@clear-capabilities/agentic-security-scanner 0.144.0 → 0.147.0

package/dist/{435.index.js → 9091.index.js}

@@ -1,8 +1,8 @@
-export const id = 435;
-export const ids = [435,752];
+export const id = 9091;
+export const ids = [9091,8218,8752];
 export const modules = {
 
-/***/ 2435:
+/***/ 9091:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -102,111 +102,182 @@ var integrity = __webpack_require__(1130);
 var state_dir = __webpack_require__(1174);
 // EXTERNAL MODULE: ./src/posture/cache-economics.js
 var cache_economics = __webpack_require__(8752);
-;// CONCATENATED MODULE: ./src/mcp/redact.js
-// Secret redactor for MCP tool outputs and audit log argument summaries.
-//
-// OWASP MCP01 + MCP10: the scanner reads source code, and findings carry
-// `snippet` / `description` / `trace` strings that may contain hardcoded
-// credentials, API keys, JWTs, private keys, etc. When those flow back to
-// the agent through tools/call responses they land in the agent's context
-// — exposing the secret to model logs, transcripts, and any downstream tool
-// the agent passes them to.
-//
-// We replace high-confidence secret shapes with [REDACTED:<kind>] before
-// emitting them. The original full content is still on disk (scanner
-// findings); the MCP surface is the bottleneck we control.
+// EXTERNAL MODULE: ./src/mcp/redact.js
+var redact = __webpack_require__(3468);
+// EXTERNAL MODULE: ./src/report/index.js + 3 modules
+var report = __webpack_require__(457);
+// EXTERNAL MODULE: ./src/posture/provenance/schema.js
+var schema = __webpack_require__(4594);
+// EXTERNAL MODULE: ./src/server/graph-loader.js
+var graph_loader = __webpack_require__(8218);
+// EXTERNAL MODULE: ./src/server/routes.js
+var routes = __webpack_require__(4268);
+// EXTERNAL MODULE: ./src/lineage/redact-graph.js
+var redact_graph = __webpack_require__(334);
+// EXTERNAL MODULE: ./src/lineage/export-json.js
+var export_json = __webpack_require__(859);
+;// CONCATENATED MODULE: ./src/mcp/dataflow-tools.js
+// dataflow-tools.js — Milestone 4, sub-project MCP tools.
 //
-// Patterns deliberately stay narrow: high-precision so we don't garble
-// non-secret long strings (UUIDs, SHAs, base64-encoded scan IDs).
-
-const PATTERNS = [
-  // Provider-specific high-entropy keys (anchored prefixes give very low FP)
-  [/AKIA[0-9A-Z]{16}/g, 'aws-access-key'],
-  [/ASIA[0-9A-Z]{16}/g, 'aws-temp-key'],
-  [/gh[pousr]_[A-Za-z0-9]{36,255}/g, 'github-token'],
-  [/xox[abprs]-[A-Za-z0-9-]{10,}/g, 'slack-token'],
-  [/sk-ant-[A-Za-z0-9_-]{20,}/g, 'anthropic-key'],
-  [/sk-proj-[A-Za-z0-9_-]{20,}/g, 'openai-project-key'],
-  [/sk-[A-Za-z0-9]{32,}/g, 'openai-or-stripe-key'],
-  [/sk_(?:live|test)_[A-Za-z0-9]{20,}/g, 'stripe-key'],
-  [/rk_(?:live|test)_[A-Za-z0-9]{20,}/g, 'stripe-restricted-key'],
-  [/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g, 'sendgrid-key'],
-  [/AIza[0-9A-Za-z_-]{35}/g, 'google-api-key'],
-  // Stage 4 correctness audit (coverage breadth, AI security): this list
-  // only covered a small subset of what the scanner's OWN credential
-  // detector (engine.js's CREDENTIAL_PATTERNS, 40+ provider shapes) finds
-  // — a Shopify/Telegram/Twilio/Discord-webhook/Square/Google-OAuth/JDBC
-  // secret detected and reported by a scan reached explain_finding's
-  // output completely unredacted, because none of those shapes were in
-  // THIS separate, narrower list. Reusing the same regex bodies as
-  // engine.js's CREDENTIAL_PATTERNS for the shapes verified to leak
-  // (rather than importing engine.js itself, which would pull its entire
-  // multi-thousand-line module graph into the MCP server's dependency
-  // surface for a handful of consts).
-  [/ya29\.[0-9A-Za-z_-]{20,}/g, 'google-oauth-token'],
-  [/shp(?:at|ss|ca|pa)_[a-fA-F0-9]{32}/g, 'shopify-token'],
-  [/(?<![0-9])[0-9]{8,10}:AA[0-9A-Za-z_-]{33}(?![A-Za-z0-9_])/g, 'telegram-bot-token'],
-  [/twilio.{0,20}SK[0-9a-fA-F]{32}/gi, 'twilio-api-key'],
-  [/sq0atp-[0-9A-Za-z_-]{22}/g, 'square-access-token'],
-  [/sq0csp-[0-9A-Za-z_-]{43}/g, 'square-oauth-secret'],
-  [/access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}/g, 'paypal-braintree-token'],
-  [/https:\/\/(?:discordapp|discord)\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g, 'discord-webhook'],
-  [/https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]{8}\/B[a-zA-Z0-9_]{8,12}\/[a-zA-Z0-9_]{24}/g, 'slack-webhook'],
-  [/https:\/\/outlook\.office\.com\/webhook\/[A-Za-z0-9\-@]+\/IncomingWebhook\/[A-Za-z0-9-]+\/[A-Za-z0-9-]+/g, 'teams-webhook'],
-  [/https:\/\/(?:www\.)?hooks\.zapier\.com\/hooks\/catch\/[A-Za-z0-9]+\/[A-Za-z0-9]+\//g, 'zapier-webhook'],
-  // JDBC connection string carrying a password: only redact when password
-  // evidence is actually on the line (matches engine.js's own ctx gate),
-  // so a credential-free JDBC URL in docs isn't needlessly mangled.
-  [/jdbc:[a-z:]+:\/\/[A-Za-z0-9.\-_:;=/@?,&]*(?:@|password=|passwd=|pwd=)[A-Za-z0-9.\-_:;=/@?,&]*/gi, 'jdbc-connection-string'],
-  // JWT — three dot-separated b64url segments starting with eyJ
-  [/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, 'jwt'],
-  // PEM-encoded private keys
-  [/-----BEGIN (?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g, 'private-key-block'],
-  // Authorization headers — common copy-paste shape
-  [/(?:Authorization|authorization)\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, 'bearer-token'],
-  // Hardcoded password literals — assignment shape with quoted value
-  [/(password|passwd|secret|api[_-]?key|access[_-]?token)\s*[:=]\s*["'][^"'\n]{6,}["']/gi, 'hardcoded-credential'],
-];
+// Thin, read-only MCP adapter over the DataFlowGraph v1 artifact. Every
+// piece of actual graph-loading and graph-query logic here is REUSED,
+// unmodified, from scanner/src/server/ (built for the `explore` HTTP
+// server, Milestone 3): loadSignedGraph does the signed-artifact
+// load+verify, the four handleX functions do the lookups. This module
+// adds nothing but MCP tool shape (name/description/inputSchema/handler)
+// and MCP-appropriate error handling — no new graph-query logic is
+// written here, on purpose (see this sub-project's own scoping doc).
+
+
+
 
-const SNIPPET_MAX = 2000;
-// OWASP A03 — cap input before running 14 regex patterns over it. A forged
-// last-scan.json could plant a 50MB description string; without this cap a
-// single explain_finding/query_taint call would peg CPU. After truncation
-// the snippet still gets the final SNIPPET_MAX trim downstream.
-const INPUT_MAX = 100_000;
-
-function redactString(s) {
-  if (typeof s !== 'string') return s;
-  let out = s;
-  if (out.length > INPUT_MAX) out = out.slice(0, INPUT_MAX) + `…(+${out.length - INPUT_MAX})`;
-  for (const [re, kind] of PATTERNS) {
-    out = out.replace(re, `[REDACTED:${kind}]`);
-  }
-  if (out.length > SNIPPET_MAX) out = out.slice(0, SNIPPET_MAX) + `…(+${out.length - SNIPPET_MAX})`;
-  return out;
-}
 
-// Deep-redact every string in a finding-like object (mutates returned copy).
-function redactFinding(f) {
-  if (!f || typeof f !== 'object') return f;
-  const out = { ...f };
-  for (const k of ['snippet', 'description', 'remediation', 'title', 'vuln', 'message']) {
-    if (typeof out[k] === 'string') out[k] = redactString(out[k]);
-  }
-  if (out.trace) {
-    try { out.trace = JSON.parse(redactString(JSON.stringify(out.trace))); }
-    catch { /* keep as-is if not round-trippable */ }
-  }
-  return out;
-}
 
-// Redact a freeform JSON-stringified argument blob (used by audit log).
-function redactArgsBlob(s) {
-  return redactString(s);
+const META = { source: 'agentic-security-mcp', untrusted_excerpts: true };
+
+function _loadOrFailure(sessionRoot) {
+  const loaded = (0,graph_loader.loadSignedGraph)(sessionRoot);
+  if (loaded.ok) return { graph: loaded.graph };
+  return {
+    failure: {
+      _meta: META,
+      hasResult: false,
+      reason: loaded.reason,
+      message: loaded.message,
+    },
+  };
 }
 
-// EXTERNAL MODULE: ./src/report/index.js + 3 modules
-var report = __webpack_require__(457);
+// Milestone 5, large-graph pagination: an optional `filter` input narrows the
+// returned graph via the exact same `validateFilterShape`/`_filterGraph`
+// pair the CLI's own `--filter` and the `explore` server's new
+// `POST /api/v1/query` endpoint both already use — one real, shared
+// primitive, not a third drifting copy. KNOWN, DISCLOSED GAP (still open):
+// an OMITTED filter still returns the whole graph inline, with the same
+// stdio.js MAX_LINE_BYTES (4MB) risk on a very large, unfiltered scan as
+// before this change — this increment adds an opt-in capability for a
+// caller that supplies a filter, it does not add a forced fallback/offload
+// for a caller that doesn't. That remains a follow-up increment.
+// Final whole-branch review finding: `filter: {}` is NOT the same as
+// omitting `filter` — `_filterGraph` treats an empty (but well-formed)
+// filter object as "narrow to nothing" (empty nodeIds/edgeIds Sets), so
+// `filter: {}` returns an EMPTY graph (zero nodes/edges/flows), not the
+// whole one. Called out explicitly in this tool's own `description` below
+// so an agent reaching for "no restriction" reaches for OMITTING the
+// argument, never for `{}`.
+const dataflow_get_graph = {
+  name: 'dataflow_get_graph',
+  description: 'Return the DataFlowGraph v1 artifact from the last signed, verified deep-mode scan: nodes, edges, flows, scope, coverage, and limitations. Requires a prior `AGENTIC_SECURITY_LINEAGE_DEEP=1 agentic-security scan`. Optional `filter: {nodeIds, edgeIds}` narrows the returned nodes/edges/flows/dataElements (same primitive as the CLI\'s `--filter` and the `explore` server\'s `POST /api/v1/query`). IMPORTANT: omit `filter` entirely for the whole graph — passing `filter: {}` returns an EMPTY graph (zero nodes/edges/flows), not the whole one, since an empty filter narrows to nothing rather than meaning "no restriction". KNOWN GAP: an OMITTED filter still returns the whole graph inline with no pagination/offload — may exceed the stdio transport line cap on a very large, unfiltered graph; supply a real, non-empty filter to narrow the response.',
+  inputSchema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+      filter: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          nodeIds: { type: 'array', items: { type: 'string' } },
+          edgeIds: { type: 'array', items: { type: 'string' } },
+        },
+      },
+    },
+  },
+  async handler(args, ctx) {
+    const { graph, failure } = _loadOrFailure(ctx.sessionRoot);
+    if (failure) return failure;
+    // Milestone 5, large-graph pagination: reuses the exact same
+    // validateFilterShape/_filterGraph pair the new POST /api/v1/query
+    // server endpoint and the CLI's own --filter both use — one real,
+    // shared primitive, not a third drifting copy.
+    const filterCheck = (0,export_json.validateFilterShape)(args?.filter);
+    if (!filterCheck.valid) {
+      return { _meta: META, hasResult: false, reason: 'invalid-filter', message: filterCheck.error };
+    }
+    const { status, body } = (0,routes/* handleGraph */.fn)(graph);
+    return {
+      _meta: META,
+      hasResult: true,
+      status,
+      data: (0,redact_graph/* _redactGraph */.zl)(args?.filter ? (0,export_json/* _filterGraph */.e)(body.data, args.filter) : body.data),
+      digest: body.digest,
+      schemaVersion: body.schemaVersion,
+      extensions: body.extensions,
+      scope: body.scope,
+      coverage: body.coverage,
+      limitations: body.limitations,
+    };
+  },
+};
+
+const dataflow_get_node = {
+  name: 'dataflow_get_node',
+  description: 'Look up one node by canonical id in the DataFlowGraph v1 artifact.',
+  inputSchema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: { id: { type: 'string', minLength: 1, maxLength: 512 } },
+    required: ['id'],
+  },
+  async handler({ id }, ctx) {
+    const { graph, failure } = _loadOrFailure(ctx.sessionRoot);
+    if (failure) return failure;
+    const { status, body } = (0,routes/* handleNode */.d5)(graph, id);
+    return {
+      _meta: META,
+      hasResult: true,
+      notFound: status === 404,
+      data: (0,redact_graph/* _redactNode */.T2)(body.data),
+      canonicalIds: body.canonicalIds,
+    };
+  },
+};
+
+const dataflow_get_edge = {
+  name: 'dataflow_get_edge',
+  description: 'Look up one edge by canonical id in the DataFlowGraph v1 artifact.',
+  inputSchema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: { id: { type: 'string', minLength: 1, maxLength: 512 } },
+    required: ['id'],
+  },
+  async handler({ id }, ctx) {
+    const { graph, failure } = _loadOrFailure(ctx.sessionRoot);
+    if (failure) return failure;
+    const { status, body } = (0,routes/* handleEdge */.Yu)(graph, id);
+    return {
+      _meta: META,
+      hasResult: true,
+      notFound: status === 404,
+      data: body.data,
+      canonicalIds: body.canonicalIds,
+    };
+  },
+};
+
+const dataflow_get_flow = {
+  name: 'dataflow_get_flow',
+  description: 'Look up one flow by canonical id in the DataFlowGraph v1 artifact, including its contributing node/edge canonical ids.',
+  inputSchema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: { id: { type: 'string', minLength: 1, maxLength: 512 } },
+    required: ['id'],
+  },
+  async handler({ id }, ctx) {
+    const { graph, failure } = _loadOrFailure(ctx.sessionRoot);
+    if (failure) return failure;
+    const { status, body } = (0,routes/* handleFlow */.jg)(graph, id);
+    return {
+      _meta: META,
+      hasResult: true,
+      notFound: status === 404,
+      data: body.data,
+      canonicalIds: body.canonicalIds,
+    };
+  },
+};
+
 ;// CONCATENATED MODULE: ./src/posture/agents-memory.js
 // AGENTS.md — writable continual-learning memory (harness-anatomy #2).
 //
@@ -508,6 +579,11 @@ const cve_lookup_internals = { CACHE_DIR, CVE_RE, _stalenessTier };
 
 
 
+// Git-origin provenance (Finding Provenance M0/M1). Distinct from
+// `finding.provenance` (AI-authorship) and from an SCA entry's `provenance`
+// (Sigstore/SLSA attestation) — see report/index.js's import comment.
+
+
 
 // Lazy-loaded: these transitively pull in npm packages (@babel/core and
 // friends) that aren't available in the plugin-cache install path
@@ -520,14 +596,14 @@ async function getRunScan() {
 }
 let _verifyFixCore;
 async function getVerifyFixCore() {
-  if (!_verifyFixCore) _verifyFixCore = (await __webpack_require__.e(/* import() */ 526).then(__webpack_require__.bind(__webpack_require__, 3526))).verifyFix;
+  if (!_verifyFixCore) _verifyFixCore = (await __webpack_require__.e(/* import() */ 3526).then(__webpack_require__.bind(__webpack_require__, 3526))).verifyFix;
   return _verifyFixCore;
 }
 
 const MAX_FILES_PER_SCAN = 1024;
 const MAX_FILE_BYTES = 500_000;
 const MAX_TOTAL_SCAN_BYTES = 50_000_000;
-const META = { source: 'agentic-security-mcp', untrusted_excerpts: true };
+const tools_META = { source: 'agentic-security-mcp', untrusted_excerpts: true };
 
 // OWASP A01 — refuse writes to paths that could subvert the security tool
 // itself or the host's source-control / dependency state. A forged finding
@@ -907,7 +983,7 @@ const scan_diff = {
     // scanning), left as-is rather than silently claimed fixed here.
     const findings = (0,report.normalizeFindings)(result.scan)
       .filter(f => wantSet.has(String(f.file || '').replace(/\\/g, '/')) && (sevRank[f.severity] ?? 0) >= min)
-      .map(f => redactFinding({
+      .map(f => (0,redact/* redactFinding */.lE)({
         id: f.id, severity: f.severity, file: f.file, line: f.line,
         title: f.vuln, cwe: f.cwe,
         description: f.description, remediation: f.remediation,
@@ -919,7 +995,7 @@ const scan_diff = {
     const off = _maybeOffload(sessionRoot, 'scan_diff', findings);
     if (off.offloaded) {
       return {
-        _meta: META,
+        _meta: tools_META,
         scannedFiles: Object.keys(fileContents).length,
         findingCount: off.total,
         offloaded: true,
@@ -929,7 +1005,7 @@ const scan_diff = {
       };
     }
     return {
-      _meta: META,
+      _meta: tools_META,
       scannedFiles: Object.keys(fileContents).length,
       findingCount: findings.length,
       findings,
@@ -955,7 +1031,7 @@ const query_taint = {
   async handler({ source, sink, limit, offset }, ctx) {
     const { scan, status } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: true });
     if (!scan) {
-      return { _meta: META, hasResult: false, status, message: `No usable scan state (${status}).` };
+      return { _meta: tools_META, hasResult: false, status, message: `No usable scan state (${status}).` };
     }
     const lim = Number.isInteger(limit) ? Math.min(50, Math.max(1, limit)) : 10;
     const off = Number.isInteger(offset) ? Math.max(0, offset) : 0;
@@ -970,13 +1046,13 @@ const query_taint = {
       const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(f.trace || '')].join(' ').toLowerCase();
       return hay.includes(srcL) && hay.includes(sinkL);
     });
-    const page = all.slice(off, off + lim).map(f => redactFinding({
+    const page = all.slice(off, off + lim).map(f => (0,redact/* redactFinding */.lE)({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, description: f.description,
       trace: f.trace || null,
     }));
     return {
-      _meta: META,
+      _meta: tools_META,
       hasResult: true,
       integrity: status,
       scanStartedAt: scan.startedAt || scan.meta?.startedAt || null,
@@ -1008,7 +1084,7 @@ const explain_finding = {
     if (!scan) throw new Error(`No usable scan state (${status}).`);
     const f = _findById(scan, finding_id);
     if (!f) throw new Error(`Finding not found: ${finding_id}`);
-    const redacted = redactFinding({
+    const redacted = (0,redact/* redactFinding */.lE)({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, cwe: f.cwe,
       description: f.description, remediation: f.remediation,
@@ -1033,7 +1109,7 @@ const explain_finding = {
       }
     }
     return {
-      _meta: META,
+      _meta: tools_META,
       ...redacted,
       trace: traceTrimmed,
       traceOffload: traceMeta,
@@ -1053,6 +1129,21 @@ const explain_finding = {
       epssScore: typeof f.epssScore === 'number' ? f.epssScore : null,
       epssPercentile: typeof f.epssPercentile === 'number' ? f.epssPercentile : null,
       exploitedNow: !!f.exploitedNow,
+      // Which commit introduced this finding. `includeEmail` stays at its
+      // DEFAULT (false) unconditionally — unlike the JSON report there is no
+      // operator-set env escape for it here, because the consumer is an
+      // agent that has no business receiving a committer's email address.
+      // `pseudonymize`, by contrast, IS read back from the same env var
+      // report/index.js's `_normalizedProvenance` reads
+      // (AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS=1 / --pseudonymize-authors) —
+      // fix-round item 4: an operator who set that policy was still getting
+      // raw committer names (and, via providerEnrichment, raw reviewer
+      // logins/CODEOWNERS lines) through this MCP surface because this call
+      // passed no options object at all, silently defeating their policy at
+      // this one output boundary while report/index.js honoured it.
+      findingProvenance: f.findingProvenance ? (0,schema/* redactFindingProvenance */.As)(f.findingProvenance, {
+        pseudonymize: process.env.AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS === '1',
+      }) : null,
     };
   },
 };
@@ -1129,16 +1220,16 @@ const apply_fix = {
   },
   async handler({ finding_id, confirm, dry_run = false, patch = null, fixMeta = null }, ctx) {
     if (confirm !== true) {
-      return { _meta: META, applied: false, reason: 'apply_fix requires confirm: true.' };
+      return { _meta: tools_META, applied: false, reason: 'apply_fix requires confirm: true.' };
     }
     const { scan, status } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: false });
     if (!scan) {
-      return { _meta: META, applied: false, reason: `last-scan.json failed integrity check: ${status}. Run a fresh scan.` };
+      return { _meta: tools_META, applied: false, reason: `last-scan.json failed integrity check: ${status}. Run a fresh scan.` };
     }
     const f = _findById(scan, finding_id);
-    if (!f) return { _meta: META, applied: false, reason: `Finding not found: ${finding_id}` };
+    if (!f) return { _meta: tools_META, applied: false, reason: `Finding not found: ${finding_id}` };
     if (f._shadow === true) {
-      return { _meta: META, applied: false, reason: 'shadow findings cannot be auto-applied' };
+      return { _meta: tools_META, applied: false, reason: 'shadow findings cannot be auto-applied' };
     }
 
     // #3 — verifier-approved patch path. When the caller supplies `patch` (a
@@ -1153,15 +1244,15 @@ const apply_fix = {
     // slip through — there is no token to replay, the verify runs here and now.
     if (patch && typeof patch === 'object' && Object.keys(patch).length) {
       if (!f.stableId) {
-        return { _meta: META, applied: false, reason: 'finding has no stableId — cannot verify a patch against it' };
+        return { _meta: tools_META, applied: false, reason: 'finding has no stableId — cannot verify a patch against it' };
       }
       const confinedAbs = {};
       for (const [rel, content] of Object.entries(patch)) {
         let abs;
         try { abs = _confine(ctx.sessionRoot, rel, 'patch key'); }
-        catch (e) { return { _meta: META, applied: false, reason: `path-escape refused: ${e.message}` }; }
+        catch (e) { return { _meta: tools_META, applied: false, reason: `path-escape refused: ${e.message}` }; }
         if (_isReservedWritePath(ctx.sessionRoot, abs)) {
-          return { _meta: META, applied: false, reason: `reserved path refused: ${rel}` };
+          return { _meta: tools_META, applied: false, reason: `reserved path refused: ${rel}` };
         }
         confinedAbs[rel] = { abs, content: String(content) };
       }
@@ -1174,7 +1265,7 @@ const apply_fix = {
           // suite as a fourth verification leg (scan + lint + tests). Opt-in
           // because many repos have no runner and we must not fail-closed by
           // default. Normalized to the scan+lint verdict shape used below.
-          const { verifyFixWithTests } = await __webpack_require__.e(/* import() */ 113).then(__webpack_require__.bind(__webpack_require__, 4113));
+          const { verifyFixWithTests } = await __webpack_require__.e(/* import() */ 4113).then(__webpack_require__.bind(__webpack_require__, 4113));
           const t = await verifyFixWithTests({ scanRoot: ctx.sessionRoot, originalFindingStableId: f.stableId, files: _files });
           verdict = { ok: t.ok, summary: t.summary, rescan: t.legs?.scan?.detail, lint: t.legs?.lint?.detail, tests: t.legs?.tests, testVerdict: t.verdict };
         } else {
@@ -1187,11 +1278,11 @@ const apply_fix = {
           });
         }
       } catch (e) {
-        return { _meta: META, applied: false, reason: `patch verification failed: ${e.message}` };
+        return { _meta: tools_META, applied: false, reason: `patch verification failed: ${e.message}` };
       }
       if (!verdict.ok) {
         return {
-          _meta: META, applied: false,
+          _meta: tools_META, applied: false,
           reason: `patch rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
           verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok }, honesty: verdict.honesty || null },
         };
@@ -1214,7 +1305,7 @@ const apply_fix = {
       }
       const materialClassification = (0,material_change/* classifyFixMaterialRisk */.kz)(filesForMaterialClassification);
       if (dry_run) {
-        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, materialClassification };
+        return { _meta: tools_META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, materialClassification };
       }
       if (materialClassification.highImpactCategories.length) {
         const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
@@ -1223,7 +1314,7 @@ const apply_fix = {
           typeof approval.reason === 'string' && approval.reason.trim().length > 0);
         if (!hasApprovalEvidence) {
           return {
-            _meta: META, applied: false,
+            _meta: tools_META, applied: false,
             reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) requires approval evidence — pass fixMeta.approval: {approvedBy, reason} — before it can be applied`,
             materialClassification,
           };
@@ -1233,7 +1324,7 @@ const apply_fix = {
         const identityCheck = (0,approver_registry/* verifyApprover */.$N)(approverRegistry, approval.approvedBy, requiredRoles);
         if (!identityCheck.verified) {
           return {
-            _meta: META, applied: false,
+            _meta: tools_META, applied: false,
             reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${identityCheck.reason}`,
             materialClassification,
           };
@@ -1243,7 +1334,7 @@ const apply_fix = {
         const sodCheck = (0,approver_registry/* checkSeparationOfDuties */.I0)(approverRegistry, fixMeta?.author, approval.approvedBy);
         if (!sodCheck.ok) {
           return {
-            _meta: META, applied: false,
+            _meta: tools_META, applied: false,
             reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${sodCheck.reason}`,
             materialClassification,
           };
@@ -1257,6 +1348,7 @@ const apply_fix = {
           const entry = await (0,fix_history/* applyFix */.oM)({
             scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content, fileExisted,
             findingId: f.id, stableId: f.stableId, ruleId: f.ruleId || f.cwe || f.family || null, vuln: f.vuln || f.title || null,
+            findingProvenance: f.findingProvenance || null,
           });
           written.push({ file: rel, historyId: entry.id, backupPath: entry.backupPath });
         }
@@ -1269,20 +1361,20 @@ const apply_fix = {
           try { await (0,fix_history/* revertEntryById */.rJ)(ctx.sessionRoot, w.historyId); } catch { /* best-effort; original error still propagates below */ }
         }
         if (e && e.name === 'FixAttemptBudgetExceededError') {
-          return { _meta: META, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key };
+          return { _meta: tools_META, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key };
         }
         throw e;
       }
       let acceptance = null;
       try { acceptance = (0,fix_history/* fixAcceptanceRate */.XR)(ctx.sessionRoot); } catch { /* best-effort */ }
-      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance, materialClassification };
+      return { _meta: tools_META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance, materialClassification };
     }
 
     if (typeof f.fix?.replacement !== 'string') {
       // Premortem #2: templates are patch-shaped text. Same reasoning as
       // the replacement path — do NOT pass through redactString here.
       return {
-        _meta: META, applied: false,
+        _meta: tools_META, applied: false,
         reason: 'No full replacement available — only a template. Apply the template manually.',
         template: f.fix?.code || '',
         file: f.file, line: f.line,
@@ -1291,19 +1383,19 @@ const apply_fix = {
     let absFile;
     try { absFile = _confine(ctx.sessionRoot, f.file, 'finding.file'); }
     catch (e) {
-      return { _meta: META, applied: false, reason: `path-escape refused: ${e.message}` };
+      return { _meta: tools_META, applied: false, reason: `path-escape refused: ${e.message}` };
     }
     if (_isReservedWritePath(ctx.sessionRoot, absFile)) {
-      return { _meta: META, applied: false, reason: `reserved path refused: writes to .git/, .agentic-security/, or node_modules/ are not permitted via apply_fix` };
+      return { _meta: tools_META, applied: false, reason: `reserved path refused: writes to .git/, .agentic-security/, or node_modules/ are not permitted via apply_fix` };
     }
     if (!external_node_fs_.existsSync(absFile)) {
-      return { _meta: META, applied: false, reason: `File not found: ${absFile}` };
+      return { _meta: tools_META, applied: false, reason: `File not found: ${absFile}` };
     }
     const originalContent = await promises_.readFile(absFile, 'utf8');
 
     if (dry_run) {
       return {
-        _meta: META,
+        _meta: tools_META,
         applied: false, dryRun: true,
         file: f.file,
         originalSize: originalContent.length,
@@ -1325,7 +1417,7 @@ const apply_fix = {
     // size-diff shape) but the load-bearing addition is the verification
     // gate before the write.
     if (!f.stableId) {
-      return { _meta: META, applied: false, reason: 'finding has no stableId — cannot verify a stored fix against it' };
+      return { _meta: tools_META, applied: false, reason: 'finding has no stableId — cannot verify a stored fix against it' };
     }
     const result = await (0,apply_fix_service/* applyVerifiedFix */.On)({
       scanRoot: ctx.sessionRoot,
@@ -1335,9 +1427,9 @@ const apply_fix = {
     });
     if (!result.ok) {
       if (result.budgetExceeded) {
-        return { _meta: META, applied: false, reason: result.reason, budgetExceeded: true, attempts: result.attempts, maxAttempts: result.maxAttempts, key: result.key };
+        return { _meta: tools_META, applied: false, reason: result.reason, budgetExceeded: true, attempts: result.attempts, maxAttempts: result.maxAttempts, key: result.key };
       }
-      return { _meta: META, applied: false, reason: result.reason, verify: result.verify || null };
+      return { _meta: tools_META, applied: false, reason: result.reason, verify: result.verify || null };
     }
     // R25 (PRD §5): surface the running auto-fix acceptance rate after each
     // applied fix, so the closed loop reports its own success metric.
@@ -1348,7 +1440,7 @@ const apply_fix = {
       // FR-305: verifiedFull distinguishes "every required leg (lint, tests)
       // genuinely ran and passed" from "passed, but a required leg was
       // skipped or unavailable" — verified:true alone conflates them.
-      _meta: META, applied: true, verified: true, verifiedFull: result.verifiedFull,
+      _meta: tools_META, applied: true, verified: true, verifiedFull: result.verifiedFull,
       historyId: entry.historyId, file: entry.file, backupPath: entry.backupPath,
       integrity: status, attemptOrdinal: entry.attemptOrdinal, acceptance,
       verify: result.verify,
@@ -1417,7 +1509,7 @@ const verify_fix = {
       try {
         _confine(ctx.sessionRoot, relPath, 'files key');
       } catch (e) {
-        return { _meta: META, ok: false, reason: `path-escape refused: ${e.message}` };
+        return { _meta: tools_META, ok: false, reason: `path-escape refused: ${e.message}` };
       }
       confined[relPath] = String(content);
     }
@@ -1449,10 +1541,10 @@ const verify_fix = {
         fixMeta,
       });
       return {
-        _meta: META,
+        _meta: tools_META,
         ok: r.ok,
         rescan: { ok: r.rescan.ok, reason: r.rescan.reason, introduced: r.rescan.introduced || [] },
-        lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: redactString(r.lint.output || '').slice(0, 1500) },
+        lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: (0,redact/* redactString */.rd)(r.lint.output || '').slice(0, 1500) },
         // verifyFix computes five legs, not two — tests/honesty/poc were
         // being silently dropped here, leaving an agent with no structured
         // way to see WHY verification failed when the failure was in one
@@ -1463,11 +1555,11 @@ const verify_fix = {
         // it can echo proof-harness detail derived from scanned source.
         tests: r.tests,
         honesty: r.honesty,
-        poc: r.poc ? { ...r.poc, reason: r.poc.reason ? redactString(r.poc.reason) : r.poc.reason } : r.poc,
+        poc: r.poc ? { ...r.poc, reason: r.poc.reason ? (0,redact/* redactString */.rd)(r.poc.reason) : r.poc.reason } : r.poc,
         summary: r.summary,
       };
     } catch (e) {
-      return { _meta: META, ok: false, reason: `verify_fix failed: ${e.message}` };
+      return { _meta: tools_META, ok: false, reason: `verify_fix failed: ${e.message}` };
     }
   },
 };
@@ -1490,11 +1582,11 @@ const synthesize_fix = {
   async handler({ finding_id }, ctx) {
     const { scan, status } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: false });
     if (!scan) {
-      return { _meta: META, ok: false, reason: `last-scan.json failed integrity check: ${status}` };
+      return { _meta: tools_META, ok: false, reason: `last-scan.json failed integrity check: ${status}` };
     }
     const f = _findById(scan, finding_id);
-    if (!f) return { _meta: META, ok: false, reason: `Finding not found: ${finding_id}` };
-    if (f._shadow === true) return { _meta: META, ok: false, reason: 'shadow findings have no synthesized fix' };
+    if (!f) return { _meta: tools_META, ok: false, reason: `Finding not found: ${finding_id}` };
+    if (f._shadow === true) return { _meta: tools_META, ok: false, reason: 'shadow findings have no synthesized fix' };
     const fix = f.fix || {};
     const hasReplacement = typeof fix.replacement === 'string' && fix.replacement.length > 0;
     // Patch bounds: count files touched + LoC delta.
@@ -1530,7 +1622,7 @@ const synthesize_fix = {
     // verbatim. Snippet/description/etc. continue to be redacted in
     // explain_finding / scan_diff — that's the right surface for redaction.
     return {
-      _meta: META,
+      _meta: tools_META,
       ok: true,
       stable_id: f.stableId || null,
       file: f.file, line: f.line,
@@ -1580,14 +1672,14 @@ const find_rule_module = {
   },
   async handler({ cwe, family }, ctx) {
     if (!cwe && !family) {
-      return { _meta: META, ok: false, reason: 'provide cwe (e.g. "CWE-89") or family (e.g. "sql-injection")' };
+      return { _meta: tools_META, ok: false, reason: 'provide cwe (e.g. "CWE-89") or family (e.g. "sql-injection")' };
     }
     // Pattern enforcement — the mini-schema validator doesn't do `pattern`.
     if (cwe && !/^CWE-\d+$/.test(cwe)) {
-      return { _meta: META, ok: false, reason: 'cwe must match /^CWE-\\d+$/ (e.g. "CWE-89")' };
+      return { _meta: tools_META, ok: false, reason: 'cwe must match /^CWE-\\d+$/ (e.g. "CWE-89")' };
     }
     if (family && !/^[a-z][a-z0-9-]+$/.test(family)) {
-      return { _meta: META, ok: false, reason: 'family must match /^[a-z][a-z0-9-]+$/ (e.g. "sql-injection")' };
+      return { _meta: tools_META, ok: false, reason: 'family must match /^[a-z][a-z0-9-]+$/ (e.g. "sql-injection")' };
     }
     const sessionRoot = ctx.sessionRoot;
     const roots = [
@@ -1641,7 +1733,7 @@ const find_rule_module = {
       if (hits.length >= 20) break;
     }
     return {
-      _meta: META,
+      _meta: tools_META,
       ok: true,
       query: { cwe: cwe || null, family: family || null },
       hitCount: hits.length,
@@ -1684,14 +1776,14 @@ const append_scratchpad = {
   },
   async handler({ path: relPath, content }, ctx) {
     const v = _validateScratchpadPath(relPath);
-    if (!v.ok) return { _meta: META, ok: false, reason: v.reason };
+    if (!v.ok) return { _meta: tools_META, ok: false, reason: v.reason };
     let abs;
     try { abs = _scratchpadAbs(ctx.sessionRoot, relPath); }
-    catch (e) { return { _meta: META, ok: false, reason: `path-escape refused: ${e.message}` }; }
+    catch (e) { return { _meta: tools_META, ok: false, reason: `path-escape refused: ${e.message}` }; }
     const total = _scratchpadTotalBytes(ctx.sessionRoot);
     if (total + content.length > SCRATCHPAD_MAX_TOTAL_BYTES) {
       return {
-        _meta: META, ok: false,
+        _meta: tools_META, ok: false,
         reason: `scratchpad-total-exceeded: ${total} + ${content.length} > ${SCRATCHPAD_MAX_TOTAL_BYTES}. Clean up via "rm -rf .agentic-security/agent-scratchpad" or rotate sessions.`,
       };
     }
@@ -1699,7 +1791,7 @@ const append_scratchpad = {
     try { if (external_node_fs_.existsSync(abs)) existing = external_node_fs_.statSync(abs).size; } catch {}
     if (existing + content.length > SCRATCHPAD_MAX_FILE_BYTES) {
       return {
-        _meta: META, ok: false,
+        _meta: tools_META, ok: false,
         reason: `scratchpad-file-exceeded: ${existing} + ${content.length} > ${SCRATCHPAD_MAX_FILE_BYTES}. Start a new file.`,
       };
     }
@@ -1707,12 +1799,12 @@ const append_scratchpad = {
       external_node_fs_.mkdirSync(external_node_path_.dirname(abs), { recursive: true });
       external_node_fs_.appendFileSync(abs, content);
       return {
-        _meta: META, ok: true,
+        _meta: tools_META, ok: true,
         path: relPath, bytesWritten: content.length, fileSize: existing + content.length,
         scratchpadTotal: total + content.length,
       };
     } catch (e) {
-      return { _meta: META, ok: false, reason: `write-failed: ${e.message}` };
+      return { _meta: tools_META, ok: false, reason: `write-failed: ${e.message}` };
     }
   },
 };
@@ -1732,14 +1824,14 @@ const read_scratchpad = {
   },
   async handler({ path: relPath, offset, limit }, ctx) {
     const v = _validateScratchpadPath(relPath);
-    if (!v.ok) return { _meta: META, ok: false, reason: v.reason };
+    if (!v.ok) return { _meta: tools_META, ok: false, reason: v.reason };
     let abs;
     try { abs = _scratchpadAbs(ctx.sessionRoot, relPath); }
-    catch (e) { return { _meta: META, ok: false, reason: `path-escape refused: ${e.message}` }; }
-    if (!external_node_fs_.existsSync(abs)) return { _meta: META, ok: false, reason: 'not-found' };
+    catch (e) { return { _meta: tools_META, ok: false, reason: `path-escape refused: ${e.message}` }; }
+    if (!external_node_fs_.existsSync(abs)) return { _meta: tools_META, ok: false, reason: 'not-found' };
     let stat;
-    try { stat = external_node_fs_.statSync(abs); } catch (e) { return { _meta: META, ok: false, reason: `stat-failed: ${e.message}` }; }
-    if (!stat.isFile()) return { _meta: META, ok: false, reason: 'not-a-file' };
+    try { stat = external_node_fs_.statSync(abs); } catch (e) { return { _meta: tools_META, ok: false, reason: `stat-failed: ${e.message}` }; }
+    if (!stat.isFile()) return { _meta: tools_META, ok: false, reason: 'not-a-file' };
     const off = Number.isInteger(offset) ? Math.max(0, offset) : 0;
     const lim = Number.isInteger(limit) ? Math.min(64 * 1024, Math.max(1, limit)) : 4096;
     let buf;
@@ -1749,10 +1841,10 @@ const read_scratchpad = {
       const read = external_node_fs_.readSync(fd, tmp, 0, lim, off);
       external_node_fs_.closeSync(fd);
       buf = tmp.slice(0, read);
-    } catch (e) { return { _meta: META, ok: false, reason: `read-failed: ${e.message}` }; }
+    } catch (e) { return { _meta: tools_META, ok: false, reason: `read-failed: ${e.message}` }; }
     const text = buf.toString('utf8');
     return {
-      _meta: META, ok: true,
+      _meta: tools_META, ok: true,
       path: relPath,
       offset: off, limit: lim, bytesRead: buf.length,
       totalSize: stat.size,
@@ -1784,7 +1876,7 @@ const append_agents_memory = {
   },
   async handler({ agent, body }, ctx) {
     const r = appendAgentsMemory(ctx.sessionRoot, { agent, body });
-    return { _meta: META, ...r };
+    return { _meta: tools_META, ...r };
   },
 };
 
@@ -1800,16 +1892,16 @@ const read_agents_memory = {
   },
   async handler({ full }, ctx) {
     const body = readAgentsMemory(ctx.sessionRoot);
-    if (!body) return { _meta: META, present: false };
-    if (full) return { _meta: META, present: true, length: body.length, content: body };
+    if (!body) return { _meta: tools_META, present: false };
+    if (full) return { _meta: tools_META, present: true, length: body.length, content: body };
     // Tail-only — same logic as summarizeForSession but inlined to avoid a
     // second import surface.
     const limit = 6 * 1024;
-    if (body.length <= limit) return { _meta: META, present: true, length: body.length, content: body };
+    if (body.length <= limit) return { _meta: tools_META, present: true, length: body.length, content: body };
     const tail = body.slice(-limit);
     const firstSection = tail.indexOf('\n## ');
     const slice = firstSection >= 0 ? tail.slice(firstSection) : tail;
-    return { _meta: META, present: true, length: body.length, truncated: true, content: slice };
+    return { _meta: tools_META, present: true, length: body.length, truncated: true, content: slice };
   },
 };
 
@@ -1843,10 +1935,10 @@ const query_triage_memory = {
     // they landed in, rather than hardcoding a field allowlist that could
     // miss one.
     let results;
-    try { results = JSON.parse(redactString(JSON.stringify(raw))); }
+    try { results = JSON.parse((0,redact/* redactString */.rd)(JSON.stringify(raw))); }
     catch { results = raw; }
     return {
-      _meta: META,
+      _meta: tools_META,
       count: results.length,
       results,
     };
@@ -1871,7 +1963,7 @@ const query_findings_memory = {
     required: ['query'],
   },
   async handler({ query }, ctx) {
-    const { queryFindingsMemory } = await __webpack_require__.e(/* import() */ 839).then(__webpack_require__.bind(__webpack_require__, 3839));
+    const { queryFindingsMemory } = await __webpack_require__.e(/* import() */ 3839).then(__webpack_require__.bind(__webpack_require__, 3839));
     const raw = queryFindingsMemory(ctx.sessionRoot, query || '');
     // Stage 6 correctness audit — same redaction gap and same fix as
     // query_triage_memory just above: this mixes four differently-shaped
@@ -1879,9 +1971,9 @@ const query_findings_memory = {
     // whole-structure redactString round-trip is applied rather than a
     // per-field allowlist that could miss one of the four shapes.
     let body;
-    try { body = JSON.parse(redactString(JSON.stringify(raw))); }
+    try { body = JSON.parse((0,redact/* redactString */.rd)(JSON.stringify(raw))); }
     catch { body = raw; }
-    return { _meta: META, ...body };
+    return { _meta: tools_META, ...body };
   },
 };
 
@@ -1902,7 +1994,7 @@ const lookup_cve = {
   },
   async handler({ cve }, _ctx) {
     const r = lookupCve(cve);
-    return { _meta: META, ...r };
+    return { _meta: tools_META, ...r };
   },
 };
 
@@ -1920,9 +2012,9 @@ const query_cache_telemetry = {
   },
   async handler({ transcript_path } = {}, ctx) {
     const result = (0,cache_economics.analyzeTranscript)({ transcriptPath: transcript_path, projectDir: ctx?.sessionRoot || process.cwd() });
-    if (!result.ok) return { _meta: META, ok: false, reason: result.reason };
+    if (!result.ok) return { _meta: tools_META, ok: false, reason: result.reason };
     return {
-      _meta: META,
+      _meta: tools_META,
       ok: true,
       metrics: result.metrics,
       leaks: result.leaks,
@@ -1938,7 +2030,7 @@ const query_cache_telemetry = {
 // ecosystem's native --dry-run command. Safe to call any number of times.
 let _scaUpgrade;
 async function _getScaUpgrade() {
-  if (!_scaUpgrade) _scaUpgrade = await __webpack_require__.e(/* import() */ 333).then(__webpack_require__.bind(__webpack_require__, 5333));
+  if (!_scaUpgrade) _scaUpgrade = await __webpack_require__.e(/* import() */ 5333).then(__webpack_require__.bind(__webpack_require__, 5333));
   return _scaUpgrade;
 }
 const synthesize_sca_upgrade = {
@@ -1958,11 +2050,11 @@ const synthesize_sca_upgrade = {
     const f = _findById(scan, finding_id);
     if (!f) throw new Error(`Finding not found: ${finding_id}`);
     if (f.type !== 'vulnerable_dep') {
-      return { _meta: META, ok: false, reason: 'finding is not an SCA vulnerable_dep — use synthesize_fix for SAST findings' };
+      return { _meta: tools_META, ok: false, reason: 'finding is not an SCA vulnerable_dep — use synthesize_fix for SAST findings' };
     }
     const { planScaUpgrade } = await _getScaUpgrade();
     const plan = await planScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f });
-    return { _meta: META, ...plan };
+    return { _meta: tools_META, ...plan };
   },
 };
 
@@ -1989,24 +2081,24 @@ const apply_sca_upgrade = {
   },
   async handler({ finding_id, confirm, run_tests = true }, ctx) {
     if (confirm !== true) {
-      return { _meta: META, applied: false, reason: 'apply_sca_upgrade requires confirm: true.' };
+      return { _meta: tools_META, applied: false, reason: 'apply_sca_upgrade requires confirm: true.' };
     }
     const { scan, status } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: false });
     if (!scan) {
-      return { _meta: META, applied: false, reason: `last-scan.json failed integrity check: ${status}. Run a fresh scan.` };
+      return { _meta: tools_META, applied: false, reason: `last-scan.json failed integrity check: ${status}. Run a fresh scan.` };
     }
     const f = _findById(scan, finding_id);
-    if (!f) return { _meta: META, applied: false, reason: `Finding not found: ${finding_id}` };
+    if (!f) return { _meta: tools_META, applied: false, reason: `Finding not found: ${finding_id}` };
     if (f.type !== 'vulnerable_dep') {
-      return { _meta: META, applied: false, reason: 'finding is not an SCA vulnerable_dep — use apply_fix for SAST findings' };
+      return { _meta: tools_META, applied: false, reason: 'finding is not an SCA vulnerable_dep — use apply_fix for SAST findings' };
     }
     const { applyScaUpgrade } = await _getScaUpgrade();
     const result = await applyScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f, runTests: run_tests });
-    return { _meta: META, ...result };
+    return { _meta: tools_META, ...result };
   },
 };
 
-const ALL_TOOLS = [scan_diff, query_taint, explain_finding, apply_fix, verify_fix, synthesize_fix, find_rule_module, append_scratchpad, read_scratchpad, append_agents_memory, read_agents_memory, lookup_cve, synthesize_sca_upgrade, apply_sca_upgrade, query_triage_memory, query_findings_memory, query_cache_telemetry];
+const ALL_TOOLS = [scan_diff, query_taint, explain_finding, apply_fix, verify_fix, synthesize_fix, find_rule_module, append_scratchpad, read_scratchpad, append_agents_memory, read_agents_memory, lookup_cve, synthesize_sca_upgrade, apply_sca_upgrade, query_triage_memory, query_findings_memory, query_cache_telemetry, dataflow_get_graph, dataflow_get_node, dataflow_get_edge, dataflow_get_flow];
 
 ;// CONCATENATED MODULE: ./src/mcp/validate.js
 // Minimal JSON Schema validator — just the subset our tool schemas use.
@@ -2104,7 +2196,7 @@ const SESSION_ID = `${process.pid}-${Date.now().toString(36).slice(-6)}`;
 function _summarize(args) {
   let s;
   try { s = JSON.stringify(args); } catch { s = '<unserializable>'; }
-  s = redactArgsBlob(s);
+  s = (0,redact/* redactArgsBlob */.MC)(s);
   if (s.length > MAX_ARG_BYTES) s = s.slice(0, MAX_ARG_BYTES) + `…(+${s.length - MAX_ARG_BYTES})`;
   return s;
 }
@@ -2249,7 +2341,7 @@ const TOOLS_BY_NAME = Object.fromEntries(ALL_TOOLS.map(t => [t.name, t]));
 function _codeFingerprint() {
   try {
     const here = external_node_path_.dirname((0,external_node_url_.fileURLToPath)(import.meta.url));
-    const files = ['server.js', 'tools.js', 'stdio.js', 'audit.js', 'validate.js', 'redact.js'];
+    const files = ['server.js', 'tools.js', 'dataflow-tools.js', 'stdio.js', 'audit.js', 'validate.js', 'redact.js'];
     const h = external_node_crypto_.createHash('sha256');
     for (const f of files) {
       try { h.update(f); h.update(external_node_fs_.readFileSync(external_node_path_.join(here, f))); } catch {}
@@ -2737,6 +2829,307 @@ const _internal = {
 };
 
 
+/***/ }),
+
+/***/ 8218:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   loadFreshLineageGraph: () => (/* binding */ loadFreshLineageGraph),
+/* harmony export */   loadSignedGraph: () => (/* binding */ loadSignedGraph)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1174);
+/* harmony import */ var _posture_integrity_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1130);
+// graph-loader.js — Milestone 3, sub-project Server, increment 1.
+//
+// Reads and VERIFIES the `.agentic-security/lineage-graph.json` artifact
+// before `explore` is allowed to serve a single byte of it. Reuses
+// `posture/integrity.js`'s `verifyLastScan` DIRECTLY (per the plan and the
+// root CLAUDE.md's own instruction) — this module does not implement any
+// signature comparison of its own. `verifyLastScan` already uses
+// `crypto.timingSafeEqual` internally.
+//
+// Loaded ONCE at server startup (see bin/agentic-security.js's cmdExplore)
+// and held in memory for the life of the process — this is a read-only,
+// single-scan-snapshot server; a change to the graph on disk mid-session is
+// out of scope for this increment (threat-model doc's own "P0 is
+// read-only" framing).
+
+
+
+
+
+/**
+ * @param {string} scanRoot
+ * @returns {{ok:true, graph:object} | {ok:false, reason:'missing'|'unsigned'|'tampered'|'malformed', message:string}}
+ *
+ * Four, and only four, distinct failure reasons — each with its own clear
+ * message so an operator knows exactly what to do next:
+ *   - 'missing'  — no lineage-graph.json at all. Run a scan with
+ *                  AGENTIC_SECURITY_LINEAGE_DEEP=1 first.
+ *   - 'unsigned' — the graph exists but its .sig sibling does not
+ *                  (verifyLastScan returns null). Refuse to serve an
+ *                  unverifiable graph.
+ *   - 'tampered' — the graph exists and has a .sig, but the signature does
+ *                  not match the body (verifyLastScan returns false). The
+ *                  file was modified after signing, or signed under a
+ *                  different install key.
+ *   - 'malformed' — the body passed signature verification but is not
+ *                  valid JSON. Should not happen from a normal scan; the
+ *                  file may be corrupted on disk after signing.
+ */
+function loadSignedGraph(scanRoot) {
+  const graphPath = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, 'lineage-graph.json');
+  const sigPath = graphPath + '.sig';
+
+  if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(graphPath)) {
+    return {
+      ok: false,
+      reason: 'missing',
+      message: `No lineage graph found at ${graphPath}. Run a scan with AGENTIC_SECURITY_LINEAGE_DEEP=1 first (e.g. \`AGENTIC_SECURITY_LINEAGE_DEEP=1 agentic-security scan\`), then re-run \`agentic-security explore\`.`,
+    };
+  }
+
+  let body;
+  try {
+    body = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(graphPath, 'utf8');
+  } catch (e) {
+    return {
+      ok: false,
+      reason: 'missing',
+      message: `Lineage graph found at ${graphPath} but could not be read: ${e && e.message ? e.message : e}.`,
+    };
+  }
+
+  const verified = (0,_posture_integrity_js__WEBPACK_IMPORTED_MODULE_2__/* .verifyLastScan */ .Ef)(body, sigPath);
+  if (verified === null) {
+    return {
+      ok: false,
+      reason: 'unsigned',
+      message: `Lineage graph at ${graphPath} has no signature file (${sigPath} is missing). Refusing to serve an unverifiable graph. Re-run the scan (AGENTIC_SECURITY_LINEAGE_DEEP=1) to regenerate both files together.`,
+    };
+  }
+  if (verified === false) {
+    return {
+      ok: false,
+      reason: 'tampered',
+      message: `Lineage graph at ${graphPath} FAILED signature verification — its contents do not match ${sigPath}. The file may have been modified after the scan, or signed under a different install key. Refusing to serve a tampered graph. Re-run the scan to regenerate it.`,
+    };
+  }
+
+  let graph;
+  try {
+    graph = JSON.parse(body);
+  } catch (e) {
+    return {
+      ok: false,
+      reason: 'malformed',
+      message: `Lineage graph at ${graphPath} passed signature verification but is not valid JSON (${e && e.message ? e.message : e}). This should not happen from a normal scan — the file may be corrupted. Re-run the scan to regenerate it.`,
+    };
+  }
+
+  return { ok: true, graph };
+}
+
+/**
+ * Load .agentic-security/lineage-graph.json ONLY when it is genuinely
+ * fresh for THIS scan — never merely because a file happens to exist on
+ * disk. Shared by every caller that signs or narrates a graph:-derived
+ * compliance claim (M4 sub-project 6c's final whole-branch review found
+ * the identical staleness gap independently reachable from
+ * `attest --obligations` AND `compliance --walkthrough`, and required
+ * this predicate to live in exactly one place rather than being
+ * copy-pasted per caller — a safety check that drifts between two
+ * near-identical inline copies is worse than one shared bug).
+ *
+ * `.agentic-security/lineage-graph.json` is only rewritten when a scan
+ * actually finishes building a graph (`if (scan.lineageGraph)` in
+ * bin/agentic-security.js's persistence code) — an ordinary non-deep
+ * rescan, or a deep scan whose lineage build fails, leaves whatever file
+ * was there from an earlier successful deep scan untouched. Loading that
+ * stale graph and joining it to the CURRENT scan's other data would let a
+ * caller assert a graph-derived fact (e.g. "transit protected") about
+ * code that has since changed.
+ *
+ * `enabled: true` in `scan.scanHealth.lineageAnalysis` does NOT by itself
+ * mean the build succeeded — engine.js sets it the moment
+ * AGENTIC_SECURITY_LINEAGE_DEEP=1 is read, before the build even starts,
+ * and leaves it `true` even when the build later throws (only `failure`
+ * gets set in that case). `requested && enabled` alone therefore still
+ * accepts a stale graph after a failed rebuild — reproduced live via the
+ * scan's own already-shipped fault-injection fixture
+ * (test/lineage-fault-injection.test.js) before this `failure === null`
+ * check was added.
+ *
+ * @param {string} scanRoot
+ * @param {object} scan - the parsed last-scan.json for the CURRENT scan
+ * @returns {{graph:object|null, fresh:boolean, loaded:ReturnType<typeof loadSignedGraph>}}
+ *   `fresh` is true only when a signed graph loaded successfully AND this
+ *   scan's own scanHealth confirms lineage analysis was requested,
+ *   enabled, and did not fail. `graph` is `loaded.graph` when fresh, else
+ *   `null` — never the stale file, even when one exists on disk.
+ *   `loaded` is the raw `loadSignedGraph` result, so a caller can still
+ *   distinguish "no file at all" from "a file exists but isn't fresh" for
+ *   its own disclosure message.
+ */
+function loadFreshLineageGraph(scanRoot, scan) {
+  const la = scan?.scanHealth?.lineageAnalysis;
+  const requested = la?.requested === true;
+  const enabled = la?.enabled === true;
+  const failure = la?.failure ?? null;
+  const loaded = loadSignedGraph(scanRoot);
+  const fresh = loaded.ok && requested && enabled && failure === null;
+  return { graph: fresh ? loaded.graph : null, fresh, loaded };
+}
+
+
+/***/ }),
+
+/***/ 4268:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   Yo: () => (/* binding */ handleScan),
+/* harmony export */   Yu: () => (/* binding */ handleEdge),
+/* harmony export */   d5: () => (/* binding */ handleNode),
+/* harmony export */   fn: () => (/* binding */ handleGraph),
+/* harmony export */   jg: () => (/* binding */ handleFlow),
+/* harmony export */   rR: () => (/* binding */ handleQuery)
+/* harmony export */ });
+/* unused harmony export wrapResponse */
+/* harmony import */ var _lineage_export_json_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(859);
+// routes.js — Milestone 3, sub-project Server, increment 1.
+//
+// Five pure GET-endpoint handlers, each `(graph, ...) -> {status, body}`.
+// No req/res access anywhere in this file — that is what makes these
+// handlers unit-testable without an HTTP layer at all. http-server.js is
+// the only module that touches node:http and calls into these.
+//
+// Every response body is wrapped in `wrapResponse`, which adds the exact
+// envelope fields PRD line 1326 names (quoted in the implementation plan):
+// "base graph/snapshot digest, schema/extension versions, scope, coverage,
+// limitations, and contributing canonical IDs."
+
+
+
+/**
+ * Shared response envelope. Maps PRD line 1326's required fields onto the
+ * graph's own real fields:
+ *   - digest              -> graph.graphId (the base graph/snapshot digest)
+ *   - schemaVersion        -> graph.schemaVersion
+ *   - extensions           -> graph.extensions (schema/extension versions —
+ *                             today always `{}`; see schema.js)
+ *   - scope                -> graph.scope
+ *   - coverage              -> graph.coverage
+ *   - limitations           -> graph.limitations
+ *   - canonicalIds          -> see the design note below
+ *
+ * "contributing canonical IDs" design decision (disclosed per the plan):
+ * for `handleScan`/`handleGraph`, which describe the WHOLE graph rather
+ * than one entity, `canonicalIds` is `null` — the response body for
+ * `handleGraph` already IS the full nodes/edges/flows arrays, so echoing
+ * every id again here would be pure duplication with no informational
+ * gain, and for a large graph would materially bloat the response for
+ * zero benefit. For `handleNode`/`handleEdge`, `canonicalIds` is the
+ * single id the response is about. For `handleFlow`, `canonicalIds` is
+ * the flow's own id PLUS the node/edge ids that flow's evidence draws
+ * from (source, sink, edgeIds) — a flow is a derived record referencing
+ * several underlying entities, and naming all of them here is genuinely
+ * useful metadata a client would otherwise have to re-derive from the
+ * flow body itself.
+ */
+function wrapResponse(data, graph, { canonicalIds = null } = {}) {
+  return {
+    digest: graph?.graphId ?? null,
+    schemaVersion: graph?.schemaVersion ?? null,
+    extensions: graph?.extensions ?? {},
+    scope: graph?.scope ?? null,
+    coverage: graph?.coverage ?? null,
+    limitations: graph?.limitations ?? [],
+    canonicalIds,
+    data,
+  };
+}
+
+function _findById(list, id) {
+  if (!Array.isArray(list)) return null;
+  return list.find((item) => item && item.id === id) ?? null;
+}
+
+/** Scan/graph metadata — NOT the full node/edge arrays. */
+function handleScan(graph) {
+  const data = {
+    schemaVersion: graph?.schemaVersion ?? null,
+    graphId: graph?.graphId ?? null,
+    generatedAt: graph?.generatedAt ?? null,
+    scope: graph?.scope ?? null,
+    scanHealth: graph?.scanHealth ?? null,
+    coverage: graph?.coverage ?? null,
+  };
+  return { status: 200, body: wrapResponse(data, graph, { canonicalIds: null }) };
+}
+
+/** The full graph document, unfiltered. For a scoped/narrowed projection, use `handleQuery` (`POST /api/v1/query`, Milestone 5) below instead. */
+function handleGraph(graph) {
+  return { status: 200, body: wrapResponse(graph, graph, { canonicalIds: null }) };
+}
+
+/**
+ * A deterministic typed projection query — Milestone 5's own
+ * `POST /api/v1/query`, the S2 endpoint `handleGraph`'s own header
+ * comment named and deferred. `filter` is the exact `{nodeIds, edgeIds}`
+ * shape `dataflow export --filter`/`exportGraphJSON` already use — reused
+ * via `_filterGraph`, never reimplemented. Final whole-branch review
+ * finding: `undefined` (filter omitted entirely) returns the WHOLE graph,
+ * identical to `handleGraph` — but `{}` (an empty, well-formed filter
+ * object) is NOT the same thing, and does NOT mean "no restriction": both
+ * `nodeIds`/`edgeIds` default to empty Sets inside `_filterGraph`, so `{}`
+ * narrows the graph down to EMPTY node/edge/flow/dataElement arrays. A
+ * caller that wants the whole graph must omit `filter` entirely, never
+ * pass `{}` meaning "everything." A malformed filter is a 400, never a
+ * thrown exception reaching the caller.
+ */
+function handleQuery(graph, filter) {
+  const check = (0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_0__.validateFilterShape)(filter);
+  if (!check.valid) {
+    return { status: 400, body: { error: check.error } };
+  }
+  return { status: 200, body: wrapResponse((0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_0__/* ._filterGraph */ .e)(graph, filter), graph, { canonicalIds: null }) };
+}
+
+/** Look up one node by id. 404 with a clear body if not found. */
+function handleNode(graph, id) {
+  const node = _findById(graph?.nodes, id);
+  if (!node) {
+    return { status: 404, body: wrapResponse({ error: `node not found: ${id}` }, graph, { canonicalIds: [] }) };
+  }
+  return { status: 200, body: wrapResponse(node, graph, { canonicalIds: [id] }) };
+}
+
+/** Look up one edge by id. 404 with a clear body if not found. */
+function handleEdge(graph, id) {
+  const edge = _findById(graph?.edges, id);
+  if (!edge) {
+    return { status: 404, body: wrapResponse({ error: `edge not found: ${id}` }, graph, { canonicalIds: [] }) };
+  }
+  return { status: 200, body: wrapResponse(edge, graph, { canonicalIds: [id] }) };
+}
+
+/** Look up one flow by id. 404 with a clear body if not found. */
+function handleFlow(graph, id) {
+  const flow = _findById(graph?.flows, id);
+  if (!flow) {
+    return { status: 404, body: wrapResponse({ error: `flow not found: ${id}` }, graph, { canonicalIds: [] }) };
+  }
+  const contributing = new Set([id]);
+  if (flow.source) contributing.add(flow.source);
+  if (flow.sink) contributing.add(flow.sink);
+  for (const eid of (flow.edgeIds || [])) contributing.add(eid);
+  return { status: 200, body: wrapResponse(flow, graph, { canonicalIds: [...contributing] }) };
+}
+
+
 /***/ })
 
 };