@clear-capabilities/agentic-security-scanner 0.163.0 → 0.164.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-b91f501cdd42eeeb4a4d813733871bce13c44067381e17def7a7230f66638f6a  agentic-security.mjs
+cca41fc14779bcf557d1a825a32e919b51bcd4c59d73e814d37ab2ed93ca8278  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.163.0",
+  "version": "0.164.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -68,14 +68,14 @@
     "test:extras": "AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",
     "loop": "node ../scripts/loop-engineering/run.mjs",
     "test:loop-real-prd": "node --test ../scripts/loop-engineering/test/loop-real-prd.test.js",
-    "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-remote.test.js ../scripts/loop-engineering/test/loop-runbook.test.js ../scripts/loop-engineering/test/loop-assurance-profile.test.js ../scripts/loop-engineering/test/loop-assurance-runtime.test.js",
+    "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-remote.test.js ../scripts/loop-engineering/test/loop-runbook.test.js ../scripts/loop-engineering/test/loop-assurance-profile.test.js ../scripts/loop-engineering/test/loop-assurance-runtime.test.js ../scripts/loop-engineering/test/loop-bounds.test.js ../scripts/loop-engineering/test/loop-spend.test.js",
     "test:python": "node ../scripts/run-python-tests.mjs",
     "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
     "test:ollama-e2e": "AGENTIC_SECURITY_OLLAMA_E2E=1 node --test test/ollama-e2e.test.js",
     "test:glob": "node --test test/glob-compat.test.js",
     "test:sast": "node --test test/cpp-hardcoded-secret.test.js test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/csharp-cross-file.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/java-structural-cross-file.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/java-ast-folding.test.js test/java-bench-extras.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js test/secrets-coverage.test.js test/prompt-injection-payloads.test.js test/iac-cloud-templates.test.js test/ruby-path-join.test.js test/sast/manifest-line-tracking.test.js test/rust-sast.test.js test/java-deserialization-precision.test.js test/pipeline-env-secret.test.js test/mark-used-vuln-functions.test.js",
     "test:posture": "node --test test/threat-model.test.js test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/temp-leak-guard.test.js test/release-workflow.test.js test/release-workflow-structure.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/ollama-provider.test.js test/ollama-capabilities.test.js test/ollama-offline-egress.test.js test/ollama-fix-proposal.test.js test/ollama-explain-proposal.test.js test/ollama-poc-proposal.test.js test/ollama-model-probe.test.js test/ollama-agent-tools.test.js test/ollama-agent-loop.test.js test/ollama-e2e.test.js test/ollama-oom-feedback.test.js test/ollama-doc-drift.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/module-artifact-liveness.test.js test/supply-chain-provenance-completeness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/models.test.js test/cli/setup-llm.test.js test/cli/fix-retry.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js test/posture/assurance-baseline.test.js test/posture/assurance-contracts.test.js test/posture/assurance-config.test.js test/evidence-issuer.test.js test/load-factor.test.js",
-    "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-rust.test.js test/rust-taint-flow.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js test/sard-leakage-pipeline.test.js test/sard-split-scoring.test.js test/sard-llm-isolation.test.js test/sard-mutation-adversarial.test.js test/sard-baseline-adaptive-tolerance.test.js test/sard-independent-holdout.test.js test/sard-flow-aware-scoring.test.js test/sard-macro-score-support-floor.test.js test/sard-php-split.test.js test/parser-java-nary-concat.test.js test/sard-naive-baseline.test.js test/field-taint-cross-method.test.js test/field-taint-engine-unit.test.js test/coercion-sanitizer-kill.test.js test/constant-propagation-path-sensitivity.test.js test/parser-java-assignments.test.js test/catalog-java-sard.test.js test/parser-cs-juliet-shapes.test.js test/catalog-cs-sard-p2.test.js test/sard-cwe-key-merge.test.js test/parser-php-backtick.test.js test/parser-php-include.test.js test/php-include-merge.test.js test/parser-php-array-field-taint.test.js test/parser-php-cond-assign.test.js test/parser-rust-redos.test.js test/multi-sink-taint-chain.test.js test/static-field-cross-class-call-string.test.js test/regex-guard-narrowing.test.js test/object-instance-field-taint.test.js test/param-type-inference.test.js test/smt-path-feasibility.test.js test/cross-service-taint.test.js test/dataflow-expr-taint-scaling.test.js test/evaluation/guard-dominance.test.js test/evaluation/engine-mechanisms.test.js",
+    "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-rust.test.js test/rust-taint-flow.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js test/sard-leakage-pipeline.test.js test/sard-split-scoring.test.js test/sard-llm-isolation.test.js test/sard-mutation-adversarial.test.js test/sard-baseline-adaptive-tolerance.test.js test/sard-independent-holdout.test.js test/sard-flow-aware-scoring.test.js test/sard-macro-score-support-floor.test.js test/sard-php-split.test.js test/parser-java-nary-concat.test.js test/sard-naive-baseline.test.js test/field-taint-cross-method.test.js test/field-taint-engine-unit.test.js test/coercion-sanitizer-kill.test.js test/constant-propagation-path-sensitivity.test.js test/parser-java-assignments.test.js test/catalog-java-sard.test.js test/parser-cs-juliet-shapes.test.js test/catalog-cs-sard-p2.test.js test/sard-cwe-key-merge.test.js test/parser-php-backtick.test.js test/parser-php-include.test.js test/php-include-merge.test.js test/parser-php-array-field-taint.test.js test/parser-php-cond-assign.test.js test/parser-rust-redos.test.js test/multi-sink-taint-chain.test.js test/static-field-cross-class-call-string.test.js test/regex-guard-narrowing.test.js test/object-instance-field-taint.test.js test/param-type-inference.test.js test/smt-path-feasibility.test.js test/cross-service-taint.test.js test/dataflow-expr-taint-scaling.test.js test/evaluation/guard-dominance.test.js test/evaluation/engine-mechanisms.test.js test/rx-exec-receiver.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-apply-fix-multifile.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js test/mcp-dataflow-tools.test.js test/cli/governance-propose-edit.test.js test/cli/remediation-open-update.test.js test/cli/remediation-verify-reopen.test.js test/cli/dataflow-observations.test.js test/cli/federate-declare-list.test.js test/capabilities/tools.test.js",
     "test:report": "node --test test/report-scan-invariants.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/scan-health.test.js test/finding-schema.test.js test/pipeline/finding-schema-provenance.test.js test/evidence-provenance.test.js test/report/provenance-output.test.js test/report/provenance-format-parity.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",
     "test:lineage": "node --test test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js",
@@ -106,11 +106,11 @@
     "evaluation": "node ../scripts/evaluation.mjs",
     "evaluation:synthetic": "node ../scripts/evaluation.mjs synthetic",
     "test:routing": "node --test test/routing/outcomes.test.js test/routing/economics.test.js test/routing/adapter.test.js test/routing/calibration.test.js test/routing/decide.test.js test/routing/unchanged-when-off.test.js test/routing/shadow.test.js test/routing/promotion.test.js test/routing/drift.test.js test/routing/canary.test.js test/routing/feedback.test.js test/routing/report.test.js",
-    "test:release-closure": "node --test test/release-closure/closure-plan.test.js test/release-closure/closure-record.test.js test/release-closure/compatibility.test.js test/release-closure/rollout-stages.test.js test/release-closure/migration-readers.test.js test/release-closure/rollback.test.js test/release-closure/wrappers.test.js test/release-closure/final-closure.test.js test/release-closure/final-closure-controller.test.js test/release-closure/runner-hardening.test.js",
+    "test:release-closure": "node --test test/release-closure/closure-plan.test.js test/release-closure/closure-record.test.js test/release-closure/compatibility.test.js test/release-closure/rollout-stages.test.js test/release-closure/migration-readers.test.js test/release-closure/rollback.test.js test/release-closure/wrappers.test.js test/release-closure/final-closure.test.js test/release-closure/final-closure-controller.test.js test/release-closure/runner-hardening.test.js test/release-closure/remote-attestation.test.js",
     "release:closure:check": "node ../scripts/release-closure.mjs --run",
     "release:closure:static": "node ../scripts/release-closure.mjs --static",
     "test:documentation": "node --test test/documentation/drift-check.test.js test/documentation/generated-pages.test.js test/documentation/scope-and-examples.test.js test/documentation/policy-cards.test.js test/documentation/operations-and-review.test.js",
-    "test:capabilities": "node --test test/capabilities/manifest.test.js test/capabilities/filesystem.test.js test/capabilities/exec.test.js test/capabilities/network.test.js test/capabilities/canary.test.js test/capabilities/tools.test.js test/capabilities/recovery.test.js test/capabilities/receipts.test.js test/capabilities/adversarial.test.js",
+    "test:capabilities": "node --test test/capabilities/manifest.test.js test/capabilities/filesystem.test.js test/capabilities/exec.test.js test/capabilities/network.test.js test/capabilities/canary.test.js test/capabilities/tools.test.js test/capabilities/recovery.test.js test/capabilities/receipts.test.js test/capabilities/adversarial.test.js test/capabilities/linux-enforcement.test.js",
     "test:verification": "node --test test/verification/verification-record.test.js test/verification/oracle-adapters.test.js test/verification/replay-manifest.test.js test/verification/patch-negative.test.js test/verification/non-taint-classes.test.js test/verification/interface-equivalence.test.js test/verification/advisory-gating.test.js test/verification/oracle-conformance.test.js",
     "test:deployment": "node --test test/deployment/boundary-graph.test.js test/deployment/config-adapters.test.js test/deployment/trace-correlation.test.js test/deployment/cross-repo.test.js test/deployment/attack-paths.test.js test/deployment/drift.test.js test/deployment/boundary-presentation.test.js test/deployment/differentiation-ablation.test.js test/deployment/boundaries-cli.test.js",
     "test:portfolio": "node --test test/portfolio/manifest.test.js test/portfolio/bundle.test.js test/portfolio/signing.test.js test/portfolio/work-units.test.js test/portfolio/resume.test.js test/portfolio/scheduler.test.js test/portfolio/progress.test.js test/portfolio/retention.test.js test/portfolio/backend.test.js",

package/src/capabilities/CLAUDE.md

@@ -67,15 +67,20 @@ report says so. Without the opt-in an isolation-required task is `unsupported`
 (`platform-unsupported`). A control that is not proved BLOCKS the run (typed
 `blocked`, `missing-execution-backend`, the target never executes).
 
-**Linux is `unverified`.** The namespace backend does not implement read
-confinement to declared roots, several write roots, mediated network or
-supervised tree termination, so every Linux run is currently blocked with the
-missing control named. Nothing here asserts a Linux outcome that has not been
-executed; the `sandbox-linux` job is where it will be exercised. Process-count
-caps are never asserted on any backend (per-user and system-wide on macOS; they
-did not refuse on the hosted Linux runner in a previous release and the cause was
-never established); `maxProcesses` is carried and reported `unverified`, memory
-caps are carried and reported `not-enforced`.
+**Linux is `partially-verified`**, and only by the hosted `sandbox-linux` job. Its
+active probes proved write confinement, read denial, environment scrubbing, the
+no-network default, tree termination, the file-size limit, read confinement to
+declared roots and multi-root writes on the namespace backend (a pivoted tmpfs
+root; protected paths absent or masked; a PID namespace the kernel tears down).
+NOT verified: **mediated network** is not implemented on Linux (an empty network
+namespace has no path to a proxy), so a task that declares a destination is
+`blocked` there with `network-mediation is unsupported`, never allowed; and
+**process-count caps** are never asserted on any backend (on Linux the cause of
+the earlier non-refusal is that the resource prelude runs under dash, whose
+`ulimit` has no `-u`; no replacement is proved). `maxProcesses` is carried and
+reported `unverified`, memory caps `not-enforced`. The execution suites under
+`test/capabilities/` still skip on Linux (their helpers select the userspace
+backend only and several assertions encode macOS semantics); see the gaps below.
 
 ## Known limits (also in `REPORT_LIMITATIONS`)
 
@@ -107,8 +112,7 @@ attempts were stopped on this backend in this run; it does not show the sandbox
 ### What is still not claimed
 
 Tool and delegation checks are policy at the tool boundary (the tool then runs in the server process): the
-runner remains the only enforcement layer. Linux stays `unverified` in every report, receipt and coverage
-record, and no Linux outcome is asserted. No process-count cap is asserted. The corpus is not wired into the
+runner remains the only enforcement layer. Linux is `partially-verified` in the platform statement (the controls listed there, on the hosted job only) and the attack-coverage record still says `unverified` for Linux, because the corpus is not run on Linux. No process-count cap is asserted. The corpus is not wired into the
 `sandbox-linux` CI job: it would need execution cases that skip loudly (never silently pass) on Linux, and that
 has not been shown from this workspace. The enforced-mode release gate (`enforcedModeReleaseGate`) is a library
 function used by the suite; it is not yet called from `scripts/release-check.mjs`.

package/src/capabilities/probes.js

@@ -48,15 +48,18 @@ function mk(prefix) { return fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(
 function rm(p) { try { fs.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } }
 const token = (p) => `${p}-${crypto.randomBytes(8).toString('hex')}`;
 
-async function probeFsRead(backend) {
-  if (backend !== 'userspace') return unsupported(`read confinement to declared roots is not implemented on the ${backend} backend`);
+// `run` is a seam so a test can hand the probe a runner that is deliberately
+// wrong (a read root left too wide, a root left writable) and see the probe say
+// so: a probe that cannot fail proves nothing.
+export async function probeFsRead(backend, runner = runConfinedSupervised) {
+  if (backend !== 'userspace' && backend !== 'namespace') return unsupported(`read confinement to declared roots is not implemented on the ${backend} backend`);
   const root = mk('agsec-cap-r-'); const ro = mk('agsec-cap-ro-'); const outside = mk('agsec-cap-out-');
   try {
     const okTok = token('READABLE'); const secTok = token('SEALED');
     fs.writeFileSync(path.join(ro, 'r.txt'), okTok);
     fs.writeFileSync(path.join(outside, 's.txt'), secTok);
     fs.symlinkSync(path.join(outside, 's.txt'), path.join(ro, 'link'));
-    const run = (script, readRoots) => runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots, timeoutMs: 8000, graceMs: 300 });
+    const run = (script, readRoots) => runner(['/bin/sh', '-c', script], { root, readRoots, timeoutMs: 8000, graceMs: 300 });
     const pos = await run(`cat '${ro}/r.txt'`, [ro]);
     if (!pos.stdout.includes(okTok)) return notProved(`positive control failed: a file inside a declared root was not readable (${pos.status})`);
     const open = await run(`cat '${outside}/s.txt'`, [ro, outside]);
@@ -75,13 +78,13 @@ async function probeFsRead(backend) {
   } finally { rm(root); rm(ro); rm(outside); }
 }
 
-async function probeMultiWrite(backend) {
-  if (backend !== 'userspace') return unsupported(`several declared write roots are not implemented on the ${backend} backend`);
+export async function probeMultiWrite(backend, runner = runConfinedSupervised) {
+  if (backend !== 'userspace' && backend !== 'namespace') return unsupported(`several declared write roots are not implemented on the ${backend} backend`);
   const root = mk('agsec-cap-w-'); const w1 = mk('agsec-cap-w1-'); const w2 = mk('agsec-cap-w2-');
   const ro = mk('agsec-cap-wro-'); const outside = mk('agsec-cap-wout-');
   try {
     const script = [`echo a > '${w1}/f'`, `echo b > '${w2}/f'`, `echo c > '${ro}/f'`, `echo d > '${outside}/f'`, 'true'].join('; ');
-    await runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots: [ro], writeRoots: [w1, w2], timeoutMs: 8000, graceMs: 300 });
+    await runner(['/bin/sh', '-c', script], { root, readRoots: [ro], writeRoots: [w1, w2], timeoutMs: 8000, graceMs: 300 });
     if (!fs.existsSync(path.join(w1, 'f')) || !fs.existsSync(path.join(w2, 'f'))) return notProved('positive control failed: a declared write root was not writable');
     if (fs.existsSync(path.join(ro, 'f'))) return notProved('a root declared read-only was writable');
     if (fs.existsSync(path.join(outside, 'f'))) return notProved('an undeclared directory was writable');
@@ -197,8 +200,19 @@ export function isAdvertisedBackend(backend, platform = process.platform) {
 export function platformStatements() {
   return Object.freeze({
     linux: {
-      backend: 'namespace', status: 'unverified',
-      note: 'advertised for enforced mode, but the control probes in this module have not run on a Linux host from this workspace. Several controls are not implemented on the namespace backend (read confinement to declared roots, several write roots, mediated network, supervised tree termination), so enforced mode is blocked there until they are implemented and the sandbox-linux job shows them proved. Process-count caps are never claimed.',
+      backend: 'namespace', status: 'partially-verified',
+      // Evidence is the hosted sandbox-linux CI job (ubuntu-latest, x86_64), whose active probes
+      // (attack plus positive control, with fault-injection counterparts) proved these controls.
+      // Anything not listed here is not claimed: a verified control is verified on that runner image
+      // and kernel, not on every Linux host, which is why the job runs on every push.
+      evidence: 'sandbox-linux CI job (hosted ubuntu-latest, x86_64); scripts/sandbox-linux-verify.mjs',
+      verifiedControls: Object.freeze([
+        'write-confinement', 'read-denial', 'env-scrub', 'network', 'tree-termination', 'file-size-limit',
+        'fs-read-confinement', 'fs-multi-root-write',
+      ]),
+      unsupportedControls: Object.freeze(['network-mediation']),
+      unassertedControls: Object.freeze(['process-cap']),
+      note: 'advertised for enforced mode. Proved by active probes on the hosted Linux runner (not on every Linux host): write-confinement, read-denial, env-scrub, network, tree-termination, file-size-limit, fs-read-confinement, fs-multi-root-write. Mediated network is NOT implemented on the namespace backend (an empty network namespace has no path to a proxy), so a task that declares a network destination is blocked on Linux, never allowed. Process-count caps are never claimed: the cause of the earlier non-refusal was found (the shell used for the resource prelude has no process-limit option, so the cap was never applied) and no replacement has been proved. The attack corpus is not run in the sandbox-linux job, so corpus coverage stays unverified on Linux.',
     },
     darwin: {
       backend: 'userspace', status: 'host-proved-not-advertised',

package/src/dataflow/CLAUDE.md

@@ -16,6 +16,7 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
     - Guarded by `bench/mutation/runner.mjs` (`npm run bench:mutation:check`), which scores verdict-flip correctness over metamorphic rewrites (verdict must hold) and adversarial near-misses (verdict must flip). Removing the family check makes it exit non-zero.
   - **`match.receiver`** (optional, regex source string) constrains a call to call sites whose receiver chain has a matching segment. Callee matching is by *bare name*, so `callee: 'write'` otherwise matches `process.stdout.write` and `fh.write` as readily as `document.write`. Works for both sinks (via `matchSinkOrSanitizer`) and sources (via `matchSource`'s CALL-source path). `match.receiverBase` is an optional, independent second pattern (both `_receiverAllowed` checks must pass) — use it when `receiver` alone would still match an unrelated same-named local, e.g. `py-flask-args-get` requires *both* a property segment (`args`/`form`/`headers`/…) *and* a `request`/`req` segment, so `args = parse(); args.get(x)` doesn't fire just because some catalog entry happens to be named `get`.
   - **`match.receiverExclude`** (optional, regex source string) is the only NEGATIVE form — `receiver`/`receiverBase` can only ever REQUIRE a match, which cannot express "fire on a bare call, but not on THIS receiver." `py-compile` needs exactly that: Python's dangerous `compile()` builtin (`compile(source, filename, mode)`, equivalent to `eval` when followed by `exec`) is called BARE, but the catalog's bare-name last-segment fallback (`_calleeIndexHits`) makes the same key also match `re.compile(pattern)` — an ordinary regex compiler with no code-execution capability. `receiverExclude: '^re$'` fixes it. Checked FIRST, independently of `receiver`/`receiverBase`, and a bare call (no receiver segments) can never match an exclude pattern — so setting only `receiverExclude` never blocks the no-receiver case it exists to preserve. Found via this project's own self-scan once `_calleeReceiverTainted` (below) started correctly propagating taint through `.get()`-style calls on a tainted dict/file-read chain — the sink was always mismatched; the engine fix just gave taint a path to reach it. Guarded by `test/catalog-code-injection.test.js`.
+  - **`match.receiverTypeExclude`** (optional, array of regex sources) is the type-level negative form: a CONFIDENTLY resolved receiver type matching it removes the entry (`_receiverTypeAllowed`); an unresolved type never excludes, so unknown stays conservative. `js-exec` uses `['^RegExp$']` because a regex's `.exec()` shares its method name with `child_process.exec` and is far more common on request data (it was a high-volume false positive). The type comes from three places: `catalog.js`'s `_inlineReceiverType` (a regex literal or `RegExp(...)` call as the receiver, applied inside `matchSinkOrSanitizer` so every caller gets it), CHA `classOfVar` (in-function `new RegExp`), and `engine.js`'s `_regexNamesByFile` (a file-wide name set: every assignment to the name anywhere in the file is a regex initialiser and it is never a parameter; built by `_buildRegexNames` at the start of `runTaintEngine`, because CHA cannot see a module-scope const from inside a handler). The name set is deliberately scope-blind, so a name bound to anything else anywhere in the file is not trusted. Guarded by `test/rx-exec-receiver.test.js` and the `rx-exec-*` cases in `bench/mutation/runner.mjs`.
   - **`language`** is enforced by `_languageAllowed` (Phase 2) via a table (`_LANG_EXT` in `catalog.js`) covering all ten catalog languages — `js`, `py`, `cs`, `kt`, `go`, `php`, `rb`, `java`, `rs` by literal regex kept byte-identical to `ir/index.js`'s own dispatch regexes (pinned by `test/phase2-scoping.test.js`, which compares `.source` directly, not just "does this regex literal appear somewhere in the file"), and `cpp` by delegating to `ir/parser-cpp.js`'s `cppExtRe()` so it can't drift from the parser. A language with no table entry stays permissive (matches any file) — additive by design, so it can't regress a language before its entry exists.
 - **Path feasibility.** Constant-folds `if` conditions to prune unreachable branches.
 - **Per-flow source attribution.** Sources reported on a finding are the ones actually reaching the sink argument (via free-var matching in the sink expression), NOT the first source the worklist happened to see. Premortem-derived.

package/src/dataflow/catalog.js

@@ -79,7 +79,7 @@ export const CATALOG = [
     vuln: { name: 'SQL Injection (db.execute)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Use parameterized queries: db.execute("SELECT * FROM t WHERE id = ?", [id]).' } },
   // OS command.
-  { kind: 'sink', id: 'js-exec',     language: 'js', framework: 'node', match: { type: 'call', callee: 'exec'     }, argIndex: 0,
+  { kind: 'sink', id: 'js-exec',     language: 'js', framework: 'node', match: { type: 'call', callee: 'exec', receiverTypeExclude: ['^RegExp$'] }, argIndex: 0,
     vuln: { name: 'Command Injection (child_process.exec)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Use execFile or spawn with an argv array instead of exec — exec invokes the shell. If shell features are required, escape with shell-escape, never string-concat user input.' } },
   { kind: 'sink', id: 'js-execSync', language: 'js', framework: 'node', match: { type: 'call', callee: 'execSync' }, argIndex: 0,
@@ -2381,6 +2381,13 @@ function _receiverAllowed(entry, calleeExpr) {
 // vocabulary. Over-matching here is the safe direction: it only ever
 // *permits* a match the pattern layer already made.
 function _receiverTypeAllowed(entry, receiverType) {
+  // `receiverTypeExclude` is the NEGATIVE counterpart of `receiverTypeIn`: a
+  // confidently resolved receiver type that matches it removes the entry. An
+  // unresolved type (null) never excludes, so the conservative behaviour is
+  // unchanged whenever the engine cannot tell. `js-exec` uses it to drop a
+  // RegExp's `.exec()`, which shares its method name with child_process.exec.
+  const ex = entry.match && entry.match.receiverTypeExclude;
+  if (ex && ex.length && receiverType && ex.some((p) => new RegExp(p).test(String(receiverType)))) return false;
   const pats = entry.match && entry.match.receiverTypeIn;
   if (!pats || !pats.length) return true;
   if (!receiverType) return true;
@@ -2638,8 +2645,21 @@ export function matchSource(expr, file, receiverType) {
   return null;
 }
 
+// A receiver whose type is evident from the expression itself, with no
+// binding to resolve: a regex literal (`/x/.exec(s)`) or a direct construction
+// (`new RegExp(p).exec(s)`). Returns 'RegExp' or null. Callers that can also
+// resolve a bound variable pass their own `receiverType`, which wins.
+function _inlineReceiverType(calleeExpr) {
+  const o = calleeExpr && typeof calleeExpr === 'object' && calleeExpr.kind === 'member' ? calleeExpr.object : null;
+  if (!o) return null;
+  if (o.kind === 'literal' && o.isRegex) return 'RegExp';
+  if (o.kind === 'call' && o.callee && o.callee.kind === 'ident' && o.callee.name === 'RegExp') return 'RegExp';
+  return null;
+}
+
 export function matchSinkOrSanitizer(calleeExpr, file, receiverType) {
   if (!calleeExpr) return null;
+  receiverType = receiverType || _inlineReceiverType(calleeExpr);
   const raw = _calleeIndexHits(calleeExpr);
   if (!raw.length) return null;
   const hits = filterByProvenance(raw)

package/src/dataflow/engine.js

@@ -166,6 +166,11 @@ function _fullyFlattenMemberChain(calleeExpr) {
 // "unknown", never as a signal to suppress or refuse (see this file's
 // "Unknown ≠ clean" global constraint).
 function _receiverTypeFor(calleeExpr, callContext) {
+  // A bare identifier receiver that every binding in this file initialises to a
+  // regex is a RegExp (see _regexNamesForFile). Checked before CHA, which
+  // cannot see a module-scope const from inside the handler that uses it.
+  if (calleeExpr && calleeExpr.kind === 'member' && calleeExpr.object && calleeExpr.object.kind === 'ident'
+      && _currentFile && _regexNamesByFile.get(_currentFile)?.has(calleeExpr.object.name)) return 'RegExp';
   if (!callContext || !callContext._cha) return null;
   const flat = _fullyFlattenMemberChain(calleeExpr);
   if (!flat || !flat.includes('.')) return null;
@@ -197,6 +202,45 @@ function _receiverTypeFor(calleeExpr, callContext) {
   return classOfVar(callContext._cha, _currentFile, callContext._currentFnQid, parts[0]);
 }
 
+// File -> Set of identifier names that are provably RegExp objects: the name
+// is assigned at least once, EVERY assignment to it anywhere in the file (any
+// function, any scope, including module scope) is a regex literal or a
+// `RegExp(...)` / `new RegExp(...)` construction, and it is never a function
+// parameter. Name-based and file-wide on purpose: the IR has no scope
+// resolution, so a name that is ever bound to anything else is treated as
+// unknown, which keeps the catalog's conservative behaviour. Used so
+// `SEMVER.exec(s)` is not read as child_process.exec. Residual gap: a name
+// bound by an import or a destructuring that lowers to no assign node, AND
+// also assigned a regex in an unrelated scope of the same file.
+const _regexNamesByFile = new Map();
+
+function _isRegexInit(src) {
+  if (!src || typeof src !== 'object') return false;
+  if (src.kind === 'literal' && src.isRegex) return true;
+  return src.kind === 'call' && !!src.callee && src.callee.kind === 'ident' && src.callee.name === 'RegExp';
+}
+
+function _buildRegexNames(fns) {
+  _regexNamesByFile.clear();
+  const byFile = new Map();   // file -> Map(name -> boolean allRegex)
+  for (const fn of fns) {
+    if (!fn || !fn.file || !fn.cfg || !fn.cfg.nodes) continue;
+    let names = byFile.get(fn.file);
+    if (!names) { names = new Map(); byFile.set(fn.file, names); }
+    for (const p of fn.params || []) if (typeof p === 'string') names.set(p, false);
+    for (const n of Object.values(fn.cfg.nodes)) {
+      if (!n || n.kind !== 'assign' || typeof n.target !== 'string' || n.target.includes('.')) continue;
+      const prev = names.get(n.target);
+      names.set(n.target, (prev === undefined || prev === true) && _isRegexInit(n.source));
+    }
+  }
+  for (const [file, names] of byFile) {
+    const ok = new Set();
+    for (const [name, allRegex] of names) if (allRegex) ok.add(name);
+    if (ok.size) _regexNamesByFile.set(file, ok);
+  }
+}
+
 // Narrower than _flattenCalleeName: the name to hand to callGraph.resolve().
 // Only a bare identifier call (`helper()`) — or a pre-flattened STRING, which
 // is how the Go/PHP/Ruby/Python/C++ parsers already emit call targets —
@@ -1987,7 +2031,7 @@ function analyzeFunction(fn, entryState, callContext) {
       for (const [nid, ctx] of ictx) {
         const node = nodes[nid];
         if (!node || node.kind !== 'call') continue;
-        const cat = matchSinkOrSanitizer(node.callee, _currentFile);
+        const cat = matchSinkOrSanitizer(node.callee, _currentFile, _receiverTypeFor(node.callee, callContext));
         const sink = cat && cat.find((e) => e.kind === 'sink');
         if (!sink) continue;
         const inS = inStates.get(nid) || new Set();
@@ -2001,7 +2045,7 @@ function analyzeFunction(fn, entryState, callContext) {
       if (implicitState.size) {
         for (const [nid, node] of Object.entries(nodes)) {
           if (!node || node.kind !== 'call') continue;
-          const cat = matchSinkOrSanitizer(node.callee, _currentFile);
+          const cat = matchSinkOrSanitizer(node.callee, _currentFile, _receiverTypeFor(node.callee, callContext));
           const sink = cat && cat.find((e) => e.kind === 'sink');
           if (!sink) continue;
           const inS = inStates.get(nid) || new Set();
@@ -2109,6 +2153,7 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
   const fnList = [...callGraph.functions.values()].sort((a, b) =>
     a.qid < b.qid ? -1 : a.qid > b.qid ? 1 : 0
   );
+  _buildRegexNames(fnList);
   // PRD W0.1 (SARD_80_F1_EXECUTION_PRD.md) — the main per-function loop below
   // silently `break`s once `n > fnLimit` (default 5000), which for a single
   // large SARD CWE directory (Java CWE-89 alone: 3668 files, 17604

package/src/sandbox/CLAUDE.md

@@ -281,9 +281,9 @@ privilegeDrop`), the same mechanism `limits.js` uses for an unenforceable
 limit. It is never silently skipped, and the escape test that covers the
 rebind attack fails if it is missing rather than quietly passing.
 
-**None of the above has been executed anywhere yet.** It is asserted by
-`sandbox-escape.test.js`'s kernel-namespace suite, which skips on macOS. Until
-a CI log shows that suite `RAN`, this section describes code, not evidence.
+**Executed on a hosted Linux runner.** The `sandbox-linux` job ran the suite
+(see the verification sections below); this section describes code that has
+been exercised, on that runner image and kernel only.
 
 ## Timeout does not kill the process tree
 
@@ -297,18 +297,24 @@ inside the policy profile — their writes and egress remain confined — but th
 are still running and still consuming resources. A caller that needs a hard
 tree kill must implement it.
 
-The namespace backend is structurally better here: it runs the confined
-command under `--pid --fork`, so the direct child is pid 1 of a new PID
-namespace and killing it should take the namespace's processes with it. That
-is a reasoned expectation from the flags, **not** an executed result — it
-needs the same Linux-host verification as everything else on that backend.
+The namespace backend closes this with the kernel, not a sweep: the command
+runs under `--pid --fork --kill-child`, so when the `unshare` supervisor dies
+the namespace's init gets SIGKILL and the kernel kills every member, including
+a double-forked `setsid` descendant that no process-group or sweep logic can
+find. `--kill-child` is used only where `unshare` advertises it
+(`namespaceTreeKill`); without it supervised execution is refused. Proved by
+the `linux-probes.js` probes on the hosted runner (kill the supervisor, kill
+the init directly). Earlier text here said killing the direct child should reap
+the tree; CI showed it did not (the killed process was the supervisor, not the
+init) until `--kill-child` was added.
 
 ## Known limitation, deliberately accepted: reads are not confined
 
 The userspace policy allows `(allow file-read*)` globally — that backend
 confines **writes**, network egress, and resource use, but **not reads**. (The
-kernel-namespace backend has the same cut: per the section above its mount
-tree is rebound read-only, not detached, so everything on it stays readable.)
+kernel-namespace backend has the same cut in its DEFAULT mode: its mount
+tree is rebound read-only, not detached, so everything on it stays readable.
+Its capability mode, entered with `readRoots`, does confine reads; see below.)
 A confined command can read any file on the host the OS-level
 permissions allow, including outside the sandbox root. Exfiltration of
 readable host files (writing what was read to network or to a location the
@@ -364,20 +370,26 @@ then runs supervised with protected paths read-denied.
   default protected set is the key directory, common credential directories
   under the home directory, plus caller-supplied sealed-label and evidence
   directories. A denylist is a floor, not a claim of host-wide read isolation.
-  The namespace backend does NOT implement it and returns `status:'error'`
-  without executing when asked, so on Linux the boundary is `blocked`.
+  The namespace backend implements it by masking: an empty tmpfs over a
+  protected directory, `/dev/null` over a protected file (in capability mode a
+  protected path outside every declared root is simply absent). Proved by the
+  protected-canary probes on the hosted runner.
 - **Process trees** (`supervise.js`): own process group, periodic descendant
   sweep, SIGTERM, grace, SIGKILL, then a poll that confirms no survivors; the
   same cleanup runs on a clean exit. Cancel is an `AbortSignal` (status
   `cancelled`). Output is capped. Known gap: a double-fork plus setsid between
   two sweeps escapes; only a PID namespace or cgroup closes it. Supervised
-  execution exists ONLY for the userspace backend; `namespace` is refused
-  because tree termination has not been implemented and executed there.
+  execution exists for the userspace backend and for the namespace backend
+  where `--kill-child` is available (see above).
 - **Active probes**: write confinement, read denial, env scrub, network, tree
   termination and the file-size limit each run an attack plus a positive
   control through the real backend. `process-cap` is reported `unverified` on
-  every backend and must not be claimed enforced (per-uid and system-wide on
-  macOS, and it did not refuse on the hosted Linux runner in the last release).
+  every backend and must not be claimed enforced. Per-uid and system-wide on
+  macOS. On Linux the cause of the earlier non-refusal is now known: the
+  resource prelude is run by `/bin/sh`, which is dash on the hosted runner, and
+  dash's `ulimit` has no `-u` option (`ulimit: Illegal option -u` appears in
+  the `sandbox-linux` log), so the cap was never applied at all. No replacement
+  (for example `prlimit`) has been proved, so the cap stays unasserted.
   `capabilityReport()` carries the standing note that Linux enforcement is
   evidenced only where the `sandbox-linux` CI job ran the same probes.
 - **Status**: target output is returned labelled `untrusted` and is never parsed
@@ -396,7 +408,27 @@ then runs supervised with protected paths read-denied.
 - `writeRoots`: further writable subtrees (readable too). `cwd`: working directory, which must exist.
 - `networkProxyPort`: opens exactly one loopback port (`(remote ip "localhost:PORT")`); DNS, every other port and every other address stay denied.
 
-Verified by execution on macOS only (`test/capabilities/`, probes in `capabilities/probes.js`). The namespace backend implements none of these options; asked for them it ignores them, which is why the capability runner never asks it: its probes report these controls `unsupported` there and the run is blocked.
+Verified by execution on macOS only (`test/capabilities/`, probes in `capabilities/probes.js`). The namespace backend implements `readRoots`, `writeRoots`, `cwd` and
+`denyReadPaths` as **capability mode** (entered when `readRoots` is an array): a
+tmpfs root holding only the runtime baseline (`/usr`, `/bin`, `/lib*`, a few
+identity files, a fresh `/proc` and a minimal `/dev`) plus the declared roots,
+read-only for read roots and read-write for write roots, protected paths absent
+or masked, then `pivot_root` and a detached old root (`linux-rootfs.js` builds
+the plan and the setup script; `backend-namespace.js` runs it). Capability drop
+(`setpriv`, with no-new-privs) is required in this mode, not best effort.
+`networkProxyPort` is REFUSED: mediated network is not implemented on Linux, so
+a task that declares a destination is blocked there.
+
+### Linux evidence
+
+`linux-probes.js` and the generic probes in `control-probes.js` and
+`capabilities/probes.js` attack each control and pair it with a positive
+control; `test/capabilities/linux-enforcement.test.js` also runs every probe
+against a deliberately wrong runner (fault injection) and requires it to say so.
+`scripts/sandbox-linux-verify.mjs` (the `sandbox-linux` job) fails if a required
+suite skips, a required control is not proved, or a control that must stay
+unasserted claims to be proved, and uploads the evidence table. Exploratory runs
+on a local aarch64 VM are not evidence; only the hosted x86_64 job is.
 
 ## Extending this module