@clear-capabilities/agentic-security-scanner 0.163.1 → 0.164.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-ce6a06e07ced6e9bc14c71c7025f5bd9d50e91b9fffafcde1cf2ea54125a5654  agentic-security.mjs
+cca41fc14779bcf557d1a825a32e919b51bcd4c59d73e814d37ab2ed93ca8278  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.163.1",
+  "version": "0.164.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -68,7 +68,7 @@
     "test:extras": "AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",
     "loop": "node ../scripts/loop-engineering/run.mjs",
     "test:loop-real-prd": "node --test ../scripts/loop-engineering/test/loop-real-prd.test.js",
-    "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-remote.test.js ../scripts/loop-engineering/test/loop-runbook.test.js ../scripts/loop-engineering/test/loop-assurance-profile.test.js ../scripts/loop-engineering/test/loop-assurance-runtime.test.js",
+    "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-remote.test.js ../scripts/loop-engineering/test/loop-runbook.test.js ../scripts/loop-engineering/test/loop-assurance-profile.test.js ../scripts/loop-engineering/test/loop-assurance-runtime.test.js ../scripts/loop-engineering/test/loop-bounds.test.js ../scripts/loop-engineering/test/loop-spend.test.js",
     "test:python": "node ../scripts/run-python-tests.mjs",
     "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
     "test:ollama-e2e": "AGENTIC_SECURITY_OLLAMA_E2E=1 node --test test/ollama-e2e.test.js",
@@ -106,11 +106,11 @@
     "evaluation": "node ../scripts/evaluation.mjs",
     "evaluation:synthetic": "node ../scripts/evaluation.mjs synthetic",
     "test:routing": "node --test test/routing/outcomes.test.js test/routing/economics.test.js test/routing/adapter.test.js test/routing/calibration.test.js test/routing/decide.test.js test/routing/unchanged-when-off.test.js test/routing/shadow.test.js test/routing/promotion.test.js test/routing/drift.test.js test/routing/canary.test.js test/routing/feedback.test.js test/routing/report.test.js",
-    "test:release-closure": "node --test test/release-closure/closure-plan.test.js test/release-closure/closure-record.test.js test/release-closure/compatibility.test.js test/release-closure/rollout-stages.test.js test/release-closure/migration-readers.test.js test/release-closure/rollback.test.js test/release-closure/wrappers.test.js test/release-closure/final-closure.test.js test/release-closure/final-closure-controller.test.js test/release-closure/runner-hardening.test.js",
+    "test:release-closure": "node --test test/release-closure/closure-plan.test.js test/release-closure/closure-record.test.js test/release-closure/compatibility.test.js test/release-closure/rollout-stages.test.js test/release-closure/migration-readers.test.js test/release-closure/rollback.test.js test/release-closure/wrappers.test.js test/release-closure/final-closure.test.js test/release-closure/final-closure-controller.test.js test/release-closure/runner-hardening.test.js test/release-closure/remote-attestation.test.js",
     "release:closure:check": "node ../scripts/release-closure.mjs --run",
     "release:closure:static": "node ../scripts/release-closure.mjs --static",
     "test:documentation": "node --test test/documentation/drift-check.test.js test/documentation/generated-pages.test.js test/documentation/scope-and-examples.test.js test/documentation/policy-cards.test.js test/documentation/operations-and-review.test.js",
-    "test:capabilities": "node --test test/capabilities/manifest.test.js test/capabilities/filesystem.test.js test/capabilities/exec.test.js test/capabilities/network.test.js test/capabilities/canary.test.js test/capabilities/tools.test.js test/capabilities/recovery.test.js test/capabilities/receipts.test.js test/capabilities/adversarial.test.js",
+    "test:capabilities": "node --test test/capabilities/manifest.test.js test/capabilities/filesystem.test.js test/capabilities/exec.test.js test/capabilities/network.test.js test/capabilities/canary.test.js test/capabilities/tools.test.js test/capabilities/recovery.test.js test/capabilities/receipts.test.js test/capabilities/adversarial.test.js test/capabilities/linux-enforcement.test.js",
     "test:verification": "node --test test/verification/verification-record.test.js test/verification/oracle-adapters.test.js test/verification/replay-manifest.test.js test/verification/patch-negative.test.js test/verification/non-taint-classes.test.js test/verification/interface-equivalence.test.js test/verification/advisory-gating.test.js test/verification/oracle-conformance.test.js",
     "test:deployment": "node --test test/deployment/boundary-graph.test.js test/deployment/config-adapters.test.js test/deployment/trace-correlation.test.js test/deployment/cross-repo.test.js test/deployment/attack-paths.test.js test/deployment/drift.test.js test/deployment/boundary-presentation.test.js test/deployment/differentiation-ablation.test.js test/deployment/boundaries-cli.test.js",
     "test:portfolio": "node --test test/portfolio/manifest.test.js test/portfolio/bundle.test.js test/portfolio/signing.test.js test/portfolio/work-units.test.js test/portfolio/resume.test.js test/portfolio/scheduler.test.js test/portfolio/progress.test.js test/portfolio/retention.test.js test/portfolio/backend.test.js",

package/src/capabilities/CLAUDE.md

@@ -67,15 +67,20 @@ report says so. Without the opt-in an isolation-required task is `unsupported`
 (`platform-unsupported`). A control that is not proved BLOCKS the run (typed
 `blocked`, `missing-execution-backend`, the target never executes).
 
-**Linux is `unverified`.** The namespace backend does not implement read
-confinement to declared roots, several write roots, mediated network or
-supervised tree termination, so every Linux run is currently blocked with the
-missing control named. Nothing here asserts a Linux outcome that has not been
-executed; the `sandbox-linux` job is where it will be exercised. Process-count
-caps are never asserted on any backend (per-user and system-wide on macOS; they
-did not refuse on the hosted Linux runner in a previous release and the cause was
-never established); `maxProcesses` is carried and reported `unverified`, memory
-caps are carried and reported `not-enforced`.
+**Linux is `partially-verified`**, and only by the hosted `sandbox-linux` job. Its
+active probes proved write confinement, read denial, environment scrubbing, the
+no-network default, tree termination, the file-size limit, read confinement to
+declared roots and multi-root writes on the namespace backend (a pivoted tmpfs
+root; protected paths absent or masked; a PID namespace the kernel tears down).
+NOT verified: **mediated network** is not implemented on Linux (an empty network
+namespace has no path to a proxy), so a task that declares a destination is
+`blocked` there with `network-mediation is unsupported`, never allowed; and
+**process-count caps** are never asserted on any backend (on Linux the cause of
+the earlier non-refusal is that the resource prelude runs under dash, whose
+`ulimit` has no `-u`; no replacement is proved). `maxProcesses` is carried and
+reported `unverified`, memory caps `not-enforced`. The execution suites under
+`test/capabilities/` still skip on Linux (their helpers select the userspace
+backend only and several assertions encode macOS semantics); see the gaps below.
 
 ## Known limits (also in `REPORT_LIMITATIONS`)
 
@@ -107,8 +112,7 @@ attempts were stopped on this backend in this run; it does not show the sandbox
 ### What is still not claimed
 
 Tool and delegation checks are policy at the tool boundary (the tool then runs in the server process): the
-runner remains the only enforcement layer. Linux stays `unverified` in every report, receipt and coverage
-record, and no Linux outcome is asserted. No process-count cap is asserted. The corpus is not wired into the
+runner remains the only enforcement layer. Linux is `partially-verified` in the platform statement (the controls listed there, on the hosted job only) and the attack-coverage record still says `unverified` for Linux, because the corpus is not run on Linux. No process-count cap is asserted. The corpus is not wired into the
 `sandbox-linux` CI job: it would need execution cases that skip loudly (never silently pass) on Linux, and that
 has not been shown from this workspace. The enforced-mode release gate (`enforcedModeReleaseGate`) is a library
 function used by the suite; it is not yet called from `scripts/release-check.mjs`.

package/src/capabilities/probes.js

@@ -48,15 +48,18 @@ function mk(prefix) { return fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(
 function rm(p) { try { fs.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } }
 const token = (p) => `${p}-${crypto.randomBytes(8).toString('hex')}`;
 
-async function probeFsRead(backend) {
-  if (backend !== 'userspace') return unsupported(`read confinement to declared roots is not implemented on the ${backend} backend`);
+// `run` is a seam so a test can hand the probe a runner that is deliberately
+// wrong (a read root left too wide, a root left writable) and see the probe say
+// so: a probe that cannot fail proves nothing.
+export async function probeFsRead(backend, runner = runConfinedSupervised) {
+  if (backend !== 'userspace' && backend !== 'namespace') return unsupported(`read confinement to declared roots is not implemented on the ${backend} backend`);
   const root = mk('agsec-cap-r-'); const ro = mk('agsec-cap-ro-'); const outside = mk('agsec-cap-out-');
   try {
     const okTok = token('READABLE'); const secTok = token('SEALED');
     fs.writeFileSync(path.join(ro, 'r.txt'), okTok);
     fs.writeFileSync(path.join(outside, 's.txt'), secTok);
     fs.symlinkSync(path.join(outside, 's.txt'), path.join(ro, 'link'));
-    const run = (script, readRoots) => runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots, timeoutMs: 8000, graceMs: 300 });
+    const run = (script, readRoots) => runner(['/bin/sh', '-c', script], { root, readRoots, timeoutMs: 8000, graceMs: 300 });
     const pos = await run(`cat '${ro}/r.txt'`, [ro]);
     if (!pos.stdout.includes(okTok)) return notProved(`positive control failed: a file inside a declared root was not readable (${pos.status})`);
     const open = await run(`cat '${outside}/s.txt'`, [ro, outside]);
@@ -75,13 +78,13 @@ async function probeFsRead(backend) {
   } finally { rm(root); rm(ro); rm(outside); }
 }
 
-async function probeMultiWrite(backend) {
-  if (backend !== 'userspace') return unsupported(`several declared write roots are not implemented on the ${backend} backend`);
+export async function probeMultiWrite(backend, runner = runConfinedSupervised) {
+  if (backend !== 'userspace' && backend !== 'namespace') return unsupported(`several declared write roots are not implemented on the ${backend} backend`);
   const root = mk('agsec-cap-w-'); const w1 = mk('agsec-cap-w1-'); const w2 = mk('agsec-cap-w2-');
   const ro = mk('agsec-cap-wro-'); const outside = mk('agsec-cap-wout-');
   try {
     const script = [`echo a > '${w1}/f'`, `echo b > '${w2}/f'`, `echo c > '${ro}/f'`, `echo d > '${outside}/f'`, 'true'].join('; ');
-    await runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots: [ro], writeRoots: [w1, w2], timeoutMs: 8000, graceMs: 300 });
+    await runner(['/bin/sh', '-c', script], { root, readRoots: [ro], writeRoots: [w1, w2], timeoutMs: 8000, graceMs: 300 });
     if (!fs.existsSync(path.join(w1, 'f')) || !fs.existsSync(path.join(w2, 'f'))) return notProved('positive control failed: a declared write root was not writable');
     if (fs.existsSync(path.join(ro, 'f'))) return notProved('a root declared read-only was writable');
     if (fs.existsSync(path.join(outside, 'f'))) return notProved('an undeclared directory was writable');
@@ -197,8 +200,19 @@ export function isAdvertisedBackend(backend, platform = process.platform) {
 export function platformStatements() {
   return Object.freeze({
     linux: {
-      backend: 'namespace', status: 'unverified',
-      note: 'advertised for enforced mode, but the control probes in this module have not run on a Linux host from this workspace. Several controls are not implemented on the namespace backend (read confinement to declared roots, several write roots, mediated network, supervised tree termination), so enforced mode is blocked there until they are implemented and the sandbox-linux job shows them proved. Process-count caps are never claimed.',
+      backend: 'namespace', status: 'partially-verified',
+      // Evidence is the hosted sandbox-linux CI job (ubuntu-latest, x86_64), whose active probes
+      // (attack plus positive control, with fault-injection counterparts) proved these controls.
+      // Anything not listed here is not claimed: a verified control is verified on that runner image
+      // and kernel, not on every Linux host, which is why the job runs on every push.
+      evidence: 'sandbox-linux CI job (hosted ubuntu-latest, x86_64); scripts/sandbox-linux-verify.mjs',
+      verifiedControls: Object.freeze([
+        'write-confinement', 'read-denial', 'env-scrub', 'network', 'tree-termination', 'file-size-limit',
+        'fs-read-confinement', 'fs-multi-root-write',
+      ]),
+      unsupportedControls: Object.freeze(['network-mediation']),
+      unassertedControls: Object.freeze(['process-cap']),
+      note: 'advertised for enforced mode. Proved by active probes on the hosted Linux runner (not on every Linux host): write-confinement, read-denial, env-scrub, network, tree-termination, file-size-limit, fs-read-confinement, fs-multi-root-write. Mediated network is NOT implemented on the namespace backend (an empty network namespace has no path to a proxy), so a task that declares a network destination is blocked on Linux, never allowed. Process-count caps are never claimed: the cause of the earlier non-refusal was found (the shell used for the resource prelude has no process-limit option, so the cap was never applied) and no replacement has been proved. The attack corpus is not run in the sandbox-linux job, so corpus coverage stays unverified on Linux.',
     },
     darwin: {
       backend: 'userspace', status: 'host-proved-not-advertised',

package/src/sandbox/CLAUDE.md

@@ -281,9 +281,9 @@ privilegeDrop`), the same mechanism `limits.js` uses for an unenforceable
 limit. It is never silently skipped, and the escape test that covers the
 rebind attack fails if it is missing rather than quietly passing.
 
-**None of the above has been executed anywhere yet.** It is asserted by
-`sandbox-escape.test.js`'s kernel-namespace suite, which skips on macOS. Until
-a CI log shows that suite `RAN`, this section describes code, not evidence.
+**Executed on a hosted Linux runner.** The `sandbox-linux` job ran the suite
+(see the verification sections below); this section describes code that has
+been exercised, on that runner image and kernel only.
 
 ## Timeout does not kill the process tree
 
@@ -297,18 +297,24 @@ inside the policy profile — their writes and egress remain confined — but th
 are still running and still consuming resources. A caller that needs a hard
 tree kill must implement it.
 
-The namespace backend is structurally better here: it runs the confined
-command under `--pid --fork`, so the direct child is pid 1 of a new PID
-namespace and killing it should take the namespace's processes with it. That
-is a reasoned expectation from the flags, **not** an executed result — it
-needs the same Linux-host verification as everything else on that backend.
+The namespace backend closes this with the kernel, not a sweep: the command
+runs under `--pid --fork --kill-child`, so when the `unshare` supervisor dies
+the namespace's init gets SIGKILL and the kernel kills every member, including
+a double-forked `setsid` descendant that no process-group or sweep logic can
+find. `--kill-child` is used only where `unshare` advertises it
+(`namespaceTreeKill`); without it supervised execution is refused. Proved by
+the `linux-probes.js` probes on the hosted runner (kill the supervisor, kill
+the init directly). Earlier text here said killing the direct child should reap
+the tree; CI showed it did not (the killed process was the supervisor, not the
+init) until `--kill-child` was added.
 
 ## Known limitation, deliberately accepted: reads are not confined
 
 The userspace policy allows `(allow file-read*)` globally — that backend
 confines **writes**, network egress, and resource use, but **not reads**. (The
-kernel-namespace backend has the same cut: per the section above its mount
-tree is rebound read-only, not detached, so everything on it stays readable.)
+kernel-namespace backend has the same cut in its DEFAULT mode: its mount
+tree is rebound read-only, not detached, so everything on it stays readable.
+Its capability mode, entered with `readRoots`, does confine reads; see below.)
 A confined command can read any file on the host the OS-level
 permissions allow, including outside the sandbox root. Exfiltration of
 readable host files (writing what was read to network or to a location the
@@ -364,20 +370,26 @@ then runs supervised with protected paths read-denied.
   default protected set is the key directory, common credential directories
   under the home directory, plus caller-supplied sealed-label and evidence
   directories. A denylist is a floor, not a claim of host-wide read isolation.
-  The namespace backend does NOT implement it and returns `status:'error'`
-  without executing when asked, so on Linux the boundary is `blocked`.
+  The namespace backend implements it by masking: an empty tmpfs over a
+  protected directory, `/dev/null` over a protected file (in capability mode a
+  protected path outside every declared root is simply absent). Proved by the
+  protected-canary probes on the hosted runner.
 - **Process trees** (`supervise.js`): own process group, periodic descendant
   sweep, SIGTERM, grace, SIGKILL, then a poll that confirms no survivors; the
   same cleanup runs on a clean exit. Cancel is an `AbortSignal` (status
   `cancelled`). Output is capped. Known gap: a double-fork plus setsid between
   two sweeps escapes; only a PID namespace or cgroup closes it. Supervised
-  execution exists ONLY for the userspace backend; `namespace` is refused
-  because tree termination has not been implemented and executed there.
+  execution exists for the userspace backend and for the namespace backend
+  where `--kill-child` is available (see above).
 - **Active probes**: write confinement, read denial, env scrub, network, tree
   termination and the file-size limit each run an attack plus a positive
   control through the real backend. `process-cap` is reported `unverified` on
-  every backend and must not be claimed enforced (per-uid and system-wide on
-  macOS, and it did not refuse on the hosted Linux runner in the last release).
+  every backend and must not be claimed enforced. Per-uid and system-wide on
+  macOS. On Linux the cause of the earlier non-refusal is now known: the
+  resource prelude is run by `/bin/sh`, which is dash on the hosted runner, and
+  dash's `ulimit` has no `-u` option (`ulimit: Illegal option -u` appears in
+  the `sandbox-linux` log), so the cap was never applied at all. No replacement
+  (for example `prlimit`) has been proved, so the cap stays unasserted.
   `capabilityReport()` carries the standing note that Linux enforcement is
   evidenced only where the `sandbox-linux` CI job ran the same probes.
 - **Status**: target output is returned labelled `untrusted` and is never parsed
@@ -396,7 +408,27 @@ then runs supervised with protected paths read-denied.
 - `writeRoots`: further writable subtrees (readable too). `cwd`: working directory, which must exist.
 - `networkProxyPort`: opens exactly one loopback port (`(remote ip "localhost:PORT")`); DNS, every other port and every other address stay denied.
 
-Verified by execution on macOS only (`test/capabilities/`, probes in `capabilities/probes.js`). The namespace backend implements none of these options; asked for them it ignores them, which is why the capability runner never asks it: its probes report these controls `unsupported` there and the run is blocked.
+Verified by execution on macOS only (`test/capabilities/`, probes in `capabilities/probes.js`). The namespace backend implements `readRoots`, `writeRoots`, `cwd` and
+`denyReadPaths` as **capability mode** (entered when `readRoots` is an array): a
+tmpfs root holding only the runtime baseline (`/usr`, `/bin`, `/lib*`, a few
+identity files, a fresh `/proc` and a minimal `/dev`) plus the declared roots,
+read-only for read roots and read-write for write roots, protected paths absent
+or masked, then `pivot_root` and a detached old root (`linux-rootfs.js` builds
+the plan and the setup script; `backend-namespace.js` runs it). Capability drop
+(`setpriv`, with no-new-privs) is required in this mode, not best effort.
+`networkProxyPort` is REFUSED: mediated network is not implemented on Linux, so
+a task that declares a destination is blocked there.
+
+### Linux evidence
+
+`linux-probes.js` and the generic probes in `control-probes.js` and
+`capabilities/probes.js` attack each control and pair it with a positive
+control; `test/capabilities/linux-enforcement.test.js` also runs every probe
+against a deliberately wrong runner (fault injection) and requires it to say so.
+`scripts/sandbox-linux-verify.mjs` (the `sandbox-linux` job) fails if a required
+suite skips, a required control is not proved, or a control that must stay
+unasserted claims to be proved, and uploads the evidence table. Exploratory runs
+on a local aarch64 VM are not evidence; only the hosted x86_64 job is.
 
 ## Extending this module