@clear-capabilities/agentic-security-scanner 0.139.0 → 0.140.0

package/CHANGELOG.md

@@ -9,6 +9,119 @@
 > make the history less accurate, not more.
 
 
+## 0.140.0 — Five shipped bugs, found by measuring instead of reading
+
+Every fix here is a defect that was live in 0.139.1. None came from the feature
+backlog; all five came from measuring the engine against real code and taking
+failing signals seriously instead of explaining them away.
+
+### `scan --format sarif` produced INVALID SARIF in CI
+
+The CLI dispatches every command as `process.exit(await cmdX(args))`, and
+`process.exit()` does not flush an asynchronous stdout. stdout is asynchronous
+exactly when it is a pipe — every `> results.sarif`, `| jq`, and CI capture — so
+output was discarded at the 64 KiB pipe boundary, mid-token, with a normal exit
+status. On one directory that was 65,536 bytes emitted of 390,177: roughly 83%
+of the document silently dropped.
+
+**If you upload SARIF to code scanning, this affected you on any project large
+enough to matter.** A TTY and a file both flush synchronously, which is why it
+looked fine by hand and broke in automation.
+
+### LLM01 — Prompt Injection — could never fail
+
+Detectors emit the finding family as `<family>-<rule-slug>`
+(`prompt-injection-http-user-input-in-llm-`), while the compliance evaluator
+resolved `family:prompt-injection` as an exact key. It matched nothing, so the
+control reported as evidenced no matter what the scan found. The first control
+of the OWASP LLM Top 10 was structurally incapable of failing, along with ASVS
+V5.1 and NIST AI 600-1 MG-3.2-005.
+
+Two further compliance defects in the same matching code: an empty family
+bucket rendered as `✓ no open critical/high findings`, so two controls (ASVS
+V7.1, NIST Privacy CT.DP-P1) read `present` on every scan of every project; and
+a first attempt at fixing that wrongly declared four live families
+unevidenceable, degrading 15 working controls. Both directions are now gated —
+a control with no possible evidence cannot read `present`, and a family with a
+producer cannot be declared a gap.
+
+### `--deterministic` did not produce deterministic output
+
+Four of ten emitted formats differed run to run: CycloneDX/SPDX document ids and
+a CycloneDX bom-ref fallback from `crypto.randomUUID()`, a PoC marker from
+`Math.random()`, and per-file wall-clock timings (which also determined the
+sort ORDER, so blanking the values alone would not have been enough).
+
+**An attestation over an SBOM was therefore unverifiable** — the point of
+signing an artifact is that someone can regenerate and compare it.
+
+### 62% of concurrency findings on Go were false positives
+
+The lock guard matched a bare receiver (`defer mu.Unlock()`) but not a qualified
+one (`defer s.mu.Unlock()`), which is how a mutex held as a struct field is
+always written. The acquire pattern always matched the qualified form, so the
+two halves of the rule had disagreed since it was written — and the most
+idiomatic CORRECT code was the most likely to be reported. Measured: 170 of 273
+findings on a Go sample were false positives. Those findings also carried no
+CWE, so they were invisible to every CWE-keyed report.
+
+### New gates
+
+- `test/stdout-flush.test.js` — spawns the real CLI through a real pipe
+- `test/format-determinism.test.js` — every emitted format, byte-compared
+- `test/compliance-mapping-liveness.test.js` — both vacuous-pass directions
+- `test/concurrency-cwe.test.js` — per-lock guard discrimination
+- `bench/family-producers/OBSERVED.json` — 213 families observed across 331
+  real scan roots, recorded explicitly as a LOWER BOUND
+
+### Scope
+
+The world-class-harness PRD is **partially delivered**. F10.5 (determinism as a
+published property) is complete. F10.2 is half done — the enforcement half
+landed; the measurement half needs detectors to declare their families, because
+this release proved no textual search can enumerate them. Roughly 35 PRD items
+remain, several blocked on design decisions rather than implementation.
+
+## 0.139.1 — The same scanner, published with provenance
+
+**The shipped artifact is functionally identical to 0.139.0.** Only two commits
+separate them, and neither is in the published package: a test-harness timeout
+(`test/` does not ship) and a dependency hold (`.dependency-holds.json` does not
+ship). Nothing about how the scanner behaves has changed.
+
+This release exists for one reason: **0.139.0 was published without a provenance
+attestation.** It went out from a maintainer's laptop because the CI token
+lacked write access on the scoped package, so every tag-triggered publish failed
+at `PUT` with `E404` — after having already signed provenance to the Sigstore
+transparency log. The token has been replaced and verified (a re-run now returns
+`E403 "cannot publish over the previously published versions"`, which is the
+registry authenticating the write and rejecting only the duplicate version), so
+this is the first release published by CI with `--provenance`.
+
+For a security scanner that argues its case on *provable, measurable,
+reproducible*, "you can cryptographically verify this artifact was built from
+this commit in this repository" is a product property rather than a formality.
+Provenance is signed at publish time and cannot be retrofitted, which is why it
+takes a version number rather than an amendment to the last one.
+
+Fixes carried along, neither user-visible:
+
+- **`test/audit-cli.test.js` budgeted 4 s for a CLI that takes ~2.7 s idle** — a
+  1.5× margin in a suite that runs files concurrently. It failed as `status:
+  null` on a *different* test each run, was unreproducible in isolation, and
+  blocked a release push on a commit whose entire diff was 8 lines of JSON.
+  Now 30 s (~11× idle), still bounded so a genuinely hung CLI fails rather than
+  stalls.
+- **`@types/vscode` is held rather than upgraded.** It declares the VS Code API
+  surface the extension compiles against and should track `engines.vscode` — the
+  *oldest* supported host — not the newest published types. Chasing latest lets
+  the extension compile against APIs absent from hosts it claims to support, and
+  that failure lands as a runtime `TypeError` in a user's editor. The hold
+  records a pre-existing mismatch (`engines ^1.95.0` vs types `^1.125.0`) for a
+  deliberate decision at review time, since narrowing the supported host range
+  is a product call, not a dependency bump.
+
+
 ## 0.139.0 — Two detectors that were dead, a confinement rule that was documented but unenforced, and a new Go rule
 
 Every defect in this release is the same shape: **a control that exists, is

package/bin/agentic-security.js

@@ -9,6 +9,35 @@ const __require = createRequire(import.meta.url);
 const PKG_VERSION = __require('../package.json').version;
 import { signLastScan as _signLastScan, verifyLastScan as _verifyLastScanShared } from '../src/posture/integrity.js';
 import { runScan } from '../src/runScan.js';
+
+// Every command is dispatched as `process.exit(await cmdX(args))`, and
+// process.exit() does NOT flush an asynchronous stdout. stdout is asynchronous
+// whenever it is a PIPE — which is every `> file`, `| jq`, and CI capture — so
+// anything still buffered when the process exits is discarded at the pipe
+// boundary: 64 KiB on macOS and Linux.
+//
+// That silently truncated `scan --format sarif` mid-token for any project
+// large enough to matter, i.e. the primary CI integration path, while still
+// exiting with a normal status. The consumer sees a JSON parse error with no
+// connection to its cause, or ingests a partial finding set.
+//
+// fs.writeSync(1, …) hands the bytes to the OS before returning, so a later
+// exit cannot lose them. A non-blocking pipe can still short-write or raise
+// EAGAIN, hence the loop — a partial write that is not retried is the same
+// truncation bug wearing a different hat.
+function writeStdout(s) {
+  const buf = Buffer.from(String(s), 'utf8');
+  let off = 0;
+  while (off < buf.length) {
+    try {
+      off += fs.writeSync(1, buf, off, buf.length - off);
+    } catch (e) {
+      if (e.code === 'EAGAIN') continue;   // pipe full; the reader will drain it
+      if (e.code === 'EPIPE') return;      // reader closed (`| head`) — not our error
+      throw e;
+    }
+  }
+}
 import { toJSON, toMarkdown, toSARIF, toSTIX, toCSV, toJUnit, toCLI, toCLIByProfile, toShipVerdict, toProTable, toHTML, toSummary, toVex, exitCodeFor, normalizeFindings } from '../src/report/index.js';
 import { toCycloneDX, toSPDX } from '../src/posture/sbom.js';
 import { toPBOM } from '../src/sast/pipeline.js';
@@ -679,7 +708,7 @@ async function cmdScan(args) {
   }
 
   if (output) await fsp.writeFile(output, body);
-  else process.stdout.write(body + '\n');
+  else writeStdout(body + '\n');
 
   // Persist last scan for /security-fix and /security-report
   const { isSafeStateDir: _isSafeStateDir, stateWritesEnabled: _writesOnScan } = await import('../src/posture/state-dir.js');
@@ -1251,7 +1280,7 @@ async function cmdHarness(args) {
     body += `\n\nHarnesses discovered: ${present.join(', ')}${includeHome ? ' (project + ~/)' : ' (project only)'}\n`;
   }
   if (args.flags.output) await fsp.writeFile(args.flags.output, body);
-  else process.stdout.write(body + '\n');
+  else writeStdout(body + '\n');
   return exitCodeFor(scan);
 }
 
@@ -1746,7 +1775,7 @@ async function cmdCompliance(args) {
 
   if (args.flags.list) {
     const fws = listFrameworks(scanRoot);
-    if (fmt === 'json') { console.log(JSON.stringify(fws, null, 2)); return 0; }
+    if (fmt === 'json') { writeStdout(JSON.stringify(fws, null, 2) + '\n'); return 0; }
     for (const f of fws) console.log(`  ${f.id.padEnd(20)} ${f.name}  [${f.source}]`);
     return 0;
   }
@@ -1780,7 +1809,7 @@ async function cmdCompliance(args) {
 
   const gapsOnly = !!args.flags.gap;
   if (fmt === 'json') {
-    console.log(JSON.stringify(gapsOnly ? { ...r, controls: r.controls.filter(c => c.bucket === 'gap') } : r, null, 2));
+    writeStdout(JSON.stringify(gapsOnly ? { ...r, controls: r.controls.filter(c => c.bucket === 'gap') } : r, null, 2) + '\n');
   } else if (fmt === 'md') {
     console.log(fs.readFileSync(statePath(scanRoot, 'privacy-framework.md'), 'utf8'));
   } else {
@@ -2018,7 +2047,7 @@ async function cmdFix(args) {
 
   // Default mode: print the canonical template (back-compat — security-fixer subagent applies it).
   if (!isPreview && !isApply) {
-    console.log(JSON.stringify(f, null, 2));
+    writeStdout(JSON.stringify(f, null, 2) + '\n');
     if (f.fix?.code) { console.log('\n--- suggested patch ---\n'); console.log(f.fix.code); }
     console.log('\nUse --preview to see a diff, or --apply to apply directly.');
     return 0;
@@ -2247,7 +2276,7 @@ async function main() {
         const { analyzeTranscript, formatCacheReport } = await import('../src/posture/cache-economics.js');
         const projectDir = path.resolve(args.flags.root || process.env.CLAUDE_PROJECT_DIR || process.cwd());
         const result = analyzeTranscript({ transcriptPath: args.flags.transcript, projectDir });
-        if (args.flags.json) console.log(JSON.stringify(result, null, 2));
+        if (args.flags.json) writeStdout(JSON.stringify(result, null, 2) + '\n');
         else console.log(formatCacheReport(result));
         process.exit(0);
       }
@@ -2291,7 +2320,7 @@ async function main() {
         });
         if (args.flags.json) {
           // Stringify Set/etc. safely.
-          console.log(JSON.stringify(r, null, 2));
+          writeStdout(JSON.stringify(r, null, 2) + '\n');
         } else if (!r.ok) {
           console.error(`cve-watch: ${r.reason || 'failed'}`);
         }
@@ -2307,7 +2336,7 @@ async function main() {
         const headRef = args.flags.head || args.flags.h || 'HEAD';
         if (!baseRef) { console.error('pr-delta: --base <ref> is required'); process.exit(2); }
         const delta = await computePrDelta(path.resolve(root), { baseRef, headRef });
-        if (args.flags.json) console.log(JSON.stringify(delta, null, 2));
+        if (args.flags.json) writeStdout(JSON.stringify(delta, null, 2) + '\n');
         else console.log(renderPrDeltaText(delta));
         // Exit non-zero if any critical/high introduced (useful as CI gate).
         const i = delta.summary?.introduced || {};
@@ -2359,7 +2388,7 @@ async function main() {
         const repo = args.flags.repo;
         if (!repo) { console.error('leaderboard-row: --repo <owner/name> is required'); process.exit(2); }
         const row = leaderboardRowFor({ scanRoot: path.resolve(root), repo });
-        console.log(JSON.stringify(row, null, 2));
+        writeStdout(JSON.stringify(row, null, 2) + '\n');
         process.exit(0);
       }
       case 'history': {
@@ -2372,7 +2401,7 @@ async function main() {
           since:    args.flags.since    || '6.months',
           interval: args.flags.interval || '1.month',
         });
-        if (args.flags.json) console.log(JSON.stringify(r, null, 2));
+        if (args.flags.json) writeStdout(JSON.stringify(r, null, 2) + '\n');
         else if (r.error) console.error(`history: ${r.error}`);
         else {
           console.log(`Scanned ${r.refs.length} refs.`);
@@ -2408,7 +2437,7 @@ async function main() {
           ? (Array.isArray(args.flags.remove) ? args.flags.remove : [args.flags.remove])
           : [];
         const r = await runWhatIf(path.resolve(root), { overlays, remove });
-        if (args.flags.json) console.log(JSON.stringify(r, null, 2));
+        if (args.flags.json) writeStdout(JSON.stringify(r, null, 2) + '\n');
         else {
           console.log(`baseline: ${r.baselineFindings} findings`);
           console.log(`what-if:  ${r.whatIfFindings} findings (delta ${r.delta >= 0 ? '+' : ''}${r.delta})`);