@clear-capabilities/agentic-security-scanner 0.148.4 → 0.149.0

package/CHANGELOG.md

@@ -10,6 +10,65 @@
 
 
 
+## 0.149.0 - Live progress reporting for long-running scans
+
+A scan running deep interprocedural taint analysis or the Data Flow Explorer's lineage graph
+build could sit silent for minutes with no sign anything was happening, which read as a hang and
+was a real reason people quit the run before it finished. This release wires progress reporting
+through the phases that were previously silent, and threads the existing stderr status line into
+every command that runs a fresh scan.
+
+1. `runTaintEngine` (`src/dataflow/engine.js`) now reports live `current/total` progress from its
+   dominant per-function analysis loop via an optional `opts.onProgress`, additive and byte-
+   identical when omitted.
+2. `runFieldIdentityAnalysis` (`src/lineage/driver.js`) reports the same live per-function progress
+   for the lineage graph build, threaded through `graph-builder.js` -> `coverage.js` ->
+   `index.js`'s `buildLineageGraph`.
+3. Both the deep-taint and lineage-graph phases are one synchronous, unbreakable call each (Node's
+   event loop can't tick mid-call), so a "starting (budget Ns)" message prints the instant each
+   phase begins, then live progress once its main loop runs.
+4. The ~52 posture/provenance annotators (previously silent as a block) now report
+   `[Annotating] N/52 <name>` as each one runs.
+5. The stderr `\r[phase] current/total` status line, previously wired only into the default `scan`
+   command, is now shared (`scanProgressReporter()`/`clearScanProgressLine()`) and used by
+   `scan --watch`, `ci`, `verify-attestation`, and `dataflow watch` (the seed scan and every
+   rescan) too.
+
+`posture`/`compliance`/`supply`/`triage`/`labs` read the persisted `last-scan.json` rather than
+scanning themselves, so they inherit this the moment a `scan` produced that file; `org-scan`
+(concurrent multi-repo) is deliberately left silent, since a shared progress line across parallel
+workers would just interleave and garble.
+
+Also: `ide/vscode`'s transitive `js-yaml` dev dependency (pulled in via `@vscode/vsce`) is bumped
+4.3.1 -> 4.3.2, closing a high-severity CPU-exhaustion advisory the release gate's dependency-
+currency check found (GHSA-2883-xcg3-v3hh) — a non-breaking patch release, `npm audit fix` only.
+
+## 0.148.5 - Third premortem pass on the --assurance strict fix: clean bill of health, four polish items closed anyway
+
+0.148.4's fix was put through a THIRD adversarial premortem pass to check whether it introduced
+anything new. It didn't — no High-or-above defect, and one specific hypothesis (a stale
+pre-0.148.4 cached scan producing the old, wrong message after upgrading) was investigated and
+disproven with direct evidence: `ci` always re-scans fresh, and the affected finding types never
+route through the disk-cached resolver path at all. Four Low-severity polish items surfaced
+anyway and are closed here, none of them changes to already-correct behavior:
+
+1. `cdn_no_integrity`/`dynamic_require` findings, alone with no other reason present, used to fall
+   through to a generic "share the same reason" message quoting the full raw internal string —
+   honest, but verbose, and missing the "(or drop to --assurance standard/advisory)" next step
+   every other named bucket already has. They now get their own short, specific message with that
+   same next step.
+2. The "MULTIPLE distinct reasons" message (fired when more than one category is present at once)
+   now renders as a bulleted, newline-separated list instead of one semicolon-joined paragraph —
+   each bullet is an independently actionable problem, and the old format buried that.
+3. `dynamic_require` and a standalone `no_lockfile` (previously only tested paired with
+   `unpinned_dep`) now each have their own direct test, closing a "shares a code path, never
+   independently verified" gap.
+4. A new completeness guard (`scanner/test/supply-chain-provenance-completeness.test.js`) asserts
+   every supply-chain finding type `engine.js` produces is deliberately classified as either a
+   genuine absence (no origin commit exists) or a real, resolvable-in-principle source location —
+   so a future finding type added to one detection loop and forgotten in the classification can't
+   silently tell a user a permanent limitation is fixable, or vice versa.
+
 ## 0.148.4 - Adversarial premortem re-run on the 0.148.2/0.148.3 --assurance strict fix: two real defects found and fixed
 
 0.148.2's fix for a confusing `--assurance strict` failure was itself put through an adversarial

package/bin/agentic-security.js

@@ -53,6 +53,26 @@ const MACHINE_FORMATS = new Set([
   'json', 'sarif', 'oscal', 'cyclonedx', 'sbom', 'spdx', 'vex', 'openvex', 'pbom', 'aibom',
 ]);
 function isMachineFormat(fmt) { return MACHINE_FORMATS.has(String(fmt)); }
+
+// Shared stderr progress reporter for any command that runs a fresh scan —
+// the same `\r[phase] current/total file` status line the default `scan`
+// command has always printed, extracted so every OTHER scan-driving command
+// (`scan --watch`, `ci`, `verify-attestation`, `dataflow watch`) reports
+// progress too instead of running silently. Gated on `stderr.isTTY` exactly
+// like the original: piping to a file/CI log never gets a `\r`-spammed
+// status line. `runFullScan` (engine.js) now reports progress for every
+// phase, including the previously-silent deep-analysis/lineage/annotator
+// phases — see that file's own `setProgress` call sites.
+function scanProgressReporter() {
+  return (p) => {
+    if (process.stderr.isTTY) process.stderr.write(`\r[${p.phase}] ${p.current}/${p.total} ${p.file}     `);
+  };
+}
+// Wipes the progress line printed by scanProgressReporter() above — call
+// once a scan this reporter was attached to has finished.
+function clearScanProgressLine() {
+  if (process.stderr.isTTY) process.stderr.write('\r' + ' '.repeat(80) + '\r');
+}
 import { toCycloneDX, toSPDX } from '../src/posture/sbom.js';
 import { toPBOM } from '../src/sast/pipeline.js';
 import { buildAIBOM, aibomToMarkdown } from '../src/posture/aibom.js';
@@ -619,11 +639,13 @@ async function cmdScan(args) {
     process.env.AGENTIC_SECURITY_INCREMENTAL = '1';
     const { watchProject, computeDelta, persistStatus, renderStatusLine } = await import('../src/posture/watch-mode.js');
     process.stderr.write(`[watch] scanning ${targetAbs} on change — Ctrl-C to stop. Status → .agentic-security/watch-status.md\n`);
-    const seed = await runScan(targetAbs, {});
+    const seed = await runScan(targetAbs, { onProgress: scanProgressReporter() });
+    clearScanProgressLine();
     let prevFindings = seed.scan.findings || [];
     await watchProject(targetAbs, async () => {
       try {
-        const { scan } = await runScan(targetAbs, {});
+        const { scan } = await runScan(targetAbs, { onProgress: scanProgressReporter() });
+        clearScanProgressLine();
         const curr = scan.findings || [];
         const delta = computeDelta(prevFindings, curr);
         persistStatus(targetAbs, delta);
@@ -690,9 +712,7 @@ async function cmdScan(args) {
 
   const { scan, meta } = await runScan(target, {
     changedSince,
-    onProgress: (p) => {
-      if (process.stderr.isTTY) process.stderr.write(`\r[${p.phase}] ${p.current}/${p.total} ${p.file}     `);
-    },
+    onProgress: scanProgressReporter(),
   });
   // --require-provenance: flag (never fail) any finding whose provenance
   // isn't resolved, via scanHealth — deliberately independent of the
@@ -740,7 +760,7 @@ async function cmdScan(args) {
   // The BOM/attestation emitters stamp the producing engine's version into
   // their metadata; carry the real package version so it can never drift.
   if (meta && meta.engineVersion == null) meta.engineVersion = PKG_VERSION;
-  if (process.stderr.isTTY) process.stderr.write('\r' + ' '.repeat(80) + '\r');
+  clearScanProgressLine();
 
   const only = args.flags.only;
   if (only) {
@@ -1230,7 +1250,8 @@ async function cmdCi(args) {
   else          process.stderr.write(`[ci] full scan (no baseline ref detected)\n`);
 
   const profile = loadPersonaProfile(targetAbs, args);
-  const { scan, meta } = await runScan(target, { changedSince: baseline || null });
+  const { scan, meta } = await runScan(target, { changedSince: baseline || null, onProgress: scanProgressReporter() });
+  clearScanProgressLine();
 
   // Apply suppressions + overrides + packs, mirroring cmdScan's pipeline.
   scan.findings    = applySuppressions(scan.findings    || [], targetAbs, profile);
@@ -2740,7 +2761,8 @@ async function cmdVerifyRunAttestation(attestation, args) {
   const { normalizeFindings } = await import('../src/report/index.js');
   const { effectiveVersion } = await import('../src/posture/ruleset-version.js');
   const { verifyRunAttestation } = await import('../src/posture/attestation.js');
-  const { scan } = await runScan(projectPath);
+  const { scan } = await runScan(projectPath, { onProgress: scanProgressReporter() });
+  clearScanProgressLine();
   const r = verifyRunAttestation(attestation, {
     findings: normalizeFindings(scan),
     engineVersion: PKG_VERSION,
@@ -6224,7 +6246,8 @@ async function cmdDataflowWatch(args) {
   // uncached provenance-resolution cost on every edit), while every OTHER
   // state write named above stays fully suppressed. Do not "simplify" this
   // back to a bare runScan call.
-  const seed = await withStateWritesDisabled(() => runScan(targetAbs, {}), { exceptCategories: ['provenance-cache'] });
+  const seed = await withStateWritesDisabled(() => runScan(targetAbs, { onProgress: scanProgressReporter() }), { exceptCategories: ['provenance-cache'] });
+  clearScanProgressLine();
   if (!seed.scan.lineageGraph) {
     process.stderr.write(`agentic-security dataflow watch: seed scan produced no data-flow graph (${_lineageStatusReason(seed.scan.lineageStatus)}) — nothing to watch/diff against.\n`);
     return 1;
@@ -6266,7 +6289,8 @@ async function cmdDataflowWatch(args) {
       return;
     }
     try {
-      const { scan } = await withStateWritesDisabled(() => runScan(targetAbs, {}), { exceptCategories: ['provenance-cache'] });
+      const { scan } = await withStateWritesDisabled(() => runScan(targetAbs, { onProgress: scanProgressReporter() }), { exceptCategories: ['provenance-cache'] });
+      clearScanProgressLine();
       if (!scan.lineageGraph) {
         process.stderr.write(`[watch-dataflow] rescan produced no data-flow graph (${_lineageStatusReason(scan.lineageStatus)}) — skipping this change.\n`);
         return;

package/dist/4970.index.js

@@ -109,10 +109,19 @@ function _provenanceFailureReason(badProvenance, totalFindings) {
   // gap was an unfixable, by-design limitation).
   const supplyChainReasons = ranked.filter(([r]) => r.startsWith('origin resolution does not apply to a'));
   const supplyChainCount = supplyChainReasons.reduce((s, [, n]) => s + n, 0);
-  const knownReasonSet = new Set([...gitReasons, ...supplyChainReasons].map(([r]) => r));
+  // Third known bucket (S1, adversarial premortem third pass, 2026-09-07):
+  // cdn_no_integrity/dynamic_require's "not yet wired" string (see the
+  // engine.js comment this file's `supplyChainReasons` block already
+  // references) was previously falling through to the generic `otherReasons`
+  // path below — honest, but verbose, and with no recommended next step,
+  // unlike every other named bucket here. Giving it its own bucket closes
+  // that inconsistency without touching the two already-fixed buckets.
+  const notYetWiredReasons = ranked.filter(([r]) => r.startsWith('origin resolution is not yet wired for a'));
+  const notYetWiredCount = notYetWiredReasons.reduce((s, [, n]) => s + n, 0);
+  const knownReasonSet = new Set([...gitReasons, ...supplyChainReasons, ...notYetWiredReasons].map(([r]) => r));
   const otherReasons = ranked.filter(([r]) => !knownReasonSet.has(r));
-  const otherCount = badProvenance.length - gitCount - supplyChainCount;
-  const knownCategoryCount = (gitCount > 0 ? 1 : 0) + (supplyChainCount > 0 ? 1 : 0);
+  const otherCount = badProvenance.length - gitCount - supplyChainCount - notYetWiredCount;
+  const knownCategoryCount = (gitCount > 0 ? 1 : 0) + (supplyChainCount > 0 ? 1 : 0) + (notYetWiredCount > 0 ? 1 : 0);
 
   // Exactly one KNOWN category, and nothing outside it — the shape every
   // caller before this fix assumed was the only shape, and the one every
@@ -133,11 +142,17 @@ function _provenanceFailureReason(badProvenance, totalFindings) {
         `(a GitHub "Download ZIP" extracts without one). Run \`git init && git add -A && git commit -m init\` in ` +
         `the scanned directory, point the scan at a real \`git clone\`, or drop --assurance strict for standard/advisory.`;
     }
-    return `${base} — ${supplyChainCount} of them describe an ABSENT dependency declaration ` +
-      `(an unpinned version, a missing lockfile) that has no origin commit to resolve, by design. This is a ` +
-      `known, permanent limitation: strict mode cannot pass while any are present, on any real project with ` +
-      `such a dependency. Fix the underlying SCA finding(s) (pin the version / add a lockfile) if you want ` +
-      `strict to pass, or use --assurance standard/advisory for a project you don't control the dependencies of.`;
+    if (supplyChainCount > 0) {
+      return `${base} — ${supplyChainCount} of them describe an ABSENT dependency declaration ` +
+        `(an unpinned version, a missing lockfile) that has no origin commit to resolve, by design. This is a ` +
+        `known, permanent limitation: strict mode cannot pass while any are present, on any real project with ` +
+        `such a dependency. Fix the underlying SCA finding(s) (pin the version / add a lockfile) if you want ` +
+        `strict to pass, or use --assurance standard/advisory for a project you don't control the dependencies of.`;
+    }
+    return `${base} — ${notYetWiredCount} of them point at a real source location (a CDN script tag, a dynamic ` +
+      `require) this engine can't yet trace back to the commit that introduced it — unlike the ABSENT-declaration ` +
+      `case above, this is an ordinary coverage gap, not a permanent limitation, but it isn't fixable from your ` +
+      `side either. Use --assurance standard/advisory if you need this scan to pass today.`;
   }
 
   // Two or more independently-blocking categories on the SAME scan — the
@@ -147,28 +162,39 @@ function _provenanceFailureReason(badProvenance, totalFindings) {
   // rerun, and hit a second wall the first run already had full information
   // about but never mentioned — the same "the tool knew and didn't tell me"
   // complaint this whole function exists to fix, recurring in a milder form.
+  //
+  // Rendered as a bulleted, newline-separated list rather than one
+  // semicolon-joined paragraph (S2, adversarial premortem third pass,
+  // 2026-09-07) — each bullet is independently actionable, and a wall of
+  // clauses buried the fact that they are SEPARATE problems, each with its
+  // own fix, rather than one problem described three ways.
   const segments = [];
   if (gitCount > 0) {
     const gitReasonNames = gitReasons.map(([r]) => `"${r}"`).join(' and ');
-    segments.push(`${gitCount} of them are ${gitReasonNames} (strict mode requires a real git repository — ` +
-      `run \`git init && git add -A && git commit\`, or scan a real \`git clone\`)`);
+    segments.push(`${gitCount} of them are ${gitReasonNames} — strict mode requires a real git repository; ` +
+      `run \`git init && git add -A && git commit\`, or scan a real \`git clone\`.`);
   }
   if (supplyChainCount > 0) {
     segments.push(`${supplyChainCount} of them describe an ABSENT dependency declaration (unpinned version / ` +
       `missing lockfile) with no origin commit to resolve — a known, permanent limitation, not something a ` +
-      `rerun will fix`);
+      `rerun will fix.`);
+  }
+  if (notYetWiredCount > 0) {
+    segments.push(`${notYetWiredCount} of them point at a real source location this engine can't yet trace ` +
+      `back to a commit — an ordinary coverage gap, not a permanent limitation, but not fixable from your side.`);
   }
   if (otherCount > 0) {
     if (otherReasons.length === 1) {
-      segments.push(`${otherCount} share the reason "${otherReasons[0][0]}"`);
+      segments.push(`${otherCount} share the reason "${otherReasons[0][0]}".`);
     } else {
       const breakdown = otherReasons.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
-      segments.push(`${otherCount} break down as: ${breakdown}${otherReasons.length > 5 ? ', …' : ''}`);
+      segments.push(`${otherCount} break down as: ${breakdown}${otherReasons.length > 5 ? ', …' : ''}.`);
     }
   }
-  return `${base} — MULTIPLE distinct reasons, not just one: ${segments.join('; ')}. Every category above must ` +
-    `be resolved for strict to pass (or drop to --assurance standard/advisory) — fixing only one will surface ` +
-    `the next on your following run.`;
+  const bullets = segments.map((s) => `  - ${s}`).join('\n');
+  return `${base} — MULTIPLE distinct reasons, not just one:\n${bullets}\nEvery category above must be ` +
+    `resolved for strict to pass (or drop to --assurance standard/advisory) — fixing only one will surface the ` +
+    `next on your following run.`;
 }
 
 /**