@clear-capabilities/agentic-security-scanner 0.165.1 → 0.167.0

package/src/posture/rule-compiler/corpus.js

@@ -0,0 +1,61 @@
+// Automatic corpus creation and scoring for ONE candidate rule.
+//
+// Positive corpus: the original vulnerable snippet plus its generated sibling variants (mutation.js).
+// Negative corpus: an explicit patched/clean variant the caller supplies, nearby clean patterns, protected
+// (sanitizer/guard) variants, and the NEGATIVE mutations of those (same mutators, applied to the safe side) — a
+// candidate rule must decline on ALL of them, not just the one hand-picked negative.
+//
+// Scoring reuses the exact runtime matcher (`runRule` in `../custom-rules.js`), never a second implementation —
+// the score a rule gets here is the score it will actually produce once promoted.
+import { generateVariants } from './mutation.js';
+import { compileToCustomRule } from './ir.js';
+import { runRule } from '../custom-rules.js';
+
+function toRuntimeRule(ir) {
+  const { ok, doc, errs } = compileToCustomRule(ir);
+  if (!ok) throw new Error(`cannot build corpus for an invalid rule IR: ${errs.join('; ')}`);
+  const regexes = doc.match.allOf ? doc.match.allOf.map((p) => new RegExp(p, 'g')) : [new RegExp(doc.match.pattern, 'g')];
+  return {
+    id: doc.id, title: doc.title, severity: doc.severity, cwe: doc.cwe, languages: doc.languages, message: doc.message,
+    regexes, requireAll: !!doc.match.allOf, windowLines: doc.match.window ?? 5,
+    notMatch: doc.match.notMatch ? new RegExp(doc.match.notMatch) : null,
+  };
+}
+
+const EXT = { javascript: 'x.js', typescript: 'x.ts', python: 'x.py', go: 'x.go', ruby: 'x.rb', java: 'x.java', rust: 'x.rs', csharp: 'x.cs', php: 'x.php', any: 'x.txt' };
+
+export function buildCorpus(ir, { originalCode, patchedCode = null, nearbyCleanCode = [], protectedVariantsCode = [] } = {}) {
+  const positives = [{ label: 'original', code: originalCode }];
+  for (const v of generateVariants(originalCode)) positives.push({ label: `sibling:${v.mutator}`, code: v.code });
+
+  const negatives = [];
+  if (patchedCode) {
+    negatives.push({ label: 'patched', code: patchedCode });
+    for (const v of generateVariants(patchedCode)) negatives.push({ label: `patched-sibling:${v.mutator}`, code: v.code });
+  }
+  nearbyCleanCode.forEach((code, i) => negatives.push({ label: `nearby-clean-${i}`, code }));
+  protectedVariantsCode.forEach((code, i) => negatives.push({ label: `protected-${i}`, code }));
+
+  return { positives, negatives };
+}
+
+export function scoreRule(ir, corpus) {
+  const rule = toRuntimeRule(ir);
+  const lang = ir.languages[0] || 'javascript';
+  const file = EXT[lang] || 'x.txt';
+  const run = (code) => runRule(rule, file, code).length > 0;
+
+  const posResults = corpus.positives.map((p) => ({ ...p, fired: run(p.code) }));
+  const negResults = corpus.negatives.map((n) => ({ ...n, fired: run(n.code) }));
+
+  const tp = posResults.filter((p) => p.fired).length;
+  const fn = posResults.length - tp;
+  const fp = negResults.filter((n) => n.fired).length;
+  const tn = negResults.length - fp;
+  const precision = tp + fp === 0 ? null : tp / (tp + fp);
+  const recall = corpus.positives.length === 0 ? null : tp / corpus.positives.length;
+  // "Protected negative failures" per PRD 3: a rule firing on a sanitizer/guard-carrying variant specifically.
+  const protectedFailures = negResults.filter((n) => n.label.startsWith('protected-') && n.fired).length;
+
+  return { precision, recall, tp, fp, tn, fn, protectedFailures, positives: posResults, negatives: negResults };
+}

package/src/posture/rule-compiler/eligibility.js

@@ -0,0 +1,25 @@
+// X-eligibility (PRD 3 "Eligibility"): a finding may enter synthesis only with a stable id, a vulnerable span, a
+// CWE/family, code-flow evidence, and deterministic corroboration OR exploit proof. Reuses the existing
+// vocabularies rather than inventing a third: proof-fabric's evidence-state ladder when present, else the older
+// proof-tier (`taint-proven`/`execution-proven`), else the finding's own `parser` (an IR-TAINT/MULTI-SINK parser
+// origin is code-flow evidence even with no execution).
+import { stateRank } from '../proof-fabric/states.js';
+
+const ANALYSED_PARSERS = new Set(['IR-TAINT', 'MULTI-SINK']);
+
+export function checkEligibility(finding, { proofState = null } = {}) {
+  const reasons = [];
+  if (!finding?.stableId && !finding?.id) reasons.push('no stable id');
+  if (finding?.file == null || finding?.line == null) reasons.push('no vulnerable span (file:line)');
+  if (!finding?.cwe && !finding?.family) reasons.push('no CWE or family');
+  const hasFlowEvidence = ANALYSED_PARSERS.has(finding?.parser) || !!finding?.snippet;
+  if (!hasFlowEvidence) reasons.push('no code-flow evidence (parser not IR-TAINT/MULTI-SINK, no snippet)');
+
+  let evidenceState = 'none';
+  if (proofState && stateRank(proofState) >= stateRank('EXPLOIT_CONFIRMED')) evidenceState = 'execution-proven';
+  else if (finding?.proofTier === 'execution-proven') evidenceState = 'execution-proven';
+  else if (finding?.proofTier === 'taint-proven' || ANALYSED_PARSERS.has(finding?.parser)) evidenceState = 'taint-proven';
+  if (evidenceState === 'none') reasons.push('no deterministic corroboration or exploit proof');
+
+  return { eligible: reasons.length === 0, reasons, evidenceState };
+}

package/src/posture/rule-compiler/ir.js

@@ -0,0 +1,87 @@
+// Rule intermediate representation: compiles DOWN into the existing pattern-rule engine
+// (`../custom-rules.js`), never a parallel matcher. "Compile" here means "emit a
+// custom-rules.js-compatible document" — detection at runtime is 100% the already-proven
+// regex/allOf/notMatch/window engine; this module only adds PROVENANCE metadata around it.
+//
+// A rule's match semantics are deliberately the same closed vocabulary custom-rules.js
+// already supports (pattern | allOf+window | notMatch) — no new matching primitive is
+// introduced, so a promoted rule is exactly as auditable as a hand-written one.
+import { sha256 } from '../proof-fabric/reproducer.js';
+
+const RULE_IR_SCHEMA = 'agentic-security/rule-ir';
+const RULE_IR_VERSION = 1;
+export const RULE_STATES = Object.freeze(['DRAFT', 'CANDIDATE', 'VALIDATED', 'PROMOTED', 'DEPRECATED', 'ROLLED_BACK']);
+const VALID_LANGS = new Set(['javascript', 'typescript', 'python', 'go', 'ruby', 'java', 'rust', 'csharp', 'php', 'any']);
+
+const isStr = (v) => typeof v === 'string' && v.length > 0;
+
+/** Problems with a draft rule IR; an empty list means it is well-formed (not yet validated/promoted). */
+export function validateRuleIR(ir) {
+  const errs = [];
+  if (!ir || typeof ir !== 'object') return ['rule IR must be an object'];
+  if (ir.schema !== RULE_IR_SCHEMA) errs.push('unknown schema');
+  if (ir.version !== RULE_IR_VERSION) errs.push('unsupported rule IR version');
+  if (!isStr(ir.id) || !/^[a-z][a-z0-9-]{2,79}$/.test(ir.id)) errs.push('id must be a lowercase kebab-case string');
+  if (!isStr(ir.title)) errs.push('title required');
+  if (!['critical', 'high', 'medium', 'low'].includes(ir.severity)) errs.push('severity must be critical|high|medium|low');
+  if (!isStr(ir.cwe) || !/^CWE-\d+$/.test(ir.cwe)) errs.push('cwe must look like CWE-###');
+  if (!isStr(ir.family)) errs.push('family required');
+  if (!Array.isArray(ir.languages) || !ir.languages.length || !ir.languages.every((l) => VALID_LANGS.has(l))) errs.push('languages must be a non-empty array from the supported set');
+  const m = ir.match;
+  if (!m || typeof m !== 'object') errs.push('match required');
+  else {
+    const hasPattern = isStr(m.pattern);
+    const hasAllOf = Array.isArray(m.allOf) && m.allOf.length > 0 && m.allOf.every(isStr);
+    if (!hasPattern && !hasAllOf) errs.push('match needs a pattern or a non-empty allOf');
+    if (m.notMatch != null && !isStr(m.notMatch)) errs.push('notMatch must be a string');
+    if (m.window != null && !(Number.isInteger(m.window) && m.window > 0 && m.window <= 200)) errs.push('window must be an integer in 1..200');
+    for (const re of [m.pattern, ...(m.allOf || []), m.notMatch].filter(isStr)) {
+      try { new RegExp(re); } catch { errs.push(`invalid regex: ${re}`); }
+    }
+  }
+  // Declarative-only hint fields (sink/source/propagator/sanitizer/dominatingGuard/frameworkConstraint): free text,
+  // never executable, carried for provenance/review only and NOT consulted by the matcher.
+  for (const k of ['sink', 'source', 'propagator', 'sanitizer', 'dominatingGuard', 'frameworkConstraint']) {
+    if (ir[k] != null && !isStr(ir[k])) errs.push(`${k} must be a string when present`);
+  }
+  if (ir.exclusions != null && !(Array.isArray(ir.exclusions) && ir.exclusions.every(isStr))) errs.push('exclusions must be an array of strings');
+  if (!ir.provenance || typeof ir.provenance !== 'object') errs.push('provenance required');
+  else {
+    if (!isStr(ir.provenance.originatingFindingId)) errs.push('provenance.originatingFindingId required');
+    if (ir.provenance.originatingCommit != null && !isStr(ir.provenance.originatingCommit)) errs.push('provenance.originatingCommit must be a string');
+    if (!['execution-proven', 'taint-proven', 'deterministic-corroboration'].includes(ir.provenance.evidenceState)) errs.push('provenance.evidenceState must be execution-proven|taint-proven|deterministic-corroboration');
+  }
+  return errs;
+}
+
+export function ruleIRDigest(ir) {
+  const { state: _s, ...rest } = ir;
+  return sha256(JSON.stringify(rest, Object.keys(rest).sort()));
+}
+
+/** Build a DRAFT rule IR. Caller supplies the candidate pattern — this module never invents one. */
+export function draftRuleIR({ id, title, severity, cwe, family, languages, match, remediation, originatingFindingId, originatingCommit, evidenceState, model = null, promptConfigVersion = null, ...hints }) {
+  const ir = {
+    schema: RULE_IR_SCHEMA, version: RULE_IR_VERSION, id, title, severity, cwe, family, languages, match,
+    remediation: remediation ?? null, state: 'DRAFT',
+    ...hints,
+    provenance: { originatingFindingId, originatingCommit: originatingCommit ?? null, evidenceState, model, promptConfigVersion },
+  };
+  return ir;
+}
+
+/** Compile a rule IR into a custom-rules.js-compatible document. Caller writes the YAML. */
+export function compileToCustomRule(ir) {
+  const errs = validateRuleIR(ir);
+  if (errs.length) return { ok: false, errs };
+  const doc = {
+    id: `rule-compiler/${ir.id}`,
+    title: ir.title,
+    severity: ir.severity,
+    cwe: ir.cwe,
+    languages: ir.languages,
+    match: { ...(ir.match.pattern ? { pattern: ir.match.pattern } : {}), ...(ir.match.allOf ? { allOf: ir.match.allOf, window: ir.match.window ?? 5 } : {}), ...(ir.match.notMatch ? { notMatch: ir.match.notMatch } : {}) },
+    message: ir.remediation || `${ir.title} (${ir.cwe}, compiled from ${ir.provenance.originatingFindingId})`,
+  };
+  return { ok: true, doc };
+}

package/src/posture/rule-compiler/lifecycle.js

@@ -0,0 +1,57 @@
+// Rule lifecycle ledger: DRAFT -> CANDIDATE -> VALIDATED -> PROMOTED -> DEPRECATED/ROLLED_BACK.
+//
+// Append-only, hash-chained (same idiom as remediation-ledger.js / invariants/lifecycle.js): each entry links the
+// previous entry's hash, so a dropped or edited middle record breaks the chain and `verifyLedger` catches it. A
+// rule cannot promote itself: `transition` only records a transition a caller already decided; `advance`-style
+// guarding on VALID edges lives here so no caller can jump DRAFT straight to PROMOTED.
+import { createHash } from 'node:crypto';
+import { RULE_STATES } from './ir.js';
+
+export const LEDGER_SCHEMA = 'agentic-security/rule-lifecycle-ledger';
+const EDGES = Object.freeze({
+  DRAFT: ['CANDIDATE'], CANDIDATE: ['VALIDATED', 'DRAFT'], VALIDATED: ['PROMOTED', 'DRAFT'],
+  PROMOTED: ['DEPRECATED', 'ROLLED_BACK'], DEPRECATED: [], ROLLED_BACK: ['CANDIDATE'],
+});
+
+const hashOf = (entry) => createHash('sha256').update(JSON.stringify(entry)).digest('hex');
+
+export function newLedger() { return { schema: LEDGER_SCHEMA, entries: [] }; }
+
+function currentState(ledger, ruleId) {
+  for (let i = ledger.entries.length - 1; i >= 0; i--) if (ledger.entries[i].ruleId === ruleId) return ledger.entries[i].to;
+  return null;
+}
+
+/**
+ * Record a transition. Refuses an edge not in EDGES, and refuses DRAFT->DRAFT re-entry for a rule that has never
+ * existed (the first entry for a rule id must be `from: null, to: 'DRAFT'`).
+ */
+export function recordTransition(ledger, { ruleId, from, to, reason, evidence = null, actor }) {
+  if (!RULE_STATES.includes(to)) return { ok: false, reason: `unknown target state: ${to}` };
+  const cur = currentState(ledger, ruleId);
+  if (cur === null) {
+    if (from !== null || to !== 'DRAFT') return { ok: false, reason: 'first transition for a rule must be null -> DRAFT' };
+  } else {
+    if (from !== cur) return { ok: false, reason: `stale transition: current state is ${cur}, not ${from}` };
+    if (!EDGES[cur].includes(to)) return { ok: false, reason: `cannot go from ${cur} to ${to}` };
+  }
+  const prevHash = ledger.entries.length ? ledger.entries[ledger.entries.length - 1].entryHash : null;
+  const entry = { ruleId, from: cur, to, reason: reason ?? null, evidence, actor: actor ?? 'unknown', at: new Date().toISOString(), prevHash };
+  entry.entryHash = hashOf({ ...entry, entryHash: undefined });
+  ledger.entries.push(entry);
+  return { ok: true, entry };
+}
+
+export function verifyLedger(ledger) {
+  let prevHash = null;
+  for (const e of ledger.entries) {
+    if (e.prevHash !== prevHash) return { ok: false, reason: 'chain broken: prevHash mismatch' };
+    const recomputed = hashOf({ ...e, entryHash: undefined });
+    if (recomputed !== e.entryHash) return { ok: false, reason: `entry hash mismatch for ${e.ruleId} at ${e.at}` };
+    prevHash = e.entryHash;
+  }
+  return { ok: true };
+}
+
+export function historyFor(ledger, ruleId) { return ledger.entries.filter((e) => e.ruleId === ruleId); }
+export function stateOf(ledger, ruleId) { return currentState(ledger, ruleId); }

package/src/posture/rule-compiler/mutation.js

@@ -0,0 +1,60 @@
+// Bounded structural mutation for ONE candidate rule's own corpus — not bench/mutation's engine-wide verdict-flip
+// harness (a different scope: the whole deterministic+taint engine against curated adversarial cases). This module
+// exists only to answer PRD 3's "unseen sibling" question for a single rule: does the candidate still fire on a
+// structurally different variant of the same vulnerable shape, and does it still decline on a structurally
+// different variant of a mitigated shape.
+//
+// Mutations are SYNTACTIC, deterministic, seed-free and language-agnostic: variable rename, wrap-in-function,
+// reorder-adjacent-statements, insert-indirection (a pass-through local variable). No semantics are changed on
+// purpose — a mutation that silently changed behavior would make a "same vulnerability, different shape" claim
+// false.
+const RESERVED = new Set(['if', 'else', 'for', 'while', 'return', 'function', 'const', 'let', 'var', 'import', 'from', 'def', 'class', 'req', 'res']);
+
+function identifiers(code) {
+  const seen = new Set();
+  for (const m of code.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\b/g)) if (!RESERVED.has(m[1]) && !/^[A-Z_]+$/.test(m[1])) seen.add(m[1]);
+  return [...seen];
+}
+
+function renameOne(code, from, to) {
+  if (!from || code.includes(to)) return null;
+  return code.replace(new RegExp(`\\b${from}\\b`, 'g'), to);
+}
+
+export function variableRename(code, { suffix = '_v2' } = {}) {
+  const ids = identifiers(code);
+  const target = ids.find((id) => id.length > 1);
+  if (!target) return null;
+  return renameOne(code, target, `${target}${suffix}`);
+}
+
+export function wrapInFunction(code, { name = 'wrapped_v2' } = {}) {
+  const indented = code.split('\n').map((l) => (l ? `  ${l}` : l)).join('\n');
+  return `function ${name}() {\n${indented}\n}\n${name}();\n`;
+}
+
+/** Insert a pass-through local for the first simple right-hand-side identifier assigned with `=` (indirection,
+ * no behavior change): `x = y;` becomes `const indirectN = y; x = indirectN;`. */
+function insertIndirection(code) {
+  const m = /^(\s*)([A-Za-z_][A-Za-z0-9_.]*)\s*=\s*([A-Za-z_][A-Za-z0-9_.]*)\s*;/m.exec(code);
+  if (!m) return null;
+  const [whole, indent, lhs, rhs] = m;
+  const varName = `indirect_${Math.abs(_hash(rhs)) % 1000}`;
+  if (code.includes(varName)) return null;
+  return code.replace(whole, `${indent}const ${varName} = ${rhs};\n${indent}${lhs} = ${varName};`);
+}
+
+function _hash(s) { let h = 0; for (const c of s) h = (h * 31 + c.charCodeAt(0)) | 0; return h; }
+
+const MUTATORS = Object.freeze({ 'variable-rename': variableRename, 'wrap-in-function': wrapInFunction, 'insert-indirection': insertIndirection });
+
+/** Every mutator applied to `code`; mutators that don't apply (return null) are omitted, never silently skipped without saying so. */
+export function generateVariants(code) {
+  const out = [];
+  for (const [name, fn] of Object.entries(MUTATORS)) {
+    let variant = null;
+    try { variant = fn(code); } catch { variant = null; }
+    if (variant && variant !== code) out.push({ mutator: name, code: variant });
+  }
+  return out;
+}

package/src/posture/rule-compiler/promotion.js

@@ -0,0 +1,47 @@
+// Promotion gate (PRD 3 "Promotion Gate"): precision/recall thresholds, zero protected-negative failures, zero
+// benchmark leakage. A candidate rule does NOT automatically become a production rule — `evaluateRule` only
+// scores; `gatePromotion` only judges; the lifecycle ledger (`lifecycle.js`) is the one place a PROMOTED state is
+// actually recorded, and nothing in this module writes to it.
+import { scoreRule } from './corpus.js';
+
+export const PROMOTION_DEFAULTS = Object.freeze({ minPrecision: 0.95, minRecall: 0.80, maxProtectedFailures: 0 });
+
+// Deliberately independent of posture/evaluation/custody.js: that module's term list and guard are reserved for
+// the evaluation custodian's sealed-label boundary (QA-002.AC03), and a test enforces that nothing outside
+// posture/evaluation/ may import it. The anti-cheating need here is smaller and different in kind — a rule
+// synthesis prompt/corpus must not embed a benchmark name or an advisory id — so it gets its own small, independent
+// checker rather than reaching across that isolation boundary.
+const ADVISORY_ID = /\b(?:CVE|GHSA|CWE)-[A-Za-z0-9-]+\b/i;
+
+/** Anti-cheating: the synthesis agent must never see benchmark answer keys, hidden labels, CWE-bearing hidden
+ * filenames or vulnerability-comment metadata. */
+export function checkLeakage(promptText, { benchmarkNames = [] } = {}) {
+  const hay = String(promptText ?? '');
+  const offending = [];
+  for (const name of benchmarkNames) if (name && hay.toLowerCase().includes(String(name).toLowerCase())) offending.push(name);
+  const m = ADVISORY_ID.exec(hay);
+  if (m) offending.push(m[0]);
+  return { ok: offending.length === 0, offendingTerms: offending };
+}
+
+export function evaluateRule(ir, corpus, thresholds = PROMOTION_DEFAULTS) {
+  const score = scoreRule(ir, corpus);
+  const t = { ...PROMOTION_DEFAULTS, ...thresholds };
+  const reasons = [];
+  if (score.precision === null) reasons.push('precision unmeasured (no positive or negative corpus fired)');
+  else if (score.precision < t.minPrecision) reasons.push(`precision ${(score.precision * 100).toFixed(1)}% below ${(t.minPrecision * 100).toFixed(0)}%`);
+  if (score.recall === null) reasons.push('recall unmeasured (empty positive corpus)');
+  else if (score.recall < t.minRecall) reasons.push(`recall ${(score.recall * 100).toFixed(1)}% below ${(t.minRecall * 100).toFixed(0)}%`);
+  if (score.protectedFailures > t.maxProtectedFailures) reasons.push(`${score.protectedFailures} protected-negative failure(s) (max ${t.maxProtectedFailures})`);
+  return { pass: reasons.length === 0, reasons, score, thresholds: t };
+}
+
+/** The one promotion decision. Never auto-applied: a caller still has to act on `pass:true` by recording a
+ * lifecycle transition. Localization ("acceptable") is a human/caller judgment this function cannot make from
+ * line/column alone; it is surfaced for review, never silently assumed. */
+export function gatePromotion({ ir, corpus, leakageCheck, thresholds } = {}) {
+  const evalResult = evaluateRule(ir, corpus, thresholds);
+  const reasons = [...evalResult.reasons];
+  if (!leakageCheck || leakageCheck.ok !== true) reasons.push(leakageCheck ? `leakage check failed: ${leakageCheck.offendingTerms.join(', ')}` : 'leakage check was not run');
+  return { pass: reasons.length === 0, reasons, evaluation: evalResult };
+}

package/src/posture/rule-compiler/store.js

@@ -0,0 +1,96 @@
+// Persistence for the rule compiler: one directory per rule under `.agentic-security/rule-compiler/<id>/`
+// (`ir.json`, `ledger.json`, `evaluation.json`), the promoted custom-rule document at
+// `.agentic-security/rules/<id>.yml` (so the EXISTING `loadCustomRules`/`rule test` machinery picks it up with no
+// change), and a regression fixture pair at `.agentic-security/rule-compiler/fixtures/<id>/{vulnerable,clean}/`
+// using the SAME filename convention `runRuleTests` already reads (`vulnerable`/`clean` in the path).
+import fs from 'node:fs';
+import path from 'node:path';
+import { statePath, ensureStateDir, safeWriteState } from '../state-dir.js';
+import { newLedger, verifyLedger } from './lifecycle.js';
+import { compileToCustomRule } from './ir.js';
+
+const DIR = 'rule-compiler';
+const EXT = { javascript: 'js', typescript: 'ts', python: 'py', go: 'go', ruby: 'rb', java: 'java', rust: 'rs', csharp: 'cs', php: 'php', any: 'txt' };
+
+function ruleDir(scanRoot, id) { return statePath(scanRoot, DIR, id); }
+
+export function loadLedger(scanRoot) {
+  const f = statePath(scanRoot, DIR, 'ledger.json');
+  if (!fs.existsSync(f)) return newLedger();
+  try {
+    const ledger = JSON.parse(fs.readFileSync(f, 'utf8'));
+    const v = verifyLedger(ledger);
+    return v.ok ? ledger : { ...newLedger(), tampered: true, tamperReason: v.reason };
+  } catch { return newLedger(); }
+}
+
+export function saveLedger(scanRoot, ledger) {
+  if (!ensureStateDir(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
+  const f = statePath(scanRoot, DIR, 'ledger.json');
+  return { ok: safeWriteState(f, JSON.stringify(ledger, null, 2)) };
+}
+
+export function saveIR(scanRoot, ir) {
+  if (!ensureStateDir(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
+  const f = path.join(ruleDir(scanRoot, ir.id), 'ir.json');
+  return { ok: safeWriteState(f, JSON.stringify(ir, null, 2)), file: f };
+}
+
+export function loadIR(scanRoot, id) {
+  const f = path.join(ruleDir(scanRoot, id), 'ir.json');
+  try { return JSON.parse(fs.readFileSync(f, 'utf8')); } catch { return null; }
+}
+
+export function saveEvaluation(scanRoot, id, evaluation) {
+  if (!ensureStateDir(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
+  const f = path.join(ruleDir(scanRoot, id), 'evaluation.json');
+  return { ok: safeWriteState(f, JSON.stringify(evaluation, null, 2)) };
+}
+
+/** Write the regression fixtures a promoted rule needs: the SAME vulnerable/clean convention `runRuleTests`
+ * already reads, scored against the exact corpus the rule was promoted on. */
+export function writeFixtures(scanRoot, ir, corpus) {
+  const ext = EXT[ir.languages[0]] || 'txt';
+  const base = path.join(ruleDir(scanRoot, ir.id), 'fixtures');
+  if (!ensureStateDir(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
+  const written = [];
+  for (const p of corpus.positives) {
+    const f = path.join(base, 'vulnerable', `${p.label.replace(/[^a-z0-9_-]/gi, '_')}.${ext}`);
+    if (safeWriteState(f, p.code)) written.push(f);
+  }
+  for (const n of corpus.negatives) {
+    const f = path.join(base, 'clean', `${n.label.replace(/[^a-z0-9_-]/gi, '_')}.${ext}`);
+    if (safeWriteState(f, n.code)) written.push(f);
+  }
+  return { ok: true, written, glob: path.join(base, '**', '*') };
+}
+
+/** Promote: write the compiled custom-rule document to the live rules directory. Does not touch the ledger —
+ * the caller records the PROMOTED transition itself, so a failed write here can never produce an inconsistent
+ * "promoted but not live" or "live but not recorded" state silently. */
+export function publishCustomRule(scanRoot, ir) {
+  const { ok, doc, errs } = compileToCustomRule(ir);
+  if (!ok) return { ok: false, reason: `invalid rule IR: ${errs.join('; ')}` };
+  if (!ensureStateDir(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
+  const f = statePath(scanRoot, 'rules', `${ir.id}.yml`);
+  const yamlText = [
+    `# Compiled by the rule compiler from finding ${ir.provenance.originatingFindingId} (${ir.provenance.evidenceState}).`,
+    `- id: ${doc.id}`,
+    `  title: ${JSON.stringify(doc.title)}`,
+    `  severity: ${doc.severity}`,
+    `  cwe: ${doc.cwe}`,
+    `  languages: [${doc.languages.join(', ')}]`,
+    `  match:`,
+    ...(doc.match.pattern ? [`    pattern: ${JSON.stringify(doc.match.pattern)}`] : []),
+    ...(doc.match.allOf ? [`    allOf:`, ...doc.match.allOf.map((p) => `      - ${JSON.stringify(p)}`), `    window: ${doc.match.window}`] : []),
+    ...(doc.match.notMatch ? [`    notMatch: ${JSON.stringify(doc.match.notMatch)}`] : []),
+    `  message: ${JSON.stringify(doc.message)}`,
+    '',
+  ].join('\n');
+  return { ok: safeWriteState(f, yamlText), file: f };
+}
+
+export function unpublishCustomRule(scanRoot, id) {
+  const f = statePath(scanRoot, 'rules', `${id}.yml`);
+  try { if (fs.existsSync(f)) fs.unlinkSync(f); return { ok: true }; } catch (e) { return { ok: false, reason: e.message }; }
+}

package/src/sandbox/backend-userspace.js

@@ -50,11 +50,17 @@ function _profile({ allowNetwork, proxyPort = null, denyRead = [], confineReads
     readRoots.forEach((_, i) => lines.push(`(allow file-read* (subpath (param "RD${i}")))`));
     writeRoots.forEach((_, i) => lines.push(`(allow file-read* (subpath (param "WR${i}")))`));
     metaLiterals.forEach((_, i) => lines.push(`(allow file-read-metadata (literal (param "META${i}")))`));
-    lines.push('(allow file-write* (literal "/dev/null"))');
   }
   // Read denial (CORE-003). SBPL is last-match-wins, so these deny rules MUST
   // come after every read allow.
   denyRead.forEach((_, i) => lines.push(`(deny file-read* (subpath (param "DENY${i}")))`));
+  // /dev/null is a kernel sink: writing to it (`stdio: 'ignore'`, `> /dev/null`, a piped-to-null redirect — all
+  // common and harmless) cannot leak data or escape confinement. Allowed unconditionally, in BOTH the default and
+  // capability-mode profiles (it used to be capability-mode only, which left the far more common default profile
+  // denying it: `posix_spawn` opens /dev/null to set up an ignored fd BEFORE exec, so the spawn itself failed with
+  // EPERM — any target that redirects a child's output to /dev/null never ran at all, silently, under the default
+  // profile only).
+  lines.push('(allow file-write* (literal "/dev/null"))');
   lines.push('(allow file-write* (subpath (param "ROOT")))');
   writeRoots.forEach((_, i) => lines.push(`(allow file-write* (subpath (param "WR${i}")))`));
   if (allowNetwork) lines.push('(allow network*)');

package/src/sandbox/supervise.js

@@ -22,7 +22,7 @@
 // sweep interval bounds the window; it does not close it. Only a PID-namespace
 // or cgroup boundary closes it, and macOS has neither. The namespace backend
 // has the boundary (see `runConfinedSupervised`).
-import { spawn, spawnSync } from 'node:child_process';
+import { spawn, execFile } from 'node:child_process';
 import { detectBackend } from './capabilities.js';
 import { runDisabled } from './backend-disabled.js';
 import { buildUserspaceInvocation } from './backend-userspace.js';
@@ -40,12 +40,21 @@ function groupAlive(pgid) {
 function signalPid(pid, sig) { try { process.kill(pid, sig); } catch { /* already gone */ } }
 function signalGroup(pgid, sig) { try { process.kill(-pgid, sig); } catch { /* already gone */ } }
 
-/** Descendants of `rootPid` plus members of its group, from one `ps` snapshot. */
+/**
+ * Descendants of `rootPid` plus members of its group, from one `ps` snapshot. Asynchronous on purpose: a synchronous `ps` blocks the
+ * controller's event loop for as long as the machine takes to run it (tens of milliseconds idle, far more under load), and this runs on
+ * every sweep.
+ */
 function snapshotTree(rootPid) {
-  const r = spawnSync('ps', ['-A', '-o', 'pid=,ppid=,pgid='], { encoding: 'utf8', timeout: 2000 });
-  if (r.error || r.status !== 0) return [];
+  return new Promise((resolve) => {
+    execFile('ps', ['-A', '-o', 'pid=,ppid=,pgid='], { encoding: 'utf8', timeout: 2000, maxBuffer: 16 * 1024 * 1024 }, (err, stdout) => {
+      resolve(err ? [] : treeFromPs(stdout, rootPid));
+    });
+  });
+}
+function treeFromPs(stdout, rootPid) {
   const rows = [];
-  for (const line of String(r.stdout).split('\n')) {
+  for (const line of String(stdout).split('\n')) {
     const m = line.trim().split(/\s+/).map(Number);
     if (m.length === 3 && m.every(Number.isFinite)) rows.push({ pid: m[0], ppid: m[1], pgid: m[2] });
   }
@@ -86,27 +95,28 @@ export function superviseSpawn(bin, args, {
     let finishing = null;
     let timer = null;
 
-    const sweep = () => { if (pgid) for (const p of snapshotTree(pgid)) tracked.add(p); };
-    // sweepMs <= 0 turns the periodic sweep off. Each sweep is a SYNCHRONOUS `ps`, which blocks the controller's event loop for as long as
-    // it runs; on the namespace backend the kernel ends every member with the supervisor (--kill-child), so the periodic sweep adds nothing
-    // there and only costs responsiveness. The cleanup below still takes its own snapshots.
-    const sweeper = sweepMs > 0 ? setInterval(sweep, sweepMs) : null;
+    const sweep = async () => { if (pgid) for (const p of await snapshotTree(pgid)) tracked.add(p); };
+    // sweepMs <= 0 turns the periodic sweep off: on the namespace backend the kernel ends every member with the supervisor
+    // (--kill-child), so the periodic sweep adds nothing there. The cleanup below still takes its own snapshots. A sweep never overlaps the
+    // previous one, so a slow `ps` under load cannot pile up work.
+    let sweeping = false;
+    const sweeper = sweepMs > 0 ? setInterval(() => { if (sweeping) return; sweeping = true; sweep().finally(() => { sweeping = false; }); }, sweepMs) : null;
 
-    const survivors = () => {
-      sweep();
+    const survivors = async () => {
+      await sweep();
       return { live: [...tracked].filter(alive), group: groupAlive(pgid) };
     };
 
     async function terminate() {
       const t = _emptyTermination();
-      const before = survivors();
+      const before = await survivors();
       if (!before.group && before.live.length === 0) return t;
       t.signalled = 'SIGTERM';
       signalGroup(pgid, 'SIGTERM');
       for (const p of tracked) signalPid(p, 'SIGTERM');
       const deadline = Date.now() + graceMs;
       while (Date.now() < deadline) {
-        const s = survivors();
+        const s = await survivors();
         if (!s.group && s.live.length === 0) return t;
         await sleep(25);
       }
@@ -115,13 +125,13 @@ export function superviseSpawn(bin, args, {
       t.signalled = 'SIGKILL';
       const hard = Date.now() + 3000;
       while (Date.now() < hard) {
-        const s = survivors();
+        const s = await survivors();
         if (!s.group && s.live.length === 0) break;
         signalGroup(pgid, 'SIGKILL');
         for (const p of s.live) { signalPid(p, 'SIGKILL'); if (!t.killedPids.includes(p)) t.killedPids.push(p); }
         await sleep(25);
       }
-      const s = survivors();
+      const s = await survivors();
       t.survivors = s.live.length ? s.live : (s.group ? [-pgid] : []);
       return t;
     }

package/src/sandbox/trust-boundary.js

@@ -58,7 +58,7 @@ export async function runInBoundary(argv, o = {}) {
   const {
     root, labelDirs = [], evidenceDirs = [], denyReadPaths = [], env = {},
     allowNetwork = false, timeoutMs = 10000, graceMs = 1000, signal, force, limits,
-    maxOutputBytes, controlProbes,
+    maxOutputBytes, controlProbes, networkProxyPort = null,
   } = o;
   const required = [...(o.require || DEFAULT_REQUIRED_CONTROLS)];
   if (!allowNetwork && !required.includes('network')) required.push('network');
@@ -94,6 +94,7 @@ export async function runInBoundary(argv, o = {}) {
   const r = await runConfinedSupervised(argv, {
     root, timeoutMs, graceMs, signal, force, allowNetwork, limits, maxOutputBytes,
     env, denyReadPaths: protectedPaths,
+    ...(networkProxyPort != null ? { networkProxyPort } : {}),
   });
   const executed = r.status !== 'disabled' && !(r.status === 'error' && !r.supervised);
   const run = { ...r, executed };