@clear-capabilities/agentic-security-scanner 0.149.4 → 0.150.1

package/dist/1905.index.js

@@ -113,6 +113,10 @@ function partitionCallGraph(callGraph, opts = {}) {
 var discovery_lenses = __webpack_require__(3499);
 // EXTERNAL MODULE: ./src/egress/policy.js
 var policy = __webpack_require__(5712);
+// EXTERNAL MODULE: ./src/llm-validator/providers.js
+var providers = __webpack_require__(8947);
+// EXTERNAL MODULE: ./src/llm-validator/ollama-provider.js
+var ollama_provider = __webpack_require__(3837);
 ;// CONCATENATED MODULE: ./src/discovery/llm-invoke.js
 //
 // Shared LLM endpoint caller. Both the hunter and the refutation panel need
@@ -123,10 +127,65 @@ var policy = __webpack_require__(5712);
 
 
 
+
+
 const DEFAULT_TIMEOUT_MS = 60000;
 
+// agentic-security-ollama-offline-prd.md §32 — hunt is one of the highest-
+// value initial Ollama use cases, and this is the single injected caller both
+// hunter.js and disprove.js already share (per this directory's CLAUDE.md:
+// "no other module may talk to an LLM directly"). Rather than give hunt its
+// own separate provider-resolution copy, `defaultLlmInvoke` now checks
+// `resolveProvider()` FIRST — but only when the caller hasn't already pinned
+// a literal `opts.endpoint` (the multi-endpoint consensus path in this same
+// file does exactly that, one resolved URL per voter, predating the provider
+// abstraction; that path must keep POSTing `{prompt}` to that literal URL
+// exactly as before, so it deliberately skips provider resolution).
+//
+// BACKWARD COMPATIBILITY: for every existing deployment that sets
+// AGENTIC_SECURITY_LLM_ENDPOINT with no PRESET, resolveProvider() resolves
+// that to `provider: 'byo'`, not `'ollama'` — so this function falls straight
+// through to the untouched raw-fetch path below, byte-identical to before.
+// Only `PRESET=ollama` takes the new branch. `'hunt'` is passed as the role
+// deliberately: it is not a member of providers.js's ROLES set, so
+// `resolveProvider` never picks up a role-specific override
+// (AGENTIC_SECURITY_LLM_MODEL_VALIDATE etc.) that was never meant to apply
+// to a hunt call — only the global AGENTIC_SECURITY_LLM_PRESET/_MODEL.
 async function defaultLlmInvoke(prompt, opts = {}) {
   const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : DEFAULT_TIMEOUT_MS;
+
+  if (!opts.endpoint) {
+    const resolved = (0,providers.resolveProvider)({ role: opts.role || 'hunt' });
+    // A REFUSAL (a preset was explicitly configured and declined — e.g. a
+    // non-loopback Ollama host, or `local`'s own non-loopback refusal) must
+    // propagate here, not silently fall through to the legacy raw-endpoint
+    // path below. Falling through would mean a refused `ollama`/`local`
+    // config could still reach a network call via a leftover
+    // AGENTIC_SECURITY_LLM_ENDPOINT — exactly the bypass PRD §23.2 exists to
+    // prevent. `resolved.reason` is non-null ONLY for a genuine refusal;
+    // "nothing configured" always carries `reason: null` (providers.js).
+    if (!resolved.ok && resolved.reason) throw new Error(resolved.reason);
+    if (resolved.ok && resolved.config.provider === 'ollama') {
+      const oc = resolved.config.ollama;
+      const r = await (0,ollama_provider/* callOllamaChat */.L5)({
+        host: resolved.config.endpoint,
+        model: resolved.config.model,
+        messages: [{ role: 'user', content: prompt }],
+        keepAlive: oc?.keepAlive,
+        timeouts: oc
+          ? { connectTimeoutMs: oc.connectTimeoutMs, requestTimeoutMs: oc.requestTimeoutMs }
+          : { connectTimeoutMs: 3000, requestTimeoutMs: timeoutMs },
+      });
+      // PRD §23.4: never fall back to a cloud provider on failure — throwing
+      // here is exactly what the pre-existing raw-fetch path already does on
+      // a non-2xx/network error, and both hunter.js and disprove.js already
+      // treat a thrown/rejected llmInvoke as "this voter did not answer",
+      // never as "try something else".
+      if (!r.ok) throw new Error(`ollama ${r.code}: ${r.reason || 'request failed'}`);
+      return r.result.text;
+    }
+  }
+
   // The URL is the operator's own configured endpoint, read from an environment
   // variable they set. Reaching it is this module's entire purpose; no
   // request-controlled input exists anywhere on this path, and an operator who
@@ -275,6 +334,28 @@ function resolveLlmInvokeWithDecision(opts = {}) {
     return { invoke, decision, decisions };
   }
 
+  // ollama-offline-prd.md §32: PRESET=ollama is a configured provider even
+  // when no raw AGENTIC_SECURITY_LLM_ENDPOINT is set — resolve it the exact
+  // same way llm-validator/index.js's endpointConfig() does, so hunt gets
+  // the SAME egress-evaluated-before-any-call treatment every other
+  // configured provider already gets here (this function's whole reason to
+  // exist, per the block comment above). Checked BEFORE the legacy
+  // raw-endpoint fallback below, matching providers.js's own precedence
+  // (ollama/local checked before a bare BYO endpoint).
+  const resolved = (0,providers.resolveProvider)({ role: opts.role || 'hunt' });
+  if (!resolved.ok && resolved.reason) {
+    // A REFUSAL (non-loopback ollama/local, explicitly configured and
+    // declined) is itself a policy decision — same shape as an egress
+    // denial below, so callers' existing "read .reason when invoke is
+    // null" handling covers it without a new branch on their side.
+    return { invoke: null, decision: { allowed: false, reason: resolved.reason } };
+  }
+  if (resolved.ok && resolved.config.provider === 'ollama') {
+    const decision = (0,policy/* evaluateEgress */.nn)({ scanRoot: opts.scanRoot, purpose: opts.purpose || 'discovery', endpoint: resolved.config.endpoint, provider: 'ollama' });
+    if (!decision.allowed) return { invoke: null, decision };
+    return { invoke: (prompt) => defaultLlmInvoke(prompt, { timeoutMs: opts.timeoutMs, role: opts.role }), decision };
+  }
+
   const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
   if (!endpoint) return { invoke: null, decision: null };
 
@@ -369,7 +450,16 @@ async function runHunter(focusArea, lens, ctx = {}, opts = {}) {
   const transcript = [];
   const lensKey = lens?.key || 'unknown';
   const base = { focusAreaId: focusArea.id, lens: lensKey, transcript };
-  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, purpose: 'discovery-hunter' });
+  // ollama-offline-prd.md §32 — "permit each refutation-panel member to be a
+  // separately configured local model" extends naturally to the hunter's own
+  // lenses: the `business-logic` lens is exactly the PRD's `logic` role
+  // ("cross-file business-logic reasoning"), so it alone routes through
+  // role='logic' (honoring AGENTIC_SECURITY_LLM_MODEL_LOGIC) while every
+  // other lens keeps the existing role='hunt' default — a caller-supplied
+  // `opts.role` still wins over both, same precedence resolveProvider
+  // already documents.
+  const role = opts.role || (lensKey === 'business-logic' ? 'logic' : 'hunt');
+  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, role, purpose: 'discovery-hunter' });
 
   if (typeof llmInvoke !== 'function') {
     // FR-601: distinguish "policy denied a configured endpoint" from "nothing
@@ -520,7 +610,12 @@ async function disproveCandidate(candidate, opts = {}) {
   // missing endpoint always has, so it falls straight into this module's own
   // pre-existing rule — "silence never refutes" — with zero votes cast and no
   // prompt ever built for a denied endpoint.
-  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, purpose: 'discovery-disprove' });
+  // ollama-offline-prd.md §32 — the refutation panel is the PRD's `verify`
+  // role ("adversarial verification"): route it through role='verify' by
+  // default so AGENTIC_SECURITY_LLM_MODEL_VERIFY applies, same precedence
+  // (a caller-supplied opts.role still wins) hunter.js's lens routing uses.
+  const role = opts.role || 'verify';
+  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, role, purpose: 'discovery-disprove' });
 
   const votes = [];
   if (typeof llmInvoke === 'function') {

package/dist/4399.index.js

@@ -0,0 +1,266 @@
+export const id = 4399;
+export const ids = [4399];
+export const modules = {
+
+/***/ 4399:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   MEMORY_PROFILES: () => (/* binding */ MEMORY_PROFILES),
+/* harmony export */   capabilitiesFromFamilyHint: () => (/* binding */ capabilitiesFromFamilyHint),
+/* harmony export */   classifyModelFamily: () => (/* binding */ classifyModelFamily),
+/* harmony export */   detectMemoryTier: () => (/* binding */ detectMemoryTier),
+/* harmony export */   detectSystemMemory: () => (/* binding */ detectSystemMemory),
+/* harmony export */   recommendAdmission: () => (/* binding */ recommendAdmission)
+/* harmony export */ });
+/* unused harmony exports KNOWN_MODEL_SIZE_GB, evaluateMemoryAdmission */
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(8161);
+// Model family hints, RAM-aware memory profiles, and the memory-admission
+// check for the Ollama provider (agentic-security-ollama-offline-prd.md
+// §13, §14, §15, §22.3, §30).
+//
+// FAMILY HINTS ARE DEFAULTS, NEVER AUTHORITY (PRD §12/§13). A name like
+// `gemma4:e2b` tells us nothing Ollama itself won't confirm — it only lets the
+// harness suggest a sane default before any network call. If a model actually
+// installed under a family-hinted name lacks a capability the hint implied,
+// the runtime probe (model-probe.js, added when tool-calling/structured-output
+// probing lands) always wins. This module only classifies and estimates; it
+// never asserts a capability is present.
+//
+// MEMORY NUMBERS ARE ESTIMATES, NOT PROMISES (PRD §22.3, §14.1). Ollama
+// artifact sizes and this module's headroom reserves are best-effort figures
+// sourced from what Ollama currently publishes; they exist so the harness can
+// fail BEFORE an OS-level OOM, not so it can claim an exact answer. Every
+// admission decision leaves a stated safety margin rather than trying to pack
+// memory to the byte.
+
+
+
+// PRD §12/§13 FR-1203 — non-authoritative family hint from a model name.
+// Longest/most-specific pattern first so `qwen3.5:4b` doesn't fall through to
+// the bare `qwen` bucket.
+const FAMILY_PATTERNS = [
+  [/^qwen3\.5/i, 'qwen3.5'],
+  [/^qwen3-coder-next/i, 'qwen3-coder-next'],
+  [/^qwen3-coder/i, 'qwen3-coder'],
+  [/^qwen2\.5-coder/i, 'qwen2.5-coder'],
+  [/^qwen3/i, 'qwen3'],
+  [/^qwen/i, 'qwen'],
+  [/^gemma4/i, 'gemma4'],
+  [/^functiongemma/i, 'functiongemma'],
+  [/^gemma3/i, 'gemma3'],
+  [/^gemma/i, 'gemma'],
+];
+
+/** Non-authoritative family classification for defaults/messaging only. */
+function classifyModelFamily(modelName) {
+  const name = String(modelName || '').trim();
+  for (const [re, family] of FAMILY_PATTERNS) if (re.test(name)) return family;
+  return 'unknown';
+}
+
+// PRD §13.1 — non-authoritative defaults per family, overridden by any real
+// runtime probe result (model-probe.js). `tools`/`structuredJson`/`thinking`
+// are 'unknown' where Ollama's own behavior varies by specific tag/quant
+// rather than by family alone.
+const FAMILY_CAPABILITY_HINTS = {
+  'qwen3.5': { chat: true, structuredJson: true, tools: true, thinking: 'unknown' },
+  qwen3: { chat: true, structuredJson: true, tools: true, thinking: 'unknown' },
+  'qwen3-coder': { chat: true, structuredJson: true, tools: true, thinking: false },
+  'qwen3-coder-next': { chat: true, structuredJson: true, tools: true, thinking: false },
+  'qwen2.5-coder': { chat: true, structuredJson: true, tools: 'unknown', thinking: false },
+  qwen: { chat: true, structuredJson: 'unknown', tools: 'unknown', thinking: 'unknown' },
+  gemma4: { chat: true, structuredJson: true, tools: true, thinking: 'unknown' },
+  functiongemma: { chat: true, structuredJson: 'unknown', tools: true, thinking: false },
+  gemma3: { chat: true, structuredJson: true, tools: false, thinking: false },
+  gemma: { chat: true, structuredJson: 'unknown', tools: 'unknown', thinking: 'unknown' },
+  unknown: { chat: true, structuredJson: 'unknown', tools: 'unknown', thinking: 'unknown' },
+};
+
+/**
+ * Build the PRD §13.1 ModelCapabilities object from a family hint alone
+ * (Layer B). Layer A (Ollama's own /api/show metadata) and Layer C (runtime
+ * probes) are applied by the caller and override these fields — this
+ * function only ever sets `source.familyHint: true`.
+ */
+function capabilitiesFromFamilyHint(modelName) {
+  const family = classifyModelFamily(modelName);
+  const hint = FAMILY_CAPABILITY_HINTS[family] || FAMILY_CAPABILITY_HINTS.unknown;
+  return {
+    chat: hint.chat,
+    structuredJson: hint.structuredJson,
+    tools: hint.tools,
+    thinking: hint.thinking,
+    vision: false,
+    contextTokens: undefined,
+    source: { metadata: false, familyHint: true, runtimeProbe: false },
+  };
+}
+
+// ── RAM-aware memory profiles (PRD §14.4, §15.2, §22.3, §30) ───────────────
+
+const MB = 1024 * 1024;
+const GB = 1024 * MB;
+
+// Best-effort artifact sizes as currently distributed by Ollama, used only to
+// pick a SENSIBLE STARTING recommendation — the real admission decision below
+// uses actually-free memory, not this table. Keep in sync with the PRD's own
+// cited figures; a stale entry only affects the suggested default, never the
+// admission math (which reads real os.freemem()).
+const KNOWN_MODEL_SIZE_GB = Object.freeze({
+  'qwen3.5:2b': 1.7,
+  'qwen3.5:4b': 3.4,
+  'qwen3.5:9b': 6.6,
+  'gemma4:e2b': 7.2,
+  'gemma4:12b': 7.6,
+  'gemma4:latest': 9.6,
+});
+
+/** PRD §30 profile presets. `auto` picks between these by detected RAM. */
+const MEMORY_PROFILES = Object.freeze({
+  '8gb': {
+    label: '8gb',
+    preferredModel: 'qwen3.5:4b',
+    fallbackModel: 'qwen3.5:2b',
+    initialContextTokens: 4096,
+    targetContextTokens: 8192,
+    maxConcurrency: 1,
+    minFreeRamMb: 1536,
+  },
+  '16gb-qwen': {
+    label: '16gb-qwen',
+    preferredModel: 'qwen3.5:9b',
+    fallbackModel: 'qwen3.5:4b',
+    initialContextTokens: 16384,
+    targetContextTokens: 32768,
+    maxConcurrency: 1,
+    minFreeRamMb: 2048,
+  },
+  '16gb-gemma': {
+    label: '16gb-gemma',
+    preferredModel: 'gemma4:e2b',
+    fallbackModel: 'qwen3.5:4b',
+    initialContextTokens: 8192,
+    targetContextTokens: 16384,
+    maxConcurrency: 1,
+    minFreeRamMb: 2048,
+  },
+});
+
+/**
+ * PRD §22.3 — detect total/available system RAM. Thin wrapper over `os` so
+ * tests can inject fake values without mocking the `os` module globally.
+ */
+function detectSystemMemory({ totalBytes, freeBytes } = {}) {
+  return {
+    totalBytes: Number.isFinite(totalBytes) ? totalBytes : node_os__WEBPACK_IMPORTED_MODULE_0__.totalmem(),
+    freeBytes: Number.isFinite(freeBytes) ? freeBytes : node_os__WEBPACK_IMPORTED_MODULE_0__.freemem(),
+  };
+}
+
+/**
+ * Pick the RAM tier ('8gb' | '16gb') a machine falls into. Anything under
+ * ~9 GB total is treated as the 8 GB tier — real "8 GB" machines report
+ * slightly less than 8*1024^3 bytes to userspace (firmware/GPU reservations),
+ * so a hard `< 8*GB` cutoff would misclassify real 8 GB hardware as unknown.
+ */
+function detectMemoryTier(totalBytes) {
+  if (!Number.isFinite(totalBytes) || totalBytes <= 0) return 'unknown';
+  if (totalBytes < 9 * GB) return '8gb';
+  return '16gb';
+}
+
+/**
+ * PRD §22.3 admission algorithm: does `contextTokens` at `model` fit in
+ * currently-free memory with the configured reserve intact?
+ *
+ * This is deliberately conservative and coarse (PRD "avoid pretending memory
+ * estimates are exact"): model residency is estimated from KNOWN_MODEL_SIZE_GB
+ * when available (falling back to a pessimistic 8 GB assumption for an
+ * unrecognized tag so an unknown model never LOOKS safer than a known large
+ * one), and KV-cache growth is approximated as a fixed per-1K-token cost
+ * rather than modeled per-architecture — real KV cache size depends on layer
+ * count/head count/quantization the harness cannot know without Ollama's own
+ * runtime numbers.
+ */
+const ESTIMATED_KV_CACHE_MB_PER_1K_TOKENS = 32; // conservative, model-independent approximation
+const RUNTIME_OVERHEAD_MB = 512; // Ollama server + OS scheduler slack, independent of model size
+
+function evaluateMemoryAdmission({
+  modelName,
+  contextTokens,
+  freeBytes,
+  minFreeRamMb,
+  modelSizeGb,
+} = {}) {
+  const sizeGb = Number.isFinite(modelSizeGb) ? modelSizeGb : (KNOWN_MODEL_SIZE_GB[modelName] ?? 8);
+  const modelMb = sizeGb * 1024;
+  const kvCacheMb = (Number(contextTokens) || 0) / 1000 * ESTIMATED_KV_CACHE_MB_PER_1K_TOKENS;
+  const requiredMb = modelMb + kvCacheMb + RUNTIME_OVERHEAD_MB + (Number(minFreeRamMb) || 0);
+  const freeMb = (Number(freeBytes) || 0) / MB;
+  const admitted = freeMb >= requiredMb;
+  return {
+    admitted,
+    freeMb: Math.round(freeMb),
+    requiredMb: Math.round(requiredMb),
+    modelEstimateMb: Math.round(modelMb),
+    kvCacheEstimateMb: Math.round(kvCacheMb),
+    reserveMb: Number(minFreeRamMb) || 0,
+  };
+}
+
+/**
+ * Full recommendation flow (PRD §22 "Memory admission algorithm"):
+ * try the profile's preferred context, shrink it, then fall back to the
+ * profile's smaller model, before ever declaring the profile unusable.
+ * Never recommends cloud — the worst outcome this function can return is
+ * `{admitted:false}` with a human-readable explanation, which callers treat
+ * as "run deterministic-only" (PRD §23.4).
+ */
+function recommendAdmission({ profile, freeBytes, requestedContextTokens, requestedModel } = {}) {
+  const p = MEMORY_PROFILES[profile];
+  if (!p) return { admitted: false, reason: `unknown memory profile '${profile}'` };
+
+  const model = requestedModel || p.preferredModel;
+  const attempts = [];
+
+  // 1. Requested (or target) context at the requested/preferred model.
+  const primaryContext = Number.isFinite(requestedContextTokens) ? requestedContextTokens : p.targetContextTokens;
+  let check = evaluateMemoryAdmission({ modelName: model, contextTokens: primaryContext, freeBytes, minFreeRamMb: p.minFreeRamMb });
+  attempts.push({ model, contextTokens: primaryContext, ...check });
+  if (check.admitted) return { admitted: true, model, contextTokens: primaryContext, attempts };
+
+  // 2. Reduce context to the profile's conservative initial value first —
+  //    PRD FR-2104: "shrink context before declaring an otherwise compatible
+  //    model unusable."
+  if (primaryContext !== p.initialContextTokens) {
+    check = evaluateMemoryAdmission({ modelName: model, contextTokens: p.initialContextTokens, freeBytes, minFreeRamMb: p.minFreeRamMb });
+    attempts.push({ model, contextTokens: p.initialContextTokens, ...check });
+    if (check.admitted) return { admitted: true, model, contextTokens: p.initialContextTokens, attempts, reducedContext: true };
+  }
+
+  // 3. Fall back to the profile's smaller model at its initial context.
+  if (p.fallbackModel && p.fallbackModel !== model) {
+    check = evaluateMemoryAdmission({ modelName: p.fallbackModel, contextTokens: p.initialContextTokens, freeBytes, minFreeRamMb: p.minFreeRamMb });
+    attempts.push({ model: p.fallbackModel, contextTokens: p.initialContextTokens, ...check });
+    if (check.admitted) {
+      return {
+        admitted: true, model: p.fallbackModel, contextTokens: p.initialContextTokens, attempts,
+        reducedContext: true, fellBackToSmallerModel: true,
+      };
+    }
+  }
+
+  // 4. Nothing fits — deterministic-only, never cloud.
+  return {
+    admitted: false,
+    attempts,
+    reason: `No local model/context combination fit in available memory with the configured reserve. ` +
+      `Recommend deterministic-only scanning, or free memory before retrying.`,
+  };
+}
+
+
+/***/ })
+
+};