@clear-capabilities/agentic-security-scanner 0.143.0 → 0.144.0

package/dist/736.index.js

@@ -0,0 +1,301 @@
+export const id = 736;
+export const ids = [736];
+export const modules = {
+
+/***/ 3736:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   buildPolicyBundle: () => (/* binding */ buildPolicyBundle),
+/* harmony export */   ensurePolicyKeyPair: () => (/* binding */ ensurePolicyKeyPair),
+/* harmony export */   loadPolicyBundles: () => (/* binding */ loadPolicyBundles),
+/* harmony export */   loadPolicyPublicKey: () => (/* binding */ loadPolicyPublicKey),
+/* harmony export */   resolveEffectivePolicy: () => (/* binding */ resolveEffectivePolicy),
+/* harmony export */   signPolicyBundle: () => (/* binding */ signPolicyBundle)
+/* harmony export */ });
+/* unused harmony exports POLICY_BUNDLE_SCHEMA, SCOPES, canonicalPolicyBytes, verifyPolicyBundle, computePolicyDrift */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8161);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7598);
+/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8317);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(1174);
+// Signed, portable policy bundles (assurance-hardening PRD FR-1001).
+//
+// "Support signed portable policy bundles with organization, repository, and
+// environment inheritance" | "Tampered or expired policy is rejected;
+// effective policy is explainable."
+//
+// WHY REUSE evidence-bundle.js's Ed25519 SCHEME, NOT integrity.js's HMAC
+// -------------------------------------------------------------------------
+// A policy bundle is authored by one party (typically a central security
+// team, "the organization") and distributed to many repositories that never
+// had the signing key. integrity.js's per-install symmetric HMAC is
+// tamper-evidence for the SAME install that wrote it — a different install
+// verifying a bundle it didn't sign is exactly the case that scheme cannot
+// serve. evidence-bundle.js already solved this for findings: Ed25519,
+// verify with only the public key. This module reuses that primitive
+// directly (canonicalisation shape, allowlist-signed-fields discipline,
+// exclusive-create key generation) rather than inventing a third signing
+// mechanism, per this session's own established "survey before building a
+// parallel primitive" practice (see D-0023/D-0025 for the same discipline
+// applied to identity and exception mechanisms respectively).
+//
+// EA-03 LESSON, APPLIED HERE FROM THE START
+// -------------------------------------------------------------------------
+// evidence-bundle.js's own history (see its EA-03 comment) is the reason
+// `canonicalPolicyBytes` signs an explicit ALLOWLIST and `verifyPolicyBundle`
+// REJECTS any top-level key outside it: a bundle with a field stapled on
+// after signing must fail verification, not silently pass with the addition
+// unverified. Getting this right on the first pass — rather than discovering
+// the gap the way evidence-bundle.js did — is the entire point of writing it
+// down here.
+//
+// SCOPE — WHAT THIS MODULE DOES NOT DO
+// -------------------------------------------------------------------------
+// It does not invent a policy SCHEMA — `policy` is an opaque object; whatever
+// keys a bundle carries (egress rules, severity floors, approved providers,
+// anything else this repo already treats as policy) are merged the same way.
+// It does not implement deep/recursive merging — inheritance is shallow,
+// top-level-key override (organization -> repository -> environment, most
+// specific wins per key), matching how every other flat policy config file
+// in this repo (egress-policy.yml, compliance-severity-policy.json, …) is
+// already shaped. A future consumer needing nested-key inheritance is new,
+// separate scope, not assumed here.
+
+
+
+
+
+
+
+
+const POLICY_BUNDLE_SCHEMA = 'agentic-security/policy-bundle@1';
+
+const SCOPES = ['organization', 'repository', 'environment'];
+// Inheritance order — later entries override earlier ones, per top-level key.
+const INHERITANCE_ORDER = ['organization', 'repository', 'environment'];
+
+function keyDir() {
+  const xdg = process.env.XDG_CONFIG_HOME || node_path__WEBPACK_IMPORTED_MODULE_2__.join(node_os__WEBPACK_IMPORTED_MODULE_1__.homedir(), '.config');
+  return node_path__WEBPACK_IMPORTED_MODULE_2__.join(xdg, 'agentic-security', 'policy-bundles');
+}
+
+/** A SEPARATE Ed25519 keypair from evidence-bundle.js's finding-attestation
+ * key — signing "this policy is authentic" and "this finding really came
+ * from a scan run by me" are different trust domains and must not share a
+ * key. Reuses evidence-bundle.js's hardened, race-safe generation logic
+ * directly (its exclusive-create collision handling is the kind of code
+ * worth NOT re-implementing) rather than duplicating it — the separation
+ * that matters is the DIRECTORY (`policy-bundles/`, isolated from
+ * evidence-bundle.js's own key dir), not the leaf filenames, which are
+ * `attest-key.pem`/`attest-key.pub.pem` regardless of caller (a
+ * evidence-bundle.js internal, not overridable here) — a readability wart,
+ * not a security one, since the directory is what prevents key reuse. */
+function ensurePolicyKeyPair(dir = keyDir()) {
+  return (0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_4__.ensureKeyPair)(dir);
+}
+
+/**
+ * Deterministic JSON, keys sorted at every level — identical algorithm to
+ * evidence-bundle.js's canonicalJson (duplicated rather than imported: it is
+ * a pure, three-line function, and importing it would couple this module's
+ * signature format to evidence-bundle.js's internals for no real benefit).
+ */
+function canonicalJson(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value ?? null);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  const keys = Object.keys(value).sort();
+  return `{${keys.map(k => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(',')}}`;
+}
+
+// The complete set of fields a legitimately-built bundle carries, BEFORE
+// signing. This is the signed allowlist AND (in verifyPolicyBundle) the
+// complete set of keys a signed bundle is permitted to have alongside
+// `signature` — see the EA-03 note above for why both matter.
+const BUNDLE_FIELDS = ['schema', 'scope', 'policy', 'issuedAt', 'expiresAt'];
+const BUNDLE_TOP_LEVEL_KEYS = new Set([...BUNDLE_FIELDS, 'signature']);
+
+function canonicalPolicyBytes(bundle) {
+  const signed = {};
+  for (const k of BUNDLE_FIELDS) signed[k] = bundle[k] ?? null;
+  return Buffer.from(canonicalJson(signed), 'utf8');
+}
+
+/**
+ * Build an unsigned bundle. `policy` is caller-supplied and opaque — this
+ * module does not validate its shape, only its provenance and freshness.
+ */
+function buildPolicyBundle(scope, policy, { issuedAt, expiresAt } = {}) {
+  if (!SCOPES.includes(scope)) return null;
+  if (!policy || typeof policy !== 'object' || Array.isArray(policy)) return null;
+  return {
+    schema: POLICY_BUNDLE_SCHEMA,
+    scope,
+    policy,
+    issuedAt: issuedAt ?? new Date().toISOString(),
+    expiresAt: expiresAt ?? null,
+  };
+}
+
+/** Sign a bundle. Returns a new object; the input is not mutated. */
+function signPolicyBundle(bundle, privateKeyPem) {
+  const sig = node_crypto__WEBPACK_IMPORTED_MODULE_3__.sign(null, canonicalPolicyBytes(bundle), privateKeyPem);
+  return {
+    ...bundle,
+    signature: { algorithm: 'ed25519', canonicalisation: POLICY_BUNDLE_SCHEMA, value: sig.toString('base64') },
+  };
+}
+
+/**
+ * Verify a bundle: signature authenticity AND freshness. Never throws — a
+ * malformed or tampered bundle from an untrusted source (a repo checking out
+ * whatever an org distributed) is an expected input, not exceptional.
+ *
+ * @returns {{ok: boolean, reason: string|null}}
+ */
+function verifyPolicyBundle(bundle, publicKeyPem, { now = Date.now() } = {}) {
+  if (!bundle || typeof bundle !== 'object') return { ok: false, reason: 'bundle is not an object' };
+  if (bundle.schema !== POLICY_BUNDLE_SCHEMA) return { ok: false, reason: `unrecognised schema: ${bundle.schema}` };
+  if (!SCOPES.includes(bundle.scope)) return { ok: false, reason: `unrecognised scope: ${bundle.scope}` };
+  const unknownKeys = Object.keys(bundle).filter(k => !BUNDLE_TOP_LEVEL_KEYS.has(k));
+  if (unknownKeys.length) {
+    return { ok: false, reason: `unrecognised top-level key(s) not covered by the signature: ${unknownKeys.join(', ')}` };
+  }
+  const sig = bundle.signature;
+  if (!sig?.value) return { ok: false, reason: 'bundle is unsigned' };
+  if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };
+  if (!publicKeyPem) return { ok: false, reason: 'no public key supplied' };
+  let sigOk = false;
+  try {
+    sigOk = node_crypto__WEBPACK_IMPORTED_MODULE_3__.verify(null, canonicalPolicyBytes(bundle), publicKeyPem, Buffer.from(sig.value, 'base64'));
+  } catch (e) {
+    return { ok: false, reason: `verification error: ${e.message}` };
+  }
+  if (!sigOk) return { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
+  if (bundle.expiresAt) {
+    const exp = Date.parse(bundle.expiresAt);
+    if (!Number.isFinite(exp)) return { ok: false, reason: `expiresAt is not a valid date: ${bundle.expiresAt}` };
+    if (exp < now) return { ok: false, reason: `policy expired on ${bundle.expiresAt}` };
+  }
+  return { ok: true, reason: null };
+}
+
+/**
+ * Merge verified bundles into one effective policy, in inheritance order
+ * (organization -> repository -> environment; most specific wins per key).
+ * A tampered or expired bundle is EXCLUDED from the merge (rejected, not
+ * silently dropped — its scope and reason are reported so a rejection is
+ * visible, not just absent). `provenance[key]` names which scope's bundle
+ * last set that key — the "effective policy is explainable" half of the
+ * acceptance criterion.
+ *
+ * @param {Array<{scope: string, bundle: object}>} entries
+ * @param {string} publicKeyPem
+ * @returns {{effective: object, provenance: Record<string,string>,
+ *   accepted: string[], rejected: Array<{scope:string, reason:string}>}}
+ */
+function resolveEffectivePolicy(entries, publicKeyPem, { now = Date.now() } = {}) {
+  const byScope = new Map();
+  for (const e of entries || []) {
+    if (e && SCOPES.includes(e.scope)) byScope.set(e.scope, e.bundle);
+  }
+  const effective = {};
+  const provenance = {};
+  const accepted = [];
+  const rejected = [];
+  for (const scope of INHERITANCE_ORDER) {
+    const bundle = byScope.get(scope);
+    if (!bundle) continue;
+    const v = verifyPolicyBundle(bundle, publicKeyPem, { now });
+    if (!v.ok) { rejected.push({ scope, reason: v.reason }); continue; }
+    accepted.push(scope);
+    for (const [k, val] of Object.entries(bundle.policy)) {
+      effective[k] = val;
+      provenance[k] = scope;
+    }
+  }
+  return { effective, provenance, accepted, rejected };
+}
+
+/**
+ * Load whichever policy bundle files exist under
+ * `.agentic-security/policy-bundles/{organization,repository,environment}.json`.
+ * Degrades gracefully — a missing directory or missing/malformed individual
+ * file is simply absent from the result, never thrown. Read-first-in-try/
+ * catch throughout (no existsSync-then-readFileSync — D-0012/D-0022).
+ */
+function loadPolicyBundles(scanRoot) {
+  if (!scanRoot) return [];
+  const entries = [];
+  for (const scope of SCOPES) {
+    let fp;
+    try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_5__/* .statePath */ .BQ)(scanRoot, 'policy-bundles', `${scope}.json`); } catch { continue; }
+    let raw;
+    try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); } catch { continue; }
+    try {
+      const bundle = JSON.parse(raw);
+      if (bundle && typeof bundle === 'object') entries.push({ scope, bundle });
+    } catch { /* malformed — skip, do not throw */ }
+  }
+  return entries;
+}
+
+/**
+ * Read the operator-supplied public key an org distributes alongside its
+ * bundles, from `.agentic-security/policy-bundle-public-key.pem`. Returns
+ * null (not a throw) if absent or unreadable — resolution then rejects
+ * every bundle for lack of a key, same as any other "no public key
+ * supplied" case in verifyPolicyBundle.
+ */
+function loadPolicyPublicKey(scanRoot) {
+  if (!scanRoot) return null;
+  let fp;
+  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_5__/* .statePath */ .BQ)(scanRoot, 'policy-bundle-public-key.pem'); } catch { return null; }
+  try { return node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); } catch { return null; }
+}
+
+/**
+ * FR-1006 ("policy drift"): does this repository's LOCALLY resolved effective
+ * policy diverge from what the organization-scope bundle alone specifies —
+ * and is anything the repo is relying on actually being rejected (tampered
+ * or expired) rather than enforced? Both are GOVERNANCE gaps, distinct from
+ * risk findings, which is the exact distinction FR-1006's acceptance
+ * criterion asks fleet output to make.
+ *
+ * No bundles configured at all is a no-op (`null`), matching this session's
+ * established convention: drift can only be reported relative to a
+ * baseline, and a repo with no organization bundle has no baseline to drift
+ * from.
+ *
+ * @returns {{accepted: string[], rejected: Array<{scope,reason}>,
+ *   overrides: Array<{key, organizationValue, effectiveValue, overriddenBy}>}
+ *   | null}
+ */
+function computePolicyDrift(scanRoot) {
+  const entries = loadPolicyBundles(scanRoot);
+  if (!entries.length) return null;
+  const publicKeyPem = loadPolicyPublicKey(scanRoot);
+  const { effective, provenance, accepted, rejected } = resolveEffectivePolicy(entries, publicKeyPem);
+
+  const overrides = [];
+  const orgEntry = entries.find(e => e.scope === 'organization');
+  if (orgEntry && accepted.includes('organization')) {
+    for (const [key, organizationValue] of Object.entries(orgEntry.bundle.policy || {})) {
+      const overriddenBy = provenance[key];
+      if (overriddenBy && overriddenBy !== 'organization' && !_deepEqual(effective[key], organizationValue)) {
+        overrides.push({ key, organizationValue, effectiveValue: effective[key], overriddenBy });
+      }
+    }
+  }
+  return { accepted, rejected, overrides };
+}
+
+function _deepEqual(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+
+
+/***/ })
+
+};

package/dist/824.index.js

@@ -12,6 +12,7 @@ export const modules = {
 /* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
+/* harmony import */ var _egress_policy_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5712);
 // LLM-assisted vulnerable function extraction for SCA findings.
 //
 // For CVEs without OSV ecosystem_specific data or GHSA fix commits,
@@ -24,6 +25,7 @@ export const modules = {
 
 
 
+
 const CACHE_DIR = process.env.XDG_CONFIG_HOME
   ? node_path__WEBPACK_IMPORTED_MODULE_2__.join(process.env.XDG_CONFIG_HOME, 'agentic-security', 'llm-sca-cache')
   : node_path__WEBPACK_IMPORTED_MODULE_2__.join(process.env.HOME || '/tmp', '.config', 'agentic-security', 'llm-sca-cache');
@@ -77,6 +79,11 @@ async function extractVulnFunctionsViaLLM(supplyChain, opts = {}) {
   if (!isLlmScaEnabled()) return [];
   const config = _endpointConfig();
   if (!config) return [];
+  // FR-601: one decision for the whole batch (same endpoint for every CVE in
+  // this run) — evaluated before any of the per-candidate prompts below are
+  // built.
+  const egressDecision = (0,_egress_policy_js__WEBPACK_IMPORTED_MODULE_3__/* .evaluateEgress */ .nn)({ scanRoot: opts.scanRoot, purpose: 'sca-llm-function-extract', endpoint: config.endpoint });
+  if (!egressDecision.allowed) return [];
 
   const enriched = [];
   const candidates = (supplyChain || []).filter(sc =>

package/dist/905.index.js

@@ -111,6 +111,8 @@ function partitionCallGraph(callGraph, opts = {}) {
 
 // EXTERNAL MODULE: ./src/discovery/lenses.js
 var discovery_lenses = __webpack_require__(3499);
+// EXTERNAL MODULE: ./src/egress/policy.js
+var policy = __webpack_require__(5712);
 ;// CONCATENATED MODULE: ./src/discovery/llm-invoke.js
 //
 // Shared LLM endpoint caller. Both the hunter and the refutation panel need
@@ -119,6 +121,8 @@ var discovery_lenses = __webpack_require__(3499);
 // other does not, the bug stays buried in one direction.
 //
 
+
+
 const DEFAULT_TIMEOUT_MS = 60000;
 
 async function defaultLlmInvoke(prompt, opts = {}) {
@@ -202,12 +206,27 @@ function consensusOf(responses) {
  * An llmInvoke that queries several endpoints and returns the consensus answer.
  * Returns null when no endpoint answered — the callers already treat a null or
  * a throw as degradation, so an all-providers-down run degrades honestly.
+ *
+ * FR-605 (assurance-hardening PRD): each endpoint gets its OWN egress
+ * decision before being included — `mode: local-only` / `deniedProviders`
+ * must not be smuggled past just because the SINGLE-endpoint path already
+ * checks it. A policy-denied endpoint is EXCLUDED from the vote, the exact
+ * same treatment an unreachable endpoint already gets a few lines below
+ * (never counted as dissent) — the module's own established pattern
+ * extended to a second exclusion reason. Returns `{invoke, decisions}`:
+ * `invoke` is null only when EVERY endpoint was denied (the all-down
+ * equivalent); `decisions` is the full per-endpoint array for a caller
+ * that wants it, kept alongside the single aggregate `decision` the
+ * pre-existing callers already read.
  */
-function makeConsensusInvoke(endpoints, { timeoutMs } = {}) {
+function makeConsensusInvoke(endpoints, { timeoutMs, scanRoot, purpose } = {}) {
   const list = parseEndpoints(endpoints);
-  if (list.length === 0) return null;
-  return async (prompt) => {
-    const answers = await Promise.all(list.map(async (url) => {
+  if (list.length === 0) return { invoke: null, decisions: [] };
+  const decisions = list.map(url => (0,policy/* evaluateEgress */.nn)({ scanRoot, purpose: purpose || 'discovery-consensus', endpoint: url }));
+  const allowedList = list.filter((_, i) => decisions[i].allowed);
+  if (allowedList.length === 0) return { invoke: null, decisions };
+  const invoke = async (prompt) => {
+    const answers = await Promise.all(allowedList.map(async (url) => {
       try { return await defaultLlmInvoke(prompt, { timeoutMs, endpoint: url }); }
       catch { return null; } // excluded from the vote, never counted as dissent
     }));
@@ -215,22 +234,61 @@ function makeConsensusInvoke(endpoints, { timeoutMs } = {}) {
     if (value === null) throw new Error('no LLM endpoint answered');
     return value;
   };
+  return { invoke, decisions };
 }
 
-function resolveLlmInvoke(opts = {}) {
-  // Precedence, most explicit first: an injected callback beats configuration,
-  // and a multi-endpoint list beats a single endpoint. A caller who supplied
-  // their own function must always get exactly that function.
-  if (opts.llmInvoke) return opts.llmInvoke;
+// FR-601: egress policy is evaluated here, BEFORE returning a callable and
+// therefore before either caller (hunter.js, disprove.js) builds a prompt —
+// a denied decision makes this resolve to `invoke: null`, which both callers
+// already treat as "nothing to call" via their existing degrade path, so a
+// denial produces no network request through the exact same code path a
+// missing endpoint always has. `decision` carries the machine-readable
+// reason so callers can distinguish "not configured" from "configured but
+// policy-denied" in their own degrade message, rather than reporting a
+// generic "not set" that would be actively wrong once policy is what
+// blocked the call.
+//
+// FR-605 (assurance-hardening PRD): consensus mode (multiple endpoints) is
+// now egress-filtered per endpoint, same as the single-endpoint path below —
+// this is what closes the actual "a remote URL cannot be smuggled into
+// local-only configuration" gap the paragraph below used to describe as
+// open. Per-endpoint CONSTRAINT dimensions beyond allow/deny/local-only
+// (role/region/repository/path/data-class — one provider allowed, another
+// denied for a REASON beyond the deny-list) remain FR-602's separate scope;
+// what changed here is that the single allow/deny/local-only gate FR-601
+// already built is no longer bypassable just by using multiple endpoints
+// instead of one.
+function resolveLlmInvokeWithDecision(opts = {}) {
+  // An injected callback is a test/consumer-controlled escape hatch — it
+  // bypasses egress the same way it already bypasses endpoint resolution,
+  // because there is no real endpoint here for a policy to evaluate.
+  if (opts.llmInvoke) return { invoke: opts.llmInvoke, decision: null };
 
   const multi = opts.endpoints || process.env[DEFAULT_CONSENSUS_ENV];
   if (multi) {
-    const consensus = makeConsensusInvoke(multi, { timeoutMs: opts.timeoutMs });
-    if (consensus) return consensus;
+    const { invoke, decisions } = makeConsensusInvoke(multi, { timeoutMs: opts.timeoutMs, scanRoot: opts.scanRoot, purpose: opts.purpose });
+    // A single aggregate `decision` for the pre-existing callers (hunter.js,
+    // disprove.js), which only ever read `.reason` when `invoke` is null —
+    // the all-denied case. The full per-endpoint detail is on `decisions`
+    // for a caller that wants it.
+    const decision = decisions.find(d => !d.allowed) || decisions[0] || null;
+    return { invoke, decision, decisions };
   }
 
-  if (!process.env.AGENTIC_SECURITY_LLM_ENDPOINT) return null;
-  return (prompt) => defaultLlmInvoke(prompt, { timeoutMs: opts.timeoutMs });
+  const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
+  if (!endpoint) return { invoke: null, decision: null };
+
+  const decision = (0,policy/* evaluateEgress */.nn)({ scanRoot: opts.scanRoot, purpose: opts.purpose || 'discovery', endpoint });
+  if (!decision.allowed) return { invoke: null, decision };
+
+  return { invoke: (prompt) => defaultLlmInvoke(prompt, { timeoutMs: opts.timeoutMs }), decision };
+}
+
+function resolveLlmInvoke(opts = {}) {
+  // Precedence, most explicit first: an injected callback beats configuration,
+  // and a multi-endpoint list beats a single endpoint. A caller who supplied
+  // their own function must always get exactly that function.
+  return resolveLlmInvokeWithDecision(opts).invoke;
 }
 
 ;// CONCATENATED MODULE: ./src/discovery/hunter.js
@@ -311,12 +369,16 @@ async function runHunter(focusArea, lens, ctx = {}, opts = {}) {
   const transcript = [];
   const lensKey = lens?.key || 'unknown';
   const base = { focusAreaId: focusArea.id, lens: lensKey, transcript };
-  const llmInvoke = resolveLlmInvoke(opts);
+  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, purpose: 'discovery-hunter' });
 
   if (typeof llmInvoke !== 'function') {
-    const reason = 'no llmInvoke supplied and AGENTIC_SECURITY_LLM_ENDPOINT not set';
-    appendEntry(transcript, { phase: 'init', reason });
-    return { ...base, candidates: [], degraded: true, reason };
+    // FR-601: distinguish "policy denied a configured endpoint" from "nothing
+    // was configured at all" — the reason must reflect which actually happened.
+    const reason = egressDecision
+      ? `egress policy denied this call: ${egressDecision.reason}`
+      : 'no llmInvoke supplied and AGENTIC_SECURITY_LLM_ENDPOINT not set';
+    appendEntry(transcript, { phase: 'init', reason, egressDecision: egressDecision || undefined });
+    return { ...base, candidates: [], degraded: true, reason, egressDecision };
   }
 
   let prompt;
@@ -454,7 +516,11 @@ function parseVote(raw) {
 
 async function disproveCandidate(candidate, opts = {}) {
   const angles = Array.isArray(opts.angles) && opts.angles.length ? opts.angles : DEFAULT_ANGLES;
-  const llmInvoke = resolveLlmInvoke(opts);
+  // FR-601: an egress-policy denial resolves llmInvoke to null the same way a
+  // missing endpoint always has, so it falls straight into this module's own
+  // pre-existing rule — "silence never refutes" — with zero votes cast and no
+  // prompt ever built for a denied endpoint.
+  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, purpose: 'discovery-disprove' });
 
   const votes = [];
   if (typeof llmInvoke === 'function') {
@@ -469,7 +535,7 @@ async function disproveCandidate(candidate, opts = {}) {
   const refuteCount = votes.filter(v => v.refuted).length;
   const undecided = voterCount === 0;
   const refuted = !undecided && refuteCount * 2 > voterCount;
-  return { ...candidate, refutation: { votes, voterCount, refuteCount, refuted, undecided } };
+  return { ...candidate, refutation: { votes, voterCount, refuteCount, refuted, undecided, egressDecision: egressDecision || undefined } };
 }
 
 async function disprovePanel(candidates, opts = {}) {
@@ -800,7 +866,7 @@ function makeTaintProbe(perFileIR, callGraph) {
 
 async function runDeepAnalysisSafe(perFileIR, callGraph) {
   try {
-    const { runDeepAnalysis } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 6732));
+    const { runDeepAnalysis } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 7165));
     return runDeepAnalysis(perFileIR, callGraph, {});
   } catch {
     return null;
@@ -925,7 +991,7 @@ async function runDiscovery(ctx = {}, opts = {}) {
   for (const area of areas) {
     let areaDegradedCount = 0;
     for (const lens of lenses) {
-      const run = await runHunter(area, lens, { fileContents: ctx.fileContents || {} }, { llmInvoke });
+      const run = await runHunter(area, lens, { fileContents: ctx.fileContents || {} }, { llmInvoke, scanRoot: opts.scanRoot });
       runs.push({ focusAreaId: run.focusAreaId, lens: run.lens, degraded: run.degraded, reason: run.reason, candidateCount: run.candidates.length });
       if (run.degraded && run.reason) reasons.push(`${area.label} × ${lens.key}: ${run.reason}`);
       if (run.degraded) areaDegradedCount += 1;
@@ -987,7 +1053,7 @@ async function runDiscovery(ctx = {}, opts = {}) {
       'every candidate is reported unconfirmed and severity is not evidence-derived');
   }
   const confirmed = await confirmAll(candidates, { taintProbe });
-  const { survivors, refuted } = await disprovePanel(confirmed, { llmInvoke });
+  const { survivors, refuted } = await disprovePanel(confirmed, { llmInvoke, scanRoot: opts.scanRoot });
   const { fresh, duplicates, suppressed } = judgeCandidates(survivors, ctx.priorScan, ctx.triageFeedback);
 
   // A spent budget is a coverage gap, stated once at the top level rather than