@clear-capabilities/agentic-security-scanner 0.139.1 → 0.141.0

package/src/posture/poc-inprocess.js

@@ -38,12 +38,14 @@ const MARKER = 'PROVEN';
 // PoC observes the acceptance and records it. Both are execution-based — code
 // ran and behaved insecurely — but they are proven by different evidence, and
 // conflating them is how a template ends up asserting something it never saw.
-const SUPPORTED = new Set([
+export const SUPPORTED = new Set([
   'command-injection',
   'code-injection',
   'webhook-missing-signature-verification',
   'sql-injection',
   'path-traversal',
+  'ldap-injection',
+  'xxe',
 ]);
 
 // Classes proven by observing the HANDLER's behaviour rather than a payload
@@ -53,6 +55,8 @@ const BEHAVIOURAL = new Map([
   ['webhook-missing-signature-verification', (f, c) => _webhookPoc(f, c)],
   ['sql-injection', (f, c) => _sqlInjectionPoc(f, c)],
   ['path-traversal', (f, c) => _pathTraversalPoc(f, c)],
+  ['ldap-injection', (f, c) => _ldapInjectionPoc(f, c)],
+  ['xxe', (f, c) => _xxePoc(f, c)],
 ]);
 
 // Classes deliberately NOT here, with the reason, so the gap is a decision
@@ -491,6 +495,218 @@ function _sqlInjectionPoc(finding, fileContent) {
 const TRAVERSAL_SENTINEL = 'PROVEN_TRAVERSAL_SENTINEL_CONTENT';
 const READ_SINK = /\b(?:readFile|readFileSync|sendFile|readFileAsync)\s*\(/;
 
+
+// ── LDAP injection (CWE-90) ────────────────────────────────────────────────
+//
+// Added because `ldap-injection` was the largest UNCLASSIFIED family in the
+// published proof-coverage breakdown (10 of 280 corpus findings) and it has the
+// same property that makes SQL provable: a decidable boundary where the
+// question is settled without a running directory server.
+//
+// For SQL the question is "did the payload arrive as query TEXT or as a bound
+// parameter". For LDAP it is "did the payload's filter METACHARACTERS survive".
+// A correctly escaped value still contains the sentinel — `ldap_escape`,
+// `EqualityFilter` and friends escape `(`, `)`, `*` and `\` to `\28`, `\29`,
+// `\2a`, `\5c` — so matching the sentinel alone would call a FIXED handler
+// vulnerable. The proof requires the sentinel AND an unescaped metacharacter in
+// the same filter string.
+const LDAP_SENTINEL = 'PROVEN_LDAPI';
+// RELATIVE, like SQL_LOG. An absolute path (/tmp/...) is denied by the
+// confinement backend, so the recorder silently wrote nothing and the proof
+// came back proof-failed on a genuinely vulnerable handler — the sandbox
+// working exactly as intended, and a reminder that a PoC must live entirely
+// inside the sandbox root.
+const LDAP_LOG = 'ldap-calls.jsonl';
+const LDAP_DRIVERS = ['ldapjs', 'ldap-authentication', 'activedirectory', 'activedirectory2', 'ldapts'];
+const LDAP_DRIVER_RES = LDAP_DRIVERS.map((d) => [
+  d, new RegExp(`require\\(\\s*['"\`]${d}['"\`]|from\\s*['"\`]${d}['"\`]`),
+]);
+
+const LDAP_STUB = [
+  "const fs = require('fs');",
+  'function record(args) {',
+  '  const filters = [];',
+  '  for (const a of args) {',
+  "    if (typeof a === 'string') filters.push(a);",
+  "    else if (a && typeof a === 'object') {",
+  "      if (typeof a.filter === 'string') filters.push(a.filter);",
+  "      if (a.filter && typeof a.filter === 'object' && typeof a.filter.toString === 'function') filters.push(String(a.filter));",
+  '    }',
+  '  }',
+  '  if (filters.length) {',
+  `    try { fs.appendFileSync(${JSON.stringify(LDAP_LOG)}, JSON.stringify({ filters }) + '\\n'); } catch {}`,
+  '  }',
+  '}',
+  'const mk = () => new Proxy(function () {}, {',
+  "  get(t, p) { if (typeof p === 'symbol' || p === 'then' || p === 'inspect') return undefined; return mk(); },",
+  '  apply(t, self, args) {',
+  '    record(args);',
+  "    for (const a of args) if (typeof a === 'function') { try { a(null, { on: () => {} }); } catch {} }",
+  '    return mk();',
+  '  },',
+  '});',
+  'module.exports = mk();',
+].join('\n');
+
+function _ldapInjectionPoc(finding, fileContent) {
+  const driver = (LDAP_DRIVER_RES.find(([, re]) => re.test(fileContent)) || [])[0];
+  if (!driver) {
+    return {
+      ok: false,
+      reason: `no recognised LDAP client is required by this file, so there is no boundary to observe the filter at (looked for: ${LDAP_DRIVERS.join(', ')})`,
+    };
+  }
+  const found = _findHandler(fileContent);
+  if (!found) return NO_HANDLER;
+  const { call, reqIdent } = found;
+
+  const src = _requestSource(fileContent, reqIdent, finding.line);
+  if (!src) {
+    return { ok: false, reason: `the handler does not read query/body/params off '${reqIdent}', so the injection point is unknown` };
+  }
+
+  const { base, importLine, invoke, handlerLabel } = _binding(finding, call);
+  // Filter metacharacters plus the sentinel. An escaping handler keeps the
+  // sentinel and neutralises the parens/star, which is exactly the difference
+  // the decision below reads.
+  const payload = `*)(uid=*))(|(uid=*${LDAP_SENTINEL}`;
+  // The distinctive raw tail of that payload. Present verbatim only if no
+  // escaping happened between the request and the client.
+  const RAW_TAIL = `)(|(uid=*${LDAP_SENTINEL}`;
+
+  const code = [
+    `// Auto-generated proof for ${finding.file}.`,
+    `// Stubs the '${driver}' client with a recorder and calls the handler with a`,
+    '// payload carrying LDAP filter metacharacters. The marker is written only if',
+    '// those metacharacters reached the filter UNESCAPED — an escaped value still',
+    '// carries the sentinel, so the sentinel alone proves nothing.',
+    importLine,
+    "import fs from 'node:fs';",
+    'await new Promise((resolve) => {',
+    '  let timer = null;',
+    '  const done = () => { clearTimeout(timer); resolve(); };',
+    '  const res = {',
+    '    send: done, json: done, end: done,',
+    '    status: () => ({ send: done, json: done, end: done }),',
+    '  };',
+    `  const req = { ${src.prop}: ${JSON.stringify({ [src.key]: payload })} };`,
+    '  timer = setTimeout(resolve, 3000);',
+    `  try { ${invoke}(req, res); } catch { done(); }`,
+    '});',
+    '',
+    '// The whole decision, stated once: did the PAYLOAD\'s OWN metacharacters',
+    '// survive verbatim? Looking for any raw paren near the sentinel does not',
+    '// work — the application\'s filter template (\'(uid=\' + v + \')\') always',
+    '// contributes raw parens of its own, so that test called an ESCAPING',
+    '// handler vulnerable. Escaping rewrites the payload tail to \\2a\\29\\28…,',
+    '// so its verbatim presence is the bug and its absence is the fix working.',
+    'let proven = false;',
+    'try {',
+    `  for (const line of fs.readFileSync(${JSON.stringify(LDAP_LOG)}, 'utf8').split('\\n')) {`,
+    '    if (!line.trim()) continue;',
+    '    const rec = JSON.parse(line);',
+    `    for (const f of rec.filters) if (f.includes(${JSON.stringify(RAW_TAIL)})) proven = true;`,
+    '  }',
+    '} catch {}',
+    `if (proven) fs.writeFileSync('${MARKER}', 'x');`,
+  ].join('\n');
+
+  return {
+    ok: true,
+    poc: {
+      lang: 'js', kind: 'in-process', family: finding.family, cwe: finding.cwe || null,
+      marker: MARKER, paramKey: src.key, paramSource: src.prop, handler: handlerLabel,
+      driver,
+      observes: 'the request payload reached the LDAP client with its filter metacharacters unescaped',
+      requires: [base],
+      extraFiles: { [`node_modules/${driver}/index.js`]: LDAP_STUB },
+      code,
+    },
+  };
+}
+
+
+// ── XXE (CWE-611) ──────────────────────────────────────────────────────────
+//
+// The third-largest unclassified family in the published proof-coverage
+// breakdown. It is provable in-process for a reason the SSRF class is NOT: the
+// external entity can point at a LOCAL file the harness plants inside the
+// sandbox, so the proof needs no network and a failed fetch can never be
+// confinement talking.
+//
+// The decision is whether the parser RESOLVED the entity. The sentinel content
+// lives only in a file the XML never contains, so its presence in the parsed
+// output means the parser went and read it — which is the vulnerability. A
+// parser with entity expansion off returns the entity unexpanded (or throws),
+// and neither writes the marker.
+const XXE_SENTINEL = 'PROVEN_XXE_ENTITY_RESOLVED';
+const XXE_SENTINEL_FILE = 'xxe-sentinel.txt';
+const XXE_PARSERS = ['libxmljs', 'libxmljs2', '@xmldom/xmldom', 'xmldom', 'node-expat'];
+const XXE_PARSER_RES = XXE_PARSERS.map((d) => [
+  d, new RegExp(`require\\(\\s*['"\`]${d.replace('/', '\\/')}['"\`]|from\\s*['"\`]${d.replace('/', '\\/')}['"\`]`),
+]);
+
+function _xxePoc(finding, fileContent) {
+  const parser = (XXE_PARSER_RES.find(([, re]) => re.test(fileContent)) || [])[0];
+  if (!parser) {
+    return {
+      ok: false,
+      reason: `no recognised XML parser is required by this file, so there is nothing to observe entity resolution at (looked for: ${XXE_PARSERS.join(', ')})`,
+    };
+  }
+  const found = _findHandler(fileContent);
+  if (!found) return NO_HANDLER;
+  const { call, reqIdent } = found;
+
+  const src = _requestSource(fileContent, reqIdent, finding.line);
+  if (!src) {
+    return { ok: false, reason: `the handler does not read query/body/params off '${reqIdent}', so the XML entry point is unknown` };
+  }
+
+  const { base, importLine, invoke, handlerLabel } = _binding(finding, call);
+  const xml = `<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x SYSTEM "file://./${XXE_SENTINEL_FILE}">]><r>&x;</r>`;
+
+  const code = [
+    `// Auto-generated proof for ${finding.file}.`,
+    '// Plants a sentinel file, hands the handler XML whose external entity points',
+    '// at it, and writes the marker only if the SENTINEL CONTENT comes back —',
+    '// which can only happen if the parser resolved the entity and read the file.',
+    '// A parser with entity expansion disabled returns it unexpanded or throws.',
+    importLine,
+    "import fs from 'node:fs';",
+    `fs.writeFileSync(${JSON.stringify(XXE_SENTINEL_FILE)}, ${JSON.stringify(XXE_SENTINEL)});`,
+    'let seen = "";',
+    'await new Promise((resolve) => {',
+    '  let timer = null;',
+    '  const capture = (v) => { try { seen += typeof v === "string" ? v : JSON.stringify(v); } catch {} clearTimeout(timer); resolve(); };',
+    '  const res = {',
+    '    send: capture, json: capture, end: capture,',
+    '    status: () => ({ send: capture, json: capture, end: capture }),',
+    '  };',
+    `  const req = { ${src.prop}: ${JSON.stringify({ [src.key]: xml })} };`,
+    '  timer = setTimeout(resolve, 3000);',
+    `  try { const r = ${invoke}(req, res); if (r && typeof r.then === "function") r.then(capture, () => resolve()); } catch { resolve(); }`,
+    '});',
+    '',
+    '// The whole decision, stated once: the sentinel STRING is only reachable by',
+    '// reading the planted file. Matching the entity name or the XML itself would',
+    '// be satisfied by a parser that never expanded anything.',
+    `if (seen.includes(${JSON.stringify(XXE_SENTINEL)})) fs.writeFileSync('${MARKER}', 'x');`,
+  ].join('\n');
+
+  return {
+    ok: true,
+    poc: {
+      lang: 'js', kind: 'in-process', family: finding.family, cwe: finding.cwe || null,
+      marker: MARKER, paramKey: src.key, paramSource: src.prop, handler: handlerLabel,
+      driver: parser,
+      observes: 'the XML parser resolved an external entity and returned the contents of a local file',
+      requires: [base],
+      code,
+    },
+  };
+}
+
 function _pathTraversalPoc(finding, fileContent) {
   const found = _findHandler(fileContent);
   if (!found) return NO_HANDLER;

package/src/posture/proof-coverage.js

@@ -0,0 +1,162 @@
+// PRD F7.2 — publish what CANNOT be proven, and how much of the finding set that is.
+//
+// The PoC generator declines whole vulnerability classes it cannot honestly
+// prove. Those reasons were documented in poc-inprocess.js's header and nowhere
+// else, so the only number a reader ever saw was the proof RATE — computed over
+// the findings that happened to be provable. A high rate on a small provable
+// subset reads as strength and is nearly meaningless.
+//
+// Publishing which classes are structurally unprovable, and what share of real
+// findings they represent, is more credible than a high proof rate. It is also
+// the harder number to publish, which is rather the point.
+//
+// THE THREE BUCKETS, and why "unclassified" is separate from "indeterminate":
+//
+//   provable       — a proof class exists and a PoC can be attempted.
+//   indeterminate  — the class is DECLINED ON PURPOSE, with a stated reason.
+//                    Not a gap in effort; a limit of what a single-shot harness
+//                    can honestly assert.
+//   unclassified   — no proof class covers it and no decision has been recorded.
+//                    This is the genuine backlog, and it is kept apart so it can
+//                    never hide inside the principled exclusions.
+//   out-of-scope   — the in-process harness is JAVASCRIPT-ONLY. A Python, Java,
+//                    C#, PHP, Kotlin, Go or Ruby finding cannot be proven by it
+//                    at any effort, so it is not backlog — it is the CEILING.
+//
+// That fourth bucket is the "stated ceiling" Feature 7's exit gate asks for, and
+// omitting it made the headline number mean two different things at once.
+// Measured on the CVE corpus: 280 findings, of which only 76 are JS/TS. Proof
+// coverage is 26% of ALL findings and 96% of the ones the harness can reach.
+// Reporting the first alone understates the harness; reporting the second alone
+// overstates the product. Both are published, with the denominator on each.
+//
+// Folding `unclassified` into `indeterminate` would let "we haven't looked at
+// this" borrow the credibility of "we looked and it can't be done".
+import { SUPPORTED } from './poc-inprocess.js';
+
+// Declined on purpose. Reasons are the ones recorded in poc-inprocess.js — kept
+// as DATA here so a report can print them, rather than living only in a comment
+// nobody downstream can read.
+export const INDETERMINATE_BY_CLASS = Object.freeze({
+  'idor': 'proving it means showing user A read user B\'s record, which needs two authenticated identities and a populated data store. A single-shot harness would invent both, and a PoC built on invented state proves something about the invention.',
+  'broken-access-control': 'same as idor — requires two identities and real state.',
+  'broken-authz': 'same as idor — requires two identities and real state.',
+  'ssrf': 'the proof is that the server fetched an attacker-named host. The sandbox denies egress by design, so a failed fetch is confinement talking, not the finding.',
+  'xss': 'needs a browser to say whether the payload executed; a marker file cannot observe a DOM.',
+  'mutation-xss': 'needs a DOM and a parser round-trip — same limit as xss.',
+  'open-redirect': 'the effect is a Location header a browser would follow; nothing in a marker-file harness observes the follow.',
+});
+
+// The in-process harness only ever loads JavaScript (see poc-inprocess.js's
+// JS_EXT and its "ES-module source" refusal). Anything else is unreachable by
+// construction.
+const HARNESS_LANGS = /\.(?:js|cjs|mjs|jsx|ts|tsx)$/i;
+
+// Internal: `bucketOf` is the public surface for this question. Not exported —
+// the dead-export guard is right that a second entry point with no caller is
+// just surface area.
+function outOfHarnessScope(finding) {
+  const file = finding && typeof finding.file === 'string' ? finding.file : '';
+  if (!file) return false;              // unknown file — do not claim a ceiling
+  return !HARNESS_LANGS.test(file);
+}
+
+/** Bucket a finding: 'provable' | 'indeterminate' | 'unclassified' | 'out-of-scope'. */
+export function bucketOf(finding) {
+  // Language first: a Python SQL-injection finding is not "provable", however
+  // good the SQL proof class is. Ordering this after the class check would
+  // report a ceiling case as a capability.
+  if (outOfHarnessScope(finding)) return 'out-of-scope';
+  const fam = finding && typeof finding.family === 'string' ? finding.family : '';
+  if (!fam) return 'unclassified';
+  // Families are emitted as `<base>-<rule-slug>` in places, so match the base
+  // too — the same resolution problem the compliance evaluator hit.
+  const base = fam.split('-').slice(0, 2).join('-');
+  for (const key of SUPPORTED) {
+    if (fam === key || fam.startsWith(`${key}-`)) return 'provable';
+  }
+  for (const key of Object.keys(INDETERMINATE_BY_CLASS)) {
+    if (fam === key || fam.startsWith(`${key}-`) || base === key) return 'indeterminate';
+  }
+  return 'unclassified';
+}
+
+/**
+ * Proof coverage over a finding set.
+ *
+ * Every share carries {n, d} — a percentage without its denominator is exactly
+ * the shape of claim this module exists to replace.
+ */
+export function proofCoverage(findings) {
+  const list = Array.isArray(findings) ? findings.filter(Boolean) : [];
+  const d = list.length;
+  const buckets = { provable: [], indeterminate: [], unclassified: [], 'out-of-scope': [] };
+  for (const f of list) buckets[bucketOf(f)].push(f);
+
+  const byClass = {};
+  for (const f of buckets.indeterminate) {
+    const fam = f.family || '(none)';
+    const key = Object.keys(INDETERMINATE_BY_CLASS)
+      .find(k => fam === k || fam.startsWith(`${k}-`) || fam.split('-').slice(0, 2).join('-') === k) || fam;
+    if (!byClass[key]) byClass[key] = { n: 0, reason: INDETERMINATE_BY_CLASS[key] || 'declined' };
+    byClass[key].n += 1;
+  }
+
+  const unclassifiedFamilies = {};
+  for (const f of buckets.unclassified) {
+    const fam = f.family || '(no family)';
+    unclassifiedFamilies[fam] = (unclassifiedFamilies[fam] || 0) + 1;
+  }
+
+  const reachable = d - buckets['out-of-scope'].length;
+  const outLangs = {};
+  for (const f of buckets['out-of-scope']) {
+    const ext = (String(f.file || '').match(/\.[a-z0-9]+$/i) || ['(none)'])[0].toLowerCase();
+    outLangs[ext] = (outLangs[ext] || 0) + 1;
+  }
+
+  return {
+    total: d,
+    // Reported BOTH ways on purpose. `provable.d` is every finding; `ofReachable`
+    // is the share of what the harness can actually load. Publishing only one of
+    // them is how a number ends up meaning whatever the reader assumes.
+    provable: { n: buckets.provable.length, d, ofReachable: { n: buckets.provable.length, d: reachable } },
+    ceiling: {
+      reachable: { n: reachable, d },
+      outOfScope: { n: buckets['out-of-scope'].length, d, byExtension: outLangs },
+      reason: 'the in-process proof harness only loads JavaScript; findings in other languages cannot be execution-proven by it at any effort',
+    },
+    indeterminate: { n: buckets.indeterminate.length, d, byClass },
+    unclassified: { n: buckets.unclassified.length, d, families: unclassifiedFamilies },
+    provableClasses: [...SUPPORTED],
+    meaning: 'provable = a proof class exists; indeterminate = declined on purpose with a stated reason; unclassified = no proof class and no decision yet (the real backlog); out-of-scope = a language the JS-only harness cannot load at all (the ceiling, not backlog).',
+  };
+}
+
+/** Markdown for the scorecard. Every rate keeps its denominator. */
+export function renderProofCoverage(cov) {
+  if (!cov || !cov.total) return '_No findings to report proof coverage over._\n';
+  const pct = (n) => `${n}/${cov.total} (${Math.round((n / cov.total) * 100)}%)`;
+  const lines = [
+    '| Bucket | Share | Meaning |',
+    '|---|---|---|',
+    `| Provable | ${pct(cov.provable.n)} | a proof class exists and a PoC can be attempted |`,
+    `| Indeterminate by class | ${pct(cov.indeterminate.n)} | declined on purpose — see reasons below |`,
+    `| Unclassified | ${pct(cov.unclassified.n)} | no proof class yet; the real backlog |`,
+    `| Out of harness scope | ${pct(cov.ceiling.outOfScope.n)} | not JavaScript — the harness cannot load it at all |`,
+    '',
+    // Stated every time, because the two readings of "provable" differ by a lot
+    // and a reader who sees only the first will draw the wrong conclusion.
+    `**Ceiling.** ${cov.ceiling.reason}. Of ${cov.total} findings, ${cov.ceiling.reachable.n} are reachable by the harness; `
+    + `proof coverage is ${cov.provable.n}/${cov.total} of ALL findings and `
+    + `${cov.provable.ofReachable.n}/${cov.provable.ofReachable.d} of the reachable ones.`,
+    '',
+  ];
+  const entries = Object.entries(cov.indeterminate.byClass).sort((a, b) => b[1].n - a[1].n);
+  if (entries.length) {
+    lines.push('**Why each class is declined**', '');
+    for (const [cls, { n, reason }] of entries) lines.push(`- \`${cls}\` (${n}): ${reason}`);
+    lines.push('');
+  }
+  return lines.join('\n');
+}

package/src/posture/reachability-filter.js

@@ -71,3 +71,47 @@ export function demoteUnreachable(findings, opts = {}) {
     f._reachabilityDemoted = before;
   }
 }
+
+// ── PRD F3.2 — reachability is its OWN claim, scored separately ────────────
+//
+// "A vulnerable version is present" and "the vulnerable FUNCTION is reachable"
+// are different assertions with different error costs, and they were reported as
+// one number.
+//
+//   A false "unreachable" is a MISSED EXPLOIT — the finding is demoted to info
+//   and a real vulnerability stops being shown.
+//   A false "reachable" is noise — someone reads a finding that did not matter.
+//
+// Those costs are not symmetric, so a single accuracy figure covering both is
+// the wrong instrument. This reports each separately with {n, d}, plus the
+// DEMOTION RATE, which is the number that says how much work the reachability
+// claim is doing: a demotion rate near zero means the feature is not earning
+// its risk, and a high one means a great deal rests on it being right.
+export function summarizeReachability(findings) {
+  const list = Array.isArray(findings) ? findings.filter(Boolean) : [];
+
+  // Only findings the analysis actually had an opinion about belong in the
+  // denominator. A finding with no reachability verdict is UNKNOWN, and folding
+  // unknowns into "reachable" would inflate the claim being measured.
+  const judged = list.filter((f) => f.unreachable === true || f.reachable === true || f.functionReachable != null);
+  const d = judged.length;
+
+  const demoted = judged.filter((f) => f.unreachable === true);
+  const reachable = judged.filter((f) => f.unreachable !== true);
+
+  return {
+    total: list.length,
+    judged: { n: d, d: list.length },
+    unknown: { n: list.length - d, d: list.length },
+    reachable: { n: reachable.length, d },
+    unreachable: { n: demoted.length, d },
+    demotionRate: { n: demoted.length, d },
+    errorCosts: {
+      falseUnreachable: 'a MISSED EXPLOIT — the finding is demoted to info and a real vulnerability stops being shown',
+      falseReachable: 'noise — someone reads a finding that did not matter',
+    },
+    caveat: d === 0
+      ? 'nothing was judged for reachability; every rate is 0/0 and means nothing'
+      : 'unknown is a first-class state and is NOT counted as reachable',
+  };
+}

package/src/posture/sbom.js

@@ -7,24 +7,63 @@
 // SPDX 2.3 schema reference:  https://spdx.github.io/spdx-spec/v2.3/
 
 import * as crypto from 'node:crypto';
+import { isDeterministic } from './deterministic.js';
 
 function _purl(c) {
   if (c.purl) return c.purl;
   const eco = c.ecosystem || 'generic';
   const name = encodeURIComponent(c.name || '');
-  const ver = encodeURIComponent(c.version || '');
+  // Same rule as _bomRef: no version means no `@version` segment at all, not an
+  // empty or undefined one. purl consumers treat `pkg:npm/x@` as malformed.
+  const ver = c.version ? encodeURIComponent(c.version) : '';
   // pkg:npm/<name>@<version> — pkg URL spec
-  return `pkg:${eco === 'npm' ? 'npm' : eco === 'pypi' ? 'pypi' : eco === 'maven' ? 'maven' : eco === 'cargo' ? 'cargo' : eco === 'go' ? 'golang' : eco === 'rubygems' ? 'gem' : eco === 'composer' ? 'composer' : eco}/${name}@${ver}`;
+  return `pkg:${eco === 'npm' ? 'npm' : eco === 'pypi' ? 'pypi' : eco === 'maven' ? 'maven' : eco === 'cargo' ? 'cargo' : eco === 'go' ? 'golang' : eco === 'rubygems' ? 'gem' : eco === 'composer' ? 'composer' : eco}/${name}${ver ? `@${ver}` : ''}`;
 }
 
 function _bomRef(c) {
-  return `${c.ecosystem || 'pkg'}:${c.name}@${c.version}`;
+  // A component with no version is ordinary — unpinned entries appear in real
+  // manifests — and the identifier must DEGRADE rather than interpolate a JS
+  // value. `npm:x@undefined` is not a version anyone can resolve, and it ships
+  // inside a document whose whole purpose is to be parsed by someone else's
+  // tooling, where it fails days later pointing at them rather than at us.
+  const eco = c.ecosystem || 'pkg';
+  const name = c.name || 'unknown';
+  return c.version ? `${eco}:${name}@${c.version}` : `${eco}:${name}`;
+}
+
+// CycloneDX `serialNumber` and SPDX `documentNamespace` are both required to
+// identify a document, and both were minted with crypto.randomUUID() — so two
+// scans of identical input produced different bytes, and `--deterministic` did
+// not actually make an SBOM reproducible. An attestation over an SBOM is only
+// meaningful if the SBOM can be regenerated and compared.
+//
+// Under --deterministic the identifier is derived from the document's own
+// content instead of randomness. That preserves what the identifier is FOR:
+// different content still yields a different id, while identical content
+// yields an identical one — the standard reproducible-build treatment. Outside
+// deterministic mode the random UUID is unchanged, so ordinary scans keep
+// per-run-unique document ids.
+function _stableUuidFrom(seed) {
+  const h = crypto.createHash('sha256').update(String(seed)).digest('hex');
+  // Shape the digest as a v4-looking UUID: the version/variant nibbles are set
+  // so consumers that validate the format still accept it.
+  return [
+    h.slice(0, 8),
+    h.slice(8, 12),
+    `4${h.slice(13, 16)}`,
+    `${((parseInt(h[16], 16) & 0x3) | 0x8).toString(16)}${h.slice(17, 20)}`,
+    h.slice(20, 32),
+  ].join('-');
+}
+
+function _documentUuid(seed) {
+  return isDeterministic() ? _stableUuidFrom(seed) : crypto.randomUUID();
 }
 
 export function toCycloneDX(scan, meta = {}) {
   const components = scan.components || [];
   const supplyChain = (scan.supplyChain || []).filter(s => s.type === 'vulnerable_dep');
-  const serialNumber = `urn:uuid:${crypto.randomUUID()}`;
+  const serialNumber = `urn:uuid:${_documentUuid(JSON.stringify(components.map(_bomRef)))}`;
 
   const cdxComponents = components.map(c => ({
     type: 'library',
@@ -36,8 +75,12 @@ export function toCycloneDX(scan, meta = {}) {
     ...(c.scope ? { scope: c.scope === 'dev' ? 'optional' : 'required' } : {}),
   }));
 
-  const vulnerabilities = supplyChain.map(s => ({
-    'bom-ref': `${_bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version })}#${s.osvId || s.advisory || crypto.randomUUID()}`,
+  const vulnerabilities = supplyChain.map((s, i) => ({
+    // The last-resort id was crypto.randomUUID(), which reintroduced
+    // per-run drift for any advisory carrying neither an osvId nor an
+    // advisory string. Index within the (already deterministically sorted)
+    // supplyChain array identifies it just as well and is reproducible.
+    'bom-ref': `${_bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version })}#${s.osvId || s.advisory || `unidentified-${i}`}`,
     id: s.osvId || (s.cveAliases || [])[0] || s.advisory,
     source: { name: 'OSV.dev', url: `https://osv.dev/vulnerability/${s.osvId || ''}` },
     references: (s.cveAliases || []).map(cve => ({ id: cve, source: { name: 'NVD' } })),
@@ -72,7 +115,7 @@ export function toCycloneDX(scan, meta = {}) {
 export function toSPDX(scan, meta = {}) {
   const components = scan.components || [];
   const supplyChain = (scan.supplyChain || []).filter(s => s.type === 'vulnerable_dep');
-  const docNamespace = `https://agentic-security.local/spdx/${crypto.randomUUID()}`;
+  const docNamespace = `https://agentic-security.local/spdx/${_documentUuid(JSON.stringify(components.map(_bomRef)))}`;
   const ts = meta.startedAt || new Date().toISOString();
 
   const packages = components.map((c, i) => ({

package/src/runScan.js

@@ -4,7 +4,7 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as cp from 'node:child_process';
 import { listFiles } from './util/glob.js';
-import { runFullScan, shouldScan, isKubernetesManifest } from './engine.js';
+import { runFullScan, shouldScan, isKubernetesManifest, isCloudFormationTemplate, isInstructionFile } from './engine.js';
 import { appendScanSnapshot } from './posture/security-trend.js';
 import { recover as recoverFixHistory } from './posture/fix-history.js';
 import { stampScan } from './posture/ruleset-version.js';
@@ -13,11 +13,55 @@ const DEP_FILE_NAMES = new Set([
   'package.json','package-lock.json','yarn.lock','pnpm-lock.yaml',
   'requirements.txt','pyproject.toml','poetry.lock','Pipfile.lock',
   'composer.json','composer.lock','Gemfile','Gemfile.lock',
-  'go.mod','Cargo.toml','Cargo.lock',
+  // go.sum, not just go.mod: go.mod lists what this module REQUIRES, go.sum
+  // lists what was RESOLVED — the transitive graph that is actually shipped.
+  // `_parseGoSum` and its dispatch entry have always existed in engine.js; the
+  // file simply never reached them, so Go SCA saw direct requires only.
+  // Measured by bench/sca-replay at 15 of 549 labelled vulnerable versions.
+  'go.mod','go.sum','Cargo.toml','Cargo.lock',
   'pom.xml','build.gradle','build.gradle.kts',
   'pubspec.yaml','pubspec.lock',
 ]);
 
+// Python requirements files are `requirements/dev.txt`, `requirements-dev.txt`
+// and `requirements/base.txt` at least as often as they are the bare name.
+// pallets/flask ships `requirements/dev.txt` and scored 0 of 11 labelled
+// vulnerabilities until this matched.
+//
+// Deliberately narrow. An arbitrary `.txt` reaching the PyPI parser would
+// invent components out of prose, which is a worse failure than missing one:
+// a false dependency is unfalsifiable noise in a supply-chain report.
+const REQUIREMENTS_FILE = /^requirements(?:[._-][\w.-]+)?\.txt$/i;
+const REQUIREMENTS_DIR_FILE = /(?:^|\/)requirements\/[\w.-]+\.txt$/i;
+
+export function isDepFile(rel) {
+  const base = rel.split('/').pop();
+  if (DEP_FILE_NAMES.has(base)) return true;
+  if (REQUIREMENTS_FILE.test(base)) return true;
+  if (REQUIREMENTS_DIR_FILE.test(rel.split(path.sep).join('/'))) return true;
+  return false;
+}
+
+// Two caps, because the two kinds of file cost completely different amounts to
+// process.
+//
+// A CODE file over the cap is skipped to protect the analysis path: parsing and
+// walking an AST of a multi-megabyte generated file is where a scan goes from
+// slow to hung.
+//
+// A MANIFEST is read by JSON.parse or a line loop. Applying the code cap to it
+// bought nothing and cost everything: npm/cli's package-lock.json is 666 KB,
+// next.js's pnpm-lock.yaml is 910 KB, magento2's composer.lock is 501 KB — so
+// on every project large enough for supply-chain risk to matter, the lockfile
+// was dropped and SCA silently fell back to the exact versions that happened to
+// appear in package.json. That is DIRECT dependencies only, while the headline
+// claim of this feature is transitive reachability.
+//
+// The manifest cap is larger, not absent. Reading an unbounded file into memory
+// to parse it is how a scan becomes a denial of service against its own host.
+const MAX_CODE_BYTES = 500_000;
+const MAX_DEP_BYTES = 10_000_000;
+
 const DEFAULT_IGNORE = [
   '**/node_modules/**','**/.git/**','**/__pycache__/**','**/vendor/**',
   '**/dist/**','**/build/**','**/.next/**','**/venv/**','**/env/**','**/.venv/**',
@@ -33,11 +77,12 @@ export async function readTree(root, { ignore = [] } = {}) {
     const abs = path.join(root, rel);
     let stat;
     try { stat = await fs.stat(abs); } catch { continue; }
-    if (stat.size > 500_000) continue;
+    const dep = isDepFile(rel);
+    if (stat.size > (dep ? MAX_DEP_BYTES : MAX_CODE_BYTES)) continue;
     let content;
     try { content = await fs.readFile(abs, 'utf8'); } catch { continue; }
     const base = path.basename(rel);
-    if (DEP_FILE_NAMES.has(base)) depFileContents[rel] = content;
+    if (dep) depFileContents[rel] = content;
     // Cross-language taint module needs to see openapi/swagger specs even
     // though they aren't "code" per se. Stash them in depFileContents so
     // they ride through to runFullScan without polluting the SAST loop.
@@ -48,7 +93,13 @@ export async function readTree(root, { ignore = [] } = {}) {
     // A Kubernetes manifest is admitted on CONTENT, not on living under a
     // directory named k8s/ — see isKubernetesManifest. Without this the
     // k8s-admission detector is wired into the dispatch and never invoked by it.
-    if (shouldScan(rel) || isKubernetesManifest(rel, content)) fileContents[rel] = content;
+    // BOTH gates must open, exactly as the k8s fix required: runScan admits a
+    // file here, then runFullScan re-filters the same list. Opening only one
+    // leaves the detector just as dark.
+    // A CloudFormation template is a `.yaml`/`.json` that no path predicate can
+    // recognise — same problem as a Kubernetes manifest, same fix, and the same
+    // requirement that BOTH gates open: runFullScan re-filters this exact list.
+    if (shouldScan(rel) || isKubernetesManifest(rel, content) || isCloudFormationTemplate(rel, content) || isInstructionFile(rel)) fileContents[rel] = content;
     // Auxiliary files: .properties files are referenced by Java rules
     // (e.g. OWASP Benchmark's benchmark.properties resolves algorithm
     // aliases). They are not scannable for vulns themselves, but the