@clear-capabilities/agentic-security-scanner 0.143.0 → 0.144.0

package/dist/1.index.js

@@ -0,0 +1,223 @@
+export const id = 1;
+export const ids = [1];
+export const modules = {
+
+/***/ 3001:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   OUTCOMES: () => (/* binding */ OUTCOMES),
+/* harmony export */   buildCalibrationReport: () => (/* binding */ buildCalibrationReport),
+/* harmony export */   recordCalibrationFeedback: () => (/* binding */ recordCalibrationFeedback),
+/* harmony export */   renderCalibrationReportSummary: () => (/* binding */ renderCalibrationReportSummary)
+/* harmony export */ });
+/* unused harmony exports CALIBRATION_FEEDBACK_FILE, loadCalibrationFeedback, _internals */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(7598);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+// FR-806 (assurance-hardening PRD): "Validate model calibration against
+// accepted and realized incidents where customers opt in | Calibration
+// reports are aggregated and privacy-preserving."
+//
+// SCOPE, stated explicitly because the PRD's own wording is terse: this
+// codebase has no SaaS control plane and takes no runtime cloud calls
+// (root CLAUDE.md's own "No runtime cloud calls" rule, and E10's own goal
+// of "consistent policy... without requiring a SaaS control plane") — so
+// "aggregated" here means aggregated WITHIN one installation, across every
+// feedback event an operator has recorded over time, never aggregated
+// ACROSS installations on some central server. An operator who wants a
+// cross-organization rollup can feed this module's own report output into
+// their own aggregation, the same way `fleet.js` composes many single-repo
+// scans without a hosted backend.
+//
+// TWO OUTCOMES, matching the PRD's own two named cases:
+//   'accepted-risk'    — an operator/customer reviewed a finding, accepted
+//                        the risk, and (later, of their own accord) reports
+//                        that no incident occurred. A well-calibrated model
+//                        should have predicted LOW confidence/risk for
+//                        these.
+//   'realized-incident' — an operator reports that a finding's
+//                        vulnerability WAS actually exploited or otherwise
+//                        caused a real incident. A well-calibrated model
+//                        should have predicted HIGH confidence/risk for
+//                        these — a realized incident on a LOW-predicted
+//                        finding is exactly the miscalibration this
+//                        requirement exists to surface.
+//
+// PRIVACY-PRESERVING AT THE SOURCE, not just at the report layer: a
+// feedback record snapshots only the model's OWN prediction signals
+// (confidence, severity, riskDollars.ev) plus the operator's outcome and
+// optional free-text note — never file path, line, vuln title, or code
+// snippet. This mirrors this codebase's existing privacy modules' own
+// discipline (dataflow/privacy-*.js) of never persisting more than a
+// report needs to answer its one question.
+//
+// OPT-IN, genuinely: nothing here is ever auto-populated by a scan. A
+// record exists only when an operator explicitly calls
+// `recordCalibrationFeedback` (via the CLI's `calibration-feedback record`
+// command) — the file simply does not exist for every project that never
+// opts in, and every read degrades to "no data" rather than throwing.
+
+
+
+
+
+const CALIBRATION_FEEDBACK_FILE = 'calibration-feedback.jsonl';
+const OUTCOMES = Object.freeze(['accepted-risk', 'realized-incident']);
+
+// Below this many samples, a rate is an artifact of the sample, not a
+// property of the model — same precedent as fix-metrics.js's RELIABLE_N.
+const RELIABLE_N = 10;
+
+function _findFinding(scanRoot, findingId) {
+  try {
+    const raw = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync((0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'last-scan.json'), 'utf8'));
+    const findings = Array.isArray(raw.findings) ? raw.findings : [];
+    return findings.find(f => f && (f.id === findingId || f.stableId === findingId)) || null;
+  } catch { return null; }
+}
+
+// FR-806 privacy fix: the caller-supplied findingId is routinely a finding's
+// plain `.id` (e.g. "client-side:DANGEROUS_INNERHTML:src/billing/secret.js:142"),
+// which embeds the exact file path and line this module's own docstring
+// promises never to persist. Never write the caller's raw string to disk:
+// prefer the matched finding's own privacy-safe `.stableId` (a hash, by
+// construction elsewhere in this codebase), and otherwise hash the input
+// ourselves so a stale/removed finding's id can never leak path/line either.
+function _privacySafeFindingId(findingId, finding) {
+  if (finding && typeof finding.stableId === 'string' && finding.stableId) return finding.stableId;
+  return node_crypto__WEBPACK_IMPORTED_MODULE_1__.createHash('sha256').update(findingId).digest('hex').slice(0, 16);
+}
+
+/**
+ * Record one opt-in calibration-feedback event. Snapshots ONLY the
+ * model's own prediction signals for the named finding (if it is still
+ * present in the last scan — a finding fixed/removed since is still
+ * recordable, just without a fresh snapshot) plus the outcome and an
+ * optional note. Never throws; returns {ok, record} or {ok:false, reason}.
+ */
+function recordCalibrationFeedback(scanRoot, { findingId, outcome, note } = {}) {
+  if (!findingId || typeof findingId !== 'string') return { ok: false, reason: '--finding-id is required' };
+  if (!OUTCOMES.includes(outcome)) return { ok: false, reason: `--outcome must be one of: ${OUTCOMES.join(', ')}` };
+  const finding = _findFinding(scanRoot, findingId);
+  const record = {
+    at: new Date().toISOString(),
+    findingId: _privacySafeFindingId(findingId, finding),
+    outcome,
+    predictedConfidence: finding && typeof finding.confidence === 'number' ? finding.confidence : null,
+    predictedConfidenceTier: finding?.confidenceTier || null,
+    predictedSeverity: finding?.severity || null,
+    predictedRiskEv: finding?.riskDollars && typeof finding.riskDollars.ev === 'number' ? finding.riskDollars.ev : null,
+    note: note ? String(note).slice(0, 280) : null,
+  };
+  // Append-only, same primitives as fix-metrics.js/triage-memory.js's own
+  // JSONL writers — a single fs.appendFileSync, never a read-modify-write
+  // of the whole file (which would also reintroduce a TOCTOU between an
+  // existence check and the write, the exact anti-pattern this codebase's
+  // own conventions forbid).
+  const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return { ok: false, reason: 'no safe state directory' };
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return { ok: false, reason: 'state writes are disabled (--no-state)' };
+  try {
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync((0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, CALIBRATION_FEEDBACK_FILE), JSON.stringify(record) + '\n', 'utf8');
+  } catch (e) { return { ok: false, reason: e.message }; }
+  return { ok: true, record };
+}
+
+/**
+ * Every well-formed feedback event ever recorded. A line that fails to
+ * parse or lacks a valid outcome is skipped, not fatal.
+ */
+function loadCalibrationFeedback(scanRoot) {
+  let fp;
+  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, CALIBRATION_FEEDBACK_FILE); } catch { return []; }
+  let raw;
+  try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); } catch { return []; }
+  const out = [];
+  for (const line of raw.split('\n')) {
+    if (!line.trim()) continue;
+    try {
+      const rec = JSON.parse(line);
+      if (rec && OUTCOMES.includes(rec.outcome)) out.push(rec);
+    } catch { /* torn or hand-edited line — drop it, keep the rest */ }
+  }
+  return out;
+}
+
+function _avg(nums) {
+  const v = nums.filter(n => typeof n === 'number' && Number.isFinite(n));
+  return v.length ? v.reduce((a, b) => a + b, 0) / v.length : null;
+}
+
+function _summarizeOutcome(records) {
+  const withConfidence = records.map(r => r.predictedConfidence).filter(c => typeof c === 'number');
+  return {
+    n: records.length,
+    reliable: records.length >= RELIABLE_N,
+    avgPredictedConfidence: _avg(withConfidence),
+    withoutPrediction: records.length - withConfidence.length,
+  };
+}
+
+/**
+ * Aggregate ALL recorded feedback (this installation only — see the
+ * module header for why cross-installation aggregation is out of scope)
+ * into a privacy-preserving report: rates and averages only, never a
+ * per-finding breakdown, never file/line/vuln text (none of that was ever
+ * stored in the first place).
+ */
+function buildCalibrationReport(scanRoot) {
+  const records = loadCalibrationFeedback(scanRoot);
+  const acceptedRisk = records.filter(r => r.outcome === 'accepted-risk');
+  const realizedIncident = records.filter(r => r.outcome === 'realized-incident');
+  return {
+    schema: 'agentic-security/calibration-report@1',
+    generatedAt: new Date().toISOString(),
+    totalEvents: records.length,
+    acceptedRisk: _summarizeOutcome(acceptedRisk),
+    realizedIncident: _summarizeOutcome(realizedIncident),
+    // The calibration question itself: accepted-risk events SHOULD skew
+    // toward low predicted confidence; realized-incident events SHOULD
+    // skew toward high. This flag is a coarse, disclosed-uncertainty
+    // signal, not a verdict — it only ever fires when BOTH buckets have
+    // enough samples to say anything at all (RELIABLE_N each).
+    possibleMiscalibration: (() => {
+      const a = _summarizeOutcome(acceptedRisk);
+      const r = _summarizeOutcome(realizedIncident);
+      if (!a.reliable || !r.reliable || a.avgPredictedConfidence == null || r.avgPredictedConfidence == null) return null;
+      return r.avgPredictedConfidence <= a.avgPredictedConfidence;
+    })(),
+  };
+}
+
+/**
+ * One block of human-readable summary, or null when nothing has ever been
+ * recorded — genuinely opt-in, so "nothing recorded" is the expected
+ * default state for almost every project, not an error.
+ */
+function renderCalibrationReportSummary(report) {
+  if (!report || report.totalEvents === 0) return null;
+  const lines = [
+    'Calibration feedback (this installation, opt-in):',
+    `  accepted-risk:     n=${report.acceptedRisk.n}${report.acceptedRisk.reliable ? '' : ' (below reliable sample size)'}` +
+      (report.acceptedRisk.avgPredictedConfidence != null ? `  avg predicted confidence=${report.acceptedRisk.avgPredictedConfidence.toFixed(2)}` : ''),
+    `  realized-incident: n=${report.realizedIncident.n}${report.realizedIncident.reliable ? '' : ' (below reliable sample size)'}` +
+      (report.realizedIncident.avgPredictedConfidence != null ? `  avg predicted confidence=${report.realizedIncident.avgPredictedConfidence.toFixed(2)}` : ''),
+  ];
+  if (report.possibleMiscalibration === true) {
+    lines.push('  ⚠ realized incidents were NOT predicted with higher confidence than accepted risks — possible miscalibration.');
+  } else if (report.possibleMiscalibration === false) {
+    lines.push('  ✓ realized incidents were predicted with higher confidence than accepted risks, as expected.');
+  } else {
+    lines.push('  (not enough samples in both buckets yet to assess calibration — this is not a pass or fail.)');
+  }
+  return lines.join('\n');
+}
+
+const _internals = { RELIABLE_N, _findFinding };
+
+
+/***/ })
+
+};

package/dist/113.index.js

@@ -8,9 +8,10 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   I3: () => (/* binding */ recordFixAttempt),
 /* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
-/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
+/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary),
+/* harmony export */   sU: () => (/* binding */ loadFixAttempts)
 /* harmony export */ });
-/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
+/* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
 /* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
@@ -491,8 +492,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 200 modules
-var engine = __webpack_require__(3474);
+// EXTERNAL MODULE: ./src/engine.js + 211 modules
+var engine = __webpack_require__(7087);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //
@@ -637,23 +638,64 @@ function computeFixTier(signals) {
 }
 
 /**
- * Compose the three gates for a single fix's output.
+ * FR-308: cross-check a fix-completeness TIER against MECHANICAL evidence,
+ * when any is available. `signals` (computeFixTier's input) is agent-
+ * self-reported — this module cannot compute sinkSignatureChanged /
+ * allCallersRouted / testDiscriminates itself (see the header above: "the
+ * gate can only run against claims the AGENT self-reports... nothing here
+ * is server-computable"). `pocLeg` is different: fix-verify.js's PoC leg is
+ * a REAL execution result (posture/CLAUDE.md's execution-proof tiers), not
+ * a claim. When it is available and shows the proof-of-concept STILL
+ * demonstrates the vulnerability against the patch, a self-reported FULL
+ * tier is not merely internally inconsistent — it is REFUTED by fact. This
+ * is the literal "a mitigation or workaround cannot be represented as a
+ * full fix" acceptance criterion, now backed by mechanical evidence where
+ * it exists rather than by self-report consistency alone.
  *
- * ok = residual-honesty ok AND evidence-citation ok, further constrained by the
- * tier/residual consistency invariant:
+ * A `pocLeg` of `not-requested` or `inconclusive` carries no mechanical
+ * signal either way and is a no-op here — this check can only ever ADD a
+ * violation on real contrary evidence, never manufacture one from absence.
+ *
+ * @param {string} tier
+ * @param {{status: string, reason?: string}|null} pocLeg
+ * @returns {{ ok: boolean, violations: string[] }}
+ */
+function checkMechanicalTierEvidence(tier, pocLeg) {
+  if (!pocLeg || typeof pocLeg !== 'object') return { ok: true, violations: [] };
+  if (tier === 'FULL' && pocLeg.status === 'still-exploitable') {
+    return {
+      ok: false,
+      violations: [`tier 'FULL' is refuted by mechanical evidence: the proof-of-concept still demonstrates the vulnerability against the patch${pocLeg.reason ? ` (${pocLeg.reason})` : ''}`],
+    };
+  }
+  return { ok: true, violations: [] };
+}
+
+/**
+ * Compose the four gates for a single fix's output.
+ *
+ * ok = residual-honesty ok AND evidence-citation ok AND mechanical-tier-
+ * evidence ok, further constrained by the tier/residual consistency
+ * invariant:
  *   - a FULL tier must NOT carry a residual (a full fix has nothing left);
  *   - a non-FULL tier MUST document a residual (say what's still open).
  *
  * @param {{ residual?: string, verdict?: string, evidence?: any, signals?: object }} input
+ * @param {{ pocLeg?: object|null }} [mechanical] - FR-308: optional real
+ *   execution evidence (fix-verify.js's pocLeg) to cross-check the
+ *   self-reported tier against. Omitted entirely by any caller that has no
+ *   PoC leg to offer — this parameter never REQUIRES mechanical evidence,
+ *   it only USES it when present.
  * @returns {{ ok: boolean, tier: string, violations: string[] }}
  */
-function gateFixOutput({ residual, verdict, evidence, signals } = {}) {
+function gateFixOutput({ residual, verdict, evidence, signals } = {}, { pocLeg = null } = {}) {
   const tier = computeFixTier(signals);
   const residualCheck = checkResidualHonesty(residual);
   const evidenceCheck = requireCitedEvidence(verdict, evidence);
+  const mechanicalCheck = checkMechanicalTierEvidence(tier, pocLeg);
 
-  const violations = [...residualCheck.violations, ...evidenceCheck.violations];
-  let ok = residualCheck.ok && evidenceCheck.ok;
+  const violations = [...residualCheck.violations, ...evidenceCheck.violations, ...mechanicalCheck.violations];
+  let ok = residualCheck.ok && evidenceCheck.ok && mechanicalCheck.ok;
 
   const residualEmpty = typeof residual !== 'string' || residual.trim() === '';
   if (tier === 'FULL' && !residualEmpty) {
@@ -1011,12 +1053,6 @@ async function verifyFix({
   // and on the result so a caller cannot mistake it for a verified patch.
   const _testedPrePatch = !tests.skipped && _candidateDiffersFromDisk(scanRoot, files);
   const testsOk = tests.skipped ? true : tests.passed === true;
-  let honesty = null;
-  if (fixMeta && typeof fixMeta === 'object') {
-    try { honesty = gateFixOutput(fixMeta); } catch { honesty = null; }
-  }
-  _lap('honesty');
-
   // R5 — the PoC leg. Re-run the finding's proof-of-concept against the
   // CANDIDATE patch inside R1's sandbox. A patch that still lets the PoC
   // demonstrate the predicted effect has not fixed anything, however green the
@@ -1028,6 +1064,11 @@ async function verifyFix({
   // to run, or a sandbox that could not start, is recorded as `inconclusive`
   // and left out of the verdict entirely. Treating "could not prove it" as
   // "fixed" is exactly the false confidence this leg exists to prevent.
+  //
+  // Computed BEFORE the honesty gate (FR-308): a still-exploitable PoC is
+  // MECHANICAL evidence, not a self-report, and gateFixOutput cross-checks a
+  // self-reported FULL tier against it below — the ordering matters, not
+  // just the value.
   let pocLeg = { status: 'not-requested', reason: null, tier: null };
   if (poc?.code) {
     try {
@@ -1046,7 +1087,54 @@ async function verifyFix({
   _lap('poc');
   const pocOk = pocLeg.status !== 'still-exploitable';
 
+  // FR-308: "a mitigation or workaround cannot be represented as a full
+  // fix" — gateFixOutput's tier/residual check is a pure self-consistency
+  // check (fixMeta.signals is agent-self-reported; see fix-honesty-gate.js's
+  // header for why nothing there is server-computable). pocLeg IS
+  // server-computable — a real execution result, not a claim — so it is
+  // passed through as the one MECHANICAL cross-check available: a
+  // self-reported FULL tier is refuted, not just internally inconsistent,
+  // when the PoC still demonstrates the vulnerability against the patch.
+  // D-0024: `fixMeta` is a shared envelope — FR-307/FR-1002's `approval`
+  // key lives alongside FR-308's completeness self-report (`residual`/
+  // `verdict`/`evidence`/`signals`). Gating on mere object-truthiness meant
+  // a caller supplying ONLY `approval` (a real, common shape once the CLI's
+  // --approved-by flag and the MCP schema fix made that reachable) got
+  // silently gated on an UNRELATED FR-308 self-consistency check it never
+  // engaged with — computeFixTier(undefined) defaults to MITIGATION, which
+  // then demands a `residual` nobody was ever asked to supply, blocking an
+  // otherwise-genuine, approved fix for a reason that has nothing to do
+  // with completeness honesty. Scope the gate to fixMeta shapes that
+  // actually make a completeness-adjacent claim.
+  const hasHonestyClaim = fixMeta && typeof fixMeta === 'object' &&
+    (fixMeta.residual !== undefined || fixMeta.verdict !== undefined ||
+     fixMeta.evidence !== undefined || fixMeta.signals !== undefined);
+  let honesty = null;
+  if (hasHonestyClaim) {
+    try { honesty = gateFixOutput(fixMeta, { pocLeg }); } catch { honesty = null; }
+  }
+  _lap('honesty');
+
   const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true);
+
+  // FR-305 (assurance-hardening PRD): `ok` alone conflates "every leg
+  // genuinely ran and passed" with "passed, but a required leg was skipped
+  // or unavailable" — `lint.ok`/`testsOk` are both true in the skipped case
+  // by design (this codebase does not fail-closed just because a repo has
+  // no linter or no detected test runner), so a caller checking only `ok`
+  // cannot tell the difference. `lint.skipped` is only ever true when a
+  // linter WAS configured but its binary could not be run (missing config
+  // entirely returns `runner: 'none'` with no `skipped` field at all — that
+  // is a genuine N/A, nothing was required, not a degradation). `verifiedFull`
+  // is the honest label: true only when nothing that WAS required was
+  // skipped. A caller must never present `ok: true, verifiedFull: false` as
+  // "fully verified" — `degradedLegs` names exactly what was skipped so a
+  // report can say so plainly instead of a bare pass.
+  const degradedLegs = [];
+  if (lint.skipped) degradedLegs.push(`lint: ${lint.runner} not installed`);
+  if (tests.skipped) degradedLegs.push(`tests: skipped (${tests.reason})`);
+  const verifiedFull = ok && degradedLegs.length === 0;
+
   const durations = { ...stages, totalMs: Date.now() - t0 };
   const summary = [
     `re-scan: ${rescan.ok ? 'PASS' : 'FAIL — ' + rescan.reason}`,
@@ -1068,6 +1156,8 @@ async function verifyFix({
       : pocLeg.status === 'still-exploitable' ? `poc:     FAIL — the proof-of-concept still demonstrates the vulnerability against the patch`
       : pocLeg.status === 'no-longer-proven' ? 'poc:     PASS (ran against the patch and no longer demonstrates the vulnerability)'
       : `poc:     inconclusive — not counted either way (${pocLeg.reason || 'no detail reported'})`,
+    // FR-305: never let a degraded pass read the same as a full one.
+    ok && !verifiedFull ? `NOTE:    PASSED, but NOT fully verified — ${degradedLegs.join('; ')}` : null,
   ].filter(Boolean).join('\n');
   // Persist the attempt so the distribution can be reported from real runs.
   // `testsRan` is the load-bearing field: it is what keeps "verified with no
@@ -1080,6 +1170,7 @@ async function verifyFix({
       at: new Date().toISOString(),
       stableId: originalFindingStableId || null,
       ok,
+      verifiedFull,
       testsRan: !tests.skipped,
       testsPassed: tests.skipped ? null : tests.passed === true,
       testedPrePatch: _testedPrePatch,
@@ -1092,7 +1183,7 @@ async function verifyFix({
     });
   }
 
-  return { ok, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
+  return { ok, verifiedFull, degradedLegs, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
 }
 
 

package/dist/144.index.js

@@ -0,0 +1,163 @@
+export const id = 144;
+export const ids = [144];
+export const modules = {
+
+/***/ 5144:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   addLegalHold: () => (/* binding */ addLegalHold),
+/* harmony export */   isUnderHold: () => (/* binding */ isUnderHold),
+/* harmony export */   listLegalHolds: () => (/* binding */ listLegalHolds),
+/* harmony export */   loadLegalHolds: () => (/* binding */ loadLegalHolds),
+/* harmony export */   removeLegalHold: () => (/* binding */ removeLegalHold)
+/* harmony export */ });
+/* unused harmony export LEGAL_HOLD_FILE */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1174);
+/* harmony import */ var _artifact_registry_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(471);
+// FR-707 (assurance-hardening PRD): "Support legal hold and policy-
+// authorized retention exceptions | Legal hold is identity-bound, reasoned,
+// time-bounded where applicable, and auditable."
+//
+// A third instance of the recurring {owner, reason, expires_at} exception
+// shape this codebase already uses twice — `posture/suppressions.js`'s
+// pro-tier exception (scoped to a FINDING) and `posture/compliance-policy.js`'s
+// structured `not-applicable` (scoped to a COMPLIANCE CONTROL). Per D-0025,
+// these are deliberately distinct mechanisms serving different subjects, not
+// one shared module — this file is the third subject: a STATE ARTIFACT.
+//
+// Field naming matches the existing two schemas' snake_case convention
+// (`owner`, `reason`, `expires_at`) rather than inventing a fourth style.
+//
+//   identity-bound   -> `owner` (required, who placed the hold and is
+//                        accountable for lifting it)
+//   reasoned         -> `reason` (required — "we might need this later" is
+//                        not a reason; same discipline suppressions.js
+//                        already enforces for its own exceptions)
+//   time-bounded
+//     where applicable -> `expires_at` is OPTIONAL: a null/absent value is
+//                        an INDEFINITE hold, which the acceptance
+//                        criterion's own "where applicable" phrase
+//                        explicitly allows (a genuine legal matter may have
+//                        no known end date) — an ISO date value behaves
+//                        exactly like FR-506/FR-1004's own expiring
+//                        exceptions: once past, the hold is no longer
+//                        active and the artifact is exposed to its normal
+//                        retention TTL again.
+//   auditable        -> persisted as a single JSON array under
+//                        `.agentic-security/legal-holds.json` (itself
+//                        registered as operator-config — an operator/legal
+//                        team's own input, never scanner-written from scan
+//                        results), readable via `listLegalHolds`.
+//
+// Consulted from TWO places, not one: `retention-policy.js#findExpiredArtifacts`
+// (defense in depth for any caller reaching it directly) AND `cmdReset`
+// itself for its PLAIN (non-`--expired`) path, which deletes every
+// registered 'generated' artifact unconditionally and would otherwise blow
+// through a hold that only gated TTL expiry.
+
+
+
+
+
+const LEGAL_HOLD_FILE = 'legal-holds.json';
+
+function _loadRaw(scanRoot) {
+  let fp;
+  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, LEGAL_HOLD_FILE); } catch { return []; }
+  let raw;
+  try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); } catch { return []; }
+  try {
+    const doc = JSON.parse(raw);
+    return Array.isArray(doc) ? doc : [];
+  } catch { return []; }
+}
+
+/**
+ * All legal holds ever recorded for this project, malformed entries
+ * dropped rather than throwing. Never filters by expiry — see
+ * `isUnderHold`/`listLegalHolds` for that.
+ */
+function loadLegalHolds(scanRoot) {
+  return _loadRaw(scanRoot).filter(h => h && typeof h === 'object' && typeof h.artifact === 'string' && typeof h.owner === 'string' && typeof h.reason === 'string');
+}
+
+/**
+ * Is `artifactName` currently protected by an active (non-expired) hold?
+ * Returns the matching hold record, or null. Multiple holds on the same
+ * artifact are permitted (e.g. two independent legal matters); the first
+ * still-active one found is returned.
+ */
+function isUnderHold(artifactName, holds, now = Date.now()) {
+  for (const h of holds) {
+    if (h.artifact !== artifactName) continue;
+    if (!h.expires_at) return h; // indefinite hold — always active
+    const t = Date.parse(h.expires_at);
+    if (!Number.isFinite(t) || t >= now) return h;
+  }
+  return null;
+}
+
+/**
+ * Active (non-expired) holds only, unless `includeExpired`. For
+ * `legal-hold list` / auditing.
+ */
+function listLegalHolds(scanRoot, { includeExpired = false, now = Date.now() } = {}) {
+  const holds = loadLegalHolds(scanRoot);
+  if (includeExpired) return holds;
+  return holds.filter(h => {
+    if (!h.expires_at) return true;
+    const t = Date.parse(h.expires_at);
+    return !Number.isFinite(t) || t >= now;
+  });
+}
+
+/**
+ * Add a legal hold. Validates identity-bound + reasoned up front (both
+ * required, non-empty) and that `expires_at`, if given, is a parseable
+ * date in the future — an already-expired hold would be a hold that
+ * protects nothing, which is never a legitimate request. `artifact` must
+ * name a real registered artifact (artifact-registry.js) — a hold on an
+ * unrecognised name can never protect anything and almost always means a
+ * typo. Returns `{ok:true, hold}` or `{ok:false, reason}`; never throws.
+ */
+function addLegalHold(scanRoot, { artifact, owner, reason, expires_at } = {}) {
+  if (!artifact || typeof artifact !== 'string') return { ok: false, reason: '--artifact is required' };
+  if (!(0,_artifact_registry_js__WEBPACK_IMPORTED_MODULE_2__/* .isRegisteredArtifact */ .Jl)(artifact)) return { ok: false, reason: `"${artifact}" is not a registered state artifact` };
+  if (!owner || typeof owner !== 'string') return { ok: false, reason: '--owner is required (identity-bound)' };
+  if (!reason || typeof reason !== 'string') return { ok: false, reason: '--reason is required (reasoned)' };
+  if (expires_at) {
+    const t = Date.parse(expires_at);
+    if (!Number.isFinite(t)) return { ok: false, reason: 'expires_at must be a parseable date' };
+    if (t < Date.now()) return { ok: false, reason: 'expires_at is in the past — a hold that already expired protects nothing' };
+  }
+  const hold = { artifact, owner, reason, expires_at: expires_at || null, created_at: new Date().toISOString() };
+  const holds = _loadRaw(scanRoot);
+  holds.push(hold);
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, LEGAL_HOLD_FILE);
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .safeWriteState */ .Ep)(fp, JSON.stringify(holds, null, 2) + '\n')) {
+    return { ok: false, reason: 'state writes are disabled (--no-state) or this is not a safe state directory' };
+  }
+  return { ok: true, hold };
+}
+
+/**
+ * Remove every hold on `artifact` (lifting a hold, not letting it expire).
+ * Returns the number removed. A no-op (0) if none existed — never an error.
+ */
+function removeLegalHold(scanRoot, artifact) {
+  const holds = _loadRaw(scanRoot);
+  const remaining = holds.filter(h => !(h && h.artifact === artifact));
+  const removedCount = holds.length - remaining.length;
+  if (removedCount > 0) {
+    const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, LEGAL_HOLD_FILE);
+    (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .safeWriteState */ .Ep)(fp, JSON.stringify(remaining, null, 2) + '\n');
+  }
+  return removedCount;
+}
+
+
+/***/ })
+
+};

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3474);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7087);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/238.index.js

@@ -8,9 +8,10 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   I3: () => (/* binding */ recordFixAttempt),
 /* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
-/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
+/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary),
+/* harmony export */   sU: () => (/* binding */ loadFixAttempts)
 /* harmony export */ });
-/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
+/* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
 /* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);