@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/9899.index.js

@@ -0,0 +1,138 @@
+export const id = 9899;
+export const ids = [9899];
+export const modules = {
+
+/***/ 99899:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   validateOsvFunctionsExist: () => (/* binding */ validateOsvFunctionsExist)
+/* harmony export */ });
+/* unused harmony export extractPythonPackageFunctions */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31421);
+/* harmony import */ var _ir_parser_py_cst_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(71349);
+// Python package function extraction via the CST parser.
+//
+// Locates an installed Python package in site-packages or .venv,
+// parses its source files via the Python CST parser, and returns
+// a map of exported function names. Used by markUsedVulnFunctions
+// to validate that OSV-named vulnerable functions actually exist
+// in the installed version.
+
+
+
+
+
+
+const VENV_DIRS = ['.venv', 'venv', '.env', 'env'];
+
+function _findSitePackages(scanRoot) {
+  for (const vdir of VENV_DIRS) {
+    const base = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot || '.', vdir);
+    if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(base)) continue;
+    const lib = node_path__WEBPACK_IMPORTED_MODULE_1__.join(base, 'lib');
+    if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(lib)) continue;
+    const pydirs = node_fs__WEBPACK_IMPORTED_MODULE_0__.readdirSync(lib).filter(d => d.startsWith('python'));
+    for (const pydir of pydirs) {
+      const sp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(lib, pydir, 'site-packages');
+      if (node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(sp)) return sp;
+    }
+  }
+  // Fallback: ask python3 directly
+  try {
+    const out = (0,node_child_process__WEBPACK_IMPORTED_MODULE_2__.execFileSync)('python3', ['-c', 'import site; print(site.getsitepackages()[0])'], {
+      encoding: 'utf8', timeout: 5000,
+    }).trim();
+    if (out && node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(out)) return out;
+  } catch { /* no python3 or no site-packages */ }
+  return null;
+}
+
+function _findPackageDir(sitePackages, packageName) {
+  if (!sitePackages) return null;
+  const normalized = packageName.replace(/-/g, '_').toLowerCase();
+  const candidates = [
+    normalized,
+    packageName.toLowerCase(),
+    packageName,
+  ];
+  for (const name of candidates) {
+    const dir = node_path__WEBPACK_IMPORTED_MODULE_1__.join(sitePackages, name);
+    if (node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(dir) && node_fs__WEBPACK_IMPORTED_MODULE_0__.statSync(dir).isDirectory()) return dir;
+  }
+  return null;
+}
+
+function _readPyFilesFromDir(dir, maxFiles = 50) {
+  const entries = [];
+  try {
+    const files = node_fs__WEBPACK_IMPORTED_MODULE_0__.readdirSync(dir, { recursive: true })
+      .filter(f => f.endsWith('.py'))
+      .slice(0, maxFiles);
+    for (const f of files) {
+      const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(dir, f);
+      try {
+        const content = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8');
+        if (content.length < 1_000_000) {
+          entries.push({ file: f, content });
+        }
+      } catch { /* skip unreadable files */ }
+    }
+  } catch { /* dir not readable */ }
+  return entries;
+}
+
+function extractPythonPackageFunctions(packageName, scanRoot) {
+  const cap = (0,_ir_parser_py_cst_js__WEBPACK_IMPORTED_MODULE_3__/* .probePythonAvailable */ .w4)();
+  if (!cap.ok) return null;
+
+  const sitePackages = _findSitePackages(scanRoot);
+  const pkgDir = _findPackageDir(sitePackages, packageName);
+  if (!pkgDir) return null;
+
+  const pyFiles = _readPyFilesFromDir(pkgDir);
+  if (!pyFiles.length) return null;
+
+  const batch = (0,_ir_parser_py_cst_js__WEBPACK_IMPORTED_MODULE_3__/* .parsePythonFilesBatch */ .H2)(pyFiles);
+  if (!batch || !Array.isArray(batch)) return null;
+
+  const functionMap = new Map();
+  for (const fileIR of batch) {
+    if (!fileIR || !fileIR.functions) continue;
+    for (const fn of fileIR.functions) {
+      if (fn.name && !fn.name.startsWith('_')) {
+        functionMap.set(fn.name, {
+          file: fileIR.file,
+          line: fn.line,
+          qid: fn.qid,
+          params: fn.params,
+        });
+      }
+    }
+  }
+  return functionMap;
+}
+
+function validateOsvFunctionsExist(packageName, osvFunctions, scanRoot) {
+  if (!osvFunctions || !osvFunctions.length) return { validated: [], missing: [] };
+  const fnMap = extractPythonPackageFunctions(packageName, scanRoot);
+  if (!fnMap) return { validated: osvFunctions, missing: [] };
+  const validated = [];
+  const missing = [];
+  for (const fn of osvFunctions) {
+    const shortFn = fn.includes('.') ? fn.split('.').pop() : fn;
+    if (fnMap.has(shortFn) || fnMap.has(fn)) {
+      validated.push(shortFn);
+    } else {
+      missing.push(fn);
+    }
+  }
+  return { validated, missing };
+}
+
+
+/***/ })
+
+};

package/dist/9981.index.js

@@ -0,0 +1,206 @@
+export const id = 9981;
+export const ids = [9981];
+export const modules = {
+
+/***/ 89981:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   buildBaselineMap: () => (/* binding */ buildBaselineMap),
+/* harmony export */   computeMTTR: () => (/* binding */ computeMTTR),
+/* harmony export */   fingerprintFinding: () => (/* binding */ fingerprintFinding),
+/* harmony export */   renderSlaSummary: () => (/* binding */ renderSlaSummary),
+/* harmony export */   stampFindingTimestamps: () => (/* binding */ stampFindingTimestamps)
+/* harmony export */ });
+/* unused harmony export findingsExceedingSLA */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(49171);
+// 0.8.0 Feat-11: MTTR / finding-age tracking — per-finding firstSeenAt/lastSeenAt with SLA breach detection.
+//
+// Stamps every finding with `firstSeenAt` (preserved from the baseline if the
+// finding existed previously) and `lastSeenAt` (the current scan time). Surfaces
+// findings exceeding an SLA threshold per severity.
+//
+// Pure function — does not write to disk. The caller (CLI / fix workflow) decides
+// when to persist firstSeenAt back into the baseline.
+
+
+
+
+// FR-PROV-019: "reports never show an age without its basis and confidence."
+// FINDING_ORIGIN is the only basis backed by a resolved git commit for the
+// finding's actual introduction; EARLIEST_OBSERVABLE is also git-derived but
+// partial (weaker claim, no exact introduction commit). UNCOMMITTED and
+// FIRST_OBSERVED are both wall-clock fallbacks — the age is a first-seen
+// timestamp, never resolved against git history — and must say so honestly
+// rather than read like a proven date.
+function _ageBasisLabel(ageBasis, confidence) {
+  const level = confidence?.level && confidence.level !== 'unknown' ? confidence.level.toUpperCase() : null;
+  switch (ageBasis) {
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FINDING_ORIGIN:
+      return `proven origin${level ? `, ${level} confidence` : ''}`;
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.EARLIEST_OBSERVABLE:
+      return `earliest observable commit, partial history${level ? `, ${level} confidence` : ''}`;
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.UNCOMMITTED:
+      return 'uncommitted — first-seen fallback, origin not proven';
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED:
+    default:
+      return 'first-seen fallback — origin not proven';
+  }
+}
+
+// Stable fingerprint for cross-scan finding identity. Mirrors the dedupe key.
+// Exported so a caller can compute the "removed since baseline" (i.e. fixed)
+// set that computeMTTR needs, using the exact same identity function
+// buildBaselineMap uses internally — a caller-side reimplementation would
+// risk drifting from this one and silently under/over-counting fixes.
+function fingerprintFinding(f) { return _fingerprint(f); }
+function _fingerprint(f) {
+  const file = (f.file || '').split(' -> ').pop();
+  const line = f.line || f.source?.line || f.sink?.line || 0;
+  const vuln = (f.vuln || f.type || '').replace(/\W+/g, '_').toLowerCase();
+  const cwe = (f.cwe || '').toUpperCase();
+  return node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(`${file}:${line}:${vuln}:${cwe}`).digest('hex').slice(0, 16);
+}
+
+// Stamp findings in-place with firstSeenAt / lastSeenAt / ageDays.
+// `findings` — current scan findings (will be mutated).
+// `baselineMap` — optional Map of fingerprint → { firstSeenAt }. Pass an empty Map for first run.
+// `now` — Date.now() at scan time (allow injection for tests).
+function stampFindingTimestamps(findings, baselineMap = new Map(), now = Date.now()) {
+  const nowIso = new Date(now).toISOString();
+  for (const f of findings) {
+    const fp = _fingerprint(f);
+    f._fp = fp;
+    const prev = baselineMap.get(fp);
+    f.firstSeenAt = prev?.firstSeenAt || nowIso;
+    f.lastSeenAt = nowIso;
+    const firstMs = Date.parse(f.firstSeenAt);
+    f.ageDays = Math.max(0, Math.floor((now - firstMs) / 86400000));
+    // FR-PROV-019: age/SLA basis. ageDays above stays pure wall-clock —
+    // every existing SLA/computeMTTR consumer keeps its current meaning.
+    // ageBasis + provenAgeDays are ADDITIVE: a report can show both and
+    // explain the discrepancy, never silently swap which number "age" means.
+    const status = f.findingProvenance?.status;
+    const origin = f.findingProvenance?.findingOrigin;
+    if (status === 'complete' && origin?.authorDate) {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FINDING_ORIGIN;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'partial' && origin?.authorDate) {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.EARLIEST_OBSERVABLE;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'uncommitted') {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.UNCOMMITTED;
+      f.provenAgeDays = f.ageDays;
+    } else {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED;
+      f.provenAgeDays = f.ageDays;
+    }
+  }
+  return findings;
+}
+
+// Build a baseline map from an existing baseline JSON (or scan JSON shape).
+// Recognised top-level: { findings, secrets, supplyChain }. Each entry retains
+// firstSeenAt if it had one previously.
+function buildBaselineMap(baselineJson) {
+  const map = new Map();
+  const all = [
+    ...(baselineJson?.findings || []),
+    ...(baselineJson?.secrets || []),
+    ...(baselineJson?.supplyChain || []).filter(s => s.type === 'vulnerable_dep'),
+  ];
+  for (const f of all) {
+    const fp = _fingerprint(f);
+    if (f.firstSeenAt) map.set(fp, { firstSeenAt: f.firstSeenAt });
+  }
+  return map;
+}
+
+// Identify findings exceeding an SLA threshold.
+// slaDays: { critical: 7, high: 30, medium: 60, low: 90, info: 180 } (default).
+function findingsExceedingSLA(findings, slaDays = null) {
+  const SLA = slaDays || { critical: 7, high: 30, medium: 60, low: 90, info: 180 };
+  return findings.filter(f => {
+    const limit = SLA[f.severity] ?? 90;
+    return (f.ageDays || 0) > limit;
+  });
+}
+
+// Median age (days) of the currently-open findings, PLUS the ageBasis/
+// confidence of whichever finding landed on that median — a single-scan proxy
+// for "how long has this debt been sitting". True MTTR (computeMTTR) needs the
+// set of findings that were FIXED; this reports the open backlog's median age
+// so a scan can show whether debt is getting older. Returns null on empty
+// input. Local — surfaced only through renderSlaSummary (its sole consumer).
+//
+// FR-PROV-019: the days figure prefers `provenAgeDays` (git-derived when
+// available) over the pure-wall-clock `ageDays`, and the ageBasis/confidence
+// travel WITH the day count they describe — never a bare number with the
+// basis looked up separately, which is how the original miss happened
+// (ageBasis was stamped onto the finding but never reached the string that
+// printed its age). Findings stamped by an older/test caller that never ran
+// through stampFindingTimestamps (no ageBasis at all) degrade to the same
+// honest "not proven" label FIRST_OBSERVED gets, never a false claim.
+function medianOpenAge(findings) {
+  const entries = (findings || [])
+    .map(f => ({
+      days: f.provenAgeDays != null ? f.provenAgeDays : (f.ageDays || 0),
+      ageBasis: f.ageBasis || _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED,
+      confidence: f.findingProvenance?.confidence || null,
+    }))
+    .sort((a, b) => a.days - b.days);
+  if (!entries.length) return null;
+  return entries[Math.floor(entries.length / 2)];
+}
+
+// One-line SLA-breach summary for surfacing after a scan (#10). Returns null
+// when nothing is past its per-severity SLA. Pairs with medianOpenAge for a
+// "is my security debt aging" readout that the vibecoder can act on.
+//
+// FR-PROV-019: never prints the median age number without its basis and
+// confidence alongside it — see medianOpenAge/_ageBasisLabel above.
+function renderSlaSummary(findings, slaDays = null) {
+  const breached = findingsExceedingSLA(findings || [], slaDays);
+  if (!breached.length) return null;
+  const bySev = {};
+  for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
+  const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
+  const median = medianOpenAge(findings);
+  const ageNote = median != null
+    ? ` (median open age ${median.days}d, ${_ageBasisLabel(median.ageBasis, median.confidence)})`
+    : '';
+  return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
+}
+
+// Compute MTTR statistics from a series of saved scans (each with firstSeen/lastSeen).
+// Useful for trend reporting.
+function computeMTTR(removedFindings) {
+  // removedFindings: findings that existed in baseline but no longer in current
+  // (i.e., were fixed). Each carries firstSeenAt and lastSeenAt from the baseline.
+  if (!removedFindings.length) return { count: 0, meanDays: null, medianDays: null, perSeverity: {} };
+  const ages = removedFindings.map(f => {
+    const first = Date.parse(f.firstSeenAt || 0);
+    const last = Date.parse(f.lastSeenAt || 0);
+    return Math.max(0, (last - first) / 86400000);
+  }).sort((a, b) => a - b);
+  const meanDays = ages.reduce((s, x) => s + x, 0) / ages.length;
+  const medianDays = ages[Math.floor(ages.length / 2)];
+  const perSeverity = {};
+  for (const f of removedFindings) {
+    const sev = f.severity || 'medium';
+    (perSeverity[sev] = perSeverity[sev] || []).push(
+      Math.max(0, (Date.parse(f.lastSeenAt || 0) - Date.parse(f.firstSeenAt || 0)) / 86400000)
+    );
+  }
+  for (const k of Object.keys(perSeverity)) {
+    const a = perSeverity[k];
+    perSeverity[k] = { count: a.length, meanDays: a.reduce((s,x)=>s+x,0)/a.length };
+  }
+  return { count: removedFindings.length, meanDays, medianDays, perSeverity };
+}
+
+
+/***/ })
+
+};

package/dist/999.index.js

@@ -0,0 +1,117 @@
+export const id = 999;
+export const ids = [999];
+export const modules = {
+
+/***/ 60999:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   validateScenario: () => (/* binding */ validateScenario)
+/* harmony export */ });
+/* unused harmony exports SCENARIO_VERSION, SCENARIO_OPERATION_KINDS, SCENARIO_OPERATION_REQUIRED_FIELDS */
+// scenario.js — M5 deliverable #3a (FR-502 §10.10, DFG-0xx): the
+// Scenario extension contract — a hypothetical set of graph overrides,
+// NOT a DataFlowGraph v1 entity, mirrors recipient-profile.js's own
+// contract shape exactly (structural-only {valid, errors} validator,
+// zero graph access, per-field evidence typing for the fields a
+// Scenario actually overrides).
+//
+// See docs/superpowers/plans/2026-09-02-data-flow-explorer-m5-whatif-simulator-scoping.md
+// for the full design reasoning, including why EVIDENCE_GRADES gained
+// 'assumed' instead of reusing 'declared', and why this module's own
+// operations catalog excludes synthetic node/edge insertion (deferred).
+
+const SCENARIO_VERSION = '1.0.0';
+
+// The 6 in-scope hypothetical-change kinds (FR-502's own 7, minus the
+// deferred synthetic-insertion category). Each operation names its
+// target canonical id(s) plus the override value(s); scenario-engine.js
+// is the only consumer that interprets `kind`.
+const SCENARIO_OPERATION_KINDS = Object.freeze([
+  'require_transit_protection',
+  'apply_handling',
+  'remove_entity',
+  'replace_recipient_fact',
+  'change_storage_fact',
+  'change_governance_fact',
+]);
+
+// Per-operation-kind required fields, beyond the universal `kind`. Kept
+// as data (not inline in validateScenario) for the same reason
+// SCENARIO_OPERATION_KINDS above is — a single source of truth a table
+// can be checked against — though scenario-engine.js does not currently
+// import this table itself; it only mentions it in a prose comment on
+// its own _applyReplaceRecipientFact.
+const SCENARIO_OPERATION_REQUIRED_FIELDS = Object.freeze({
+  require_transit_protection: ['targetEdgeId'],
+  apply_handling: ['targetEdgeId', 'handling'],
+  remove_entity: ['targetNodeId'],
+  replace_recipient_fact: ['targetNodeId', 'field', 'value'],
+  change_storage_fact: ['targetNodeId', 'field', 'value'],
+  change_governance_fact: ['targetFlowId', 'field', 'value'],
+});
+
+function _isNonEmptyString(v) { return typeof v === 'string' && v.length > 0; }
+function _isPlainObject(v) { return v !== null && typeof v === 'object' && !Array.isArray(v); }
+function _isStringArray(v) { return Array.isArray(v) && v.every((x) => typeof x === 'string'); }
+
+/**
+ * Structural validation only — mirrors validateRecipientProfile's own
+ * {valid, errors} shape and "never throws" contract. Does not check
+ * that targetEdgeId/targetNodeId/targetFlowId actually exist in any
+ * real graph — that is scenario-engine.js's job at apply time, since
+ * this module has zero graph access by design.
+ */
+function validateScenario(record) {
+  const errors = [];
+  const err = (p, message) => errors.push({ path: p, message });
+  if (!record || typeof record !== 'object' || Array.isArray(record)) {
+    err('$', 'Scenario record must be an object');
+    return { valid: false, errors };
+  }
+  if (!_isNonEmptyString(record.id) || !record.id.startsWith('scenario:')) {
+    err('$.id', 'id is required and must start with "scenario:"');
+  }
+  if (!_isNonEmptyString(record.version)) err('$.version', 'version is required');
+  if (!_isNonEmptyString(record.baseGraphId)) err('$.baseGraphId', 'baseGraphId is required');
+  if (!_isNonEmptyString(record.baseGraphDigest)) err('$.baseGraphDigest', 'baseGraphDigest is required');
+  if (!_isNonEmptyString(record.author)) err('$.author', 'author is required');
+  if (!_isNonEmptyString(record.createdAt)) err('$.createdAt', 'createdAt is required');
+  if (record.expiration !== null && record.expiration !== undefined && !_isNonEmptyString(record.expiration)) {
+    err('$.expiration', 'expiration must be a string or null');
+  }
+  if (!_isStringArray(record.assumptions ?? [])) err('$.assumptions', 'assumptions must be an array of strings');
+  if (!_isStringArray(record.verificationRequirements ?? [])) {
+    err('$.verificationRequirements', 'verificationRequirements must be an array of strings');
+  }
+  if (!Array.isArray(record.operations) || record.operations.length === 0) {
+    err('$.operations', 'operations is required and must be a non-empty array');
+  } else {
+    record.operations.forEach((op, i) => {
+      const p = `$.operations[${i}]`;
+      if (!_isPlainObject(op)) { err(p, 'each operation must be an object'); return; }
+      if (!SCENARIO_OPERATION_KINDS.includes(op.kind)) {
+        err(`${p}.kind`, `unrecognized operation kind "${op.kind}" — must be one of ${SCENARIO_OPERATION_KINDS.join('|')}`);
+        return;
+      }
+      for (const field of SCENARIO_OPERATION_REQUIRED_FIELDS[op.kind]) {
+        if (op[field] === undefined || op[field] === null || op[field] === '') {
+          err(`${p}.${field}`, `operation of kind "${op.kind}" requires "${field}"`);
+        }
+      }
+    });
+  }
+  // simulatedDelta is populated by scenario-engine.js after apply, never
+  // by a caller constructing the pre-apply record — null is the only
+  // valid pre-apply value, an object (scenario-diff.js's own shape) the
+  // only valid post-apply value.
+  if (record.simulatedDelta !== null && record.simulatedDelta !== undefined && !_isPlainObject(record.simulatedDelta)) {
+    err('$.simulatedDelta', 'simulatedDelta must be null (before apply) or an object (after apply)');
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+
+/***/ })
+
+};