@clear-capabilities/agentic-security-scanner 0.166.0 → 0.168.0

package/CHANGELOG.md

@@ -9,6 +9,97 @@
 > make the history less accurate, not more.
 
 
+## 0.168.0 - fleet: multi-repository scan orchestration and cross-repository dependency blast radius
+
+A real, honestly-scoped slice of the organization-wide security graph recommendation: a new CLI command group,
+`fleet init|scan|status|resume|query`, built almost entirely on existing machinery rather than a new engine.
+
+**The manifest and the scan.** `fleet.yaml` declares an organization and a list of `{id, path}` repositories
+(plus `workers` and `perRepoTimeout`), validated closed-world — an unknown key, a duplicate id, a non-kebab id or
+an unresolvable path refuses the whole manifest. `fleet scan fleet.yaml` drives the EXISTING `posture/fleet.js`
+(`runFleet`) over that list: bounded concurrency, a resumable on-disk checkpoint, per-repository isolation (one
+repo exploding never takes the run down), and an honest rollup (a failed repo is reported failed, never folded
+into "0 findings"). No new scanning engine was written for this.
+
+**The new part: a cross-repository dependency graph.** Built purely from each repository's own package manifest
+(`package.json`/`go.mod`/`Cargo.toml`/`requirements.txt`/`pyproject.toml` — name plus dependencies), with no
+deployment configuration required, so a fleet of plain application repositories works immediately. `fleet query
+--depends-on <repo-id>` answers "which repositories depend on this one, directly or transitively, and through
+what path" — a real question about organization-wide blast radius, not a guess.
+
+**A real, grounded demonstration, not an asserted-away fixture.** A four-repository synthetic organization
+(frontend, payments-api, shared-auth-lib, payments-worker) where only `shared-auth-lib` carries an actual
+command-injection vulnerability the deterministic engine genuinely finds (the same confirmed-detected shape —
+`req.body.host` into `child_process.exec` — already used in this repository's own fixtures). The blast-radius
+query correctly reports `frontend` and `payments-api` as direct dependents and `payments-worker` as a transitive
+one, through `payments-api`, at the right depth, with the right path.
+
+**A bug this process itself caught, twice.** A first draft of the fleet CLI wrapped `runScan()`'s own
+`{ scan, meta }` return value in a SECOND `{ scan }` object; `runFleet`'s internal summarizer reads fields
+defensively rather than throwing on the wrong shape, so every repository silently reported zero findings with no
+error of any kind. Found by running the CLI against the fixture and noticing the finding count was wrong, not by
+the automated test — whose own fixture at the time also happened to use a vulnerability shape the deterministic
+engine does not actually flag (an unlabeled function parameter reaching `exec`, no recognized untrusted source).
+Both are fixed, and the fixture now uses the same confirmed-detected shape the test asserts against.
+
+**Still open, and disclosed as such** (`docs/implementation-status/fleet.md`): no Internet-facing/regulated-data
+overlay — the fuller "which Internet-facing app can reach PCI data through this component" question needs the
+existing deployment-boundary graph's trust-zone model layered on top of this dependency graph, not attempted
+here; no natural-language query parser (`--depends-on <repo-id>` is the one supported shape); no SQLite-backed
+storage (reuses the existing flat-JSON fleet checkpoint; `posture/portfolio/backend.js`'s existing storage
+abstraction is the natural place for a SQLite implementation later); no persisted job queue with lease/retry
+(reuses in-process `runFleet` rather than the heavier, operator-only `portfolio/work-units.js` scheduler); matching
+across repositories is by declared package name only, with no ecosystem disambiguation.
+
+## 0.167.0 - execution-backed exploit proof, and a self-learning rule compiler that turns one confirmed finding into a deterministic detection rule
+
+Two new, independently opt-in capabilities, each off by default until explicitly invoked.
+
+**Execution-backed exploit proof (`triage exploit --prove`, `fix --require-proof`).** A new evidence-state ladder
+(`CANDIDATE` → `STATICALLY_CORROBORATED` → `REPRODUCER_GENERATED` → `REPRODUCED` → `EXPLOIT_CONFIRMED` →
+`FIX_REPLAY_BLOCKED` → `FIX_VERIFIED`), separate from severity and confidence, reached only by executing a bounded,
+serialized reproducer inside the existing confined sandbox (`src/sandbox/`) and judging the result with one of nine
+deterministic oracles — never a model. `EXPLOIT_CONFIRMED` requires 3 of 3 reproductions (configurable) plus an
+independent re-run in a fresh environment that receives only the reproducer, the finding id, the oracle and the
+revision, never the reasoning that found it. `fix --apply --require-proof` extends the existing fix-verify
+vocabulary (never a competing definition of "verified"): it refuses to write a patch unless the original exploit is
+confirmed beforehand and the SAME reproducer is demonstrably blocked, in every attempt, afterward. New CLI: `proof
+show|replay|doctor`, `triage exploit <id> --prove`, `triage list --evidence`. Eight fixture classes (SQL injection,
+command injection, path traversal, SSRF, auth bypass, insecure deserialization, unsafe file write, and a real
+AddressSanitizer-backed buffer overflow in C) are tested both directions: vulnerable reaches `EXPLOIT_CONFIRMED`,
+mitigated never does. Guide: `docs/guides/exploit-proof-fabric.md`.
+
+Building the fixture corpus surfaced two real, pre-existing defects, each fixed with its own regression test: the
+default (non-capability) confined sandbox profile had no write allowance for `/dev/null`, so any confined command
+redirecting output there (`stdio: 'ignore'`, a common pattern) failed to spawn at all with a silent `EPERM`; and
+the proof runner's own loopback callback listener read the wrong `process.argv` index for a `node -e` invocation,
+so every callback request crashed it (observed by the client as `ECONNRESET`).
+
+**Self-learning finding-to-rule compiler (`rules synthesize|evaluate|promote|status|rollback`).** Turns one
+confirmed finding into a reviewed, promoted, deterministic custom rule — compiled into the EXISTING pattern-rule
+engine (`posture/custom-rules.js`), never a second matcher. A candidate rule (its pattern supplied by a model or a
+human; nothing here calls one) must clear a promotion gate — precision ≥95%, recall ≥80%, zero protected-negative
+failures, by default — against an automatically generated corpus that includes deterministic, semantics-preserving
+structural mutations (variable rename, wrap-in-function, indirection) of both the vulnerable and the patched code,
+before an append-only, hash-chained lifecycle ledger lets it advance from `CANDIDATE` to `VALIDATED` to `PROMOTED`.
+A promoted rule is published to the existing `.agentic-security/rules/` directory, so it is live on the very next
+scan with no code change, and gets regression fixtures in the project's own existing `vulnerable`/`clean`
+convention. Demonstrated end to end on a real, grounded miss: the deterministic engine does not recognize
+`db.rawQuery(...)` string concatenation as a SQL sink (verified by a real scan); after promotion, the rule catches
+not just the original finding but an unseen structural sibling — different file, renamed identifiers, extra
+indirection — with zero model calls. Guide: `docs/guides/rule-compiler.md`.
+
+A duplicate command name was caught before shipping: the PRD's own example CLI shape collided with the pre-existing
+`rules validate`/`rules lock` (rule-pack override linting and lockfile writing). A first draft added a second,
+competing `case 'rules':` switch arm, which JavaScript resolves to the first match — silently making the original
+two subcommands permanently unreachable. Fixed by folding the new subcommands into the existing dispatcher instead.
+
+**Still open.** Neither capability has a model-driven proposal step (both expect the candidate pattern/reproducer
+supplied by the caller); container execution for the proof fabric is detected but not implemented, so execution
+always runs in the existing lower-assurance local sandbox and says so; the rule compiler implements three of the
+PRD's seven listed mutator kinds. Full detail and honest remaining gaps in
+`docs/implementation-status/{exploit-proof-fabric,rule-compiler}.md`.
+
 ## 0.166.0 - the closure accepts hosted Linux test evidence for tests that skip on a non-Linux host; the shared-portfolio drain test is deterministic
 
 **Hosted Linux evidence for skipped tests, kept separate and labelled.** On a macOS host the capabilities suite skips six Linux-namespace tests, and a skipped required test counts as failed, so requirements X-501 to X-508 could never verify there even though the same tests run and pass on the hosted `sandbox-linux` job (which fails on any skip). The controller's verification can now count a locally skipped test only when a commit-bound attestation shows that the `sandbox-linux` check run for the exact commit succeeded and that the named test passed in that job's per-test report (uploaded as the `sandbox-linux-test-report` artifact, bound to the commit, the run and a digest). Anything else (wrong or never-pushed commit, job missing, in progress, failed, cancelled or skipped, test absent or skipped in the report, malformed or forged report, `gh` unavailable, a dirty tree) produces a typed refusal and the skip stays open. Local results are never rewritten: the local skip count is unchanged, covered tests are reported as a separate source (`attested-from-ci: sandbox-linux@<sha>`), and a local failure or abnormal exit never triggers a lookup. It is opt-in per profile (`attestFromCi`, capabilities suite only) and `LOOP_ATTEST_FROM_CI=0` turns it off. This is evidence from a hosted run, not a claim that the local host enforced anything; Linux stays `partially-verified`. The new test file has 60 tests, including every refusal and forged-report cases, and 12 hand-made mutants of the new code (nine caught; two proved equivalent; the remaining three guards are only caught together). A live read against the real hosted run covered all six tests and refused an invented one. Writing the reader exposed one real defect: on pull-request runs the job's commit is the merge ref, so the report is now bound to the pull request head and records the merge ref actually tested as `testedSha`.

package/bin/agentic-security.js

@@ -1528,6 +1528,7 @@ async function cmdProfile(args) {
 // /triage list | assign | transition | trend
 async function cmdTriage(args) {
   const target = path.resolve(args._[args._.length - 1] && !args._[args._.length - 1].startsWith('--') ? args._[args._.length - 1] : '.');
+  const sub = args._[1];
   // ollama-offline-prd.md §34 — `triage --explain <finding-id>` is read-only
   // narrative generation, not triage's own assign/transition/lock state
   // machine, so it doesn't need the pro-tier gate below (and is checked
@@ -1599,12 +1600,17 @@ async function cmdTriage(args) {
     }
     return 0;
   }
+  if (sub === 'exploit' || (sub === 'validate' && args.flags.execution)) {
+    if (sub === 'exploit' && !args.flags.prove) { console.error('triage exploit requires --prove (it executes a reproducer in an isolated environment).'); return 4; }
+    const last = args._[args._.length - 1];
+    const exploitTarget = path.resolve(args.flags.root || (last && !String(last).startsWith('--') && last !== args._[1] && last !== args._[2] ? last : '.'));
+    return (await import('../src/posture/proof-fabric/cli.js')).cmdProve(args, exploitTarget);
+  }
   const profile = loadProfile(target);
   if (profile.profile !== 'pro') {
     console.error('Triage is a pro-mode feature. Run `agentic-security profile set pro` to enable.');
     return 4;
   }
-  const sub = args._[1];
   // Sync first so list reflects the latest scan.
   const lastScanPath = statePath(target, 'findings.json');
   if (fs.existsSync(lastScanPath)) {
@@ -1618,10 +1624,16 @@ async function cmdTriage(args) {
     if (args.flags.assignee) filter.assignee = args.flags.assignee;
     if (args.flags.unassigned) filter.unassigned = true;
     const items = triage.list(target, filter);
-    const hdr = ['ID', 'Severity', 'State', 'Assignee', 'File:Line', 'Vuln'].join('  ');
+    // --evidence (PRD 1): an optional, read-only column naming the latest stored exploit-proof evidence state for a
+    // finding, when one exists. Decoupled from triage's own open/fixed state machine on purpose — proof evidence and
+    // triage workflow state answer different questions and must not be conflated.
+    const showEvidence = !!args.flags.evidence;
+    const latestProofFn = showEvidence ? (await import('../src/posture/proof-fabric/store.js')).latestProof : null;
+    const hdr = ['ID', 'Severity', 'State', 'Assignee', 'File:Line', 'Vuln', ...(showEvidence ? ['Evidence'] : [])].join('  ');
     console.log(hdr);
     console.log('─'.repeat(80));
     for (const t of items.slice(0, 50)) {
+      const evidence = showEvidence ? (latestProofFn(target, t.id)?.record?.state ?? 'none') : null;
       console.log([
         t.id.slice(0, 16),
         (t.severity || '').padEnd(8),
@@ -1629,6 +1641,7 @@ async function cmdTriage(args) {
         (t.assignee || '—').padEnd(20),
         `${t.file}:${t.line}`.padEnd(40),
         t.vuln,
+        ...(showEvidence ? [evidence] : []),
       ].join('  '));
     }
     return 0;
@@ -1740,8 +1753,14 @@ async function cmdOrgScan(args) {
 
 // /rules validate | rules lock
 async function cmdRules(args) {
-  const target = path.resolve(args._[2] || '.');
   const sub = args._[1];
+  // Self-learning finding-to-rule compiler (PRD 3): synthesize/evaluate/promote/status/rollback a DETECTION rule
+  // from one confirmed finding — distinct from validate/lock below (rules.yml override linting and pack locking).
+  // Dispatches to its own module rather than inlining here, same convention as `triage exploit`/`proof`.
+  if (sub === 'synthesize' || sub === 'evaluate' || sub === 'promote' || sub === 'status' || sub === 'rollback') {
+    return (await import('../src/posture/rule-compiler/cli.js')).cmdRules(args, path.resolve(args.flags.root || '.'));
+  }
+  const target = path.resolve(args._[2] || '.');
   if (sub === 'validate') {
     const r = validateOverrides(target);
     if (r.ok) { console.log('✓ rules.yml is valid'); return 0; }
@@ -1755,7 +1774,7 @@ async function cmdRules(args) {
     console.log(`  scanner: ${lock.scannerVersion}  rulePackHash: ${lock.rulePackHash}`);
     return 0;
   }
-  console.error('rules validate | rules lock'); return 4;
+  console.error('rules validate | rules lock | rules synthesize <finding-id> --spec <file.json> | rules evaluate|promote|status|rollback <rule-id>'); return 4;
 }
 
 // `agentic-security secure [--launch]` — smart router. One command picks the
@@ -3617,6 +3636,21 @@ async function cmdFix(args) {
   const fixMeta = (approvedBy || approvalReason || patchAuthor)
     ? { approval: { approvedBy: approvedBy || '', reason: approvalReason || '' }, ...(patchAuthor ? { author: patchAuthor } : {}) }
     : null;
+  // --require-proof: the patch is applied ONLY if the original exploit is confirmed beforehand and demonstrably blocked
+  // afterwards (posture/proof-fabric/fix-proof.js). Missing reproducer, unavailable environment or an incomplete replay all refuse.
+  if (args.flags['require-proof']) {
+    const { loadReproducerFor } = await import('../src/posture/proof-fabric/cli.js');
+    const { verifyFixWithProof, formatFixProof } = await import('../src/posture/proof-fabric/fix-proof.js');
+    const { verifyFix } = await import('../src/posture/fix-verify.js');
+    const loaded = loadReproducerFor(scanRoot, f.id, args.flags.reproducer);
+    if (!loaded) { console.error(`--require-proof: no reproducer for ${f.id}. Refusing to apply; nothing was executed. Supply --reproducer <file>.`); return 4; }
+    const files = { [f.file]: newContent };
+    const staticVerification = await verifyFix({ scanRoot, originalFindingStableId: f.stableId || null, files, recordMetrics: false });
+    const siblings = (last.findings || []).filter((x) => x.id !== f.id && x.file !== f.file && (x.vuln === f.vuln || x.cwe === f.cwe)).map((x) => ({ id: x.id, file: x.file, line: x.line }));
+    const fp = await verifyFixWithProof({ finding: f, reproducer: loaded.reproducer, files, scanRoot, staticVerification, siblings });
+    console.log(formatFixProof(fp));
+    if (!fp.verified) { console.error('\nRefusing to apply: the fix is not proof-verified (--require-proof).'); return 4; }
+  }
   let result = await applyVerifiedFix({
     scanRoot,
     finding: { file: f.file, id: f.id, stableId: f.stableId || null, ruleId: f.cwe || f.title, vuln: f.vuln || f.title },
@@ -7077,9 +7111,11 @@ async function main() {
       case 'undo':     process.exit(await cmdUndo(args));
       case 'accept':   process.exit(await cmdAccept(args));
       case 'profile':  process.exit(await cmdProfile(args));
+      case 'proof':    process.exit(await (await import('../src/posture/proof-fabric/cli.js')).cmdProof(args, path.resolve(args.flags.root || '.')));
       case 'triage':   process.exit(await cmdTriage(args));
       case 'org-scan': process.exit(await cmdOrgScan(args));
       case 'rules':    process.exit(await cmdRules(args));
+      case 'fleet':    process.exit(await (await import('../src/posture/fleet/cli.js')).cmdFleet(args, path.resolve(args.flags.root || '.')));
       case 'rule':     process.exit(await cmdRule(args));
       case 'tickets':  process.exit(await cmdTickets(args));
       case 'secure':   process.exit(await cmdSecure(args));

package/dist/2199.index.js

@@ -0,0 +1,348 @@
+export const id = 2199;
+export const ids = [2199];
+export const modules = {
+
+/***/ 25517:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   $: () => (/* binding */ ORACLE_TYPES),
+/* harmony export */   U: () => (/* binding */ evaluateOracle)
+/* harmony export */ });
+// Deterministic security oracles. A model may SELECT an oracle and propose its parameters; it may never decide that the
+// oracle succeeded. Each oracle is a pure function of an Observation gathered by the TRUSTED runner (never by the model):
+//
+//   Observation = {
+//     exitCode, signal, timedOut, stdout, stderr,
+//     canaries: { <name>: { exists, digestBefore, digestAfter } }      // checked by the runner on disk, after the run
+//     callbacks: [{ nonce }]                                            // hits recorded by the runner's loopback listener
+//     nonce                                                             // per-run random token the target cannot predict
+//   }
+//
+// An oracle returns { fired, reason }. `fired:false` with `inconclusive:true` means the observation could not decide
+// (for example a timeout); it is never treated as "not exploitable".
+const ORACLE_TYPES = Object.freeze([
+  'crash_sanitizer', 'command_execution', 'unauthorized_http_access', 'unauthorized_db_read', 'database_mutation',
+  'filesystem_mutation', 'outbound_callback', 'authentication_bypass', 'arbitrary_assertion',
+]);
+
+const SANITIZER_RE = /(AddressSanitizer|UndefinedBehaviorSanitizer|stack-buffer-overflow|heap-buffer-overflow|SEGV on unknown address|stack smashing detected|buffer overflow detected)/i;
+const CRASH_SIGNALS = new Set(['SIGSEGV', 'SIGABRT', 'SIGBUS', 'SIGILL', 'SIGFPE']);
+
+const out = (fired, reason, extra = {}) => ({ fired, reason, ...extra });
+const inconclusive = (reason) => ({ fired: false, inconclusive: true, reason });
+const has = (obs, text) => typeof text === 'string' && text.length > 0 && `${obs.stdout || ''}${obs.stderr || ''}`.includes(text);
+
+const IMPL = {
+  crash_sanitizer(obs) {
+    if (SANITIZER_RE.test(obs.stderr || '')) return out(true, 'sanitizer or runtime memory-safety report on stderr');
+    if (obs.signal && CRASH_SIGNALS.has(obs.signal)) return out(true, `process terminated by ${obs.signal}`);
+    if (obs.timedOut) return inconclusive('run timed out before a crash could be judged');
+    return out(false, 'no crash signal and no sanitizer report');
+  },
+  // The injected payload asks the shell/interpreter to create a file named after the per-run nonce inside the
+  // watched canary directory. The target cannot create it unless attacker data reached a command.
+  command_execution(obs, p) {
+    const c = obs.canaries?.[p.canary || 'command'];
+    if (!c) return inconclusive('command canary was not armed by the runner');
+    if (c.exists && !c.existedBefore) return out(true, 'nonce-named canary file created by an injected command');
+    if (obs.timedOut) return inconclusive('run timed out before the canary could be judged');
+    return out(false, 'canary file not created');
+  },
+  // A secret planted behind authorization (never shown to the exploit client). Seeing the nonce-bearing secret in the
+  // client's output while the actor held no credential is the violation.
+  unauthorized_http_access(obs, p) {
+    const secret = obs.secrets?.[p.secret || 'http'];
+    if (!secret) return inconclusive('protected secret was not armed by the runner');
+    if (has(obs, secret)) return out(true, 'protected resource content returned to an unauthenticated actor');
+    if (obs.timedOut) return inconclusive('run timed out');
+    return out(false, 'protected content not observed');
+  },
+  unauthorized_db_read(obs, p) {
+    const secret = obs.secrets?.[p.secret || 'db'];
+    if (!secret) return inconclusive('database canary row was not armed by the runner');
+    if (has(obs, secret)) return out(true, 'row the actor may not read was returned');
+    if (obs.timedOut) return inconclusive('run timed out');
+    return out(false, 'canary row value not observed');
+  },
+  database_mutation(obs, p) {
+    const c = obs.canaries?.[p.canary || 'db'];
+    if (!c) return inconclusive('database canary was not armed by the runner');
+    if (c.digestBefore && c.digestAfter && c.digestBefore !== c.digestAfter) return out(true, 'protected database state changed');
+    if (obs.timedOut) return inconclusive('run timed out');
+    return out(false, 'protected database state unchanged');
+  },
+  filesystem_mutation(obs, p) {
+    const c = obs.canaries?.[p.canary || 'fs'];
+    if (!c) return inconclusive('filesystem canary was not armed by the runner');
+    if ((c.exists && !c.existedBefore) || (c.digestBefore && c.digestAfter && c.digestBefore !== c.digestAfter)) return out(true, 'file outside the permitted area was created or modified');
+    if (obs.timedOut) return inconclusive('run timed out');
+    return out(false, 'protected path unchanged');
+  },
+  outbound_callback(obs) {
+    if (obs.callbackUnavailable) return { fired: false, unsupported: true, reason: 'loopback callback listener is not available on this backend' };
+    const hit = (obs.callbacks || []).some((c) => c && c.nonce && c.nonce === obs.nonce);
+    if (hit) return out(true, 'nonce-bearing request reached the runner-controlled listener');
+    if (obs.timedOut) return inconclusive('run timed out');
+    return out(false, 'no nonce-bearing callback received');
+  },
+  authentication_bypass(obs, p) {
+    const secret = obs.secrets?.[p.secret || 'auth'];
+    if (!secret) return inconclusive('protected secret was not armed by the runner');
+    if (has(obs, secret)) return out(true, 'privileged content returned without valid credentials');
+    if (obs.timedOut) return inconclusive('run timed out');
+    return out(false, 'privileged content not observed without credentials');
+  },
+  // Declarative only: no code, no regex supplied by a model. Operators are a closed set.
+  arbitrary_assertion(obs, p) {
+    const a = p.assert;
+    if (!a || typeof a !== 'object') return inconclusive('assertion missing');
+    if (obs.timedOut) return inconclusive('run timed out');
+    if ('exitCode' in a) return a.exitCode === obs.exitCode ? out(true, `exit code was ${obs.exitCode}`) : out(false, `exit code was ${obs.exitCode}`);
+    if ('stdoutIncludes' in a) return has({ stdout: obs.stdout }, String(a.stdoutIncludes)) ? out(true, 'stdout contained the asserted text') : out(false, 'stdout did not contain the asserted text');
+    if ('stderrIncludes' in a) return has({ stderr: obs.stderr }, String(a.stderrIncludes)) ? out(true, 'stderr contained the asserted text') : out(false, 'stderr did not contain the asserted text');
+    return inconclusive('unsupported assertion operator');
+  },
+};
+
+function evaluateOracle(spec, observation) {
+  if (!spec || !ORACLE_TYPES.includes(spec.type)) return { fired: false, unsupported: true, reason: `unknown oracle type: ${String(spec?.type)}` };
+  if (!observation || typeof observation !== 'object') return inconclusive('no observation');
+  try { return IMPL[spec.type](observation, spec.params || {}); } catch (e) { return inconclusive(`oracle error: ${e.message}`); }
+}
+
+
+/***/ }),
+
+/***/ 37055:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   IW: () => (/* binding */ verifierView),
+/* harmony export */   V2: () => (/* binding */ substitute),
+/* harmony export */   Yj: () => (/* binding */ LANGUAGES),
+/* harmony export */   dw: () => (/* binding */ canonicalize),
+/* harmony export */   mC: () => (/* binding */ validateReproducer),
+/* harmony export */   sc: () => (/* binding */ sha256),
+/* harmony export */   we: () => (/* binding */ reproducerDigest)
+/* harmony export */ });
+/* unused harmony exports MAX_FILES, MAX_FILE_BYTES, isSafeRelPath */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var _oracles_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(25517);
+// Serialized reproducer: the ONLY thing an independent verifier receives (besides revision, finding id and oracle).
+// It carries no reasoning, no model output and no prior results. Everything per-run (nonce, secrets, canary paths,
+// callback URL) is a placeholder substituted fresh by the trusted runner, so a replay can never reuse a stale value
+// and a target cannot learn the values in advance.
+
+
+
+const REPRODUCER_SCHEMA = 'agentic-security/reproducer';
+const REPRODUCER_VERSION = 1;
+const LANGUAGES = Object.freeze(['javascript', 'typescript', 'python', 'java', 'c', 'cpp', 'csharp']);
+const MAX_FILES = 64;
+const MAX_FILE_BYTES = 256 * 1024;
+const MAX_TOTAL_BYTES = 1024 * 1024;
+const PLACEHOLDER_RE = /\{\{([A-Z_]+)(?::([a-z0-9_-]{1,32}))?\}\}/g;
+const ALLOWED_PLACEHOLDERS = new Set(['NONCE', 'SECRET', 'CANARY', 'CALLBACK_URL', 'CALLBACK_PORT', 'ROOT', 'NODE', 'PYTHON', 'JAVA', 'JAVAC', 'CC']);
+
+function isSafeRelPath(rel) {
+  if (typeof rel !== 'string' || !rel || rel.length > 200) return false;
+  if (rel.startsWith('/') || rel.includes('\0') || rel.includes('\\')) return false;
+  if (['canary', 'tmp'].includes(rel.split('/')[0])) return false;
+  return rel.split('/').every((seg) => seg && seg !== '.' && seg !== '..' && !seg.startsWith('__oracle_'));
+}
+
+/** Canonical JSON (sorted keys) so identical reproducers hash identically regardless of key order. */
+function canonicalize(v) {
+  if (Array.isArray(v)) return `[${v.map(canonicalize).join(',')}]`;
+  if (v && typeof v === 'object') return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonicalize(v[k])}`).join(',')}}`;
+  return JSON.stringify(v);
+}
+const sha256 = (s) => (0,node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash)('sha256').update(s).digest('hex');
+const reproducerDigest = (r) => sha256(canonicalize(r));
+
+function validateReproducer(r) {
+  const errs = [];
+  if (!r || typeof r !== 'object' || Array.isArray(r)) return ['reproducer must be an object'];
+  if (r.schema !== REPRODUCER_SCHEMA) errs.push('unknown schema');
+  if (r.version !== REPRODUCER_VERSION) errs.push('unsupported reproducer version');
+  if (typeof r.findingId !== 'string' || !r.findingId || r.findingId.length > 200) errs.push('findingId required');
+  if (!LANGUAGES.includes(r.lang)) errs.push(`unsupported language: ${String(r.lang)}`);
+  if (!r.oracle || !_oracles_js__WEBPACK_IMPORTED_MODULE_1__/* .ORACLE_TYPES */ .$.includes(r.oracle.type)) errs.push(`unknown oracle: ${String(r.oracle?.type)}`);
+  const files = r.files ?? {};
+  if (typeof files !== 'object' || Array.isArray(files)) errs.push('files must be an object');
+  else {
+    const names = Object.keys(files);
+    if (names.length > MAX_FILES) errs.push(`file count must be at most ${MAX_FILES}`);
+    let total = 0;
+    for (const n of names) {
+      if (!isSafeRelPath(n)) { errs.push(`unsafe file path: ${n}`); continue; }
+      if (typeof files[n] !== 'string') { errs.push(`file ${n} must be a string`); continue; }
+      const b = Buffer.byteLength(files[n]);
+      total += b;
+      if (b > MAX_FILE_BYTES) errs.push(`file ${n} exceeds ${MAX_FILE_BYTES} bytes`);
+    }
+    if (total > MAX_TOTAL_BYTES) errs.push('reproducer exceeds total size limit');
+  }
+  const sourceNames = r.sources && typeof r.sources === 'object' && !Array.isArray(r.sources) ? Object.keys(r.sources) : [];
+  if (Object.keys(files).length + sourceNames.length === 0) errs.push('reproducer must declare at least one file or source');
+  for (const key of ['build', 'run']) {
+    const a = r[key];
+    if (a == null && key === 'build') continue;
+    if (!Array.isArray(a) || !a.length || !a.every((x) => typeof x === 'string' && x.length < 2000 && !x.includes('\0'))) errs.push(`${key} must be a non-empty argv array of strings (no shell string)`);
+  }
+  for (const text of [...Object.values(files || {}), ...(r.build || []), ...(r.run || [])]) {
+    if (typeof text !== 'string') continue;
+    for (const m of text.matchAll(PLACEHOLDER_RE)) if (!ALLOWED_PLACEHOLDERS.has(m[1])) errs.push(`unknown placeholder {{${m[1]}}}`);
+  }
+  if (r.watch != null) {
+    if (typeof r.watch !== 'object' || Array.isArray(r.watch)) errs.push('watch must be an object');
+    else for (const [k, v] of Object.entries(r.watch)) if (!/^[a-z0-9_-]{1,32}$/.test(k) || !isSafeRelPath(v)) errs.push(`bad watch entry: ${k}`);
+  }
+  if (r.env != null) {
+    if (typeof r.env !== 'object' || Array.isArray(r.env)) errs.push('env must be an object');
+    else for (const [k, v] of Object.entries(r.env)) {
+      if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(k)) errs.push(`bad env var name: ${k}`);
+      if (typeof v !== 'string' || v.length > 4096) errs.push(`env value for ${k} must be a short string`);
+    }
+  }
+  if (r.sources != null) {
+    if (typeof r.sources !== 'object' || Array.isArray(r.sources)) errs.push('sources must be an object');
+    else for (const [dest, src] of Object.entries(r.sources)) if (!isSafeRelPath(dest) || !isSafeRelPath(src)) errs.push(`bad sources entry: ${dest}`);
+  }
+  if (r.network != null && !['none', 'callback'].includes(r.network)) errs.push('network must be none or callback');
+  return errs;
+}
+
+/** The view handed to an independent verifier: exactly the reproducer, plus identifiers. Nothing else. */
+function verifierView({ revision, reproducer, findingId, oracle }) {
+  return Object.freeze({ revision: revision ?? null, findingId, oracle, reproducer: structuredClone(reproducer) });
+}
+
+function substitute(text, ctx) {
+  return text.replace(PLACEHOLDER_RE, (whole, name, arg) => {
+    switch (name) {
+      case 'NONCE': return ctx.nonce;
+      case 'SECRET': return ctx.secret(arg || 'default');
+      case 'CANARY': return ctx.canary(arg || 'default');
+      case 'CALLBACK_URL': return ctx.callbackUrl ?? whole;
+      case 'CALLBACK_PORT': return String(ctx.callbackPort ?? '');
+      case 'ROOT': return ctx.root;
+      case 'NODE': return ctx.tools.node;
+      case 'PYTHON': return ctx.tools.python ?? whole;
+      case 'JAVA': return ctx.tools.java ?? whole;
+      case 'JAVAC': return ctx.tools.javac ?? whole;
+      case 'CC': return ctx.tools.cc ?? whole;
+      default: return whole;
+    }
+  });
+}
+
+
+/***/ }),
+
+/***/ 62199:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.r(__webpack_exports__);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   findingKey: () => (/* binding */ findingKey),
+/* harmony export */   latestProof: () => (/* binding */ latestProof),
+/* harmony export */   listProofs: () => (/* binding */ listProofs),
+/* harmony export */   saveProof: () => (/* binding */ saveProof),
+/* harmony export */   scrubDeep: () => (/* binding */ scrubDeep)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
+/* harmony import */ var _encryption_provider_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(39984);
+/* harmony import */ var _llm_validator_redact_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(65388);
+/* harmony import */ var _reproducer_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(37055);
+// Proof artifact store: `.agentic-security/proofs/<findingKey>/<recordDigest>.json`.
+//
+// Reuses the existing state machinery rather than adding another: `safeWriteState` (refuses unsafe dirs and symlinks),
+// `maybeEncryptForWrite` / `maybeDecryptForRead` (the `proofs` artifact is registered `confidential`), retention
+// (evidence class) and legal holds (a hold on `proofs` blocks purge). Nothing persisted contains a plaintext credential:
+// records are passed through a recursive secret filter first, and the runner never returns its per-run nonce or secrets.
+
+
+
+
+
+
+
+const PROOF_RECORD_SCHEMA = 'agentic-security/proof-record';
+const PROOFS_DIR = 'proofs';
+const MAX_RECORD_BYTES = 512 * 1024;
+
+const findingKey = (id) => `${String(id).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 80)}-${(0,_reproducer_js__WEBPACK_IMPORTED_MODULE_5__/* .sha256 */ .sc)(String(id)).slice(0, 8)}`;
+
+// The shared redactor catches key=value shapes; bare tokens need their own pass, so persisted evidence cannot carry one.
+const BARE_SECRET_RES = [
+  /\b(?:ghp|gho|ghu|ghs|ghr|github_pat)_[A-Za-z0-9_]{20,}\b/g, /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, /\bsk-[A-Za-z0-9_-]{20,}\b/g,
+  /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g, /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, /\bSECRET-[0-9a-f]{24}-[a-z0-9_-]+\b/g,
+];
+function scrubString(text) {
+  let t = String(text);
+  try { t = (0,_llm_validator_redact_js__WEBPACK_IMPORTED_MODULE_4__/* .redactSecrets */ .f)(t).text; } catch { return '[unredactable]'; }
+  for (const re of BARE_SECRET_RES) t = t.replace(re, '[REDACTED-SECRET]');
+  return t;
+}
+
+/** Deep-copy `v` with every string passed through the secret redactor. */
+function scrubDeep(v) {
+  if (typeof v === 'string') return scrubString(v);
+  if (Array.isArray(v)) return v.map(scrubDeep);
+  if (v && typeof v === 'object') return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, scrubDeep(x)]));
+  return v;
+}
+
+function recordDigest(record) {
+  const { recordDigest: _omit, ...rest } = record;
+  return (0,_reproducer_js__WEBPACK_IMPORTED_MODULE_5__/* .sha256 */ .sc)((0,_reproducer_js__WEBPACK_IMPORTED_MODULE_5__/* .canonicalize */ .dw)(rest));
+}
+
+function saveProof(scanRoot, record) {
+  const safe = scrubDeep(record);
+  safe.schema = PROOF_RECORD_SCHEMA;
+  safe.recordDigest = recordDigest(safe);
+  const text = JSON.stringify(safe, null, 2);
+  if (Buffer.byteLength(text) > MAX_RECORD_BYTES) return { ok: false, reason: 'proof record exceeds the size limit' };
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .ensureStateDir */ .xH)(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
+  const enc = (0,_encryption_provider_js__WEBPACK_IMPORTED_MODULE_3__/* .maybeEncryptForWrite */ .v2)(scanRoot, PROOFS_DIR, text);
+  if (!enc.ok) return { ok: false, reason: enc.reason };
+  const file = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, PROOFS_DIR, findingKey(record.findingId), `${safe.recordDigest}.json`);
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .safeWriteState */ .Ep)(file, enc.content)) return { ok: false, reason: 'state write refused' };
+  return { ok: true, file, digest: safe.recordDigest, encrypted: enc.encrypted };
+}
+
+function readRecord(file) {
+  const text = (0,_encryption_provider_js__WEBPACK_IMPORTED_MODULE_3__.maybeDecryptForRead)(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(file, 'utf8'));
+  const rec = JSON.parse(text);
+  // A record whose content no longer matches its own digest was modified after it was written.
+  if (rec.recordDigest !== recordDigest(rec)) return { tampered: true, record: rec };
+  return { tampered: false, record: rec };
+}
+
+/** Newest-first records for a finding. Tampered records are returned flagged, never silently dropped or trusted. */
+function listProofs(scanRoot, findingId) {
+  const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, PROOFS_DIR, findingKey(findingId));
+  let names = [];
+  try { names = node_fs__WEBPACK_IMPORTED_MODULE_0__.readdirSync(dir).filter((n) => n.endsWith('.json')); } catch { return []; }
+  const out = [];
+  for (const n of names) {
+    const f = node_path__WEBPACK_IMPORTED_MODULE_1__.join(dir, n);
+    try { const { tampered, record } = readRecord(f); out.push({ file: f, tampered, record, mtime: node_fs__WEBPACK_IMPORTED_MODULE_0__.statSync(f).mtimeMs }); } catch { out.push({ file: f, tampered: true, record: null, mtime: 0 }); }
+  }
+  return out.sort((a, b) => b.mtime - a.mtime);
+}
+
+function latestProof(scanRoot, findingId) {
+  return listProofs(scanRoot, findingId).find((p) => p.record) ?? null;
+}
+
+
+/***/ })
+
+};

package/dist/3736.index.js

@@ -10,10 +10,11 @@ export const modules = {
 /* harmony export */   ensurePolicyKeyPair: () => (/* binding */ ensurePolicyKeyPair),
 /* harmony export */   loadPolicyBundles: () => (/* binding */ loadPolicyBundles),
 /* harmony export */   loadPolicyPublicKey: () => (/* binding */ loadPolicyPublicKey),
+/* harmony export */   rE: () => (/* binding */ computePolicyDrift),
 /* harmony export */   resolveEffectivePolicy: () => (/* binding */ resolveEffectivePolicy),
 /* harmony export */   signPolicyBundle: () => (/* binding */ signPolicyBundle)
 /* harmony export */ });
-/* unused harmony exports POLICY_BUNDLE_SCHEMA, SCOPES, canonicalPolicyBytes, verifyPolicyBundle, computePolicyDrift */
+/* unused harmony exports POLICY_BUNDLE_SCHEMA, SCOPES, canonicalPolicyBytes, verifyPolicyBundle */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
 /* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(48161);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);