@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/3314.index.js

@@ -0,0 +1,263 @@
+export const id = 3314;
+export const ids = [3314];
+export const modules = {
+
+/***/ 33314:
+/***/ ((__webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependencies__, __webpack_async_result__) => { try {
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   computePrDelta: () => (/* binding */ computePrDelta),
+/* harmony export */   netNewGate: () => (/* binding */ netNewGate),
+/* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
+/* harmony export */ });
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
+/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(12179);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(28369);
+/* harmony import */ var _language_discovery_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(41928);
+var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_engine_js__WEBPACK_IMPORTED_MODULE_2__]);
+_engine_js__WEBPACK_IMPORTED_MODULE_2__ = (__webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__)[0];
+// Shadowscan / security-DELTA on PR (v0.72).
+//
+// Most SAST PR-comment integrations show absolute counts — "12 findings
+// detected in changed files." Engineers can't act on that: 11 of those
+// 12 already existed before they touched the file. They want a DELTA:
+// what did THIS PR introduce, what did it remove, what changed.
+//
+// This module diffs two scans (PR branch vs base) by stableId and emits
+// both a JSON delta and a human-readable summary suitable for embedding
+// in a PR comment. Reuses the existing `history-scan.js` machinery for
+// the at-ref scans.
+//
+// Algorithm:
+//   1. Scan the base ref (in-memory via runFullScan, no checkout)
+//   2. Scan the head ref (same way)
+//   3. Key findings by stableId
+//   4. Emit:
+//        - introduced: findings in head not in base
+//        - resolved:   findings in base not in head
+//        - persistent: findings in both (changed severity/cwe → 'shifted')
+//   5. Severity-summary counts each side
+//
+// Output shape stays stable so downstream renderers (advisor-tone PR
+// comment) can transform without re-walking IR.
+
+
+
+
+
+
+const FILE_EXT_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs|py|java|cs|kt|go|rb|php|sol|swift|rs|tf|yml|yaml|json|toml|md|hs|lhs|hsc|hs-boot|nix|cabal)$/i;
+const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+
+// `root` is the PR's repository — a scan target, not this project's own
+// trusted checkout — hardened per FR-PROV-024 / the second Finding
+// Provenance PRD audit (same exposure class as
+// provenance/git-evidence.js's `_run`).
+function _git(root, args) {
+  const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)('git', (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__/* .hardenGitArgs */ .Ax)(args), { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, env: (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__/* .hardenGitEnv */ .Si)() });
+  return { ok: r.status === 0, stdout: r.stdout || '', stderr: r.stderr || '' };
+}
+
+function _readFileAtRef(root, ref, file) {
+  // `--no-textconv`: this blob-cat form of `show` (`<ref>:<file>`, not a
+  // diff) was verified NOT reachable via a hostile textconv driver in
+  // current git, same as git-evidence.js's getBlobAtCommit — kept for
+  // defense-in-depth/uniformity.
+  const r = _git(root, ['show', '--no-textconv', `${ref}:${file}`]);
+  return r.ok ? r.stdout : null;
+}
+
+function _listFilesAtRef(root, ref) {
+  const r = _git(root, ['ls-tree', '-r', '--name-only', ref]);
+  if (!r.ok) return [];
+  return r.stdout.trim().split('\n').filter(p => {
+    if (!p) return false;
+    if (p.includes('/node_modules/') || p.includes('/.venv/')) return false;
+    if ((0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_3__/* .isLanguageExcludedPath */ .EG)(p)) return false;
+    return FILE_EXT_RE.test(p) || (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_3__/* .isLanguageManifest */ .mD)(p);
+  });
+}
+
+async function _scanAtRef(root, ref) {
+  const files = _listFilesAtRef(root, ref);
+  const fileContents = {};
+  const depFileContents = {};
+  for (const f of files) {
+    const c = _readFileAtRef(root, ref, f);
+    if (c == null) continue;
+    // Haskell/Nix manifests and lock files are dependency inputs, not code (the same split a working-tree scan makes).
+    if ((0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_3__/* .isLanguageManifest */ .mD)(f)) depFileContents[f] = c; else fileContents[f] = c;
+  }
+  // `provenance:false` — a base-ref snapshot, not the current working state.
+  // Beyond the wasted git walks, updateLifecycle marks every open stableId
+  // absent from the finding set it is handed as `remediated`; running the PR
+  // delta gate would silently rewrite the project's lifecycle store from the
+  // base ref's findings.
+  return (0,_engine_js__WEBPACK_IMPORTED_MODULE_2__/* .runFullScan */ .wW)({ fileContents, depFileContents, scanRoot: root, provenance: false }, () => {});
+}
+
+function _summary(findings) {
+  const out = { total: 0 };
+  for (const s of SEVERITIES) out[s] = 0;
+  for (const f of (findings || [])) {
+    const s = f.severity || 'info';
+    if (out[s] !== undefined) out[s]++;
+    out.total++;
+  }
+  return out;
+}
+
+function _changedFiles(root, baseRef, headRef) {
+  // `--no-ext-diff`: found during the second-audit-remediation sweep — this
+  // is a `git diff` call site (`--name-only`, no content rendered, so not
+  // itself a verified exploit path today, same as runScan.js's
+  // `changedSince`), but every `diff` invocation in this codebase gets it
+  // uniformly per the live exploit VERIFIED in material-change.js's
+  // classifyGitDiff (external diff drivers fire on `git diff` even with
+  // `--no-textconv`, which is a surface `--no-textconv` alone does not close).
+  const r = _git(root, ['diff', '--name-only', '--no-ext-diff', `${baseRef}...${headRef}`]);
+  if (!r.ok) return new Set();
+  return new Set(r.stdout.trim().split('\n').filter(Boolean));
+}
+
+/**
+ * Top-level entry: compute the delta between two refs.
+ *
+ *   root:     scan root (a git repo)
+ *   baseRef:  the ref to compare against (e.g. main, origin/main)
+ *   headRef:  the ref to score (e.g. HEAD, the PR branch). Defaults HEAD.
+ *
+ * Returns:
+ *   {
+ *     baseRef, headRef,
+ *     changedFiles: [...],          // git diff --name-only base...head
+ *     base:        { findings, summary, secrets, supplyChain, logicVulns },
+ *     head:        { findings, summary, secrets, supplyChain, logicVulns },
+ *     introduced:  Finding[],       // new in head only
+ *     resolved:    Finding[],       // removed from base
+ *     persistent:  Finding[],       // same stableId in both (no semantic change)
+ *     shifted:     Finding[],       // same stableId, severity OR cwe changed
+ *     summary:     { introduced: SeveritySummary, resolved, persistent, net },
+ *   }
+ *
+ * `net` is per-severity (head − base). A negative critical count means
+ * the PR resolved a critical finding overall.
+ */
+async function computePrDelta(root, { baseRef, headRef = 'HEAD' } = {}) {
+  if (!baseRef) throw new Error('computePrDelta: baseRef is required');
+  const changedFiles = [..._changedFiles(root, baseRef, headRef)];
+  const baseScan = await _scanAtRef(root, baseRef);
+  const headScan = await _scanAtRef(root, headRef);
+  const baseById = new Map();
+  const headById = new Map();
+  for (const f of (baseScan.findings || [])) {
+    const k = f.stableId || f.id;
+    if (k) baseById.set(k, f);
+  }
+  for (const f of (headScan.findings || [])) {
+    const k = f.stableId || f.id;
+    if (k) headById.set(k, f);
+  }
+  const introduced = [];
+  const resolved = [];
+  const persistent = [];
+  const shifted = [];
+  for (const [k, f] of headById) {
+    if (!baseById.has(k)) introduced.push(f);
+    else {
+      const base = baseById.get(k);
+      if (base.severity !== f.severity || base.cwe !== f.cwe) {
+        shifted.push({ from: base, to: f });
+      } else {
+        persistent.push(f);
+      }
+    }
+  }
+  for (const [k, f] of baseById) {
+    if (!headById.has(k)) resolved.push(f);
+  }
+  // Net severity (head − base).
+  const net = {};
+  const baseSummary = _summary(baseScan.findings || []);
+  const headSummary = _summary(headScan.findings || []);
+  for (const s of [...SEVERITIES, 'total']) net[s] = (headSummary[s] || 0) - (baseSummary[s] || 0);
+  return {
+    baseRef, headRef,
+    changedFiles,
+    base: {
+      findings: baseScan.findings || [],
+      summary: baseSummary,
+      secrets: baseScan.secrets || [],
+      supplyChain: baseScan.supplyChain || [],
+      logicVulns: baseScan.logicVulns || [],
+    },
+    head: {
+      findings: headScan.findings || [],
+      summary: headSummary,
+      secrets: headScan.secrets || [],
+      supplyChain: headScan.supplyChain || [],
+      logicVulns: headScan.logicVulns || [],
+    },
+    introduced,
+    resolved,
+    persistent,
+    shifted,
+    summary: {
+      introduced: _summary(introduced),
+      resolved: _summary(resolved),
+      persistent: _summary(persistent),
+      net,
+    },
+  };
+}
+
+/**
+ * Lightweight text summary used as a CLI fallback when --json isn't set.
+ */
+// R24 (PRD §5) — net-new CI gate. Blocks the build ONLY on findings the PR
+// INTRODUCED (delta.introduced), at or above `failOn` severity — never on the
+// pre-existing backlog. This is the only SAST CI posture teams tolerate
+// long-term. Pure + deterministic: takes a delta, returns the gate decision.
+const _NETNEW_SEV_RANK = { critical: 3, high: 2, medium: 1, low: 0, info: -1 };
+function netNewGate(delta, failOn = 'critical') {
+  const introduced = (delta && Array.isArray(delta.introduced)) ? delta.introduced : [];
+  if (failOn === 'none') return { fail: false, failOn, introducedCount: introduced.length, blocked: [] };
+  const threshold = _NETNEW_SEV_RANK[failOn] ?? 3;
+  const blocked = introduced.filter((f) => (_NETNEW_SEV_RANK[f.severity] ?? -1) >= threshold);
+  return { fail: blocked.length > 0, failOn, introducedCount: introduced.length, blocked };
+}
+
+function renderPrDeltaText(delta) {
+  const i = delta.summary.introduced;
+  const r = delta.summary.resolved;
+  const lines = [];
+  lines.push(`Delta: ${delta.baseRef} → ${delta.headRef}`);
+  lines.push(`Changed files: ${delta.changedFiles.length}`);
+  lines.push('');
+  if (delta.introduced.length === 0 && delta.resolved.length === 0 && delta.shifted.length === 0) {
+    lines.push('No security delta. Safe to merge.');
+    return lines.join('\n');
+  }
+  lines.push(`Introduced: ${delta.introduced.length}  ` +
+    `(crit ${i.critical} · high ${i.high} · med ${i.medium} · low ${i.low})`);
+  lines.push(`Resolved:   ${delta.resolved.length}  ` +
+    `(crit ${r.critical} · high ${r.high} · med ${r.medium} · low ${r.low})`);
+  if (delta.shifted.length) lines.push(`Shifted:    ${delta.shifted.length}`);
+  if (delta.introduced.length) {
+    lines.push('');
+    lines.push('Newly introduced:');
+    for (const f of delta.introduced.slice(0, 20)) {
+      lines.push(`  + ${f.severity.padEnd(8)} ${f.cwe || ''} ${f.vuln} (${f.file}:${f.line})`);
+    }
+    if (delta.introduced.length > 20) lines.push(`  … ${delta.introduced.length - 20} more`);
+  }
+  return lines.join('\n');
+}
+
+__webpack_async_result__();
+} catch(e) { __webpack_async_result__(e); } });
+
+/***/ })
+
+};