@clear-capabilities/agentic-security-scanner 0.137.1 → 0.139.1

package/CHANGELOG.md

@@ -9,6 +9,250 @@
 > make the history less accurate, not more.
 
 
+## 0.139.1 — The same scanner, published with provenance
+
+**The shipped artifact is functionally identical to 0.139.0.** Only two commits
+separate them, and neither is in the published package: a test-harness timeout
+(`test/` does not ship) and a dependency hold (`.dependency-holds.json` does not
+ship). Nothing about how the scanner behaves has changed.
+
+This release exists for one reason: **0.139.0 was published without a provenance
+attestation.** It went out from a maintainer's laptop because the CI token
+lacked write access on the scoped package, so every tag-triggered publish failed
+at `PUT` with `E404` — after having already signed provenance to the Sigstore
+transparency log. The token has been replaced and verified (a re-run now returns
+`E403 "cannot publish over the previously published versions"`, which is the
+registry authenticating the write and rejecting only the duplicate version), so
+this is the first release published by CI with `--provenance`.
+
+For a security scanner that argues its case on *provable, measurable,
+reproducible*, "you can cryptographically verify this artifact was built from
+this commit in this repository" is a product property rather than a formality.
+Provenance is signed at publish time and cannot be retrofitted, which is why it
+takes a version number rather than an amendment to the last one.
+
+Fixes carried along, neither user-visible:
+
+- **`test/audit-cli.test.js` budgeted 4 s for a CLI that takes ~2.7 s idle** — a
+  1.5× margin in a suite that runs files concurrently. It failed as `status:
+  null` on a *different* test each run, was unreproducible in isolation, and
+  blocked a release push on a commit whose entire diff was 8 lines of JSON.
+  Now 30 s (~11× idle), still bounded so a genuinely hung CLI fails rather than
+  stalls.
+- **`@types/vscode` is held rather than upgraded.** It declares the VS Code API
+  surface the extension compiles against and should track `engines.vscode` — the
+  *oldest* supported host — not the newest published types. Chasing latest lets
+  the extension compile against APIs absent from hosts it claims to support, and
+  that failure lands as a runtime `TypeError` in a user's editor. The hold
+  records a pre-existing mismatch (`engines ^1.95.0` vs types `^1.125.0`) for a
+  deliberate decision at review time, since narrowing the supported host range
+  is a product call, not a dependency bump.
+
+
+## 0.139.0 — Two detectors that were dead, a confinement rule that was documented but unenforced, and a new Go rule
+
+Every defect in this release is the same shape: **a control that exists, is
+documented, and does not hold end-to-end.** Unit tests passed in every case.
+Only checks that exercised the whole pipeline found them.
+
+### Two detectors produced nothing through a real scan
+
+Both worked when called directly and returned zero through `runScan` — the
+`rate-limit.js` signature (a rule that discarded 100% of its own findings,
+project-wide, from the day it was written).
+
+- **`k8s-admission`** — `_isIaCFile` admitted YAML as Kubernetes only when the
+  path contained a directory literally named `k8s/`. Its own comment claimed the
+  caller also checked for `kind:`; nothing ever did. **Manifests under
+  `deploy/`, `manifests/`, `charts/`, `kubernetes/` or the repository root were
+  invisible** — which is where most projects actually put them. Now admitted on
+  CONTENT (`apiVersion:` and `kind:` at line-start within the first 2 KB),
+  because the set of directory names people use is unbounded and the file
+  format is not.
+
+  The fix had to be applied at **both** admission gates: `runScan` admits a file
+  into `fileContents`, and then `runFullScan` independently re-filters that same
+  list with `shouldScan()`. With only the first opened, the predicate returned
+  true, the walker collected the files, and the scan still returned zero.
+
+- **`install-script`** — `package.json` is routed to `depFileContents` and fails
+  `shouldScan()`, so the per-file SAST loop never visited it and
+  `scanInstallScripts` was wired in but never invoked. Fixed on the manifest
+  path rather than by admitting `package.json` into the SAST loop, which would
+  push a manifest through all ~117 code detectors to satisfy one rule.
+
+Measured blast radius rather than assumed: 16 of 1129 YAML files in this tree
+are newly admitted (1.4%), all in fixtures and caches. Self-scan unchanged.
+
+### `_CONFINEMENT` rule 3 was documented and unimplemented
+
+`agents/_CONFINEMENT.md` states three refusal rules for every edit-capable agent
+and for the MCP write tools. The code enforced two. Rule 3 — *"a backup, lock, or
+build-output file (`*.bak`, `*.lock`, `dist/`, `build/`, `target/`)"* — was not
+enforced at all.
+
+The tests failed by **successfully writing**, which is what makes this more than
+pedantry: `scanner/dist/` holds the shipped bundle, which carries its own
+SHA-256 integrity sidecar precisely because its contents matter. `apply_fix`
+would have rewritten it and reported success. A contract an agent is instructed
+to follow, enforced less strictly than it claims, is worse than no contract.
+
+Build output is matched as a **path segment at any depth** — `packages/web/dist/`
+is the normal shape — while a source file *named* `dist.js` or `build.py` stays
+writable.
+
+### New: `sibling-guard-omission` (CWE-22, Go)
+
+From `GHSA-95cv-r8x4-vh75`: two fields of one request struct reach a filesystem
+rename and the project's **own** guard is applied to only one. High precision by
+construction — the rule never decides what a guard *is*, it observes one being
+applied to a sibling, so every finding reduces to "this file guards X and forgets
+Y", falsifiable from a single screen of code, with the guard name and both field
+names carried as evidence.
+
+Fires on the real advisory in `pre` and goes silent there in `post`. FP budget
+measured across 72 real Go packages: **1.12%** of findings, max 5 per repo.
+
+**It could never have shipped without a second fix.** `dropGuardedFindings` drops
+a CWE-22 finding when its window contains a containment guard — and for this
+family the window *always* contains one, because the guard on the sibling **is**
+the finding. The centralized precision filter was reading the evidence of the bug
+as proof of safety and would have deleted 100% of the family regardless of
+detector quality. Exemption keyed on `family`, deliberately narrow.
+
+A false positive in this rule was then found on real code (an `\n` escape read as
+a path separator) and fixed, with a regression test written from that code.
+
+### Instruments
+
+- **The shipped LSP is smoke-tested.** `bin/agentic-security-lsp.js` ships inside
+  the JetBrains and Neovim plugins and was referenced by no test, script or
+  workflow. It now runs as a subprocess speaking real LSP over stdio —
+  `initialize` → `didOpen` → `publishDiagnostics` → `shutdown` → `exit` — plus a
+  malformed-frame survival case.
+- **Per-language layer attribution** on the independent population, with taint's
+  attributable share stated outright each run.
+- **Gate integrity** (P0 of `docs/WORLD_CLASS_HARNESS_PRD.md`): CI-parity checks
+  so the local gate cannot disagree with hosted CI; layer-recall gates on
+  equality rather than a floor, so an unrecorded *improvement* fails too; a
+  shared per-entry bench watchdog; and a detector-liveness guard that requires
+  every rule fixture to produce a finding *through* `runScan`. That guard is what
+  found both dead detectors above.
+
+
+## 0.138.0 — Findings come from code, not comments; container taint; a benchmark that can no longer hang
+
+### Comment blindness, enforced instead of documented
+
+`src/sast/CLAUDE.md` has always named this as its first gotcha for detector
+authors — "Comments confuse detectors. Always go through `blankComments()`" —
+but nothing enforced it, so whether a rule ignored comments depended on whether
+its author remembered. A probe over nine languages, in which *every* dangerous
+construct sat inside a comment and the only executable statement was
+`return 1`, produced **15 findings from code that can never run**. Three
+independent defects, each fixed after a failing test proved it:
+
+- `runFullScan` handed the **raw** file to every SAST module. 64 of 117 modules
+  called `blankComments()` themselves; roughly 40 of the rest ran regexes over
+  raw text. The per-file dispatch now computes one comment-blanked,
+  offset-preserving view and passes it to 99 detector call sites.
+- The engine's own `stripNoise()` understood `//` and `/* */` but **not `#`**,
+  so every engine-internal regex pass leaked on Python/Ruby/shell/HCL comments.
+  All 15 call sites now pass a path, and the mapping is language-aware because
+  it has to be: `#` opens a comment in Python but is `#include`/`#region` in the
+  C family, and `//` is a comment in C-family languages but **floor division in
+  Python**, where blanking it would delete real code.
+- `blankComments()` let a `'`/`"` string span a newline. An odd number of quotes
+  on one line — which regex literals produce routinely; `/"(?:sh|bash)"\s*,\s*(?!"[^"]*")/`
+  has seven — left the scanner stuck in string mode for the **entire rest of the
+  file**, silently disabling comment stripping from that point on. Found on this
+  repository's own `sast/go-extended.js`, where it resurrected a false positive
+  from a comment six lines below such a regex.
+
+Ruby `=begin`/`=end` blocks are now stripped too (a `#`-only pass left them
+wholly intact).
+
+**Measured, finding-by-finding rather than by totals.** Self-scan on this
+repository fell 458 → 427: **33 findings removed, all 33 on comment lines, zero
+real findings lost**; the 2 added were previously *masked* by the string-mode
+defect. On the 315-entry independent population of real upstream advisories,
+localized precision rose **40.74% → 44.00%** with true positives unchanged at
+11 — the fix buys precision, not recall, which is exactly what was predicted
+once it was established that none of the credited true positives sat on a
+comment line. Deliberately still reading raw source: the prompt-injection
+family (for an agentic tool, instructions hidden in a comment *are* the attack),
+the secrets scanners (a committed credential is leaked whether or not its line
+executes), and `scanTodosNearSecurity`, whose entire subject is comments.
+
+The property is pinned end-to-end by `test/comment-blindness.test.js`, including
+a positive control and a Python-floor-division guard, so a regression surfaces
+as a test failure rather than as quietly inflated findings.
+
+### Container / collection-element taint (PRD T3.3)
+
+Probed ten container shapes before writing anything, which showed the JS array
+cases already worked. Coverage went from 5/10 to 9/10:
+
+- A computed write with a non-literal key (`bag[k] = tainted`) lowers to access
+  path `bag.*`, and `'*'` is a *literal* property name, not a wildcard — the
+  lattice propagates only downward from a prefix, so the write was unreachable
+  from every correctly-computed read. An unknown key could be any key, so it now
+  widens to the container.
+- `Map.set` / `Set.add` joined the mutator list.
+- **The mutator rule required `callee.kind === 'member'`, a shape only Babel
+  emits**, so container writes in Python/Ruby/PHP/Go/Java/C#/Kotlin never matched
+  at all. The miss was invisible because a PY-SAST pattern rule caught the same
+  sink.
+- `__setitem__` is in the mutator list because `parser-py.js` lowers a Python
+  subscript *assignment* to a call node, not an assign node — established by
+  dumping the IR, not by inference.
+
+**Reported as capability, not as a recall gain:** `bench:layer-recall` is
+unchanged at 116/215 and the dataflow-shaped subset unchanged at 115/137,
+because the corpus holds no container-shaped entries. Pinned by
+`test/container-taint.test.js`, including two precision cases that must *not*
+fire.
+
+### Performance
+
+The comment work initially cost **19.7%** of end-to-end scan time on a 307-file
+entry, because `stripNoise` is called ~15× per file and an interpreted character
+loop had replaced two native regex passes. A single-slot memo (safe because the
+engine processes one file at a time and `fileContents[p]` returns the same
+string *reference*) plus a rewrite of `blankComments` to emit bulk slices
+instead of per-character appends brought that to **5.7%**. Byte offsets and line
+counts are preserved exactly — every finding's line number depends on it.
+
+### The independent benchmark could hang indefinitely
+
+A full run wedged at entry 186 of 315 on `GHSA-hcm8-x79p-wx2w` (apache/camel,
+649 MB): process alive, state `S`, 0.0% CPU, no progress for six hours, killed
+with 129 entries never scored. Reproduced on a clean checkout, so it was
+pre-existing. `runScan` carries a deep-mode walltime budget and a per-file
+timeout, but nothing bounded a whole-entry scan. There is now a per-entry
+watchdog (`AGENTIC_SECURITY_BENCH_ENTRY_TIMEOUT_MS`, default 600 s) that marks
+the entry UNSCORED — the harness's own documented doctrine for an entry that
+could not be run, never a miss. The run that produced this release's numbers
+named 6 such entries (all Java, all very large) and completed.
+
+Worth stating plainly: **every independent-population figure published before
+this release came from a harness that could silently stall partway through.**
+
+### Documentation corrected
+
+`docs/METRICS.md`'s taint table was ~5× stale (23/210 = 11%; actual 116/215 =
+54%) and its central claim that kotlin still had **0%** taint recall was false
+(48%). Both `bench/layer-recall/baseline.json` and the table are regenerated.
+The cause is recorded alongside the fix, because it is a gate-design lesson:
+`bench:layer-recall:check` compares against a **floor**, so an improvement from
+31 to 116 passed it exactly as a no-change run would.
+
+Also fixed two long-standing lifecycle failures: `jsUnits` — Theme 6's JS/TS
+extractor, which carries 6 of the 10 known sibling-omission entries — was wired
+into production with **no test at all**, and now has four; and a stale
+`profile.js::DEFAULTS` dead-code allowlist entry was removed.
+
+
 ## 0.137.1 — Dependabot policy for the deliberately-vulnerable fixtures
 
 Housekeeping release. Adds `.github/dependabot.yml` so Dependabot leaves the

package/dist/113.index.js

@@ -415,8 +415,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 196 modules
-var engine = __webpack_require__(2739);
+// EXTERNAL MODULE: ./src/engine.js + 203 modules
+var engine = __webpack_require__(6622);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2739);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6622);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2739);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(6622);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/435.index.js

@@ -572,7 +572,29 @@ const RESERVED_WRITE_SUFFIXES = [
   '.tfvars',
   'docker-compose.yml',
   'docker-compose.yaml',
+  // _CONFINEMENT rule 3 — backup and lock files. The specific lock BASENAMES
+  // above cover the ecosystems we know; this catches the rest (`deps.lock`,
+  // `foo.bak`) without needing to enumerate them. Nothing an autofix should
+  // ever be rewriting: a `.bak` is someone's safety copy and a `.lock` is
+  // generated state.
+  '.bak',
+  '.lock',
 ];
+// _CONFINEMENT rule 3 — build output. Matched as a PATH SEGMENT at any depth,
+// not as a top-level prefix, because build output is routinely nested
+// (`packages/web/dist/`, `services/api/target/`) and a top-level-only check
+// would refuse the monorepo root and allow every package inside it.
+//
+// This matters most in THIS repository: `scanner/dist/` holds the shipped
+// bundle, which carries its own SHA-256 integrity sidecar precisely because
+// what it contains matters. Before this, `apply_fix` would rewrite it and
+// report success.
+//
+// NOTE for a future change, deliberately not made here: the PREFIX list above
+// (`node_modules/`, `.git/`, …) is still top-level-only, so a nested
+// `packages/a/node_modules/` is not covered by it. That is a separate widening
+// with its own blast radius and belongs in its own change with its own tests.
+const RESERVED_WRITE_DIR_SEGMENTS = new Set(['dist', 'build', 'target']);
 function _isReservedWritePath(sessionRoot, absFile) {
   // Resolve sessionRoot symlinks so the relative path is computed against
   // the same canonical root as `absFile` (which _confine already realpath'd).
@@ -581,9 +603,15 @@ function _isReservedWritePath(sessionRoot, absFile) {
   const rootReal = external_node_fs_.realpathSync(external_node_path_.resolve(sessionRoot));
   const rel = external_node_path_.relative(rootReal, absFile).replace(/\\/g, '/');
   if (RESERVED_WRITE_PREFIXES.some(p => rel === p.replace(/\/$/, '') || rel.startsWith(p))) return true;
-  const base = rel.split('/').pop() || '';
+  const segments = rel.split('/');
+  const base = segments[segments.length - 1] || '';
   if (RESERVED_WRITE_BASENAMES.has(base)) return true;
   if (RESERVED_WRITE_SUFFIXES.some(s => base === s || base.endsWith(s))) return true;
+  // Any DIRECTORY segment that names build output — checked over
+  // `segments.length - 1` so a source file legitimately called `build` or
+  // `dist` is not refused for its own name; only living inside such a
+  // directory counts.
+  if (segments.slice(0, -1).some(seg => RESERVED_WRITE_DIR_SEGMENTS.has(seg))) return true;
   return false;
 }
 

package/dist/526.index.js

@@ -234,8 +234,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 196 modules
-var engine = __webpack_require__(2739);
+// EXTERNAL MODULE: ./src/engine.js + 203 modules
+var engine = __webpack_require__(6622);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //

package/dist/637.index.js

@@ -11,7 +11,7 @@ export const modules = {
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2739);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6622);
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings