@clear-capabilities/agentic-security-scanner 0.136.2 → 0.136.9

package/src/posture/verifier.js

@@ -17,9 +17,11 @@
 //     against a caller-provided target URL (AGENTIC_SECURITY_VERIFY_TARGET).
 //     Without a target, live mode falls back to validate-only with a
 //     `cannot-verify` verdict + reason 'no-target'.
-//   * Sandbox: Docker by default with restrictive flags; subprocess fallback
-//     with ulimit. The sandbox runner is exported so the CLI subcommand can
-//     reuse it.
+//   * Sandbox: live execution runs through src/sandbox/index.js's confined
+//     execution facility (the same one execution-proof.js uses) — never a
+//     bare, unconfined subprocess. When no confinement primitive is
+//     available on the host, live verification refuses rather than falling
+//     back to running the PoC unconfined.
 //
 // Fail-closed semantics (FR-VER-7): any error — Docker missing, target down,
 // PoC throws — produces `cannot-verify`, never `rejected`. An attacker who
@@ -28,7 +30,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { spawnSync } from 'node:child_process';
+import { runConfined, sandboxAvailable } from '../sandbox/index.js';
 import { isExplicitlyNoPoc } from './poc-cwe-map.js';
 
 // ─── PoC static validation ──────────────────────────────────────────────────
@@ -122,18 +124,36 @@ export function proveSanitizerAbsence(finding, fileContents) {
 function runSandboxed(poc, opts = {}) {
   const target = opts.target;
   if (!target) return { ok: false, reason: 'no-target' };
-  // Materialise the PoC to a temp file.
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'as-poc-'));
-  const file = path.join(dir, poc.lang === 'python' ? 'poc.py' : 'poc.mjs');
+  if (!sandboxAvailable() && !opts.force) {
+    return { ok: false, reason: 'no confinement primitive available on this host; refusing to execute the PoC unconfined', runner: 'disabled' };
+  }
+  // Materialise the PoC into a fresh sandbox root.
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'as-poc-')));
+  const file = poc.lang === 'python' ? 'poc.py' : 'poc.mjs';
   try {
-    fs.writeFileSync(file, _patchTarget(poc.code, target));
+    fs.writeFileSync(path.join(dir, file), _patchTarget(poc.code, target));
   } catch (e) {
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
     return { ok: false, reason: `write-failed:${e.message}` };
   }
-  const docker = _haveDocker() ? _runDocker(file, dir, poc.lang, opts) : null;
-  const result = docker || _runSubprocess(file, poc.lang, opts);
-  try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
-  return result;
+  try {
+    const argv = poc.lang === 'python' ? ['python3', file] : [process.execPath, file];
+    // allowNetwork: the whole point of live verification is reaching the
+    // caller-provided target — writes and everything else stay confined.
+    const r = runConfined(argv, { root: dir, timeoutMs: opts.timeoutMs || 15000, allowNetwork: true, force: opts.force });
+    if (r.status === 'disabled') {
+      return { ok: false, reason: 'confined execution is disabled; the PoC was refused and never executed', runner: r.backend };
+    }
+    if (r.status === 'error') {
+      return { ok: false, reason: `sandbox-error:${(r.stderr || '').trim() || 'unknown'}`, runner: r.backend };
+    }
+    if (r.timedOut) {
+      return { ok: false, reason: 'poc-timeout', runner: r.backend };
+    }
+    return { ok: true, exitCode: r.exitCode, stderr: r.stderr || '', stdout: r.stdout || '', runner: r.backend, denied: r.denied };
+  } finally {
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
+  }
 }
 
 function _patchTarget(code, target) {
@@ -141,51 +161,6 @@ function _patchTarget(code, target) {
   return code.replace(/http:\/\/localhost:3000/g, target);
 }
 
-function _haveDocker() {
-  try {
-    const r = spawnSync('docker', ['version'], { stdio: 'ignore', timeout: 3000 });
-    return r.status === 0;
-  } catch { return false; }
-}
-
-function _runDocker(file, dir, lang, opts) {
-  const image = lang === 'python' ? 'python:3.12-slim' : 'node:22-slim';
-  const cmd = lang === 'python' ? ['python3', '/work/poc.py'] : ['node', '/work/poc.mjs'];
-  const args = [
-    'run', '--rm',
-    '--network=host',          // PoC must reach the target; host is the smallest blast radius
-    '--cap-drop=ALL',
-    '--memory=256m',
-    '--cpu-quota=20000',
-    '--pids-limit=64',
-    '--read-only',
-    '--tmpfs=/tmp',
-    '--user', 'nobody',
-    '-v', `${dir}:/work:ro`,
-    image,
-    ...cmd,
-  ];
-  const r = spawnSync('docker', args, {
-    timeout: opts.timeoutMs || 15000,
-    encoding: 'utf8',
-  });
-  if (r.error) return { ok: false, reason: `docker-error:${r.error.code || r.error.message}`, runner: 'docker' };
-  return { ok: true, exitCode: r.status, stderr: r.stderr || '', stdout: r.stdout || '', runner: 'docker' };
-}
-
-function _runSubprocess(file, lang, opts) {
-  const bin = lang === 'python' ? 'python3' : 'node';
-  const r = spawnSync(bin, [file], {
-    timeout: opts.timeoutMs || 15000,
-    encoding: 'utf8',
-    // Best-effort containment without Docker. Operators are warned in stderr
-    // that the subprocess fallback offers materially weaker isolation.
-    env: { PATH: process.env.PATH || '', NODE_OPTIONS: '' },
-  });
-  if (r.error) return { ok: false, reason: `subprocess-error:${r.error.code || r.error.message}`, runner: 'subprocess' };
-  return { ok: true, exitCode: r.status, stderr: r.stderr || '', stdout: r.stdout || '', runner: 'subprocess' };
-}
-
 // ─── Per-finding verdict assignment ─────────────────────────────────────────
 
 export function verdictForFinding(finding, ctx = {}) {

package/src/report/index.js

@@ -24,7 +24,12 @@ function riskNote(f) {
   const et = String(f.exploitabilityTier || '').toLowerCase();
   if (et === 'minimal' || et === 'low') return `likely lower risk — ${et} exploitability`;
   const ct = String(f.confidenceTier || '').toLowerCase();
-  if (ct === 'low' || (typeof f.confidence === 'number' && f.confidence > 0 && f.confidence < 0.5)) {
+  // `f.confidence` is clamped to [0,1] by posture/confidence.js and 0 is a
+  // real, reachable value (unset confidence normalizes to `null`, not 0) —
+  // the single worst score this note exists to catch. A `> 0` lower bound
+  // exempted exactly that value from the downgrade note a 0.05 finding
+  // correctly got.
+  if (ct === 'low' || (typeof f.confidence === 'number' && f.confidence < 0.5)) {
     return 'lower confidence — verify before prioritising';
   }
   return null;
@@ -83,6 +88,25 @@ function fingerprint(f){
   return crypto.createHash('sha256').update(s).digest('hex').slice(0, 16);
 }
 
+// CMP-3: the findings schema requires `remediation` (root CLAUDE.md), and
+// most detectors set it, but normalizeFindings only ever read the older
+// `fix` STRING field that a minority of detectors use — so for every
+// detector using the documented schema field, the SARIF fixes[]/
+// fullDescription, the Markdown Fix column, and the CLI inline "fix:" line
+// all rendered empty. `fix` still wins when both are set, matching the
+// existing precedence in explainParts() above.
+// Exported (Stage 6) so other raw-finding consumers outside this module —
+// mcp/tools.js's scan_diff, lsp/server.js — that read scan.findings BEFORE
+// normalizeFindings ever touches it can apply the same fix-string-vs-
+// remediation-field precedence instead of re-implementing it ad hoc (and
+// getting it wrong the way both of those did — reading only `.remediation`,
+// which ~127 of engine.js's own detectors never set).
+export function _remediationOf(f) {
+  if (f && typeof f.fix === 'string') return f.fix;
+  if (typeof f?.remediation === 'string') return f.remediation;
+  return null;
+}
+
 export function normalizeFindings(scan){
   const out = [];
   // Feat-4: filter findings via custom suppressions, recording the suppression
@@ -109,11 +133,13 @@ export function normalizeFindings(scan){
       file: f.file,
       line: f.line || f.source?.line || f.sink?.line || 0,
       snippet: f.snippet || f.source?.snippet || f.sink?.snippet || '',
-      fix: f.fix ? { description: f.fix, code: f.code || '' } : null,
+      fix: _remediationOf(f) ? { description: _remediationOf(f), code: f.code || '' } : null,
+      remediation: _remediationOf(f),
       reachable: f.reachable ?? null,
       triage: f.triageScore ?? null,
       dataClasses: f.dataClasses || [],
       chain: Array.isArray(f.chain) ? f.chain : null,
+      sourceProvenance: f.sourceProvenance || null,
       confidence: typeof f.confidence === 'number' ? f.confidence : null,
       // R17: corroboration ("one issue, many signals") — count of independent
       // analyses that agreed, and which ones.
@@ -237,6 +263,65 @@ export function normalizeFindings(scan){
       predictedBountyUsd: f.predictedBountyUsd || null,
       bountyConfidence: f.bountyConfidence || null,
       attackPlaybook: f.attackPlaybook || null,
+      // posture/git-history.js#annotateGitHistory — git blame + commit
+      // context, including AI-authorship detection via the Claude
+      // co-author trailer. Wired in engine.js but previously dropped here.
+      introducedBy: f.introducedBy || null,
+      introducedIn: f.introducedIn || null,
+      introducedAt: f.introducedAt || null,
+      introducedInMessage: f.introducedInMessage || null,
+      originatingPrompt: f.originatingPrompt || null,
+      aiAuthored: f.aiAuthored === true,
+      // posture/risk-dollars.js#annotateRiskDollars,
+      // posture/time-to-fix.js#annotateTimeToFix — same class of gap.
+      riskDollars: f.riskDollars || null,
+      estimatedFixHours: typeof f.estimatedFixHours === 'number' ? f.estimatedFixHours : null,
+      estimatedFixHoursSource: f.estimatedFixHoursSource || null,
+      // posture/composite-risk.js#annotateCompositeRisk — the module's own
+      // header calls this "the canonical sort key" for agents/UI; toProTable
+      // silently fell back to the older `triage` field because this was
+      // never in the allowlist.
+      compositeRisk: typeof f.compositeRisk === 'number' ? f.compositeRisk : null,
+      compositeRiskTier: f.compositeRiskTier || null,
+      compositeRiskFactors: Array.isArray(f.compositeRiskFactors) ? f.compositeRiskFactors : null,
+      // posture/relevance.js#annotateRelevance — entrypoint-reachability
+      // verdict + audit trail. The re-ranked `exploitability` it also sets
+      // did survive normalization; the verdict fields explaining WHY did not.
+      entrypointReachable: f.entrypointReachable ?? null,
+      relevance: typeof f.relevance === 'number' ? f.relevance : null,
+      relevanceTier: f.relevanceTier || null,
+      relevanceFactors: Array.isArray(f.relevanceFactors) ? f.relevanceFactors : null,
+      // posture/attack-taxonomy.js#annotateAttackTaxonomy — default-on;
+      // toProTable's `capec`/`mitre` columns read these and rendered `—`
+      // for every finding because they were never in this allowlist.
+      attck: f.attck || null,
+      attckName: f.attckName || null,
+      attckTactic: f.attckTactic || null,
+      atlas: f.atlas || null,
+      atlasName: f.atlasName || null,
+      d3fend: f.d3fend || null,
+      capec: f.capec || null,
+      // posture/falsification.js#annotateFalsification, which records its
+      // verdict via posture/verification-separation.js — recall-preserving
+      // (never removes a finding, never touches severity), but the verdict
+      // itself needs to survive to output or a quarantined finding ships
+      // indistinguishable from one nobody contested.
+      falsification: f.falsification || null,
+      quarantined: f.quarantined === true,
+      // The canonical schema (scanner/CLAUDE.md) documents `description` as
+      // a required field distinct from `vuln` (headline) and `remediation`
+      // (fix instructions) — ~47 SAST detectors set finding-specific "why
+      // this fired" prose here. It was never in this allowlist, so it was
+      // silently dropped between the detector and every report format.
+      description: f.description || null,
+      // posture/threat-model-grounding.js#applyThreatModel — crown-jewel /
+      // out-of-scope / compliance-regime / attacker-model tags. The severity
+      // bump/demotion it also performs mutates `severity` directly (so that
+      // half already survived normalization); this object itself did not.
+      threatModel: f.threatModel || null,
+      verification: f.verification || null,
+      // posture/pattern-propagation.js#annotateCrossRepoSignals — default-on.
+      crossRepoSignal: f.crossRepoSignal || null,
     });
   }
   for (const s of (scan.secrets||[])) {
@@ -250,11 +335,19 @@ export function normalizeFindings(scan){
       stride: s.stride || 'Information Disclosure',
       file: s.file, line: s.line, snippet: s.snippet || '',
       masked: s.masked || null,
-      fix: s.fix ? { description: s.fix, code: s.code || '' } : null,
+      fix: _remediationOf(s) ? { description: _remediationOf(s), code: s.code || '' } : null,
+      remediation: _remediationOf(s),
       blastRadius: s.blastRadius || null,
       // Premortem #8: parser/family for downstream confidence + calibration.
       parser: s.parser || 'SECRETS',
       family: s.family || 'hardcoded-secret',
+      // secret-history.js sets these on a git-history-sweep finding (the
+      // commit it was found in, and a flag distinguishing it from a
+      // working-tree finding) — carried through so a consumer doesn't have
+      // to parse the commit sha back out of the synthetic `file` value.
+      commit: s.commit || null,
+      historical: s._historical === true,
+      description: s.description || null,
     });
   }
   for (const lv of (scan.logicVulns||[])) {
@@ -267,11 +360,21 @@ export function normalizeFindings(scan){
       cwe: lv.cwe || null,
       stride: lv.stride || null,
       file: lv.file, line: lv.line, snippet: lv.snippet || '',
-      fix: lv.fix ? { description: lv.fix, code: lv.code || '' } : null,
+      fix: _remediationOf(lv) ? { description: _remediationOf(lv), code: lv.code || '' } : null,
+      remediation: _remediationOf(lv),
       blastRadius: lv.blastRadius || null,
       // Premortem #8.
       parser: lv.parser || 'LOGIC',
       family: lv.family || null,
+      // evaluateLicensePolicy (kind:'license') sets these so a consumer can
+      // identify WHICH component/license triggered the finding without
+      // regex-parsing the prose `vuln` string. Harmless no-op (all null)
+      // for every other logicVulns kind that doesn't set them.
+      package: lv.package || null,
+      version: lv.version || null,
+      ecosystem: lv.ecosystem || null,
+      license: lv.license || null,
+      description: lv.description || null,
     });
   }
   for (const sc of (scan.supplyChain||[])) {
@@ -281,6 +384,12 @@ export function normalizeFindings(scan){
     out.push({
       id: fingerprint(sc),
       kind: 'sca',
+      // sc.type discriminates vulnerable_dep | unpinned_dep | no_lockfile
+      // (src/sca/CLAUDE.md). Every MCP SCA-upgrade tool checks this field
+      // on findings looked up from the PERSISTED (toJSON-serialized) scan —
+      // dropping it here made synthesize_sca_upgrade/apply_sca_upgrade
+      // refuse every real SCA finding unconditionally.
+      type: sc.type || 'vulnerable_dep',
       severity: sc.severity || 'high',
       vuln: scVuln,
       cwe: sc.cwe || null,
@@ -421,6 +530,22 @@ export function toJSON(scan, meta={}, opts={}){
     // signature proves who asked for it, not that the results are absent.
     suppressedRules: scan.suppressedRules || null,
     _scanMeta: scan._scanMeta || null,
+    // S7: engine.js computes these on every scan with components, and their
+    // own findings already flow into `findings` above — but the structured
+    // summary objects (per-component license map, drift counts, "first
+    // scan, no baseline yet") were previously dropped here, so they never
+    // reached last-scan.json (written from this function's return value)
+    // or any --format output at all.
+    licenseGraph: scan.licenseGraph || null,
+    sbomDiff: scan.sbomDiff || null,
+    entrypointInventory: scan.entrypointInventory || null,
+    // S7: same class of gap as the three above — computed on every scan
+    // (rootCauseSweep unconditionally; attackTaxonomy/privacyFramework each
+    // default-on unless their own AGENTIC_SECURITY_NO_*/opt-in env var says
+    // otherwise) but never reached last-scan.json or any --format output.
+    rootCauseSweep: scan.rootCauseSweep || null,
+    attackTaxonomy: scan.attackTaxonomy || null,
+    privacyFramework: scan.privacyFramework || null,
   };
   if (opts.includeSuppressed) out.suppressed = scan.suppressions||[];
   return out;
@@ -462,7 +587,10 @@ export function toSTIX(scan, meta = {}) {
       created: now,
       modified: now,
       name: `${f.vuln || 'Security finding'} at ${f.file || '?'}:${f.line || '?'}`,
-      description: f.fix?.description || f.vuln || '',
+      // Same precedence fix as toSARIF's fullDescription/message: the
+      // detector's own description of the finding beats remediation text,
+      // which beats degrading to the bare vuln title.
+      description: f.description || f.fix?.description || f.vuln || '',
       external_references: cweExt,
       labels: [f.severity || 'unknown'],
       // x_* extension fields — STIX 2.1 allows custom properties prefixed
@@ -615,7 +743,14 @@ export function toSARIF(scan, meta={}){
     id: f.vuln.replace(/[^a-zA-Z0-9]/g, '_'),
     name: f.vuln,
     shortDescription: { text: f.vuln },
-    fullDescription: { text: f.fix?.description || f.vuln },
+    // Prefer the detector's own explanation of the finding (`description`)
+    // over remediation text — `fix?.description` is fix instructions, not
+    // an account of the vulnerability. Falling back to remediation (rather
+    // than degrading to the bare rule title, already shown in
+    // shortDescription/name) when no description was set is intentional —
+    // see CMP-3's test asserting a remediation-only finding still gets a
+    // non-degenerate fullDescription.
+    fullDescription: { text: f.description || f.fix?.description || f.vuln },
     helpUri: f.cwe ? `https://cwe.mitre.org/data/definitions/${f.cwe.replace(/[^0-9]/g,'')}.html` : undefined,
     properties: { tags: [f.cwe, f.stride].filter(Boolean) },
   });
@@ -680,7 +815,7 @@ export function toSARIF(scan, meta={}){
         return {
         ruleId: f.vuln ? f.vuln.replace(/[^a-zA-Z0-9]/g, '_') : 'unknown',
         level: SEV_TO_SARIF[f.severity] || 'warning',
-        message: { text: f.fix?.description || f.vuln || 'Security finding' },
+        message: { text: f.description || f.fix?.description || f.vuln || 'Security finding' },
         locations: [{ physicalLocation: { artifactLocation: { uri: f.file }, region: { startLine: Math.max(1, f.line||1) } } }],
         ...(codeFlows ? { codeFlows } : {}),
         ...(fixes ? { fixes } : {}),
@@ -792,7 +927,12 @@ export function toHTML(scan, meta = {}) {
   for (const f of findings) byFile[f.file] = (byFile[f.file] || 0) + 1;
   const hotspots = Object.entries(byFile).sort((a,b)=>b[1]-a[1]).slice(0, 10);
   const data = JSON.stringify(findings).replace(/</g, '\\u003c');
-  const generatedAt = new Date().toISOString();
+  // Every other emitter falls back to meta.startedAt (which
+  // posture/deterministic.js forces to a fixed value under --deterministic)
+  // before minting a fresh timestamp — toHTML never consulted it, so it was
+  // the one format that stayed non-deterministic run-to-run even under
+  // --deterministic.
+  const generatedAt = meta.startedAt || new Date().toISOString();
   const SEV_HEX = { critical: '#ff2d55', high: '#ff6b35', medium: '#ffb800', low: '#34d058', info: '#82aaff' };
   const sevBars = Object.entries(counts).map(([k, v]) =>
     `<div class="sev-row"><span class="sev-tag" style="background:${SEV_HEX[k]}22;color:${SEV_HEX[k]}">${k}</span><span class="sev-bar" style="width:${Math.min(100, v * 4)}%;background:${SEV_HEX[k]}"></span><span class="sev-num">${v}</span></div>`
@@ -1098,8 +1238,29 @@ export function toShipVerdict(scan, options = {}) {
   const profile = options.profile || { confidenceMin: CONF_DEFAULT_VIB, showTaxonomy: false };
   const color = options.color !== false;
   const c = (s, code) => color ? `${code}${s}${RESET}` : s;
-  const findings = _withConfidence(normalizeFindings(scan), profile.confidenceMin ?? CONF_DEFAULT_VIB);
-  const actionable = findings.filter(f => /critical|high/.test(f.severity));
+  // CMP-4 (Stage-0 audit, 2026): the safety headline (Safe/Not-safe-to-deploy)
+  // and the critical/high counts that drive it MUST come from the FULL
+  // finding set, matching exitCodeFor — confidence filtering must never be
+  // able to make a real critical/high invisible to the verdict. Before this
+  // fix, `findings` was confidence-filtered BEFORE the severity split, so a
+  // critical at confidence 0.85 (below the 0.9 vibecoder floor) made the
+  // verdict print "Safe to deploy" while exitCodeFor — reading the same scan
+  // unfiltered — returned 3. Same scan, contradictory answers depending on
+  // which one you read.
+  //
+  // Confidence filtering KEEPS its legitimate purpose for low/medium/info
+  // findings — those never gate the safety verdict, so hiding noisy
+  // low-signal ones from a non-expert reader is a reasonable UX choice, not a
+  // security decision. What changes is that low/medium/info findings hidden
+  // this way are now DISCLOSED by count rather than silently vanishing,
+  // matching the project's no-silent-truncation convention.
+  const allFindings = normalizeFindings(scan);
+  const min = profile.confidenceMin ?? CONF_DEFAULT_VIB;
+  const criticalOrHighAll = allFindings.filter(f => /critical|high/.test(f.severity));
+  const restFiltered = _withConfidence(allFindings.filter(f => !/critical|high/.test(f.severity)), min);
+  const findings = [...criticalOrHighAll, ...restFiltered];
+  const filteredOutCount = allFindings.length - findings.length;
+  const actionable = criticalOrHighAll;
   const advisoryCount = findings.length - actionable.length;
   const sev = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
   for (const f of findings) sev[f.severity] = (sev[f.severity] || 0) + 1;
@@ -1164,6 +1325,12 @@ export function toShipVerdict(scan, options = {}) {
   } else if (advisoryCount > 0) {
     lines.push(c(`  ${advisoryCount} advisory item${advisoryCount === 1 ? '' : 's'} — run /security-scan-all --firehose to see them.`, DIM));
   }
+  // No-silent-truncation: a low/medium/info finding hidden by the confidence
+  // floor must be disclosed by count. Critical/high are never in this count —
+  // see filteredOutCount's computation above.
+  if (filteredOutCount > 0) {
+    lines.push(c(`  ${filteredOutCount} more below your confidence threshold — run /security-scan-all --firehose to see them.`, DIM));
+  }
   // Discoverability: the depth (per-finding explanation) and the shareable report
   // exist but aren't obvious from the one-screen verdict — point to them.
   if (findings.length > 0) {
@@ -1201,10 +1368,12 @@ export function toProTable(scan, options = {}) {
   const columns = options.columns || 'standard'; // 'standard' | 'mitre' | 'capec' | 'owasp'
   const findings = _withConfidence(normalizeFindings(scan), profile.confidenceMin ?? CONF_DEFAULT_PRO);
 
-  // Rank by triage score (or severity rank if absent).
+  // Rank by compositeRisk (the canonical priority key, per composite-risk.js's
+  // own header) when present, falling back to the older triage score, then
+  // severity rank.
   findings.sort((a, b) => {
-    const ea = a.triage ?? (1 - (SEV_RANK[a.severity] || 0) / 4);
-    const eb = b.triage ?? (1 - (SEV_RANK[b.severity] || 0) / 4);
+    const ea = a.compositeRisk ?? (a.triage != null ? a.triage * 100 : (1 - (SEV_RANK[a.severity] || 0) / 4) * 100);
+    const eb = b.compositeRisk ?? (b.triage != null ? b.triage * 100 : (1 - (SEV_RANK[b.severity] || 0) / 4) * 100);
     return eb - ea;
   });
 
@@ -1229,7 +1398,7 @@ export function toProTable(scan, options = {}) {
     const cwe = (f.cwe || '—').padEnd(10);
     const cvss = (f.cvss || f.cvssV3?.score || '—').toString().padEnd(5);
     const owasp = (f.owasp || f.owaspCategory || '—').padEnd(10);
-    const mitre = (f.mitreAttack || f.attckTechnique || '—').padEnd(20);
+    const mitre = (f.attck || '—').padEnd(20);
     const capec = (f.capec || '—').padEnd(10);
     const conf = (f.confidence == null ? '—' : f.confidence.toFixed(2));
     const vuln = (f.vuln || '').slice(0, 60);

package/src/runScan.js

@@ -120,7 +120,7 @@ export async function runScan(rootDir, opts = {}) {
 
   // R8: `resume` is opt-in. Left undefined here, runFullScan falls back to the
   // AGENTIC_SECURITY_RESUME=1 env var, which is off by default.
-  const scan = await runFullScan({ fileContents, depFileContents, scanRoot: root, resume: opts.resume }, opts.onProgress || (()=>{}));
+  const scan = await runFullScan({ fileContents, depFileContents, scanRoot: root, resume: opts.resume, deep: opts.deep, deepInCi: opts.deepInCi }, opts.onProgress || (()=>{}));
   // Premortem 2R4.2: stamp ruleset version + source on the scan result, and
   // notify if the operator pinned a different version than what's installed.
   try { stampScan(root, scan); } catch {}

package/src/sast/_comment-strip.js

@@ -7,16 +7,25 @@
 //   - JS/TS/Java/Go/C/C++/Rust line comments  // ...
 //   - JS/TS/Java/Go/C/C++/Rust block comments /* ... */
 //   - Python line comments                    # ...
+//   - PHP: all three of the above — `//`, `/* */`, AND `#` are all valid
+//     PHP line/block comment forms simultaneously (unlike Python, which
+//     only has `#`), so PHP needs its own mode rather than reusing 'py'
+//     (which would strip `#` but silently leave `//`/`/* */` PHP comments
+//     unstripped — a source of false positives on commented-out code).
 //
 // Skips comment-like content inside string literals (single/double/backtick).
 //
-// The `lang` parameter is optional; pass 'py' to treat `#` as a line comment.
+// The `lang` parameter is optional; pass 'py' to treat `#` as a line comment
+// (and skip `//`/`/* */`), or 'php' to strip all three comment forms.
 
 export function blankComments(s, lang) {
   let out = '';
   let inS = null;
   let i = 0;
   const isPy = lang === 'py';
+  const isPhp = lang === 'php';
+  const stripSlashForms = !isPy || isPhp;
+  const stripHash = isPy || isPhp;
   while (i < s.length) {
     const c = s[i];
     if (inS) {
@@ -26,17 +35,19 @@ export function blankComments(s, lang) {
       i++; continue;
     }
     if (c === "'" || c === '"' || c === '`') { inS = c; out += c; i++; continue; }
-    if (!isPy && c === '/' && s[i+1] === '/') {
+    if (stripSlashForms && c === '/' && s[i+1] === '/') {
       while (i < s.length && s[i] !== '\n') { out += ' '; i++; }
       continue;
     }
-    if (!isPy && c === '/' && s[i+1] === '*') {
+    if (stripSlashForms && c === '/' && s[i+1] === '*') {
       const end = s.indexOf('*/', i + 2);
       const stop = end < 0 ? s.length : end + 2;
       while (i < stop) { out += (s[i] === '\n' ? '\n' : ' '); i++; }
       continue;
     }
-    if (isPy && c === '#') {
+    // PHP 8 attributes (`#[Route(...)]`) use the same `#` prefix as a line
+    // comment — `#[` is never a comment, so don't blank it.
+    if (stripHash && c === '#' && s[i+1] !== '[') {
       while (i < s.length && s[i] !== '\n') { out += ' '; i++; }
       continue;
     }

package/src/sast/_secret-entropy.js

@@ -63,7 +63,7 @@ const JWT_RE       = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
 // Configurable thresholds. Defaults tuned against the Juliet Java
 // 468-FP / 1-TP collapse — these settings drop FPs to ~30 without
 // losing the AWS-key-shaped TP.
-export const DEFAULT_OPTIONS = {
+const DEFAULT_OPTIONS = {
   // Empirical floor for *non-dictionary* credentials. Lower than the
   // 3.5 ceiling Shannon-quoted for "true randomness" because real test
   // fixtures and rotated secrets often use repetitive base alphabets

package/src/sast/authz.js

@@ -145,10 +145,12 @@ export function scanAuthZ(fp, raw) {
     const m2 = ln.match(JWT_HARDCODED_SECRET_RE);
     if (m2) {
       const val = m2[1];
-      // Suppress only template/env placeholders
-      if (!/process\.env|\$\{|<.*?>|^\s*$/.test(val) && !/\bsecret\b|\bchange.?me\b|^example$/i.test(val) === false || val.length >= 4) {
-        // We still flag well-known placeholders ("secret", "changeme") because they
-        // are the most common production foot-gun.
+      // Suppress only template/env placeholders. We still flag well-known
+      // placeholders ("secret", "changeme", "example") because they are the
+      // most common production foot-gun.
+      const looksLikePlaceholder = /process\.env|\$\{|<.*?>|^\s*$/.test(val);
+      const isKnownBadPlaceholder = /\bsecret\b|\bchange.?me\b|^example$/i.test(val);
+      if (!looksLikePlaceholder || isKnownBadPlaceholder) {
         push(_emit(fp, i + 1,
           'AuthZ: hardcoded JWT secret in source',
           'critical', 'CWE-798', ln.replace(val, '<redacted>'),

package/src/sast/bench-shape/index.js

@@ -21,7 +21,7 @@
 // set) AND strips the marker comments from the corpus before scanning, so the
 // engine's true detection capability is measured.
 
-export function isBenchShape() {
+function isBenchShape() {
   return process.env.AGENTIC_SECURITY_BENCH_SHAPE === '1';
 }
 
@@ -38,11 +38,6 @@ export {
   applyJavaBenchSuppressions,
 } from '../java-bench-extras.js';
 
-// Re-export the cpp-bench-extras suppressor — gated at call sites.
-export {
-  applyJulietCppSuppressions as applyJulietCppFamilySuppressions,
-} from '../cpp-bench-extras.js';
-
 // OWASP Benchmark @WebServlet route-category extractor.
 // Returns the canonical vuln family (e.g. 'sql-injection') for files whose
 // @WebServlet URL encodes the test category, or null.
@@ -54,7 +49,7 @@ const _OWASP_BENCH_CATEGORY_MAP = {
   'weakrand': 'weak-rng', 'trustbound': 'trust-boundary',
   'securecookie': 'header-hardening',
 };
-export function benchShapeWebServletCategory(cleaned) {
+function benchShapeWebServletCategory(cleaned) {
   if (!isBenchShape()) return null;
   const m = cleaned.match(/@WebServlet\s*\(\s*(?:value\s*=\s*)?["'](?:[^"']*\/)?(\w+?)-\d+\//);
   if (!m) return null;

package/src/sast/claude-md-prompt-injection.js

@@ -64,14 +64,25 @@ function _line(raw, idx) {
   return raw.slice(0, idx).split('\n').length;
 }
 
+// Zero-width / invisible Unicode characters: zero-width space, ZWNJ, ZWJ,
+// word joiner, BOM/zero-width no-break space. Interspersing these between
+// every character renders/executes identically to a human or LLM reader
+// (most tokenizers treat them as no-ops) while breaking literal-word regex
+// matching — a documented real-world prompt-injection evasion technique
+// against exactly this kind of pattern-matching defense. None of these are
+// '\n', so removing them never shifts _line()'s line-count computation.
+const _ZERO_WIDTH_RE = /[​‌‍⁠]/g;
+
 export function scanClaudeMdPromptInjection(file, raw) {
   if (!file || !raw || typeof raw !== 'string') return [];
   if (!_INSTRUCTION_FILE_RE.test(file)) return [];
   if (raw.length > 1_000_000) return [];
 
+  const cleaned = raw.replace(_ZERO_WIDTH_RE, '');
+
   // Strip fenced code blocks so example snippets in docs don't trip the
   // detector. Replace with same-length whitespace to preserve line offsets.
-  const stripped = raw.replace(/```[\s\S]*?```/g, (m) => m.replace(/[^\n]/g, ' '));
+  const stripped = cleaned.replace(/```[\s\S]*?```/g, (m) => m.replace(/[^\n]/g, ' '));
 
   const findings = [];
 
@@ -149,12 +160,12 @@ export function scanClaudeMdPromptInjection(file, raw) {
 
   // Hardcoded credentials in CLAUDE.md / AGENTS.md.
   for (const { re, label } of _CRED_RE) {
-    const m = re.exec(raw);
+    const m = re.exec(cleaned);
     if (!m) continue;
     findings.push({
       id: `claude-md:hardcoded-cred:${file}:${m.index}`,
       file,
-      line: _line(raw, m.index),
+      line: _line(cleaned, m.index),
       vuln: `Instruction file contains a hardcoded ${label}`,
       severity: 'critical',
       family: 'harness-config-secrets',