@clear-capabilities/agentic-security-scanner 0.136.2 → 0.137.0

package/src/ir/parser-py.helper.py

@@ -12,7 +12,8 @@
 #   { file, functions: [
 #       { qid, name, line, params, file,
 #         cfg: { entry: nodeId, exit: nodeId, nodes: { id: node } } }
-#     ], topLevel: null }
+#     ], topLevel: <qid of synthetic <module> function, or null if the file
+#                   has no top-level statements worth lowering (PRD R14(b))> }
 #
 #   node = {
 #     kind: 'entry' | 'exit' | 'noop' | 'loop-header' | 'assign' | 'call'
@@ -595,7 +596,36 @@ def _process_one(file: str, content: str) -> dict[str, Any]:
     except SyntaxError as e:
         return {"file": file, "functions": [], "topLevel": None, "_error": f"syntax-error: {e.msg} (line {e.lineno})"}
     fns = _extract_functions(tree, file)
-    return {"file": file, "functions": fns, "topLevel": None}
+    # R14(b): lower top-level (module-scope) statements into a synthetic
+    # <module> function, mirroring parser-js.js's Program-level lowering.
+    # Only included when it carries real content — a FunctionDef/ClassDef
+    # encountered here lowers to a noop placeholder (_lower_stmt already
+    # does this so nested defs aren't double-counted; see _extract_functions
+    # above, which independently captures them via ast.walk), so a
+    # function-only file must not gain a <module> entry just because its
+    # single top-level statement happens to be a def.
+    mod_builder = CfgBuilder("<module>")
+    mod_builder.lower(tree.body)
+    mod_has_content = any(
+        n.get("kind") not in ("entry", "exit", "noop")
+        for n in mod_builder.nodes.values()
+    )
+    top_level_qid = None
+    if mod_has_content:
+        top_level_qid = _qid(file, "<module>", 1)
+        fns.append({
+            "qid": top_level_qid,
+            "name": "<module>",
+            "line": 1,
+            "params": [],
+            "file": file,
+            "cfg": {
+                "entry": mod_builder.entry,
+                "exit": mod_builder.exit,
+                "nodes": mod_builder.nodes,
+            },
+        })
+    return {"file": file, "functions": fns, "topLevel": top_level_qid}
 
 
 def main() -> int:

package/src/ir/parser-py.js

@@ -170,6 +170,7 @@ function _findTopLevel(s, sep) {
 function extractFunctions(text, file) {
   const lines = blankComments(text, 'py').split('\n');
   const fns = [];
+  const consumed = new Set();
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
     // Premortem #14: balanced-paren signature parse to handle default values
@@ -194,16 +195,18 @@ function extractFunctions(text, file) {
     const after = line.slice(p + 1);
     if (!/^\s*(?:->\s*[^:]+)?:\s*(?:#.*)?$/.test(after)) continue;
     const params = _splitArgs(paramsText).map(s => s.trim().split(/[:=]/)[0].trim()).filter(Boolean);
+    consumed.add(i + 1);
     // Collect body lines: anything indented strictly more than `indent`
     // until we hit a line with same-or-less indent.
     const body = [];
     let j = i + 1;
     while (j < lines.length) {
       const l = lines[j];
-      if (l.trim() === '') { body.push({ line: j + 1, text: '' }); j++; continue; }
+      if (l.trim() === '') { body.push({ line: j + 1, text: '' }); consumed.add(j + 1); j++; continue; }
       const li = l.match(/^(\s*)/)[1].length;
       if (li <= indent) break;
       body.push({ line: j + 1, text: l.slice(indent + 4) });   // strip one indent
+      consumed.add(j + 1);
       j++;
     }
     fns.push({
@@ -214,7 +217,22 @@ function extractFunctions(text, file) {
       body,
     });
   }
-  return fns;
+  return { fns, consumed, lines };
+}
+
+// R14(b): the complement of extractFunctions' consumed lines is the
+// module-level (top-level) statement text, lowered through the same
+// buildCfg() every real function body already uses. Only line text is
+// needed — buildCfg/_classifyLine already trim() before matching, so
+// leading indentation on a stray line is harmless.
+function _moduleLevelBody(lines, consumed) {
+  const body = [];
+  for (let i = 0; i < lines.length; i++) {
+    const lineNo = i + 1;
+    if (consumed.has(lineNo)) continue;
+    body.push({ line: lineNo, text: lines[i] });
+  }
+  return body;
 }
 
 // ── Build CFG from a function's body lines ──────────────────────────────
@@ -295,7 +313,7 @@ export function parsePythonFile(file, raw) {
   if (!file || !raw || typeof raw !== 'string') return null;
   if (!/\.py$/i.test(file)) return null;
   if (raw.length > 1_000_000) return null;
-  const fnRecs = extractFunctions(raw, file);
+  const { fns: fnRecs, consumed, lines } = extractFunctions(raw, file);
   const functions = fnRecs.map(fn => ({
     qid: fn.qid,
     name: fn.name,
@@ -304,9 +322,18 @@ export function parsePythonFile(file, raw) {
     cfg: buildCfg(fn),
     file,
   }));
+  const modBody = _moduleLevelBody(lines, consumed);
+  const modCfg = buildCfg({ body: modBody });
+  const modHasContent = Object.values(modCfg.nodes).some(n => n.kind !== 'entry' && n.kind !== 'exit' && n.kind !== 'noop');
+  let topLevel = null;
+  if (modHasContent) {
+    const modQid = `${file}::module::<module>`;
+    functions.push({ qid: modQid, name: '<module>', line: 1, params: [], cfg: modCfg, file });
+    topLevel = modQid;
+  }
   return {
     file,
     functions,
-    topLevel: null,
+    topLevel,
   };
 }

package/src/ir/parser-rb.js

@@ -21,8 +21,21 @@
 // failure (heredocs, multi-line strings can confuse the regex parser).
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
+import { matchBalancedCall } from './balanced-call.js';
 
-const DEF_RE = /(?:^|\n)\s*def\s+(?:self\.)?(\w+[?!=]?)\s*(?:\(([^)]*)\))?/g;
+// `[ \t]*` before the optional parameter list, NOT `\s*`.
+//
+// `\s*` crosses newlines, so for `def show\n  c = params[:c]` the match ran to
+// the next line's indentation. `parseRubyFile` then computes the body start as
+// `indexOf('\n', m.index + m[0].length)`, which landed on the newline at the END
+// of the first statement — so the body was sliced from after it and statement 1
+// of EVERY Ruby method was silently discarded (a single-statement body became
+// empty). In a Rails controller that first statement is almost always the
+// `params` read, i.e. the taint source, which is why `bench/layer-recall`
+// measured Ruby at 0/20 IR-TAINT recall while all 20 corpus entries passed on
+// the regex layer. A parameter list on the same line still matches.
+const DEF_RE = /(?:^|\n)[ \t]*def\s+(?:self\.)?(\w+[?!=]?)[ \t]*(?:\(([^)]*)\))?/g;
 
 function _extractRubyBody(src, defEnd) {
   let depth = 1;
@@ -66,33 +79,48 @@ function _extractRubyBody(src, defEnd) {
 const _RB_OPENERS = /^(?:if|unless|while|until|for|case|begin|do)\b/;
 const _RB_BLOCK_KW = /\b(?:def|class|module|if|unless|while|until|for|case|begin|do)\b/;
 
+// Returns `{ text, line }[]` — `line` is the 1-indexed line, relative to the
+// START of `body`, where that statement's text begins (the array index of
+// its first raw source line, +1). For a multi-line if/while/until block
+// this is the line of the OPENING keyword, not of `end`. Tracking this
+// directly from each raw line's position — rather than recomputing it
+// afterwards by counting newlines inside the joined, already-trimmed
+// statement text — avoids silently losing blank/comment lines that were
+// skipped along the way (they're dropped entirely by the `!line` guard
+// below and never contribute to any count once the text is joined). See
+// parser-php.js's twin fix and comment for the full rationale (Finding 2 of
+// the R14(b) final whole-branch review) — this is the same root bug in a
+// per-line splitter instead of a per-semicolon one.
 function _splitStatements(body) {
   const lines = body.split('\n');
   const out = [];
   let buf = '';
+  let bufLine = 0;
   let depth = 0;
-  for (const rawLine of lines) {
+  lines.forEach((rawLine, idx) => {
+    const lineNo = idx + 1;
     const line = rawLine.trim();
-    if (!line || line.startsWith('#')) continue;
+    if (!line || line.startsWith('#')) return;
     if (depth === 0 && _RB_OPENERS.test(line)) {
-      if (buf.trim()) out.push(buf.trim());
+      if (buf.trim()) out.push({ text: buf.trim(), line: bufLine });
       buf = line + '\n';
+      bufLine = lineNo;
       for (const m of line.matchAll(/\b(?:if|unless|while|until|for|case|begin|do|def|class|module)\b/g)) depth++;
       if (/\bend\b/.test(line)) depth--;
-      if (depth <= 0) { depth = 0; out.push(buf.trim()); buf = ''; }
-      continue;
+      if (depth <= 0) { depth = 0; out.push({ text: buf.trim(), line: bufLine }); buf = ''; }
+      return;
     }
     if (depth > 0) {
       buf += line + '\n';
       for (const m of line.matchAll(/\b(?:if|unless|while|until|for|case|begin|do|def|class|module)\b/g)) depth++;
       const endMatches = line.match(/\bend\b/g);
       if (endMatches) depth -= endMatches.length;
-      if (depth <= 0) { depth = 0; out.push(buf.trim()); buf = ''; }
-      continue;
+      if (depth <= 0) { depth = 0; out.push({ text: buf.trim(), line: bufLine }); buf = ''; }
+      return;
     }
-    out.push(line);
-  }
-  if (buf.trim()) out.push(buf.trim());
+    out.push({ text: line, line: lineNo });
+  });
+  if (buf.trim()) out.push({ text: buf.trim(), line: bufLine });
   return out;
 }
 
@@ -110,10 +138,15 @@ function _lowerExpr(text) {
   if (/^(true|false|nil)\b/.test(s)) return { kind: 'literal', value: s };
   // Symbol
   if (/^:\w+/.test(s)) return { kind: 'literal', value: s };
-  // Call: obj.method(args) or method(args)
-  const callMatch = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  // Call: obj.method(args) or method(args). matchBalancedCall finds the
+  // paren that actually balances the FIRST '(' — not the greedy-to-end-of-
+  // string match the old `/\((.*)\)\s*$/` used, which corrupted the
+  // argument text for a chained call (`sanitize(x).strip` produced
+  // args="x).strip", which then fell through to {kind:'unknown'} and
+  // silently dropped x).
+  const callMatch = matchBalancedCall(s, /^([\w.]+)/);
   if (callMatch) {
-    return { kind: 'call', callee: callMatch[1], args: _splitTopLevelCommas(callMatch[2]).map(_lowerExpr) };
+    return { kind: 'call', callee: callMatch.callee, args: _splitTopLevelCommas(callMatch.argsText).map(_lowerExpr) };
   }
   // Method call without parens is very common in Ruby but hard to detect
   // reliably with regex. We handle the explicit-paren form above.
@@ -179,13 +212,24 @@ function _lowerStmt(stmt, line) {
     return { kind: 'assign', line, target: assign[1], source: _lowerExpr(assign[2]) };
   }
   // Statement-form call with parens
-  const call = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  const call = matchBalancedCall(s, /^([\w.]+)/);
   if (call) {
-    return { kind: 'call', line, callee: call[1], args: _splitTopLevelCommas(call[2]).map(_lowerExpr) };
+    return { kind: 'call', line, callee: call.callee, args: _splitTopLevelCommas(call.argsText).map(_lowerExpr) };
   }
   // Statement-form call without parens (common Ruby idiom): redirect_to expr
+  //
+  // `class` and `module` must be excluded here: before R14(b), top-level
+  // text was never fed through `_lowerStmt` at all, so a wrapper like
+  // `class Foo < ApplicationController` never reached this heuristic. Now
+  // that every top-level statement is, an unguarded match lowers it to a
+  // bogus `{kind:'call', callee:'class', ...}` node — and since nearly
+  // every Ruby file wraps its top-level content in a `class`/`module`
+  // (an extremely common idiom), this alone caused most of this repo's own
+  // Ruby fixtures to gain a spurious `<module>` entry containing nothing
+  // but this one bogus node, contradicting the "zero existing fixtures
+  // gain a <module> entry" constraint for Ruby specifically.
   const bareCall = s.match(/^([a-z_]\w*)\s+(.+)$/s);
-  if (bareCall && /^[a-z_]/.test(bareCall[1]) && !/^(?:if|unless|while|until|for|case|when|elsif|else|end|return|raise|require|include|extend|attr_\w+)$/.test(bareCall[1])) {
+  if (bareCall && /^[a-z_]/.test(bareCall[1]) && !/^(?:if|unless|while|until|for|case|when|elsif|else|end|return|raise|require|include|extend|attr_\w+|class|module)$/.test(bareCall[1])) {
     return { kind: 'call', line, callee: bareCall[1], args: [_lowerExpr(bareCall[2])] };
   }
   return null;
@@ -202,6 +246,47 @@ function _qid(file, name, line, body) {
   return `${file}::${name}@${line}#${sha}`;
 }
 
+// DEF_RE's leading alternation `(?:^|\n)` matches a single boundary
+// character (the newline ending the PRECEDING line) that belongs to
+// whatever precedes the def, not to the def itself. `m.index` always points
+// at the START of that boundary. `_blank` (below) never touches actual `\n`
+// characters — only non-newline characters are turned into spaces — so
+// including this boundary newline in the def's span would be harmless
+// either way; this still excludes it, purely so the span's meaning (source
+// consumed by the def declaration) doesn't include a character that
+// belongs to the previous line, mirroring parser-php.js's twin fix (there
+// the equivalent boundary CAN be a non-newline character like `;`, which
+// does need excluding).
+function _defBoundaryLen(idx) {
+  return idx === 0 ? 0 : 1;
+}
+
+// Blank out every real def's span in a COPY of the full source (replace its
+// characters with spaces, preserving every newline exactly). This lets the
+// WHOLE file be lowered in a single _buildCfg call at startLine=1 for the
+// module-level CFG, which keeps every remaining statement's reported line
+// number exactly equal to its real source line — no character is ever
+// deleted, only turned into a space, so nothing can shift. This replaces
+// the old per-gap slicing + per-gap startLine re-derivation, which
+// mis-tracked lines whenever a gap slice started with leading
+// blank/newline characters and broke the line-scoped
+// `agentic-security-ignore` suppression pragma for module-level findings.
+function _blankSpans(code, spans) {
+  let out = '';
+  let cursor = 0;
+  for (const span of spans) {
+    if (span.start > cursor) out += code.slice(cursor, span.start);
+    out += _blank(code.slice(span.start, span.end));
+    cursor = span.end;
+  }
+  out += code.slice(cursor);
+  return out;
+}
+
+function _blank(text) {
+  return text.replace(/[^\n]/g, ' ');
+}
+
 let _nid = 0;
 function _nextId() { return `rn${++_nid}`; }
 
@@ -225,13 +310,22 @@ function _extractRubyBlockBody(compound) {
   return lines.slice(1, -1).join('\n');
 }
 
+// `startLine` is the absolute source line of the FIRST raw line of
+// `bodyText`. Each statement's absolute line is `startLine + stmt.line - 1`
+// (`stmt.line` from _splitStatements is already 1-indexed and relative to
+// `bodyText`), so — unlike the old incremental `line++`/`line += newlines+1`
+// bookkeeping this replaced — no line is ever derived by re-counting
+// newlines in already-joined, already-trimmed text. That old scheme
+// silently dropped any blank line (or, at module level, any blanked-out def
+// span — see `_blankSpans`) that preceded a statement, which is exactly
+// what made module-level Ruby findings report the wrong source line.
 function _buildCfg(bodyText, nodes, prevId, startLine) {
   const stmts = _splitStatements(bodyText);
   let prev = prevId;
-  let line = startLine;
   for (const stmt of stmts) {
-    const s = stmt.trim();
-    if (!s || s.startsWith('#')) { line++; continue; }
+    const s = stmt.text;
+    const line = startLine + stmt.line - 1;
+    if (!s || s.startsWith('#')) continue;
 
     const ifMatch = s.match(/^(if|unless)\s+(.+)$/m);
     if (ifMatch && /\bend\b\s*$/.test(s)) {
@@ -244,7 +338,6 @@ function _buildCfg(bodyText, nodes, prevId, startLine) {
       _linkNodes(nodes, thenTail, join);
       _linkNodes(nodes, ifNode, join);
       prev = join;
-      line += (s.match(/\n/g) || []).length + 1;
       continue;
     }
 
@@ -258,16 +351,14 @@ function _buildCfg(bodyText, nodes, prevId, startLine) {
       const join = _addNode(nodes, { kind: 'noop', line });
       _linkNodes(nodes, header, join);
       prev = join;
-      line += (s.match(/\n/g) || []).length + 1;
       continue;
     }
 
     const node = _lowerStmt(s, line);
-    if (!node) { line += (s.match(/\n/g) || []).length + 1; continue; }
+    if (!node) continue;
     const id = _addNode(nodes, node);
     _linkNodes(nodes, prev, id);
     prev = id;
-    line += (s.match(/\n/g) || []).length + 1;
   }
   return prev;
 }
@@ -278,6 +369,7 @@ export function parseRubyFile(file, code) {
   if (code.length > 1_000_000) return null;
 
   const functions = [];
+  const spans = []; // {start, end}: source ranges fully consumed by a matched def (header through matching `end`)
   DEF_RE.lastIndex = 0;
   _nid = 0;
   let m;
@@ -298,12 +390,55 @@ export function parseRubyFile(file, code) {
     const exit = _addNode(nodes, { kind: 'exit', line: startLine });
     const tail = _buildCfg(extracted.body, nodes, entry, startLine + 1);
     _linkNodes(nodes, tail, exit);
+    const cfg = { entry, exit, nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry, exit, nodes },
+      cfg,
+      // Ruby never emitted `fn.calls` at all (ir/CLAUDE.md documents this
+      // as a known gap) — tabulation.js, dataflow/index.js and
+      // callgraph.js all read it to build call edges, so an absent array
+      // is indistinguishable from "calls nothing," disabling ALL Ruby
+      // interprocedural taint. call-sites.js's callSitesFromCfg is the
+      // same language-agnostic CFG walk parser-py-cst.js already uses for
+      // exactly this; Ruby's node shapes ('call' with callee/args,
+      // 'assign' with source, 'return'/'throw' with value, 'if' with
+      // cond) match its documented contract already, so no new lowering
+      // logic is needed here — only wiring the call.
+      calls: callSitesFromCfg(cfg),
     });
+    spans.push({ start: m.index + _defBoundaryLen(m.index), end: extracted.end });
     DEF_RE.lastIndex = extracted.end;
   }
-  return functions.length ? { file, functions, topLevel: null } : null;
+
+  // R14(b): lower top-level (module-scope) statements into a synthetic
+  // <module> function, mirroring parser-js.js's Program-level lowering.
+  // Every real def's span is blanked (see _blankSpans) in a copy of the
+  // full source, and the WHOLE blanked text is lowered in a single
+  // _buildCfg call at startLine=1 — this keeps every remaining statement's
+  // reported line number exactly equal to its real source line, since no
+  // character is ever deleted, only blanked to a space (newlines always
+  // survive). Same approach as parser-php.js's twin fix.
+  spans.sort((a, b) => a.start - b.start);
+  const blanked = _blankSpans(code, spans);
+  const modNodes = {};
+  const modEntry = _addNode(modNodes, { kind: 'entry', line: 1 });
+  const modExit = _addNode(modNodes, { kind: 'exit', line: 1 });
+  const modTail = _buildCfg(blanked, modNodes, modEntry, 1);
+  _linkNodes(modNodes, modTail, modExit);
+  const modHasContent = Object.values(modNodes).some(n => n.kind !== 'entry' && n.kind !== 'exit');
+  let topLevel = null;
+  if (modHasContent) {
+    const moduleCfg = { entry: modEntry, exit: modExit, nodes: modNodes };
+    const modQid = _qid(file, '<module>', 1, code);
+    functions.push({
+      qid: modQid,
+      name: '<module>', line: 1, params: [], file,
+      cfg: moduleCfg,
+      calls: callSitesFromCfg(moduleCfg),
+    });
+    topLevel = modQid;
+  }
+
+  return functions.length ? { file, functions, topLevel } : null;
 }

package/src/ir/ssa.js

@@ -43,7 +43,12 @@ export function isSSAEnabled() {
  *
  * Returns Map<nodeId, Set<nodeId>>  — dom[n] = set of nodes that dominate n.
  */
-function computeDominators(cfg) {
+// Exported (Stage 6 correctness audit) so dataflow/implicit-flow.js can
+// reuse this tested algorithm to correctly scope "is node N genuinely
+// inside branch B" (N is inside iff B dominates N — every path to N passes
+// through B) instead of a path-dependent DFS depth counter that had no way
+// to detect a branch's join point.
+export function computeDominators(cfg) {
   const nodes = Object.keys(cfg.nodes || {});
   const entry = cfg.entry;
   const dom = new Map();

package/src/lsp/server.js

@@ -18,6 +18,8 @@ import * as path from 'node:path';
 import * as readline from 'node:readline';
 import { runScan } from '../runScan.js';
 import { resetCustomRulesBudget } from '../posture/custom-rules.js';
+import { redactFinding } from '../mcp/redact.js';
+import { _remediationOf } from '../report/index.js';
 
 const PROTOCOL_VERSION = '3.17';
 const SERVER_NAME = 'agentic-security-lsp';
@@ -52,6 +54,13 @@ function sevToLsp(sev) {
 
 function findingToDiagnostic(f) {
   const line = Math.max(0, (f.line || 1) - 1);
+  // Stage 6 correctness audit: this read f.remediation directly, but raw
+  // scan.findings entries (what this consumes, pre-normalizeFindings) come
+  // from two conventions — most posture/*.js and newer sast/*.js modules
+  // set `remediation`, while ~127 of engine.js's own detectors set a `fix`
+  // STRING field instead. _remediationOf carries the same precedence
+  // report/index.js already established for this exact split (CMP-3).
+  const remediation = _remediationOf(f);
   return {
     range: {
       start: { line, character: 0 },
@@ -60,7 +69,7 @@ function findingToDiagnostic(f) {
     severity: sevToLsp(f.severity),
     source: 'agentic-security',
     code: f.cwe || f.family || 'finding',
-    message: `${f.vuln || 'Security finding'}${f.remediation ? '\n\n' + (typeof f.remediation === 'string' ? f.remediation : '') : ''}`.slice(0, 2000),
+    message: `${f.vuln || 'Security finding'}${remediation ? '\n\n' + remediation : ''}`.slice(0, 2000),
     tags: [],
   };
 }
@@ -141,8 +150,27 @@ async function scanFile(uri) {
     // the reset, a long-lived LSP server would accumulate budget across saves
     // and eventually start skipping custom rules.
     resetCustomRulesBudget(_rootDir);
-    const { scan } = await runScan(_rootDir, { fileContents, depFileContents });
-    const findings = (scan.findings || []).filter(f => f.file === rel);
+    // PRD R1 (docs/DETECTION_GAP_REMEDIATION_PRD.md): deep mode is
+    // default-on for the interactive CLI scan but was never requested here,
+    // so every on-save diagnostic pass was regex/AST-only — blind to any bug
+    // whose source and sink are connected only through a call. Scoped to
+    // exactly the saved file (fileContents has one entry), so this does not
+    // turn every keystroke's save into a full-project deep scan.
+    const { scan } = await runScan(_rootDir, { fileContents, depFileContents, deep: true, deepInCi: true });
+    // Stage 6 correctness audit: this only ever read scan.findings (the SAST
+    // channel). scan.secrets and scan.logicVulns are separate arrays on the
+    // raw runScan() result — normalizeFindings is what merges all four
+    // channels, and that hasn't run here — so a saved file with a hardcoded
+    // credential got a clean problem pane, no diagnostic at all. Unlike the
+    // MCP surface, this server never applied redactFinding either (nothing
+    // here imported mcp/redact.js), which would have been a landmine the
+    // moment secrets/logicVulns were added without it: those channels are
+    // exactly where raw secret material shows up in `snippet`. Both fixed
+    // together — merge the channels AND redact — so the fix for one gap
+    // doesn't open the other.
+    const findings = [...(scan.findings || []), ...(scan.secrets || []), ...(scan.logicVulns || [])]
+      .filter(f => f.file === rel)
+      .map(f => redactFinding(f));
     await publishDiagnostics(uri, findings);
   } catch (e) {
     process.stderr.write(`agentic-security-lsp: scan failed: ${e.message}\n`);
@@ -273,3 +301,7 @@ export function startLspServer() {
 if (import.meta.url === `file://${process.argv[1]}`) {
   startLspServer();
 }
+
+function _setRootDir(dir) { _rootDir = dir; _depCache = { rootDir: null, depFileContents: {} }; }
+
+export const _internals = { findingToDiagnostic, scanFile, uriToPath, pathToUri, _diagnosticsByUri, _setRootDir };

package/src/mcp/CLAUDE.md

@@ -12,14 +12,21 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 | `find_rule_module` | ✓ | reads `scanner/src/{sast,posture}/` to answer "which file detects CWE-X / family Y" |
 | `lookup_cve` | ✓ | reads local OSV / KEV / EPSS cache; staleness-tiered |
 | `synthesize_fix` | ✓ | reads last-scan; returns the patch text |
-| `verify_fix` | ✓ | re-scans patched files in memory + runs lint; no writes |
+| `verify_fix` | ✗ | re-scans patched files in memory, runs lint + the project test suite + the fix-honesty gate + PoC re-check; does not touch the target project's own files, but appends a record to `.agentic-security/fix-metrics.jsonl` per attempt |
 | `apply_fix` | ✗ | writes via `posture/fix-history.js` (with backup) |
 | `append_scratchpad` | ✗ | writes under `.agentic-security/agent-scratchpad/<agent>/<session>/` only |
 | `read_scratchpad` | ✓ | paginated read of scratchpad files |
 | `append_agents_memory` | ✗ | appends to `.agentic-security/AGENTS.md` continual-learning file |
 | `read_agents_memory` | ✓ | tail of `.agentic-security/AGENTS.md` |
+| `synthesize_sca_upgrade` | ✓ | runs an ecosystem dry-run (`npm install --dry-run` etc.); returns the upgrade plan; no writes |
+| `apply_sca_upgrade` | ✗ | backs up manifests, runs the package manager, runs the project test command, restores manifests on test failure |
+| `query_triage_memory` | ✓ | reads past triage decisions (wont-fix/false-positive) by natural-language query |
+| `query_findings_memory` | ✓ | reads accumulated scan memory (findings + triage history + AGENTS.md) by natural-language query |
+| `query_cache_telemetry` | ✓ | reads prompt-cache economics from the current session transcript; no network |
 
-`apply_fix` is the only write tool. It requires `confirm:true` AND the last-scan HMAC to verify AND the target path not on the reserved-write list.
+**17 tools, not 12** — this table previously stopped at 12 and the count quoted elsewhere (root `CLAUDE.md`, the non-Claude plugin manifests) said "Six." Re-derive with `grep -c "name: '" scanner/src/mcp/tools.js` rather than trusting a hardcoded number here again.
+
+**Two write tools, not one.** `apply_fix` and `apply_sca_upgrade` both write; `verify_fix` also writes (see its row above) though not to the target project's own files. `apply_fix` additionally requires `confirm:true` AND the last-scan HMAC to verify AND the target path not on the reserved-write list; `apply_sca_upgrade` requires `confirm:true` and gates on its own test-restore cycle.
 
 ## Hardening posture (OWASP MCP Top 10)
 

package/src/mcp/redact.js

@@ -27,6 +27,32 @@ const PATTERNS = [
   [/rk_(?:live|test)_[A-Za-z0-9]{20,}/g, 'stripe-restricted-key'],
   [/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g, 'sendgrid-key'],
   [/AIza[0-9A-Za-z_-]{35}/g, 'google-api-key'],
+  // Stage 4 correctness audit (coverage breadth, AI security): this list
+  // only covered a small subset of what the scanner's OWN credential
+  // detector (engine.js's CREDENTIAL_PATTERNS, 40+ provider shapes) finds
+  // — a Shopify/Telegram/Twilio/Discord-webhook/Square/Google-OAuth/JDBC
+  // secret detected and reported by a scan reached explain_finding's
+  // output completely unredacted, because none of those shapes were in
+  // THIS separate, narrower list. Reusing the same regex bodies as
+  // engine.js's CREDENTIAL_PATTERNS for the shapes verified to leak
+  // (rather than importing engine.js itself, which would pull its entire
+  // multi-thousand-line module graph into the MCP server's dependency
+  // surface for a handful of consts).
+  [/ya29\.[0-9A-Za-z_-]{20,}/g, 'google-oauth-token'],
+  [/shp(?:at|ss|ca|pa)_[a-fA-F0-9]{32}/g, 'shopify-token'],
+  [/(?<![0-9])[0-9]{8,10}:AA[0-9A-Za-z_-]{33}(?![A-Za-z0-9_])/g, 'telegram-bot-token'],
+  [/twilio.{0,20}SK[0-9a-fA-F]{32}/gi, 'twilio-api-key'],
+  [/sq0atp-[0-9A-Za-z_-]{22}/g, 'square-access-token'],
+  [/sq0csp-[0-9A-Za-z_-]{43}/g, 'square-oauth-secret'],
+  [/access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}/g, 'paypal-braintree-token'],
+  [/https:\/\/(?:discordapp|discord)\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g, 'discord-webhook'],
+  [/https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]{8}\/B[a-zA-Z0-9_]{8,12}\/[a-zA-Z0-9_]{24}/g, 'slack-webhook'],
+  [/https:\/\/outlook\.office\.com\/webhook\/[A-Za-z0-9\-@]+\/IncomingWebhook\/[A-Za-z0-9-]+\/[A-Za-z0-9-]+/g, 'teams-webhook'],
+  [/https:\/\/(?:www\.)?hooks\.zapier\.com\/hooks\/catch\/[A-Za-z0-9]+\/[A-Za-z0-9]+\//g, 'zapier-webhook'],
+  // JDBC connection string carrying a password: only redact when password
+  // evidence is actually on the line (matches engine.js's own ctx gate),
+  // so a credential-free JDBC URL in docs isn't needlessly mangled.
+  [/jdbc:[a-z:]+:\/\/[A-Za-z0-9.\-_:;=/@?,&]*(?:@|password=|passwd=|pwd=)[A-Za-z0-9.\-_:;=/@?,&]*/gi, 'jdbc-connection-string'],
   // JWT — three dot-separated b64url segments starting with eyJ
   [/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, 'jwt'],
   // PEM-encoded private keys