@clear-capabilities/agentic-security-scanner 0.139.1 → 0.141.0

package/src/dataflow/catalog.js

@@ -163,6 +163,41 @@ export const CATALOG = [
   // `dict.get(...)`/`config.get(...)` elsewhere in the file does not also
   // fire.
   { kind: 'source', id: 'py-flask-args-get',       language: 'py', framework: 'flask',   match: { type: 'call', callee: 'get', receiver: '^(?:args|form|values|headers|cookies|json|data|GET|POST|FILES|META)$', receiverBase: '^(?:request|req)$' }, label: 'request.args/form/values/headers/cookies/json/data.get() (Flask/Django)', provenance: 'url-param' },
+  // PRD F2.2 — the MULTI-VALUE accessors, which were missing entirely.
+  //
+  // `getlist` is the standard Flask/Werkzeug and Django QueryDict API for a
+  // repeated query parameter (`?host=a&host=b`), and `getall` is its
+  // multidict equivalent. Only `get` was modelled, so every repeated-parameter
+  // flow was invisible to the taint engine.
+  //
+  // This is worth recording because the PRD attributed the miss to Python
+  // COMPREHENSIONS (`[x for x in request.args.getlist(...)]`) and proposed
+  // modelling them. Comprehensions already flow — verified with the same shape
+  // over `request.args.get()`, which the engine tracks end to end. The example
+  // failed on its SOURCE, not on its loop, and modelling comprehensions would
+  // have changed nothing while looking like a fix.
+  { kind: 'source', id: 'py-flask-args-getlist',   language: 'py', framework: 'flask',   match: { type: 'call', callee: 'getlist', receiver: '^(?:args|form|values|headers|cookies|json|data|GET|POST|FILES|META)$', receiverBase: '^(?:request|req)$' }, label: 'request.args/form/values.getlist() (Flask/Django)', provenance: 'url-param' },
+  { kind: 'source', id: 'py-flask-args-getall',    language: 'py', framework: 'flask',   match: { type: 'call', callee: 'getall',  receiver: '^(?:args|form|values|headers|cookies|json|data|GET|POST|FILES|META)$', receiverBase: '^(?:request|req)$' }, label: 'request.args/form/values.getall() (multidict)', provenance: 'url-param' },
+
+  // PRD F2.3 — NETWORK-RESPONSE sources.
+  //
+  // Only two existed, both C++ (`recv`, `recvfrom`), so a response body from an
+  // external service was trusted input everywhere else. It is not: the upstream
+  // may be compromised, attacker-influenced (the far end of an SSRF), or simply
+  // a third party whose output this code renders, executes or shells out with.
+  // This is the same trust boundary as an HTTP request arriving — the direction
+  // is reversed, not the trust.
+  //
+  // Kept under its OWN provenance ('network') rather than folded into
+  // http-body, so a report can say where the value came from and a team that
+  // genuinely trusts its own internal API can filter on it. Collapsing them
+  // would remove exactly the fact needed to triage these.
+  { kind: 'source', id: 'js-fetch-json',   language: 'js', framework: 'fetch', match: { type: 'call', callee: 'json', receiverBase: '^(?:res|resp|response|r)$' }, label: 'HTTP response .json() [fetch]', provenance: 'network' },
+  { kind: 'source', id: 'js-fetch-text',   language: 'js', framework: 'fetch', match: { type: 'call', callee: 'text', receiverBase: '^(?:res|resp|response|r)$' }, label: 'HTTP response .text() [fetch]', provenance: 'network' },
+  { kind: 'source', id: 'js-axios-data',   language: 'js', framework: 'axios', match: { type: 'member', object: 'response', prop: 'data' }, label: 'axios response.data', provenance: 'network' },
+  { kind: 'source', id: 'py-requests-text', language: 'py', framework: 'requests', match: { type: 'member', object: 'resp', prop: 'text' }, label: 'requests response .text', provenance: 'network' },
+  { kind: 'source', id: 'py-requests-json', language: 'py', framework: 'requests', match: { type: 'call', callee: 'json', receiverBase: '^(?:resp|response|r)$' }, label: 'requests response .json()', provenance: 'network' },
+  { kind: 'source', id: 'py-urlopen-read',  language: 'py', framework: 'urllib',   match: { type: 'call', callee: 'read', receiverBase: '^(?:resp|response|r|f)$' }, label: 'urlopen read() [urllib]', provenance: 'network' },
   { kind: 'source', id: 'py-fastapi-request-query',language: 'py', framework: 'fastapi', match: { type: 'call',   callee: 'Query'                  }, label: 'fastapi.Query()' },
   { kind: 'source', id: 'py-fastapi-request-body', language: 'py', framework: 'fastapi', match: { type: 'call',   callee: 'Body'                   }, label: 'fastapi.Body()' },
   { kind: 'source', id: 'py-fastapi-form',         language: 'py', framework: 'fastapi', match: { type: 'call',   callee: 'Form'                   }, label: 'fastapi.Form()' },
@@ -228,6 +263,32 @@ export const CATALOG = [
   { kind: 'source', id: 'py-mcp-tool', language: 'py', framework: 'mcp', match: { type: 'annotation', name: 'mcp.tool' }, label: '@mcp.tool() parameter', provenance: 'agent-tool' },
   { kind: 'source', id: 'py-mcp-server-tool', language: 'py', framework: 'mcp', match: { type: 'annotation', name: 'server.tool' }, label: '@server.tool() parameter', provenance: 'agent-tool' },
 
+  // PRD F5.3 — the SAME trust boundary in JavaScript/TypeScript.
+  //
+  // The agent-tool boundary was modelled for Python only, while the
+  // TypeScript SDK (@modelcontextprotocol/sdk) is the dominant implementation.
+  // A tool argument is attacker-influenced in exactly the way an HTTP body is:
+  // whatever the model was persuaded to pass, by a web page it read, a file it
+  // opened, or another tool's output. Treating it as trusted because "the model
+  // sent it" is the confused-deputy assumption this whole feature exists to
+  // reject.
+  //
+  // `request.params.arguments` is the CallToolRequest shape every SDK server
+  // handler receives; `extra.arguments` covers the newer callback signature.
+  { kind: 'source', id: 'js-mcp-call-args', language: 'js', framework: 'mcp', match: { type: 'member', object: 'params', prop: 'arguments' }, label: 'MCP tool call arguments', provenance: 'agent-tool' },
+  { kind: 'source', id: 'js-mcp-request-params', language: 'js', framework: 'mcp', match: { type: 'member', object: 'request', prop: 'params' }, label: 'MCP request.params', provenance: 'agent-tool' },
+  { kind: 'source', id: 'js-mcp-extra-args', language: 'js', framework: 'mcp', match: { type: 'member', object: 'extra', prop: 'arguments' }, label: 'MCP tool callback arguments', provenance: 'agent-tool' },
+
+  // TOOL OUTPUT is the other half of F5.3's shape (tool output -> model context
+  // -> tool invocation). Content returned by ANOTHER tool or an MCP resource is
+  // not the agent's own reasoning — it is third-party text that reached the
+  // context window. A server that reads a resource and passes it onward is the
+  // indirect-injection path, and it was invisible while only tool INPUT was a
+  // source.
+  { kind: 'source', id: 'js-mcp-tool-result', language: 'js', framework: 'mcp', match: { type: 'member', object: 'result', prop: 'content' }, label: 'MCP tool result content', provenance: 'agent-tool' },
+  { kind: 'source', id: 'js-mcp-resource-contents', language: 'js', framework: 'mcp', match: { type: 'member', object: 'resource', prop: 'contents' }, label: 'MCP resource contents', provenance: 'agent-tool' },
+  { kind: 'source', id: 'py-mcp-tool-result', language: 'py', framework: 'mcp', match: { type: 'member', object: 'result', prop: 'content' }, label: 'MCP tool result content', provenance: 'agent-tool' },
+
   // ─── SOURCES (Go) ─────────────────────────────────────────────────────────
   { kind: 'source', id: 'go-r-form',     language: 'go', framework: 'net/http', match: { type: 'member', object: 'r', prop: 'Form' },     label: 'r.Form' },
   { kind: 'source', id: 'go-r-postform', language: 'go', framework: 'net/http', match: { type: 'member', object: 'r', prop: 'PostForm' }, label: 'r.PostForm' },

package/src/engine.js

@@ -15,6 +15,7 @@ import { scanLlmCost } from './sast/llm-cost-advisor.js';
 import { scanBusinessLogic } from './sast/logic.js';
 import { scanPipeline } from './sast/pipeline.js';
 import { scanMCP } from './sast/mcp-audit.js';
+import { detectRugPull as _detectRugPull, saveBaseline as _saveMcpBaseline, fingerprintConfig as _fingerprintMcp } from './posture/mcp-rug-pull.js';
 import { scanClaudeSettings } from './sast/claude-settings.js';
 import { scanClaudeMdPromptInjection } from './sast/claude-md-prompt-injection.js';
 import { scanClaudeHookInjection } from './sast/claude-hook-injection.js';
@@ -35,8 +36,11 @@ import { scanLlmTradingAgent } from './sast/llm-trading-agent.js';
 import { scanMobileManifest } from './sast/mobile-manifest.js';
 import { scanQuarkusHardening } from './sast/quarkus-hardening.js';
 import { scanFastapiHardening } from './sast/fastapi-hardening.js';
+import { isDeterministic } from './posture/deterministic.js';
+import { proofCoverage } from './posture/proof-coverage.js';
 import { scanAuthZ } from './sast/authz.js';
 import { scanApiBrokenAuthz } from './sast/api-authz.js';
+import { scanCloudTemplates, isCloudFormationTemplate } from './sast/iac-cloud-templates.js';
 import { scanTerraform } from './sast/iac-terraform.js';
 import { scanCrossService } from './sast/cross-service.js';
 import { scanRbacConsistency } from './sast/rbac-consistency.js';
@@ -124,7 +128,7 @@ import { scanMutationXSS } from './sast/mutation-xss.js';
 import { scanDeserializationGadgets, _detectGadgets } from './sast/deserialization-gadgets.js';
 // Phase 2 — Kotlin / Ruby / PHP coverage.
 import { scanKotlin } from './sast/kotlin.js';
-import { scanRuby } from './sast/ruby.js';
+import { scanRuby, scanRubyPathJoin } from './sast/ruby.js';
 import { scanPhp } from './sast/php.js';
 import { classifySecretCandidate as _entropyClassifySecret } from './sast/_secret-entropy.js';
 // Phase 1 — precision-engineering posture modules.
@@ -664,6 +668,7 @@ function _isIaCFile(p){
   if (IAC_FILENAMES.has(base)) return true;
   if (/\.dockerfile$/i.test(base)) return true;
   if (/\.tf$|\.tfvars$/i.test(base)) return true;
+  if (/\.bicep$/i.test(base)) return true;
   // K8s YAML heuristic: under k8s/ — the CONTENT half of this rule lives in
   // `isKubernetesManifest` below, because a path predicate cannot see content.
   if (/(?:^|\/)k8s(?:\/|$)/.test(p) && /\.ya?ml$/i.test(base)) return true;
@@ -709,6 +714,27 @@ export function isKubernetesManifest(relPath, content) {
   return _K8S_API_VERSION_RE.test(head) && _K8S_KIND_RE.test(head);
 }
 function getExt(n){const p=n.split(".");return p.length>1?p.pop().toLowerCase():"";}
+
+// Agent instruction files (CLAUDE.md, AGENTS.md, .cursorrules, …) are admitted
+// by CONTENT-INDEPENDENT NAME, the same way isKubernetesManifest admits a
+// manifest a path predicate cannot recognise.
+//
+// They fail shouldScan() because they are markdown, so `fileContents` never held
+// one, so scanClaudeMdPromptInjection / scanClaudeHookInjection / scanMCP at the
+// per-file dispatch could never run on them. The detectors were CORRECT and
+// fully tested when called directly — they were simply never called. That is the
+// same dark-detector shape as k8s-admission and install-script, and it is worse
+// here: for an agentic security tool a poisoned instruction file loaded into
+// every session is a flagship threat, and a normal scan could not see it.
+//
+// Matched on the naming convention only. A repository's ordinary docs stay out
+// of scope, so this admits a handful of files rather than every .md in the tree.
+const _INSTRUCTION_FILE_ADMIT_RE = /(?:^|[\\/])(?:CLAUDE|AGENTS|GEMINI|CURSOR|CODEX|KIRO|QWEN|TRAE|OPENCODE|SYSTEM_PROMPT)\.(?:md|markdown|txt|prompt|system\.md)$|(?:^|[\\/])\.(?:cursorrules|windsurfrules|aiderrules)$|(?:^|[\\/])\.(?:claude|cursor|codex|gemini)[\\/].*\.(?:md|json|ya?ml)$/i;
+
+export function isInstructionFile(relPath) {
+  return typeof relPath === 'string' && _INSTRUCTION_FILE_ADMIT_RE.test(relPath);
+}
+
 function shouldScan(p){if(/\.(test|spec|mock)\./i.test(p))return false;if(/_test\.go$/i.test(p))return false;if(/_spec\.rb$/i.test(p))return false;if(/Test\.(?:java|cs|kt|scala)$/i.test(p))return false;if(/\.min\.[mc]?js$/i.test(p))return false;for(const x of p.split("/"))if(IGNORE_DIRS.has(x))return false;
   // Mobile + framework manifest files needed by the v4 detectors.
   const base=p.split('/').pop();
@@ -1401,6 +1427,10 @@ function _sinkLineIdentifiers(ctx) {
 // (excluding the sink line itself, which trivially contains its own
 // argument). Tries every match, not just the first, since a window can
 // contain several guard-shaped lines and only one need actually correlate.
+// A function/method declaration line, in every language this engine reads.
+// Matching a guard-shaped NAME here means a method is being defined, not called.
+const _DECL_LINE_RE = /^\s*(?:@\w+\s*)?(?:(?:public|private|protected|internal|static|final|abstract|override|async|export|default|func|fun|fn|def|sub|function)\s+)+[\w.<>\[\]]+\s*\(|^\s*def\s+\w|^\s*(?:async\s+)?function\s+\w|^\s*func\s+(?:\([^)]*\)\s*)?\w+\s*\(|^\s*(?:const|let|var)\s+\w+\s*=\s*(?:async\s*)?\([^)]*\)\s*=>/;
+
 function _guardMatchNearSinkIdentifier(ctx, guardRe, span = 2) {
   const w = _guardWindow(ctx);
   const re = new RegExp(guardRe.source, guardRe.flags.includes('g') ? guardRe.flags : guardRe.flags + 'g');
@@ -1411,6 +1441,19 @@ function _guardMatchNearSinkIdentifier(ctx, guardRe, span = 2) {
   let m;
   while ((m = re.exec(w))) {
     const guardLineIdx = w.slice(0, m.index).split('\n').length - 1; // 0-based within window
+    // A DECLARATION is not a guard. The shape alternative deliberately matches a
+    // project-local validator by name (`[Cc]heck\w+\(`, `[Ee]nsure\w+\(`, …), and
+    // that also matches the line that DEFINES such a method — so
+    // `def check_static_cache(request)` was read as containment being applied,
+    // and every path-traversal finding inside a method whose own name begins
+    // "check"/"validate"/"ensure"/"verify"/"assert"/"require" was dropped.
+    //
+    // Found by test/detector-liveness.test.js on the ruby-path-join fixture: the
+    // rule fired in isolation and produced nothing through a scan — the same
+    // signature as rate-limit.js and sibling-guard-omission. Narrow by design:
+    // it skips declaration LINES, and does not touch the window heuristic that
+    // every other CWE-22 and CWE-918 emitter depends on.
+    if (_DECL_LINE_RE.test(wLines[guardLineIdx] || '')) continue;
     const lo = Math.max(0, guardLineIdx - span);
     const hi = Math.min(wLines.length, guardLineIdx + span + 1);
     const local = wLines.slice(lo, hi).filter((l) => l !== sinkLineText).join('\n');
@@ -1849,9 +1892,27 @@ const STRUCTURAL_VULN_PATTERNS=[
    type:"File Serve",vuln:"Path Traversal (sendFile with User Input)",severity:"high",cwe:"CWE-22",stride:"Information Disclosure",
    fix:"Allowlist file paths; never pass raw user input to sendFile"},
   // ── Command Injection ──────────────────────────────────────────────────────
-  {regex:/(?:exec|spawn|execSync|execFile)\s*\([^;)]*(?:req\.|\.body\.|\.query\.|\.params\.)[^;)]{0,200}\)/g,
+  // SHELL-INVOKING forms only. `exec`/`execSync` hand the whole string to a
+  // shell, so user input anywhere in the command is injection.
+  //
+  // `execFile`/`spawn` are DELIBERATELY NOT HERE. They take an argv array and
+  // do not spawn a shell, so a tainted ARGUMENT cannot inject a command — they
+  // are the canonical FIX for this very finding. The previous rule matched them
+  // and rated it critical, while its own remediation text read "Use execFile
+  // with argument array": following the advice could not clear the finding.
+  // Flagging the fix as the bug is how a team learns to ignore a scanner.
+  {regex:/(?:exec|execSync)\s*\([^;)]*(?:req\.|\.body\.|\.query\.|\.params\.)[^;)]{0,200}\)/g,
    type:"OS Command",vuln:"Command Injection (User-Controlled Input)",severity:"critical",cwe:"CWE-78",stride:"Elevation of Privilege",
    fix:"Use execFile with argument array; never interpolate user input into shell commands"},
+  // The two ways an argv-form call IS still injectable:
+  //   1. the tainted value is the COMMAND (first argument), not an argument to it
+  //   2. `shell: true` is passed, which re-introduces the shell the argv form avoids
+  {regex:/(?:execFile|spawn)(?:Sync)?\s*\(\s*[^,;)]*(?:req\.|\.body\.|\.query\.|\.params\.)[^,;)]{0,120}[,)]/g,
+   type:"OS Command",vuln:"Command Injection (User-Controlled Command Name)",severity:"critical",cwe:"CWE-78",stride:"Elevation of Privilege",
+   fix:"The COMMAND itself is user-controlled — an argv array does not help. Resolve the binary from a fixed allowlist."},
+  {regex:/(?:execFile|spawn)(?:Sync)?\s*\([^;]{0,300}shell\s*:\s*true[^;]{0,200}(?:req\.|\.body\.|\.query\.|\.params\.)|(?:execFile|spawn)(?:Sync)?\s*\([^;]{0,300}(?:req\.|\.body\.|\.query\.|\.params\.)[^;]{0,200}shell\s*:\s*true/g,
+   type:"OS Command",vuln:"Command Injection (argv form with shell:true)",severity:"critical",cwe:"CWE-78",stride:"Elevation of Privilege",
+   fix:"`shell: true` re-introduces the shell that the argv array exists to avoid. Drop the option, or escape the input."},
   {regex:/(?:vm\.runInContext|vm\.runInNewContext|new\s+vm\.Script)\s*\(/g,
    type:"VM Sandbox",vuln:"VM Sandbox Execution (RCE Risk)",severity:"critical",cwe:"CWE-94",stride:"Elevation of Privilege",
    fix:"Never execute user-supplied code in vm.runInContext; use a strict AST sandbox"},
@@ -6850,6 +6911,19 @@ const CIPHER_TRANSIT_PATTERNS=[
 function classifyCipherStrength(cipher){const c=cipher.toUpperCase();if(/\bRC4\b|\bRC2\b|\bARCFOUR\b|SSLV2|SSLV3|\bNULL\b|\bEXPORT\b|\bANULL\b|\bENULL\b|\bECB\b|\bMD5\b|\bSHA1\b(?![\d_])/.test(c))return"weak";if(/\bDES\b/.test(c)&&!/3DES|EDE|TRIPLE/.test(c))return"weak";if(/3DES|TRIPLE.?DES|DES.EDE|TLS.?1.?1|TLSV1\.1/.test(c))return"weak";if(/BCRYPT|ARGON2|SCRYPT|PBKDF2|FERNET|CHACHA20|CHACHAPOLY|PASSWORD_BCRYPT|PASSWORD_ARGON/.test(c))return"strong";if(/\bAES\b|SHA256|SHA384|SHA512|SHA3|BLAKE2|HMACSHA256|HMACSHA512|\bGCM\b|\bCCM\b|ECDHE|DHE|TLS.?1.?[23]|TLSV1\.[23]|HTTPS.SERVER|TLS.SERVER|TLS.CERTIF|HS256|RS256|ES256/.test(c))return"strong";return"unknown";}
 function scanCiphers(fp,raw){const cleaned=stripNoise(raw,fp);const lines=raw.split("\n");const atRest=[],inTransit=[];for(const pat of CIPHER_REST_PATTERNS){const re=new RegExp(pat.regex.source,pat.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const cipher=pat.getLabel(m);atRest.push({cipher,strength:classifyCipherStrength(cipher),ctx:pat.ctx,file:fp,line,snippet:(lines[line-1]||"").trim()});}}for(const pat of CIPHER_TRANSIT_PATTERNS){const re=new RegExp(pat.regex.source,pat.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const cipher=pat.getLabel(m);inTransit.push({cipher,strength:classifyCipherStrength(cipher),ctx:pat.ctx,file:fp,line,snippet:(lines[line-1]||"").trim()});}}const uniq=(a)=>a.filter((v,i,arr)=>arr.findIndex(x=>x.cipher===v.cipher&&x.file===v.file&&x.line===v.line)===i);return{atRest:uniq(atRest),inTransit:uniq(inTransit)};}
 
+// True for the JWT specimen published in the standard's own documentation.
+// Decodes the payload rather than matching the encoded string, so a token that
+// merely shares a prefix is not suppressed.
+function _isSpecimenJwt(token){
+  try{
+    const parts=String(token).split('.');
+    if(parts.length!==3)return false;
+    const payload=Buffer.from(parts[1].replace(/-/g,'+').replace(/_/g,'/'),'base64').toString('utf8');
+    const d=JSON.parse(payload);
+    return d&&d.sub==='1234567890'&&typeof d.name==='string'&&d.name==='John Doe';
+  }catch(_){return false;}
+}
+
 function scanCredentials(fp,raw){
   if(!CRED_PREFILTER.test(raw))return[];
   const lines=raw.split("\n");const results=[];const seen=new Set();
@@ -6859,11 +6933,23 @@ function scanCredentials(fp,raw){
     while((m=re.exec(raw))!=null){
       const val=m[0];
       if(/placeholder|example|xxx+|your_|changeme|<[A-Z_]+>|MY_|INSERT_|REPLACE_|TODO|test_key|fake_|sample_|dummy_/i.test(val))continue;
+      // The published specimen token, which appears verbatim in essentially
+      // every piece of JWT documentation and in most auth tutorials. Its
+      // payload decodes to {"sub":"1234567890","name":"John Doe",…} — a
+      // documented example value in exactly the sense AKIAIOSFODNN7EXAMPLE is,
+      // and suppressed for the same reason and just as narrowly: the check is
+      // on the DECODED payload, so a real token that merely resembles it is
+      // unaffected. Found by bench/secrets-precision as the single false
+      // positive in its negative set.
+      if(pat.n==="Exposed JWT Token"&&_isSpecimenJwt(val))continue;
       const line=raw.substring(0,m.index).split("\n").length;
       const snippet=lines[line-1]?.trim()||"";
       // Per-pattern line-context gate: if ctx is set, the matched line must satisfy it
       if(pat.ctx&&!pat.ctx.test(snippet))continue;
-      if(pat.n==="Password in URL"&&/localhost|127\.0\.|0\.0\.0\.0|example\.com|test\.com|::1|user:pass|admin:admin|foo:bar|user:password|username:password|admin:password|root:password|test:test|john:doe|demo:demo|myuser:mypass|guest:guest/i.test(val))continue;
+      // The same placeholder-credential guard now covers every URI-with-inline-
+      // credentials pattern, not just the one it was written for. A connection
+      // string pointing at localhost with `user:pass` is a README, not a leak.
+      if((pat.n==="Password in URL"||pat.urlCreds)&&/localhost|127\.0\.|0\.0\.0\.0|example\.com|test\.com|::1|user:pass|admin:admin|foo:bar|user:password|username:password|admin:password|root:password|test:test|john:doe|demo:demo|myuser:mypass|guest:guest/i.test(val))continue;
       const key=`${fp}:${line}:${pat.n}`;
       if(seen.has(key))continue;seen.add(key);
       const severity=pat.s==="c"?"critical":pat.s==="h"?"high":"medium";
@@ -6872,10 +6958,18 @@ function scanCredentials(fp,raw){
       // unredacted-snippet leak as scanEntropySecrets — `snippet` carried
       // the raw source line (full credential value) straight through to
       // every report format. Redact the exact matched value here too.
-      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,snippet:snippet.split(val).join(masked),masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
+      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,_urlCreds:!!pat.urlCreds,snippet:snippet.split(val).join(masked),masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
     }
   }
-  return results;
+  // One secret, one finding. A `postgres://user:pass@host/db` matches both the
+  // specific PostgreSQL pattern and the generic "Password in URL" one, and
+  // reporting the same credential on the same line twice is noise that makes a
+  // secrets report look padded. The specific name wins: it tells the reader
+  // which system to go and rotate.
+  const specificUrlLines=new Set(results.filter(r=>r._urlCreds).map(r=>`${r.file}:${r.line}`));
+  const deduped=results.filter(r=>!(r.vuln==="Password in URL"&&specificUrlLines.has(`${r.file}:${r.line}`)));
+  for(const r of deduped)delete r._urlCreds;
+  return deduped;
 }
 
 /* ── OSV-backed SCA Engine ───────────────────────────────────────────────── */
@@ -6976,16 +7070,60 @@ async function _enrichWithEPSS(supplyChainResults){
 const _KEV_FEED_URL = 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
 const _KEV_TTL_MS = 24 * 60 * 60 * 1000;
 
+// PRD F3.4 — a KEV catalog has no meaning without its age.
+//
+// The refresh TTL above only decides when to TRY the network. Every failure
+// path below falls back to `cached?.byCve` with NO age bound, so an offline
+// machine, a blocked egress rule or a CISA outage silently serves a catalog of
+// any age. A six-month-old catalog does not fail loudly — it quietly omits
+// every vulnerability added since, which UNDERSTATES risk. That is the worst
+// direction for this particular signal: KEV membership is used to escalate.
+//
+// The catalog is still used when stale (dropping it would understate risk even
+// harder), but its age is recorded and surfaced on the scan so a report can
+// state it, and `staleness` is a first-class value rather than an inference.
+const _KEV_STALE_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
+
+// Populated by _loadKEVCatalog and read when the scan result is assembled.
+let _kevCatalogMeta = { source: 'not-loaded', fetchedAt: null, ageDays: null, stale: null, entries: 0 };
+export function kevCatalogMeta() { return { ..._kevCatalogMeta }; }
+
+function _setKevMeta(source, ts, entries) {
+  const ageMs = ts ? Date.now() - ts : null;
+  _kevCatalogMeta = {
+    source,
+    fetchedAt: ts ? new Date(ts).toISOString() : null,
+    ageDays: ageMs == null ? null : Math.floor(ageMs / 86400000),
+    stale: ageMs == null ? null : ageMs > _KEV_STALE_AFTER_MS,
+    entries: entries || 0,
+    meaning: 'KEV membership escalates severity. A stale catalog omits recently-added CVEs, so it understates risk rather than overstating it.',
+  };
+}
+
 async function _loadKEVCatalog(){
-  if (process.env.AGENTIC_SECURITY_OFFLINE === '1') return null;
+  if (process.env.AGENTIC_SECURITY_OFFLINE === '1') {
+    _setKevMeta('offline-skipped', null, 0);
+    return null;
+  }
   // Cached blob: { ts, byCve: { 'CVE-XXXX-YYYY': { dateAdded, ransomwareCampaign, vendor, product, vuln, action } } }
   const cached = _osvCacheGet('kev:catalog');
-  if (cached && cached.ts && (Date.now() - cached.ts < _KEV_TTL_MS)) return cached.byCve || null;
+  if (cached && cached.ts && (Date.now() - cached.ts < _KEV_TTL_MS)) {
+    _setKevMeta('cache-fresh', cached.ts, Object.keys(cached.byCve || {}).length);
+    return cached.byCve || null;
+  }
+  const fallback = () => {
+    if (cached && cached.byCve) {
+      _setKevMeta('cache-stale', cached.ts || null, Object.keys(cached.byCve).length);
+      return cached.byCve;
+    }
+    _setKevMeta('unavailable', null, 0);
+    return null;
+  };
   try {
     const res = await fetch(_KEV_FEED_URL, {
       headers: { 'User-Agent': 'agentic-security/0.1' },
     });
-    if (!res.ok) return cached?.byCve || null;
+    if (!res.ok) return fallback();
     const j = await res.json();
     const byCve = {};
     for (const v of (j.vulnerabilities || [])) {
@@ -7000,9 +7138,11 @@ async function _loadKEVCatalog(){
         dueDate: v.dueDate || null,
       };
     }
-    _osvCacheSet('kev:catalog', { ts: Date.now(), byCve });
+    const ts = Date.now();
+    _osvCacheSet('kev:catalog', { ts, byCve });
+    _setKevMeta('network', ts, Object.keys(byCve).length);
     return byCve;
-  } catch { return cached?.byCve || null; }
+  } catch { return fallback(); }
 }
 
 async function _enrichWithKEV(supplyChainResults){
@@ -7154,7 +7294,14 @@ function _parseGoMod(text,filePath){
     if(t===')'){inReq=false;continue;}
     let m=inReq?t.match(/^([^\s]+)\s+v([^\s/]+)/):t.match(/^require\s+([^\s]+)\s+v([^\s/]+)/);
     if(m){
-      const name=m[1];const ver=m[2].replace(/-.*$/,'');
+      // Keep the version VERBATIM. This used to do `.replace(/-.*$/,'')`,
+      // which turns every Go pseudo-version — v0.0.0-20210903162142-ad29c8ab022f
+      // — into a bare `0.0.0`. That is not a shorter version, it is a different
+      // and nonexistent one, and it made every pseudo-versioned module in a tree
+      // collapse onto the same key. Normalisation for an advisory query belongs
+      // at the query, where _osvQueryVersion does it; a component's recorded
+      // version is also what lands in the SBOM, where truncating it is worse.
+      const name=m[1];const ver=m[2];
       const isIndirect=t.includes('// indirect');
       out.push({name,version:ver,group:name.split('/').slice(0,2).join('/'),
         scope:isIndirect?'optional':'required',purl:_makePurl('golang',name,ver,''),
@@ -7549,8 +7696,10 @@ function _parseGoSum(text, filePath){
     const m = t.match(/^(\S+)\s+v([^\s]+)\s+h1:/);
     if (!m) continue;
     const name = m[1];
-    // Strip +incompatible / -timestamp-sha suffixes that aren't useful for OSV matching.
-    const ver = m[2].replace(/\+incompatible$/, '').replace(/^v?/, '');
+    // Verbatim, minus the leading `v`. The suffixes this used to strip
+    // (`+incompatible`, the pseudo-version timestamp+sha) are part of the
+    // module version the advisory database matches on — see _parseGoMod.
+    const ver = m[2].replace(/^v/, '');
     const dedupKey = `${name}@${ver}`;
     if (seen.has(dedupKey)) continue;
     seen.add(dedupKey);
@@ -7645,11 +7794,20 @@ function parseManifests(allFileContents){
     // R10: Gradle resolved transitive graph — `gradle dependencies > gradle-dependencies.txt`.
     'gradle-dependencies.txt':_parseGradleDependencies,
   };
+  // Requirements files are named a dozen ways and the basename table can only
+  // hold one of them. `requirements/dev.txt`, `requirements-dev.txt` and
+  // `requirements/base.txt` are all ordinary; matched by SHAPE so a new variant
+  // does not need a new table entry. Kept narrow on purpose — an arbitrary
+  // `.txt` reaching this parser would invent dependencies out of prose.
+  const _REQ_FILE=/^requirements(?:[._-][\w.-]+)?\.txt$/i;
+  const _REQ_DIR=/(?:^|\/)requirements\/[\w.-]+\.txt$/i;
+  const _pick=(fp,base)=>PARSERS[base]||((_REQ_FILE.test(base)||_REQ_DIR.test(fp))?_parseRequirementsTxt:null);
   const out=[],seen=new Set();
   for(const[fp,content]of Object.entries(allFileContents)){
     const base=fp.split('/').pop();
-    if(!PARSERS[base])continue;
-    for(const comp of PARSERS[base](content,fp)){
+    const parser=_pick(fp.split('\\').join('/'),base);
+    if(!parser)continue;
+    for(const comp of parser(content,fp)){
       const key=`${comp.ecosystem}:${comp.name}:${comp.version}`;
       if(!seen.has(key)){seen.add(key);out.push(comp);}
     }
@@ -7727,6 +7885,34 @@ function computeAttackPathComponents(findings,components,byFile){
   return{flagged,pathsByKey};
 }
 
+// The version string an advisory database can actually match on.
+//
+// This used to be `version.match(/(\d+\.\d+(?:\.\d+)*)/)`, which takes the
+// first dotted-number run and throws the rest away. For most ecosystems that is
+// harmless; for Go it is destructive. A Go pseudo-version is
+//
+//     v0.0.0-20210903162142-ad29c8ab022f
+//
+// and the leading `0.0.0` is a placeholder, not a version — every pseudo-version
+// in the tree collapsed to the same meaningless `0.0.0`, so the query asked
+// about a release that does not exist and the real one was never checked.
+// bench/sca-replay attributed nearly every remaining Go miss to exactly this.
+// `+incompatible` builds lost their suffix the same way.
+//
+// A WILDCARD is refused outright rather than truncated. `2.0.*` is a range; it
+// has no single version to be affected, and reporting "phpseclib 2.0.* is
+// vulnerable" names something that was never installed.
+function _osvQueryVersion(raw){
+  const s=String(raw||'').trim();
+  if(!s)return null;
+  if(/[*x]/i.test(s.replace(/^[\^~>=<\s]+/,'').replace(/[-+][\w.-]+$/,'')))return null;
+  // Strip only a leading range operator or `v`; keep the whole version after it.
+  const m=s.match(/^[\^~>=<\s]*v?(\d[\w.+-]*)$/);
+  if(m)return m[1];
+  const fallback=s.match(/(\d+\.\d+(?:\.\d+)*)/);
+  return fallback?fallback[1]:null;
+}
+
 async function queryOSV(components,allFileContents){
   const OSV_ECO={npm:'npm',pypi:'PyPI',packagist:'Packagist',rubygems:'RubyGems',golang:'Go',cargo:'crates.io',maven:'Maven',pub:'Pub'};
   const results=[];
@@ -7741,7 +7927,7 @@ async function queryOSV(components,allFileContents){
   const queries=[],uncached=[],vulnAffects={};
   for(const comp of queryable){
     const eco=OSV_ECO[comp.ecosystem];
-    const cleanVer=(comp.version.match(/(\d+\.\d+(?:\.\d+)*)/)||[])[1];
+    const cleanVer=_osvQueryVersion(comp.version);
     if(!cleanVer)continue;
     const ck=`comp:${eco}:${comp.name}:${cleanVer}`;
     const cached=_osvCacheGet(ck);
@@ -8019,9 +8205,26 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   try { _GLOBAL_JAVA_TAINTED_METHODS = _buildGlobalJavaTaintedMethodIndex(fileContents); }
   catch { _GLOBAL_JAVA_TAINTED_METHODS = new Set(); }
   const _perFileTimeoutMs = parseInt(process.env.AGENTIC_SECURITY_PER_FILE_TIMEOUT_MS || '10000', 10);
+// Per-file wall-clock timings are the slowest-first performance view, and they
+// leaked straight into --deterministic output: the `ms` values differ run to
+// run, and because the list is SORTED BY those values the ORDER differs too.
+// Zeroing the numbers alone would not have been enough — the sort key would
+// have become constant and the resulting order arbitrary. Under deterministic
+// mode the timings are therefore reported as 0 and ordered by filename, so the
+// field keeps its shape (consumers still see the same 20 entries) without
+// carrying anything a clock decided.
+function _deterministicFileTimings(timings) {
+  if (!isDeterministic()) return timings.sort((a, b) => b.ms - a.ms).slice(0, 20);
+  return timings
+    .slice()
+    .sort((a, b) => String(a.file).localeCompare(String(b.file)))
+    .slice(0, 20)
+    .map(t => ({ ...t, ms: 0 }));
+}
+
   const _fileTimings = [];
   let _filesSkipped = 0, _filesTimedOut = 0, _filesDenseSkipped = 0;
-  const files=Object.keys(fileContents).filter(f=>(shouldScan(f) || isKubernetesManifest(f, fileContents[f])) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];
+  const files=Object.keys(fileContents).filter(f=>(shouldScan(f) || isKubernetesManifest(f, fileContents[f]) || isCloudFormationTemplate(f, fileContents[f]) || isInstructionFile(f)) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];
   // ---- R8: opt-in per-file checkpointing (AGENTIC_SECURITY_RESUME=1, or
   // runScan({resume:true})). Default OFF, so existing behaviour is untouched.
   // Only this loop is checkpointed; every cross-file pass below re-runs, so
@@ -8089,7 +8292,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});
     if(_ckptDone.has(p)&&_ckptReplay(p))continue;
     const _mk={aR:aR.length,aF:aF.length,aSrc:aSrc.length,aSink:aSink.length,aSan:aSan.length,aLogic:aLogic.length,aSecrets:aSecrets.length,aCR:aCiphersRest.length,aCT:aCiphersTransit.length,sup:_suppressionLog.length};
-    try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}const cc=_blankCached(c,_commentLangFor(p));fc[p]=c;aR.push(...scanRoutes(p,cc));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,cc));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,cc));aF.push(...scanExtraStructural(p,cc));aF.push(...scanAliasedSinks(p,cc));aF.push(...scanJavaSAST(p,cc));aF.push(...scanJavaBenchExtras(p,cc));aLogic.push(...scanMiddlewareOrdering(p,cc));aLogic.push(...scanReDoS(p,cc));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,cc));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,cc);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,cc));aF.push(...scanIaC(p,cc));aF.push(...scanTerraform(p,cc));
+    try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}const cc=_blankCached(c,_commentLangFor(p));fc[p]=c;aR.push(...scanRoutes(p,cc));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,cc));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,cc));aF.push(...scanExtraStructural(p,cc));aF.push(...scanAliasedSinks(p,cc));aF.push(...scanJavaSAST(p,cc));aF.push(...scanJavaBenchExtras(p,cc));aLogic.push(...scanMiddlewareOrdering(p,cc));aLogic.push(...scanReDoS(p,cc));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,cc));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,cc);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,cc));aF.push(...scanIaC(p,cc));aF.push(...scanTerraform(p,cc));aF.push(...scanCloudTemplates(p,c));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
       aF.push(...scanLlmCost(p,c));
@@ -8098,6 +8301,31 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       aF.push(...scanContainer(p,cc));
       aF.push(...scanInstallScripts(p,cc));
       aF.push(...scanMCP(p,c));
+      // PRD F5.2 — rug-pull: a tool whose definition changed AFTER approval.
+      // Every scanMCP rule judges the CURRENT content, so a description that is
+      // innocuous today and hostile tomorrow passes both scans. This compares
+      // against a recorded baseline, which is the only way to see a change.
+      // Wired here rather than left as a tested module: a detector with no call
+      // site is a dark detector, which is the exact class this session keeps
+      // finding.
+      if (/(?:^|[\\/])\.?mcp(?:\.[a-z]+)?\.json$|(?:^|[\\/])\.mcp\.json$/i.test(p)) {
+        try {
+          const _cfg = JSON.parse(c);
+          const _rp = _detectRugPull(scanRoot, _cfg, { file: p });
+          aF.push(..._rp.findings);
+          // Record on first sight so the NEXT scan has something to compare
+          // against; refresh after reporting so a reviewed change is not
+          // re-reported forever.
+          _saveMcpBaseline(scanRoot, _fingerprintMcp(_cfg));
+        } catch (e) {
+          // Only a malformed config is tolerated here — scanMCP already reports
+          // what it can from one. Anything else is a programmer error and must
+          // not be swallowed: a bare `catch {}` around this block hid a
+          // ReferenceError (`root` vs `scanRoot`) that silently disabled the
+          // whole detector while every unit test still passed.
+          if (!(e instanceof SyntaxError)) throw e;
+        }
+      }
       aF.push(...scanClaudeSettings(p,c));
       aF.push(...scanClaudeMdPromptInjection(p,c));
       aF.push(...scanClaudeHookInjection(p,c));
@@ -8182,7 +8410,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       aF.push(...scanSSRFCloudMetadata(p,cc));
       aF.push(...scanMutationXSS(p,cc));
       aF.push(...scanKotlin(p,cc));
-      aF.push(...scanRuby(p,cc));
+      aF.push(...scanRuby(p,cc));aF.push(...scanRubyPathJoin(p,cc));
       aF.push(...scanPhp(p,cc));
       // Integration block: scaffolded SAST scanners. Gated by env var.
       if (process.env.AGENTIC_SECURITY_NO_INTEGRATION !== '1') {
@@ -9516,7 +9744,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // seen when only N-of-those-candidates were actually analyzed.
   // checkpoint.total intentionally keeps files.length — that field means the
   // full candidate set for resume bookkeeping, a different, correct meaning.
-  const _scanMeta={filesScanned:Object.keys(fc).length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
+  const _scanMeta={filesScanned:Object.keys(fc).length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_deterministicFileTimings(_fileTimings),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
   // R8: the scan completed, so the checkpoint has been fully consumed — remove
   // it. Anything that threw before this point leaves it in place to resume from.
   try { closeCheckpoint(_ckpt, { complete: true }); } catch (_) {}
@@ -9539,7 +9767,13 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // Addition #3 — root-cause sweep: from confirmed findings, find sibling instances
   // detectors missed, with total-count accounting. Confirmed-only (cheap by default).
   let _rootCauseSweep = null; try { _rootCauseSweep = sweepRootCauses(finalFindings, fc); } catch { _rootCauseSweep = null; }
-  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
+  // PRD F7.2: publish what CANNOT be proven alongside what can. A proof RATE
+  // computed over the provable subset makes a narrow subset look like strength;
+  // the three-bucket split (provable / declined-on-purpose / not-yet-classified)
+  // is the honest shape. Measured on the CVE corpus: 19% / 13% / 68%.
+  let _proofCoverage = null;
+  try { _proofCoverage = proofCoverage([...finalFindings, ...aLogic]); } catch { _proofCoverage = null; }
+  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".
 // Orphans (no finding linkage) are bucketed by file-local heuristic so the UI shows binary states only.
@@ -9749,6 +9983,30 @@ const CREDENTIAL_PATTERNS=[
   // Database / Infrastructure
   // ctx gate: JDBC URLs in docs/test configs without credentials are not findings; require @ or password= evidence
   {n:"Database Connection String",r:"jdbc:[a-z:]+://[A-Za-z0-9\\.\\-_:;=/@?,&]+",s:"h",ctx:/@|password=|passwd=|pwd=/i},
+  // PRD F4.1. bench/secrets-precision measured format coverage at 83% and every
+  // one of these five was a genuine absence, not a tuning problem. Four are
+  // among the most common real leaks there are — a database URI with the
+  // password inline is what a connection string looks like when someone pastes
+  // one into a config file.
+  //
+  // `jdbc:` was the ONLY database URI shape covered. `postgres://` and
+  // `mongodb+srv://` are far more common in the ecosystems this tool is aimed
+  // at, and the generic "Password in URL" pattern could not reach them: it is
+  // gated behind CRED_PREFILTER, which had no token for either scheme.
+  {n:"PostgreSQL Connection URI",r:"postgres(?:ql)?://[^\\s:@/]{1,64}:[^\\s:@/]{6,64}@[^\\s/\"']{1,128}",s:"h",urlCreds:true},
+  {n:"MongoDB Connection URI",r:"mongodb(?:\\+srv)?://[^\\s:@/]{1,64}:[^\\s:@/]{6,64}@[^\\s/\"']{1,128}",s:"h",urlCreds:true},
+  {n:"Azure Storage Account Key",r:"AccountKey=[A-Za-z0-9+/]{86}==",s:"c"},
+  {n:"GitLab Personal Access Token",r:"glpat-[0-9A-Za-z_-]{20}",s:"c"},
+  {n:"DigitalOcean Personal Access Token",r:"dop_v1_[a-f0-9]{64}",s:"c"},
+  {n:"Supabase Service Key",r:"sbp_[a-f0-9]{40}",s:"c"},
+  {n:"HubSpot Private App Token",r:"pat-(?:na|eu)[0-9]-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",s:"c"},
+  // NOT added, deliberately: Datadog, Vercel and Algolia keys are a bare run of
+  // hex or alphanumerics with no prefix. bench/secrets-precision reports them as
+  // misses and they should stay reported. A pattern for "32 hex characters"
+  // would fire on every content digest, Cargo checksum, test vector and build
+  // hash in the negative set — trading five detections for thousands of false
+  // positives, in the feature most prone to alert fatigue. Closing this needs
+  // variable-name context, not another regex.
   // Downgraded to medium; scanner also skips localhost/example hosts (see scanCredentials)
   {n:"Password in URL",r:"[a-zA-Z]{3,10}://[^/\\s:@]{3,20}:[^/\\s:@]{3,20}@.{1,100}[\"'\\s]",s:"m"},
   {n:"WordPress Secret Key",r:"define(.{0,20})?(DB_PASSWORD|AUTH_KEY|SECURE_AUTH_KEY|LOGGED_IN_KEY|AUTH_SALT|NONCE_KEY).{0,20}['\"].{10,120}['\"]",s:"h"},
@@ -9760,7 +10018,7 @@ const CREDENTIAL_PATTERNS=[
   // ctx gate: only report when the line contains a storage/assignment keyword, filters standalone examples in comments
   {n:"Exposed JWT Token",r:"eyJ[a-zA-Z0-9]{10,}\\.eyJ[a-zA-Z0-9]{10,}\\.[a-zA-Z0-9_\\-]{10,}",s:"m",ctx:/token|jwt|auth|bearer|secret|key|credential|sign|=|:/i},
 ];
-const CRED_PREFILTER=/AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA|da2-[a-z0-9]{10}|amzn\.mws|AIza|ya29\.[0-9A-Za-z]{15}|googleusercontent|[Hh][Ee][Rr][Oo][Kk][Uu]|dt0[A-Za-z][0-9]{2}\.|ghp_|gho_|ghu_|ghs_|ghr_|sk_live_|sk_test_|rk_live_|access_token\$production|sq0atp|sq0csp|xox[baprs]-[0-9a-zA-Z]{8}|hooks\.slack\.com|discord(?:app)?\.com\/api\/webhooks|outlook\.office\.com\/webhook|[0-9]{8,10}:AA[0-9A-Za-z]|AAAA[a-zA-Z0-9_-]{7}:|twilio|SG\.[a-zA-Z0-9_-]{15}|mailchimp|key-[0-9a-zA-Z]{20}|shpat_|shpss_|shpca_|shppa_|-----BEGIN .*(PRIVATE|PGP)|NRAA-|NRII-|NRIQ-|NRRA-|EAACEdEose0cBA|pypi-AgEIcH|hooks\.zapier\.com|jdbc:|cloudinary:\/\/|R_[0-9a-f]{20}|eyJ[a-zA-Z0-9]{10,}\.eyJ/i;
+const CRED_PREFILTER=/AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA|da2-[a-z0-9]{10}|amzn\.mws|AIza|ya29\.[0-9A-Za-z]{15}|googleusercontent|[Hh][Ee][Rr][Oo][Kk][Uu]|dt0[A-Za-z][0-9]{2}\.|ghp_|gho_|ghu_|ghs_|ghr_|sk_live_|sk_test_|rk_live_|access_token\$production|sq0atp|sq0csp|xox[baprs]-[0-9a-zA-Z]{8}|hooks\.slack\.com|discord(?:app)?\.com\/api\/webhooks|outlook\.office\.com\/webhook|[0-9]{8,10}:AA[0-9A-Za-z]|AAAA[a-zA-Z0-9_-]{7}:|twilio|SG\.[a-zA-Z0-9_-]{15}|mailchimp|key-[0-9a-zA-Z]{20}|shpat_|shpss_|shpca_|shppa_|-----BEGIN .*(PRIVATE|PGP)|NRAA-|NRII-|NRIQ-|NRRA-|EAACEdEose0cBA|pypi-AgEIcH|hooks\.zapier\.com|jdbc:|cloudinary:\/\/|R_[0-9a-f]{20}|eyJ[a-zA-Z0-9]{10,}\.eyJ|postgres(?:ql)?:\/\/|mongodb(?:\+srv)?:\/\/|AccountKey=|glpat-|dop_v1_|sbp_[a-f0-9]{10}|pat-(?:na|eu)[0-9]-|[a-z][a-z0-9+.-]{2,15}:\/\/[^\s:@\/]{3,64}:[^\s:@\/]{3,64}@/i;
 const SECRET_IMPACT_MAP={
   "AWS Access Key ID":"Provides programmatic access to AWS resources. With the paired secret key, an attacker can enumerate S3 buckets, exfiltrate databases, spin up EC2 instances for cryptomining, or pivot to any service the role permits. If the key belongs to an admin role, this is full cloud account takeover.",
   "AWS AppSync GraphQL Key":"Allows unauthenticated queries and mutations against your AppSync GraphQL API. Attackers can read application data, trigger mutations to corrupt records, or enumerate the schema to map further attack surface.",
@@ -9982,7 +10240,7 @@ export {
   classifyOrphans, classifyField, classifyEndpoint, shouldScan,
   _isFalsePositiveCredential, _detectSafeSinkShape,
   _loadCustomRules, _isCustomSuppressed, _isPathIgnored,
-  scanIaC, IAC_PATTERNS, _isIaCFile,
+  scanIaC, IAC_PATTERNS, _isIaCFile, isCloudFormationTemplate,
   payloadsForFinding, buildProofObligation,
   DATA_CLASSES, SOURCE_PATTERNS, SINK_PATTERNS, SANITIZER_PATTERNS,
   ROUTE_PATTERNS, AUTH_PATTERNS, IGNORE_DIRS, CODE_EXTS,

package/src/mcp/tools.js

@@ -330,6 +330,18 @@ function _maybeOffload(sessionRoot, toolName, items) {
 }
 
 // ─── scan_diff ───────────────────────────────────────────────────────────────
+// Test seam for the write boundary (PRD F6.4).
+//
+// `_confine` and `isReservedWrite` ARE the confinement contract in
+// agents/_CONFINEMENT.md. A boundary is only worth what its refusals are worth,
+// and refusals cannot be adversarially tested through the public tools without
+// also exercising a real scan, a real patch and a real filesystem write — so
+// the check would be measuring four things and attributing failure to one.
+//
+// Exported under the `_internals` convention this codebase already uses
+// (see posture/poc-inprocess.js). Not part of the MCP tool surface.
+export const _internals = { _confine, isReservedWrite: _isReservedWritePath };
+
 export const scan_diff = {
   name: 'scan_diff',
   description: 'Scan a list of files for security findings. Use BEFORE writing a Write/Edit to disk so the agent can self-correct. Returns findings with severity, file:line, title, remediation. Snippets are redacted of obvious secret patterns. Paths confined to the session root; symlinks are refused.',