@clear-capabilities/agentic-security-scanner 0.161.0 → 0.163.0

package/src/engine.js

@@ -243,6 +243,7 @@ import { applyLearnedCalibration } from './posture/triage-learning.js';
 import { annotateFormalVerification } from './dataflow/formal-verify.js';
 import { annotateProofGate } from './dataflow/proof-gate.js';
 import { applySanitizerGate } from './dataflow/sanitizer-gate.js';
+import { guardDominatesSink } from './dataflow/guard-dominance.js';
 import { annotateFalsification } from './posture/falsification.js';
 import { routeModelForFinding } from './posture/model-routing.js';
 import { buildEntrypointInventory } from './posture/entrypoint-inventory.js';
@@ -1468,10 +1469,38 @@ function _guardWindow(ctx, before = 25, after = 5) {
   const line = ctx.line || 1;
   const lo = Math.max(0, line - before);
   const hi = Math.min(ctx.lines.length, line + after);
-  return ctx.lines.slice(lo, hi).join('\n')
-    .replace(/\/\*[\s\S]*?\*\//g, ' ')
-    .replace(/\/\/[^\n]*/g, ' ')
-    .replace(/(^|[^\w'"`])#[^\n]*/g, '$1 ');
+  return _stripCommentsKeepLines(ctx.lines.slice(lo, hi).join('\n'));
+}
+
+// Comment removal that is aware of string literals and keeps every newline, so a line index in the result is a line index in the file.
+// The previous regex chain treated the `//` in `"https://"` as the start of a comment and erased the rest of the line, which is where the
+// allow-list check usually is (`in_array("https://" . $host, $allowed)`): a guard written on that line disappeared from the window and a
+// neighbouring declaration happened to stand in for it. Strings never span lines here; a stray apostrophe therefore costs at most one line.
+function _stripCommentsKeepLines(text) {
+  let out = '';
+  let i = 0; const n = text.length;
+  let quote = null;
+  while (i < n) {
+    const c = text[i]; const d = text[i + 1];
+    if (c === '\n') { quote = null; out += c; i++; continue; }
+    if (quote) {
+      out += c;
+      if (c === '\\' && i + 1 < n && text[i + 1] !== '\n') { out += text[i + 1]; i += 2; continue; }
+      if (c === quote) quote = null;
+      i++; continue;
+    }
+    if (c === '"' || c === "'" || c === '`') { quote = c; out += c; i++; continue; }
+    if (c === '/' && d === '*') {
+      const end = text.indexOf('*/', i + 2);
+      const body = text.slice(i, end < 0 ? n : end + 2);
+      out += body.replace(/[^\n]/g, ' ');
+      i += body.length; continue;
+    }
+    if (c === '/' && d === '/') { while (i < n && text[i] !== '\n') { out += ' '; i++; } continue; }
+    if (c === '#' && (i === 0 || !/[\w'"`]/.test(text[i - 1]))) { while (i < n && text[i] !== '\n') { out += ' '; i++; } continue; }
+    out += c; i++;
+  }
+  return out;
 }
 
 // PRD R15: a guard-shaped token anywhere in the -25/+5 window used to be
@@ -1524,7 +1553,20 @@ function _guardMatchNearSinkIdentifier(ctx, guardRe, span = 2) {
   const w = _guardWindow(ctx);
   const re = new RegExp(guardRe.source, guardRe.flags.includes('g') ? guardRe.flags : guardRe.flags + 'g');
   const ids = _sinkLineIdentifiers(ctx);
-  if (!ids.size) return re.test(w); // can't correlate — fall back to the old shape-only check
+  // QA-005.AC02: text that LOOKS like a guard is not enough; it must dominate the sink. `_guardWindow` starts at `winLo` in the file.
+  const winLo = Math.max(0, (ctx.line || 1) - 25);
+  const sinkIdx = (ctx.line || 1) - 1;
+  const dominates = (windowLineIdx) => {
+    const v = guardDominatesSink({ lines: ctx.lines, guardIdx: winLo + windowLineIdx, sinkIdx, file: ctx.file });
+    if (v.dominates) ctx._guardEvidence = { guardLine: winLo + windowLineIdx + 1, dominance: v.reason };
+    else if (_stageEvidenceOn()) _stageEvidence.guard.push({ file: ctx.file || null, sinkLine: sinkIdx + 1, guardLine: winLo + windowLineIdx + 1, rejectedBecause: v.reason });
+    return v.dominates;
+  };
+  if (!ids.size) { // can't correlate by identifier: shape-only, but the shape must still dominate
+    let nm; const probe = new RegExp(re.source, re.flags);
+    while ((nm = probe.exec(w))) { if (dominates(w.slice(0, nm.index).split('\n').length - 1)) return true; if (nm.index === probe.lastIndex) probe.lastIndex++; }
+    return false;
+  }
   const wLines = w.split('\n');
   const sinkLineText = (ctx.lines && ctx.lines[(ctx.line || 1) - 1]) || '';
   let m;
@@ -1547,7 +1589,7 @@ function _guardMatchNearSinkIdentifier(ctx, guardRe, span = 2) {
     const hi = Math.min(wLines.length, guardLineIdx + span + 1);
     const local = wLines.slice(lo, hi).filter((l) => l !== sinkLineText).join('\n');
     for (const id of ids) {
-      if (new RegExp(`\\b${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`).test(local)) return true;
+      if (new RegExp(`\\b${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`).test(local) && dominates(guardLineIdx)) return true;
     }
   }
   return false;
@@ -1555,6 +1597,16 @@ function _guardMatchNearSinkIdentifier(ctx, guardRe, span = 2) {
 
 function _hasSsrfHostGuard(ctx) { return _guardMatchNearSinkIdentifier(ctx, _SSRF_HOST_GUARD_RE); }
 
+// An open-redirect (CWE-601) target guard: a framework's local-URL / safe-redirect predicate, a relative-path check (`startsWith("/")`),
+// or a host allow-list. QA-006: once the taint layer sees a handler's implicit request parameters, a redirect that is validated
+// by the framework's own predicate (`LocalRedirect(Url.IsLocalUrl(next) ? next : "/")`) reaches this pass like any other guarded
+// sink, and is cleared by the same rule as SSRF and path guards: the guard must name the sink's identifier AND dominate the sink.
+const _REDIRECT_GUARD_RE = new RegExp(
+  String.raw`\b(?:IsLocalUrl|is_safe_url|url_has_allowed_host_and_scheme|safe_redirect|safeRedirect|isSafeRedirect|isRelativeUrl|is_relative_url|validateRedirect|validate_redirect|SafeRedirect)\b`
+  + String.raw`|\.\s*(?:startsWith|startswith|StartsWith|HasPrefix)\s*\(\s*['"]/['"]\s*\)|\bstr_starts_with\s*\(|\bstrpos\s*\(\s*\$?\w+\s*,\s*['"]/['"]\s*\)`
+  + '|' + _SSRF_HOST_GUARD_RE.source, _SSRF_HOST_GUARD_RE.flags);
+function _hasRedirectGuard(ctx) { return _guardMatchNearSinkIdentifier(ctx, _REDIRECT_GUARD_RE); }
+
 // A path-traversal containment guard near the file sink: a basename/strip
 // helper that removes directory components, a framework safe-join, or a
 // canonicalize-then-startsWith containment check.
@@ -1609,7 +1661,7 @@ function _hasXssOutputEncoding(ctx) {
 // detector produced them, using the same comment-stripped window guards.
 // Recall-safe: a genuinely-unguarded sink has no guard in its window (the
 // cve-replay vulnerable-tier TP count is the invariant that proves this).
-export function dropGuardedFindings(findings, fileContents) {
+export function dropGuardedFindings(findings, fileContents, onDrop = null) {
   if (!Array.isArray(findings)) return findings;
   const cache = new Map();
   const linesOf = (file) => {
@@ -1641,7 +1693,7 @@ export function dropGuardedFindings(findings, fileContents) {
     if (f.family === 'sibling-guard-omission') return true;
     const cwe = f.cwe || '';
     const isXss = cwe === 'CWE-79' && /reflected xss/i.test(f.vuln || '');
-    if (cwe !== 'CWE-918' && cwe !== 'CWE-22' && !isXss) return true;
+    if (cwe !== 'CWE-918' && cwe !== 'CWE-22' && cwe !== 'CWE-601' && !isXss) return true;
     // Flow-pair findings (REGEX parser) carry the line on sink/source, not at
     // the top level; fall back to those before parsing it out of the id.
     let line = f.line;
@@ -1655,10 +1707,12 @@ export function dropGuardedFindings(findings, fileContents) {
     if (typeof line !== 'number') return true;
     const lines = linesOf(f.file);
     if (!lines) return true;
-    const ctx = { lines, line };
-    if (cwe === 'CWE-918' && _hasSsrfHostGuard(ctx)) return false;
-    if (cwe === 'CWE-22' && _hasPathGuard(ctx)) return false;
-    if (isXss && _hasXssOutputEncoding(ctx)) return false;
+    const ctx = { lines, line, file: f.file };
+    const dropped = (kind) => { if (onDrop) onDrop(f, { kind, line, evidence: ctx._guardEvidence || null }); return false; };
+    if (cwe === 'CWE-918' && _hasSsrfHostGuard(ctx)) return dropped('ssrf-host-guard');
+    if (cwe === 'CWE-22' && _hasPathGuard(ctx)) return dropped('path-containment-guard');
+    if (cwe === 'CWE-601' && _hasRedirectGuard(ctx)) return dropped('redirect-target-guard');
+    if (isXss && _hasXssOutputEncoding(ctx)) return dropped('xss-output-encoding');
     return true;
   });
 }
@@ -2693,7 +2747,14 @@ const _PROTOCOL_CONSTANT_VAL_RE = new RegExp('^(?:'
 }
 // Module-level suppression log; cleared at the start of each runFullScan invocation.
 const _suppressionLog = [];
-function _resetSuppressions(){ _suppressionLog.length = 0; }
+function _resetSuppressions(){ _suppressionLog.length = 0; _stageEvidence.dedupe.length = 0; _stageEvidence.guard.length = 0; }
+// QA-005: stage-level diagnostics for the evaluation's why-missed analysis. DIAGNOSTIC ONLY: it records what the filter and
+// dedupe stages did and never changes a finding (test/posture-level pin: findings are identical with it on and off). Collected
+// only when AGENTIC_SECURITY_STAGE_EVIDENCE=1, because a normal scan has no reader for it.
+//   guard:  guard-shaped text the recognizer found but that did NOT dominate its sink, so did not clear the finding
+//   dedupe: findings collapsed into a winner, with the loser's own location kept (matchable identity)
+const _stageEvidence = { dedupe: [], guard: [] };
+const _stageEvidenceOn = () => process.env.AGENTIC_SECURITY_STAGE_EVIDENCE === '1';
 // R8: the per-file taint result minus the four arrays that are also appended
 // wholesale to the aggregates. Resume rebuilds those from the aggregate slices
 // so pfr[p] and the aggregates share object identity, exactly as in a normal run.
@@ -6587,6 +6648,7 @@ function dedupeFindingsWithEvidence(findings){
       : (SEV_RANK[f.severity]??9) < (SEV_RANK[kept.severity]??9);
     const winner = keepNew ? f : kept;
     const loser  = keepNew ? kept : f;
+    if(_stageEvidenceOn())_stageEvidence.dedupe.push({file,family:fam,winner:{id:winner.id||null,file:winner.file||null,line:winner.line??null,parser:winner.parser||null},loser:{id:loser.id||null,file:loser.file||null,line:loser.line??null,parser:loser.parser||null}});
     if(!winner.evidence)winner.evidence=[winner.parser||"UNKNOWN"];
     if(loser.parser&&!winner.evidence.includes(loser.parser))winner.evidence.push(loser.parser);
     if(loser.vuln&&loser.vuln!==winner.vuln){
@@ -9602,7 +9664,10 @@ function _deterministicFileTimings(timings) {
   // #1 — centralized SSRF/path guard recognition: drop CWE-918/CWE-22 findings
   // on code hardened by a host allow/deny check or a path containment guard,
   // regardless of which detector emitted them. Opt out: AGENTIC_SECURITY_NO_GUARD_RECOGNITION=1.
-  if(process.env.AGENTIC_SECURITY_NO_GUARD_RECOGNITION!=='1'){try{finalFindings=dropGuardedFindings(finalFindings,fc);}catch(_){}}
+  if(process.env.AGENTIC_SECURITY_NO_GUARD_RECOGNITION!=='1'){try{finalFindings=dropGuardedFindings(finalFindings,fc,(f,why)=>{
+    // QA-005.AC01: a guard-recognized drop is a suppression and goes in the ledger with the identity a later analysis needs to match it.
+    _suppressionLog.push({vuln:f.vuln,file:f.file,line:why.line,snippet:f.snippet||'',reason:'guard-recognized:'+why.kind+(why.evidence?':dominates@'+why.evidence.guardLine+':'+why.evidence.dominance:''),id:f.id||null,cwe:f.cwe||null,family:f.family||null});
+  });}catch(_){}}
   // 0.34.6: filter out Java FPs where a sanitizer pattern (argv-form ProcessBuilder,
   // parameterized prepareStatement, constant-folded dead-branch) is present.
   // applyJavaBenchSuppressions is a no-op on non-.java files.
@@ -11098,7 +11163,7 @@ function _deterministicFileTimings(timings) {
     compliance: _complianceReport ? { stale: _complianceReport.summary?.stale || 0 } : null,
   });
   } // end if (!skipAnnotators) — FR-PROV-029
-  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,linesScanned:Object.values(fc).reduce((_n,_c)=>_n+(typeof _c==='string'?_c.split("\n").length:0),0),crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,depFileContents,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,detectorErrors:_detectorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,privacyIrBacked:_privacyIrBacked,privacyTaxonomyVersion:_privacyTaxonomyVersion,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary,scanHealth:_scanHealth,coverageLedger:_coverageLedger,lineageGraph:_lineageGraph,lineageStatus:_lineageStatus,languageBridges:_languageBridges,languageBom:_languageBom,aiAssistance:_aiAssistance};}
+  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,linesScanned:Object.values(fc).reduce((_n,_c)=>_n+(typeof _c==='string'?_c.split("\n").length:0),0),crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,depFileContents,suppressions:_getSuppressions(),...(_stageEvidenceOn()?{stageEvidence:{dedupe:[..._stageEvidence.dedupe],guard:[..._stageEvidence.guard]}}:{}),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,detectorErrors:_detectorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,privacyIrBacked:_privacyIrBacked,privacyTaxonomyVersion:_privacyTaxonomyVersion,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary,scanHealth:_scanHealth,coverageLedger:_coverageLedger,lineageGraph:_lineageGraph,lineageStatus:_lineageStatus,languageBridges:_languageBridges,languageBom:_languageBom,aiAssistance:_aiAssistance};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".
 // Orphans (no finding linkage) are bucketed by file-local heuristic so the UI shows binary states only.

package/src/fix/apply-fix-service.js

@@ -42,6 +42,7 @@ import { verifyLastScan } from '../posture/integrity.js';
 import { stateDir } from '../posture/state-dir.js';
 import { applyFix as applyFixHistory, revertEntryById as revertFixEntry } from '../posture/fix-history.js';
 import { classifyFixMaterialRisk } from '../posture/material-change.js';
+import { appendRepairRecord } from '../posture/verification/repair-records.js';
 import { loadApproverRegistry, verifyApprover, requiredRolesFor, checkSeparationOfDuties } from './approver-registry.js';
 
 const RESERVED_WRITE_PREFIXES = [
@@ -191,6 +192,12 @@ async function getVerifyFixCore() {
  *   .agentic-security/authorized-approvers.json is configured, `approvedBy` is ALSO checked
  *   against it (fix/approver-registry.js) — an approvedBy the registry doesn't recognize, or one
  *   missing a role a touched category requires, is refused. A no-op with no registry configured.
+ * @param {object} [opts.patchNegative] - X-204: `{ original: {files, entry, oracleId, inputs}, functional: {inputs}, commit?, ... }`,
+ *   the exploit scenario and functional cases the patch must satisfy. Honoured only when the `patch-negative-verification`
+ *   feature (and `verification-oracles`) is enabled; otherwise ignored and this function behaves exactly as before. When it
+ *   runs, a patch is written only if it is `verified-fix`, and the result carries `patchNegative` plus `repairRecords`: SEPARATE
+ *   records for the proposal, its promotion or rejection, its application and any rollback.
+ * @param {object} [opts.assuranceConfig] - resolved assurance config (defaults to the process environment)
  * @param {boolean} [opts.dryRun]
  * @param {boolean} [opts.skipVerification] - escape hatch for callers that have ALREADY verified
  *   (none currently use this — present so a future caller cannot be forced into double verification
@@ -202,7 +209,7 @@ async function getVerifyFixCore() {
  *   configured, tests when a runner is detected — genuinely ran and passed, not silently skipped.
  *   `verified:true, verifiedFull:false` is a real, honest state: applied, but on a degraded pass.
  */
-export async function applyVerifiedFix({ scanRoot, finding, files, fixMeta = null, dryRun = false, skipVerification = false } = {}) {
+export async function applyVerifiedFix({ scanRoot, finding, files, fixMeta = null, dryRun = false, skipVerification = false, patchNegative = null, assuranceConfig } = {}) {
   if (!scanRoot) return { ok: false, applied: false, reason: 'scanRoot required' };
   if (!finding) return { ok: false, applied: false, reason: 'finding required' };
   if (!files || typeof files !== 'object' || !Object.keys(files).length) {
@@ -316,6 +323,9 @@ export async function applyVerifiedFix({ scanRoot, finding, files, fixMeta = nul
   }
 
   let verify = null;
+  let pn = null;
+  let repairRecords = [];
+  const pnView = (r) => ({ status: r.status, verifiedFix: r.verifiedFix, incompleteStep: r.incompleteStep, failureCode: r.failureCode, reason: r.reason, steps: r.steps, patchDigest: r.patchDigest, summary: r.summary, verificationRecord: r.verificationRecord });
   if (!skipVerification) {
     if (!finding.stableId) {
       return { ok: false, applied: false, reason: 'finding has no stableId — cannot verify a candidate fix against it' };
@@ -328,22 +338,31 @@ export async function applyVerifiedFix({ scanRoot, finding, files, fixMeta = nul
         originalFindingStableId: finding.stableId,
         files: Object.fromEntries(Object.entries(confined).map(([rel, v]) => [rel, v.content])),
         fixMeta,
+        ...(patchNegative ? { patchNegative, assuranceConfig } : {}),
       });
     } catch (e) {
       return { ok: false, applied: false, reason: `verification failed: ${e.message}` };
     }
     verify = verdict;
+    // X-204: present only when the caller asked and the feature is on. `pn` stays null on every legacy path.
+    const pnRun = verdict.patchNegative && verdict.patchNegative.status !== 'disabled' ? verdict.patchNegative : null;
+    if (pnRun) { pn = pnRun; repairRecords = pnRun.repairRecords || []; }
     if (!verdict.ok) {
+      // the patch-negative leg may have passed while another leg did not: the rejection is still its own record
+      if (pn && pn.verifiedFix) {
+        repairRecords = appendRepairRecord(repairRecords, { kind: 'rejected', hypothesisId: finding.stableId, revision: pn.promotion?.revision ?? null, diffDigest: pn.patchDigest, step: 'other-verification-legs', reason: `rejected by verifier: ${String(verdict.summary || 'did not verify').slice(0, 200)}` }).records;
+      }
       return {
         ok: false, applied: false,
         reason: `rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
         verify: { rescan: verdict.rescan, lint: verdict.lint ? { runner: verdict.lint.runner, ok: verdict.lint.ok } : null, honesty: verdict.honesty || null },
+        ...(pn ? { patchNegative: pnView(pn), repairRecords } : {}),
       };
     }
   }
 
   if (dryRun) {
-    return { ok: true, applied: false, dryRun: true, verified: !skipVerification, files: Object.keys(confined), verify, materialClassification };
+    return { ok: true, applied: false, dryRun: true, verified: !skipVerification, files: Object.keys(confined), verify, materialClassification, ...(pn ? { patchNegative: pnView(pn), repairRecords } : {}) };
   }
 
   // FR-304: re-check every file against its pre-verification baseline hash,
@@ -381,11 +400,21 @@ export async function applyVerifiedFix({ scanRoot, finding, files, fixMeta = nul
     for (const w of written) {
       try { await revertFixEntry(scanRoot, w.historyId); } catch { /* best-effort; original error still propagates below */ }
     }
+    // X-204: the rollback is its own record, after the promotion it undoes (a write that failed part-way)
+    if (pn) {
+      const rolled = appendRepairRecord(repairRecords, { kind: 'rolled-back', hypothesisId: finding.stableId, revision: pn.promotion?.revision ?? null, diffDigest: pn.patchDigest, reason: `the write failed and every file written in this batch was restored: ${String(e?.message || e).slice(0, 160)}` });
+      repairRecords = rolled.records;
+    }
     if (e && e.name === 'FixAttemptBudgetExceededError') {
-      return { ok: false, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key };
+      return { ok: false, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key, ...(pn ? { patchNegative: pnView(pn), repairRecords } : {}) };
     }
+    if (pn && e && typeof e === 'object') e.repairRecords = repairRecords;
     throw e;
   }
+  // X-204: application is a separate record from the promotion that allowed it
+  if (pn) {
+    repairRecords = appendRepairRecord(repairRecords, { kind: 'applied', hypothesisId: finding.stableId, revision: pn.promotion?.revision ?? null, diffDigest: pn.patchDigest, reason: `written to ${written.length} file(s) after verified-fix promotion` }).records;
+  }
 
   // FR-305: `verified: true` only ever meant "verification was attempted",
   // not "every required leg genuinely ran and passed" — a caller that
@@ -400,5 +429,6 @@ export async function applyVerifiedFix({ scanRoot, finding, files, fixMeta = nul
     written,
     verify: verify ? { summary: verify.summary, verifiedFull: verify.verifiedFull, degradedLegs: verify.degradedLegs || [] } : null,
     materialClassification,
+    ...(pn ? { patchNegative: pnView(pn), repairRecords } : {}),
   };
 }

package/src/integrations/index.js

@@ -14,6 +14,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as yaml from '../util/yaml.js';
 import { statePath } from '../posture/state-dir.js';
+import { portfolioAssuranceEnabled, HEADLINE, BLOCKED_HEADLINE } from '../posture/portfolio/wording.js';
 
 function _configPath(scanRoot) {
   return statePath(scanRoot, 'integrations.yml');
@@ -36,12 +37,14 @@ export function buildSlackDigest(findings, summary, options = {}) {
   const project = options.project || 'project';
   const status = (summary.critical || 0) === 0 && (summary.high || 0) === 0
     ? '✅ safe to deploy' : '❌ not safe to deploy';
+  const statusLine = portfolioAssuranceEnabled({ option: options.portfolioAssurance })
+    ? (status.startsWith('✅') ? `✅ ${HEADLINE}` : `❌ ${BLOCKED_HEADLINE}`) + ' (completed supported checks only)' : status;
   const top = (findings || []).slice(0, 3);
 
   const lines = [
     `*🛡 agentic-security daily — ${new Date().toISOString().slice(0,10)}*`,
     `Project: \`${project}\``,
-    `Status: ${status}`,
+    `Status: ${statusLine}`,
     '',
     `*Findings:* ${summary.critical || 0} critical · ${summary.high || 0} high · ${summary.medium || 0} medium`,
   ];
@@ -66,7 +69,7 @@ export function buildDiscordDigest(findings, summary, options = {}) {
     embeds: [{
       title: `🛡 agentic-security — ${project}`,
       color: safe ? 0x2ecc71 : 0xe74c3c,
-      description: safe ? '✅ safe to deploy' : '❌ not safe to deploy',
+      description: portfolioAssuranceEnabled({ option: options.portfolioAssurance }) ? (safe ? `✅ ${HEADLINE} (completed supported checks only)` : `❌ ${BLOCKED_HEADLINE}`) : (safe ? '✅ safe to deploy' : '❌ not safe to deploy'),
       fields: [
         { name: 'Critical', value: String(summary.critical || 0), inline: true },
         { name: 'High',     value: String(summary.high || 0),     inline: true },

package/src/ir/CLAUDE.md

@@ -34,6 +34,20 @@ consumed by `scanner/src/dataflow/` for taint analysis.
 | Rust     | `parser-rust.js`      | Hand-rolled, the `parser-go.js`/`parser-cs.js` pattern (preprocess: comments blanked, `::` paths flattened to dots, turbofish/`?`/`.await` stripped; then statement-split + recursive CFG build). **SARD 80% F1 push, first-class from day one — no prior IR existed for Rust at all** (only the opt-in, WASM-based `tree-sitter-loader.js` long-tail path below, which nothing in the taint engine consumes). Models: `fn` items (free/impl/trait, qualifiers, generics, `impl Type` methods named `Type.method`), `let`/destructuring/compound-assign, method chains (args accumulated innermost-first, so `Command::new("sh").arg("-c").arg(x)` has the literal program name at arg 0 regardless of the chain's terminal method), macros (`format!`/`write!`/etc. lower to a template with inline `{ident}` and positional args; `vec!` to an array; every other macro keeps its own `name!` callee so `sqlx::query!` — the compile-checked, parameterized macro — never collides with the `query` sink); `if`/`if let`/`while`/`while let`/`loop`/`for`/`match` (pattern bindings assigned from the scrutinee) including expression-position control flow (`let x = match … {}` yields a `union` of the branch tails); trailing closures inlined with their parameter bound to the receiver; extractor-typed parameters (`Query(q): Query<P>`) and route-attributed handlers (`#[get("/<x>")]`) emit `fn.paramAnnotations`. **`.unwrap()`/`.expect(msg)` are popped from the chain, not just taint-transparent** — leaving them in shifts the terminal segment away from the real sink name (`sqlx::query(&sql).fetch_all(pool).await.unwrap()` would otherwise end in `.unwrap`, never `.fetch_all`, and no catalog entry could ever match it), the same "terminal segment shift" defect class documented for Go/Java/Kotlin above; a macro-only statement whose sole continuation is a popped `.unwrap()` (`write!(w, "…", x).unwrap();`) still counts as a call, tracked via a separate `_baseIsCall` flag so it doesn't fall through to "no call happened here" once the passthrough is gone. Three self-scan-flagged regexes (`(?:#\[[^\]]*\]\s*)+`, the attribute-skip pattern, appearing at three call sites) match the "optional/quantified group flanked by `\s*`" ReDoS heuristic shape but are linear by construction — each iteration is bounded by the mandatory literal `#[`…`]`, no shared character class exists for the engine to backtrack across — confirmed by direct timing (50 000 back-to-back attributes, 200 000 non-matching whitespace chars: both single-digit milliseconds), not merely asserted; see the comment at `_parseParams` in `parser-rust.js`. Guarded by `test/parser-rust.test.js` (CFG shape) and `test/rust-taint-flow.test.js` (end-to-end taint flow + precision cases). **Measured `bench/layer-recall` impact: 0 → 5/5 (100%) whole-corpus, 0 → 3/3 (100%) deep-tier** on first measurement — the corpus is small and every entry is annotation-sourced (axum/actix/rocket extractor parameters route directly into `paramAnnotations`), so 100% reflects the corpus's own composition, not general Rust ecosystem coverage; see `docs/METRICS.md`'s own disclosure. |
 | Long-tail (solidity/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. Rust's own tree-sitter grammar remains loadable here too (unaffected by `parser-rust.js` existing), but the hand-rolled parser above is what feeds the taint engine — this path is now redundant for Rust specifically, kept only because removing a language from `tree-sitter-sinks.js`'s opt-in surface is out of scope for this change. |
 
+## Implicit handler parameters and Go line attribution (QA-006)
+
+`implicit-handler-params.js` is the pure decision "is this parameter request-bound without any annotation". `parser-cs.js` emits a
+`paramAnnotations` entry with decorator `ImplicitMvcActionParam` for a string-shaped parameter of a public, non-static, non-`[NonAction]` method of a
+controller class (derived from Controller/ControllerBase/ApiController, or named `*Controller`) unless it carries `[FromServices]` or an explicit
+`[From*]`; `parser-java.js` emits `ImplicitSpringMappedParam` for a plain `String` parameter of a method annotated `@GetMapping`/`@PostMapping`/
+`@RequestMapping`/... The catalog turns those two names into sources; the IR states the fact and the catalog decides what is a source. Nothing in the
+module reads a path, label or environment variable.
+
+`parser-go.js` line attribution: `FUNC_RE`'s leading `\s*` swallows blank lines, so the function used to be placed at the first newline of the run above
+it, and `_splitStatements` dropped blank and comment lines so every later statement was pulled upward by their count. Statement lines are now start-offset
+based (`_splitStatements(...).lineOffsets`, `_buildCfg` takes the line the body BEGINS on), a `//` comment no longer swallows the newline that ends its
+line, and nested if/for/closure bodies take their base from the real brace position. Tests: `test/evaluation/engine-mechanisms.test.js`.
+
 ## Python parser — dual-path with auto fallback
 
 The Python pipeline has two implementations. The dispatcher in `index.js`

package/src/ir/implicit-handler-params.js

@@ -0,0 +1,74 @@
+// Implicit request-bound handler parameters (QA-006, mechanism "framework entry points").
+//
+// A web framework binds the parameters of a request-handler method from the
+// request WITHOUT any annotation on the parameter itself:
+//   - ASP.NET MVC / Core: a public action method of a controller binds `string next`
+//     from the route, query string or form unless it carries `[FromServices]`.
+//   - Spring MVC: a method carrying `@GetMapping` / `@RequestMapping` / ... binds a plain
+//     `String q` parameter from the request parameters (`@RequestParam` is optional).
+//
+// The taint engine's annotation channel (`fn.paramAnnotations`, matched by the catalog's
+// `type: 'annotation'` sources) only ever saw the EXPLICIT forms (`[FromQuery]`,
+// `@RequestParam`), so a handler written in the equally common implicit form had no
+// source at all and the flow was invisible to the taint layer. This module is the pure
+// decision of "is this parameter implicitly request-bound", shared by the C# and Java
+// frontends; each frontend turns a positive answer into a `paramAnnotations` entry whose
+// decorator is one of the two names below, which the catalog binds to a source.
+//
+// Scope, stated so nothing is over-read:
+//   - ONLY string-shaped parameters. A numeric or Guid parameter cannot carry an injection
+//     payload, and a complex model parameter's field-level taint is out of scope here.
+//   - ONLY inside a class the framework would treat as a handler (a Controller-derived
+//     class, or any class whose name ends in `Controller`; for Spring, the MAPPING
+//     annotation on the method is what makes it a handler, not the class).
+//   - A DI-injected parameter is not request-bound: `[FromServices]` opts a parameter out.
+//   - Nothing here looks at a file name, path, comment or label.
+
+export const IMPLICIT_MVC_PARAM = 'ImplicitMvcActionParam';
+export const IMPLICIT_SPRING_PARAM = 'ImplicitSpringMappedParam';
+
+const CS_CONTROLLER_BASE = /^(?:Controller|ControllerBase|ApiController|AsyncController)$/;
+const CS_STRINGISH = /^(?:(?:System\.)?[Ss]tring\??(?:\[\])?|(?:List|IList|IEnumerable|ICollection|IReadOnlyList)<\s*(?:System\.)?[Ss]tring\??\s*>)$/;
+const CS_DI_OPT_OUT = new Set(['FromServices', 'FromKeyedServices']);
+
+/** True when a C# class record (`{ name, bases }`) is one the framework treats as a controller. */
+function isCsControllerClass(range) {
+  if (!range) return false;
+  if (/Controller$/.test(range.name || '')) return true;
+  return (range.bases || []).some((b) => CS_CONTROLLER_BASE.test(b));
+}
+
+/**
+ * Should a C# parameter be treated as implicitly request-bound?
+ * @param {object} o
+ * @param {string} o.modifiers   the method's modifier text (the declaration prefix), e.g. 'public async'
+ * @param {string} o.rawType     the parameter's declared type text, e.g. 'string', 'List<string>'
+ * @param {string[]} o.decorators the parameter's attribute names
+ * @param {boolean} o.nonAction  the method carries [NonAction]
+ * @param {object} o.classRange  the enclosing class record
+ */
+export function isImplicitCsActionParam({ modifiers = '', rawType = '', decorators = [], nonAction = false, classRange = null }) {
+  if (nonAction) return false;
+  if (!isCsControllerClass(classRange)) return false;
+  if (!/\bpublic\b/.test(modifiers) || /\bstatic\b/.test(modifiers)) return false;
+  if (decorators.some((d) => CS_DI_OPT_OUT.has(d))) return false;
+  // An explicit binding attribute is handled by the explicit annotation sources.
+  if (decorators.some((d) => /^From/.test(d))) return false;
+  return CS_STRINGISH.test(String(rawType).trim());
+}
+
+const SPRING_MAPPING = /^(?:RequestMapping|GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping)$/;
+const SPRING_DI_OR_BINDING = /^(?:RequestParam|PathVariable|RequestBody|RequestHeader|CookieValue|ModelAttribute|RequestAttribute|SessionAttribute|RequestPart|Value|Autowired)$/;
+
+/**
+ * Should a Java parameter be treated as implicitly request-bound?
+ * @param {string[]} o.methodAnnotations annotation simple names on the method
+ * @param {string} o.paramType   the parameter's simple type name ('String')
+ * @param {string[]} o.decorators annotation names already on the parameter
+ */
+export function isImplicitSpringMappedParam({ methodAnnotations = [], paramType = '', decorators = [] }) {
+  if (!methodAnnotations.some((a) => SPRING_MAPPING.test(a))) return false;
+  if (paramType !== 'String') return false;
+  if (decorators.some((d) => SPRING_DI_OR_BINDING.test(d))) return false;
+  return true;
+}

package/src/ir/parser-cs.js

@@ -45,6 +45,7 @@
 // This is a v1. Promoted to a Roslyn-backed CST parser (analogous to
 // parser-py-cst.js) once we have a dotnet capability probe.
 
+import { IMPLICIT_MVC_PARAM, isImplicitCsActionParam } from './implicit-handler-params.js';
 import * as crypto from 'node:crypto';
 import { callSitesFromCfg } from './call-sites.js';
 import { matchBalancedCall } from './balanced-call.js';
@@ -270,6 +271,16 @@ function _extractClassFields(code, range) {
 // Innermost class whose range contains `pos` (a method declaration's match
 // offset), or null when the method sits outside any class (top-level
 // statements — legal but rare).
+function _enclosingClassRange(ranges, pos) {
+  let best = null;
+  for (const r of ranges) {
+    if (pos >= r.start && pos < r.end) {
+      if (!best || (r.end - r.start) < (best.end - best.start)) best = r;
+    }
+  }
+  return best;
+}
+
 function _enclosingClassName(ranges, pos) {
   let best = null;
   for (const r of ranges) {
@@ -1537,7 +1548,12 @@ export function parseCSharpFile(file, code) {
   while ((m = METHOD_RE.exec(code)) !== null) {
     const name = m[2];
     const className = _enclosingClassName(classRanges, m.index);
+    const classRange = _enclosingClassRange(classRanges, m.index);
     const paramsText = m[3] || '';
+    // [NonAction] sits in the attribute region just before the declaration.
+    // Only the attribute region of THIS member counts: cut at the previous statement or block end.
+    const attrRegion = code.slice(Math.max(0, m.index - 300), m.index + 1);
+    const nonAction = /\bNonAction\b/.test(attrRegion.slice(Math.max(attrRegion.lastIndexOf('}'), attrRegion.lastIndexOf(';')) + 1));
     const paramAnnotations = [];
     const paramTypes = {};
     // `keptIdx` tracks the parameter's position in the FILTERED array — the
@@ -1616,6 +1632,10 @@ export function parseCSharpFile(file, code) {
           paramAnnotations.push({ index: keptIdx, name: paramName, decorator });
         }
         if (paramType) paramTypes[paramName] = paramType;
+        // QA-006: a controller action's plain string parameter is bound from the request with no attribute at all.
+        if (isImplicitCsActionParam({ modifiers: m[0], rawType: nameTokens.filter(w => !/^(?:ref|out|params|in|this)$/.test(w)).join(' '), decorators, nonAction, classRange })) {
+          paramAnnotations.push({ index: keptIdx, name: paramName, decorator: IMPLICIT_MVC_PARAM });
+        }
         keptIdx++;
       }
       return paramName;

package/src/ir/parser-go.js

@@ -34,6 +34,10 @@ const FUNC_RE = new RegExp(
 
 function _splitStatements(body) {
   const out = [];
+  // Index (in `body`) of each statement's first character, so a caller can recover its real line. Blank lines and comment-only
+  // lines yield no statement, so counting statements undercounts lines wherever a function body has either.
+  const starts = [];
+  let bufStart = 0;
   let buf = '';
   let depth = 0;
   let inStr = null;
@@ -57,19 +61,24 @@ function _splitStatements(body) {
     if (c === '`') { inRaw = true; buf += c; continue; }
     if (c === '/' && body[i + 1] === '/') {
       while (i < body.length && body[i] !== '\n') i++;
+      // Leave the newline for the loop to see: swallowing it meant a comment line never ended its statement, so the next line was
+      // glued to whatever came before the comment and its line number was counted from the wrong place.
+      i--;
       continue;
     }
     if (c === '{' || c === '(' || c === '[') depth++;
     if (c === '}' || c === ')' || c === ']') depth--;
     if ((c === '\n' || c === ';') && depth === 0) {
       const t = buf.trim();
-      if (t) out.push(t);
+      if (t) { out.push(t); starts.push(bufStart + (buf.length - buf.trimStart().length)); }
       buf = '';
+      bufStart = i + 1;
       continue;
     }
     buf += c;
   }
-  if (buf.trim()) out.push(buf.trim());
+  if (buf.trim()) { out.push(buf.trim()); starts.push(bufStart + (buf.length - buf.trimStart().length)); }
+  out.lineOffsets = starts.map((idx) => _countNewlinesUpTo(body, idx));
   return out;
 }
 
@@ -399,17 +408,21 @@ function _link(nodes, src, dst) {
   if (!nodes[dst].pred.includes(src)) nodes[dst].pred.push(src);
 }
 
+// `startLine` is the line on which `bodyText` BEGINS (the line of its opening brace); each statement's line is that plus the
+// newlines before the statement, so blank lines and comments inside the body no longer pull later statements upward.
 function _buildCfg(bodyText, nodes, prevId, startLine) {
   const stmts = _splitStatements(bodyText);
   let prev = prevId;
   let line = startLine;
-  for (const stmt of stmts) {
+  for (let si = 0; si < stmts.length; si++) {
+    const stmt = stmts[si];
+    line = startLine + (stmts.lineOffsets ? stmts.lineOffsets[si] : 0);
     const s = stmt.trim();
     if (!s || s.startsWith('//')) { line++; continue; }
 
     // if statement with brace body
-    const ifMatch = s.match(/^if\s+([\s\S]+?)\s*\{([\s\S]*)\}(?:\s*else\s*\{([\s\S]*)\})?\s*$/s) ||
-                    s.match(/^if\s+([\s\S]+?)\s*\{([\s\S]*)\}\s*$/s);
+    const ifMatch = s.match(/^if\s+([\s\S]+?)\s*\{([\s\S]*)\}(?:\s*else\s*\{([\s\S]*)\})?\s*$/sd) ||
+                    s.match(/^if\s+([\s\S]+?)\s*\{([\s\S]*)\}\s*$/sd);
     if (ifMatch) {
       const condText = ifMatch[1].replace(/;[^;]*$/, '').trim();
       const thenBody = ifMatch[2];
@@ -417,10 +430,10 @@ function _buildCfg(bodyText, nodes, prevId, startLine) {
       const ifNode = _addNode(nodes, { kind: 'if', cond: _lowerExpr(condText), line });
       _link(nodes, prev, ifNode);
       const join = _addNode(nodes, { kind: 'noop', line });
-      const thenTail = _buildCfg(thenBody, nodes, ifNode, line + 1);
+      const thenTail = _buildCfg(thenBody, nodes, ifNode, line + _countNewlinesUpTo(s, ifMatch.indices[2][0]));
       _link(nodes, thenTail, join);
       if (elseBody) {
-        const elseTail = _buildCfg(elseBody, nodes, ifNode, line + 1);
+        const elseTail = _buildCfg(elseBody, nodes, ifNode, line + _countNewlinesUpTo(s, ifMatch.indices[3][0]));
         _link(nodes, elseTail, join);
       } else {
         _link(nodes, ifNode, join);
@@ -431,7 +444,7 @@ function _buildCfg(bodyText, nodes, prevId, startLine) {
     }
 
     // for loop with brace body
-    const forMatch = s.match(/^for\s+([\s\S]*?)\s*\{([\s\S]*)\}\s*$/s);
+    const forMatch = s.match(/^for\s+([\s\S]*?)\s*\{([\s\S]*)\}\s*$/sd);
     if (forMatch) {
       const header = _addNode(nodes, { kind: 'loop-header', line });
       _link(nodes, prev, header);
@@ -446,7 +459,7 @@ function _buildCfg(bodyText, nodes, prevId, startLine) {
         _link(nodes, header, assignId);
         bodyPrev = assignId;
       }
-      const bodyTail = _buildCfg(loopBody, nodes, bodyPrev, line + 1);
+      const bodyTail = _buildCfg(loopBody, nodes, bodyPrev, line + _countNewlinesUpTo(s, forMatch.indices[2][0]));
       _link(nodes, bodyTail, header);
       const join = _addNode(nodes, { kind: 'noop', line });
       _link(nodes, header, join);
@@ -476,8 +489,9 @@ function _buildCfg(bodyText, nodes, prevId, startLine) {
         const callId = _addNode(nodes, { kind: 'call', line, callee: closureCall.callee, args: outerArgs });
         _link(nodes, prev, callId);
         const closureOffset = s.indexOf(closure.closureText);
-        const bodyStartLine = closureOffset >= 0
-          ? line + _countNewlinesUpTo(s, closureOffset)
+        const closureBodyIdx = closureOffset >= 0 ? s.indexOf(closure.body, closureOffset) : -1;
+        const bodyStartLine = closureBodyIdx >= 0
+          ? line + _countNewlinesUpTo(s, closureBodyIdx)
           : line;
         prev = _buildCfg(closure.body, nodes, callId, bodyStartLine);
         line += (s.match(/\n/g) || []).length + 1;
@@ -517,11 +531,14 @@ export function parseGoFile(file, code) {
     if (braceIdx < 0) continue;
     const extracted = _extractBody(code, braceIdx);
     if (!extracted) continue;
-    const startLine = _lineAt(code, m.index);
+    // FUNC_RE's leading boundary is a newline and its `\s*` then swallows every blank line before `func`, so m.index can sit
+    // several lines ABOVE the declaration (a blank line before a function is the gofmt norm). Every line below, the function's
+    // own and each statement's, is counted from here, so the keyword's offset is what must be measured.
+    const startLine = _lineAt(code, m.index + Math.max(0, m[0].indexOf('func')));
     const nodes = {};
     const entry = _addNode(nodes, { kind: 'entry', line: startLine });
     const exit = _addNode(nodes, { kind: 'exit', line: startLine });
-    const tail = _buildCfg(extracted.body, nodes, entry, startLine + 1);
+    const tail = _buildCfg(extracted.body, nodes, entry, _lineAt(code, braceIdx + 1));
     _link(nodes, tail, exit);
     const cfg = { entry, exit, nodes };
     functions.push({

package/src/ir/parser-java.js

@@ -23,6 +23,7 @@
 
 import { blankComments } from '../sast/_comment-strip.js';
 import { callSitesFromCfg } from './call-sites.js';
+import { IMPLICIT_SPRING_PARAM, isImplicitSpringMappedParam } from './implicit-handler-params.js';
 
 let _nodeIdSeq = 0;
 function nextNodeId() { return 'jn' + (++_nodeIdSeq); }
@@ -1082,6 +1083,11 @@ export async function parseJavaFile(file, raw) {
             || md.children?.methodDeclarator?.[0]?.children?.formalParameterList?.[0];
           const paramAnnotations = [];
           const paramTypes = {};
+          // QA-006: annotation simple names on the METHOD itself (`@GetMapping`), read from its modifiers.
+          const methodAnnotations = (md.children?.methodModifier || []).map((mm) => {
+            const ids = mm.children?.annotation?.[0]?.children?.typeName?.[0]?.children?.Identifier;
+            return ids?.length ? ids[ids.length - 1]?.image : null;
+          }).filter(Boolean);
           const params = (fpl?.children?.formalParameter || []).map((fp, idx) => {
             // Regular parameters nest under `variableParaRegularParameter`.
             // Varargs (`String... args`) instead use a distinct
@@ -1119,6 +1125,7 @@ export async function parseJavaFile(file, raw) {
             // the first, or a stacked annotation is silently dropped (the
             // same class of bug Task 3's C# regex needed a fix round for).
             const variableModifiers = vp?.children?.variableModifier || [];
+            const ownDecorators = [];
             for (const vm of variableModifiers) {
               const ann = vm.children?.annotation?.[0];
               // `typeName.children.Identifier` is an array of ALL
@@ -1133,9 +1140,13 @@ export async function parseJavaFile(file, raw) {
               const identifiers = ann?.children?.typeName?.[0]?.children?.Identifier;
               const decoratorName = identifiers?.length ? identifiers[identifiers.length - 1]?.image : undefined;
               if (decoratorName && paramName) {
+                ownDecorators.push(decoratorName);
                 paramAnnotations.push({ index: idx, name: paramName, decorator: decoratorName });
               }
             }
+            if (paramName && isImplicitSpringMappedParam({ methodAnnotations, paramType, decorators: ownDecorators })) {
+              paramAnnotations.push({ index: idx, name: paramName, decorator: IMPLICIT_SPRING_PARAM });
+            }
             return paramName;
           }).filter(Boolean);
           const body = md.children?.methodBody?.[0]?.children?.block?.[0];