@clear-capabilities/agentic-security-scanner 0.136.2 → 0.137.0

package/src/report/index.js

@@ -24,7 +24,12 @@ function riskNote(f) {
   const et = String(f.exploitabilityTier || '').toLowerCase();
   if (et === 'minimal' || et === 'low') return `likely lower risk — ${et} exploitability`;
   const ct = String(f.confidenceTier || '').toLowerCase();
-  if (ct === 'low' || (typeof f.confidence === 'number' && f.confidence > 0 && f.confidence < 0.5)) {
+  // `f.confidence` is clamped to [0,1] by posture/confidence.js and 0 is a
+  // real, reachable value (unset confidence normalizes to `null`, not 0) —
+  // the single worst score this note exists to catch. A `> 0` lower bound
+  // exempted exactly that value from the downgrade note a 0.05 finding
+  // correctly got.
+  if (ct === 'low' || (typeof f.confidence === 'number' && f.confidence < 0.5)) {
     return 'lower confidence — verify before prioritising';
   }
   return null;
@@ -83,6 +88,25 @@ function fingerprint(f){
   return crypto.createHash('sha256').update(s).digest('hex').slice(0, 16);
 }
 
+// CMP-3: the findings schema requires `remediation` (root CLAUDE.md), and
+// most detectors set it, but normalizeFindings only ever read the older
+// `fix` STRING field that a minority of detectors use — so for every
+// detector using the documented schema field, the SARIF fixes[]/
+// fullDescription, the Markdown Fix column, and the CLI inline "fix:" line
+// all rendered empty. `fix` still wins when both are set, matching the
+// existing precedence in explainParts() above.
+// Exported (Stage 6) so other raw-finding consumers outside this module —
+// mcp/tools.js's scan_diff, lsp/server.js — that read scan.findings BEFORE
+// normalizeFindings ever touches it can apply the same fix-string-vs-
+// remediation-field precedence instead of re-implementing it ad hoc (and
+// getting it wrong the way both of those did — reading only `.remediation`,
+// which ~127 of engine.js's own detectors never set).
+export function _remediationOf(f) {
+  if (f && typeof f.fix === 'string') return f.fix;
+  if (typeof f?.remediation === 'string') return f.remediation;
+  return null;
+}
+
 export function normalizeFindings(scan){
   const out = [];
   // Feat-4: filter findings via custom suppressions, recording the suppression
@@ -109,11 +133,13 @@ export function normalizeFindings(scan){
       file: f.file,
       line: f.line || f.source?.line || f.sink?.line || 0,
       snippet: f.snippet || f.source?.snippet || f.sink?.snippet || '',
-      fix: f.fix ? { description: f.fix, code: f.code || '' } : null,
+      fix: _remediationOf(f) ? { description: _remediationOf(f), code: f.code || '' } : null,
+      remediation: _remediationOf(f),
       reachable: f.reachable ?? null,
       triage: f.triageScore ?? null,
       dataClasses: f.dataClasses || [],
       chain: Array.isArray(f.chain) ? f.chain : null,
+      sourceProvenance: f.sourceProvenance || null,
       confidence: typeof f.confidence === 'number' ? f.confidence : null,
       // R17: corroboration ("one issue, many signals") — count of independent
       // analyses that agreed, and which ones.
@@ -237,6 +263,65 @@ export function normalizeFindings(scan){
       predictedBountyUsd: f.predictedBountyUsd || null,
       bountyConfidence: f.bountyConfidence || null,
       attackPlaybook: f.attackPlaybook || null,
+      // posture/git-history.js#annotateGitHistory — git blame + commit
+      // context, including AI-authorship detection via the Claude
+      // co-author trailer. Wired in engine.js but previously dropped here.
+      introducedBy: f.introducedBy || null,
+      introducedIn: f.introducedIn || null,
+      introducedAt: f.introducedAt || null,
+      introducedInMessage: f.introducedInMessage || null,
+      originatingPrompt: f.originatingPrompt || null,
+      aiAuthored: f.aiAuthored === true,
+      // posture/risk-dollars.js#annotateRiskDollars,
+      // posture/time-to-fix.js#annotateTimeToFix — same class of gap.
+      riskDollars: f.riskDollars || null,
+      estimatedFixHours: typeof f.estimatedFixHours === 'number' ? f.estimatedFixHours : null,
+      estimatedFixHoursSource: f.estimatedFixHoursSource || null,
+      // posture/composite-risk.js#annotateCompositeRisk — the module's own
+      // header calls this "the canonical sort key" for agents/UI; toProTable
+      // silently fell back to the older `triage` field because this was
+      // never in the allowlist.
+      compositeRisk: typeof f.compositeRisk === 'number' ? f.compositeRisk : null,
+      compositeRiskTier: f.compositeRiskTier || null,
+      compositeRiskFactors: Array.isArray(f.compositeRiskFactors) ? f.compositeRiskFactors : null,
+      // posture/relevance.js#annotateRelevance — entrypoint-reachability
+      // verdict + audit trail. The re-ranked `exploitability` it also sets
+      // did survive normalization; the verdict fields explaining WHY did not.
+      entrypointReachable: f.entrypointReachable ?? null,
+      relevance: typeof f.relevance === 'number' ? f.relevance : null,
+      relevanceTier: f.relevanceTier || null,
+      relevanceFactors: Array.isArray(f.relevanceFactors) ? f.relevanceFactors : null,
+      // posture/attack-taxonomy.js#annotateAttackTaxonomy — default-on;
+      // toProTable's `capec`/`mitre` columns read these and rendered `—`
+      // for every finding because they were never in this allowlist.
+      attck: f.attck || null,
+      attckName: f.attckName || null,
+      attckTactic: f.attckTactic || null,
+      atlas: f.atlas || null,
+      atlasName: f.atlasName || null,
+      d3fend: f.d3fend || null,
+      capec: f.capec || null,
+      // posture/falsification.js#annotateFalsification, which records its
+      // verdict via posture/verification-separation.js — recall-preserving
+      // (never removes a finding, never touches severity), but the verdict
+      // itself needs to survive to output or a quarantined finding ships
+      // indistinguishable from one nobody contested.
+      falsification: f.falsification || null,
+      quarantined: f.quarantined === true,
+      // The canonical schema (scanner/CLAUDE.md) documents `description` as
+      // a required field distinct from `vuln` (headline) and `remediation`
+      // (fix instructions) — ~47 SAST detectors set finding-specific "why
+      // this fired" prose here. It was never in this allowlist, so it was
+      // silently dropped between the detector and every report format.
+      description: f.description || null,
+      // posture/threat-model-grounding.js#applyThreatModel — crown-jewel /
+      // out-of-scope / compliance-regime / attacker-model tags. The severity
+      // bump/demotion it also performs mutates `severity` directly (so that
+      // half already survived normalization); this object itself did not.
+      threatModel: f.threatModel || null,
+      verification: f.verification || null,
+      // posture/pattern-propagation.js#annotateCrossRepoSignals — default-on.
+      crossRepoSignal: f.crossRepoSignal || null,
     });
   }
   for (const s of (scan.secrets||[])) {
@@ -250,11 +335,19 @@ export function normalizeFindings(scan){
       stride: s.stride || 'Information Disclosure',
       file: s.file, line: s.line, snippet: s.snippet || '',
       masked: s.masked || null,
-      fix: s.fix ? { description: s.fix, code: s.code || '' } : null,
+      fix: _remediationOf(s) ? { description: _remediationOf(s), code: s.code || '' } : null,
+      remediation: _remediationOf(s),
       blastRadius: s.blastRadius || null,
       // Premortem #8: parser/family for downstream confidence + calibration.
       parser: s.parser || 'SECRETS',
       family: s.family || 'hardcoded-secret',
+      // secret-history.js sets these on a git-history-sweep finding (the
+      // commit it was found in, and a flag distinguishing it from a
+      // working-tree finding) — carried through so a consumer doesn't have
+      // to parse the commit sha back out of the synthetic `file` value.
+      commit: s.commit || null,
+      historical: s._historical === true,
+      description: s.description || null,
     });
   }
   for (const lv of (scan.logicVulns||[])) {
@@ -267,11 +360,21 @@ export function normalizeFindings(scan){
       cwe: lv.cwe || null,
       stride: lv.stride || null,
       file: lv.file, line: lv.line, snippet: lv.snippet || '',
-      fix: lv.fix ? { description: lv.fix, code: lv.code || '' } : null,
+      fix: _remediationOf(lv) ? { description: _remediationOf(lv), code: lv.code || '' } : null,
+      remediation: _remediationOf(lv),
       blastRadius: lv.blastRadius || null,
       // Premortem #8.
       parser: lv.parser || 'LOGIC',
       family: lv.family || null,
+      // evaluateLicensePolicy (kind:'license') sets these so a consumer can
+      // identify WHICH component/license triggered the finding without
+      // regex-parsing the prose `vuln` string. Harmless no-op (all null)
+      // for every other logicVulns kind that doesn't set them.
+      package: lv.package || null,
+      version: lv.version || null,
+      ecosystem: lv.ecosystem || null,
+      license: lv.license || null,
+      description: lv.description || null,
     });
   }
   for (const sc of (scan.supplyChain||[])) {
@@ -281,6 +384,12 @@ export function normalizeFindings(scan){
     out.push({
       id: fingerprint(sc),
       kind: 'sca',
+      // sc.type discriminates vulnerable_dep | unpinned_dep | no_lockfile
+      // (src/sca/CLAUDE.md). Every MCP SCA-upgrade tool checks this field
+      // on findings looked up from the PERSISTED (toJSON-serialized) scan —
+      // dropping it here made synthesize_sca_upgrade/apply_sca_upgrade
+      // refuse every real SCA finding unconditionally.
+      type: sc.type || 'vulnerable_dep',
       severity: sc.severity || 'high',
       vuln: scVuln,
       cwe: sc.cwe || null,
@@ -421,6 +530,22 @@ export function toJSON(scan, meta={}, opts={}){
     // signature proves who asked for it, not that the results are absent.
     suppressedRules: scan.suppressedRules || null,
     _scanMeta: scan._scanMeta || null,
+    // S7: engine.js computes these on every scan with components, and their
+    // own findings already flow into `findings` above — but the structured
+    // summary objects (per-component license map, drift counts, "first
+    // scan, no baseline yet") were previously dropped here, so they never
+    // reached last-scan.json (written from this function's return value)
+    // or any --format output at all.
+    licenseGraph: scan.licenseGraph || null,
+    sbomDiff: scan.sbomDiff || null,
+    entrypointInventory: scan.entrypointInventory || null,
+    // S7: same class of gap as the three above — computed on every scan
+    // (rootCauseSweep unconditionally; attackTaxonomy/privacyFramework each
+    // default-on unless their own AGENTIC_SECURITY_NO_*/opt-in env var says
+    // otherwise) but never reached last-scan.json or any --format output.
+    rootCauseSweep: scan.rootCauseSweep || null,
+    attackTaxonomy: scan.attackTaxonomy || null,
+    privacyFramework: scan.privacyFramework || null,
   };
   if (opts.includeSuppressed) out.suppressed = scan.suppressions||[];
   return out;
@@ -462,7 +587,10 @@ export function toSTIX(scan, meta = {}) {
       created: now,
       modified: now,
       name: `${f.vuln || 'Security finding'} at ${f.file || '?'}:${f.line || '?'}`,
-      description: f.fix?.description || f.vuln || '',
+      // Same precedence fix as toSARIF's fullDescription/message: the
+      // detector's own description of the finding beats remediation text,
+      // which beats degrading to the bare vuln title.
+      description: f.description || f.fix?.description || f.vuln || '',
       external_references: cweExt,
       labels: [f.severity || 'unknown'],
       // x_* extension fields — STIX 2.1 allows custom properties prefixed
@@ -615,7 +743,14 @@ export function toSARIF(scan, meta={}){
     id: f.vuln.replace(/[^a-zA-Z0-9]/g, '_'),
     name: f.vuln,
     shortDescription: { text: f.vuln },
-    fullDescription: { text: f.fix?.description || f.vuln },
+    // Prefer the detector's own explanation of the finding (`description`)
+    // over remediation text — `fix?.description` is fix instructions, not
+    // an account of the vulnerability. Falling back to remediation (rather
+    // than degrading to the bare rule title, already shown in
+    // shortDescription/name) when no description was set is intentional —
+    // see CMP-3's test asserting a remediation-only finding still gets a
+    // non-degenerate fullDescription.
+    fullDescription: { text: f.description || f.fix?.description || f.vuln },
     helpUri: f.cwe ? `https://cwe.mitre.org/data/definitions/${f.cwe.replace(/[^0-9]/g,'')}.html` : undefined,
     properties: { tags: [f.cwe, f.stride].filter(Boolean) },
   });
@@ -680,7 +815,7 @@ export function toSARIF(scan, meta={}){
         return {
         ruleId: f.vuln ? f.vuln.replace(/[^a-zA-Z0-9]/g, '_') : 'unknown',
         level: SEV_TO_SARIF[f.severity] || 'warning',
-        message: { text: f.fix?.description || f.vuln || 'Security finding' },
+        message: { text: f.description || f.fix?.description || f.vuln || 'Security finding' },
         locations: [{ physicalLocation: { artifactLocation: { uri: f.file }, region: { startLine: Math.max(1, f.line||1) } } }],
         ...(codeFlows ? { codeFlows } : {}),
         ...(fixes ? { fixes } : {}),
@@ -792,7 +927,12 @@ export function toHTML(scan, meta = {}) {
   for (const f of findings) byFile[f.file] = (byFile[f.file] || 0) + 1;
   const hotspots = Object.entries(byFile).sort((a,b)=>b[1]-a[1]).slice(0, 10);
   const data = JSON.stringify(findings).replace(/</g, '\\u003c');
-  const generatedAt = new Date().toISOString();
+  // Every other emitter falls back to meta.startedAt (which
+  // posture/deterministic.js forces to a fixed value under --deterministic)
+  // before minting a fresh timestamp — toHTML never consulted it, so it was
+  // the one format that stayed non-deterministic run-to-run even under
+  // --deterministic.
+  const generatedAt = meta.startedAt || new Date().toISOString();
   const SEV_HEX = { critical: '#ff2d55', high: '#ff6b35', medium: '#ffb800', low: '#34d058', info: '#82aaff' };
   const sevBars = Object.entries(counts).map(([k, v]) =>
     `<div class="sev-row"><span class="sev-tag" style="background:${SEV_HEX[k]}22;color:${SEV_HEX[k]}">${k}</span><span class="sev-bar" style="width:${Math.min(100, v * 4)}%;background:${SEV_HEX[k]}"></span><span class="sev-num">${v}</span></div>`
@@ -1098,8 +1238,29 @@ export function toShipVerdict(scan, options = {}) {
   const profile = options.profile || { confidenceMin: CONF_DEFAULT_VIB, showTaxonomy: false };
   const color = options.color !== false;
   const c = (s, code) => color ? `${code}${s}${RESET}` : s;
-  const findings = _withConfidence(normalizeFindings(scan), profile.confidenceMin ?? CONF_DEFAULT_VIB);
-  const actionable = findings.filter(f => /critical|high/.test(f.severity));
+  // CMP-4 (Stage-0 audit, 2026): the safety headline (Safe/Not-safe-to-deploy)
+  // and the critical/high counts that drive it MUST come from the FULL
+  // finding set, matching exitCodeFor — confidence filtering must never be
+  // able to make a real critical/high invisible to the verdict. Before this
+  // fix, `findings` was confidence-filtered BEFORE the severity split, so a
+  // critical at confidence 0.85 (below the 0.9 vibecoder floor) made the
+  // verdict print "Safe to deploy" while exitCodeFor — reading the same scan
+  // unfiltered — returned 3. Same scan, contradictory answers depending on
+  // which one you read.
+  //
+  // Confidence filtering KEEPS its legitimate purpose for low/medium/info
+  // findings — those never gate the safety verdict, so hiding noisy
+  // low-signal ones from a non-expert reader is a reasonable UX choice, not a
+  // security decision. What changes is that low/medium/info findings hidden
+  // this way are now DISCLOSED by count rather than silently vanishing,
+  // matching the project's no-silent-truncation convention.
+  const allFindings = normalizeFindings(scan);
+  const min = profile.confidenceMin ?? CONF_DEFAULT_VIB;
+  const criticalOrHighAll = allFindings.filter(f => /critical|high/.test(f.severity));
+  const restFiltered = _withConfidence(allFindings.filter(f => !/critical|high/.test(f.severity)), min);
+  const findings = [...criticalOrHighAll, ...restFiltered];
+  const filteredOutCount = allFindings.length - findings.length;
+  const actionable = criticalOrHighAll;
   const advisoryCount = findings.length - actionable.length;
   const sev = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
   for (const f of findings) sev[f.severity] = (sev[f.severity] || 0) + 1;
@@ -1164,6 +1325,12 @@ export function toShipVerdict(scan, options = {}) {
   } else if (advisoryCount > 0) {
     lines.push(c(`  ${advisoryCount} advisory item${advisoryCount === 1 ? '' : 's'} — run /security-scan-all --firehose to see them.`, DIM));
   }
+  // No-silent-truncation: a low/medium/info finding hidden by the confidence
+  // floor must be disclosed by count. Critical/high are never in this count —
+  // see filteredOutCount's computation above.
+  if (filteredOutCount > 0) {
+    lines.push(c(`  ${filteredOutCount} more below your confidence threshold — run /security-scan-all --firehose to see them.`, DIM));
+  }
   // Discoverability: the depth (per-finding explanation) and the shareable report
   // exist but aren't obvious from the one-screen verdict — point to them.
   if (findings.length > 0) {
@@ -1201,10 +1368,12 @@ export function toProTable(scan, options = {}) {
   const columns = options.columns || 'standard'; // 'standard' | 'mitre' | 'capec' | 'owasp'
   const findings = _withConfidence(normalizeFindings(scan), profile.confidenceMin ?? CONF_DEFAULT_PRO);
 
-  // Rank by triage score (or severity rank if absent).
+  // Rank by compositeRisk (the canonical priority key, per composite-risk.js's
+  // own header) when present, falling back to the older triage score, then
+  // severity rank.
   findings.sort((a, b) => {
-    const ea = a.triage ?? (1 - (SEV_RANK[a.severity] || 0) / 4);
-    const eb = b.triage ?? (1 - (SEV_RANK[b.severity] || 0) / 4);
+    const ea = a.compositeRisk ?? (a.triage != null ? a.triage * 100 : (1 - (SEV_RANK[a.severity] || 0) / 4) * 100);
+    const eb = b.compositeRisk ?? (b.triage != null ? b.triage * 100 : (1 - (SEV_RANK[b.severity] || 0) / 4) * 100);
     return eb - ea;
   });
 
@@ -1229,7 +1398,7 @@ export function toProTable(scan, options = {}) {
     const cwe = (f.cwe || '—').padEnd(10);
     const cvss = (f.cvss || f.cvssV3?.score || '—').toString().padEnd(5);
     const owasp = (f.owasp || f.owaspCategory || '—').padEnd(10);
-    const mitre = (f.mitreAttack || f.attckTechnique || '—').padEnd(20);
+    const mitre = (f.attck || '—').padEnd(20);
     const capec = (f.capec || '—').padEnd(10);
     const conf = (f.confidence == null ? '—' : f.confidence.toFixed(2));
     const vuln = (f.vuln || '').slice(0, 60);

package/src/runScan.js

@@ -120,7 +120,7 @@ export async function runScan(rootDir, opts = {}) {
 
   // R8: `resume` is opt-in. Left undefined here, runFullScan falls back to the
   // AGENTIC_SECURITY_RESUME=1 env var, which is off by default.
-  const scan = await runFullScan({ fileContents, depFileContents, scanRoot: root, resume: opts.resume }, opts.onProgress || (()=>{}));
+  const scan = await runFullScan({ fileContents, depFileContents, scanRoot: root, resume: opts.resume, deep: opts.deep, deepInCi: opts.deepInCi }, opts.onProgress || (()=>{}));
   // Premortem 2R4.2: stamp ruleset version + source on the scan result, and
   // notify if the operator pinned a different version than what's installed.
   try { stampScan(root, scan); } catch {}

package/src/sast/_comment-strip.js

@@ -7,16 +7,25 @@
 //   - JS/TS/Java/Go/C/C++/Rust line comments  // ...
 //   - JS/TS/Java/Go/C/C++/Rust block comments /* ... */
 //   - Python line comments                    # ...
+//   - PHP: all three of the above — `//`, `/* */`, AND `#` are all valid
+//     PHP line/block comment forms simultaneously (unlike Python, which
+//     only has `#`), so PHP needs its own mode rather than reusing 'py'
+//     (which would strip `#` but silently leave `//`/`/* */` PHP comments
+//     unstripped — a source of false positives on commented-out code).
 //
 // Skips comment-like content inside string literals (single/double/backtick).
 //
-// The `lang` parameter is optional; pass 'py' to treat `#` as a line comment.
+// The `lang` parameter is optional; pass 'py' to treat `#` as a line comment
+// (and skip `//`/`/* */`), or 'php' to strip all three comment forms.
 
 export function blankComments(s, lang) {
   let out = '';
   let inS = null;
   let i = 0;
   const isPy = lang === 'py';
+  const isPhp = lang === 'php';
+  const stripSlashForms = !isPy || isPhp;
+  const stripHash = isPy || isPhp;
   while (i < s.length) {
     const c = s[i];
     if (inS) {
@@ -26,17 +35,19 @@ export function blankComments(s, lang) {
       i++; continue;
     }
     if (c === "'" || c === '"' || c === '`') { inS = c; out += c; i++; continue; }
-    if (!isPy && c === '/' && s[i+1] === '/') {
+    if (stripSlashForms && c === '/' && s[i+1] === '/') {
       while (i < s.length && s[i] !== '\n') { out += ' '; i++; }
       continue;
     }
-    if (!isPy && c === '/' && s[i+1] === '*') {
+    if (stripSlashForms && c === '/' && s[i+1] === '*') {
       const end = s.indexOf('*/', i + 2);
       const stop = end < 0 ? s.length : end + 2;
       while (i < stop) { out += (s[i] === '\n' ? '\n' : ' '); i++; }
       continue;
     }
-    if (isPy && c === '#') {
+    // PHP 8 attributes (`#[Route(...)]`) use the same `#` prefix as a line
+    // comment — `#[` is never a comment, so don't blank it.
+    if (stripHash && c === '#' && s[i+1] !== '[') {
       while (i < s.length && s[i] !== '\n') { out += ' '; i++; }
       continue;
     }

package/src/sast/_secret-entropy.js

@@ -63,7 +63,7 @@ const JWT_RE       = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
 // Configurable thresholds. Defaults tuned against the Juliet Java
 // 468-FP / 1-TP collapse — these settings drop FPs to ~30 without
 // losing the AWS-key-shaped TP.
-export const DEFAULT_OPTIONS = {
+const DEFAULT_OPTIONS = {
   // Empirical floor for *non-dictionary* credentials. Lower than the
   // 3.5 ceiling Shannon-quoted for "true randomness" because real test
   // fixtures and rotated secrets often use repetitive base alphabets

package/src/sast/authz.js

@@ -145,10 +145,12 @@ export function scanAuthZ(fp, raw) {
     const m2 = ln.match(JWT_HARDCODED_SECRET_RE);
     if (m2) {
       const val = m2[1];
-      // Suppress only template/env placeholders
-      if (!/process\.env|\$\{|<.*?>|^\s*$/.test(val) && !/\bsecret\b|\bchange.?me\b|^example$/i.test(val) === false || val.length >= 4) {
-        // We still flag well-known placeholders ("secret", "changeme") because they
-        // are the most common production foot-gun.
+      // Suppress only template/env placeholders. We still flag well-known
+      // placeholders ("secret", "changeme", "example") because they are the
+      // most common production foot-gun.
+      const looksLikePlaceholder = /process\.env|\$\{|<.*?>|^\s*$/.test(val);
+      const isKnownBadPlaceholder = /\bsecret\b|\bchange.?me\b|^example$/i.test(val);
+      if (!looksLikePlaceholder || isKnownBadPlaceholder) {
         push(_emit(fp, i + 1,
           'AuthZ: hardcoded JWT secret in source',
           'critical', 'CWE-798', ln.replace(val, '<redacted>'),

package/src/sast/bench-shape/index.js

@@ -21,7 +21,7 @@
 // set) AND strips the marker comments from the corpus before scanning, so the
 // engine's true detection capability is measured.
 
-export function isBenchShape() {
+function isBenchShape() {
   return process.env.AGENTIC_SECURITY_BENCH_SHAPE === '1';
 }
 
@@ -38,11 +38,6 @@ export {
   applyJavaBenchSuppressions,
 } from '../java-bench-extras.js';
 
-// Re-export the cpp-bench-extras suppressor — gated at call sites.
-export {
-  applyJulietCppSuppressions as applyJulietCppFamilySuppressions,
-} from '../cpp-bench-extras.js';
-
 // OWASP Benchmark @WebServlet route-category extractor.
 // Returns the canonical vuln family (e.g. 'sql-injection') for files whose
 // @WebServlet URL encodes the test category, or null.
@@ -54,7 +49,7 @@ const _OWASP_BENCH_CATEGORY_MAP = {
   'weakrand': 'weak-rng', 'trustbound': 'trust-boundary',
   'securecookie': 'header-hardening',
 };
-export function benchShapeWebServletCategory(cleaned) {
+function benchShapeWebServletCategory(cleaned) {
   if (!isBenchShape()) return null;
   const m = cleaned.match(/@WebServlet\s*\(\s*(?:value\s*=\s*)?["'](?:[^"']*\/)?(\w+?)-\d+\//);
   if (!m) return null;

package/src/sast/claude-md-prompt-injection.js

@@ -64,14 +64,25 @@ function _line(raw, idx) {
   return raw.slice(0, idx).split('\n').length;
 }
 
+// Zero-width / invisible Unicode characters: zero-width space, ZWNJ, ZWJ,
+// word joiner, BOM/zero-width no-break space. Interspersing these between
+// every character renders/executes identically to a human or LLM reader
+// (most tokenizers treat them as no-ops) while breaking literal-word regex
+// matching — a documented real-world prompt-injection evasion technique
+// against exactly this kind of pattern-matching defense. None of these are
+// '\n', so removing them never shifts _line()'s line-count computation.
+const _ZERO_WIDTH_RE = /[​‌‍⁠]/g;
+
 export function scanClaudeMdPromptInjection(file, raw) {
   if (!file || !raw || typeof raw !== 'string') return [];
   if (!_INSTRUCTION_FILE_RE.test(file)) return [];
   if (raw.length > 1_000_000) return [];
 
+  const cleaned = raw.replace(_ZERO_WIDTH_RE, '');
+
   // Strip fenced code blocks so example snippets in docs don't trip the
   // detector. Replace with same-length whitespace to preserve line offsets.
-  const stripped = raw.replace(/```[\s\S]*?```/g, (m) => m.replace(/[^\n]/g, ' '));
+  const stripped = cleaned.replace(/```[\s\S]*?```/g, (m) => m.replace(/[^\n]/g, ' '));
 
   const findings = [];
 
@@ -149,12 +160,12 @@ export function scanClaudeMdPromptInjection(file, raw) {
 
   // Hardcoded credentials in CLAUDE.md / AGENTS.md.
   for (const { re, label } of _CRED_RE) {
-    const m = re.exec(raw);
+    const m = re.exec(cleaned);
     if (!m) continue;
     findings.push({
       id: `claude-md:hardcoded-cred:${file}:${m.index}`,
       file,
-      line: _line(raw, m.index),
+      line: _line(cleaned, m.index),
       vuln: `Instruction file contains a hardcoded ${label}`,
       severity: 'critical',
       family: 'harness-config-secrets',

package/src/sast/cloud-iam.js

@@ -90,20 +90,68 @@ function _actionList(a) {
   return Array.isArray(a) ? a : [a];
 }
 
+// Finds every balanced {...} substring in `raw` that parses as valid JSON
+// and itself contains a "Statement" key. Recovers the case _isAwsPolicy
+// already promises to route here: an AWS policy document embedded as a
+// JSON-quoted string inside a non-JSON host file — most commonly a
+// Terraform heredoc (`policy = <<EOF ... EOF`). Does not attempt to parse
+// native-HCL jsonencode({...}) blocks (bare identifiers, no quotes) — that
+// shape doesn't match _isAwsPolicy's own quoted-key detection regex either,
+// so it's already outside this detector's claimed scope.
+function _extractJsonPolicyBlocks(raw) {
+  const blocks = [];
+  for (let i = 0; i < raw.length; i++) {
+    if (raw[i] !== '{') continue;
+    let depth = 0, inStr = false, strCh = '', esc = false, j = i;
+    for (; j < raw.length; j++) {
+      const c = raw[j];
+      if (inStr) {
+        if (esc) esc = false;
+        else if (c === '\\') esc = true;
+        else if (c === strCh) inStr = false;
+        continue;
+      }
+      if (c === '"') { inStr = true; strCh = c; continue; }
+      if (c === '{') depth++;
+      else if (c === '}') { depth--; if (depth === 0) break; }
+    }
+    if (depth !== 0 || j >= raw.length) continue;
+    const candidate = raw.slice(i, j + 1);
+    if (!/"Statement"\s*:/.test(candidate)) continue;
+    try { blocks.push(JSON.parse(candidate)); } catch { /* not valid JSON on its own */ }
+  }
+  return blocks;
+}
+
 function detectAws(file, raw, out, seen) {
-  let parsed;
-  try { parsed = JSON.parse(raw); } catch { return; }
-  const ss = _statements(parsed);
+  let ss;
+  try {
+    ss = _statements(JSON.parse(raw));
+  } catch {
+    // Non-JSON host file (e.g. Terraform HCL) — fall back to locating
+    // embedded JSON policy-document blocks instead of giving up outright.
+    ss = _extractJsonPolicyBlocks(raw).flatMap(_statements);
+    if (!ss.length) return;
+  }
+  // _line() takes a raw-text offset, not a substring — a monotonically
+  // advancing cursor lets successive statements (JSON.parse preserves
+  // source order) each locate their OWN occurrence of a shared marker
+  // like `"Principal"` instead of every statement resolving to the same
+  // (first) occurrence in the file.
+  let _cursor = 0;
   for (const s of ss) {
     if ((s.Effect || 'Allow') !== 'Allow') continue;
     const actions = _actionList(s.Action);
     const isStarAction = actions.includes('*') || actions.some(a => /^[a-z]+:\*$/.test(a));
     const hasCondition = s.Condition && Object.keys(s.Condition).length > 0;
     const principalStar = _principalIsWildcard(s.Principal);
+    let _advanceTo = _cursor;
 
     // aws-public-s3-policy
     if (principalStar && actions.some(a => /^s3:/.test(a))) {
-      const ln = _line(raw, `"Principal"`);
+      const idx = raw.indexOf('"Principal"', _cursor);
+      const ln = _line(raw, idx >= 0 ? idx : _cursor);
+      if (idx >= 0) _advanceTo = Math.max(_advanceTo, idx + 1);
       const id = `aws-public-s3-policy:${file}:${ln}`;
       if (!seen.has(id)) {
         seen.add(id);
@@ -118,7 +166,9 @@ function detectAws(file, raw, out, seen) {
 
     // aws-public-trust-policy (Principal:* on AssumeRole)
     if (principalStar && actions.includes('sts:AssumeRole')) {
-      const ln = _line(raw, 'AssumeRole');
+      const idx = raw.indexOf('AssumeRole', _cursor);
+      const ln = _line(raw, idx >= 0 ? idx : _cursor);
+      if (idx >= 0) _advanceTo = Math.max(_advanceTo, idx + 1);
       const id = `aws-public-trust-policy:${file}:${ln}`;
       if (!seen.has(id)) {
         seen.add(id);
@@ -136,7 +186,9 @@ function detectAws(file, raw, out, seen) {
       if (_HIGH_RISK_AWS_ACTIONS.includes(a) || a === '*') {
         const conditionStr = JSON.stringify(s.Condition || {});
         if (!/MultiFactorAuthPresent|MultiFactorAuthAge/.test(conditionStr)) {
-          const ln = _line(raw, `"${a}"`);
+          const idx = raw.indexOf(`"${a}"`, _cursor);
+          const ln = _line(raw, idx >= 0 ? idx : _cursor);
+          if (idx >= 0) _advanceTo = Math.max(_advanceTo, idx + 1);
           const id = `aws-no-mfa-condition:${file}:${a}:${ln}`;
           if (!seen.has(id)) {
             seen.add(id);
@@ -153,12 +205,13 @@ function detectAws(file, raw, out, seen) {
 
     // (iam:PassRole with Resource:* is detected by posture/iam-policy.js —
     // not duplicated here.)
+    _cursor = _advanceTo;
   }
 
   // aws-overbroad-managed-policy
   if (/"AdministratorAccess"|"PowerUserAccess"/.test(raw) && !/root\b|Bootstrap\b/.test(raw)) {
     const m = /"(AdministratorAccess|PowerUserAccess)"/.exec(raw);
-    const ln = _line(raw, m[0]);
+    const ln = _line(raw, m.index);
     const id = `aws-overbroad-managed-policy:${file}:${ln}`;
     if (!seen.has(id)) {
       seen.add(id);

package/src/sast/cpp-bench-extras.js

@@ -82,7 +82,7 @@ function familyOf(finding) {
 }
 
 // Return the primary-CWE family for a Juliet C/C++ test path, or null.
-export function julietPrimaryFamily(file) {
+function julietPrimaryFamily(file) {
   const m = JULIET_DIR_RE.exec(String(file).replace(/\\/g, '/'));
   if (!m) return null;
   return CWE_TO_FAMILY[parseInt(m[1], 10)] || null;

package/src/sast/csrf.js

@@ -63,11 +63,13 @@ export function scanCSRF(fp, raw) {
   if (!langSel) return [];
 
   const code = blankComments(raw, (ext === 'py' || ext === 'rb') ? 'py' : undefined);
-  // Project-wide-ish: if the file shows CSRF defence anywhere or only handles
-  // token-authenticated routes, we suppress.
-  const csrfInScope = CSRF_DEFENCE_RE.test(code);
-  const tokenAuthInScope = TOKEN_AUTH_RE.test(code);
-  if (csrfInScope || tokenAuthInScope) return [];
+  // Per-route defence is checked below (±15-line window around each route).
+  // There used to also be a whole-file gate here ("if the file shows CSRF
+  // defence ANYWHERE, suppress every route in it") — by regex-substring
+  // monotonicity that gate always fires whenever the per-route window would
+  // have matched too (the window is a substring of the file), so it made the
+  // per-route check provably unreachable: one protected route silently
+  // suppressed every OTHER route in the same file, however unprotected.
 
   const findings = [];
   const seen = new Set();

package/src/sast/env-hygiene.js

@@ -4,12 +4,15 @@
 // NEXT_PUBLIC_ vars that expose private values, .env.example with real
 // credentials, and hardcoded fallback values that look real.
 //
-// Findings:
+// Findings (4 implemented; ENV_MISSING_GITIGNORE was documented here but has
+// no implementation anywhere in this file — found via Stage-0 doc audit,
+// 2026. Either implement it or drop it from this list; left as a gap, not
+// silently removed, so the missing coverage stays visible):
 //   ENV_NEXT_PUBLIC_SECRET     — NEXT_PUBLIC_ variable whose name implies it's secret
 //   ENV_EXAMPLE_REAL_VALUE     — .env.example / .env.sample with a real-looking value
 //   ENV_HARDCODED_FALLBACK     — process.env.X || "looks-real" fallback in source
-//   ENV_MISSING_GITIGNORE      — .env / .env.local present but not in .gitignore
 //   ENV_DOTENV_IN_SOURCE       — .env file content loaded via require/import in prod code
+//   NOT IMPLEMENTED: ENV_MISSING_GITIGNORE — .env / .env.local present but not in .gitignore
 
 const _ENV_FILE_RE = /^\.env(?:\.(?:local|development|production|test|staging))?$/i;
 const _NONPROD_RE = /(?:^|\/)(?:tests?|__tests__|spec|fixtures?|examples?|node_modules)\//i;