@clear-capabilities/agentic-security-scanner 0.172.0 → 0.172.1

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-edcc9e08f076b2bc50946c512557c15038e337fa568bc490586fc882ca1c11bc  agentic-security.mjs
+e7ecb2875e67c227bbc9a9643742632dbf486accded83c1ada02043d1c5307d1  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.172.0",
+  "version": "0.172.1",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -43,13 +43,13 @@
     "@babel/core": "^8.0.5",
     "@babel/preset-react": "^8.0.1",
     "@babel/preset-typescript": "^8.0.1",
-    "js-yaml": "^5.4.2",
+    "js-yaml": "^5.5.0",
     "safe-regex": "^2.1.1"
   },
   "optionalDependencies": {
     "tree-sitter-wasms": "0.1.13",
     "web-tree-sitter": "0.20.8",
-    "z3-solver": "^5.3.0"
+    "z3-solver": "^5.3.1"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",
@@ -121,7 +121,7 @@
     "verification:replay-example": "node ../scripts/verification-replay-example.mjs",
     "test:lifecycle": "node --test test/ci-hang-protection.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
-    "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/git-diff-candidates.test.js",
+    "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/premortem.test.js test/context-intelligence/git-diff-candidates.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
     "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",
     "smoke": "node bin/agentic-security.js scan test/fixtures/vulnerable-js",

package/src/context-intelligence/CLAUDE.md

@@ -10,6 +10,10 @@ Deterministic Context Intelligence (the `context` command). Opt-in and additive:
 - Model output cannot set severity. A citation outside the bundle invalidates the review. Severity comes from the existing confirmation tier.
 - Store writes are atomic and refuse links and unsafe paths. Stored packages are re-checked against their hashes.
 - A job with no verified result is missing coverage, never a clean result.
+- Names from the repository (route strings, file names) are data: sanitised before they are printed, never placed in prompt text outside the fence.
+- Source reaches a non-loopback endpoint only with an explicit approval, and the egress policy still applies after it.
+- A citation is checked for range AND for being about the cited lines. `no_issue_observed` needs a control the deterministic pass also found.
+- Orderings that reach a hashed value use `cmpCodeUnit`, never the locale.
 - Evaluation is synthetic. Scorecards must say so and must not state an accuracy claim. Holdout use is ledgered.
 
 ## Where things are

package/src/context-intelligence/adapters/haskell-hie.js

@@ -85,15 +85,42 @@ export function loadHieMetadata(rootReal, hieDir, { fileContents }) {
   return { status: 'ok', tool: doc.tool, compiler: doc.compiler, declarations, references, exportHash: hashOf({ declarations, references }) };
 }
 
+function uncorroboratedReferences(graph, references, fileContents) {
+  const byName = new Map();
+  for (const sym of graph.symbols) {
+    if (sym.kind !== 'function' || sym.id.includes('::<anon>@')) continue;
+    if (!byName.has(sym.name)) byName.set(sym.name, []);
+    byName.get(sym.name).push(sym);
+  }
+  const bad = [];
+  for (const r of references) {
+    const owners = byName.get(r.from) || [];
+    if (owners.length !== 1) continue; // an ambiguous or unknown name is already counted as unmatched and adds nothing
+    const sym = owners[0];
+    const text = fileContents[sym.file];
+    const callee = String(r.to).split(/[.:]/).pop();
+    const lineText = typeof text === 'string' ? text.split('\n')[r.line - 1] : undefined;
+    const inside = r.line >= sym.startLine && r.line <= sym.endLine;
+    if (!inside || lineText === undefined || !callee || !lineText.includes(callee)) bad.push(`${r.from}->${r.to}@${r.line}`);
+  }
+  return bad;
+}
+
 /**
  * Merge an imported export into the static graph. Returns { graph, semantic } where `semantic` carries the provenance
  * and the static-versus-compiler difference report.
  */
 export function mergeHieIntoGraph(graph, meta, fileContents) {
-  void fileContents;
   if (meta.status !== 'ok') {
     return { graph, semantic: { source: ['static-ir'], status: meta.status, reason: meta.reason || null, detail: meta.detail || null, diff: null } };
   }
+  // The export is untrusted even when its file hashes match: it is checked into the repository it describes. A reference
+  // is accepted only if the line it names, inside the declaration it names, actually mentions the callee. One that does
+  // not degrades the whole import, so a crafted export cannot add edges that the source does not contain.
+  const uncorroborated = uncorroboratedReferences(graph, meta.references, fileContents || {});
+  if (uncorroborated.length) {
+    return { graph, semantic: { source: ['static-ir'], status: 'degraded', reason: 'reference-not-in-source', detail: uncorroborated.slice(0, 5).join(', '), diff: null } };
+  }
   const idsByName = new Map();
   for (const s of graph.symbols) {
     if (s.kind !== 'function' || s.id.includes('::<anon>@')) continue;

package/src/context-intelligence/canonical.js

@@ -14,6 +14,31 @@ export function sha256(text) {
   return crypto.createHash('sha256').update(text).digest('hex');
 }
 
+/**
+ * Code-unit order, independent of the host locale. `localeCompare` orders by the process locale, so the same checkout
+ * could be sorted differently on two machines; every ordering that reaches a hashed value goes through this instead.
+ */
+export function cmpCodeUnit(a, b) {
+  const x = String(a); const y = String(b);
+  return x < y ? -1 : x > y ? 1 : 0;
+}
+
+// Control characters (C0, DEL, C1), the bidirectional override/isolate marks and the line/paragraph separators. A
+// repository controls the text of its own route strings and file names, so anything printed to a terminal or placed
+// in a prompt outside the untrusted fence must not be able to carry an escape sequence or reorder what a reader sees.
+const UNSAFE_DISPLAY = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g;
+
+/** Make text safe to print: unsafe characters become '?'. Newline and tab are kept; use `safeLabel` for one-line values. */
+export function cleanForTerminal(text) {
+  return String(text).replace(UNSAFE_DISPLAY, '?');
+}
+
+/** A one-line, bounded, printable form of a name taken from source (a route path, a file name). */
+export function safeLabel(text, max = 120) {
+  const t = String(text).replace(/[\n\r\t]+/g, ' ').replace(UNSAFE_DISPLAY, '?').replace(/ {2,}/g, ' ').trim();
+  return t.length > max ? `${t.slice(0, max - 3)}...` : t;
+}
+
 /** CRLF/CR -> LF so a Windows checkout and a Unix one produce the same spans and hashes. */
 export function normalizeText(text) {
   return String(text).replace(/\r\n?/g, '\n');

package/src/context-intelligence/cli.js

@@ -16,6 +16,7 @@ import { readStoreJson, writeStoreJson, readManifest, readPackageText, verifySto
 import { diffManifestSets, cacheReport } from './diff.js';
 import { readGitSnapshot, readSnapshot } from './files.js';
 import { QUESTION_PACKS, packById } from './prompts/packs.js';
+import { cleanForTerminal } from './canonical.js';
 import { describeModel, resolveInvoker, buildReviewPrompt, redactPackageText, checkEgressForFiles } from './review.js';
 import { planJobs, runQueue, exportBatch, importBatch, HARD_LIMITS } from './queue.js';
 import { reviewsToCandidates, adjudicate } from './candidates.js';
@@ -26,21 +27,24 @@ const flag = (a, k) => (a.flags[k] === undefined ? undefined : a.flags[k]);
 const truthy = (v) => v === true || (typeof v === 'string' && v !== 'false' && v !== '0');
 const num = (v) => (v === undefined || v === true ? undefined : Number(v));
 
+/** Everything this command prints goes through here: repository-supplied names must not carry escape sequences to a terminal. */
+function say(text) { console.log(cleanForTerminal(text)); }
+
 function out(format, text, obj) {
-  if (format === 'json') console.log(JSON.stringify(obj, null, 2));
-  else if (format === 'jsonl') console.log(JSON.stringify(obj));
-  else console.log(text);
+  if (format === 'json') say(JSON.stringify(obj, null, 2));
+  else if (format === 'jsonl') say(JSON.stringify(obj));
+  else say(text);
 }
 
 function usage() {
-  console.log([
+  say([
     'Usage: agentic-security context <subcommand> [--root <dir>] [--format text|json|jsonl]',
     '',
     '  build     Resolve entry points and write one inspectable context bundle each (no model, no network)',
     '            [--entrypoints http,webhook,queue,cron,upload,cli] [--profile compact|standard|extended] [--max-tokens N] [--route <label|id>] [--no-write]',
     '  inspect   Show one bundle: --route <label|id> | --hash <contextHash>  [--show-context] [--package N]',
     '  diff      Routes added/removed/changed between two refs: --from <ref> [--to <ref>]  (omit --to for the working tree)',
-    '  review    Focused one-call reviews over frozen bundles: --question <pack[,pack]> [--route x] [--local-only] [--concurrency N]',
+    '  review    Focused one-call reviews over frozen bundles: --question <pack[,pack]> [--route x] [--local-only] [--allow-remote] [--concurrency N]',
     '            [--max-calls N] [--max-wall-seconds N] [--max-cost-usd N --cost-per-call-usd N] [--retry-failed] [--refute] [--strict]',
     '            [--dry-run] [--export-batch] [--import-batch <results.jsonl> --batch-id <id>]',
     '  status    Coverage so far: entry points, bundles, review jobs',
@@ -62,7 +66,7 @@ async function doBuild(root, args, { write = true } = {}) {
   if (flag(args, 'max-tokens')) config.context.maxTokens = num(flag(args, 'max-tokens'));
   const events = [];
   const jsonl = flag(args, 'format') === 'jsonl';
-  const built = await buildContext(root, { config, route: entrypointFilter(flag(args, 'route')), onEvent: (e) => { events.push(e); if (jsonl) console.log(JSON.stringify(e)); } });
+  const built = await buildContext(root, { config, route: entrypointFilter(flag(args, 'route')), onEvent: (e) => { events.push(e); if (jsonl) say(JSON.stringify(e)); } });
   if (!built.ok) return { ok: false, built, config, problems };
   let persisted = null;
   if (write) persisted = persistBuild(root, built, config);
@@ -155,7 +159,7 @@ async function cmdInspect(root, args, format) {
     `  boundaries (calls into libraries, not first-party code): ${m.boundaries.length}`,
   ];
   if (text) lines.push('', text.ok ? text.text : `(context text unavailable: ${text.code})`);
-  console.log(lines.join('\n'));
+  say(lines.join('\n'));
   return 0;
 }
 
@@ -255,7 +259,7 @@ async function cmdExport(root, args, format) {
   if (!h || h === true) { out(format, 'context export: --hash <contextHash> is required', { ok: false }); return 1; }
   const r = exportBundle(root, String(h));
   if (!r.ok) { out(format, `context export: refused (${r.problems.join(', ')})`, { ok: false, problems: r.problems }); return 1; }
-  console.log(JSON.stringify(r.export, null, 2));
+  say(JSON.stringify(r.export, null, 2));
   return 0;
 }
 
@@ -303,7 +307,7 @@ async function cmdReview(root, args, format) {
   const r = await doBuild(root, args, { write: true });
   if (!r.ok) { out(format, `context review: build failed (${r.built.reason})`, { ok: false, reason: r.built.reason }); return r.built.reason === 'too-many-files' ? 2 : 1; }
   const { built } = r;
-  const model = describeModel();
+  const model = describeModel({ allowRemote: truthy(flag(args, 'allow-remote')) || r.config.review.allowRemote === true });
   const { jobs, droppedByJobLimit } = planJobs({ bundles: built.bundles, packs, model, maxJobs: Math.min(HARD_LIMITS.maxJobs, num(flag(args, 'max-jobs')) || HARD_LIMITS.maxJobs) });
   const loadJob = loadJobFrom(built, packs);
   const ctxBase = { root: built.root, fileContents: built.fileContents, model };
@@ -341,7 +345,7 @@ async function cmdReview(root, args, format) {
   try {
     result = await runQueue(jobs, {
       ...ctxBase, invoker, loadJob, signal: ac.signal, retryFailed: truthy(flag(args, 'retry-failed')),
-      onEvent: jsonl ? (e) => console.log(JSON.stringify(e)) : undefined,
+      onEvent: jsonl ? (e) => say(JSON.stringify(e)) : undefined,
       limits: {
         concurrency: num(flag(args, 'concurrency')) || config.review.concurrency,
         maxCalls: num(flag(args, 'max-calls')) || config.review.maxCalls,

package/src/context-intelligence/config.js

@@ -22,7 +22,7 @@ export const DEFAULT_CONFIG = Object.freeze({
   maxFiles: 3000,
   semanticMetadata: { mode: 'off', haskellHieDir: null },
   context: { profile: 'standard', maxTokens: null, pruneLowValue: true, maxSymbols: 60, maxDepth: 12 },
-  review: { enabled: false, questionPacks: ['authz-idor'], concurrency: 2, maxCalls: 100, maxWallSeconds: 900, maxCostUsd: null, maxTokensPerJob: 40000, maxRetries: 3 },
+  review: { enabled: false, allowRemote: false, questionPacks: ['authz-idor'], concurrency: 2, maxCalls: 100, maxWallSeconds: 900, maxCostUsd: null, maxTokensPerJob: 40000, maxRetries: 3 },
   replay: { contentAddressed: true, retention: 'inherit' },
 });
 
@@ -63,6 +63,7 @@ export function normalizeConfig(raw) {
     },
     review: {
       enabled: rv.enabled === true,
+      allowRemote: rv.allowRemote === true,
       questionPacks: Array.isArray(rv.questionPacks) && rv.questionPacks.length ? rv.questionPacks.filter(x => typeof x === 'string') : d.review.questionPacks,
       concurrency: clamp(rv.concurrency, 1, 16, d.review.concurrency),
       maxCalls: clamp(rv.maxCalls, 1, 5000, d.review.maxCalls),

package/src/context-intelligence/controls.js

@@ -47,7 +47,46 @@ export function signatureText(lines, declLine, maxLines = 12) {
   for (let i = declLine - 1; i < Math.min(lines.length, declLine - 1 + maxLines); i++) { t += ' ' + lines[i]; if (/\)\s*(?:->[^:]*)?:\s*(?:#.*)?$/.test(lines[i])) break; }
   return t;
 }
-const OWNER_FIELD = /(?:owner|tenant|org(?:anization)?|account|created_?by|author|user_?id|userId|team|workspace)/i;
+// An owner/tenant FIELD NAME, not any word that merely contains one: `ownerId`, `owner_id`, `tenant`, `getOwnerId`
+// qualify; `owner_name` and `cols` do not (the trailing boundary rejects them).
+const OWNER_KEY = '\\w*?(?:[Oo]wner|[Tt]enant|[Oo]rg(?:ani[sz]ation)?|[Aa]ccount|[Cc]reated_?[Bb]y|[Aa]uthor|[Tt]eam|[Ww]orkspace)(?:_?(?:[Ii]d|ID))?\\b|[Uu]ser_?(?:[Ii]d|ID)\\b';
+const OWNER_KEY_RE = new RegExp(`(?<![\\w])(?:${OWNER_KEY})`);
+const TENANT_WORD = /tenant|org|workspace|team|account/i;
+// a SQL string comparing an owner column with a bound parameter: `owner_id = ?`, `owner_id = $1`, `tenant_id = :t`
+const SQL_OWNER_PLACEHOLDER = new RegExp(`(?<![\\w])(?:${OWNER_KEY})\\s*(?:=|\\bIN\\b|\\bin\\b)\\s*\\(?\\s*(?:\\?|\\$\\d+|:\\w+|%s|@\\w+)`);
+// an owner column compared with the principal written straight into the string: `owner_id = ${req.user.id}`
+const SQL_OWNER_INTERPOLATED = new RegExp(`(?<![\\w])(?:${OWNER_KEY})\\s*=\\s*(?:'?\\s*\\+\\s*|\\$\\{\\s*)(?:${QUALIFIED_PRINCIPAL.source}|${BARE_PRINCIPAL.source})`);
+const PRINCIPAL_GLOBAL = new RegExp(QUALIFIED_PRINCIPAL.source, 'g');
+const STRING_LITERAL = /(["'`])(?:\\.|(?!\1).)*\1/g;
+
+/**
+ * Is an owner/tenant FIELD actually tied to the principal in this text? The field and the principal must sit in the
+ * same clause (split on , ; && || braces), so `{ audit: req.user.id, cols: 'owner_name' }` is a decoy and
+ * `{ ownerId: req.user.id }` is a filter. A SQL string with an owner column against a bound placeholder counts when the
+ * principal is passed in the same call. Returns null or { level: 'qualified'|'bare', tenant }.
+ */
+export function ownerBinding(text, extra = null) {
+  let best = null;
+  const take = (level, tenant) => { if (!best || (level === 'qualified' && best.level !== 'qualified')) best = { level, tenant }; };
+  const code = text.replace(STRING_LITERAL, (m) => (SQL_OWNER_PLACEHOLDER.test(m) || SQL_OWNER_INTERPOLATED.test(m) ? m : '""'));
+  for (const clause of code.split(/[,;{}]|&&|\|\|/)) {
+    // the principal's own name (`req.user`, `current_user`) is not an owner field, so it is removed before looking for one
+    const forKey = clause.replace(STRING_LITERAL, ' ').replace(PRINCIPAL_GLOBAL, ' ');
+    if (!OWNER_KEY_RE.test(forKey)) continue;
+    const pr = principalIn(clause, extra);
+    if (pr) take(pr, TENANT_WORD.test(clause));
+  }
+  for (const m of text.match(STRING_LITERAL) || []) {
+    const placeholder = SQL_OWNER_PLACEHOLDER.test(m);
+    if (placeholder) {
+      const pr = principalIn(text, extra);
+      if (pr) take(pr, TENANT_WORD.test(m));
+    }
+    if (SQL_OWNER_INTERPOLATED.test(m)) take('qualified', TENANT_WORD.test(m));
+  }
+  return best;
+}
+
 const COMPARE = /(?:===|!==|==|!=|\.equals\(|\bis not\b|\bis\b|\bnot in\b|\bin\b|\.includes\(|\.has\()/;
 const REJECT = /(?:\breturn\b|\bthrow\b|\braise\b|\babort\b|\bexit\b|\b40[0-9]\b|\bforbidden\b|\bunauthori[sz]ed\b|\bHttpError\b|\breject\b|\bnot_?allowed\b|\bdeny\b|\bdenied\b|throwError|\bfinish\b|\bhalt\b|\bPermissionDenied\b|\bAccessDenied\b|status\()/i;
 
@@ -58,6 +97,13 @@ const DB_RECEIVER = /(?:^|\b)(?:db|database|conn|connection|pool|client|cursor|s
 const SQL_TEXT = /\b(?:select\s[\s\S]{1,120}\sfrom|insert\s+into|update\s+\w+\s+set|delete\s+from)\b/i;
 const HS_SENSITIVE = /(?:^|\.)(?:runDB|selectList|selectFirst|getBy|getJust|insert_?|insertEntity|update|updateWhere|delete|deleteWhere|replace|upsert|query|query_|execute|execute_|readFile|writeFile|callProcess|readProcess)$|^(?:Database\.|System\.Process\.|System\.Directory\.)/;
 
+// Names that answer a question rather than enforce a rule.
+const PREDICATE_NAME = /^(?:is|has|can|cannot|allow|owned|belongs)/i;
+function bareCallStatement(trimmedLine, name) {
+  const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`^(?:await\\s+)?${esc}\\s*\\(`).test(trimmedLine) && /\)\s*;?\s*(?:\/\/.*|\/\*.*)?$/.test(trimmedLine);
+}
+
 const WRITE_VERB = /(?:insert|update|upsert|delete|remove|destroy|save|create|write|append|unlink|rm|exec|spawn|system|popen|post|put|patch|replace)/i;
 
 function kindOfAuthName(name) {
@@ -132,8 +178,12 @@ export function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
     }
     for (const name of calls) {
       if (AUTH_NAME.test(name) && !/^(?:if|for|while|switch|catch|function)$/.test(name)) {
-        const rej = REJECT.test(lines.slice(ln - 1, ln + 3).join(' ')) || /^(?:require|ensure|enforce|assert|authori[sz]e|authenticate|protect)/i.test(name.split(/[.:]/).pop());
-        push({ line: ln, category: 'control', kind: kindOfAuthName(name), subkind: null, evidence: 'inferred', basis: 'call-name', rejectionSeen: rej, text: clip(raw) });
+        const lastSeg = name.split(/[.:]/).pop();
+        // A predicate (isOwner, hasRole, can) only returns an answer. Called as a bare statement its answer is thrown away,
+        // so it guards nothing, whatever the lines around it say.
+        const discarded = !haskell && PREDICATE_NAME.test(lastSeg) && bareCallStatement(t, name);
+        const rej = !discarded && (REJECT.test(lines.slice(ln - 1, ln + 3).join(' ')) || /^(?:require|ensure|enforce|assert|authori[sz]e|authenticate|protect)/i.test(lastSeg));
+        push({ line: ln, category: 'control', kind: kindOfAuthName(name), subkind: null, evidence: 'inferred', basis: discarded ? 'call-name-result-discarded' : 'call-name', rejectionSeen: rej, text: clip(raw) });
       }
       const last = name.split(/[.:]/).pop();
       const recv = name.includes('.') ? name.slice(0, name.lastIndexOf('.')) : '';
@@ -149,9 +199,9 @@ export function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
         push({ line: ln, category: 'sensitive', kind: sub, subkind: verb, evidence: 'observed', basis: 'call-name', rejectionSeen: null, text: clip(raw) });
         // a data operation whose own statement mentions the principal and an owner/tenant field is scoped by it
         const stmt = statementAt(lines, ln);
-        const pr = sub.startsWith('data-') && OWNER_FIELD.test(stmt) ? principalIn(stmt, extraPrincipal) : null;
+        const pr = sub.startsWith('data-') ? ownerBinding(stmt, extraPrincipal) : null;
         if (pr) {
-          push({ line: ln, category: 'control', kind: /tenant|org|workspace|team|account/i.test(stmt) ? 'tenant-scope' : 'ownership', subkind: null, evidence: pr === 'qualified' ? 'observed' : 'inferred', basis: pr === 'qualified' ? 'query-filter' : 'query-filter-bare-identifier', rejectionSeen: null, text: clip(raw) });
+          push({ line: ln, category: 'control', kind: pr.tenant ? 'tenant-scope' : 'ownership', subkind: null, evidence: pr.level === 'qualified' ? 'observed' : 'inferred', basis: pr.level === 'qualified' ? 'query-filter' : 'query-filter-bare-identifier', rejectionSeen: null, text: clip(raw) });
         }
       }
     }
@@ -159,17 +209,17 @@ export function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
       const verb = /\b(?:insert|update|delete)\b/i.test(raw) ? 'write' : 'read';
       push({ line: ln, category: 'sensitive', kind: `data-${verb}`, subkind: verb, evidence: 'observed', basis: 'sql-text', rejectionSeen: null, text: clip(raw) });
       const stmt = statementAt(lines, ln);
-      const pr = OWNER_FIELD.test(stmt) ? principalIn(stmt, extraPrincipal) : null;
+      const pr = ownerBinding(stmt, extraPrincipal);
       if (pr) {
-        push({ line: ln, category: 'control', kind: /tenant|org|workspace|team|account/i.test(stmt) ? 'tenant-scope' : 'ownership', subkind: null, evidence: pr === 'qualified' ? 'observed' : 'inferred', basis: pr === 'qualified' ? 'query-filter' : 'query-filter-bare-identifier', rejectionSeen: null, text: clip(raw) });
+        push({ line: ln, category: 'control', kind: pr.tenant ? 'tenant-scope' : 'ownership', subkind: null, evidence: pr.level === 'qualified' ? 'observed' : 'inferred', basis: pr.level === 'qualified' ? 'query-filter' : 'query-filter-bare-identifier', rejectionSeen: null, text: clip(raw) });
       }
     }
 
     // a resource field compared with the principal: the ownership check itself
-    const cmpPr = COMPARE.test(raw) && OWNER_FIELD.test(raw) && /\b(?:if|unless|assert|when|guard|require|expect|where|elif|&&|\|\|)\b|\?/.test(raw) ? principalIn(raw, extraPrincipal) : null;
+    const cmpPr = COMPARE.test(raw) && /\b(?:if|unless|assert|when|guard|require|expect|where|elif|&&|\|\|)\b|\?/.test(raw) ? ownerBinding(raw, extraPrincipal) : null;
     if (cmpPr) {
       const rej = REJECT.test(lines.slice(ln - 1, ln + 3).join(' '));
-      push({ line: ln, category: 'control', kind: /tenant|org|workspace|team|account/i.test(raw) ? 'tenant-scope' : 'ownership', subkind: null, evidence: cmpPr === 'qualified' ? 'observed' : 'inferred', basis: cmpPr === 'qualified' ? 'comparison' : 'comparison-bare-identifier', rejectionSeen: rej, text: clip(raw) });
+      push({ line: ln, category: 'control', kind: cmpPr.tenant ? 'tenant-scope' : 'ownership', subkind: null, evidence: cmpPr.level === 'qualified' ? 'observed' : 'inferred', basis: cmpPr.level === 'qualified' ? 'comparison' : 'comparison-bare-identifier', rejectionSeen: rej, text: clip(raw) });
     }
   }
   // A function whose NAME says it is a guard and whose BODY shows a rejection path is a guard function. This is

package/src/context-intelligence/entrypoints.js

@@ -12,7 +12,7 @@
 //                        not resolve, a handler matched by name only, a router whose mount point is not visible
 //   unresolved           no handler could be identified; the manifest still exists and says so
 //   excluded_by_policy   deliberately not processed (operator exclusion, or the entry-point cap)
-import { hashOf } from './canonical.js';
+import { hashOf, safeLabel } from './canonical.js';
 import { callStatement, inlineBlockSpan, splitArgs } from './spans.js';
 import { dependencyParams, signatureText } from './controls.js';
 import { buildEntrypointInventory } from '../posture/entrypoint-inventory.js';
@@ -313,7 +313,7 @@ export async function collectEntrypoints({ fileContents, graph, config = {} }) {
     const n = (ord.get(stem) || 0) + 1;
     ord.set(stem, n);
     r.id = `ep:${stem.slice(0, 20)}${n > 1 ? `-${n}` : ''}`;
-    r.label = `${r.method ? r.method + ' ' : ''}${r.pathTemplate}`.trim() || r.kind;
+    r.label = safeLabel(`${r.method ? r.method + ' ' : ''}${r.pathTemplate}`) || r.kind;
     void hname;
     let disposition;
     const excluded = exclude.some(re => re.test(r.registrationSite.file) || re.test(r.pathTemplate));

package/src/context-intelligence/evaluation/index.js

@@ -92,6 +92,8 @@ export function metricsFor(units, protocolHash, name) {
     precision: precisionOf(c), recall: recallOf(c), f1: f1Of(c),
     precisionInterval: pn > 0 ? wilsonInterval(c.tp, pn) : { status: 'unmeasured', reason: 'nothing was reported' },
     f1Interval: f1,
+    // A point estimate with no interval around it reads as a finding. It is reportable only when the interval is measured.
+    reportable: f1 && f1.status === 'measured',
   };
 }
 
@@ -127,6 +129,9 @@ function readLedger(root) {
 const pct = (x) => (x === null || x === undefined ? 'n/a' : (x * 100).toFixed(0) + '%');
 const interval = (i) => (!i || i.status !== 'measured' ? `unmeasured (${i && i.reason ? i.reason.split(',')[0] : 'no data'})` : `${pct(i.low)} to ${pct(i.high)}`);
 
+// Precision, recall and F1 are printed only when their interval is measured; otherwise the counts stand alone.
+const shown = (m, x) => (m.reportable ? pct(x) : 'withheld');
+
 export function renderMarkdown(card) {
   const L = [];
   L.push('# Context Intelligence evaluation scorecard', '');
@@ -141,18 +146,20 @@ export function renderMarkdown(card) {
   for (const s of card.systems) {
     if (s.status !== 'measured') { L.push(`| ${s.system} | ${s.status}: ${s.reason} | | | | | | | | | | |`); continue; }
     const m = s.metrics;
-    L.push(`| ${s.system} | measured | ${m.counts.tp} | ${m.counts.fp} | ${m.counts.fn} | ${m.counts.tn} | ${pct(m.precision)} | ${pct(m.recall)} | ${pct(m.f1)} | ${interval(m.f1Interval)} | ${s.calls} | ${s.promptChars} |`);
+    L.push(`| ${s.system} | measured | ${m.counts.tp} | ${m.counts.fp} | ${m.counts.fn} | ${m.counts.tn} | ${shown(m, m.precision)} | ${shown(m, m.recall)} | ${shown(m, m.f1)} | ${interval(m.f1Interval)} | ${s.calls} | ${s.promptChars} |`);
   }
   L.push('', '## Economics (estimated; no price supplied)', '', '| system | median ctx tokens | P95 | P99 | model calls | calls per true positive | wall ms |', '|---|---|---|---|---|---|---|');
-  for (const s of card.systems) if (s.economics) { const e = s.economics; L.push(`| ${s.system} | ${e.contextTokens.median ?? 'n/a'} | ${e.contextTokens.p95 ?? 'n/a'} | ${e.contextTokens.p99 ?? 'n/a'} | ${e.modelCalls} | ${e.callsPerTruePositive === null ? 'n/a' : e.callsPerTruePositive.toFixed(1)} | ${e.wallMs} |`); }
+  for (const s of card.systems) if (s.economics) { const e = s.economics; L.push(`| ${s.system} | ${e.contextTokens.median ?? 'n/a'} | ${e.contextTokens.p95 ?? 'n/a'} | ${e.contextTokens.p99 ?? 'n/a'} | ${e.modelCalls} | ${e.callsPerTruePositive === null || !s.metrics || !s.metrics.reportable ? 'withheld' : e.callsPerTruePositive.toFixed(1)} | ${e.wallMs} |`); }
+  L.push('', 'Precision, recall, F1 and calls per true positive are withheld while their interval is unmeasured (fewer than 10 independent groups). The counts above are what was observed; they are not an estimate of anything.');
   L.push('', `Replay: \`${card.replay}\``, '');
   if (card.leakage.length) { L.push('## Leakage hits', ...card.leakage.map(h => `- ${h.where} ${h.file || ''} ${h.term}`), ''); }
   return L.join('\n');
 }
 
 export function renderCsv(card) {
-  const rows = [['system', 'case', 'variant', 'vulnerable', 'flagged', 'outcome', 'calls', 'promptChars']];
-  for (const s of card.systems) for (const u of (s.units || [])) rows.push([s.system, u.caseId, u.variant, u.vulnerable, u.flagged, u.outcome, u.calls, u.promptChars]);
+  // The marker is a column, not a banner: a CSV is the format that gets pasted into a spreadsheet without its header text.
+  const rows = [['system', 'case', 'variant', 'vulnerable', 'flagged', 'outcome', 'calls', 'promptChars', 'synthetic']];
+  for (const s of card.systems) for (const u of (s.units || [])) rows.push([s.system, u.caseId, u.variant, u.vulnerable, u.flagged, u.outcome, u.calls, u.promptChars, card.synthetic === false ? false : true]);
   return rows.map(r => r.join(',')).join('\n') + '\n';
 }
 

package/src/context-intelligence/evaluation/scripted-reader.js

@@ -189,6 +189,16 @@ function stripUntrustedKeepUser(t) { return stripUntrusted(t).replace(/""/g, '""
 
 function cite(l, role, claim) { return { role, file: l.file, startLine: l.n, endLine: l.n, claim }; }
 
+/** A reader that cites a line says what is on it: the claim quotes the cited text, as a careful model would. */
+function quoteCited(obj, blocks) {
+  const text = (c) => {
+    for (const b of blocks) if (b.file === c.file) { const l = b.lines.find(x => x.n === c.startLine); if (l) return l.text.trim().slice(0, 100); }
+    return '';
+  };
+  const fix = (list) => (Array.isArray(list) ? list.map(c => ({ ...c, claim: `${c.claim}: ${text(c)}` })) : list);
+  return { ...obj, evidence: fix(obj.evidence), observedMitigations: fix(obj.observedMitigations) };
+}
+
 /** The decision for a pack, from the observations. Returns the review JSON object. */
 export function decide(packId, obs, ctx) {
   const base = { observedMitigations: [], attackerControl: [], uncertainties: [], likelihood: 'low' };
@@ -237,7 +247,7 @@ export function scriptedReader() {
   const invoke = async (prompt) => {
     if (/^QUESTION PACK: /m.test(prompt)) {
       const packId = /^QUESTION PACK: ([\w-]+)\//m.exec(prompt)[1];
-      const label = /^ENTRY POINT 1: (.*?) \(id /m.exec(prompt)[1];
+      const label = (/^ENTRY POINT LABEL \(data\): (.*)$/m.exec(prompt) || [])[1] || '';
       const { blocks, unresolved, notIncluded, limit } = blocksFromReviewPrompt(prompt);
       const routes = findRoutes(blocks);
       const [method, ...rest] = label.split(' ');
@@ -246,7 +256,7 @@ export function scriptedReader() {
       if (!route) return JSON.stringify({ evidence: [], observedMitigations: [], conclusion: 'insufficient_evidence', invariant: 'unspecified', uncertainties: ['the registration is not in the provided context'] });
       const obs = analyseRoute(route, blocks);
       const complete = !unresolved && !notIncluded && !limit;
-      return JSON.stringify(decide(packId, obs, { complete, unresolved }));
+      return JSON.stringify(quoteCited(decide(packId, obs, { complete, unresolved }), blocks));
     }
     // hunt prompt: report the candidates for the lens, with a location
     const lens = /Your lens is ([\w ]+)\./.exec(prompt);

package/src/context-intelligence/reachability.js

@@ -12,6 +12,7 @@
 //   * lose a control. Middleware and every callee are walked, and each visited symbol's controls are collected by the
 //     same classifier the packer uses to refuse pruning.
 import { analyzeSymbolText } from './controls.js';
+import { cmpCodeUnit } from './canonical.js';
 import { MATERIAL_REASONS } from './graph-schema.js';
 
 export const DEFAULT_LIMITS = Object.freeze({ maxSymbols: 60, maxDepth: 12 });
@@ -70,7 +71,7 @@ export function reachFrom({ graph, fileContents, entrypoint, limits = {} }) {
   }
 
   // middleware runs before the handler: it is enqueued first and ordered at line -1
-  for (const mw of [...entrypoint.middleware].sort((a, b) => (a.line - b.line) || String(a.name).localeCompare(String(b.name)))) {
+  for (const mw of [...entrypoint.middleware].sort((a, b) => (a.line - b.line) || cmpCodeUnit(a.name, b.name))) {
     if (mw.symbolId && byId.has(mw.symbolId)) enqueue(mw.symbolId, 0, mw.inherited ? 'inherited-middleware' : 'middleware', -1, [mw.symbolId], mw.resolution === 'resolved' ? 'exact' : 'name-match');
   }
   if (root.symbolId) {
@@ -163,11 +164,14 @@ export function evaluateProtection({ facts, unknowns, omittedWithControls = fals
   for (const dim of PROTECTION_DIMENSIONS) {
     const kinds = dim === 'ownership' ? ['ownership', 'tenant-scope'] : [dim];
     const ctl = facts.filter(f => f.category === 'control' && kinds.includes(f.kind));
-    const before = ctl.filter(f => firstSens === null || f.effLine < firstSens || (f.basis === 'query-filter' && f.effLine <= firstSens));
+    // A control whose answer is visibly thrown away (a predicate called as a bare statement) guards nothing.
+    const effective = (f) => f.rejectionSeen !== false;
+    const before = ctl.filter(f => effective(f) && (firstSens === null || f.effLine < firstSens || (f.basis === 'query-filter' && f.effLine <= firstSens)));
     const after = ctl.filter(f => firstSens !== null && f.effLine > firstSens);
     let state; let why;
     if (before.length) { state = 'present'; why = 'a control precedes the first sensitive operation'; }
     else if (after.length) { state = 'evaluated_and_ineffective'; why = 'every control of this kind runs after the first sensitive operation'; }
+    else if (ctl.length && ctl.every(f => !effective(f))) { state = 'evaluated_and_ineffective'; why = 'a check is called but nothing in view acts on its answer'; }
     else if (ctl.length) { state = 'evaluated_and_ineffective'; why = 'a control is present but is not ordered before the sensitive operation'; }
     else if (omittedWithControls) { state = 'omitted_due_to_budget'; why = 'a symbol holding a control was left out for size'; }
     else if (unknowns.some(u => u.material) || capped) { state = 'not_resolved'; why = 'an unresolved call or a traversal limit could hide a control'; }
@@ -175,6 +179,8 @@ export function evaluateProtection({ facts, unknowns, omittedWithControls = fals
     else { state = 'not_present'; why = 'the resolved context is complete and contains no control of this kind'; }
     dims[dim] = {
       state, why, firstSensitiveLine: firstSens,
+      // How the control was established: 'observed' = the text shows it, 'inferred' = only a name suggests it. Only meaningful for `present`.
+      strength: state === 'present' ? (before.some(f => f.evidence === 'observed') ? 'observed' : 'inferred') : null,
       evidence: ctl.slice(0, 6).map(f => ({ file: f.file, line: f.line, kind: f.kind, evidence: f.evidence, basis: f.basis, order: firstSens === null ? 'no-sensitive-op' : f.effLine < firstSens ? 'before-sensitive' : f.effLine > firstSens ? 'after-sensitive' : 'same-step', rejectionSeen: f.rejectionSeen })),
     };
   }