@clear-capabilities/agentic-security-scanner 0.134.0 → 0.136.9

package/dist/435.index.js

@@ -124,6 +124,32 @@ const PATTERNS = [
   [/rk_(?:live|test)_[A-Za-z0-9]{20,}/g, 'stripe-restricted-key'],
   [/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g, 'sendgrid-key'],
   [/AIza[0-9A-Za-z_-]{35}/g, 'google-api-key'],
+  // Stage 4 correctness audit (coverage breadth, AI security): this list
+  // only covered a small subset of what the scanner's OWN credential
+  // detector (engine.js's CREDENTIAL_PATTERNS, 40+ provider shapes) finds
+  // — a Shopify/Telegram/Twilio/Discord-webhook/Square/Google-OAuth/JDBC
+  // secret detected and reported by a scan reached explain_finding's
+  // output completely unredacted, because none of those shapes were in
+  // THIS separate, narrower list. Reusing the same regex bodies as
+  // engine.js's CREDENTIAL_PATTERNS for the shapes verified to leak
+  // (rather than importing engine.js itself, which would pull its entire
+  // multi-thousand-line module graph into the MCP server's dependency
+  // surface for a handful of consts).
+  [/ya29\.[0-9A-Za-z_-]{20,}/g, 'google-oauth-token'],
+  [/shp(?:at|ss|ca|pa)_[a-fA-F0-9]{32}/g, 'shopify-token'],
+  [/(?<![0-9])[0-9]{8,10}:AA[0-9A-Za-z_-]{33}(?![A-Za-z0-9_])/g, 'telegram-bot-token'],
+  [/twilio.{0,20}SK[0-9a-fA-F]{32}/gi, 'twilio-api-key'],
+  [/sq0atp-[0-9A-Za-z_-]{22}/g, 'square-access-token'],
+  [/sq0csp-[0-9A-Za-z_-]{43}/g, 'square-oauth-secret'],
+  [/access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}/g, 'paypal-braintree-token'],
+  [/https:\/\/(?:discordapp|discord)\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g, 'discord-webhook'],
+  [/https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]{8}\/B[a-zA-Z0-9_]{8,12}\/[a-zA-Z0-9_]{24}/g, 'slack-webhook'],
+  [/https:\/\/outlook\.office\.com\/webhook\/[A-Za-z0-9\-@]+\/IncomingWebhook\/[A-Za-z0-9-]+\/[A-Za-z0-9-]+/g, 'teams-webhook'],
+  [/https:\/\/(?:www\.)?hooks\.zapier\.com\/hooks\/catch\/[A-Za-z0-9]+\/[A-Za-z0-9]+\//g, 'zapier-webhook'],
+  // JDBC connection string carrying a password: only redact when password
+  // evidence is actually on the line (matches engine.js's own ctx gate),
+  // so a credential-free JDBC URL in docs isn't needlessly mangled.
+  [/jdbc:[a-z:]+:\/\/[A-Za-z0-9.\-_:;=/@?,&]*(?:@|password=|passwd=|pwd=)[A-Za-z0-9.\-_:;=/@?,&]*/gi, 'jdbc-connection-string'],
   // JWT — three dot-separated b64url segments starting with eyJ
   [/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, 'jwt'],
   // PEM-encoded private keys
@@ -171,6 +197,10 @@ function redactArgsBlob(s) {
   return redactString(s);
 }
 
+// EXTERNAL MODULE: ./src/report/index.js + 2 modules
+var report = __webpack_require__(3550);
+// EXTERNAL MODULE: ./src/posture/state-dir.js
+var state_dir = __webpack_require__(1174);
 ;// CONCATENATED MODULE: ./src/posture/agents-memory.js
 // AGENTS.md — writable continual-learning memory (harness-anatomy #2).
 //
@@ -203,6 +233,7 @@ function redactArgsBlob(s) {
 
 
 
+
 const MEMORY_FILE = '.agentic-security/AGENTS.md';
 const ARCHIVE_FILE = '.agentic-security/AGENTS.md.archive';
 const MAX_BYTES = 20 * 1024;
@@ -210,8 +241,8 @@ const MAX_ENTRY_BYTES = 2 * 1024;
 const ARCHIVE_MAX_BYTES = 200 * 1024;
 const HEADER = '# AGENTS.md\n\nAgent-authored continual-learning notes. Each entry: timestamp + agent name + one short paragraph. New entries appended at the bottom; oldest entries rotate to AGENTS.md.archive when this file exceeds 20 KB.\n\n';
 
-function _resolve(scanRoot) { return external_node_path_.join(scanRoot, MEMORY_FILE); }
-function _archivePath(scanRoot) { return external_node_path_.join(scanRoot, ARCHIVE_FILE); }
+function _resolve(scanRoot) { return (0,state_dir/* statePath */.BQ)(scanRoot, 'AGENTS.md'); }
+function _archivePath(scanRoot) { return (0,state_dir/* statePath */.BQ)(scanRoot, 'AGENTS.md.archive'); }
 
 function readAgentsMemory(scanRoot) {
   const fp = _resolve(scanRoot);
@@ -239,7 +270,8 @@ function appendAgentsMemory(scanRoot, { agent, body }) {
   const entry = `\n## ${ts}  agent: ${agent}\n\n${snippet}\n`;
   try {
     const fp = _resolve(scanRoot);
-    external_node_fs_.mkdirSync(external_node_path_.dirname(fp), { recursive: true });
+    if (!(0,state_dir.stateWritesEnabled)()) return;
+  external_node_fs_.mkdirSync(external_node_path_.dirname(fp), { recursive: true });
     if (!external_node_fs_.existsSync(fp)) external_node_fs_.writeFileSync(fp, HEADER);
     external_node_fs_.appendFileSync(fp, entry);
     _maybeRotate(scanRoot);
@@ -466,6 +498,7 @@ const cve_lookup_internals = { CACHE_DIR, CVE_RE, _stalenessTier };
 
 
 
+
 // Lazy-loaded: these transitively pull in npm packages (@babel/core and
 // friends) that aren't available in the plugin-cache install path
 // (no node_modules). Deferring keeps the MCP server bootable everywhere;
@@ -596,12 +629,17 @@ function _validateScratchpadPath(relPath) {
   return { ok: true, agent, session, fileParts };
 }
 
+// Routes through the same lstat+realpath confinement every other write/
+// path-taking tool uses (OWASP MCP05) — a lexical prefix/charset check
+// alone doesn't stop a pre-planted symlink at any path component from
+// relocating the write/read outside the session root. Throws on escape;
+// callers must catch (see append_scratchpad / read_scratchpad).
 function _scratchpadAbs(sessionRoot, relPath) {
-  return external_node_path_.resolve(sessionRoot, relPath.replace(/\\/g, '/'));
+  return _confine(sessionRoot, relPath.replace(/\\/g, '/'), 'scratchpad path');
 }
 
 function _scratchpadTotalBytes(sessionRoot) {
-  const base = external_node_path_.join(sessionRoot, '.agentic-security', 'agent-scratchpad');
+  const base = (0,state_dir/* statePath */.BQ)(sessionRoot, 'agent-scratchpad');
   if (!external_node_fs_.existsSync(base)) return 0;
   let total = 0;
   const walk = (dir) => {
@@ -666,8 +704,8 @@ function _confine(sessionRoot, candidate, label) {
 }
 
 function _readLastScanVerified(sessionRoot, { allowUnsigned = false } = {}) {
-  const stateDir = external_node_path_.join(sessionRoot, '.agentic-security');
-  const scanFile = external_node_path_.join(stateDir, 'last-scan.json');
+  const stateDirPath = (0,state_dir/* stateDir */.Pn)(sessionRoot);
+  const scanFile = external_node_path_.join(stateDirPath, 'last-scan.json');
   const sigFile = scanFile + '.sig';
   if (!external_node_fs_.existsSync(scanFile)) return { scan: null, status: 'missing' };
   const body = external_node_fs_.readFileSync(scanFile, 'utf8');
@@ -781,12 +819,22 @@ const scan_diff = {
     const wantSet = new Set(Object.keys(fileContents));
     const sevRank = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
     const min = sevRank[severity] ?? 0;
-    const findings = (result.scan.findings || [])
+    // Stage 6 correctness audit: this only ever read result.scan.findings
+    // (the SAST channel) — scan.secrets and scan.logicVulns are separate
+    // arrays on the raw runScan() result (report/index.js's normalizeFindings
+    // is what merges all four channels, and that merge hasn't run yet here).
+    // A file containing a bare hardcoded credential reported findingCount: 0
+    // through a tool whose own description promises "Use BEFORE writing a
+    // Write/Edit to disk so the agent can self-correct". Also reused
+    // _remediationOf so a fix-string detector (the majority of engine.js's
+    // own, ~127 call sites) doesn't silently report an empty `description`
+    // the way reading only `.remediation` did.
+    const findings = [...(result.scan.findings || []), ...(result.scan.secrets || []), ...(result.scan.logicVulns || [])]
       .filter(f => wantSet.has(String(f.file || '').replace(/\\/g, '/')) && (sevRank[f.severity] ?? 0) >= min)
       .map(f => redactFinding({
         id: f.id, severity: f.severity, file: f.file, line: f.line,
         title: f.title || f.vuln, cwe: f.cwe,
-        description: f.description, remediation: f.remediation,
+        description: f.description, remediation: (0,report/* _remediationOf */.uV)(f),
       }));
     // Harness-anatomy #1: offload when the result exceeds OFFLOAD_THRESHOLD.
     // The agent gets a head+tail preview plus a path it can page through;
@@ -949,10 +997,40 @@ const apply_fix = {
         additionalProperties: { type: 'string', maxLength: 500_000 },
         minProperties: 1, maxProperties: 8,
       },
+      // Stage 6 correctness audit: same gap and same fix as verify_fix — the
+      // honesty gate is reachable but was never wired to any real caller.
+      // Here it's stronger than advisory: the inline re-verify below already
+      // gates the WRITE on `verdict.ok`, and verifyFixCore's own `ok`
+      // formula already folds in `honesty.ok` when fixMeta is supplied — so
+      // passing it through here makes a dishonest fixMeta (hand-wave
+      // residual, uncited false-positive verdict) block the write itself,
+      // not just report a verdict.
+      fixMeta: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          residual: { type: 'string', maxLength: 2000 },
+          verdict: { type: 'string', maxLength: 64 },
+          evidence: { type: 'array', items: { type: 'string', maxLength: 500 }, maxItems: 20 },
+          signals: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              sinkSignatureChanged: { type: 'boolean' },
+              allCallersRouted: { type: 'boolean' },
+              testDiscriminates: { type: 'boolean' },
+              rateLimitOnly: { type: 'boolean' },
+              docsOnly: { type: 'boolean' },
+              logOnlyNoReject: { type: 'boolean' },
+              partialSanitization: { type: 'boolean' },
+            },
+          },
+        },
+      },
     },
     required: ['finding_id', 'confirm'],
   },
-  async handler({ finding_id, confirm, dry_run = false, patch = null }, ctx) {
+  async handler({ finding_id, confirm, dry_run = false, patch = null, fixMeta = null }, ctx) {
     if (confirm !== true) {
       return { _meta: META, applied: false, reason: 'apply_fix requires confirm: true.' };
     }
@@ -1008,6 +1086,7 @@ const apply_fix = {
             scanRoot: ctx.sessionRoot,
             originalFindingStableId: f.stableId,
             files: _files,
+            fixMeta,
           });
         }
       } catch (e) {
@@ -1017,7 +1096,7 @@ const apply_fix = {
         return {
           _meta: META, applied: false,
           reason: `patch rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
-          verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok } },
+          verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok }, honesty: verdict.honesty || null },
         };
       }
       if (dry_run) {
@@ -1029,7 +1108,7 @@ const apply_fix = {
           const originalContent = external_node_fs_.existsSync(v.abs) ? await promises_.readFile(v.abs, 'utf8') : '';
           const entry = await (0,fix_history/* applyFix */.oM)({
             scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content,
-            findingId: f.id, stableId: f.stableId, ruleId: f.rule || null, vuln: f.vuln || f.title || null,
+            findingId: f.id, stableId: f.stableId, ruleId: f.ruleId || f.cwe || f.family || null, vuln: f.vuln || f.title || null,
           });
           written.push({ file: rel, historyId: entry.id, backupPath: entry.backupPath });
         }
@@ -1087,7 +1166,7 @@ const apply_fix = {
         newContent: f.fix.replacement,
         findingId: f.id,
         stableId: f.stableId || null,   // premortem 4R-8
-        ruleId: f.rule || null,
+        ruleId: f.ruleId || f.cwe || f.family || null,
         vuln: f.vuln || f.title || null,
       });
     } catch (e) {
@@ -1124,7 +1203,7 @@ const apply_fix = {
 // proceed with apply_fix.
 const verify_fix = {
   name: 'verify_fix',
-  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory and runs the project linter. Returns { ok, rescan, lint, summary }. No filesystem writes.',
+  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory, runs the project linter, runs the project test suite, checks fix honesty (FULL/MITIGATION/WORKAROUND) when fixMeta is supplied, and re-runs the PoC when one exists. Returns { ok, rescan, lint, tests, honesty, poc, summary }. Does not write to the target project’s own files, but DOES append one record per attempt to .agentic-security/fix-metrics.jsonl for the measured fix-loop.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -1136,10 +1215,41 @@ const verify_fix = {
         minProperties: 1,
         maxProperties: 8,
       },
+      // Stage 6 correctness audit: posture/fix-honesty-gate.js's deterministic
+      // honesty checks (vague-assurance residual prose, unbacked false-
+      // positive verdicts, tier/residual consistency) were fully built and
+      // fix-verify.js already consulted them when given a `fixMeta` — but
+      // this schema never had a `fixMeta` property, so no call through the
+      // MCP surface could ever supply one. The gate can only run against
+      // claims the AGENT self-reports (residual risk, verdict, evidence,
+      // completeness signals) — nothing here is server-computable — so
+      // fixing this meant exposing the property, not inventing a lookup.
+      fixMeta: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          residual: { type: 'string', maxLength: 2000 },
+          verdict: { type: 'string', maxLength: 64 },
+          evidence: { type: 'array', items: { type: 'string', maxLength: 500 }, maxItems: 20 },
+          signals: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              sinkSignatureChanged: { type: 'boolean' },
+              allCallersRouted: { type: 'boolean' },
+              testDiscriminates: { type: 'boolean' },
+              rateLimitOnly: { type: 'boolean' },
+              docsOnly: { type: 'boolean' },
+              logOnlyNoReject: { type: 'boolean' },
+              partialSanitization: { type: 'boolean' },
+            },
+          },
+        },
+      },
     },
     required: ['stable_id', 'files'],
   },
-  async handler({ stable_id, files }, ctx) {
+  async handler({ stable_id, files, fixMeta }, ctx) {
     // Confine every file path before passing to the verifier.
     const confined = {};
     for (const [relPath, content] of Object.entries(files || {})) {
@@ -1151,17 +1261,48 @@ const verify_fix = {
       confined[relPath] = String(content);
     }
     try {
+      // The PoC-re-check leg (verifyFixCore's `pocLeg`) needs a `poc` param
+      // to do anything — until now nothing supplied one, so it always
+      // reported {status:'not-requested'} through this surface (see
+      // posture/CLAUDE.md's disclosure). Rather than widening inputSchema
+      // to make the CALLER pass PoC data back, look it up server-side: the
+      // scan pipeline already attaches an HTTP-shaped f.poc to matching
+      // findings by default (engine.js's annotatePocs), and last-scan.json
+      // already carries it under the same stableId this handler receives.
+      // Best-effort: a missing/unsigned/tampered scan just means no PoC is
+      // available to re-check, not a verify_fix failure — the rescan/lint/
+      // tests legs below are independent of this and still apply.
+      let poc = null;
+      try {
+        const { scan: lastScan } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: true });
+        const orig = lastScan && (lastScan.findings || []).find(f => f.stableId === stable_id);
+        if (orig && orig.poc && orig.poc.code) poc = { ...orig.poc, finding: orig };
+      } catch { /* best-effort lookup; poc stays null */ }
+
       const verifyFixCore = await getVerifyFixCore();
       const r = await verifyFixCore({
         scanRoot: ctx.sessionRoot,
         originalFindingStableId: stable_id,
         files: confined,
+        poc,
+        fixMeta,
       });
       return {
         _meta: META,
         ok: r.ok,
         rescan: { ok: r.rescan.ok, reason: r.rescan.reason, introduced: r.rescan.introduced || [] },
         lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: redactString(r.lint.output || '').slice(0, 1500) },
+        // verifyFix computes five legs, not two — tests/honesty/poc were
+        // being silently dropped here, leaving an agent with no structured
+        // way to see WHY verification failed when the failure was in one
+        // of those three (only the free-text summary carried it).
+        // test-runner.js's runProjectTests never returns raw stdout/stderr,
+        // so no redaction is needed there; honesty.violations are static,
+        // code-generated strings; poc.reason is redacted defensively since
+        // it can echo proof-harness detail derived from scanned source.
+        tests: r.tests,
+        honesty: r.honesty,
+        poc: r.poc ? { ...r.poc, reason: r.poc.reason ? redactString(r.poc.reason) : r.poc.reason } : r.poc,
         summary: r.summary,
       };
     } catch (e) {
@@ -1245,7 +1386,13 @@ const synthesize_fix = {
       regression_test: f.regression_test || null,
       remediation: typeof fix.description === 'string' ? fix.description : (typeof fix === 'string' ? fix : null),
       patchBounds: { touchedFiles, locDelta, oversized },
-      recommendsFixPlan: oversized && !hasReplacement && !autofix,
+      // oversized can only be true when hasReplacement is true (locDelta is
+      // only computed in that branch, and touchedFiles never varies) — a
+      // `!hasReplacement` conjunct here was a structural contradiction that
+      // made this permanently false. The correct signal: the stored
+      // replacement itself is too big to trust auto-applying, and there's
+      // no safer deterministic alternative.
+      recommendsFixPlan: oversized && !autofix,
     };
   },
 };
@@ -1377,7 +1524,9 @@ const append_scratchpad = {
   async handler({ path: relPath, content }, ctx) {
     const v = _validateScratchpadPath(relPath);
     if (!v.ok) return { _meta: META, ok: false, reason: v.reason };
-    const abs = _scratchpadAbs(ctx.sessionRoot, relPath);
+    let abs;
+    try { abs = _scratchpadAbs(ctx.sessionRoot, relPath); }
+    catch (e) { return { _meta: META, ok: false, reason: `path-escape refused: ${e.message}` }; }
     const total = _scratchpadTotalBytes(ctx.sessionRoot);
     if (total + content.length > SCRATCHPAD_MAX_TOTAL_BYTES) {
       return {
@@ -1423,7 +1572,9 @@ const read_scratchpad = {
   async handler({ path: relPath, offset, limit }, ctx) {
     const v = _validateScratchpadPath(relPath);
     if (!v.ok) return { _meta: META, ok: false, reason: v.reason };
-    const abs = _scratchpadAbs(ctx.sessionRoot, relPath);
+    let abs;
+    try { abs = _scratchpadAbs(ctx.sessionRoot, relPath); }
+    catch (e) { return { _meta: META, ok: false, reason: `path-escape refused: ${e.message}` }; }
     if (!external_node_fs_.existsSync(abs)) return { _meta: META, ok: false, reason: 'not-found' };
     let stat;
     try { stat = external_node_fs_.statSync(abs); } catch (e) { return { _meta: META, ok: false, reason: `stat-failed: ${e.message}` }; }
@@ -1457,6 +1608,7 @@ const read_scratchpad = {
 
 
 
+
 const append_agents_memory = {
   name: 'append_agents_memory',
   description: 'Append a short narrative entry to AGENTS.md — agent-authored continual-learning notes. Use at session end to record "what worked / what didn\'t / what I\'d try differently next time" so the next agent can pick up the lesson. Bounded: 2 KB per entry, 20 KB total before rotation to AGENTS.md.archive. Use sparingly — narrative, not structured data.',
@@ -1518,7 +1670,20 @@ const query_triage_memory = {
   },
   async handler({ query }, ctx) {
     const { queryMemory } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 1905));
-    const results = queryMemory(ctx.sessionRoot, query || '');
+    const raw = queryMemory(ctx.sessionRoot, query || '');
+    // Stage 6 correctness audit: this returned queryMemory's output
+    // verbatim, with no redaction pass — every other tool that echoes
+    // scanned-source-derived text redacts it (mcp/CLAUDE.md's "Adding a new
+    // tool" step 3). Round-trip through redactString the same way
+    // redactFinding already does for its own opaque `.trace` field: results
+    // here mix shapes (a triage decision's free-text `reason`, a finding's
+    // `vuln`/`family`/file path), so scrubbing the whole serialized
+    // structure catches secret-shaped substrings regardless of which field
+    // they landed in, rather than hardcoding a field allowlist that could
+    // miss one.
+    let results;
+    try { results = JSON.parse(redactString(JSON.stringify(raw))); }
+    catch { results = raw; }
     return {
       _meta: META,
       count: results.length,
@@ -1546,7 +1711,16 @@ const query_findings_memory = {
   },
   async handler({ query }, ctx) {
     const { queryFindingsMemory } = await __webpack_require__.e(/* import() */ 839).then(__webpack_require__.bind(__webpack_require__, 3839));
-    return { _meta: META, ...queryFindingsMemory(ctx.sessionRoot, query || '') };
+    const raw = queryFindingsMemory(ctx.sessionRoot, query || '');
+    // Stage 6 correctness audit — same redaction gap and same fix as
+    // query_triage_memory just above: this mixes four differently-shaped
+    // result kinds (finding / triage / history / AGENTS.md text), so a
+    // whole-structure redactString round-trip is applied rather than a
+    // per-field allowlist that could miss one of the four shapes.
+    let body;
+    try { body = JSON.parse(redactString(JSON.stringify(raw))); }
+    catch { body = raw; }
+    return { _meta: META, ...body };
   },
 };
 
@@ -1754,6 +1928,7 @@ function validate(schema, value, path = 'arguments') {
 
 
 
+
 const MAX_ARG_BYTES = 1024;
 const GENESIS = 'GENESIS';
 const REMOTE_TIMEOUT_MS = 1500;
@@ -1814,7 +1989,7 @@ function auditCall({ sessionRoot, tool, args, outcome, reason }) {
     let hasMarker = false;
     for (const m of MARKERS) { try { if (external_node_fs_.existsSync(external_node_path_.join(sessionRoot, m))) { hasMarker = true; break; } } catch {} }
     if (!hasMarker) return;
-    const dir = external_node_path_.join(sessionRoot, '.agentic-security');
+    const dir = (0,state_dir/* stateDir */.Pn)(sessionRoot);
     external_node_fs_.mkdirSync(dir, { recursive: true });
     const logFile = external_node_path_.join(dir, 'mcp-audit.log');
     const entry = {

package/dist/444.index.js

@@ -43,17 +43,26 @@ function scanHistoryDiff(diffText, commit, detectFn) {
   if (!added.trim()) return [];
   let findings = [];
   try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
-  return findings.map((f) => ({
-    ...f,
-    id: `secret-history:${commit}:${f.id || f.vuln || 'secret'}`,
-    file: `git-history@${commit}`,
-    line: 0,
-    commit,
-    _historical: true,
-    vuln: `${f.vuln || 'Hardcoded Secret'} (in git history)`,
-    description: `${f.description || 'A credential was committed.'} Found in commit ${commit}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
-    remediation: 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.',
-  }));
+  return findings.map((f) => {
+    const remediation = 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.';
+    return {
+      ...f,
+      id: `secret-history:${commit}:${f.id || f.vuln || 'secret'}`,
+      file: `git-history@${commit}`,
+      line: 0,
+      commit,
+      _historical: true,
+      vuln: `${f.vuln || 'Hardcoded Secret'} (in git history)`,
+      description: `${f.description || 'A credential was committed.'} Found in commit ${commit}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
+      remediation,
+      // report/index.js's _remediationOf checks `.fix` before `.remediation`
+      // — the underlying detector already set `.fix` to a generic "remove
+      // the line" string, which would otherwise silently shadow this
+      // history-specific instruction ("removing it from HEAD alone is
+      // insufficient") in every report format.
+      fix: remediation,
+    };
+  });
 }
 
 /**

package/dist/449.index.js

@@ -7,10 +7,12 @@ export const modules = {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   buildBaselineMap: () => (/* binding */ buildBaselineMap),
+/* harmony export */   computeMTTR: () => (/* binding */ computeMTTR),
+/* harmony export */   fingerprintFinding: () => (/* binding */ fingerprintFinding),
 /* harmony export */   renderSlaSummary: () => (/* binding */ renderSlaSummary),
 /* harmony export */   stampFindingTimestamps: () => (/* binding */ stampFindingTimestamps)
 /* harmony export */ });
-/* unused harmony exports findingsExceedingSLA, computeMTTR */
+/* unused harmony export findingsExceedingSLA */
 /* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
 // 0.8.0 Feat-11: MTTR / finding-age tracking — per-finding firstSeenAt/lastSeenAt with SLA breach detection.
 //
@@ -24,6 +26,11 @@ export const modules = {
 
 
 // Stable fingerprint for cross-scan finding identity. Mirrors the dedupe key.
+// Exported so a caller can compute the "removed since baseline" (i.e. fixed)
+// set that computeMTTR needs, using the exact same identity function
+// buildBaselineMap uses internally — a caller-side reimplementation would
+// risk drifting from this one and silently under/over-counting fixes.
+function fingerprintFinding(f) { return _fingerprint(f); }
 function _fingerprint(f) {
   const file = (f.file || '').split(' -> ').pop();
   const line = f.line || f.source?.line || f.sink?.line || 0;

package/dist/513.index.js

@@ -12,6 +12,7 @@ export const modules = {
 /* unused harmony exports badgeFromScanRoot, renderSvg, _internal */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
 // Live SVG badge generator (v0.72).
 //
 // Every repo can drop a badge in its README pulling from the latest scan:
@@ -42,6 +43,7 @@ export const modules = {
 
 
 
+
 const COLORS = {
   critical:    '#e05d44',  // red
   high:        '#fe7d37',  // orange
@@ -56,7 +58,7 @@ const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
 
 function _readLastScan(scanRoot) {
   if (!scanRoot) return null;
-  const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, '.agentic-security', 'last-scan.json');
+  const fp = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'last-scan.json');
   if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return null;
   try { return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8')); }
   catch { return null; }
@@ -214,6 +216,7 @@ const _internal = { COLORS, _ageString, _readLastScan };
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
 /* harmony import */ var _badge_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(3117);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(1174);
 // Leaderboard backend (v0.72).
 //
 // Generates the data shape that powers the future public leaderboard at
@@ -243,6 +246,7 @@ const _internal = { COLORS, _ageString, _readLastScan };
 
 
 
+
 // Grade thresholds. Critical findings dominate; high/medium contribute
 // secondarily. These numbers are heuristic — calibrate against the
 // public leaderboard corpus once data lands.
@@ -306,7 +310,7 @@ function _deltaTrend(history) {
  */
 function leaderboardRowFor({ scanRoot, repo, badgeBase = 'https://agentic-security.dev/badge' } = {}) {
   if (!repo) throw new Error('leaderboardRowFor: repo slug is required');
-  const lastScanPath = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot || '.', '.agentic-security', 'last-scan.json');
+  const lastScanPath = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__/* .statePath */ .BQ)(scanRoot || '.', 'last-scan.json');
   let scan = null;
   try { scan = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(lastScanPath, 'utf8')); } catch {}
   const summary = (0,_badge_js__WEBPACK_IMPORTED_MODULE_2__/* .summarizeForBadge */ .iI)(scan);
@@ -314,7 +318,7 @@ function leaderboardRowFor({ scanRoot, repo, badgeBase = 'https://agentic-securi
   const topCwe = _topCwe(scan);
 
   // Optional scan history for the trend signal.
-  const historyPath = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot || '.', '.agentic-security', 'scan-history.jsonl');
+  const historyPath = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__/* .statePath */ .BQ)(scanRoot || '.', 'scan-history.jsonl');
   let history = [];
   if (node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(historyPath)) {
     try {

package/dist/526.index.js

@@ -52,7 +52,6 @@ export const modules = {
 
 
 
-const STATE_DIR = '.agentic-security';
 const LOG_FILE = 'fix-metrics.jsonl';
 
 // Below this many samples a percentile is an artifact of the sample, not a
@@ -65,7 +64,7 @@ const RELIABLE_N = 10;
 const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
 
 function _logPath(scanRoot) {
-  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR, LOG_FILE);
+  return (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, LOG_FILE);
 }
 
 /**
@@ -77,9 +76,10 @@ function _logPath(scanRoot) {
 function recordFixAttempt(scanRoot, record) {
   if (!scanRoot || !record || typeof record !== 'object') return false;
   try {
-    const dir = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR);
+    const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
     if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return false;
+  node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
     // One writeSync of one newline-terminated line: a concurrent reader sees
     // whole records or nothing, and a torn tail is dropped on read.
     node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
@@ -234,8 +234,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 501 modules
-var engine = __webpack_require__(5695);
+// EXTERNAL MODULE: ./src/engine.js + 196 modules
+var engine = __webpack_require__(2739);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //

package/dist/637.index.js

@@ -11,7 +11,7 @@ export const modules = {
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(5695);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2739);
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings

package/dist/675.index.js

@@ -11,6 +11,7 @@ export const modules = {
 /* unused harmony exports readDeps, _queryOsvForDep, loadState, persistState, loadConfig, formatPayload, _internals */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
 // Continuous CVE-watch daemon.
 //
 // Polls OSV for the project's dependency tree on a schedule (or one-shot),
@@ -40,9 +41,9 @@ export const modules = {
 
 
 
+
 const OSV_API = 'https://api.osv.dev/v1/query';
-const CFG_PATH = '.agentic-security/cve-alerts.json';
-const STATE_PATH = '.agentic-security/cve-alerts-state.json';
+
 
 // Multi-ecosystem dep extraction. Each entry: { manifest filename → ecosystem }
 const ECOSYSTEM_BY_MANIFEST = {
@@ -280,7 +281,7 @@ async function _queryOsvForDep({ name, ecosystem }, { fetchImpl = globalThis.fet
 // ─── State persistence ───────────────────────────────────────────────────
 
 function loadState(scanRoot) {
-  const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_PATH);
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'cve-alerts-state.json');
   if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return { known: new Set(), lastRun: null };
   try {
     const j = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'));
@@ -289,7 +290,8 @@ function loadState(scanRoot) {
 }
 
 function persistState(scanRoot, state) {
-  const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_PATH);
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'cve-alerts-state.json');
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return;
   node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(node_path__WEBPACK_IMPORTED_MODULE_1__.dirname(fp), { recursive: true });
   node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(fp, JSON.stringify({
     known: [...state.known].sort(),
@@ -298,7 +300,7 @@ function persistState(scanRoot, state) {
 }
 
 function loadConfig(scanRoot) {
-  const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, CFG_PATH);
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'cve-alerts.json');
   if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return null;
   try { return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8')); } catch { return null; }
 }