@clear-capabilities/agentic-security-scanner 0.148.3 → 0.148.4

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-50ac012aad784a997fa9c835b7f9c38c1f482592eb6e2876e96e488d6e46f4f4  agentic-security.mjs
+9d52cc907c314d1ac60bc62b0c15a0ce4bbf28bdaeaa54a2e57782b9a75f97eb  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.148.3",
+  "version": "0.148.4",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",

package/src/engine.js

@@ -10625,27 +10625,45 @@ function _deterministicFileTimings(timings) {
    // The supply-chain half. report/index.js normalizes EVERY supplyChain entry
    // into an SCA finding — not just the direct vulnerable_dep ones the resolver
    // can speak to — and pipeline/finding-schema.js requires findingProvenance on
-   // every channel. Three distinct populations reach this loop and they are not
-   // the same statement, so they do not share a limitation string:
+   // every channel. FOUR distinct populations reach this loop, not three, and
+   // they do not share a limitation string (adversarial premortem R2,
+   // 2026-09-07, follow-up to the assurance-strict message fix — this split
+   // used to be binary, and pipeline/assurance-mode.js's message building
+   // depends on the exact wording below to tell them apart):
    //
    //  - transitive vulnerable_deps: resolved by resolveTransitiveSCAOrigin
    //    above (M3 §3.2) — this branch is now reached only if that annotation
    //    pass itself failed to stamp the entry.
-   //  - unpinned_dep / no_lockfile and friends: these describe the ABSENCE of a
-   //    declaration, so "which commit introduced this version" is not a question
-   //    that has an answer to defer.
-   //  - anything the annotator failed to reach, as above.
+   //  - unpinned_dep / no_lockfile: these describe the ABSENCE of a
+   //    declaration, so "which commit introduced this version" is not a
+   //    question that has an answer to defer — permanently unresolvable, by
+   //    construction, not merely unresolved today.
+   //  - cdn_no_integrity / dynamic_require: NOT the same claim as the one
+   //    above, despite both reaching this loop as "not the vulnerable_dep
+   //    the resolver speaks to" — each of these carries a real `file`+`line`
+   //    (a specific `<script src>` tag or `require(...)` call someone
+   //    specifically wrote), so there IS a commit that introduced it; this
+   //    engine's resolver just isn't wired to walk it yet. Confusing this
+   //    with the absence case above told a user their finding was a
+   //    "permanent, by-design limitation" when it was really an ordinary,
+   //    fixable coverage gap.
+   //  - anything else: the annotator failed to reach it, as above.
    //
-   // The first two are honest `not_available` — that is exactly what the status
-   // is for. Only a genuine annotator failure is an `error`, which is why this
-   // loop distinguishes them rather than stamping one status for all three.
+   // The first three are honest `not_available` — that is exactly what the
+   // status is for. Only a genuine annotator failure is an `error`, which is
+   // why this loop distinguishes them rather than stamping one status for all.
+   const SUPPLY_CHAIN_ABSENCE_TYPES = new Set(['unpinned_dep', 'no_lockfile']);
    for (const sc of (supplyChain || [])) {
      if (!sc || typeof sc !== 'object' || sc.findingProvenance) continue;
-     sc.findingProvenance = emptyProvenance(PROVENANCE_STATUS.NOT_AVAILABLE, {
-       limitations: [sc.type === 'vulnerable_dep'
-         ? 'transitive dependency origin resolution failed for this entry (annotator error)'
-         : `origin resolution does not apply to a ${sc.type || 'non-vulnerability'} supply-chain entry`],
-     });
+     let limitation;
+     if (sc.type === 'vulnerable_dep') {
+       limitation = 'transitive dependency origin resolution failed for this entry (annotator error)';
+     } else if (SUPPLY_CHAIN_ABSENCE_TYPES.has(sc.type)) {
+       limitation = `origin resolution does not apply to a ${sc.type} supply-chain entry`;
+     } else {
+       limitation = `origin resolution is not yet wired for a ${sc.type || 'non-vulnerability'} supply-chain entry (this describes a real source location, not an absent declaration — resolvable in principle, just not implemented today)`;
+     }
+     sc.findingProvenance = emptyProvenance(PROVENANCE_STATUS.NOT_AVAILABLE, { limitations: [limitation] });
    }
    // The OTHER two channels report/index.js normalizes into findings —
    // `scan.secrets` and `scan.logicVulns`. The same argument that produced the

package/src/pipeline/assurance-mode.js

@@ -72,39 +72,89 @@ function _provenanceFailureReason(badProvenance, totalFindings) {
     counts.set(reason, (counts.get(reason) || 0) + 1);
   }
   const ranked = [...counts.entries()].sort((a, b) => b[1] - a[1]);
-  const [topReason, topCount] = ranked[0];
-  const allSameReason = ranked.length === 1;
   const base = `strict mode requires complete finding provenance; ${badProvenance.length}/${totalFindings} finding(s) have status outside [complete, uncommitted]`;
 
-  if (topReason === 'not a Git repository' || topReason === 'repository state unavailable') {
-    return `${base} — reason: ${allSameReason ? 'all of them are' : `${topCount} of them are`} "${topReason}". ` +
-      `strict mode resolves finding provenance from git history, so it requires a real git repository ` +
-      `(a GitHub "Download ZIP" extracts without one). Run \`git init && git add -A && git commit -m init\` in ` +
-      `the scanned directory, point the scan at a real \`git clone\`, or drop --assurance strict for standard/advisory.`;
+  const gitReasons = ranked.filter(([r]) => r === 'not a Git repository' || r === 'repository state unavailable');
+  const gitCount = gitReasons.reduce((s, [, n]) => s + n, 0);
+  // engine.js's own comment on this branch: "unpinned_dep / no_lockfile...
+  // describe the ABSENCE of a declaration, so 'which commit introduced this
+  // version' is not a question that has an answer to defer ... this is a
+  // known, disclosed limitation, not a bug... strict mode WILL fail on
+  // nearly any real project that has a package.json." That disclosure lived
+  // only in a source comment nobody hits this error reads — the README's
+  // own quickstart explicitly invites pointing --assurance strict at "your
+  // own project," where this is the single most likely outcome. Named here
+  // so the person who hits it learns it is expected and permanent, not
+  // something to keep investigating. This prefix is deliberately narrower
+  // than "every non-vulnerable_dep supply-chain entry" — engine.js's
+  // provenance-stamping loop only uses it for unpinned_dep/no_lockfile,
+  // which genuinely have no origin commit; cdn_no_integrity/dynamic_require
+  // carry a real file:line and get a DIFFERENT string precisely so they
+  // never land in this "permanent, give up" bucket (adversarial premortem
+  // R2, 2026-09-07 — conflating the two told a user a resolvable coverage
+  // gap was an unfixable, by-design limitation).
+  const supplyChainReasons = ranked.filter(([r]) => r.startsWith('origin resolution does not apply to a'));
+  const supplyChainCount = supplyChainReasons.reduce((s, [, n]) => s + n, 0);
+  const knownReasonSet = new Set([...gitReasons, ...supplyChainReasons].map(([r]) => r));
+  const otherReasons = ranked.filter(([r]) => !knownReasonSet.has(r));
+  const otherCount = badProvenance.length - gitCount - supplyChainCount;
+  const knownCategoryCount = (gitCount > 0 ? 1 : 0) + (supplyChainCount > 0 ? 1 : 0);
+
+  // Exactly one KNOWN category, and nothing outside it — the shape every
+  // caller before this fix assumed was the only shape, and the one every
+  // existing test was written against. Kept as tight, single-topic prose
+  // rather than the multi-segment form below.
+  if (knownCategoryCount === 0) {
+    if (otherReasons.length === 1) {
+      return `${base} — all ${badProvenance.length} share the same reason: "${otherReasons[0][0]}".`;
+    }
+    const breakdown = otherReasons.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
+    return `${base} — breakdown: ${breakdown}${otherReasons.length > 5 ? ', …' : ''}.`;
   }
-  // engine.js's own comment on this branch: "unpinned_dep / no_lockfile and
-  // friends... describe the ABSENCE of a declaration, so 'which commit
-  // introduced this version' is not a question that has an answer to defer
-  // ... this is a known, disclosed limitation, not a bug... strict mode
-  // WILL fail on nearly any real project that has a package.json." That
-  // disclosure lived only in a source comment nobody hits this error reads —
-  // the README's own quickstart explicitly invites pointing --assurance
-  // strict at "your own project," where this is the single most likely
-  // outcome. Named here so the person who hits it learns it is expected and
-  // permanent, not something to keep investigating.
-  const supplyChainCount = ranked.filter(([r]) => r.startsWith('origin resolution does not apply to a')).reduce((s, [, n]) => s + n, 0);
-  if (supplyChainCount > 0 && supplyChainCount >= badProvenance.length / 2) {
+  if (knownCategoryCount === 1 && otherCount === 0) {
+    if (gitCount > 0) {
+      const gitReasonNames = gitReasons.map(([r]) => `"${r}"`).join(' and ');
+      return `${base} — reason: ${gitCount === badProvenance.length ? 'all of them are' : `${gitCount} of them are`} ${gitReasonNames}. ` +
+        `strict mode resolves finding provenance from git history, so it requires a real git repository ` +
+        `(a GitHub "Download ZIP" extracts without one). Run \`git init && git add -A && git commit -m init\` in ` +
+        `the scanned directory, point the scan at a real \`git clone\`, or drop --assurance strict for standard/advisory.`;
+    }
     return `${base} — ${supplyChainCount} of them describe an ABSENT dependency declaration ` +
       `(an unpinned version, a missing lockfile) that has no origin commit to resolve, by design. This is a ` +
       `known, permanent limitation: strict mode cannot pass while any are present, on any real project with ` +
       `such a dependency. Fix the underlying SCA finding(s) (pin the version / add a lockfile) if you want ` +
       `strict to pass, or use --assurance standard/advisory for a project you don't control the dependencies of.`;
   }
-  if (allSameReason) {
-    return `${base} — all ${badProvenance.length} share the same reason: "${topReason}".`;
+
+  // Two or more independently-blocking categories on the SAME scan — the
+  // defect this closes (adversarial premortem R1, 2026-09-07): the old
+  // code picked whichever category had the most findings and silently
+  // dropped every other one, so a user could "fix" the reported problem,
+  // rerun, and hit a second wall the first run already had full information
+  // about but never mentioned — the same "the tool knew and didn't tell me"
+  // complaint this whole function exists to fix, recurring in a milder form.
+  const segments = [];
+  if (gitCount > 0) {
+    const gitReasonNames = gitReasons.map(([r]) => `"${r}"`).join(' and ');
+    segments.push(`${gitCount} of them are ${gitReasonNames} (strict mode requires a real git repository — ` +
+      `run \`git init && git add -A && git commit\`, or scan a real \`git clone\`)`);
+  }
+  if (supplyChainCount > 0) {
+    segments.push(`${supplyChainCount} of them describe an ABSENT dependency declaration (unpinned version / ` +
+      `missing lockfile) with no origin commit to resolve — a known, permanent limitation, not something a ` +
+      `rerun will fix`);
+  }
+  if (otherCount > 0) {
+    if (otherReasons.length === 1) {
+      segments.push(`${otherCount} share the reason "${otherReasons[0][0]}"`);
+    } else {
+      const breakdown = otherReasons.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
+      segments.push(`${otherCount} break down as: ${breakdown}${otherReasons.length > 5 ? ', …' : ''}`);
+    }
   }
-  const breakdown = ranked.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
-  return `${base} — breakdown: ${breakdown}${ranked.length > 5 ? ', …' : ''}.`;
+  return `${base} — MULTIPLE distinct reasons, not just one: ${segments.join('; ')}. Every category above must ` +
+    `be resolved for strict to pass (or drop to --assurance standard/advisory) — fixing only one will surface ` +
+    `the next on your following run.`;
 }
 
 /**