@clear-capabilities/agentic-security-scanner 0.154.0 → 0.155.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-e460f63891e70f53f1a0d6061a5393cc92c5ade0ddde80bd8bfaf8eb00dbb849  agentic-security.mjs
+5b1c3482deb6bf15eb606402755278ad1e04a5b2e8b12c5b5246c5dcd4028b50  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.154.0",
+  "version": "0.155.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -81,12 +81,12 @@
     "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
     "test:haskell": "node --test test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js",
     "test:nix": "node --test test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js",
-    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js",
+    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js test/language/language-trust-boundary.test.js",
     "test:language-stress": "node --test --test-concurrency=1 test/language/language-stress-offline.test.js",
     "test:language-tools": "node --test test/haskell/haskell-web-auth.test.js test/haskell/haskell-support-gate.test.js",
     "bench:language-support:check": "node ../bench/language-support/check.mjs",
     "bench:language-support:perf": "node ../bench/language-support/perf.mjs",
-    "test:lifecycle": "node --test test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs",
+    "test:lifecycle": "node --test test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
@@ -199,10 +199,12 @@
     "test:ci-parity": "CI=true GITHUB_ACTIONS=true node --test test/backward-default.test.js test/ci-parity.test.js test/container-taint.test.js test/deep-taint.test.js test/engine-recall.test.js test/engine-reconnect.test.js test/gate-verdict-cache.test.js test/ignore-pragma.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/py-annotation-sources.test.js test/runscan-deep-option.test.js test/sanitizer-typed-flow.test.js",
     "docs:render-language": "node ../scripts/render-language-docs.mjs",
     "docs:capture-language": "node ../scripts/capture-language-examples.mjs",
+    "completion-status": "node ../scripts/write-completion-status.mjs",
     "docs:check-language": "node ../scripts/render-language-docs.mjs --check && node ../scripts/capture-language-examples.mjs --check",
     "test:nixos-host": "node --test test/nix/nixos-host-runtime.test.js",
     "test:language-gates": "node --test --test-concurrency=1 test/language/language-benchmark-gates.test.js",
-    "test:language-slow": "node --test --test-concurrency=1 test/language/language-doc-examples-metrics.test.js test/language/language-end-to-end.test.js test/language/language-package-ci.test.js test/language/language-scan-modes.test.js"
+    "test:language-slow": "node --test --test-concurrency=1 test/language/language-doc-examples-metrics.test.js test/language/language-end-to-end.test.js test/language/language-package-ci.test.js test/language/language-scan-modes.test.js",
+    "test:chrome": "AGENTIC_SECURITY_CHROME_TESTS=1 node --test test/export-image.test.js test/server/cmd-dataflow-export.test.js"
   },
   "author": "Ross Young <ross@clearcapabilities.com>",
   "license": "PolyForm-Internal-Use-1.0.0",

package/src/engine.js

@@ -9228,7 +9228,7 @@ function _deterministicFileTimings(timings) {
   const annotatedComponents=components.map(c=>{const key=`${c.ecosystem}:${c.name}:${c.version}`;const vulns=vulnsByKey[key]||[];const riKey=c.ecosystem==='maven'&&c.group?`maven:${c.group}/${c.name}`:`${c.ecosystem}:${c.name}`;const ri=registryInfo.get(riKey)||{};const latestVersion=ri.latestVersion||'';const vd=(ri.versions||{})[c.version]||{};const isDeprecated=typeof vd.deprecated==='string'&&vd.deprecated.length>0;const deprecationMessage=isDeprecated?vd.deprecated:'';const isOutdated=!isDeprecated&&typeof vd.outdated==='string'&&vd.outdated.length>0;const outdatedMessage=isOutdated?vd.outdated:'';const license=ri.license||vd.license||'';return{...c,vulns,hasVulns:vulns.length>0,hasAttackPath:attackResult.flagged.has(key),attackPaths:attackResult.pathsByKey.get(key)||[],latestVersion,isDeprecated,deprecationMessage,isOutdated,outdatedMessage,license};});
   // X-010: Hackage and Nix components, dependency edges and target provenance. Kept beside (not inside) the ordinary
   // component list so the existing consumers are untouched; the BOM emitters and the SBOM diff read it explicitly.
-  let _languageBom=null;try{if(Object.keys(allFileContents).some(f=>/\.(?:l?hs|nix)$|\.cabal$|(?:^|\/)(?:cabal\.project(?:\.freeze)?|package\.yaml|stack\.yaml(?:\.lock)?|flake\.lock)$/i.test(f))){const{languageBom}=await import('./language/bom.js');const{resolvedHaskellGraph,nixClosureOf}=await import('./language/resolved-pass.js');const _rg=resolvedHaskellGraph(allFileContents);const _nc=nixClosureOf(allFileContents);_languageBom=languageBom(allFileContents,{...(_rg?{resolved:_rg.graph}:{}),...(_nc?{closure:_nc.closure}:{})});}}catch(_){_languageBom=null;}
+  let _languageBom=null;try{if(Object.keys(allFileContents).some(f=>/\.(?:l?hs|nix)$|\.cabal$|(?:^|\/)(?:cabal\.project(?:\.freeze)?|package\.yaml|stack\.yaml(?:\.lock)?|flake\.lock)$/i.test(f))){const{languageBom}=await import('./language/bom.js');const{resolvedHaskellGraph,nixClosureOf}=await import('./language/resolved-pass.js');const _rg=resolvedHaskellGraph(allFileContents);const _nc=nixClosureOf(allFileContents);_languageBom=languageBom(allFileContents,{...(_rg?{resolved:_rg.graph}:{}),...(_nc&&!_nc.refused.length?{closure:_nc.closure}:{})});}}catch(_){_languageBom=null;}
   aF.push(...(runDetector(_detectorErrors,'<project>','scanDbTaintCrossFile',()=>scanDbTaintCrossFile(fc))||[]));
   aF.push(...(runDetector(_detectorErrors,'<project>','scanCsharpCrossFile',()=>scanCsharpCrossFile(fc))||[]));
   // SARD_80_F1 W5.41/W5.42 — unlike the ADD-only cross-file passes above,
@@ -11038,7 +11038,7 @@ function _deterministicFileTimings(timings) {
       _languageCoverage = (await assessLanguageAssurance({
         files: allFileContents, findings: finalFindings, timeoutMs: Number(env.AGENTIC_SECURITY_LANG_TIMEOUT_MS) || 0,
         disabled: [...String(env.AGENTIC_SECURITY_LANG_DISABLE || '').split(',').map(x => x.trim()).filter(Boolean), ...((_hasHaskellSource && !_deepEnabled) ? ['haskell:taint'] : [])],
-        advisoryDb: configuredAdvisoryDb(scanRoot).db,
+        ...(() => { const a = configuredAdvisoryDb(scanRoot); return { advisoryDb: a.db, advisoryReason: a.db ? null : a.reason }; })(),
         policyExcluded,
         sizeSkipped,
         supplyGaps: _languageSupplyGaps,

package/src/language/assurance.js

@@ -134,14 +134,14 @@ export async function assessLanguageAssurance(input = {}) {
   const scaRequired = (required.haskell || []).includes('sca') && !disabled.has('haskell:sca');
   if (present.has('haskell') && scaRequired && manifests.length) {
     const db = input.advisoryDb;
-    if (!db) conditions.push('no Hackage advisory snapshot is loaded: Haskell dependency vulnerabilities were not assessed');
+    if (!db) conditions.push(`no Hackage advisory snapshot is loaded: Haskell dependency vulnerabilities were not assessed${input.advisoryReason ? `. ${input.advisoryReason}` : ''}`);
     else if (db.stale) conditions.push(`the Hackage advisory snapshot is stale (${db.ageDays == null ? 'age unknown' : `${Math.floor(db.ageDays)} day(s) old`}, limit ${db.maxAgeDays})`);
   }
 
   // 3b. resolved dependency data and the Nix closure: a stale, malformed or unchecked input is stated, never silently dropped
   for (const g of input.supplyGaps || []) {
     if (!g || !g.kind) continue;
-    if (/unavailable|stale|malformed|failed|unverified/.test(g.kind)) conditions.push(`${g.kind.replace(/^(?:resolved|closure)-/, '')}: ${String(g.detail || '').slice(0, 220)}`);
+    if (/unavailable|stale|malformed|failed|unverified|refused|contradicts/.test(g.kind)) conditions.push(`${g.kind.replace(/^(?:resolved|closure)-/, '')}: ${String(g.detail || '').slice(0, 220)}`);
     else limitations.push({ kind: 'supply-gap', gap: g.kind, note: String(g.detail || '').slice(0, 220) });
   }
 

package/src/language/haskell-supply.js

@@ -1,8 +1,8 @@
 // Haskell supply-chain orchestration for a project (HS-009): manifests -> components -> advisories + policy.
 // The pure logic lives in haskell-sca.js; this module only gathers inputs and shapes supply-chain entries.
 
-import { statePath } from '../posture/state-dir.js';
-import { readFileSync, existsSync } from 'node:fs';
+import { resolveOperatorSnapshot, IGNORED_NOTE } from './trusted-inputs.js';
+import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { analyzeHaskellManifests } from './haskell-manifests.js';
 import { buildHaskellIR } from './haskell-ir.js';
@@ -62,12 +62,12 @@ function mergeResolved(declared, resolved) {
 
 /** Advisory data configured for this scan: a hash-pinned snapshot from the environment or the project's state dir. */
 export function configuredAdvisoryDb(root, env = process.env) {
-  const path = env.AGENTIC_SECURITY_HACKAGE_ADVISORIES || (root && existsSync(statePath(root, 'hackage-advisories.json')) ? statePath(root, 'hackage-advisories.json') : null);
-  if (!path) return { db: null, reason: 'no advisory snapshot configured (set AGENTIC_SECURITY_HACKAGE_ADVISORIES or provide the hackage-advisories.json snapshot in the project state directory)' };
+  const sel = resolveOperatorSnapshot({ envVar: 'AGENTIC_SECURITY_HACKAGE_ADVISORIES', fileName: 'hackage-advisories.json', root, env });
+  if (!sel.path) return { db: null, reason: `no advisory snapshot configured (set AGENTIC_SECURITY_HACKAGE_ADVISORIES, or place hackage-advisories.json in the operator configuration directory, agentic-security under XDG_CONFIG_HOME)${sel.projectLocalIgnored ? IGNORED_NOTE('hackage-advisories.json') : ''}`, projectLocalIgnored: !!sel.projectLocalIgnored };
   let snap;
-  try { snap = JSON.parse(readFileSync(path, 'utf8')); } catch (e) { return { db: null, reason: `advisory snapshot unreadable: ${e.code || e.message}` }; }
+  try { snap = JSON.parse(readFileSync(sel.path, 'utf8')); } catch (e) { return { db: null, reason: `advisory snapshot unreadable: ${e.code || e.message}` }; }
   const r = loadAdvisorySnapshot(snap, { pinnedSha256: env.AGENTIC_SECURITY_HACKAGE_ADVISORIES_SHA256 || null });
-  return r.ok ? { db: r.db, reason: null } : { db: null, reason: `advisory snapshot refused: ${r.reason}` };
+  return r.ok ? { db: r.db, reason: null, source: sel.source } : { db: null, reason: `advisory snapshot refused: ${r.reason}` };
 }
 
 /** Imports and import-qualified callees across the project's Haskell sources. */

package/src/language/resolved-pass.js

@@ -10,8 +10,9 @@
 //
 // Nothing here fetches, builds, evaluates or runs a project's code unless the evaluation is selected AND the sandbox proves its isolation.
 
-import { readFileSync, existsSync } from 'node:fs';
-import { statePath } from '../posture/state-dir.js';
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { resolveOperatorSnapshot, IGNORED_NOTE } from './trusted-inputs.js';
 import { analyzeHaskellManifests } from './haskell-manifests.js';
 import { buildResolvedGraph } from './haskell-resolved-graph.js';
 import { importNixClosure } from './nix-closure.js';
@@ -58,6 +59,12 @@ export function resolvedHackageComponents(files) {
   const gaps = (g.gaps || []).map((x) => ({ kind: `resolved-${x.kind}`, detail: x.detail || x.message || x.kind, file: r.file }));
   const summary = { file: r.file, source: g.source, graphAvailable: g.graphAvailable, freshness: g.freshness, closure: g.closure, units: g.units ? g.units.length : null, edges: g.edges ? g.edges.length : null };
   if (!g.graphAvailable || g.freshness.status === 'stale') return { components: [], gaps, summary };
+  // The plan is a file in the scanned project. Where the project's own freeze file also pins a package, the two must agree: a plan that
+  // contradicts the freeze is stale or forged, and contributes no versions.
+  const frozen = new Map(((r.manifests && r.manifests.lockedPackages) || []).filter((l) => l.name && l.version).map((l) => [l.name, l.version]));
+  const clashes = (g.units || []).filter((u) => u.name && u.version && frozen.has(u.name) && frozen.get(u.name) !== u.version).map((u) => `${u.name} ${u.version} (plan) vs ${frozen.get(u.name)} (freeze)`);
+  if (clashes.length) { gaps.push({ kind: 'resolved-stale-plan-contradicts-freeze', detail: `the plan contradicts the freeze file (${clashes.slice(0, 3).join('; ')}): it is stale or forged, so no version was taken from it`, file: r.file }); return { components: [], gaps, summary }; }
+  gaps.push({ kind: 'resolved-project-supplied-plan', detail: 'the plan is a file in the scanned project: it is checked against the declared bounds and the freeze file, but whoever controls the project controls its contents', file: r.file });
   const SCOPE = { runtime: 'required', test: 'optional', benchmark: 'optional', setup: 'optional', 'build-tool': 'optional' };
   const direct = new Set((g.declared || []).map((d) => d.name));
   const components = [];
@@ -71,24 +78,39 @@ export function resolvedHackageComponents(files) {
 }
 
 // ── Nix closure ──────────────────────────────────────────────────────────────────
-function loadNixExports(files) {
-  const exports = []; const sources = []; const problems = []; let expected = {};
-  for (const p of Object.keys(files).filter((x) => NIX_EXPORT.test(x)).sort()) {
-    const parsed = parseJson(files[p]);
-    sources.push(p);
-    if (!parsed.ok) { problems.push({ kind: 'malformed-export', file: p, detail: parsed.reason }); continue; }
+function loadNixExports(files, env = process.env) {
+  const exports = []; const sources = []; const problems = []; const trust = new Set();
+  const take = (label, text, origin) => {
+    sources.push(label);
+    const parsed = parseJson(text);
+    if (!parsed.ok) { problems.push({ kind: 'malformed-export', file: label, detail: parsed.reason }); return; }
     const j = parsed.value;
-    if (j && Array.isArray(j.exports)) { exports.push(...j.exports.filter((e) => e && typeof e === 'object')); if (j.expected && typeof j.expected === 'object') expected = { ...expected, ...j.expected }; }
+    trust.add(origin);
+    // NOTE: an `expected` block inside the file is IGNORED. The file is the thing under test, so it cannot also say what it should be
+    // checked against; what an export must match is derived by the scanner (below) or comes from the operator.
+    if (j && Array.isArray(j.exports)) exports.push(...j.exports.filter((e) => e && typeof e === 'object'));
     else if (j && typeof j === 'object' && j.schema && (j.data !== undefined || j.text !== undefined)) exports.push(j);
-    else exports.push({ text: files[p] });
+    else exports.push({ text });
+  };
+  if (env.AGENTIC_SECURITY_NIX_EXPORT) {
+    try { take(env.AGENTIC_SECURITY_NIX_EXPORT, readFileSync(env.AGENTIC_SECURITY_NIX_EXPORT, 'utf8'), 'operator'); }
+    catch (e) { sources.push(env.AGENTIC_SECURITY_NIX_EXPORT); problems.push({ kind: 'malformed-export', file: env.AGENTIC_SECURITY_NIX_EXPORT, detail: `unreadable: ${e.code || e.message}` }); }
   }
-  return { exports, sources, problems, expected };
+  for (const p of Object.keys(files).filter((x) => NIX_EXPORT.test(x)).sort()) take(p, files[p], 'project-supplied');
+  // What the export must have been made against: the real flake.lock of this project (a forged export cannot also forge that file's hash
+  // without the lock it claims to describe being the lock that is here).
+  const expected = {};
+  const lockPath = Object.keys(files).filter((p) => /(^|\/)flake\.lock$/.test(p)).sort((a, b) => a.length - b.length)[0];
+  if (lockPath) expected.flakeLockSha256 = createHash('sha256').update(files[lockPath]).digest('hex');
+  else if (sources.length) problems.push({ kind: 'export-unverified', detail: 'there is no flake.lock to bind the export to, so it cannot be shown to describe this project' });
+  if (env.AGENTIC_SECURITY_NIX_EXPORT_PUBKEY) { try { expected.publicKeyPem = readFileSync(env.AGENTIC_SECURITY_NIX_EXPORT_PUBKEY, 'utf8'); expected.requireSigned = true; } catch { problems.push({ kind: 'malformed-export', detail: 'the configured export public key is unreadable' }); } }
+  return { exports, sources, problems, expected, trust: [...trust] };
 }
 
 /** The imported closure (and each derivation's env block) for a file set, or null when there is no export. Cached per file set. */
 export function nixClosureOf(files, { now = Date.now() } = {}) {
   return memoized(files, 'nix-closure', () => {
-    const { exports, sources, problems, expected } = loadNixExports(files);
+    const { exports, sources, problems, expected, trust } = loadNixExports(files);
     if (!sources.length) return null;
     const closure = importNixClosure({ exports, expected, now });
     const drvEnv = {};
@@ -97,15 +119,19 @@ export function nixClosureOf(files, { now = Date.now() } = {}) {
       let data = ex.data; if (data === undefined && typeof ex.text === 'string') { const p = parseJson(ex.text); data = p.ok ? p.value : null; }
       for (const [k, v] of Object.entries(data || {})) if (v && v.env) drvEnv[k] = v.env;
     }
-    return { closure, drvEnv, sources, problems };
+    // A disclosure that says the export does not describe THIS project (another lock, another target, a bad or missing required
+    // signature) means its contents are not evidence about this build: it is refused, not merely labelled.
+    const REFUSE = new Set(['stale-export', 'foreign-target', 'foreign-revision', 'invalid-signature', 'unsigned']);
+    const refused = (closure.disclosures || []).filter((d) => REFUSE.has(d.kind));
+    return { closure, drvEnv, sources, problems, trust, refused };
   });
 }
 
 /** Advisory records for Nix: a snapshot named by AGENTIC_SECURITY_NIX_ADVISORIES or kept in the project state directory. */
 export function configuredNixAdvisories(root, env = process.env, hackageDb = null) {
-  const path = env.AGENTIC_SECURITY_NIX_ADVISORIES || (root && existsSync(statePath(root, 'nix-advisories.json')) ? statePath(root, 'nix-advisories.json') : null);
-  if (!path) return { data: null, reason: 'no Nix advisory snapshot is configured (set AGENTIC_SECURITY_NIX_ADVISORIES or provide nix-advisories.json in the project state directory)' };
-  let snap; try { snap = JSON.parse(readFileSync(path, 'utf8')); } catch (e) { return { data: null, reason: `the Nix advisory snapshot is unreadable: ${e.code || e.message}` }; }
+  const sel = resolveOperatorSnapshot({ envVar: 'AGENTIC_SECURITY_NIX_ADVISORIES', fileName: 'nix-advisories.json', root, env });
+  if (!sel.path) return { data: null, reason: `no Nix advisory snapshot is configured (set AGENTIC_SECURITY_NIX_ADVISORIES, or place nix-advisories.json in the operator configuration directory, agentic-security under XDG_CONFIG_HOME)${sel.projectLocalIgnored ? IGNORED_NOTE('nix-advisories.json') : ''}` };
+  let snap; try { snap = JSON.parse(readFileSync(sel.path, 'utf8')); } catch (e) { return { data: null, reason: `the Nix advisory snapshot is unreadable: ${e.code || e.message}` }; }
   const records = Array.isArray(snap) ? snap : (Array.isArray(snap.records) ? snap.records : []);
   return { data: new NixAdvisoryData({ records, hackage: hackageDb, source: 'pinned-snapshot', generatedAt: (snap && snap.generatedAt) || null }), reason: null };
 }
@@ -121,9 +147,11 @@ function _analyzeNixClosure(files, { scanRoot = null, env = process.env, now = D
   const adv = configuredNixAdvisories(scanRoot, env, hackage);
   let usage = null; try { usage = collectUsage(files); } catch { usage = null; }
   let matched = null;
-  try { matched = matchNixVulnerabilities({ closure: c.closure, drvEnv: c.drvEnv, data: adv.data, overlays: overlayEvidence(files), haskellUsage: usage }); } catch (e) { matched = null; c.problems.push({ kind: 'match-failed', detail: String((e && e.message) || e).slice(0, 160) }); }
+  if (!c.refused.length) try { matched = matchNixVulnerabilities({ closure: c.closure, drvEnv: c.drvEnv, data: adv.data, overlays: overlayEvidence(files), haskellUsage: usage }); } catch (e) { matched = null; c.problems.push({ kind: 'match-failed', detail: String((e && e.message) || e).slice(0, 160) }); }
   const gaps = [];
+  if (c.trust.includes('project-supplied') && !c.trust.includes('operator')) gaps.push({ kind: 'closure-project-supplied', detail: 'the closure export is a file in the scanned project, bound to its flake.lock but not signed: whoever controls the project controls its contents, so the ABSENCE of a finding for a component it lists is not evidence the real build is free of it (provide the export through AGENTIC_SECURITY_NIX_EXPORT, signed with AGENTIC_SECURITY_NIX_EXPORT_PUBKEY, to have it treated as operator evidence)' });
   for (const d of c.closure.disclosures || []) gaps.push({ kind: `closure-${d.kind}`, detail: d.detail });
+  for (const d of c.refused) gaps.push({ kind: `closure-refused-${d.kind}`, detail: `${d.detail}; the export was REFUSED and contributes nothing` });
   for (const p of c.problems) gaps.push({ kind: `closure-${p.kind}`, detail: p.detail, file: p.file });
   if (!adv.data) gaps.push({ kind: 'closure-advisory-feed-unavailable', detail: `${adv.reason}. The closure's components were NOT checked against any advisory: the absence of findings is not a clean result.` });
   else if (adv.data.stale) gaps.push({ kind: 'closure-advisory-feed-stale', detail: `the Nix advisory snapshot is stale or undated (${adv.data.ageDays == null ? 'age unknown' : `${Math.floor(adv.data.ageDays)} day(s) old`})` });

package/src/language/support-registry.js

@@ -24,7 +24,7 @@ export const PAIR_GATE = Object.freeze({ change: 1, preserve: 0.9 });
 export const REQUIRED_CAPABILITIES = Object.freeze({
   haskell: Object.freeze({
     parser: 'parse-fixtures', sast: 'sast-holdout', taint: 'taint-holdout', 'privacy-lineage': 'privacy-holdout',
-    auth: 'test-suite', sca: 'sca-fixtures', bom: 'test-suite', fix: 'fix-fixtures', integration: 'test-suite',
+    auth: 'auth-detection', sca: 'sca-fixtures', bom: 'test-suite', fix: 'fix-fixtures', integration: 'test-suite',
   }),
   nix: Object.freeze({
     parser: 'parse-fixtures', 'config-sast': 'sast-holdout', 'config-taint': 'taint-holdout', 'privacy-lineage': 'privacy-holdout',
@@ -32,6 +32,13 @@ export const REQUIRED_CAPABILITIES = Object.freeze({
   }),
 });
 
+/**
+ * Authentication and authorization are rated on DETECTION of the families that carry them (measured on the frozen holdout, gated like
+ * any other layer) AND on the web-model test suite passing. A pass/fail test run alone is not a measurement of how well missing or
+ * broken authentication is found, so it can never promote this row by itself.
+ */
+export const AUTH_FAMILIES = Object.freeze(['route-authentication', 'object-authorization']);
+
 /** Capabilities that need an external tool or host to be exercised at all: absent, the row is BLOCKED whatever its tests say. */
 export const REQUIRES_TOOL = Object.freeze({
   haskell: Object.freeze({ auth: Object.freeze({ tool: 'ghc', why: 'the route fixtures are compiled by GHC (HS-006.AC01)' }) }),
@@ -45,6 +52,28 @@ export const REQUIRES_TOOL = Object.freeze({
 export const NON_PROMOTING_EVIDENCE = Object.freeze(['installation', 'grammar-present', 'structural-only', 'documentation', 'model-assertion', 'taint-as-privacy', 'unknown']);
 
 const ratio = (n, d) => (d > 0 ? n / d : null);
+
+/**
+ * Exact (Clopper-Pearson) two-sided confidence interval for k successes in n trials. A rate of 30/30 is NOT "100%": its 95% lower
+ * bound is about 0.88, and a table that prints 1.000 without it invites exactly that misreading.
+ */
+export function clopperPearson(k, n, alpha = 0.05) {
+  if (!(n > 0)) return null;
+  const binomTail = (p, from) => { // P(X >= from) for X ~ Bin(n, p), computed in log space
+    let sum = 0;
+    for (let i = from; i <= n; i++) {
+      let lc = 0; for (let j = 1; j <= i; j++) lc += Math.log((n - i + j) / j);
+      sum += Math.exp(lc + (p > 0 ? i * Math.log(p) : (i === 0 ? 0 : -Infinity)) + (p < 1 ? (n - i) * Math.log(1 - p) : (n - i === 0 ? 0 : -Infinity)));
+    }
+    return sum;
+  };
+  const bisect = (f, lo, hi) => { for (let i = 0; i < 80; i++) { const mid = (lo + hi) / 2; if (f(mid)) hi = mid; else lo = mid; } return (lo + hi) / 2; };
+  const lower = k === 0 ? 0 : bisect((p) => binomTail(p, k) >= alpha / 2, 0, 1);
+  const upper = k === n ? 1 : bisect((p) => binomTail(p, k + 1) >= 1 - alpha / 2, 0, 1);
+  return [lower, upper];
+}
+const ci = (k, n) => { const r = clopperPearson(k, n); return r ? [Number(r[0].toFixed(4)), Number(r[1].toFixed(4))] : null; };
+const withInterval = (e) => (e && Number.isFinite(e.tp) ? { ...e, ci: { precision: ci(e.tp, e.tp + (e.fp || 0)), recall: ci(e.tp, e.tp + (e.fn || 0)), level: 0.95, method: 'Clopper-Pearson' } } : e);
 const pct = (x) => (x == null ? 'not measured' : `${(x * 100).toFixed(1)}%`);
 
 function rate(layer) {
@@ -132,6 +161,19 @@ export function evaluateSupport(language, input) {
       const u = detection.unknownOutcomes;
       if (u && u.silentClean > 0) reasons.push(`${u.silentClean} unknown case(s) came back with neither a finding nor a disclosure (false assurance)`);
       row(cap, !layer || !layer.measured ? 'not-measured' : reasons.length ? 'failed' : 'supported', reasons, layer ? { metric: kind, layer: key, tp: layer.tp, fp: layer.fp, fn: layer.fn, tn: layer.tn, precision: layer.precision, recall: layer.recall, f1: layer.f1, cases: layer.cases, families: layer.families, strictPrecision: layer.strict && layer.strict.precision } : null);
+    } else if (kind === 'auth-detection') {
+      const sast = detection.layers && detection.layers.sast;
+      const fams = Object.fromEntries(AUTH_FAMILIES.filter((f) => sast && sast.families && sast.families[f]).map((f) => [f, sast.families[f]]));
+      if (!Object.keys(fams).length) { row(cap, 'not-measured', [`no measured authentication families (${AUTH_FAMILIES.join(', ')}): a passing test run is not a detection measurement`]); continue; }
+      const sum = (k) => Object.values(fams).reduce((n, x) => n + (x[k] || 0), 0);
+      const tp = sum('tp'); const fp = sum('fp'); const fn = sum('fn');
+      const precision = ratio(tp, tp + fp); const recall = ratio(tp, tp + fn);
+      const f1 = precision != null && recall != null && precision + recall > 0 ? (2 * precision * recall) / (precision + recall) : null;
+      const pseudo = { measured: true, tp, fp, fn, tn: sum('tn'), precision, recall, f1, families: fams };
+      const g = gateLayer(pseudo, filterFamilies(detection.perFamilyCases, pseudo), { kind: 'auth' });
+      const ts = suiteStatus(input.suites, (input.capabilitySuites || {})[cap]);
+      const reasons = [...g.reasons, ...dataOk.reasons, ...(ts.ok ? [] : ts.reasons)];
+      row(cap, reasons.length ? (ts.status === 'blocked' ? 'blocked' : 'failed') : 'supported', reasons, { metric: 'auth-detection', layer: 'sast', families: Object.keys(fams), tp, fp, fn, precision, recall, f1, suites: ((input.capabilitySuites || {})[cap] || []) });
     } else if (kind === 'privacy-holdout') {
       const p = eco.privacy;
       if (!p || !(p.positives > 0 && p.negatives > 0)) { row(cap, 'not-measured', ['no privacy field-to-sink measurement (a security finding or a taint metric is never a privacy metric)']); continue; }
@@ -168,6 +210,29 @@ export function evaluateSupport(language, input) {
       row(cap, ts.status === 'supported' ? 'supported' : ts.status, ts.reasons, { metric: kind, suites: ((input.capabilitySuites || {})[cap] || []) });
     }
   }
+  // 95% intervals beside every measured rate, and the strict precision (which counts findings of other families) beside the scoped one
+  for (const r of Object.values(out.rows)) {
+    if (!r.evidence || !Number.isFinite(r.evidence.tp)) continue;
+    const key = /taint/.test(r.capability) ? 'taint' : 'sast';
+    const strict = r.evidence.metric === 'sast-holdout' || r.evidence.metric === 'taint-holdout' ? (detection.layers || {})[key] && (detection.layers[key].strict || null) : null;
+    r.evidence = withInterval({ ...r.evidence, ...(strict && Number.isFinite(strict.precision) ? { strictPrecision: strict.precision } : {}) });
+  }
+  // Generalisation: the SAME layers measured on shapes absent from train, validation and holdout. It never changes a row's status (the
+  // PRD's gates are defined on the frozen holdout); it is stated beside it, with the shortfalls named, so "supported" is not read as more.
+  const un = input.unseen && input.unseen.ecosystems && input.unseen.ecosystems[language] && input.unseen.ecosystems[language].detection;
+  out.generalizationGaps = [];
+  for (const r of Object.values(out.rows)) {
+    if (!r.evidence || !/^(sast|taint)-holdout$/.test(r.evidence.metric || '')) continue;
+    const key = /taint/.test(r.capability) ? 'taint' : 'sast';
+    const u = un && un.layers && un.layers[key];
+    if (!u || !u.measured) { r.generalization = { status: 'not-measured' }; continue; }
+    const shortfalls = [];
+    if (!(u.precision >= TARGETS.precision)) shortfalls.push(`precision ${pct(u.precision)} < ${pct(TARGETS.precision)}`);
+    if (!(u.recall >= TARGETS.recall)) shortfalls.push(`recall ${pct(u.recall)} < ${pct(TARGETS.recall)}`);
+    if (!(u.f1 >= TARGETS.f1)) shortfalls.push(`F1 ${pct(u.f1)} < ${pct(TARGETS.f1)}`);
+    r.generalization = { status: shortfalls.length ? 'below-target' : 'meets-targets', shortfalls, cases: u.cases, tp: u.tp, fp: u.fp, fn: u.fn, tn: u.tn, precision: u.precision, recall: u.recall, f1: u.f1, strictPrecision: u.strict && u.strict.precision, ci: { precision: ci(u.tp, u.tp + u.fp), recall: ci(u.tp, u.tp + u.fn), level: 0.95, method: 'Clopper-Pearson' } };
+    if (shortfalls.length) out.generalizationGaps.push(`${r.capability}: ${shortfalls.join(', ')}`);
+  }
   // a capability whose tool is absent is blocked, not passed and not skipped
   const tools = input.tools || {};
   for (const [cap, req] of Object.entries(REQUIRES_TOOL[language] || {})) {

package/src/language/trusted-inputs.js

@@ -0,0 +1,38 @@
+// Where an advisory snapshot may come from (trust boundary).
+//
+// An advisory snapshot decides which dependencies are reported as vulnerable. A scanned project is untrusted input: if the project could
+// supply its own snapshot, a pull request could ship an empty, perfectly well-formed, freshly dated one and the scan would report
+// "complete" with the vulnerable dependency gone. So a snapshot is accepted only from the operator:
+//   1. the environment variable named by the caller (a path the operator set), or
+//   2. a file in the operator's per-user configuration directory ($XDG_CONFIG_HOME/agentic-security, or ~/.config/agentic-security),
+//      the same directory that holds the per-install signing key.
+// A file of the same name inside the scanned project is never read. It is reported, so the operator knows why it had no effect.
+
+import { existsSync, lstatSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { statePath } from '../posture/state-dir.js';
+
+/** The operator's per-user configuration directory. */
+export function operatorConfigDir(env = process.env) {
+  const base = env.XDG_CONFIG_HOME && env.XDG_CONFIG_HOME.length ? env.XDG_CONFIG_HOME : join(homedir(), '.config');
+  return join(base, 'agentic-security');
+}
+
+const isRegularFile = (p) => { try { return lstatSync(p).isFile(); } catch { return false; } };
+
+/**
+ * Resolves a snapshot path from operator-controlled places only.
+ * @returns {{path: string|null, source: 'env'|'operator-config'|null, projectLocalIgnored: string|null}}
+ */
+export function resolveOperatorSnapshot({ envVar, fileName, root = null, env = process.env }) {
+  const local = root ? statePath(root, fileName) : null;
+  const projectLocalIgnored = local && existsSync(local) ? local : null;
+  if (env[envVar]) return { path: env[envVar], source: 'env', projectLocalIgnored };
+  const cfg = join(operatorConfigDir(env), fileName);
+  if (isRegularFile(cfg)) return { path: cfg, source: 'operator-config', projectLocalIgnored };
+  return { path: null, source: null, projectLocalIgnored };
+}
+
+/** The sentence added to a "no snapshot" reason when the project carried one that was deliberately ignored. */
+export const IGNORED_NOTE = (fileName) => ` A ${fileName} inside the scanned project was IGNORED: a project cannot vouch for its own advisories (provide the snapshot through the environment variable or your per-user configuration directory).`;