@clear-capabilities/agentic-security-scanner 0.171.0 → 0.172.1

package/CHANGELOG.md

@@ -9,6 +9,35 @@
 > make the history less accurate, not more.
 
 
+## 0.172.1 - Deterministic Context Intelligence: adversarial review fixes
+
+An adversarial review of the first release found nine problems, each demonstrated against the shipped code and each now pinned by a regression test (`scanner/test/context-intelligence/premortem.test.js`).
+
+- **False ownership protection.** A route that built SQL from `req.params.id` and merely mentioned `req.user.id` and `owner_name` in the same call reported `ownership: present` with a `complete` bundle. An owner field now counts only when it is tied to the principal in the same clause, and the principal's own name is never read as an owner field. `present` carries a `strength` (`observed` or `inferred`).
+- **Discarded guards.** `isOwner(...)` called as a bare statement no longer counts as a guard; it is `evaluated_and_ineffective`.
+- **Prompt injection through the route label.** The label sat in the instruction text outside the untrusted fence. It is now sanitised and placed inside the fence.
+- **Remote egress.** A non-loopback endpoint now needs `--allow-remote` or `review.allowRemote`; the egress policy and redaction still apply after approval.
+- **Terminal escapes.** Every line the command prints has control characters and bidirectional marks replaced.
+- **Citations.** A citation must now be about its cited lines (not only inside the bundle), spans at most 60 lines, and `no_issue_observed` must cite a control the deterministic pass also found.
+- **Unmeasured numbers.** Precision, recall, F1 and calls per true positive are withheld while the interval is unmeasured; the CSV carries a `synthetic` column.
+- **Compiler export.** A reference must name a callee that its cited line contains, or the whole import degrades.
+- **Locale.** The one locale-sensitive ordering now uses code-unit order, so manifests do not differ by host locale.
+
+## 0.172.0 - Deterministic Context Intelligence (`context` command)
+
+An opt-in, additive subsystem. The default scan, `hunt` and every existing command are unchanged.
+
+- `agentic-security context build` resolves entry points (JavaScript and TypeScript, Python, Haskell, plus the surfaces the existing inventory recognises) and writes one inspectable, hash-bound context bundle each. No model call, no network call. A bundle is `complete` only when nothing material was unresolved, omitted, capped or split.
+- Protection states are explicit per dimension (present, not present, not seen, not resolved, omitted due to budget, evaluated and ineffective for a control that runs after the sensitive operation), with observed versus inferred evidence.
+- `context review` runs focused single-call reviews over frozen bundles through the existing model resolver, egress policy and redaction. Citations are verified against the bundle, severity comes only from the existing confirmation tier, and the bounded queue retries, caches, checkpoints and resumes. A job with no verified result is reported as missing coverage; `--strict` exits 3 on it.
+- `context diff`, `inspect`, `verify`, `export`, `status`, `cleanup`, and an offline batch export and import.
+- Optional read-only compiler metadata import for Haskell (`hie-export/1`), validated against the source snapshot. Automatic metadata builds and a provider batch API are blocked and documented as such.
+- `context eval` scores a bundled synthetic suite with a scripted reader. It is labelled synthetic on its face and supports no accuracy claim; intervals are unmeasured below 10 independent cases, and the holdout split is ledgered.
+- A batch import bug found while testing: a stored declined result no longer blocks importing a good result for the same job.
+- Registered `context-intelligence` and `context-intelligence.json` in the state artifact registry.
+
+See [the guide](docs/guides/context-intelligence.md).
+
 ## 0.171.0 - documentation: surface every shipped PRD capability in the README and docs index
 
 A documentation-only release. Auditing the docs against the actual CLI surface after PRD 5 shipped found

package/bin/agentic-security.js

@@ -181,6 +181,11 @@ Commands:
                                to each finding of a scan result. Read-only, local files only.
                                Off by default: set AGENTIC_SECURITY_ASSURANCE_DEPLOYMENT_BOUNDARIES=1.
                                Exit: 0 ok, 1 failed, 2 usage, 3 feature off or blocked.
+  context <build|inspect|diff|review|status|eval|verify|export|cleanup> [--root <dir>]
+                               Deterministic Context Intelligence (opt-in, additive): resolve entry points,
+                               write one inspectable, hash-bound context bundle each, and optionally run
+                               focused single-call model reviews over them. 'context build' makes no model
+                               call and no network call. Run 'agentic-security context' for the full usage.
   explore [path] [--port <n>] [--keep-open]
                                Start a local, read-only server over an
                                already-scanned lineage graph (run
@@ -7636,6 +7641,7 @@ async function main() {
       case 'calibration-feedback': process.exit(await cmdCalibrationFeedback(args));
       case 'calibration-report': process.exit(await cmdCalibrationReport(args));
       case 'hunt':     process.exit(await cmdHunt(args));
+      case 'context':  process.exit(await (await import('../src/context-intelligence/cli.js')).cmdContext(args));
       case 'compliance': process.exit(await cmdCompliance(args));
       case 'attest':   process.exit(await cmdAttest(args));
       case 'verify-attestation': process.exit(await cmdVerifyAttestation(args));