@clear-capabilities/agentic-security-scanner 0.147.0 → 0.147.5

package/dist/frontend/styles/tokens.css

@@ -0,0 +1,128 @@
+/*
+ * Data Flow Explorer design tokens (PRD §8.1). Dark is the reference theme.
+ * Values are copied verbatim from the PRD — do not adjust without a
+ * deliberate, separately-reviewed change.
+ */
+
+:root {
+  /* Surfaces */
+  --surface-canvas: #061625;
+  --surface-panel: #0B1E2F;
+  --surface-elevated: #102A40;
+  --border-default: #28445A;
+
+  /* Text */
+  --text-primary: #F3F7FA;
+  --text-secondary: #9FB3C5;
+
+  /* Selection / focus */
+  --accent-selection: #3DA9FF;
+
+  /* Protection verdict status */
+  --status-protected: #59D17D;
+  --status-unprotected: #FF625C;
+  --status-unknown: #F5B83D;
+
+  /* Text color for content painted directly on a status token background
+     (e.g. the coverage banner). NOT the same as --text-primary, which is
+     sized against --surface-canvas/--surface-panel, not against a status
+     color. Verified with lib/contrast.js's contrastRatio(): #061625 on
+     dark --status-unknown (#F5B83D) is 10.27:1. See the light-theme block
+     below for the light-theme value and its own verified ratio. */
+  --status-banner-text: #061625;
+
+  /* AI processing context */
+  --context-ai: #B47AFF;
+
+  /* Data class overlays */
+  --class-pii: #28D1C5;
+  --class-phi: #A97BFF;
+  --class-pci: #4CA7FF;
+
+  /* Spacing (8px grid, PRD §7.7) */
+  --space-1: 8px;
+  --space-2: 16px;
+  --space-3: 24px;
+  --space-4: 32px;
+
+  /* Radius / border (PRD §8.2) */
+  --radius-default: 8px;
+  --border-width: 1px;
+
+  /* Typography (PRD §8.2) — bundled system stack; never a remote/CDN font */
+  --font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+  --font-mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  --font-size-view-title: 23px;
+  --font-size-panel-title: 15px;
+  --font-size-node-title: 14px;
+  --font-size-body: 13px;
+  --font-size-code: 12.5px;
+
+  /* Motion (PRD §8.2 — focus/topology change only, no ambient animation) */
+  --motion-duration: 200ms;
+  --motion-duration-reduced: 0ms;
+
+  /* Shell region sizing (PRD §7.7) */
+  --header-height: 56px;
+  --view-tabs-height: 44px;
+  --left-rail-width: 248px;
+  --left-rail-collapsed-width: 56px;
+  --right-inspector-width: 360px;
+  --context-rail-height: 72px;
+}
+
+/* Light theme — same semantic tokens, WCAG-AA-equivalent contrast (PRD §8.1/§23) */
+:root[data-theme="light"] {
+  --surface-canvas: #FFFFFF;
+  --surface-panel: #F4F7FA;
+  --surface-elevated: #E7EEF3;
+  --border-default: #C7D3DC;
+
+  --text-primary: #0B1E2F;
+  --text-secondary: #3E5568;
+
+  --accent-selection: #1B6FC2;
+
+  /* status-protected and status-unknown darkened slightly from their
+     original values (#1E8A4C, #9A6B00) — Milestone 3, sub-project A11y,
+     found via test/tokens-contrast.test.js that both originals failed
+     WCAG AA (4.5:1) against --surface-panel (#F4F7FA): 4.07:1 and 4.36:1
+     respectively. Verified with lib/contrast.js's contrastRatio() against
+     BOTH backgrounds a status color plausibly renders on: --status-
+     protected (#1C8047) is 4.97:1 on --surface-canvas / 4.62:1 on
+     --surface-panel; --status-unknown (#956700) is 4.98:1 / 4.63:1. Both
+     now clear AA with margin (>=4.6) rather than sitting at the exact
+     4.50 boundary, which is fragile against hex-rounding. --status-
+     unprotected was already compliant (5.26:1 / 4.89:1), unchanged. */
+  --status-protected: #1C8047;
+  --status-unprotected: #C7362D;
+  --status-unknown: #956700;
+
+  /* Verified with lib/contrast.js's contrastRatio(): #FFFFFF on light
+     --status-unknown (#956700) is 4.98:1 (>= 4.5:1 AA). The dark-block
+     value (#061625, --surface-canvas's own dark value) is 3.90:1 here --
+     below AA -- which is the bug this token pair fixes: shell.css must
+     never hardcode dark theme's value and expect it to also work in
+     light theme. */
+  --status-banner-text: #FFFFFF;
+
+  --context-ai: #6E38B8;
+
+  --class-pii: #0E7C73;
+  --class-phi: #6E44B8;
+  --class-pci: #1C63A8;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  :root {
+    --motion-duration: var(--motion-duration-reduced);
+  }
+}
+
+body {
+  background: var(--surface-canvas);
+  color: var(--text-primary);
+  font-family: var(--font-family);
+  font-size: var(--font-size-body);
+  margin: 0;
+}

package/dist/frontend/styles/trace-view.css

@@ -0,0 +1,95 @@
+.trace-view {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-2);
+  max-width: 640px;
+}
+
+.trace-step {
+  display: flex;
+  gap: var(--space-2);
+  padding: var(--space-2);
+  background: var(--surface-panel);
+  border: var(--border-width) solid var(--border-default);
+  border-radius: var(--radius-default);
+}
+
+.trace-step-number {
+  flex: 0 0 auto;
+  width: 24px;
+  height: 24px;
+  border-radius: 50%;
+  background: var(--surface-elevated);
+  color: var(--text-primary);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: var(--font-size-code);
+  font-weight: 600;
+}
+
+.trace-step-body {
+  flex: 1 1 auto;
+}
+
+.trace-step-kind {
+  color: var(--text-secondary);
+  font-size: var(--font-size-code);
+  text-transform: uppercase;
+}
+
+.trace-step-mapping {
+  font-family: var(--font-mono);
+  font-size: var(--font-size-code);
+  color: var(--text-primary);
+  margin: 4px 0;
+}
+
+.trace-step-node {
+  color: var(--text-secondary);
+  font-size: var(--font-size-body);
+}
+
+.trace-step-boundary {
+  display: inline-block;
+  border: 1px solid var(--status-unprotected);
+  color: var(--status-unprotected);
+  border-radius: var(--radius-default);
+  padding: 1px 6px;
+  font-size: var(--font-size-code);
+  margin-top: 4px;
+}
+
+.trace-branch-group {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-2);
+  padding-left: var(--space-2);
+  border-left: 2px solid var(--accent-selection);
+}
+
+.trace-branch-label {
+  color: var(--text-secondary);
+  font-size: var(--font-size-code);
+  text-transform: uppercase;
+}
+
+.trace-alternates {
+  margin-top: var(--space-2);
+}
+
+.trace-alternate-item {
+  padding: var(--space-1) 0;
+  cursor: pointer;
+  color: var(--text-secondary);
+}
+
+.trace-alternate-item:hover {
+  color: var(--text-primary);
+}
+
+.trace-empty {
+  color: var(--text-secondary);
+  font-style: italic;
+  padding: var(--space-2);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.147.0",
+  "version": "0.147.5",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -56,7 +56,7 @@
     "lodash-es": "^4.18.1"
   },
   "scripts": {
-    "build": "ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && rm -rf dist/compliance-frameworks && mkdir -p dist/compliance-frameworks && cp src/posture/compliance-frameworks/*.json dist/compliance-frameworks/ && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
+    "build": "ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && rm -rf dist/compliance-frameworks && mkdir -p dist/compliance-frameworks && cp src/posture/compliance-frameworks/*.json dist/compliance-frameworks/ && node scripts/copy-frontend.mjs && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
     "prepare": "node ../scripts/pre-push-gate.mjs --install-hook",
     "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs && node ../scripts/release-check.mjs",
     "test": "node ../scripts/run-unit-tests.mjs && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",

package/src/server/static-assets.js

@@ -14,14 +14,19 @@
 
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { resolveFrontendRoot } from '../shared/frontend-root.js';
 
-// Located the SAME way scanner/src/mcp/server.js locates files relative to
-// its own module (path.dirname(fileURLToPath(import.meta.url))) — the real,
-// existing precedent for this pattern in this codebase, not a new one.
-// scanner/src/server/ -> ../../../frontend, computed (not guessed) and
-// confirmed to resolve to the real frontend/ directory.
+// Located relative to this module's own directory (path.dirname(
+// fileURLToPath(import.meta.url)), the same pattern scanner/src/mcp/server.js
+// uses), but via resolveFrontendRoot's search-upward strategy rather than a
+// single hardcoded relative depth — a fixed `../../../frontend` resolved
+// correctly for this file's unbundled dev location but broke (silently, at
+// runtime, for every real npx/npm user) once `npm run build` split this
+// module into its own dist/ chunk, whose import.meta.url reflects dist/'s
+// own shallower location. See src/shared/frontend-root.js for the full story
+// and scripts/copy-frontend.mjs for the build-time copy this now finds.
 const _here = path.dirname(fileURLToPath(import.meta.url));
-export const FRONTEND_ROOT = path.resolve(_here, '..', '..', '..', 'frontend');
+export const FRONTEND_ROOT = resolveFrontendRoot(_here);
 
 export const CONTENT_TYPE_MAP = Object.freeze({
   '.html': 'text/html; charset=utf-8',

package/src/shared/frontend-root.js

@@ -0,0 +1,52 @@
+// frontend-root.js — locates the Data Flow Explorer's `frontend/` assets
+// (index.html/src/styles) regardless of whether this code is running:
+//   - unbundled, straight out of scanner/src/ or scanner/scripts/ (dev/test —
+//     frontend/ is a monorepo sibling of scanner/, 2-3 levels up), or
+//   - bundled by `npm run build` (ncc splits a dynamic import() into its own
+//     chunk file physically written into scanner/dist/, so import.meta.url
+//     inside that chunk reflects dist/'s own location, not the original
+//     source file's — a fixed relative-levels-up path that was correct for
+//     one depth breaks silently at the other), or
+//   - installed from the published npm package, where the build copies
+//     frontend/'s servable files into scanner/dist/frontend/ (a sibling of
+//     the chunk file itself, i.e. 0 levels up) — see scripts/copy-frontend.mjs.
+//
+// Rather than hardcode one of those depths (the bug this file fixes: every
+// consumer used to hardcode the dev-only depth), search upward from the
+// caller's own directory and take the first candidate that actually has a
+// frontend/index.html on disk. Never guessed silently past that — a caller
+// with no match anywhere gets a clear, actionable error instead of a
+// downstream ENOENT/404 with no indication why.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+const MAX_LEVELS_UP = 4;
+
+/**
+ * @param {string} startDir - `path.dirname(fileURLToPath(import.meta.url))`
+ *   of the CALLING module (not this file) — each caller's own bundled/
+ *   unbundled location determines which candidate depth resolves.
+ * @returns {string} absolute path to a real `frontend/` directory containing
+ *   `index.html`.
+ * @throws if no candidate directory up to MAX_LEVELS_UP contains one.
+ */
+export function resolveFrontendRoot(startDir) {
+  const tried = [];
+  for (let up = 0; up <= MAX_LEVELS_UP; up++) {
+    const candidate = path.resolve(startDir, ...Array(up).fill('..'), 'frontend');
+    tried.push(candidate);
+    // Every caller invokes resolveFrontendRoot() once, at module-load time,
+    // to compute a top-level FRONTEND_ROOT const (see static-assets.js /
+    // generate-html-report.mjs) — never per-request inside the explore
+    // server's request handler. At most MAX_LEVELS_UP+1 (5) sync stat calls
+    // at process startup is not a request-path DoS surface.
+    if (fs.existsSync(path.join(candidate, 'index.html'))) return candidate; // agentic-security-ignore: dos-sync-io
+  }
+  throw new Error(
+    `resolveFrontendRoot: no frontend/index.html found searching up from ${startDir}. ` +
+    `Tried: ${tried.join(', ')}. If you're running from a source checkout, run \`npm run build\` ` +
+    `first (it copies frontend/ into scanner/dist/frontend/); if you're running the published ` +
+    `package, this indicates a packaging defect — report it.`
+  );
+}