@clear-capabilities/agentic-security-scanner 0.148.5 → 0.149.1

package/CHANGELOG.md

@@ -10,6 +10,56 @@
 
 
 
+## 0.149.1 - Fix scan hang on unbounded registry/OSV network calls
+
+An SCA scan could hang indefinitely at "Registry metadata..." (or, less visibly, during OSV
+lookup) with no timeout, no error, and no way to tell it apart from a genuine long-running scan.
+`queryRegistries()` and `queryOSV()` in `src/engine.js` fired `fetch()` against npm, PyPI,
+Packagist, crates.io, RubyGems, pub.dev, Maven Central, and the OSV API with no timeout at all —
+if any single registry stalled (rate-limiting, a proxy silently dropping the connection, DNS),
+the whole scan sat there forever, since Node's global `fetch` has no default timeout.
+
+1. All 9 registry/OSV fetches now carry `AbortSignal.timeout(8000)`, matching the convention
+   already used for the KEV feed fetch.
+2. `queryOSV`'s per-vulnerability detail fetch now also honors `AGENTIC_SECURITY_OFFLINE=1`, so
+   offline scans skip that network path instead of attempting and timing out on it.
+3. `queryRegistries` deliberately does **not** honor `AGENTIC_SECURITY_OFFLINE` — that flag's
+   established scope in this codebase is OSV/KEV/EPSS, and `test/sca-deprecated.test.js` already
+   depends on registry lookups still running (against a stubbed fetch) under `OFFLINE=1`.
+
+## 0.149.0 - Live progress reporting for long-running scans
+
+A scan running deep interprocedural taint analysis or the Data Flow Explorer's lineage graph
+build could sit silent for minutes with no sign anything was happening, which read as a hang and
+was a real reason people quit the run before it finished. This release wires progress reporting
+through the phases that were previously silent, and threads the existing stderr status line into
+every command that runs a fresh scan.
+
+1. `runTaintEngine` (`src/dataflow/engine.js`) now reports live `current/total` progress from its
+   dominant per-function analysis loop via an optional `opts.onProgress`, additive and byte-
+   identical when omitted.
+2. `runFieldIdentityAnalysis` (`src/lineage/driver.js`) reports the same live per-function progress
+   for the lineage graph build, threaded through `graph-builder.js` -> `coverage.js` ->
+   `index.js`'s `buildLineageGraph`.
+3. Both the deep-taint and lineage-graph phases are one synchronous, unbreakable call each (Node's
+   event loop can't tick mid-call), so a "starting (budget Ns)" message prints the instant each
+   phase begins, then live progress once its main loop runs.
+4. The ~52 posture/provenance annotators (previously silent as a block) now report
+   `[Annotating] N/52 <name>` as each one runs.
+5. The stderr `\r[phase] current/total` status line, previously wired only into the default `scan`
+   command, is now shared (`scanProgressReporter()`/`clearScanProgressLine()`) and used by
+   `scan --watch`, `ci`, `verify-attestation`, and `dataflow watch` (the seed scan and every
+   rescan) too.
+
+`posture`/`compliance`/`supply`/`triage`/`labs` read the persisted `last-scan.json` rather than
+scanning themselves, so they inherit this the moment a `scan` produced that file; `org-scan`
+(concurrent multi-repo) is deliberately left silent, since a shared progress line across parallel
+workers would just interleave and garble.
+
+Also: `ide/vscode`'s transitive `js-yaml` dev dependency (pulled in via `@vscode/vsce`) is bumped
+4.3.1 -> 4.3.2, closing a high-severity CPU-exhaustion advisory the release gate's dependency-
+currency check found (GHSA-2883-xcg3-v3hh) — a non-breaking patch release, `npm audit fix` only.
+
 ## 0.148.5 - Third premortem pass on the --assurance strict fix: clean bill of health, four polish items closed anyway
 
 0.148.4's fix was put through a THIRD adversarial premortem pass to check whether it introduced

package/bin/agentic-security.js

@@ -53,6 +53,26 @@ const MACHINE_FORMATS = new Set([
   'json', 'sarif', 'oscal', 'cyclonedx', 'sbom', 'spdx', 'vex', 'openvex', 'pbom', 'aibom',
 ]);
 function isMachineFormat(fmt) { return MACHINE_FORMATS.has(String(fmt)); }
+
+// Shared stderr progress reporter for any command that runs a fresh scan —
+// the same `\r[phase] current/total file` status line the default `scan`
+// command has always printed, extracted so every OTHER scan-driving command
+// (`scan --watch`, `ci`, `verify-attestation`, `dataflow watch`) reports
+// progress too instead of running silently. Gated on `stderr.isTTY` exactly
+// like the original: piping to a file/CI log never gets a `\r`-spammed
+// status line. `runFullScan` (engine.js) now reports progress for every
+// phase, including the previously-silent deep-analysis/lineage/annotator
+// phases — see that file's own `setProgress` call sites.
+function scanProgressReporter() {
+  return (p) => {
+    if (process.stderr.isTTY) process.stderr.write(`\r[${p.phase}] ${p.current}/${p.total} ${p.file}     `);
+  };
+}
+// Wipes the progress line printed by scanProgressReporter() above — call
+// once a scan this reporter was attached to has finished.
+function clearScanProgressLine() {
+  if (process.stderr.isTTY) process.stderr.write('\r' + ' '.repeat(80) + '\r');
+}
 import { toCycloneDX, toSPDX } from '../src/posture/sbom.js';
 import { toPBOM } from '../src/sast/pipeline.js';
 import { buildAIBOM, aibomToMarkdown } from '../src/posture/aibom.js';
@@ -619,11 +639,13 @@ async function cmdScan(args) {
     process.env.AGENTIC_SECURITY_INCREMENTAL = '1';
     const { watchProject, computeDelta, persistStatus, renderStatusLine } = await import('../src/posture/watch-mode.js');
     process.stderr.write(`[watch] scanning ${targetAbs} on change — Ctrl-C to stop. Status → .agentic-security/watch-status.md\n`);
-    const seed = await runScan(targetAbs, {});
+    const seed = await runScan(targetAbs, { onProgress: scanProgressReporter() });
+    clearScanProgressLine();
     let prevFindings = seed.scan.findings || [];
     await watchProject(targetAbs, async () => {
       try {
-        const { scan } = await runScan(targetAbs, {});
+        const { scan } = await runScan(targetAbs, { onProgress: scanProgressReporter() });
+        clearScanProgressLine();
         const curr = scan.findings || [];
         const delta = computeDelta(prevFindings, curr);
         persistStatus(targetAbs, delta);
@@ -690,9 +712,7 @@ async function cmdScan(args) {
 
   const { scan, meta } = await runScan(target, {
     changedSince,
-    onProgress: (p) => {
-      if (process.stderr.isTTY) process.stderr.write(`\r[${p.phase}] ${p.current}/${p.total} ${p.file}     `);
-    },
+    onProgress: scanProgressReporter(),
   });
   // --require-provenance: flag (never fail) any finding whose provenance
   // isn't resolved, via scanHealth — deliberately independent of the
@@ -740,7 +760,7 @@ async function cmdScan(args) {
   // The BOM/attestation emitters stamp the producing engine's version into
   // their metadata; carry the real package version so it can never drift.
   if (meta && meta.engineVersion == null) meta.engineVersion = PKG_VERSION;
-  if (process.stderr.isTTY) process.stderr.write('\r' + ' '.repeat(80) + '\r');
+  clearScanProgressLine();
 
   const only = args.flags.only;
   if (only) {
@@ -1230,7 +1250,8 @@ async function cmdCi(args) {
   else          process.stderr.write(`[ci] full scan (no baseline ref detected)\n`);
 
   const profile = loadPersonaProfile(targetAbs, args);
-  const { scan, meta } = await runScan(target, { changedSince: baseline || null });
+  const { scan, meta } = await runScan(target, { changedSince: baseline || null, onProgress: scanProgressReporter() });
+  clearScanProgressLine();
 
   // Apply suppressions + overrides + packs, mirroring cmdScan's pipeline.
   scan.findings    = applySuppressions(scan.findings    || [], targetAbs, profile);
@@ -2740,7 +2761,8 @@ async function cmdVerifyRunAttestation(attestation, args) {
   const { normalizeFindings } = await import('../src/report/index.js');
   const { effectiveVersion } = await import('../src/posture/ruleset-version.js');
   const { verifyRunAttestation } = await import('../src/posture/attestation.js');
-  const { scan } = await runScan(projectPath);
+  const { scan } = await runScan(projectPath, { onProgress: scanProgressReporter() });
+  clearScanProgressLine();
   const r = verifyRunAttestation(attestation, {
     findings: normalizeFindings(scan),
     engineVersion: PKG_VERSION,
@@ -6224,7 +6246,8 @@ async function cmdDataflowWatch(args) {
   // uncached provenance-resolution cost on every edit), while every OTHER
   // state write named above stays fully suppressed. Do not "simplify" this
   // back to a bare runScan call.
-  const seed = await withStateWritesDisabled(() => runScan(targetAbs, {}), { exceptCategories: ['provenance-cache'] });
+  const seed = await withStateWritesDisabled(() => runScan(targetAbs, { onProgress: scanProgressReporter() }), { exceptCategories: ['provenance-cache'] });
+  clearScanProgressLine();
   if (!seed.scan.lineageGraph) {
     process.stderr.write(`agentic-security dataflow watch: seed scan produced no data-flow graph (${_lineageStatusReason(seed.scan.lineageStatus)}) — nothing to watch/diff against.\n`);
     return 1;
@@ -6266,7 +6289,8 @@ async function cmdDataflowWatch(args) {
       return;
     }
     try {
-      const { scan } = await withStateWritesDisabled(() => runScan(targetAbs, {}), { exceptCategories: ['provenance-cache'] });
+      const { scan } = await withStateWritesDisabled(() => runScan(targetAbs, { onProgress: scanProgressReporter() }), { exceptCategories: ['provenance-cache'] });
+      clearScanProgressLine();
       if (!scan.lineageGraph) {
         process.stderr.write(`[watch-dataflow] rescan produced no data-flow graph (${_lineageStatusReason(scan.lineageStatus)}) — skipping this change.\n`);
         return;