@clear-capabilities/agentic-security-scanner 0.175.0 → 0.176.0

package/dist/4978bec8fdf5c733dc85.json

@@ -0,0 +1,283 @@
+{
+  "name": "@clear-capabilities/agentic-security-scanner",
+  "version": "0.176.0",
+  "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
+  "type": "module",
+  "main": "src/index.js",
+  "bin": {
+    "agentic-security": "dist/agentic-security.mjs",
+    "agentic-security-scanner": "dist/agentic-security.mjs",
+    "as": "dist/agentic-security.mjs",
+    "agentic-security-mcp": "bin/agentic-security-mcp.js",
+    "agentic-security-lsp": "bin/agentic-security-lsp.js",
+    "agentic-security-rule": "bin/agentic-security-rule.js",
+    "agentic-security-diff": "bin/agentic-security-diff.js",
+    "agentic-security-consistency": "bin/agentic-security-consistency.js",
+    "agentic-security-audit": "bin/agentic-security-audit.js"
+  },
+  "exports": {
+    ".": "./src/index.js",
+    "./engine": "./src/engine.js",
+    "./sast": "./src/sast/index.js",
+    "./sca": "./src/sca/index.js",
+    "./secrets": "./src/secrets/index.js",
+    "./report": "./src/report/index.js",
+    "./posture/fix-style-mirror.js": "./src/posture/fix-style-mirror.js"
+  },
+  "files": [
+    "src/",
+    "bin/",
+    "dist/",
+    "vendor/",
+    "CHANGELOG.md",
+    "!**/.agentic-security",
+    "!**/.agentic-security/**"
+  ],
+  "imports": {
+    "#java-parser": "./vendor/java-parser/entry.mjs"
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "dependencies": {
+    "@babel/core": "^8.0.5",
+    "@babel/preset-react": "^8.0.1",
+    "@babel/preset-typescript": "^8.0.1",
+    "js-yaml": "^5.5.0",
+    "safe-regex": "^2.1.1"
+  },
+  "optionalDependencies": {
+    "tree-sitter-wasms": "0.1.13",
+    "web-tree-sitter": "0.20.8",
+    "z3-solver": "^5.3.1"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "@vercel/ncc": "^0.45.0",
+    "java-parser": "^3.0.1"
+  },
+  "overrides": {
+    "lodash": "^4.18.1",
+    "lodash-es": "^4.18.1"
+  },
+  "scripts": {
+    "build": "node scripts/vendor-java-parser.mjs && ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && rm -rf dist/compliance-frameworks && mkdir -p dist/compliance-frameworks && cp src/posture/compliance-frameworks/*.json dist/compliance-frameworks/ && node scripts/copy-frontend.mjs && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
+    "prepare": "node scripts/prepare.mjs",
+    "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs && node ../scripts/release-check.mjs",
+    "test": "node ../scripts/run-unit-tests.mjs",
+    "test:extras": "AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",
+    "loop": "node ../scripts/loop-engineering/run.mjs",
+    "test:engineering-excellence": "node --test --test-concurrency=1 test/engineering-excellence/e0-01-inventory.test.js test/engineering-excellence/e0-02-baseline.test.js test/engineering-excellence/e0-03-contract.test.js test/engineering-excellence/e0-04-task-manifest.test.js test/engineering-excellence/e0-05-status-runner.test.js test/engineering-excellence/e0-06-backlog.test.js test/engineering-excellence/e1-01-dataset-provenance.test.js test/engineering-excellence/e1-02-splits.test.js test/engineering-excellence/e1-03-scoring.test.js test/engineering-excellence/e1-04-baseline-run.test.js test/engineering-excellence/e1-05-forensics.test.js test/engineering-excellence/e1-05-baseline-forensics.test.js test/engineering-excellence/e1-06-adversarial-controls.test.js test/engineering-excellence/e1-07-realcode-policy.test.js test/engineering-excellence/e1-07-baseline-gate.test.js test/engineering-excellence/e2-06-cross-language.test.js test/engineering-excellence/e2-08-suppression-attribution.test.js test/engineering-excellence/e2-09-semantic-gates.test.js test/engineering-excellence/e4-06-dci-real-app.test.js test/engineering-excellence/e6-08-perf-budget.test.js test/engineering-excellence/e8-02-e2e-demo.test.js test/engineering-excellence/e8-03-regression-report.test.js test/engineering-excellence/e8-04-docs.test.js test/engineering-excellence/e8-05-handoff.test.js test/engineering-excellence/e8-06-release-decision.test.js test/engineering-excellence/u01-ruby-path-resolver.test.js test/engineering-excellence/e1-08-scorecard.test.js test/engineering-excellence/e3-01-patch-routes.test.js test/engineering-excellence/e3-02-fix-verification-record.test.js test/engineering-excellence/e3-03-central-verifier.test.js test/engineering-excellence/e3-04-exploit-replay.test.js test/engineering-excellence/e3-05-functional-preservation.test.js test/engineering-excellence/e3-06-patch-policy.test.js test/engineering-excellence/e3-07-rollback-crash-safety.test.js test/engineering-excellence/e3-08-fix-benchmark.test.js test/engineering-excellence/e2-01-semantic-graph.test.js test/engineering-excellence/e2-02-cross-file-resolution.test.js test/engineering-excellence/e2-03-heap-fields-aliases.test.js test/engineering-excellence/e2-04-async-callbacks-frameworks.test.js test/engineering-excellence/e2-05-interprocedural-contexts.test.js test/engineering-excellence/e2-07-service-edges.test.js test/engineering-excellence/e4-01-dci-audit.test.js test/engineering-excellence/e4-02-invariants.test.js test/engineering-excellence/e4-03-cross-route.test.js test/engineering-excellence/e4-04-counterexample.test.js test/engineering-excellence/e4-05-llm-safeguards.test.js test/engineering-excellence/e4-07-dci-findings.test.js test/engineering-excellence/e6-01-telemetry.test.js test/engineering-excellence/e5-01-runtime-audit.test.js test/engineering-excellence/e5-02-build-identity.test.js test/engineering-excellence/e5-03-privacy-ingest.test.js test/engineering-excellence/e5-04-graph-reconciliation.test.js test/engineering-excellence/e5-05-exploitability-evidence.test.js test/engineering-excellence/e5-06-service-chain-graph.test.js test/engineering-excellence/e5-07-runtime-explanation.test.js test/engineering-excellence/e6-05-supervised-analyzers.test.js test/engineering-excellence/e6-06-determinism.test.js test/engineering-excellence/e6-07-adversarial-boundaries.test.js test/engineering-excellence/e6-03-shared-preprocessing.test.js test/engineering-excellence/e6-04-analysis-cache.test.js test/engineering-excellence/e7-01-evidence-contracts.test.js test/engineering-excellence/e7-03-release-package.test.js test/engineering-excellence/e7-04-compliance-truth.test.js test/engineering-excellence/e7-05-waivers-tenancy.test.js test/engineering-excellence/e7-02-provenance-coverage.test.js test/engineering-excellence/e7-06-fleet-exposure.test.js test/engineering-excellence/e7-07-perspectives.test.js test/engineering-excellence/e7-08-assurance-e2e.test.js test/engineering-excellence/e6-02-completion.test.js",
+    "ee:status": "node ../scripts/engineering-excellence/status.mjs --once",
+    "ee:init": "node ../scripts/engineering-excellence/init.mjs",
+    "ee:inventory": "node ../scripts/engineering-excellence/inventory.mjs",
+    "ee:contract": "node ../scripts/engineering-excellence/contract.mjs",
+    "ee:backlog": "node ../scripts/engineering-excellence/backlog.mjs",
+    "ee:dataset-audit": "node ../scripts/engineering-excellence/dataset-audit.mjs",
+    "ee:independent-baseline": "node ../scripts/engineering-excellence/independent-baseline.mjs",
+    "ee:dci-audit": "node ../scripts/engineering-excellence/dci-audit.mjs",
+    "ee:runtime-audit": "node ../scripts/engineering-excellence/runtime-audit.mjs",
+    "ee:ir-matrix": "node ../scripts/engineering-excellence/ir-matrix.mjs",
+    "test:loop-real-prd": "node --test ../scripts/loop-engineering/test/loop-real-prd.test.js",
+    "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-remote.test.js ../scripts/loop-engineering/test/loop-runbook.test.js ../scripts/loop-engineering/test/loop-assurance-profile.test.js ../scripts/loop-engineering/test/loop-assurance-runtime.test.js ../scripts/loop-engineering/test/loop-bounds.test.js ../scripts/loop-engineering/test/loop-spend.test.js ../scripts/loop-engineering/test/loop-ci-attest.test.js",
+    "test:python": "node ../scripts/run-python-tests.mjs",
+    "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
+    "test:ollama-e2e": "AGENTIC_SECURITY_OLLAMA_E2E=1 node --test test/ollama-e2e.test.js",
+    "test:glob": "node --test test/glob-compat.test.js",
+    "test:sast": "node --test test/cpp-hardcoded-secret.test.js test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/zip-slip-go.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/csharp-cross-file.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/java-structural-cross-file.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/java-ast-folding.test.js test/java-bench-extras.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js test/secrets-coverage.test.js test/prompt-injection-payloads.test.js test/iac-cloud-templates.test.js test/ruby-path-join.test.js test/sast/manifest-line-tracking.test.js test/rust-sast.test.js test/java-deserialization-precision.test.js test/pipeline-env-secret.test.js test/mark-used-vuln-functions.test.js",
+    "test:posture": "node --test test/threat-model.test.js test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/temp-leak-guard.test.js test/release-workflow.test.js test/release-workflow-structure.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/ollama-provider.test.js test/ollama-capabilities.test.js test/ollama-offline-egress.test.js test/ollama-fix-proposal.test.js test/ollama-explain-proposal.test.js test/ollama-poc-proposal.test.js test/ollama-model-probe.test.js test/ollama-agent-tools.test.js test/ollama-agent-loop.test.js test/ollama-e2e.test.js test/ollama-oom-feedback.test.js test/ollama-doc-drift.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/module-artifact-liveness.test.js test/supply-chain-provenance-completeness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/models.test.js test/cli/setup-llm.test.js test/cli/fix-retry.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js test/posture/assurance-baseline.test.js test/posture/assurance-contracts.test.js test/posture/assurance-config.test.js test/evidence-issuer.test.js test/load-factor.test.js test/fleet/job-store.test.js test/fleet/enterprise-graph.test.js test/fleet/discover-edges.test.js test/fleet/job-runner.test.js test/fleet/fleet-org-cli.test.js test/eval-lab/dataset-neutralize.test.js test/eval-lab/arms-score-stats.test.js test/eval-lab/run-report.test.js test/eval-lab/router.test.js test/eval-lab/arm-ollama.test.js test/cli/eval-lab-cli.test.js test/dnr/ir-and-outputs.test.js test/dnr/logs-and-hunt.test.js test/dnr/window-store-view.test.js test/cli/dnr-cli.test.js test/proof-fabric/core.test.js test/proof-fabric/container.test.js test/proof-fabric/generate.test.js test/proof-fabric/siblings.test.js test/proof-fabric/generate-python.test.js test/mcp-proof.test.js test/proof-fabric/fix-store-runner.test.js test/proof-fabric/fixtures.test.js test/cli/proof-fabric-cli.test.js test/rule-compiler/core.test.js test/rule-compiler/synthesis.test.js test/cli/rule-compiler-cli.test.js test/fleet/fleet-graph.test.js test/fleet/fleet-manifest.test.js test/fleet/fleet-cli.test.js test/artifact/safe-tar.test.js test/artifact/image-archive.test.js test/artifact/filesystem.test.js test/artifact/layer-secrets.test.js test/artifact/inventory.test.js test/artifact/vuln-correlate.test.js test/artifact/signature.test.js test/artifact/provenance-graph.test.js test/artifact/mismatch.test.js test/artifact/vex.test.js test/artifact/registry.test.js test/artifact/sources-cosign-evidence.test.js test/cli/artifact-sources-cli.test.js test/cli/artifact-provenance-cli.test.js",
+    "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-rust.test.js test/rust-taint-flow.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js test/sard-leakage-pipeline.test.js test/sard-split-scoring.test.js test/sard-llm-isolation.test.js test/sard-mutation-adversarial.test.js test/sard-baseline-adaptive-tolerance.test.js test/sard-independent-holdout.test.js test/sard-flow-aware-scoring.test.js test/sard-macro-score-support-floor.test.js test/sard-php-split.test.js test/parser-java-nary-concat.test.js test/sard-naive-baseline.test.js test/field-taint-cross-method.test.js test/field-taint-engine-unit.test.js test/coercion-sanitizer-kill.test.js test/constant-propagation-path-sensitivity.test.js test/parser-java-assignments.test.js test/catalog-java-sard.test.js test/parser-cs-juliet-shapes.test.js test/catalog-cs-sard-p2.test.js test/sard-cwe-key-merge.test.js test/parser-php-backtick.test.js test/parser-php-include.test.js test/php-include-merge.test.js test/parser-php-array-field-taint.test.js test/parser-php-cond-assign.test.js test/parser-rust-redos.test.js test/multi-sink-taint-chain.test.js test/static-field-cross-class-call-string.test.js test/regex-guard-narrowing.test.js test/object-instance-field-taint.test.js test/param-type-inference.test.js test/smt-path-feasibility.test.js test/cross-service-taint.test.js test/dataflow-expr-taint-scaling.test.js test/evaluation/guard-dominance.test.js test/evaluation/engine-mechanisms.test.js test/rx-exec-receiver.test.js",
+    "test:mcp": "node --test test/mcp.test.js test/mcp-apply-fix-multifile.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js test/mcp-dataflow-tools.test.js test/cli/governance-propose-edit.test.js test/cli/remediation-open-update.test.js test/cli/remediation-verify-reopen.test.js test/cli/dataflow-observations.test.js test/cli/federate-declare-list.test.js test/capabilities/tools.test.js",
+    "test:report": "node --test test/report-scan-invariants.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/scan-health.test.js test/finding-schema.test.js test/pipeline/finding-schema-provenance.test.js test/evidence-provenance.test.js test/report/provenance-output.test.js test/report/provenance-format-parity.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",
+    "test:lineage": "node --test test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js test/lineage/runtime-assurance.test.js test/lineage/runtime-edge-states.test.js test/lineage/runtime-explorer-view.test.js test/cli/runtime-explorer-cli.test.js test/cli/runtime-identity-cli.test.js test/cli/runtime-twin-cli.test.js",
+    "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
+    "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
+    "test:haskell": "node --test test/haskell/haskell-weak-hash-names.test.js test/haskell/haskell-models-extended.test.js test/haskell/haskell-rules-extended.test.js test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-sca-severity.test.js test/haskell/haskell-web-guards.test.js test/haskell/haskell-advisory-feed.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js test/haskell/haskell-boundaries.test.js test/haskell/haskell-live-feed-scan.test.js test/haskell/haskell-supply-bounds.test.js test/haskell/haskell-ir-scaling.test.js",
+    "test:nix": "node --test test/nix/nixos-hardening-daemon.test.js test/nix/nixos-hardening-extended.test.js test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-sca-severity.test.js test/nix/nix-haskell-closure-names.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js test/nix/nix-fix-multifile.test.js test/nix/nixos-evaluator-forms.test.js test/nix/nix-advisory-feed.test.js test/nix/nix-fix-prewrite.test.js",
+    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-gap-fixes.test.js test/language/language-gap-fixes-2.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js test/language/language-trust-boundary.test.js",
+    "test:language-stress": "node --test --test-concurrency=1 test/language/language-stress-offline.test.js",
+    "test:language-tools": "node --test test/haskell/haskell-web-auth.test.js test/haskell/haskell-support-gate.test.js",
+    "bench:language-support:check": "node ../bench/language-support/check.mjs",
+    "bench:live-feed": "node ../bench/live-feed/run.mjs",
+    "bench:language-support:perf": "node ../bench/language-support/perf.mjs",
+    "test:evaluation": "node --test test/evaluation/protocol.test.js test/evaluation/grouping.test.js test/evaluation/labels.test.js test/evaluation/custody.test.js test/evaluation/runner.test.js test/evaluation/gates-scorecard.test.js test/evaluation/reporting.test.js test/evaluation/why-missed.test.js test/evaluation/guard-dominance.test.js test/evaluation/engine-mechanisms.test.js test/evaluation/release-gate.test.js test/evaluation/publication.test.js",
+    "reproduce:mini": "node ../scripts/public-reproduction.mjs",
+    "reproduce:routing": "node ../scripts/routing-replay.mjs",
+    "verification:patch-example": "node ../scripts/patch-replay-example.mjs",
+    "example:tenant-invariant": "node ../scripts/tenant-invariant-example.mjs",
+    "example:graph-drift": "node ../scripts/graph-drift-example.mjs",
+    "example:blocked-capability": "node ../scripts/blocked-capability-example.mjs",
+    "example:migration": "node ../scripts/migration-example.mjs",
+    "example:portfolio-recovery": "node ../scripts/portfolio-recovery-example.mjs",
+    "example:assurance-review": "node ../scripts/assurance-review-example.mjs",
+    "example:controller": "node ../scripts/loop-engineering/ops-example.mjs",
+    "docs:assurance": "node ../scripts/render-assurance-docs.mjs",
+    "docs:check-assurance": "node ../scripts/render-assurance-docs.mjs --check && node ../scripts/check-assurance-docs.mjs",
+    "dev-recovery": "node ../scripts/dev-recovery.mjs",
+    "evaluation": "node ../scripts/evaluation.mjs",
+    "evaluation:synthetic": "node ../scripts/evaluation.mjs synthetic",
+    "test:routing": "node --test test/routing/outcomes.test.js test/routing/economics.test.js test/routing/adapter.test.js test/routing/calibration.test.js test/routing/decide.test.js test/routing/unchanged-when-off.test.js test/routing/shadow.test.js test/routing/promotion.test.js test/routing/drift.test.js test/routing/canary.test.js test/routing/feedback.test.js test/routing/report.test.js",
+    "test:release-closure": "node --test test/release-closure/closure-plan.test.js test/release-closure/closure-record.test.js test/release-closure/compatibility.test.js test/release-closure/rollout-stages.test.js test/release-closure/migration-readers.test.js test/release-closure/rollback.test.js test/release-closure/wrappers.test.js test/release-closure/final-closure.test.js test/release-closure/final-closure-controller.test.js test/release-closure/runner-hardening.test.js test/release-closure/remote-attestation.test.js",
+    "release:closure:check": "node ../scripts/release-closure.mjs --run",
+    "release:closure:static": "node ../scripts/release-closure.mjs --static",
+    "test:documentation": "node --test test/documentation/drift-check.test.js test/documentation/generated-pages.test.js test/documentation/scope-and-examples.test.js test/documentation/policy-cards.test.js test/documentation/operations-and-review.test.js",
+    "test:capabilities": "node --test test/capabilities/manifest.test.js test/capabilities/filesystem.test.js test/capabilities/exec.test.js test/capabilities/network.test.js test/capabilities/canary.test.js test/capabilities/tools.test.js test/capabilities/recovery.test.js test/capabilities/receipts.test.js test/capabilities/adversarial.test.js test/capabilities/linux-enforcement.test.js test/supervise-async-sweep.test.js",
+    "test:verification": "node --test test/verification/verification-record.test.js test/verification/oracle-adapters.test.js test/verification/replay-manifest.test.js test/verification/patch-negative.test.js test/verification/non-taint-classes.test.js test/verification/interface-equivalence.test.js test/verification/advisory-gating.test.js test/verification/oracle-conformance.test.js",
+    "test:deployment": "node --test test/deployment/boundary-graph.test.js test/deployment/config-adapters.test.js test/deployment/trace-correlation.test.js test/deployment/cross-repo.test.js test/deployment/attack-paths.test.js test/deployment/drift.test.js test/deployment/boundary-presentation.test.js test/deployment/differentiation-ablation.test.js test/deployment/boundaries-cli.test.js",
+    "test:portfolio": "node --test test/portfolio/manifest.test.js test/portfolio/bundle.test.js test/portfolio/signing.test.js test/portfolio/work-units.test.js test/portfolio/resume.test.js test/portfolio/scheduler.test.js test/portfolio/progress.test.js test/portfolio/retention.test.js test/portfolio/backend.test.js",
+    "test:invariants": "node --test test/invariants/invariant-schema.test.js test/invariants/invariant-lifecycle.test.js test/invariants/invariant-scenarios.test.js test/invariants/business-state-oracle.test.js test/invariants/scenario-shrinking.test.js test/invariants/invariant-repair.test.js test/invariants/business-coverage.test.js test/invariants/invariant-ablation.test.js",
+    "bench:invariant-ablation": "node ../scripts/invariant-ablation.mjs",
+    "verification:conformance:check": "node ../scripts/verification-conformance-check.mjs",
+    "verification:conformance:static": "node ../scripts/verification-conformance-check.mjs --static",
+    "verification:replay-example": "node ../scripts/verification-replay-example.mjs",
+    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js",
+    "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
+    "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/premortem.test.js test/context-intelligence/git-diff-candidates.test.js",
+    "eval:independent": "node ../bench/independent-eval/runner.mjs",
+    "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",
+    "smoke": "node bin/agentic-security.js scan test/fixtures/vulnerable-js",
+    "prebench": "npm run build",
+    "bench": "node test/benchmark/bench.js",
+    "bench:update": "node test/benchmark/bench.js --update-baseline",
+    "prebench:realworld": "npm run build",
+    "bench:realworld": "node test/benchmark/realworld/bench-realworld.js",
+    "bench:llm-goats": "node test/benchmark/llm-goats/bench-llm-goats.js",
+    "bench:data-lineage": "node ../bench/data-lineage/runner.mjs",
+    "bench:data-lineage:check": "node ../bench/data-lineage/runner.mjs --check",
+    "bench:cve-replay": "node ../bench/cve-replay/runner.mjs",
+    "bench:cve-replay:ci": "node ../bench/cve-replay/runner.mjs --ci",
+    "bench:cve-replay:check": "node ../bench/cve-replay/runner.mjs --check-baseline",
+    "bench:cve-replay:update-baseline": "node ../bench/cve-replay/runner.mjs --update-baseline",
+    "bench:realcode:report": "node ../bench/independent/realcode.mjs report",
+    "bench:realcode:check": "node ../bench/independent/realcode.mjs check --tier release",
+    "bench:realcode:check:quick": "node ../bench/independent/realcode.mjs check --tier quick",
+    "bench:independent:gate:check": "node ../scripts/independent-population-gate.mjs",
+    "bench:independent:update-gate-baseline": "node ../scripts/independent-population-gate.mjs --update-baseline",
+    "bench:router-replay": "node ../bench/router-replay/runner.mjs",
+    "bench:router-replay:check": "node ../bench/router-replay/runner.mjs --check-baseline",
+    "bench:router-replay:update-baseline": "node ../bench/router-replay/runner.mjs --update-baseline",
+    "bench:bigquery:smoke": "node ../bench/bigquery-github/bin/run-cycle.mjs --smoke",
+    "bench:bigquery": "node ../bench/bigquery-github/bin/run-cycle.mjs",
+    "bench:agent-tasks": "node ../bench/agent-tasks/security-fixer/runner.mjs",
+    "bench:polyglot": "node ../bench/polyglot/runner.mjs",
+    "bench:proof-corpus": "node ../bench/proof-corpus/runner.mjs",
+    "bench:proof-corpus:pins": "node ../bench/proof-corpus/runner.mjs --refresh-pins",
+    "bench:engine-reconnect": "node ../bench/engine-reconnect/measure.mjs",
+    "bench:ttff": "node ../bench/ttff/runner.mjs",
+    "bench:ttff:check": "node ../bench/ttff/runner.mjs --check",
+    "bench:ttff:update-baseline": "node ../bench/ttff/runner.mjs --update-baseline",
+    "bench:provenance": "node ../bench/provenance/runner.mjs",
+    "bench:provenance:check": "node ../bench/provenance/runner.mjs --check",
+    "bench:provenance:update-baseline": "node ../bench/provenance/runner.mjs --update-baseline",
+    "bench:memory": "node ../bench/memory/runner.mjs",
+    "bench:memory:check": "node ../bench/memory/runner.mjs --check",
+    "bench:memory:update-baseline": "node ../bench/memory/runner.mjs --update-baseline",
+    "check:bundle-source": "node ../scripts/check-bundle-source.mjs",
+    "release:prepare": "node ../scripts/release-prepare.mjs",
+    "ship": "node ../scripts/ship.mjs",
+    "bench:self-scan": "node ../bench/self-scan/measure.mjs",
+    "bench:self-scan:check": "node ../bench/self-scan/check.mjs",
+    "bench:nist-800-171-labels:check": "node ../bench/nist-800-171-labels/check.mjs",
+    "bench:dci-real-app": "node ../bench/dci-real-app/runner.mjs", "bench:dci-real-app:check": "node ../bench/dci-real-app/runner.mjs --check", "ee:perf-budget": "node ../scripts/engineering-excellence/perf-budget.mjs", "ee:perf-budget:check": "node ../scripts/engineering-excellence/perf-budget.mjs --check", "ee:e2e-demo": "node ../scripts/engineering-excellence/e2e-demo.mjs", "ee:e2e-demo:check": "node ../scripts/engineering-excellence/e2e-demo.mjs --check", "ee:doc-captures": "node ../scripts/engineering-excellence/doc-captures.mjs", "ee:doc-captures:check": "node ../scripts/engineering-excellence/doc-captures.mjs --check", "ee:regression-report": "node ../scripts/engineering-excellence/regression-report.mjs", "ee:regression-report:check": "node ../scripts/engineering-excellence/regression-report.mjs --check", "ee:final-report": "node ../scripts/engineering-excellence/final-report.mjs", "ee:final-report:check": "node ../scripts/engineering-excellence/final-report.mjs --check", "bench:mutation:check": "node ../bench/mutation/runner.mjs",
+    "baseline:capture": "node ../scripts/baseline-capture.mjs",
+    "bench:protection-verdict:check": "node ../bench/protection-verdict/runner.mjs",
+    "bench:independent:forensics": "node ../bench/independent/forensics.mjs",
+    "bench:fix-verify": "node ../bench/fix-verification/runner.mjs",
+    "bench:fix-verify:check": "node ../bench/fix-verification/runner.mjs --check",
+    "bench:fix-correctness": "node ../bench/fix-correctness/runner.mjs",
+    "bench:iac-coverage": "node ../bench/iac-coverage/runner.mjs",
+    "bench:prompt-injection": "node ../bench/prompt-injection/runner.mjs",
+    "bench:prompt-injection:fetch": "node ../bench/prompt-injection/fetch.mjs",
+    "bench:secrets-precision": "node ../bench/secrets-precision/runner.mjs",
+    "bench:sca-replay": "node ../bench/sca-replay/runner.mjs",
+    "bench:sca-replay:reachability": "node ../bench/sca-replay/reachability.mjs",
+    "bench:sca-replay:fetch": "node ../bench/sca-replay/fetch.mjs",
+    "bench:sca-replay:label": "node ../bench/sca-replay/label.mjs",
+    "bench:sard:score": "node ../bench/sard/scripts/macro-score.mjs",
+    "bench:sard:leakage-audit": "node ../bench/sard/scripts/leakage-audit.mjs",
+    "bench:sard:java": "node test/benchmark/realworld/bench-realworld.js --app sard-juliet-java-strict --blind --scramble-identifiers --deep --json | node ../bench/sard/scripts/macro-score.mjs",
+    "bench:sard:csharp": "node test/benchmark/realworld/bench-realworld.js --app sard-juliet-csharp-strict --blind --scramble-identifiers --deep --json | node ../bench/sard/scripts/macro-score.mjs",
+    "bench:sard:java:fast-unsafe": "node test/benchmark/realworld/bench-realworld.js --app sard-juliet-java-strict --blind --json | node ../bench/sard/scripts/macro-score.mjs",
+    "bench:sard:split": "node ../bench/sard/scripts/split.mjs",
+    "bench:sard:split:check": "node ../bench/sard/scripts/split.mjs --verify",
+    "bench:sard:update-baseline": "node ../bench/sard/scripts/compare-baseline.mjs --update-baseline",
+    "bench:sard:check-baseline": "node ../bench/sard/scripts/compare-baseline.mjs --check-baseline",
+    "bench:sard:holdout-update-baseline": "node ../bench/sard/scripts/holdout-check.mjs --update-baseline",
+    "bench:sard:holdout-check": "node ../bench/sard/scripts/holdout-check.mjs --check-baseline",
+    "bench:sard:smoke": "node test/benchmark/realworld/bench-realworld.js --app sard-juliet-java-strict --blind --scramble-identifiers --cwe CWE-89,CWE-78,CWE-23,CWE-80,CWE-327 --json | node ../bench/sard/scripts/macro-score.mjs",
+    "bench:sard:mutate": "node ../bench/sard/scripts/mutate.mjs --app sard-juliet-java-strict --cwe 89,78,23,80,327 --limit 60",
+    "bench:sard:verify-fixes": "node ../bench/sard/scripts/verify-fixes.mjs --app sard-juliet-java-strict --cwe 89,78,23,80,327,328 --limit 200",
+    "bench:sard:analyze-errors": "node ../bench/sard/scripts/analyze-errors.mjs",
+    "bench:sard:naive-baseline": "node ../bench/sard/scripts/naive-baseline.mjs",
+    "bench:sard:php-ingest": "node ../bench/sard/scripts/ingest-php.mjs",
+    "bench:sard:php-score": "node ../bench/sard/scripts/score-php.mjs --deep",
+    "bench:sard:java:test-split": "node test/benchmark/realworld/bench-realworld.js --app sard-juliet-java-strict --blind --scramble-identifiers --deep --split test --json",
+    "bench:sard:csharp:test-split": "node test/benchmark/realworld/bench-realworld.js --app sard-juliet-csharp-strict --blind --scramble-identifiers --deep --split test --json",
+    "bench:sard:php:test-split": "node ../bench/sard/scripts/score-php.mjs --deep --split test --json",
+    "bench:layer-recall": "node ../bench/layer-recall/runner.mjs",
+    "bench:layer-recall:check": "node ../bench/layer-recall/runner.mjs --check",
+    "bench:layer-recall:update-baseline": "node ../bench/layer-recall/runner.mjs --update-baseline",
+    "bench:provenance-accuracy": "node ../bench/provenance-accuracy/runner.mjs",
+    "bench:provenance-accuracy:check": "node ../bench/provenance-accuracy/runner.mjs --check",
+    "bench:provenance-accuracy:update-baseline": "node ../bench/provenance-accuracy/runner.mjs --update-baseline",
+    "bench:privacy-recall": "node ../bench/privacy-recall/measure.mjs",
+    "bench:privacy-recall:compare-lineage": "node ../bench/privacy-recall/compare-lineage.mjs",
+    "bench:privacy-recall:check": "node ../bench/privacy-recall/check.mjs",
+    "bench:privacy-recall:update-baseline": "node ../bench/privacy-recall/check.mjs --update-baseline",
+    "bench:self-scan:update-baseline": "node ../bench/self-scan/check.mjs --update-baseline",
+    "bench:engine-recall": "node ../bench/engine-recall/measure.mjs",
+    "scorecard": "node ../scripts/scorecard.mjs",
+    "check-doc-drift": "node ../scripts/check-doc-drift.mjs",
+    "docs:verify-examples": "node ../scripts/verify-doc-examples.mjs",
+    "harness-score": "node ../scripts/harness-score.cjs",
+    "corpus:enroll": "node ../scripts/enroll-proven-finding.mjs",
+    "corpus:provenance": "node ../scripts/corpus-provenance-check.mjs",
+    "fleet": "node ../scripts/fleet.mjs",
+    "autopilot": "node ../scripts/autopilot.mjs",
+    "comparison": "node ../scripts/comparison.mjs",
+    "determinism:attest": "node ../scripts/attest-fixture.mjs",
+    "scorecard:check": "node ../scripts/scorecard-check.mjs",
+    "release:check": "node ../scripts/release-check.mjs",
+    "release:check:fast": "node ../scripts/release-check.mjs --fast",
+    "gate:prepush": "node ../scripts/pre-push-gate.mjs",
+    "gate:trace": "node ../scripts/gate-trace-reads.mjs",
+    "gate:prepush:install": "node ../scripts/pre-push-gate.mjs --install-hook",
+    "bench:independent": "node ../bench/independent/runner.mjs",
+    "bench:independent:fetch": "node ../bench/independent/fetch.mjs",
+    "bench:independent:mine": "node ../bench/independent/mine.mjs",
+    "bench:independent:materialise": "node ../bench/independent/materialise-cli.mjs",
+    "bench:independent:why-missed": "node ../bench/independent/why-missed.mjs",
+    "bench:independent:materialise-new": "node ../bench/independent/materialise-new.mjs",
+    "bench:independent:merge": "node ../bench/independent/merge-chunks.mjs",
+    "bench:independent:agent-delta": "node ../bench/independent/agent-boundary-delta.mjs",
+    "bench:independent:deep": "node ../bench/independent/runner.mjs --deep",
+    "test:ci-parity": "CI=true GITHUB_ACTIONS=true node --test test/backward-default.test.js test/ci-parity.test.js test/container-taint.test.js test/deep-taint.test.js test/engine-recall.test.js test/engine-reconnect.test.js test/gate-verdict-cache.test.js test/ignore-pragma.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/py-annotation-sources.test.js test/runscan-deep-option.test.js test/sanitizer-typed-flow.test.js",
+    "docs:render-language": "node ../scripts/render-language-docs.mjs",
+    "docs:capture-language": "node ../scripts/capture-language-examples.mjs",
+    "completion-status": "node ../scripts/write-completion-status.mjs",
+    "docs:check-language": "node ../scripts/render-language-docs.mjs --check && node ../scripts/capture-language-examples.mjs --check",
+    "test:nixos-host": "node --test test/nix/nixos-host-runtime.test.js",
+    "test:language-gates": "node --test --test-concurrency=1 test/language/language-benchmark-gates.test.js",
+    "test:language-slow": "node --test --test-concurrency=1 test/language/language-doc-examples-metrics.test.js test/language/language-end-to-end.test.js test/language/language-package-ci.test.js test/language/language-scan-modes.test.js",
+    "test:chrome": "AGENTIC_SECURITY_CHROME_TESTS=1 node --test test/export-image.test.js test/server/cmd-dataflow-export.test.js",
+    "ee:parse-reuse": "node ../scripts/engineering-excellence/parse-reuse-measure.mjs",
+    "ee:analysis-cache": "node ../scripts/engineering-excellence/analysis-cache-measure.mjs",
+    "ee:evidence-contracts": "node ../scripts/engineering-excellence/evidence-inventory.mjs",
+    "release:verify-package": "node ../scripts/verify-release-package.mjs",
+    "ee:completion": "node ../scripts/engineering-excellence/completion-analysis.mjs",
+    "ee:reproduce-timeouts": "node ../scripts/engineering-excellence/reproduce-timeouts.mjs",
+    "ee:provenance-measure": "node ../scripts/engineering-excellence/provenance-measure.mjs",
+    "ee:provenance-baseline": "node ../scripts/engineering-excellence/provenance-baseline.mjs"
+  },
+  "author": "Ross Young <ross@clearcapabilities.com>",
+  "license": "PolyForm-Internal-Use-1.0.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Clear-Capabilities/agentic-security.git",
+    "directory": "scanner"
+  },
+  "homepage": "https://github.com/Clear-Capabilities/agentic-security#readme",
+  "bugs": {
+    "url": "https://github.com/Clear-Capabilities/agentic-security/issues"
+  }
+}

package/dist/5099.index.js

@@ -0,0 +1,96 @@
+export const id = 5099;
+export const ids = [5099];
+export const modules = {
+
+/***/ 25099:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   findSiblings: () => (/* binding */ findSiblings)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _rule_compiler_proposal_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(47838);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(31174);
+// Sibling-exposure search for a verified fix (PRD 1, requirement 6, step 8: "look for equivalent sibling exposures").
+//
+// A fix that closes one instance of a flaw says nothing about the same shape written somewhere else. This finds candidates two ways,
+// and reports where each came from:
+//   * `scan`       other findings from the last scan with the same weakness or title (what the engine already believes);
+//   * `structural` other places in the repository whose line has the SAME SHAPE as the vulnerable line: the vulnerable line is
+//                  generalized (call names kept, strings and other identifiers become classes) by the rule compiler's own
+//                  generalizer and searched across the source files. This finds copies the engine did not flag.
+// The result is a list of CANDIDATES for a person to look at, not a verdict that each one is exploitable. Bounded in files, bytes,
+// matches and time; a bound that is hit is reported (`truncated`), because "no siblings found" must never mean "stopped looking".
+
+
+
+
+
+const SOURCE_EXT = /\.(?:js|mjs|cjs|jsx|ts|tsx|py|rb|php|java|kt|go|rs|cs|c|cc|cpp|h|hpp|sh|swift|scala)$/i;
+const SKIP = new Set(['.git', 'node_modules', 'dist', 'build', 'vendor', _state_dir_js__WEBPACK_IMPORTED_MODULE_3__/* .STATE_DIR_NAME */ .Ky, 'coverage', '__pycache__']);
+const SIBLING_LIMITS = Object.freeze({ maxFiles: 5000, maxFileBytes: 512 * 1024, maxMatches: 100, budgetMs: 8000 });
+
+const sameSpot = (a, b) => node_path__WEBPACK_IMPORTED_MODULE_1__.resolve(a) === node_path__WEBPACK_IMPORTED_MODULE_1__.resolve(b);
+
+/**
+ * @param {object} o
+ * @param {string} o.root           repository root
+ * @param {{file: string, line: number, id?: string, cwe?: string, vuln?: string}} o.finding
+ * @param {object[]} [o.scanFindings] findings from the last scan
+ * @returns {{siblings: object[], truncated: string[], pattern: string|null}}
+ */
+function findSiblings({ root, finding, scanFindings = [], limits = SIBLING_LIMITS, now = Date.now }) {
+  const out = []; const seen = new Set(); const truncated = [];
+  const add = (s) => { const k = `${s.file}:${s.line ?? ''}`; if (!seen.has(k)) { seen.add(k); out.push(s); } };
+  for (const x of scanFindings) {
+    if (!x || x.id === finding.id || x.stableId === finding.stableId && finding.stableId) continue;
+    if (x.file === finding.file && x.line === finding.line) continue;
+    if ((finding.cwe && x.cwe === finding.cwe) || (finding.vuln && x.vuln === finding.vuln)) add({ source: 'scan', file: x.file, line: x.line ?? null, id: x.id ?? null });
+  }
+  let pattern = null;
+  let line = '';
+  try {
+    const abs = node_path__WEBPACK_IMPORTED_MODULE_1__.resolve(root, finding.file);
+    line = (node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(abs, 'utf8').split('\n')[finding.line - 1] ?? '').trim();
+  } catch { /* the flagged file is gone; only the scan-based siblings are available */ }
+  if (line.length >= 8) {
+    pattern = (0,_rule_compiler_proposal_js__WEBPACK_IMPORTED_MODULE_2__/* .generalizeLine */ .Ry)(line);
+    let rx = null;
+    try { rx = new RegExp(pattern); } catch { rx = null; }
+    if (rx) {
+      const deadline = now() + limits.budgetMs; let files = 0; let matches = 0;
+      const base = node_fs__WEBPACK_IMPORTED_MODULE_0__.realpathSync(root);
+      const walk = (dir) => {
+        if (truncated.length) return;
+        let ents = [];
+        try { ents = node_fs__WEBPACK_IMPORTED_MODULE_0__.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name)); } catch { return; }
+        for (const e of ents) {
+          if (truncated.length) return;
+          if (SKIP.has(e.name) || e.isSymbolicLink()) continue;
+          const p = node_path__WEBPACK_IMPORTED_MODULE_1__.join(dir, e.name);
+          if (e.isDirectory()) { walk(p); continue; }
+          if (!e.isFile() || !SOURCE_EXT.test(e.name)) continue;
+          if (++files > limits.maxFiles) { truncated.push(`file limit (${limits.maxFiles})`); return; }
+          if (now() > deadline) { truncated.push('time budget'); return; }
+          let text; try { const st = node_fs__WEBPACK_IMPORTED_MODULE_0__.statSync(p); if (st.size > limits.maxFileBytes) continue; text = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p, 'utf8'); } catch { continue; }
+          const lines = text.split('\n');
+          for (let i = 0; i < lines.length; i++) {
+            if (lines[i].length > 2000 || !rx.test(lines[i].trim())) continue;
+            const rel = node_path__WEBPACK_IMPORTED_MODULE_1__.relative(base, node_fs__WEBPACK_IMPORTED_MODULE_0__.realpathSync(p));
+            if (sameSpot(node_path__WEBPACK_IMPORTED_MODULE_1__.resolve(base, rel), node_path__WEBPACK_IMPORTED_MODULE_1__.resolve(base, finding.file)) && i + 1 === finding.line) continue;
+            add({ source: 'structural', file: rel, line: i + 1, text: lines[i].trim().slice(0, 160) });
+            if (++matches >= limits.maxMatches) { truncated.push(`match limit (${limits.maxMatches})`); return; }
+          }
+        }
+      };
+      walk(base);
+    }
+  }
+  return { siblings: out, truncated, pattern };
+}
+
+
+/***/ })
+
+};