@clear-capabilities/agentic-security-scanner 0.148.1 → 0.148.3

package/src/posture/compliance-frameworks/owasp-llm-top-10.json

@@ -4,8 +4,11 @@
   "publisher": "OWASP Foundation",
   "license": "Creative Commons Attribution-ShareAlike 4.0",
   "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
-  "scope": "FULL TOP-10. All ten categories are present. Each category is a broad class rather than a single testable requirement, so a mapping indicates a detector exists for part of the class, not that the class is fully covered.",
-  "controlsDigest": "0a0351a9536790e4",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVersionDriftDetected": true,
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): confirmed page is OWASP Top 10 for LLM Applications, but the CURRENT published edition is now 2026 (2026-08-04), not the 2025 edition this file bundles. See scope field for the disclosure and what remediation this requires.",
+  "scope": "FULL TOP-10. All ten categories are present. Each category is a broad class rather than a single testable requirement, so a mapping indicates a detector exists for part of the class, not that the class is fully covered. VERSION DRIFT, disclosed 2026-09-07: this bundle is the 2025 edition. OWASP published a 2026 edition on 2026-08-04 (confirmed live, the project page now archives 2025 and lists 2026 as current); the 10-category taxonomy may have changed. This file has NOT been re-mapped to the 2026 edition, that requires a deliberate review of the new categories against this engine's detector families, not a rushed relabel. Treat this bundle as 2025-accurate only until that review lands.",
+  "controlsDigest": "7500b9c4268eba6f",
   "controlCount": 10,
   "controls": [
     {
@@ -101,11 +104,10 @@
       "summary": "Excessive Agency — agent autonomy is bounded by explicit guards.",
       "codeTestable": "partial",
       "evidence": [
-        "MCP server config limits write-tools to confirm:true + reserved-write-path refusal.",
-        "Apply-fix path requires HMAC-verified scan."
+        "Apply-fix path requires HMAC-verified scan.",
+        "Removed module:mcp-tools after a second-review pass: that path points at THIS scanner's own source file (scanner/src/mcp/tools.js), which only resolves inside this tool's own checkout, never inside an arbitrary assessed project. It cannot evidence that the assessed LLM application bounds ITS OWN agent's autonomy. Category error (self-referential: about this tool, not the target)."
       ],
       "mapsTo": [
-        "module:mcp-tools",
         "module:apply-fix"
       ]
     },
@@ -114,13 +116,10 @@
       "summary": "Overreliance — human review checkpoints exist.",
       "codeTestable": "partial",
       "evidence": [
-        "security-fixer agent has Stop-on-verify-fail loop.",
-        "PreToolUse bodyguard exists."
+        "No automated signal in this engine after a second-review pass removed both prior mappings. module:security-fixer pointed at THIS scanner's own agent definition file (agents/security-fixer.md) and module:pre-edit-bodyguard at THIS scanner's own installed hook — both resolve only inside this tool's own checkout/plugin install, never inside an arbitrary assessed project, and neither evidences that the assessed LLM application itself has human review checkpoints. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework.",
+        "Reported as an engine gap: human review checkpoints around an LLM application's outputs are code-observable in principle (an approval-gate library, a human-in-the-loop wrapper in the assessed system's own code), but no detector here looks for that in the SCANNED project."
       ],
-      "mapsTo": [
-        "module:security-fixer",
-        "module:pre-edit-bodyguard"
-      ]
+      "mapsTo": []
     },
     {
       "id": "LLM10",

package/src/posture/verifier.js

@@ -32,6 +32,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { runConfined, sandboxAvailable } from '../sandbox/index.js';
 import { isExplicitlyNoPoc } from './poc-cwe-map.js';
+import { isSafeStateDir, stateDir, statePath, stateWritesEnabled } from './state-dir.js';
 
 // ─── PoC static validation ──────────────────────────────────────────────────
 //
@@ -228,5 +229,74 @@ export function verifierCoverageSummary(findings) {
   return out;
 }
 
+// ─── Run persistence (adversarial premortem Q1, 2026-09-07) ────────────────
+//
+// `compliance-frameworks/*.json` has mapped `module:verifier` to
+// `verifier-runs/` since this framework's control-to-artifact table was
+// written, but nothing ever wrote to it: `cmdVerify` (bin/agentic-security.js)
+// ran the loop and printed a summary, but never persisted one. That made
+// NIST 800-171 `03.12.01` (Security Assessment) and NIST CSF 2.0 `RC.RP`
+// (Recovery plans executed and improved) permanently unable to read
+// 'present' via this leg of their mapping, on any project, ever — worse than
+// a self-referential mapping (which can at least clear, dishonestly), a
+// mapping that can never clear at all. This closes that gap for real, one
+// record per `agentic-security verify` run, same shape as fix-metrics.js's
+// append-per-attempt pattern (that file uses one growing JSONL; this one
+// uses one file per run, because the table entry it satisfies is a
+// directory, not a file, and a per-run file is what a reader would expect
+// under a name like "verifier-runs/").
+const RUN_DIR = 'verifier-runs';
+
+/**
+ * Persist one record of an `agentic-security verify` invocation. Best-effort
+ * and silent on failure, same convention as every other posture writer: a
+ * verify run's own findings must never be lost because the record of having
+ * run could not be written.
+ *
+ * @returns {boolean} whether the record was written (for tests, not callers).
+ */
+export function recordVerifierRun(scanRoot, summary) {
+  if (!scanRoot || !summary || typeof summary !== 'object') return false;
+  try {
+    const dir = stateDir(scanRoot);
+    if (!isSafeStateDir(dir)) return false;
+    if (!stateWritesEnabled()) return false;
+    const runsDir = statePath(scanRoot, RUN_DIR);
+    fs.mkdirSync(runsDir, { recursive: true });
+    const now = new Date();
+    // Millisecond Date timestamps collide under back-to-back calls (two
+    // `verify` invocations in the same test, or a scripted loop). hrtime is
+    // monotonic and nanosecond-resolution within this process, so appending
+    // it guarantees both a distinct filename AND correct chronological sort
+    // order (alphabetical == call order), which a random suffix alone would
+    // not: two records written in the same millisecond would sort by random
+    // bytes, not by which call happened first.
+    const stamp = now.toISOString().replace(/[^0-9TZ]/g, '-');
+    const seq = process.hrtime.bigint().toString().padStart(20, '0');
+    const record = { timestamp: now.toISOString(), ...summary };
+    // One writeFileSync of one complete file: a concurrent reader sees a
+    // whole record or nothing (never a partial one, unlike an append target).
+    fs.writeFileSync(path.join(runsDir, `${stamp}-${seq}.json`), JSON.stringify(record, null, 2), 'utf8');
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Read every well-formed run record, oldest first. A file that does not
+ * parse is skipped, not thrown on — same tolerant-read convention as
+ * fix-metrics.js's readFixAttempts.
+ */
+export function readVerifierRuns(scanRoot) {
+  try {
+    const runsDir = statePath(scanRoot, RUN_DIR);
+    const files = fs.readdirSync(runsDir).filter((f) => f.endsWith('.json')).sort();
+    const out = [];
+    for (const f of files) {
+      try { out.push(JSON.parse(fs.readFileSync(path.join(runsDir, f), 'utf8'))); } catch { /* skip malformed */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
 // For tests and the no-dead-modules check.
 export const _internals = { MAX_POC_BYTES, BANNED_HOSTS, SANITIZER_TABLE, runSandboxed };