@clear-capabilities/agentic-security-scanner 0.172.1 → 0.173.0

package/dist/9292.index.js

@@ -0,0 +1,369 @@
+export const id = 9292;
+export const ids = [9292,119];
+export const modules = {
+
+/***/ 69292:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   ImageArchiveError: () => (/* binding */ ImageArchiveError),
+/* harmony export */   t: () => (/* binding */ parseImageArchive)
+/* harmony export */ });
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var _safe_tar_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(30119);
+// Parses a Docker-save ("docker-archive") or OCI-layout ("oci-archive") tar
+// into one normalized shape, without executing or daemon-mounting the image
+// (PRD 5 Safety Requirements: "OCI inspection should not require executing
+// the image"). Built entirely on `safe-tar.js` — every byte read here passes
+// through the same entry-count/size/path/decompression guards.
+
+
+
+class ImageArchiveError extends Error {
+  constructor(message, code) {
+    super(message);
+    this.name = 'ImageArchiveError';
+    this.code = code;
+  }
+}
+
+function safeJsonParse(buf, what) {
+  try {
+    return JSON.parse(buf.toString('utf8'));
+  } catch (err) {
+    throw new ImageArchiveError(`${what} is not valid JSON: ${err.message}`, 'malformed_manifest');
+  }
+}
+
+function readOuterEntries(buf, limits) {
+  const outer = (0,_safe_tar_js__WEBPACK_IMPORTED_MODULE_1__/* .decompressIfGzip */ .zr)(buf, limits);
+  const byName = new Map();
+  const unsafeEntries = [];
+  for (const e of (0,_safe_tar_js__WEBPACK_IMPORTED_MODULE_1__/* .readTarEntries */ .ET)(outer, limits)) {
+    if (e.unsafe) {
+      unsafeEntries.push({ name: e.name });
+      continue;
+    }
+    byName.set(e.name, e);
+  }
+  return { byName, unsafeEntries };
+}
+
+function extractConfigShape(configObj) {
+  const cfg = (configObj && configObj.config) || {};
+  return {
+    architecture: configObj.architecture || null,
+    os: configObj.os || null,
+    labels: (cfg.Labels && typeof cfg.Labels === 'object') ? { ...cfg.Labels } : {},
+    entrypoint: Array.isArray(cfg.Entrypoint) ? [...cfg.Entrypoint] : null,
+    cmd: Array.isArray(cfg.Cmd) ? [...cfg.Cmd] : null,
+    history: Array.isArray(configObj.history)
+      ? configObj.history.map((h) => ({ createdBy: h.created_by || null, created: h.created || null, emptyLayer: !!h.empty_layer }))
+      : [],
+    rootfsDiffIds: (configObj.rootfs && Array.isArray(configObj.rootfs.diff_ids)) ? [...configObj.rootfs.diff_ids] : [],
+  };
+}
+
+function parseDockerArchive(byName, outerUnsafe, limits) {
+  const manifestEntry = byName.get('manifest.json');
+  const manifestArr = safeJsonParse(manifestEntry.data, 'manifest.json');
+  if (!Array.isArray(manifestArr) || manifestArr.length === 0) {
+    throw new ImageArchiveError('manifest.json contains no images', 'empty_manifest');
+  }
+  if (manifestArr.length > 1) {
+    throw new ImageArchiveError(`manifest.json describes ${manifestArr.length} images; image scan expects exactly one`, 'multi_image_archive');
+  }
+  const m = manifestArr[0];
+  if (typeof m.Config !== 'string' || !Array.isArray(m.Layers)) {
+    throw new ImageArchiveError('manifest.json entry is missing Config or Layers', 'malformed_manifest');
+  }
+  const configEntry = byName.get(m.Config);
+  if (!configEntry) throw new ImageArchiveError(`manifest.json references missing config "${m.Config}"`, 'missing_blob');
+  const configObj = safeJsonParse(configEntry.data, m.Config);
+  const configDigest = `sha256:${node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(configEntry.data).digest('hex')}`;
+
+  const layers = [];
+  for (let i = 0; i < m.Layers.length; i++) {
+    const layerPath = m.Layers[i];
+    const entry = byName.get(layerPath);
+    if (!entry) throw new ImageArchiveError(`manifest.json references missing layer "${layerPath}"`, 'missing_blob');
+    const tar = (0,_safe_tar_js__WEBPACK_IMPORTED_MODULE_1__/* .decompressIfGzip */ .zr)(entry.data, limits);
+    layers.push({ index: i, path: layerPath, diffId: configObj?.rootfs?.diff_ids?.[i] || null, tar, sizeBytes: entry.size });
+  }
+
+  return {
+    format: 'docker-archive',
+    digest: configDigest,
+    digestKind: 'config',
+    repoTags: Array.isArray(m.RepoTags) ? m.RepoTags : [],
+    config: extractConfigShape(configObj),
+    layers,
+    unsafeEntries: outerUnsafe,
+  };
+}
+
+function parseOciArchive(byName, outerUnsafe, limits) {
+  const indexObj = safeJsonParse(byName.get('index.json').data, 'index.json');
+  const manifests = Array.isArray(indexObj.manifests) ? indexObj.manifests : [];
+  if (manifests.length === 0) throw new ImageArchiveError('index.json lists no manifests', 'empty_manifest');
+  if (manifests.length > 1) {
+    throw new ImageArchiveError(`index.json describes ${manifests.length} manifests; image scan expects exactly one`, 'multi_image_archive');
+  }
+  const manifestDigest = manifests[0].digest;
+  if (typeof manifestDigest !== 'string' || !manifestDigest.startsWith('sha256:')) {
+    throw new ImageArchiveError('index.json manifest entry has no sha256 digest', 'malformed_manifest');
+  }
+  const manifestBlobPath = `blobs/sha256/${manifestDigest.slice('sha256:'.length)}`;
+  const manifestEntry = byName.get(manifestBlobPath);
+  if (!manifestEntry) throw new ImageArchiveError(`index.json references missing manifest blob "${manifestBlobPath}"`, 'missing_blob');
+  const manifestObj = safeJsonParse(manifestEntry.data, manifestBlobPath);
+
+  const configDigest = manifestObj.config && manifestObj.config.digest;
+  if (typeof configDigest !== 'string' || !configDigest.startsWith('sha256:')) {
+    throw new ImageArchiveError('image manifest has no config digest', 'malformed_manifest');
+  }
+  const configBlobPath = `blobs/sha256/${configDigest.slice('sha256:'.length)}`;
+  const configEntry = byName.get(configBlobPath);
+  if (!configEntry) throw new ImageArchiveError(`manifest references missing config blob "${configBlobPath}"`, 'missing_blob');
+  const configObj = safeJsonParse(configEntry.data, configBlobPath);
+
+  const layerDescs = Array.isArray(manifestObj.layers) ? manifestObj.layers : [];
+  const layers = [];
+  for (let i = 0; i < layerDescs.length; i++) {
+    const d = layerDescs[i];
+    if (typeof d.digest !== 'string' || !d.digest.startsWith('sha256:')) {
+      throw new ImageArchiveError(`layer ${i} has no sha256 digest`, 'malformed_manifest');
+    }
+    const blobPath = `blobs/sha256/${d.digest.slice('sha256:'.length)}`;
+    const entry = byName.get(blobPath);
+    if (!entry) throw new ImageArchiveError(`manifest references missing layer blob "${blobPath}"`, 'missing_blob');
+    const tar = (0,_safe_tar_js__WEBPACK_IMPORTED_MODULE_1__/* .decompressIfGzip */ .zr)(entry.data, limits);
+    layers.push({ index: i, path: blobPath, diffId: d.digest, mediaType: d.mediaType || null, tar, sizeBytes: entry.size });
+  }
+
+  return {
+    format: 'oci-archive',
+    digest: manifestDigest,
+    digestKind: 'manifest',
+    repoTags: [],
+    config: extractConfigShape(configObj),
+    layers,
+    unsafeEntries: outerUnsafe,
+  };
+}
+
+/**
+ * Parses an in-memory tar buffer (already read from disk/stdin by the
+ * caller — this module never touches the filesystem or network) as either a
+ * `docker save`-shaped archive or an OCI-layout archive. Throws
+ * ImageArchiveError for anything it cannot recognize or whose manifest
+ * references a blob that isn't present — never guesses or substitutes a
+ * default.
+ */
+function parseImageArchive(buf, limits = _safe_tar_js__WEBPACK_IMPORTED_MODULE_1__/* .DEFAULT_LIMITS */ .dR) {
+  if (!Buffer.isBuffer(buf)) throw new ImageArchiveError('image archive input must be a Buffer', 'bad_input');
+  const { byName, unsafeEntries } = readOuterEntries(buf, limits);
+  if (byName.has('manifest.json')) return parseDockerArchive(byName, unsafeEntries, limits);
+  if (byName.has('index.json') && byName.has('oci-layout')) return parseOciArchive(byName, unsafeEntries, limits);
+  throw new ImageArchiveError(
+    'archive is neither a docker-archive (manifest.json) nor an oci-archive (oci-layout + index.json)',
+    'unrecognized_format',
+  );
+}
+
+
+/***/ }),
+
+/***/ 30119:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   ET: () => (/* binding */ readTarEntries),
+/* harmony export */   Jn: () => (/* binding */ whiteoutTarget),
+/* harmony export */   TarSafetyError: () => (/* binding */ TarSafetyError),
+/* harmony export */   dR: () => (/* binding */ DEFAULT_LIMITS),
+/* harmony export */   l0: () => (/* binding */ isWhiteoutName),
+/* harmony export */   zr: () => (/* binding */ decompressIfGzip)
+/* harmony export */ });
+/* unused harmony export isSafeEntryName */
+/* harmony import */ var node_zlib__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(38522);
+// Hand-rolled, hardened POSIX/GNU tar reader for OCI/Docker image archives.
+//
+// Why hand-rolled instead of a dependency: this repo has no tar library (see
+// `src/artifact/CLAUDE.md`), and PRD 5's own Safety Requirements ask for exact
+// control over the failure modes a generic tar library treats as implementation
+// detail: malicious entry paths, decompression bombs, giant layers, oversized
+// archives. Rolling it ourselves means every one of those limits is a named,
+// tested constant in this file rather than a library default we'd have to audit.
+//
+// Scope: ustar + GNU longname ('L' typeflag) + base-256 size fields. PAX extended
+// headers ('x'/'g') and GNU longlink ('K') are structurally skipped (their data
+// block is consumed so offsets stay correct, but their content is not applied) —
+// a disclosed limitation, not a silent one. Real docker-save/oci-archive output
+// from Go's archive/tar for images in this size/complexity class essentially
+// never needs them; synthetic fixtures in this codebase never emit them either.
+
+
+const BLOCK = 512;
+
+const DEFAULT_LIMITS = Object.freeze({
+  maxEntries: 200_000,
+  maxEntrySize: 512 * 1024 * 1024, // 512MB per tar entry
+  maxTotalSize: 4 * 1024 * 1024 * 1024, // 4GB per archive (sum of entry sizes)
+  maxGunzipOutput: 4 * 1024 * 1024 * 1024, // decompression-bomb guard
+});
+
+class TarSafetyError extends Error {
+  constructor(message, code) {
+    super(message);
+    this.name = 'TarSafetyError';
+    this.code = code;
+  }
+}
+
+function parseSizeField(buf) {
+  if (buf[0] & 0x80) {
+    // GNU base-256 extension for sizes that don't fit in octal-ASCII.
+    let n = 0n;
+    for (let i = 1; i < buf.length; i++) n = (n << 8n) | BigInt(buf[i]);
+    return Number(n);
+  }
+  const s = buf.toString('ascii').replace(/\0.*$/, '').trim();
+  if (!s) return 0;
+  const n = parseInt(s, 8);
+  return Number.isFinite(n) ? n : 0;
+}
+
+function cstr(buf) {
+  return buf.toString('utf8').replace(/\0.*$/, '');
+}
+
+// A tar entry name is unsafe when it would escape a virtual extraction root:
+// absolute paths, `..` segments, embedded NULs, or an unreasonable length.
+// Because this module never writes to a real filesystem path (every caller
+// keeps extracted content in an in-memory Map keyed by this string), the
+// classic zip-slip *write* vulnerability cannot occur here — but a hostile
+// name must still never be silently treated as an ordinary path by downstream
+// manifest/package-DB matching, so unsafe entries are flagged, never dropped
+// silently and never accepted as-is.
+function isSafeEntryName(name) {
+  if (typeof name !== 'string' || name.length === 0 || name.length > 4096) return false;
+  if (name.includes('\0')) return false;
+  const norm = name.replace(/\\/g, '/');
+  if (norm.startsWith('/')) return false;
+  if (norm.split('/').some((p) => p === '..')) return false;
+  return true;
+}
+
+function isWhiteoutName(name) {
+  return (name.split('/').pop() || '').startsWith('.wh.');
+}
+
+// Resolves a whiteout entry name to what it deletes. `.wh..wh..opq` marks a
+// directory as "opaque" (everything from earlier layers under it is hidden,
+// not individually deleted) — reported distinctly so callers don't conflate
+// it with a single-file deletion.
+function whiteoutTarget(name) {
+  const parts = name.split('/');
+  const base = parts.pop();
+  if (base === '.wh..wh..opq') return { opaque: true, dir: parts.join('/') };
+  return { opaque: false, path: [...parts, base.slice(4)].join('/') };
+}
+
+// Decompresses a gzip member with a hard output-size cap (Node's native
+// ERR_BUFFER_TOO_LARGE on overflow — no custom streaming counter needed).
+// Returns the input unchanged when it isn't gzip-magic (plain tar).
+function decompressIfGzip(buf, limits = DEFAULT_LIMITS) {
+  if (buf.length >= 2 && buf[0] === 0x1f && buf[1] === 0x8b) {
+    try {
+      return node_zlib__WEBPACK_IMPORTED_MODULE_0__.gunzipSync(buf, { maxOutputLength: limits.maxGunzipOutput });
+    } catch (err) {
+      if (err && err.code === 'ERR_BUFFER_TOO_LARGE') {
+        throw new TarSafetyError('decompressed layer exceeds the decompression-bomb guard', 'gunzip_too_large');
+      }
+      throw new TarSafetyError(`gzip stream is malformed: ${err.message}`, 'gunzip_malformed');
+    }
+  }
+  return buf;
+}
+
+/**
+ * Reads a decompressed tar buffer and yields one record per entry:
+ *   { name, size, typeflag, linkname, data, unsafe }
+ * `data` is a Buffer view into `buf` (never copied) for safe entries, `null`
+ * for unsafe ones. Throws TarSafetyError (never returns a partial result) the
+ * moment any configured limit is exceeded.
+ */
+function* readTarEntries(buf, limits = DEFAULT_LIMITS) {
+  if (!Buffer.isBuffer(buf)) throw new TarSafetyError('tar input must be a Buffer', 'bad_input');
+  let offset = 0;
+  let count = 0;
+  let totalSize = 0;
+  let pendingLongName = null;
+
+  while (offset + BLOCK <= buf.length) {
+    const header = buf.subarray(offset, offset + BLOCK);
+    if (header.every((b) => b === 0)) {
+      offset += BLOCK;
+      continue; // end-of-archive zero-fill padding
+    }
+
+    count += 1;
+    if (count > limits.maxEntries) {
+      throw new TarSafetyError(`tar archive has more than ${limits.maxEntries} entries`, 'too_many_entries');
+    }
+
+    let name = cstr(header.subarray(0, 100));
+    const typeflag = String.fromCharCode(header[156] || 0);
+    const linkname = cstr(header.subarray(157, 257));
+    const magic = header.subarray(257, 263).toString('ascii');
+    const prefix = magic.startsWith('ustar') ? cstr(header.subarray(345, 500)) : '';
+    if (prefix) name = `${prefix}/${name}`;
+    const size = parseSizeField(header.subarray(124, 136));
+
+    offset += BLOCK;
+
+    if (size < 0 || !Number.isFinite(size)) {
+      throw new TarSafetyError(`tar entry "${name}" has an invalid size field`, 'bad_size');
+    }
+    if (size > limits.maxEntrySize) {
+      throw new TarSafetyError(`tar entry "${name}" (${size} bytes) exceeds the per-entry size limit`, 'entry_too_large');
+    }
+    totalSize += size;
+    if (totalSize > limits.maxTotalSize) {
+      throw new TarSafetyError('tar archive exceeds the total-size limit', 'archive_too_large');
+    }
+
+    const dataBlocks = Math.ceil(size / BLOCK);
+    if (offset + size > buf.length) {
+      throw new TarSafetyError(`tar entry "${name}" claims more data than the archive contains`, 'truncated');
+    }
+    const data = size > 0 ? buf.subarray(offset, offset + size) : Buffer.alloc(0);
+    offset += dataBlocks * BLOCK;
+
+    const resolvedName = pendingLongName ? pendingLongName : name;
+    pendingLongName = null;
+
+    if (typeflag === 'L') {
+      // GNU longname: this entry's data IS the next entry's real name.
+      pendingLongName = cstr(data);
+      continue;
+    }
+    if (typeflag === 'K' || typeflag === 'x' || typeflag === 'g') {
+      // GNU longlink / PAX extended header — structurally skipped (see header comment).
+      continue;
+    }
+
+    if (!isSafeEntryName(resolvedName)) {
+      yield { name: resolvedName, size, typeflag, linkname, data: null, unsafe: true };
+      continue;
+    }
+
+    yield { name: resolvedName.replace(/\\/g, '/'), size, typeflag, linkname, data, unsafe: false };
+  }
+}
+
+
+/***/ })
+
+};

package/dist/9382.index.js

@@ -421,7 +421,8 @@ async function adjudicate(candidates, opts = {}) {
         origin: 'context-intelligence', questionPack: c.questionPack, witnesses: c.witnesses, witnessCount: c.witnesses.length,
         sourceSpanEvidence: c.sourceSpanEvidence, scopeIntegrity: c.scopeIntegrity, reviewStatus: c.reviewStatus,
         uncertainties: c.uncertainties, recommendedValidation: c.recommendedValidation,
-        note: 'A model hypothesis checked for citations, not a proof. Severity comes from the confirmation tier only.',
+        ...(c.deterministic ? { deterministic: c.deterministic } : {}),
+        note: c.deterministic ? 'Derived from the code analysis and a deterministic counterexample attempt; no model produced this. Severity comes from the confirmation tier only.' : 'A model hypothesis checked for citations, not a proof. Severity comes from the confirmation tier only.',
       },
     };
   };
@@ -774,7 +775,8 @@ const BUILD = [
   { language: 'javascript/typescript', kind: 'http', frameworks: 'Express-style call registration (get/post/put/patch/delete/all, router.use, app.use)', status: 'verified', evidence: [T('build-js.test.js')], limits: 'Router mounts in another file and middleware factories are not followed (reported as router-mount-not-resolved); destructured and named imports are followed, re-exports and tsconfig path aliases are not.' },
   { language: 'python', kind: 'http', frameworks: 'decorator registration (Flask/FastAPI-style @app.route / @router.get), FastAPI Depends()/Security() guards', status: 'experimental', evidence: [T('build-python-haskell.test.js'), T('frameworks.test.js')], limits: 'Decorator guards are read from the decorator lines and Depends() guards from the signature (only dependencies named like an auth or user provider bind the principal); framework-level before_request hooks and Django URL conf are not modelled.' },
   { language: 'haskell', kind: 'http', frameworks: 'Scotty, WAI, Servant, Yesod (through the existing web model)', status: 'verified', evidence: [T('build-python-haskell.test.js'), T('frameworks.test.js')], limits: 'Static source analysis; the existing web model decides what a route is. Dynamic routes are reported unresolved.' },
-  { language: 'java/kotlin/c#/go/php/ruby/rust', kind: 'http', frameworks: 'whatever the engine route scan recognises', status: 'unsupported', evidence: [], limits: 'No fixture proves this, so it is listed as unsupported even though some routes may resolve: Handlers are resolved only for decorator/annotation-style registration; no dedicated fixtures here.' },
+  { language: 'php', kind: 'http', frameworks: 'Laravel Route:: registration (the entry point only)', status: 'experimental', evidence: ['test/engineering-excellence/e4-01-dci-audit.test.js'], limits: 'Measured by the E4-01 audit on one fixture: the routes resolve, but no control or sensitive operation was extracted from the handlers.' },
+  { language: 'java/kotlin/c#/go/ruby/rust', kind: 'http', frameworks: 'whatever the engine route scan recognises', status: 'unsupported', evidence: [], limits: 'Measured by the E4-01 audit (docs/engineering-excellence/DCI_MATURITY.md) on one fixture per language (Spring, net/http, ASP.NET, Rails): no entry point was found, so no bundle is built.' },
   { language: 'any with a recognised surface', kind: 'webhook/queue/cron/upload/cli', frameworks: 'existing entry-point inventory', status: 'experimental', evidence: [T('build-js.test.js')], limits: 'Handler is the enclosing declaration of the surface; no framework wiring beyond that.' },
   { language: 'haskell', kind: 'compiler metadata import', frameworks: 'hie-export/1 JSON export of GHC declarations and references', status: 'experimental', evidence: [T('hie-adapter.test.js')], limits: 'Reads an export; never runs GHC or hiedb. The export is validated against the source snapshot. No export produced by a real GHC run is checked in.' },
   { language: 'any', kind: 'compiler metadata build', frameworks: 'automatic metadata generation', status: 'blocked', evidence: [], limits: 'Running a compiler on untrusted source needs a sandbox proof this build does not have (Template Haskell, custom Setup and plugins run code).' },
@@ -1146,6 +1148,8 @@ async function cmdReview(root, args, format) {
         maxCalls: num(flag(args, 'max-calls')) || config.review.maxCalls,
         maxWallSeconds: num(flag(args, 'max-wall-seconds')) || config.review.maxWallSeconds,
         maxTokensPerJob: config.review.maxTokensPerJob,
+        maxTokensPerRepo: config.review.maxTokensPerRepo,
+        anonymizePrompts: config.review.anonymizePrompts,
         maxRetries: config.review.maxRetries,
         jobTimeoutMs: (num(flag(args, 'job-timeout-seconds')) || 120) * 1000,
         maxCostUsd: num(flag(args, 'max-cost-usd')) ?? config.review.maxCostUsd,
@@ -1258,7 +1262,7 @@ const DEFAULT_CONFIG = Object.freeze({
   maxFiles: 3000,
   semanticMetadata: { mode: 'off', haskellHieDir: null },
   context: { profile: 'standard', maxTokens: null, pruneLowValue: true, maxSymbols: 60, maxDepth: 12 },
-  review: { enabled: false, allowRemote: false, questionPacks: ['authz-idor'], concurrency: 2, maxCalls: 100, maxWallSeconds: 900, maxCostUsd: null, maxTokensPerJob: 40000, maxRetries: 3 },
+  review: { enabled: false, allowRemote: false, questionPacks: ['authz-idor'], concurrency: 2, maxCalls: 100, maxWallSeconds: 900, maxCostUsd: null, maxTokensPerJob: 40000, maxRetries: 3, maxTokensPerRepo: null, anonymizePrompts: false },
   replay: { contentAddressed: true, retention: 'inherit' },
 });
 
@@ -1307,6 +1311,8 @@ function normalizeConfig(raw) {
       maxCostUsd: Number.isFinite(rv.maxCostUsd) && rv.maxCostUsd >= 0 ? rv.maxCostUsd : null,
       maxTokensPerJob: clamp(rv.maxTokensPerJob, 1000, 400000, d.review.maxTokensPerJob),
       maxRetries: clamp(rv.maxRetries, 0, 3, d.review.maxRetries),
+      maxTokensPerRepo: Number.isFinite(rv.maxTokensPerRepo) && rv.maxTokensPerRepo >= 1000 ? Math.trunc(rv.maxTokensPerRepo) : null,
+      anonymizePrompts: rv.anonymizePrompts === true,
     },
     replay: { contentAddressed: rp.contentAddressed !== false, retention: typeof rp.retention === 'string' ? rp.retention : 'inherit' },
   };
@@ -1333,6 +1339,7 @@ function loadConfig(root) {
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   $E: () => (/* binding */ blankComments),
 /* harmony export */   TM: () => (/* binding */ looksLikeTelemetry),
 /* harmony export */   gs: () => (/* binding */ signatureText),
 /* harmony export */   kl: () => (/* binding */ analyzeSymbolText),
@@ -1480,6 +1487,51 @@ function clip(s) { return s.trim().slice(0, 160); }
  *   lines   the FILE's lines (0-based array)
  * Returns [{ symbolId, line, category:'control'|'sensitive', kind, subkind, evidence, basis, rejectionSeen, text }]
  */
+/**
+ * Blank the comments (and Python docstrings) of a source file, keeping every character position and newline, so line numbers do not move.
+ * The analysis looks for calls and comparisons in code; a comment that SAYS `ownerId: req.user.id` or `requireUser(req)` is prose, and prose is the
+ * easiest thing for a hostile or merely careless author to write. Strings are left alone (the principal and SQL rules already read around them).
+ */
+function blankComments(text, file = '') {
+  const src = String(text || '');
+  const hash = /\.(?:py|rb|sh|php|pl|r)$/i.test(file);
+  const dashes = /\.l?hs$/i.test(file);
+  const cLike = !dashes && !/\.(?:py|rb|sh|pl|r)$/i.test(file);
+  const out = src.split('');
+  const n = src.length;
+  let i = 0;
+  const blank = (a, b) => { for (let k = a; k < b && k < n; k++) if (out[k] !== '\n') out[k] = ' '; };
+  while (i < n) {
+    const c = src[i]; const d = src[i + 1];
+    if (c === '"' || c === "'" || c === '`') {
+      if (/\.py$/i.test(file) && src.startsWith(c.repeat(3), i)) {
+        const end = src.indexOf(c.repeat(3), i + 3); const stop = end < 0 ? n : end + 3;
+        blank(i, stop); i = stop; continue;           // a docstring or triple-quoted block is prose
+      }
+      let j = i + 1;
+      while (j < n && src[j] !== c && !(src[j] === '\n' && c !== '`')) { if (src[j] === '\\') j++; j++; }
+      i = j + 1; continue;
+    }
+    if (cLike && c === '/' && d === '*') { const end = src.indexOf('*/', i + 2); const stop = end < 0 ? n : end + 2; blank(i, stop); i = stop; continue; }
+    if (cLike && c === '/' && d === '/' && (i === 0 || /[\s;,)}{\]]/.test(src[i - 1]))) { let j = src.indexOf('\n', i); if (j < 0) j = n; blank(i, j); i = j; continue; }
+    if (hash && c === '#' && !(file.endsWith('.php') && d === '[')) { let j = src.indexOf('\n', i); if (j < 0) j = n; blank(i, j); i = j; continue; }
+    if (dashes && c === '-' && d === '-' && !/[!#$%&*+./<=>?@\\^|~:]/.test(src[i + 2] || ' ')) { let j = src.indexOf('\n', i); if (j < 0) j = n; blank(i, j); i = j; continue; }
+    if (dashes && c === '{' && d === '-') { const end = src.indexOf('-}', i + 2); const stop = end < 0 ? n : end + 2; blank(i, stop); i = stop; continue; }
+    i++;
+  }
+  return out.join('');
+}
+
+function bodyAfterSignature(raw) {
+  const arrow = raw.indexOf('=>');
+  let rest = null;
+  if (arrow >= 0) rest = raw.slice(arrow + 2);
+  else { const m = /\)\s*\{(.*)$/.exec(raw); if (m) rest = m[1]; }
+  if (rest === null) return '';
+  const brace = /^\s*\{(.*)$/.exec(rest);
+  return brace ? brace[1] : rest;
+}
+
 function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
   const out = [];
   const seen = new Set();
@@ -1512,7 +1564,10 @@ function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
     const calls = [];
     const re = /([A-Za-z_$][\w$]*(?:(?:\.|::)[A-Za-z_$][\w$]*)*)\s*\(/g;
     let m;
-    if (!isDeclLine) { while ((m = re.exec(raw))) calls.push(m[1]); }
+    // A one-line handler (`app.get('/x', guard, async (req, res) => { res.json(await db.docs.findOne({ id })); })`) is its own declaration
+    // line, so skipping the whole line also skipped its body. Only the SIGNATURE is skipped: the calls after the arrow or the opening brace count.
+    const scanText = isDeclLine ? bodyAfterSignature(raw) : raw;
+    while ((m = re.exec(scanText))) calls.push(m[1]);
     if (haskell && !isDeclLine) {
       const hre = /\b([A-Z][\w.]*\.[a-z][\w']*|[a-z][\w']*)\b/g;
       while ((m = hre.exec(raw))) if (AUTH_NAME.test(m[1]) || HS_SENSITIVE.test(m[1])) calls.push(m[1]);
@@ -3021,6 +3076,8 @@ async function runQueue(jobs, ctx) {
     maxCalls: Math.min(HARD_LIMITS.maxCalls, Math.max(1, ctx.limits.maxCalls || 100)),
     maxWallMs: Math.min(HARD_LIMITS.maxWallSeconds, Math.max(1, ctx.limits.maxWallSeconds || 900)) * 1000,
     maxTokensPerJob: ctx.limits.maxTokensPerJob || 40000,
+    maxTokensPerRepo: Number.isFinite(ctx.limits.maxTokensPerRepo) ? ctx.limits.maxTokensPerRepo : null,
+    anonymizePrompts: ctx.limits.anonymizePrompts === true,
     maxRetries: Math.min(HARD_LIMITS.maxRetries, Math.max(0, ctx.limits.maxRetries ?? 3)),
     jobTimeoutMs: ctx.limits.jobTimeoutMs || 120000,
     maxCostUsd: Number.isFinite(ctx.limits.maxCostUsd) ? ctx.limits.maxCostUsd : null,
@@ -3034,6 +3091,7 @@ async function runQueue(jobs, ctx) {
   const results = new Map();
   let calls = 0;
   let estCost = 0;
+  let tokensUsed = 0;
   let cooldownUntil = 0;
   let budgetStop = null;
   let persistChain = Promise.resolve();
@@ -3083,6 +3141,7 @@ async function runQueue(jobs, ctx) {
     if (ctx.signal && ctx.signal.aborted) return 'cancelled';
     if (now() - started >= L.maxWallMs) return 'budget-exhausted:wall-time';
     if (calls >= L.maxCalls) return 'budget-exhausted:max-calls';
+    if (L.maxTokensPerRepo !== null && tokensUsed >= L.maxTokensPerRepo) return 'budget-exhausted:max-tokens-per-repo';
     if (L.maxCostUsd !== null && L.costPerCallUsd !== null && estCost + L.costPerCallUsd > L.maxCostUsd) return 'budget-exhausted:max-cost';
     return null;
   };
@@ -3106,8 +3165,9 @@ async function runQueue(jobs, ctx) {
       state.jobs[job.key] = { state: 'running', reason: null, attempts, label: job.label };
       const out = await (0,_review_js__WEBPACK_IMPORTED_MODULE_2__/* .runReviewOnce */ .z6)({
         pack: loadedJob.pack, entrypoints: loadedJob.entrypoints, manifests: loadedJob.manifests, packageIndexes: job.packageIndexes, packageTexts: loadedJob.packageTexts,
-        fileContents: ctx.fileContents, scanRoot: ctx.root, invoker: ctx.invoker, model: ctx.model, limits: { maxTokensPerJob: L.maxTokensPerJob, jobTimeoutMs: L.jobTimeoutMs },
+        fileContents: ctx.fileContents, scanRoot: ctx.root, invoker: ctx.invoker, model: ctx.model, limits: { maxTokensPerJob: L.maxTokensPerJob, jobTimeoutMs: L.jobTimeoutMs, anonymizePrompts: L.anonymizePrompts },
       });
+      if (out.usage) tokensUsed += (out.usage.inputTokensEstimated || 0) + (out.usage.outputTokensEstimated || 0);
       if (out.state === 'skipped_by_policy') calls--; // nothing was sent
       if (out.state === 'failed' && out.retryable && attempts <= L.maxRetries) {
         // exponential backoff with jitter; the shared cooldown slows every worker, which is what a 429 storm needs
@@ -3284,7 +3344,7 @@ function reachFrom({ graph, fileContents, entrypoint, limits = {} }) {
   const lim = { ...DEFAULT_LIMITS, ...limits };
   const { byId, edgesFrom } = indexGraph(graph);
   const linesCache = new Map();
-  const linesOf = (f) => { if (!linesCache.has(f)) linesCache.set(f, (fileContents[f] || '').split('\n')); return linesCache.get(f); };
+  const linesOf = (f) => { if (!linesCache.has(f)) linesCache.set(f, (0,_controls_js__WEBPACK_IMPORTED_MODULE_0__/* .blankComments */ .$E)(fileContents[f] || '', f).split('\n')); return linesCache.get(f); };
 
   const visited = [];
   const seen = new Set();
@@ -3450,7 +3510,7 @@ function evaluateProtection({ facts, unknowns, omittedWithControls = false, capp
 /* harmony export */   sj: () => (/* binding */ verifyReview),
 /* harmony export */   z6: () => (/* binding */ runReviewOnce)
 /* harmony export */ });
-/* unused harmony exports CONCLUSIONS, LIKELIHOODS, isLoopbackEndpoint, claimGrounded, resolveCitation, isRetryableError */
+/* unused harmony exports CONCLUSIONS, LIKELIHOODS, isLoopbackEndpoint, stripUntrustedCommands, pseudonymizer, claimGrounded, resolveCitation, isRetryableError */
 /* harmony import */ var _util_untrusted_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(17097);
 /* harmony import */ var _egress_redact_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(11723);
 /* harmony import */ var _egress_policy_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(45712);
@@ -3599,12 +3659,69 @@ function checkEgressForFiles(files, { scanRoot, model }) {
   // other endpoint needs --allow-remote (or review.allowRemote), on top of the egress policy below, never instead of it.
   if (model.remote && !model.remoteApproved) return { allowed: false, reason: 'remote-endpoint-not-approved (pass --allow-remote or set review.allowRemote after reviewing the egress policy)', file: files[0] || null, evaluated: false };
   for (const file of files) {
-    const d = (0,_egress_policy_js__WEBPACK_IMPORTED_MODULE_2__/* .evaluateEgress */ .nn)({ scanRoot, purpose: 'context-review', endpoint: model.endpoint, provider: model.provider, model: model.model, path: file });
-    if (!d.allowed) return { allowed: false, reason: d.reason, file, evaluated: true };
+    // Fail closed. A policy check that throws (a corrupt policy file, an unreadable path, a bug) is not an allow: the answer is "deny", with the
+    // reason, and nothing is sent. This is the only place that decides whether a prompt may leave the machine.
+    let d;
+    try { d = (0,_egress_policy_js__WEBPACK_IMPORTED_MODULE_2__/* .evaluateEgress */ .nn)({ scanRoot, purpose: 'context-review', endpoint: model.endpoint, provider: model.provider, model: model.model, path: file }); }
+    catch (err) { return { allowed: false, reason: `egress-policy-error: ${String((err && err.message) || err).slice(0, 120)}`, file, evaluated: true, failedClosed: true }; }
+    if (!d || d.allowed !== true) return { allowed: false, reason: (d && d.reason) || 'egress-policy-returned-no-decision', file, evaluated: true, ...(d ? {} : { failedClosed: true }) };
   }
   return { allowed: true, evaluated: true };
 }
 
+// ---- model output hygiene -------------------------------------------------------------------------------------
+
+/**
+ * A model's text is untrusted. It can carry a command for a human or a script to run ("run curl ... | sh to confirm"). Nothing here executes model text, but
+ * these strings reach reports, tickets and fix suggestions that people copy from, so shell-looking content is removed and counted, never passed on.
+ */
+const FENCE = /```[\s\S]*?```|~~~[\s\S]*?~~~/g;
+const CMD_WORD = '(?:curl|wget|bash|sh|zsh|sudo|su|rm|chmod|chown|nc|ncat|netcat|python3?|node|perl|ruby|php|powershell|pwsh|cmd(?:\\.exe)?|eval|exec|scp|ssh|dd|mkfs|kill|pkill|git\\s+push|npm\\s+(?:i|install|publish)|pip3?\\s+install|docker\\s+run)';
+const INLINE_CMD = new RegExp('`[^`\\n]*\\b' + CMD_WORD + '\\b[^`\\n]*`|\\$\\([^)]*\\)|\\b(?:curl|wget)\\s+[^\\s]+[^\\n]*\\|\\s*(?:sh|bash)\\b|(?:^|\\n)\\s*(?:\\$|#)\\s+' + CMD_WORD + '\\b[^\\n]*', 'gi');
+function stripUntrustedCommands(text) {
+  if (typeof text !== 'string' || !text) return { text: text ?? '', stripped: 0 };
+  let n = 0;
+  let out = text.replace(FENCE, () => { n++; return '[command block removed]'; });
+  out = out.replace(INLINE_CMD, () => { n++; return '[command removed]'; });
+  return { text: out, stripped: n };
+}
+function sanitizeReviewStrings(review) {
+  let total = 0;
+  const walk = (v, key) => {
+    if (typeof v === 'string') {
+      if (['promptHash', 'responseHash', 'contextHash', 'entrypointId', 'file', 'role', 'kind', 'conclusion', 'likelihood', 'questionPack', 'status'].includes(key)) return v;
+      const r = stripUntrustedCommands(v); total += r.stripped; return r.text;
+    }
+    if (Array.isArray(v)) return v.map((x) => walk(x, key));
+    if (v && typeof v === 'object') { const o = {}; for (const [k, x] of Object.entries(v)) o[k] = walk(x, k); return o; }
+    return v;
+  };
+  const out = walk(review, '');
+  if (total) out.untrustedCommandsStripped = total;
+  return out;
+}
+
+/** Where a suggestion came from and what checked it. Attached to every review so a reader never mistakes a model's words for a finding. */
+function provenanceOf(model, promptHash) {
+  let host = null; try { host = model.endpoint ? new URL(model.endpoint).hostname : null; } catch { host = null; }
+  const loopback = host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+  return { producer: 'model', provider: model.provider ?? null, model: model.model ?? null, endpointClass: !model.endpoint ? 'none' : loopback ? 'loopback' : 'remote', promptHash, checkedBy: 'deterministic-citation-verifier', promotedToFinding: false };
+}
+
+// ---- prompt anonymization ---------------------------------------------------------------------------------------
+
+/** Replace each real file path with a stable pseudonym (`f_<hash>.<ext>`). The mapping stays in memory; only the pseudonyms leave. */
+function pseudonymizer(files) {
+  const toPseudo = new Map(); const toReal = new Map();
+  for (const f of [...new Set(files)].sort()) {
+    const ext = (/\.[A-Za-z0-9]{1,6}$/.exec(f) || [''])[0];
+    const p = `f_${(0,_canonical_js__WEBPACK_IMPORTED_MODULE_5__/* .sha256 */ .sc)(f).slice(0, 10)}${ext}`;
+    toPseudo.set(f, p); toReal.set(p, f);
+  }
+  const swap = (text, map) => { let t = text; for (const [a, b] of [...map].sort((x, y) => y[0].length - x[0].length)) t = t.split(a).join(b); return t; };
+  return { toPseudo: (t) => swap(t, toPseudo), toReal: (t) => swap(t, toReal), size: toPseudo.size };
+}
+
 // ---- response parsing and verification ------------------------------------------------------------------------
 
 function extractJson(raw) {
@@ -3813,7 +3930,12 @@ async function runReviewOnce({ pack, entrypoints, manifests, packageIndexes, pac
   const badRedact = redacted.find(r => !r.ok);
   if (badRedact) return { state: 'skipped_by_policy', reason: `redaction refused: ${badRedact.reason}` };
 
-  const { prompt, promptHash } = buildReviewPrompt({ pack, entrypoints, packageTexts: redacted.map(r => r.text), contextHash: manifests[0].contextHash });
+  // Policy-driven anonymization: file paths are replaced by pseudonyms before the prompt is built, and mapped back in the answer before its citations
+  // are checked against the real snapshot. The model never sees a real path, and what is hashed is what was sent.
+  const anon = limits.anonymizePrompts ? pseudonymizer(files) : null;
+  const sendTexts = anon ? redacted.map(r => anon.toPseudo(r.text)) : redacted.map(r => r.text);
+  const sendEntrypoints = anon ? entrypoints.map(e => JSON.parse(anon.toPseudo(JSON.stringify(e)))) : entrypoints;
+  const { prompt, promptHash } = buildReviewPrompt({ pack, entrypoints: sendEntrypoints, packageTexts: sendTexts, contextHash: manifests[0].contextHash });
   const est = (0,_packer_js__WEBPACK_IMPORTED_MODULE_6__/* .estimateTokens */ .bP)(prompt);
   if (est.tokens > limits.maxTokensPerJob) return { state: 'skipped_by_policy', reason: `prompt is about ${est.tokens} tokens, over the ${limits.maxTokensPerJob} per-job limit` };
 
@@ -3825,7 +3947,9 @@ async function runReviewOnce({ pack, entrypoints, manifests, packageIndexes, pac
     return { state: 'failed', reason: `model call failed: ${String((err && err.message) || err).slice(0, 160)}`, retryable: isRetryableError(err) };
   }
   const usage = { inputTokensEstimated: est.tokens, outputTokensEstimated: Math.ceil(String(raw || '').length / 4), source: 'estimate', redactions: redacted.reduce((n, r) => n + r.redactions, 0) };
-  const review = verifyReview({ raw, pack, entrypoints, manifests, packageIndexes, fileContents, promptHash });
+  const rawReal = anon && typeof raw === 'string' ? anon.toReal(raw) : raw;
+  const review0 = verifyReview({ raw: rawReal, pack, entrypoints, manifests, packageIndexes, fileContents, promptHash });
+  const review = { ...sanitizeReviewStrings(review0), modelProvenance: provenanceOf(model, promptHash), ...(anon ? { promptAnonymized: true } : {}) };
   if (review.status === 'declined') return { state: 'partial', reason: `answer declined: ${review.declineReasons.join(',')}`, review, usage };
   return { state: 'succeeded', reason: null, review, usage };
 }