@clear-capabilities/agentic-security-scanner 0.136.2 → 0.136.9

package/src/engine.js

@@ -121,7 +121,7 @@ import { scanRuby } from './sast/ruby.js';
 import { scanPhp } from './sast/php.js';
 import { classifySecretCandidate as _entropyClassifySecret } from './sast/_secret-entropy.js';
 // Phase 1 — precision-engineering posture modules.
-import { annotateConfidence } from './posture/confidence.js';
+import { annotateConfidence, applyUnvalidatedPenalty } from './posture/confidence.js';
 import { backfillFindingDefaults } from './posture/finding-defaults.js';
 import { annotatePocs } from './posture/poc-generator.js';
 import { annotateExecutionProofs } from './posture/prove-findings.js';
@@ -148,7 +148,7 @@ import { ingestLogicClaims } from './posture/logic-claims.js';
 import { annotateNarration } from './posture/flow-narration.js';
 import { applyPathConstraints } from './posture/path-predicates.js';
 // Phase 3 (Sentinel-parity Layer 1 + 2) — IR + interprocedural taint engine.
-import { buildProjectIR } from './ir/index.js';
+import { buildProjectIR, buildProjectIRAsync } from './ir/index.js';
 import { collectIrStats, irStatsTarget, writeIrStats } from './ir/ir-stats.js';
 import { runDeepAnalysis } from './dataflow/index.js';
 // v3 next-gen — Pillars 1, 4, 5, 6, 8, 9.
@@ -2214,7 +2214,13 @@ const IAC_PATTERNS = [
   { match: /\$\{\{\s*github\.event\.(?:issue|pull_request)\.title|\$\{\{\s*github\.event\.comment\.body/i,
     fileTypes: /\.github\/workflows\/.*\.ya?ml$/i,
     severity: 'high', cwe: 'CWE-78', vuln: 'GitHub Actions: untrusted github.event input interpolated into shell',
-    fix: 'Pass user-controlled fields via env vars and reference them as $VARNAME in the script body, not via ${{ }} interpolation.' },
+    fix: 'Pass user-controlled fields via env vars and reference them as $VARNAME in the script body, not via ${{ }} interpolation.',
+    // Same false-positive as src/sast/pipeline.js's overlapping rule: a pure
+    // `KEY: ${{ github.event.… }}` mapping line assigns to an env var at the
+    // workflow-engine level (the fix's own recommended pattern), not into a
+    // shell command string — only a match embedded in a larger line (a run:
+    // script body) is actually dangerous.
+    lineSafeRe: /^[\w.-]+\s*:\s*\$\{\{[^}]*\}\}\s*$/ },
 ];
 
 function scanIaC(fp, raw){
@@ -2227,6 +2233,7 @@ function scanIaC(fp, raw){
     let m;
     while ((m = re.exec(raw))) {
       const line = raw.substring(0, m.index).split('\n').length;
+      if (p.lineSafeRe && p.lineSafeRe.test((lines[line - 1] || '').trim())) continue;
       findings.push({
         id: `iac:${fp}:${line}:${p.vuln.replace(/\s/g, '_').slice(0, 60)}`,
         kind: 'iac', severity: p.severity, vuln: p.vuln,
@@ -2747,10 +2754,24 @@ function scanLogicVulns(fp,raw){
     while((m=re.exec(haystack))){
       const line=lineAt(haystack,m.index);
       const snippet=lines[line-1]?.trim()||"";
+      let outSnippet=snippet;
       // FP-2: credential FP filter
       if(pat.vuln==='Hardcoded Secret'||pat.vuln==='Hardcoded Credential Check'){
         const fpCheck=_isFalsePositiveCredential(fp,snippet,m[0]);
         if(fpCheck.skip){_suppressionLog.push({vuln:pat.vuln,file:fp,line,snippet,reason:fpCheck.reason});continue;}
+        // Stage 4 correctness audit (coverage breadth, secrets): same
+        // unredacted-snippet leak found in engine.js's scanEntropySecrets/
+        // scanCredentials and sast/secret-concat.js — this is a THIRD,
+        // separate detector (LOGIC_PATTERNS' own "Hardcoded Secret" rule)
+        // that also stored the raw source line, with no masking at all.
+        // The regex captures the quoted value inside `m[0]`; mask just
+        // that value within the reported snippet.
+        const valMatch=m[0].match(/['"]([^'"]{3,})['"]/);
+        if(valMatch){
+          const val=valMatch[1];
+          const masked=val.length>8?val.substring(0,4)+"…"+val.substring(val.length-4):"••••";
+          outSnippet=snippet.split(val).join(masked);
+        }
       }
       // FP-6: operational-context gate for selected logic patterns
       if (predicate) {
@@ -2760,7 +2781,7 @@ function scanLogicVulns(fp,raw){
           continue;
         }
       }
-      results.push({vuln:pat.vuln,severity:pat.severity,cwe:pat.cwe,stride:pat.stride,kind:pat.kind,fix:pat.fix,code:pat.code,file:fp,line,snippet});
+      results.push({vuln:pat.vuln,severity:pat.severity,cwe:pat.cwe,stride:pat.stride,kind:pat.kind,fix:pat.fix,code:pat.code,file:fp,line,snippet:outSnippet});
     }
   }
   const routeRe=/(?:app|router)\s*\.\s*(?:get|post|all)\s*\(\s*['"`](\/(?:debug|admin|test|internal|__)[^'"`]*)/gi;let rm;
@@ -5409,17 +5430,29 @@ function scanEntropySecrets(fp,raw){
     // FP-5: structural / doc-context suppression
     const surrounding=lines.slice(Math.max(0,line-3),Math.min(lines.length,line+1)).join("\n");
     const nonSecretReason=_isLikelyNonSecret(v, ctx, surrounding);
+    const masked=v.substring(0,4)+"…"+v.substring(v.length-4);
     if (nonSecretReason) {
-      _suppressionLog.push({vuln:"High-Entropy Credential Candidate",file:fp,line,snippet:ctx.trim(),reason:'entropy-'+nonSecretReason});
+      // Same redaction concern as the main finding below applies to the
+      // suppression log — it's exposed via --include-suppressed, and a
+      // heuristic "probably not a real secret" call can be wrong.
+      _suppressionLog.push({vuln:"High-Entropy Credential Candidate",file:fp,line,snippet:ctx.trim().split(v).join(masked),reason:'entropy-'+nonSecretReason});
       continue;
     }
-    const masked=v.substring(0,4)+"…"+v.substring(v.length-4);
+    // Stage 4 correctness audit (coverage breadth, secrets): `snippet` used
+    // to carry the RAW, unmasked source line — including the full secret
+    // value — even though `masked` right next to it was correctly
+    // redacted. Nothing downstream (normalizeFindings, toHTML, toCSV,
+    // toJUnit) ever redacts `snippet` again, so the plaintext credential
+    // this detector exists to find flowed straight into every report
+    // format this scanner emits, including last-scan.json. Redact the
+    // exact matched value out of the snippet at the source, the same way
+    // `masked` already is.
     out.push({
       vuln:"High-Entropy Credential Candidate",
       severity:"high",cwe:"CWE-798",stride:"Information Disclosure",
       fix:"Replace with environment variable or secrets manager reference; rotate the value immediately.",
       code:`// BEFORE\nconst secret = "${masked}";\n\n// AFTER\nconst secret = process.env.APP_SECRET;`,
-      file:fp,line,snippet:ctx.trim(),masked,entropy:e.toFixed(2)
+      file:fp,line,snippet:ctx.trim().split(v).join(masked),masked,entropy:e.toFixed(2)
     });
   }
   return out;
@@ -5459,12 +5492,21 @@ function scanConfigFiles(fc){
         const[,k,v]=m;
         if(!v||v==='""'||v==="''"||/^(?:change.?me|your[_-]|placeholder|example|xxx+|todo|<|\$\{)/i.test(v))continue;
         if(/(?:password|secret|key|token|api)/i.test(k)){
+          // Stage 6 correctness audit: this was the one secrets-adjacent
+          // detector still shipping the RAW, unmasked source line as
+          // `snippet` — its siblings (scanCredentials/scanEntropySecrets)
+          // were already fixed for this exact leak in the Stage 4 audit.
+          // Nothing downstream re-redacts `snippet`, and the MCP redact.js
+          // catch-all requires a QUOTED value, which standard `.env`
+          // KEY=value syntax never has — so the plaintext committed
+          // secret flowed straight through explain_finding unredacted.
+          const masked=v.length>8?v.substring(0,4)+"…"+v.substring(v.length-4):"…";
           out.push({
             vuln:`Committed .env with Real-Looking ${k}`,
             severity:"high",cwe:"CWE-538",stride:"Information Disclosure",
             fix:`Remove ${k} from committed env files. Use .env.example with placeholders and ignore .env in VCS.`,
             code:`# In .gitignore\n.env\n\n# .env.example (commit)\n${k}=<your-${k.toLowerCase()}>`,
-            file:fp,line:i+1,snippet:ln
+            file:fp,line:i+1,snippet:ln.split(v).join(masked),masked
           });
         }
       }
@@ -6369,7 +6411,11 @@ function scanCredentials(fp,raw){
       if(seen.has(key))continue;seen.add(key);
       const severity=pat.s==="c"?"critical":pat.s==="h"?"high":"medium";
       const masked=val.length>12?val.substring(0,6)+"••••••"+val.substring(val.length-4):val.substring(0,3)+"•••";
-      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,snippet,masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
+      // Stage 4 correctness audit (coverage breadth, secrets): same
+      // unredacted-snippet leak as scanEntropySecrets — `snippet` carried
+      // the raw source line (full credential value) straight through to
+      // every report format. Redact the exact matched value here too.
+      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,snippet:snippet.split(val).join(masked),masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
     }
   }
   return results;
@@ -6534,7 +6580,7 @@ function _makePurl(ecosystem,name,version,group){
   const t={npm:'npm',pypi:'pypi'}[ecosystem]||ecosystem;
   if(!t)return'';
   const ns=group?`${encodeURIComponent(group)}/`:'';
-  return`pkg:${t}/${ns}${encodeURIComponent(name)}${version?'@'+version:''}`;
+  return`pkg:${t}/${ns}${encodeURIComponent(name)}${version?'@'+encodeURIComponent(version):''}`;
 }
 
 function _parsePackageJson(text,filePath){
@@ -7508,7 +7554,7 @@ async function queryRegistries(components){
 
 // Node port: takes { fileContents, depFileContents } maps directly instead of a JSZip object.
 // fileContents = code files keyed by relative path; depFileContents = manifest/lockfiles keyed by relative path.
-async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null, resume=undefined}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
+async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null, resume=undefined, deep=undefined, deepInCi=undefined}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
   // Pre-pass: build cross-file Java tainted-method index so per-file taint
   // analysis can recognize calls to user-input-returning helper methods
   // defined in OTHER files (Juliet's DataflowThruInnerClass / Vector / Stream
@@ -7854,6 +7900,11 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // R8 (PRD §5): OS packages from an extracted container image's package DBs
   // (dpkg/apk) — baked-in deps the Dockerfile never names. Feed the OSV/SBOM pipeline.
   try{const{extractImagePackages}=await import('./sca/image-packages.js');for(const ip of extractImagePackages(allFileContents)){if(!components.some(c=>c.ecosystem===ip.ecosystem&&c.name===ip.name&&c.version===ip.version))components.push(ip);}}catch(_){}
+  // Dockerfile-declared apt/apk install-line packages — complementary to
+  // extractImagePackages above (which reads an actually scanned filesystem's
+  // installed-package DB, a different signal: build-time-declared vs.
+  // actually-installed).
+  try{const{extractContainerPackages}=await import('./sca/container.js');for(const cp of extractContainerPackages(allFileContents)){if(!components.some(c=>c.ecosystem===cp.ecosystem&&c.name===cp.name&&c.version===cp.version))components.push(cp);}}catch(_){}
   try{const{detectVendoredLibraries}=await import('./sca/vendor-detect.js');const vendored=detectVendoredLibraries(fc);for(const v of vendored){const key=`${v.ecosystem}:${v.name}:${v.version}`;if(!components.some(c=>`${c.ecosystem}:${c.name}:${c.version}`===key))components.push({...v,group:'',purl:`pkg:${v.ecosystem}/${v.name}@${v.version}`,filePath:v.file,isUnpinned:false,reachable:true});}}catch(_){}
   const reach=buildReachabilitySet(fc);
   const reachabilitySet=reach.imported;
@@ -8104,7 +8155,13 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   };
   _runAnnotator('annotateStableIds', () => annotateStableIds(finalFindings));
   _runAnnotator("clusterByRootCause", () => { finalFindings = clusterByRootCause(finalFindings); });
-  _runAnnotator("demoteUnreachable", () => { demoteUnreachable(finalFindings, { routes: aR }); });
+  _runAnnotator("demoteUnreachable", () => {
+    demoteUnreachable(finalFindings, { routes: aR });
+    // `type: 'vulnerable_dep'` findings live in supplyChain, not finalFindings
+    // (src/sca/CLAUDE.md) — demoteUnreachable's SCA-tier branch needs this
+    // array passed explicitly or it never sees an SCA finding at all.
+    demoteUnreachable(supplyChain, { routes: aR });
+  });
   // Premortem #8: backfill parser/family BEFORE confidence and calibration,
   // because both consume those fields and silently no-op when they're null.
   _runAnnotator("backfillFindingDefaults", () => { backfillFindingDefaults(finalFindings); });
@@ -8124,22 +8181,25 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
     // Generalised sanitizer consumption (dataflow/sanitizer-gate.js): labels
     // findings whose flow passes a catalog sanitizer matching their family
     // (xss/url/cmd, not just sql) so the proof gate below can demote them the
-    // same way it demotes proven-clean SQL. `sanitizersOnPath` would need to
-    // be `{ [findingId]: string[] of sanitizer callees observed on that
-    // finding's flow }`. There is nothing to build that map from: the live
-    // taint walk in dataflow/engine.js does NOT consult sanitizer catalog
-    // entries at all. `matchSinkOrSanitizer()` returns every catalog hit for
-    // a callee, but every consumer in dataflow/*.js selects only
-    // `e.kind === 'sink'` — there is no `'sanitizer'` branch anywhere in that
-    // tree. Taint is killed only by clean re-assignment of a variable
-    // (removePathAndDescendants, engine.js:374), which happens regardless of
-    // whether the RHS call is a catalog sanitizer.
-    // So this is `{}` and the gate below is INERT — not "awaiting plumbing"
-    // but awaiting the sanitizer walk itself. Making it live needs two things:
-    // (1) dataflow/engine.js honouring `kind === 'sanitizer'` at a call site,
-    // and (2) that call site's callee name threaded onto the finding
-    // alongside the trace/chain that proven-clean.js already reads.
+    // same way it demotes proven-clean SQL.
+    //
+    // The taint walk now records the sanitizer callees observed on the value
+    // reaching each sink argument (`dataflow/engine.js` `_sanitizersForExpr`)
+    // and stamps them on the finding as `_sanitizersOnPath`. This rebuilds the
+    // `{ [findingId]: string[] }` shape the gate wants. Both `id` and
+    // `stableId` are keyed because the gate accepts either and stable ids are
+    // assigned by an earlier annotator.
+    //
+    // The sanitizer never kills the taint in the walk itself: a mislabelled
+    // sanitizer would then hide a real vulnerability outright, whereas a label
+    // only demotes confidence here. Recall-preserving, on purpose.
     const sanitizersOnPath = {};
+    for (const f of finalFindings) {
+      const names = f && f._sanitizersOnPath;
+      if (!Array.isArray(names) || !names.length) continue;
+      if (f.id) sanitizersOnPath[f.id] = names;
+      if (f.stableId) sanitizersOnPath[f.stableId] = names;
+    }
     _runAnnotator("applySanitizerGate", () => { applySanitizerGate(finalFindings, { sanitizersOnPath }); });
     _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
   }
@@ -8288,8 +8348,10 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // v3 next-gen: per-attacker-persona score matrix (FR-ADV-2). Must run AFTER
   // crown-jewels + mitigation composite so it sees those signals.
   _runAnnotator("annotatePersonaScores", () => { annotatePersonaScores(finalFindings); });
-  // v3 next-gen: SCA reverse-blast-radius enrichment (FR-ADV-5).
-  _runAnnotator("annotateScaReverseBlast", () => { annotateScaReverseBlast(finalFindings, fc); });
+  // v3 next-gen: SCA reverse-blast-radius enrichment (FR-ADV-5). Annotates
+  // SCA findings (package-name-keyed) — must run against supplyChain, not
+  // finalFindings (SAST), which has no package-name field at all.
+  _runAnnotator("annotateScaReverseBlast", () => { annotateScaReverseBlast(supplyChain, fc); });
   // v3 next-gen: bug-bounty payout prediction (FR-ADV-3). Composes with the
   // mitigation composite — gated/unreachable findings get the bounty scaled
   // down rather than zeroed.
@@ -8420,10 +8482,25 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // gets strictly more wall-clock for the taint analysis itself than an
   // uninstrumented run with the same budget.
   let _sharedIR = null;
+  // Java IR requires the ASYNC builder. `parser-java.js` exports an async
+  // `parseJavaFile` (java-parser needs a dynamic import), so the sync
+  // `buildProjectIR` has no Java branch at all — and both deep-path call sites
+  // used it. The result was that no .java file had ever produced an IR function
+  // in deep mode: `bench/layer-recall` measured java at 0/25 while the catalog
+  // carried 7 Java sources and 15 Java sinks that had nothing to run against.
+  // `buildProjectIRAsync` is a full mirror plus Java and had zero callers.
+  //
+  // Gated on the presence of .java rather than always awaiting: the async
+  // builder is a superset, but switching every scan in the product to it to fix
+  // one language would change the execution shape (and attempt the java-parser
+  // import) for projects that contain no Java. `runFullScan` is already async,
+  // so the await costs nothing structurally.
+  const _hasJava = Object.keys(fc || {}).some(f => /\.java$/i.test(f));
+  const _buildIR = async () => (_hasJava ? await buildProjectIRAsync(fc) : buildProjectIR(fc));
   const _irStatsTarget = irStatsTarget();
   if (_irStatsTarget) {
     try {
-      _sharedIR = buildProjectIR(fc);
+      _sharedIR = await _buildIR();
       writeIrStats(_irStatsTarget, collectIrStats(fc, _sharedIR.perFile, _sharedIR.callGraph));
     } catch (e) {
       // Instrumentation must never fail a scan. Surface only when debugging.
@@ -8432,16 +8509,27 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       }
     }
   }
-  const _deepRequested = process.env.AGENTIC_SECURITY_DEEP === '1';
+  // `deep`/`deepInCi` come from runScan()'s options object (threaded through
+  // unchanged from runScan.js) — an explicit-opt-in override alongside the
+  // env vars, not a replacement for them. Added because `runScan(dir,
+  // {deep:true})` was a silent, total no-op: this options object was
+  // destructured for fileContents/depFileContents/scanRoot/resume only, so
+  // `deep` was dropped on the floor and deep mode stayed off regardless.
+  // Several interprocedural test files (interproc-k2.test.js,
+  // parser-cs-kt.test.js, points-to.test.js) pass exactly this option
+  // believing it enables deep mode — it never did, so those tests were
+  // exercising whatever coincidentally fires without the deep engine, not
+  // the interprocedural machinery they're named for.
+  const _deepRequested = deep === true || process.env.AGENTIC_SECURITY_DEEP === '1';
   const _inCi = !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
                    process.env.BUILDKITE || process.env.CIRCLECI || process.env.JENKINS_URL);
-  const _deepInCiAllowed = process.env.AGENTIC_SECURITY_DEEP_IN_CI === '1';
+  const _deepInCiAllowed = deepInCi === true || process.env.AGENTIC_SECURITY_DEEP_IN_CI === '1';
   const _deepEnabled = _deepRequested && (!_inCi || _deepInCiAllowed);
   if (_deepEnabled) {
     const budgetMs = parseInt(process.env.AGENTIC_SECURITY_DEEP_TIMEOUT_MS || '300000', 10);
     const t0 = Date.now();
     try {
-      const { perFile, callGraph } = _sharedIR || (_sharedIR = buildProjectIR(fc));
+      const { perFile, callGraph } = _sharedIR || (_sharedIR = await _buildIR());
       // The runDeepAnalysis call is synchronous in this codebase; we can't
       // truly interrupt it without re-architecting the worklist. We pass a
       // deadlineMs hint that the inner loops check; if absent, we still cap
@@ -8471,6 +8559,29 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
         f.validator_verdict = 'unvalidated';
       }
       finalFindings.push(...irFindings);
+      // Sanitizer + proof gate, pass 2 of 2 — same ordering trap as the
+      // ignore-pragma double pass below, and for the same reason: pass 1 runs
+      // ~2300 lines above, long before deep-mode IR findings exist, so a
+      // sanitized IR-TAINT flow was never labelled and a proven-clean one was
+      // never demoted. Deep mode is what the CLI uses outside CI, so that was
+      // the case that mattered most.
+      //
+      // Scoped to `irFindings` rather than re-running over `finalFindings`:
+      // annotateProofGate demotes confidence, so a second pass over findings
+      // pass 1 already handled would demote them twice.
+      if (process.env.AGENTIC_SECURITY_NO_PROOF_GATE !== '1') {
+        const _irSanitizers = {};
+        for (const f of irFindings) {
+          const names = f && f._sanitizersOnPath;
+          if (!Array.isArray(names) || !names.length) continue;
+          if (f.id) _irSanitizers[f.id] = names;
+          if (f.stableId) _irSanitizers[f.stableId] = names;
+        }
+        _runAnnotator("applySanitizerGate:deep", () => {
+          applySanitizerGate(irFindings, { sanitizersOnPath: _irSanitizers });
+        });
+        _runAnnotator("annotateProofGate:deep", () => { annotateProofGate(irFindings); });
+      }
       // Pragma pass 2 of 2 — see the pass-1 comment far above. Deep-mode IR
       // findings land here, long after pass 1 ran, so without this an
       // `agentic-security-ignore` on an ir-taint finding is inert. Deep mode is
@@ -8526,11 +8637,18 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       confidence: 1.0,
     });
   }
-  // Phase 2 (Sentinel-parity): LLM validator stage. No-op unless the operator
-  // sets AGENTIC_SECURITY_LLM_VALIDATE=1 AND AGENTIC_SECURITY_LLM_ENDPOINT. When
-  // disabled, every finding gets unvalidated:true and the existing confidence
-  // pipeline accounts for that. When enabled, the validator emits accept/reject
-  // /escalate per finding; rejects are dropped into the suppression log.
+  // Phase 2 (Sentinel-parity): LLM validator stage. DEFAULT-ON whenever
+  // AGENTIC_SECURITY_LLM_ENDPOINT is configured — not gated on
+  // AGENTIC_SECURITY_LLM_VALIDATE=1 as this comment previously (and wrongly)
+  // said. Opt OUT with AGENTIC_SECURITY_LLM_VALIDATE=0; the legacy
+  // AGENTIC_SECURITY_LLM_VALIDATE=1 still works as an explicit-on no-op. With
+  // no endpoint configured the validator stays a no-op regardless — no
+  // surprise network calls from an unrelated env var. See
+  // llm-validator/index.js's own header, which states this correctly; this
+  // comment was the one that had drifted. When disabled, every finding gets
+  // unvalidated:true and the existing confidence pipeline accounts for that.
+  // When enabled, the validator emits accept/reject/escalate per finding;
+  // rejects are dropped into the suppression log.
   try {
     // Concurrency defaults to 1 (the validator's deterministic-default).
     // Operators raise via AGENTIC_SECURITY_LLM_CONCURRENCY at the cost of
@@ -8543,7 +8661,23 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       vuln: d.vuln, file: d.file, line: d.line, snippet: d.snippet,
       reason: 'llm-validator:reject:' + (d.validator_reasoning || '').slice(0, 80),
     });
+    // Re-run: annotateVerifierVerdicts ran (~8335) before validator_verdict
+    // existed on any finding (set here, hundreds of lines later), so its
+    // 'verified-by-llm' verdict — documented as one of five possible
+    // outcomes in verifier.js's own header — could never be produced by the
+    // real pipeline. Cheap and idempotent; re-running is the fix, not
+    // moving the original call (confidence/exploitability annotators
+    // upstream of it still need to run before validation, same as before).
+    try { annotateVerifierVerdicts(finalFindings, { fileContents: fc }); } catch (_) {}
   } catch(_) {}
+  // Same ordering fix as annotateVerifierVerdicts above: annotateConfidence
+  // (~8111) computes f.confidence before f.unvalidated exists on any
+  // finding, so its 0.85x "LLM validator unavailable" penalty could never
+  // apply in the real pipeline. Runs unconditionally (outside the
+  // llmValidateMany try-block above) because f.unvalidated is also set
+  // directly on deep-mode IR findings appended earlier in this function,
+  // independent of whether the LLM validator itself ran.
+  try { applyUnvalidatedPenalty(finalFindings); } catch (_) {}
   try {
     const { kept, suppressed } = applyLearnedFeedback(scanRoot, finalFindings);
     finalFindings = kept;
@@ -8610,8 +8744,11 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       /(?:^|\/)test_[^/]*\.py$/i.test(f) || /_test\.(?:py|go)$/i.test(f));
     annotateScaVerdicts(supplyChain, { testsDetected: _testsDetected });
   } catch (_) {}
-  // 0.9.0 Feat-15: dep confusion
-  try{const dc=detectDepConfusion(annotatedComponents,scanRoot);aF.push(...dc);}catch(_){}
+  // 0.9.0 Feat-15: dep confusion. These are supply-chain findings (kind:'sca',
+  // derived from `components` not source code) and belong in supplyChain, not
+  // aF — aF was already snapshotted into finalFindings at dedupeFindingsWithEvidence
+  // above, so pushing into aF here silently discards every result.
+  try{const dc=detectDepConfusion(annotatedComponents,scanRoot);supplyChain.push(...dc);}catch(_){}
   // Deployment-platform security checklist
   try{const dpf=scanDeployPlatform(scanRoot);aLogic.push(...dpf);}catch(_){}
   // Stack-specific security playbook
@@ -8814,8 +8951,22 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
     if (process.env.AGENTIC_SECURITY_NO_COMPLIANCE !== '1') {
       try {
         const policy = loadCompliancePolicy(scanRoot);
-        if (policy && !policy._error) {
+        if (policy && policy._error) {
+          // CMP-5: a malformed policy used to be silently treated the same
+          // as "no policy file" — the parse error (which names the exact
+          // problem) was computed and then discarded. verifyPolicy now
+          // reports it as a distinct 'error' status rather than staying
+          // silent, and it is surfaced here too so an interactive scan
+          // shows it.
           _complianceReport = verifyCompliancePolicy(policy, { scanRoot, findings: finalFindings });
+          process.stderr.write(`[compliance] ${policy._error}\n`);
+        } else if (policy) {
+          // CMP-5: pass every channel a real scan produces, not just SAST —
+          // a finding-family check for hardcoded-secret or vulnerable-dep
+          // was previously invisible to secrets/SCA findings entirely.
+          _complianceReport = verifyCompliancePolicy(policy, {
+            scanRoot, findings: finalFindings, secrets: aSecrets, logicVulns: aLogic, supplyChain,
+          });
           emitComplianceJsonLd(_complianceReport, scanRoot);
           emitComplianceMarkdown(_complianceReport, scanRoot);
         }
@@ -8895,7 +9046,16 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   let _analysisTier = null, _unmodeledSinks = null;
   try { _analysisTier = computeAnalysisTiers(Object.keys(fc)); } catch {}
   try { _unmodeledSinks = countUnmodeledSinkCandidates(fc, finalFindings); } catch {}
-  const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
+  // filesScanned counts files actually analyzed (Object.keys(fc), the same
+  // set computeAnalysisTiers above reads) — NOT files.length, the candidate
+  // list before the per-file loop's size/density skips run. Using the
+  // candidate count here double-counted skipped files: they were included
+  // in filesScanned AND separately reported in filesSkipped/filesDenseSkipped,
+  // so coverage-report.js's "scanned=N skipped=M" line implied N+M files were
+  // seen when only N-of-those-candidates were actually analyzed.
+  // checkpoint.total intentionally keeps files.length — that field means the
+  // full candidate set for resume bookkeeping, a different, correct meaning.
+  const _scanMeta={filesScanned:Object.keys(fc).length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
   // R8: the scan completed, so the checkpoint has been fully consumed — remove
   // it. Anything that threw before this point leaves it in place to resume from.
   try { closeCheckpoint(_ckpt, { complete: true }); } catch (_) {}

package/src/ir/CLAUDE.md

@@ -10,7 +10,10 @@ consumed by `scanner/src/dataflow/` for taint analysis.
 | JS / TS  | `parser-js.js`        | `@babel/parser`                                  |
 | Python   | `parser-py-cst.js`    | Python 3.8+ stdlib `ast` via subprocess (default when available) |
 | Python   | `parser-py.js`        | Hand-rolled regex parser (fallback when python3 missing) |
-| Java     | `parser-java.js`      | `java-parser` npm package (async)                |
+| Java     | `parser-java.js`      | `java-parser` npm package (**async only** — the deep path in `engine.js` therefore awaits `buildProjectIRAsync` when any `.java` file is present, and uses the sync builder otherwise).
+⚠ Three defects made Java taint impossible until v0.136.3+: the sync-only call site; a CST walk looking for `blockStatement` on a `block` (java-parser nests `block → blockStatements → blockStatement`), which emptied every method CFG; and `exprFromCst` missing the `primary → primaryPrefix + primarySuffix` form that models **every** method call. Guarded by `test/java-taint-flow.test.js`. **Params are still not extracted** (`params: []`, marked "deferred" in the source), so Java interprocedural summaries are limited. |
+| Ruby     | `parser-rb.js`        | Hand-rolled. **`DEF_RE` must not let `\s*` cross a newline** — it did, and the body slice then started after the method's first statement, silently dropping it from every method (a one-statement body became empty). Measured as Ruby 0/20 IR-TAINT recall in `bench/layer-recall`. Guarded by `test/parser-php-rb.test.js`. ⚠ Also emitted no `fn.calls` at all (every OTHER parser does) — `callgraph.js`'s edges/callersOf/resolveKnownCallee are built entirely from `fn.calls`, so this left dead-code demotion and any interprocedural signal that depends on real call-graph resolution (rather than engine.js's generic tainted-call-argument fallback) permanently blind to Ruby. Fixed by deriving `fn.calls` from the CFG via the shared `call-sites.js#callSitesFromCfg` (the same helper `parser-py-cst.js` uses) — Ruby's node shapes already matched its documented contract. Guarded by `test/parser-rb-calls.test.js`. |
+| C#       | `parser-cs.js`        | Hand-rolled. ⚠ `_lowerExpr`'s string-concat branch **must** guard on `_splitTopLevelPlus` returning more than one part — when the `+` is nested inside parens the splitter returns the input unchanged and the branch recurses on the identical string (stack overflow, swallowed by `buildProjectIR`'s per-file catch, surfacing only as "no IR"). `new Type(args)` is lowered to a call so taint reaches constructor sinks such as `new SqlCommand`. Guarded by `test/parser-cs-kt.test.js`. |
 | C / C++  | `parser-cpp.js`       | Hand-rolled parser (functions, qualified names, CFG lowering). Dispatched by extension (`c/cc/cpp/cxx/h/hh/hpp/hxx`) in both `buildProjectIR` and `buildProjectIRAsync`. |
 | Long-tail (rust/solidity/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. |
 

package/src/ir/balanced-call.js

@@ -0,0 +1,55 @@
+// Shared by every hand-rolled regex IR parser (parser-cs.js, parser-go.js,
+// parser-php.js, parser-rb.js) for extracting a call's callee + argument
+// text without corruption when the call is followed by a chained member
+// access (`Sanitize(x).Trim()`, `$obj->clean($x)->trim()`).
+//
+// The naive pattern every one of those files used —
+// `/^(calleeRe)\s*\((.*)\)\s*$/s` — matches `(.*)` GREEDILY against the
+// LAST `)` in the string, not the one balancing the FIRST `(`. For a
+// chained call that swallows the chain's own parens into the argument
+// text (`Sanitize(x).Trim()` produced argsText = "x).Trim("), which then
+// fails to parse as any recognized expression shape in `_lowerExpr` and
+// falls through to `{kind:'unknown'}` — silently losing whatever
+// taint-relevant identifiers were inside the FIRST call's real argument
+// list, exactly the shape a wrapped-and-then-methodcalled sanitizer or
+// helper produces in real code.
+//
+// This scans forward from the first `(` tracking paren/bracket/brace
+// depth and string-literal state (so a `)` or `,` inside a nested call or
+// a string literal doesn't miscount) to find the REAL matching close
+// paren. It deliberately does NOT require that close paren to be the end
+// of the string — a trailing chain (`.Trim()`, `->trim()`, `::foo()`) is
+// simply left unconsumed rather than corrupting anything. Recovering the
+// first call's real signature is a strict improvement over the prior
+// choice between silent corruption and no match at all.
+export function matchBalancedCall(s, calleeRe) {
+  if (typeof s !== 'string') return null;
+  const m = calleeRe.exec(s);
+  if (!m || m.index !== 0) return null;
+  let i = m[0].length;
+  while (s[i] === ' ' || s[i] === '\t') i++;
+  if (s[i] !== '(') return null;
+  const openIdx = i;
+  let depth = 0;
+  let inStr = null;
+  let escape = false;
+  for (; i < s.length; i++) {
+    const c = s[i];
+    if (escape) { escape = false; continue; }
+    if (inStr) {
+      if (c === '\\') { escape = true; continue; }
+      if (c === inStr) inStr = null;
+      continue;
+    }
+    if (c === '"' || c === '\'') { inStr = c; continue; }
+    if (c === '(' || c === '[' || c === '{') { depth++; continue; }
+    if (c === ')' || c === ']' || c === '}') {
+      depth--;
+      if (depth === 0) break;
+      continue;
+    }
+  }
+  if (depth !== 0 || s[i] !== ')') return null; // unbalanced — refuse to guess
+  const callee = m[1] !== undefined ? m[1] : m[0];
+  return { callee, argsText: s.slice(openIdx + 1, i) };
+}

package/src/ir/parser-cs.js

@@ -27,6 +27,7 @@
 
 import * as crypto from 'node:crypto';
 import { callSitesFromCfg } from './call-sites.js';
+import { matchBalancedCall } from './balanced-call.js';
 
 const METHOD_RE = new RegExp(
   '(?:^|[\\s;{}])(?:public|private|protected|internal|static|virtual|override|async|sealed|abstract|new|readonly|partial)' +
@@ -80,17 +81,69 @@ function _lowerExpr(text) {
     if (parts.length === 1) return { kind: 'ident', name: parts[0] };
     return _buildMemberChain(parts);
   }
-  // Call: foo.bar(args) or Bar(args). Find the LAST '(' at depth 0.
-  const callMatch = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  // Object creation: `new Type(args)` — lowered to a call so taint flows into
+  // constructor arguments. Without this branch the expression fell through to
+  // the concat heuristic below, and because the `+` sits INSIDE the parens
+  // `_splitTopLevelPlus` returned the input unchanged, so that branch recursed
+  // on the identical string until the stack blew. `buildProjectIR` catches
+  // per-file, so the crash surfaced only as "this file has no IR" — 12 of 21 C#
+  // corpus entries, and the catalog's own `cs-sqlcommand` rule ("SQL Injection
+  // (new SqlCommand with concatenated user input)") could never fire.
+  const newMatch = matchBalancedCall(s, /^new\s+([\w.]+)/);
+  if (newMatch) {
+    const callee = newMatch.callee.split('.').pop();
+    const args = _splitTopLevelCommas(newMatch.argsText).map(_lowerExpr);
+    return { kind: 'call', callee, args, isNew: true };
+  }
+  // Call: foo.bar(args) or Bar(args). matchBalancedCall finds the paren
+  // that actually balances the FIRST '(' — not the greedy-to-end-of-string
+  // match the old `/\((.*)\)\s*$/` used, which corrupted the argument text
+  // for a chained call (`Sanitize(x).Trim()` produced argsText="x).Trim(",
+  // which then fell through to {kind:'unknown'} and silently dropped x).
+  const callMatch = matchBalancedCall(s, /^([\w.]+)/);
   if (callMatch) {
-    const callee = callMatch[1];
-    const args = _splitTopLevelCommas(callMatch[2]).map(_lowerExpr);
-    return { kind: 'call', callee, args };
+    const args = _splitTopLevelCommas(callMatch.argsText).map(_lowerExpr);
+    return { kind: 'call', callee: callMatch.callee, args };
   }
   // String concat / interpolation — heuristic.
+  //
+  // The `parts.length > 1` guard is load-bearing, not defensive tidiness: when
+  // the `+` is nested inside parens or brackets, `_splitTopLevelPlus` returns
+  // the input as a single part, and mapping `_lowerExpr` over it recurses on the
+  // identical string forever. Any future expression form that reaches here
+  // unsplit would otherwise reintroduce the same stack overflow.
   if (s.includes('+') && /["']/.test(s)) {
-    const parts = _splitTopLevelPlus(s).map(_lowerExpr);
-    return { kind: 'tpl', parts };
+    const rawParts = _splitTopLevelPlus(s);
+    if (rawParts.length > 1) return { kind: 'tpl', parts: rawParts.map(_lowerExpr) };
+  }
+  // Stage 3 correctness audit (detection depth, per-language-IR):
+  // interpolated strings ($"id={id}", $@"...", @$"...") were entirely
+  // unrecognized by every branch above — not even treated as an opaque
+  // literal, since nothing here tested for the leading `$` prefix — so
+  // they fell all the way through to {kind:'unknown'}, silently dropping
+  // any interpolated variable's taint. This is exactly
+  // `new SqlCommand($"SELECT ... WHERE id={id}", conn)`, one of the most
+  // common real C# SQL-injection shapes. `{expr}` / `{expr:format}` are
+  // lowered into a template, same shape as the `+`-concat branch above.
+  if (/^\$@?"/.test(s) || /^@\$"/.test(s)) {
+    const bodyStart = s.indexOf('"') + 1;
+    const inner = s.slice(bodyStart, -1);
+    const re = /\{([^{}:]+)(?::[^{}]*)?\}/g;
+    let lastIndex = 0;
+    const parts = [];
+    let matched = false;
+    let m;
+    while ((m = re.exec(inner)) !== null) {
+      matched = true;
+      if (m.index > lastIndex) parts.push({ kind: 'literal', value: inner.slice(lastIndex, m.index) });
+      parts.push(_lowerExpr(m[1].trim()));
+      lastIndex = re.lastIndex;
+    }
+    if (matched) {
+      if (lastIndex < inner.length) parts.push({ kind: 'literal', value: inner.slice(lastIndex) });
+      return { kind: 'tpl', parts };
+    }
+    return { kind: 'literal', value: s };
   }
   if (/^"|^@"/.test(s)) return { kind: 'literal', value: s };
   if (/^\d/.test(s))   return { kind: 'literal', value: s };
@@ -169,9 +222,9 @@ function _lowerStmt(stmt, line) {
     return { kind: 'assign', line, target, source: _lowerExpr(sourceText) };
   }
   // statement-form call
-  const cm = s.match(/^([A-Za-z_][\w.]*)\s*\((.*)\)\s*$/s);
+  const cm = matchBalancedCall(s, /^([A-Za-z_][\w.]*)/);
   if (cm) {
-    return { kind: 'call', line, callee: cm[1], args: _splitTopLevelCommas(cm[2]).map(_lowerExpr) };
+    return { kind: 'call', line, callee: cm.callee, args: _splitTopLevelCommas(cm.argsText).map(_lowerExpr) };
   }
   return { kind: 'unknown', line, text: s };
 }