(fp, raw) {
 
   // CASE 2 — Inline prompt strings in code files. Scan f-strings (Python) and
   // template literals (JS/TS) for prompt-shape markers + user interpolation.
-  if (isCodeFile && !hasRoleSeparation) {
+  if (isCodeFile) {
     const candidates = [];
     if (/\.py$/i.test(fpNorm)) {
       let m;
@@ -142,6 +137,13 @@ export function scanPromptTemplate(fp, raw) {
       if (!pyInterp && !jsInterp) continue;
       // Suppress if isolation markers are inside the prompt string itself
       if (ISOLATION_MARKER_RE.test(c.text)) continue;
+      // Suppress if THIS candidate is itself the `content:` value inside a
+      // role-separated messages:[{role,content}] object — checked in a
+      // tight preceding window (same object literal), not file-wide, so a
+      // well-formed call elsewhere in the file can't blanket-suppress an
+      // unrelated, unisolated candidate.
+      const roleWindow = raw.substring(Math.max(0, c.start - 120), c.start);
+      if (ROLE_SEPARATION_RE.test(roleWindow) || /\brole\s*[:=]/i.test(roleWindow)) continue;
       const line = raw.substring(0, c.start).split('\n').length;
       push(_emit(fp, line,
         'Prompt Template: user input interpolated into prompt string without isolation',

package/src/sast/prototype-pollution.js

@@ -89,9 +89,13 @@ export function scanPrototypePollution(fp, raw) {
     const r2 = new RegExp(re.source, re.flags);
     let mm;
     while ((mm = r2.exec(code))) {
-      // Only flag write context: look for `=` within 20 chars after.
+      // Only flag write context: an `=` that is a genuine assignment, not
+      // part of a comparison operator (==, ===, !=, !==, <=, >=). The
+      // previous /=\s*[^=]/ check wasn't anchored to the first `=`, so it
+      // matched the trailing `=` of a `===` chain (e.g.
+      // `obj.__proto__ === Object.prototype`) as a false "write."
       const post = code.slice(mm.index, mm.index + 60);
-      if (!/=\s*[^=]/.test(post)) continue;
+      if (!/(?<![=!<>])=(?!=)/.test(post)) continue;
       const line = lineOf(raw, mm.index);
       push({
         id: `prototype-pollution-direct:${fp}:${line}`,

package/src/sast/redos-nfa.js

@@ -273,7 +273,7 @@ export function isUnsafeRegex(body) {
   return detectSuperlinear(parsed.tree);
 }
 
-export function extractJsRegexBodies(code) {
+function extractJsRegexBodies(code) {
   const out = [];
   // Regex literals: /pattern/flags
   for (const m of code.matchAll(/\/([^/\n]+)\/[gimsuy]*/g)) {
@@ -307,7 +307,7 @@ export function extractJavaRegexBodies(code) {
 
 // Go: regexp.MustCompile / Compile / MatchString("…") — Go string literals use
 // "…" (interpreted) or `…` (raw). Both carry the pattern verbatim.
-export function extractGoRegexBodies(code) {
+function extractGoRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/\bregexp\.(?:MustCompile|Compile|CompilePOSIX|MatchString|Match)\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
     out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
@@ -320,7 +320,7 @@ export function extractGoRegexBodies(code) {
 
 // PHP: preg_match / preg_match_all / preg_replace("/…/flags", …) — the regex is
 // a delimited string; strip the delimiter + trailing flags.
-export function extractPhpRegexBodies(code) {
+function extractPhpRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/\bpreg_(?:match|match_all|replace|replace_callback|split)\s*\(\s*(['"])(.+?)\1/g)) {
     let lit = m[2];
@@ -334,7 +334,7 @@ export function extractPhpRegexBodies(code) {
 }
 
 // Ruby: a regex literal /…/ used with =~ / .match / .match? / Regexp.new("…").
-export function extractRubyRegexBodies(code) {
+function extractRubyRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/(?:=~|\.match\??|\.scan|\.gsub|\.sub|grep)\s*\(?\s*\/((?:\\.|[^\/\n])+)\//g)) {
     out.push({ body: m[1], line: code.slice(0, m.index).split('\n').length });
@@ -346,7 +346,7 @@ export function extractRubyRegexBodies(code) {
 }
 
 // C#: new Regex("…") / Regex.IsMatch(s, "…") / Regex.Match / Regex.Replace.
-export function extractCsharpRegexBodies(code) {
+function extractCsharpRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/\bnew\s+Regex\s*\(\s*@?"((?:\\.|""|[^"\n])+)"/g)) {
     out.push({ body: m[1].replace(/""/g, '"'), line: code.slice(0, m.index).split('\n').length });
@@ -358,7 +358,7 @@ export function extractCsharpRegexBodies(code) {
 }
 
 // Kotlin: Regex("…") / "…".toRegex() / Pattern.compile("…").
-export function extractKotlinRegexBodies(code) {
+function extractKotlinRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/\bRegex\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
     out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });

package/src/sast/secret-concat.js

@@ -48,11 +48,22 @@ export function scanSecretConcat(fp, raw) {
     const id = `secret-concat:${fp}:${line}`;
     if (seen.has(id)) continue;
     seen.add(id);
+    // Stage 4 correctness audit (coverage breadth, secrets): same
+    // unredacted-snippet leak found in engine.js's scanEntropySecrets/
+    // scanCredentials — `snippet` carried the raw source line, including
+    // the full reassembled secret's literal pieces, straight through to
+    // every report format this scanner emits. This detector never
+    // computed a masked value at all (the other two secret detectors do).
+    // Mask the exact matched concat-expression text (m[2], the same
+    // substring this detector reassembled `value` from) within the
+    // snippet before reporting it.
+    const masked = value.length > 8 ? value.substring(0, 4) + '…' + value.substring(value.length - 4) : '••••';
+    const rawSnippet = (raw.split('\n')[line - 1] || '').trim().slice(0, 200);
     findings.push({
       id, file: fp, line,
       vuln: 'Hardcoded credential — secret split across concatenated literals to evade detection',
-      severity: 'high', cwe: 'CWE-798', family: 'secret', parser: 'SECRET-CONCAT', confidence: 0.78,
-      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      severity: 'high', cwe: 'CWE-798', family: 'hardcoded-secret', parser: 'SECRET-CONCAT', confidence: 0.78,
+      snippet: rawSnippet.split(m[2]).join(masked), masked,
       remediation: 'Load the secret from the environment or a secrets manager (process.env / os.environ / Vault / AWS Secrets Manager). Splitting the literal across a concatenation does not protect it — rotate the exposed value, it must be considered compromised.',
     });
   }

package/src/sast/ssrf-cloud-metadata.js

@@ -66,15 +66,18 @@ export function scanSSRFCloudMetadata(fp, raw) {
   }
 
   // 2. User-controlled URL into an HTTP client, with no metadata guard nearby.
-  const fileHasMetadataGuard = METADATA_GUARD_RE.test(code);
   const r = new RegExp(SSRF_CLIENT_RE.source, SSRF_CLIENT_RE.flags);
   let m;
   while ((m = r.exec(code))) {
     const line = lineOf(raw, m.index);
-    // Skip if a guard appears in ±10 lines.
+    // Skip if a guard appears in ±10 lines. A file-wide "does this file
+    // contain a guard anywhere" check used to OR into this and blanket-
+    // suppressed every unguarded call site once any one call site was
+    // properly guarded — removed; proximity is what makes a guard actually
+    // apply to a given call.
     const lines = raw.split('\n');
     const window = lines.slice(Math.max(0, line - 11), line + 10).join(' ');
-    if (METADATA_GUARD_RE.test(window) || fileHasMetadataGuard) continue;
+    if (METADATA_GUARD_RE.test(window)) continue;
     push({
       id: `ssrf-meta-usercontrolled:${fp}:${line}`,
       file: fp, line,

package/src/sast/xss-reflected-multilang.js

@@ -91,7 +91,7 @@ export function scanXssReflectedMultilang(fp, raw) {
   for (const v of Object.values(LANGS)) { if (v.ext.test(fp)) { lang = v; break; } }
   if (!lang) return [];
 
-  const code = blankComments(raw, /\.(?:rb|php)$/i.test(fp) ? 'py' : undefined);
+  const code = blankComments(raw, /\.rb$/i.test(fp) ? 'py' : (/\.(?:php|phtml)$/i.test(fp) ? 'php' : undefined));
   const lines = code.split('\n');
   const findings = [];
   const seen = new Set();

package/src/sast/xxe.js

@@ -180,7 +180,7 @@ export function scanXXE(fp, raw) {
   };
 
   if (/\.(?:php|phtml)$/i.test(fp)) {
-    const code = blankComments(raw, 'py');
+    const code = blankComments(raw, 'php');
     _emitOptIn(code, PHP_XXE_RE, null,
       () => 'XXE: XML parsed with LIBXML_NOENT / LIBXML_DTDLOAD (external entities enabled)',
       () => 'Drop the LIBXML_NOENT / LIBXML_DTDLOAD flags — PHP >= 8.0 disables entity substitution by default, so plain loadXML($xml) / simplexml_load_string($xml) is safe. If you must accept DTDs, set libxml_set_external_entity_loader to reject network/file access.');

package/src/sca/CLAUDE.md

@@ -7,7 +7,7 @@ ecosystems and the most common lockfiles in each.
 
 Most of the SCA *pipeline* lives in `../engine.js` (the manifest dispatch
 in `parseManifests`, OSV/KEV/EPSS enrichment, attack-path computation).
-This directory holds the eight specialized modules called from there.
+This directory holds the seven specialized modules called from there.
 
 ## Modules
 
@@ -16,10 +16,9 @@ This directory holds the eight specialized modules called from there.
 | `index.js` | Re-exports six public symbols from `../engine.js` so external consumers can `import { parseManifests, queryOSV, … } from '@…/sca'`. |
 | `binary-metadata.js` | **Opt-in via `AGENTIC_SECURITY_BINARY_SCA=1`.** Reads dependency metadata from compiled artifacts: JAR `META-INF/MANIFEST.MF` + `pom.properties`, Go binary `go.buildinfo`. Never executes the binary. JAR extraction uses `fs.mkdtemp` for an isolated scratch dir (premortem-derived: shared `/tmp` lets a hostile JAR plant a symlinked manifest that escapes the scratch). |
 | `container.js` | Dockerfile parser. Detects EOL `FROM` base images (alpine/debian/ubuntu/node/python) against `base-images.json`, and synthesizes lightweight SCA components from `apt-get install` / `apk add` package lists. No Docker daemon required. |
-| `dep-confusion.js` | Two related detectors. **Typosquat:** Levenshtein distance ≤ 2 against the top-1000 packages in `popular-packages.json`. **Dependency confusion:** internal-scoped names (declared in `.agentic-security/internal-scopes.yml`) appearing on the public registry. Local-first; OSV consulted only to confirm confusion findings. |
+| `dep-confusion.js` | Two related detectors. **Typosquat:** Levenshtein distance ≤ 2 against `popular-packages.json` — **188 packages (115 npm + 73 pypi), not "top-1000"** as this row previously said; re-derive the count from the file rather than trusting a hardcoded number here again. **Dependency confusion:** internal-scoped names (declared in `.agentic-security/internal-scopes.yml`) appearing on the public registry. Local-first; **this module does not itself call OSV** — it reads a flag set by an earlier, separate OSV/queryRegistries pass upstream (whether a dep "resolved by OSV"), which is different from "OSV consulted [by this module] to confirm confusion findings" as previously stated. |
 | `llm-function-extract.js` | **Opt-in via `AGENTIC_SECURITY_LLM_SCA=1`.** LLM-assisted extraction of vulnerable function names for CVEs that lack OSV `ecosystem_specific.vulnerable_functions` data. Cached per CVE under `~/.config/agentic-security/llm-sca-cache/`. Endpoint-dependent — degrades to no-op when unreachable. |
 | `py-package-functions.js` | **Opt-in via `AGENTIC_SECURITY_DEEP=1`** (Python only). Locates installed Python packages via `site-packages` and parses them with the CPython `ast` module (subprocess) to *validate* that an OSV-named vulnerable function exists in the installed version. Closes the "OSV says this function is vulnerable, but the version you installed actually removed it" false-positive class. |
-| `sarif-ingest.js` | Normalizes SARIF 2.1.0 from external scanners and merges into the unified scan. Deduplicates by fingerprint `(CWE, file, line ± 2, rule)`. Twelve tool profiles supported with default-severity + semantic-kind mapping. |
 | `vendor-detect.js` | Detects libraries copied into `src/` (lodash, jQuery, Angular, React, etc.) via characteristic version strings and function signatures. Catches the case where a vulnerable library bypasses the lockfile because someone vendored it directly. |
 
 ## Data sources + caches
@@ -132,7 +131,7 @@ if a detector forgets to set them.
   is updated periodically; an alpine-3.16 today might not appear EOL until
   the file is refreshed. Bias is toward false negatives.
 - **Typosquat threshold is a single distance.** Levenshtein ≤ 2 against
-  the top-1000 list. Increasing the threshold blows up the FP rate;
+  the popular-packages.json list (188 entries, not top-1000). Increasing the threshold blows up the FP rate;
   decreasing it loses real typosquats. This is the calibrated default.
 
 ## Adding a new detector here