@clear-capabilities/agentic-security-scanner 0.175.0 → 0.177.0

package/src/posture/proof-fabric/generate.js

@@ -0,0 +1,214 @@
+// Reproducer generation from a finding's own evidence (PRD 1: `triage exploit --prove` with no hand-written reproducer).
+//
+// What this is: a DETERMINISTIC harness builder for the cases where a harness can be built from the source alone. It reads the
+// flagged file, finds the function around the flagged line, decides how that function is reached, picks the payload for the
+// weakness class, and emits an ordinary reproducer, which then goes through exactly the same runner, oracle, 3-of-3 repetition and
+// independent replay as any other. A generated reproducer is not a verdict; it is a proposal that is either confirmed by execution
+// or not.
+//
+// What this is not: a general exploit generator. It handles JavaScript (here) and Python (`generate-python.js`), and only code the proof environment can actually load:
+// the file's imports must be Node built-ins or relative files inside the repository (a package from node_modules is not there in
+// the sandbox, so a handler that needs `express` is refused, with the package named). Anything outside that returns `{ ok: false }`
+// with the reason, and nothing is executed.
+//
+// Two shapes:
+//   script    the file reads `process.argv[2]`: it is run with the payload as its argument;
+//   function  the file exports (or declares at top level and exports) the function around the flagged line: a generated harness
+//             loads it and calls it, filling the tainted parameter with the payload. A parameter that is a request-like object
+//             (`req`) gets a stand-in whose `body`/`query`/`params` answer every property with the payload.
+//
+// Weakness classes with a payload and an oracle that can SEE the effect: CWE-78 (a canary file created by the injected command),
+// CWE-22 (a write that lands outside the working directory, only for write sinks), CWE-918 (a request reaching the runner's loopback
+// listener). Others (injection into a database, deserialization, memory safety) need an environment or a native harness this does not
+// build, and are refused by name rather than approximated.
+import fs from 'node:fs';
+import path from 'node:path';
+import { builtinModules } from 'node:module';
+import { parse } from '@babel/parser';
+import { validateReproducer } from './reproducer.js';
+import { generatePythonReproducer } from './generate-python.js';
+
+const CLASSES = {
+  'CWE-78': { name: 'command-injection', payload: 'x; touch {{CANARY:command}}', oracle: { type: 'command_execution', params: { canary: 'command' } } },
+  'CWE-22': { needsPy: /\bopen\s*\([^)]*['"][wax]b?\+?['"]|\.write_(?:text|bytes)\s*\(|\bshutil\.(?:copy|move)/, name: 'path-traversal', payload: '../escaped.txt', oracle: { type: 'filesystem_mutation', params: { canary: 'fs' } }, watch: { fs: 'escaped.txt' }, needs: /\b(?:writeFile|writeFileSync|appendFile|appendFileSync|createWriteStream)\b/ },
+  'CWE-918': { name: 'ssrf', payload: '{{CALLBACK_URL}}', oracle: { type: 'outbound_callback' }, network: 'callback' },
+};
+const MAX_SOURCE = 256 * 1024;
+const MAX_FILES = 8;
+const EXTS = ['', '.js', '.mjs', '.cjs', '/index.js'];
+const BUILTINS = new Set(builtinModules.flatMap((m) => [m, `node:${m}`]));
+const MODULE_SYNTAX = /^\s*(?:import\s[^('"]|import\s*['"{*]|export\s)/m;
+
+const fail = (reason, extra = {}) => ({ ok: false, reason, ...extra });
+const normCwe = (c) => { const m = /(\d{1,5})/.exec(String(c ?? '')); return m ? `CWE-${Number(m[1])}` : null; };
+
+function inside(root, rel) {
+  if (typeof rel !== 'string' || !rel || rel.includes('\0')) return null;
+  let real;
+  try { real = fs.realpathSync(path.resolve(root, rel)); } catch { return null; }
+  const base = fs.realpathSync(root);
+  return real === base || real.startsWith(base + path.sep) ? real : null;
+}
+
+function readSource(root, rel) {
+  const real = inside(root, rel);
+  if (!real) return null;
+  const st = fs.statSync(real);
+  if (!st.isFile() || st.size > MAX_SOURCE) return null;
+  return { real, text: fs.readFileSync(real, 'utf8') };
+}
+
+function parseSource(text) {
+  try { return parse(text, { sourceType: 'unambiguous', errorRecovery: false, plugins: ['topLevelAwait'], allowReturnOutsideFunction: true }); } catch { return null; }
+}
+
+function* walk(node, parent = null) {
+  if (!node || typeof node !== 'object') return;
+  if (Array.isArray(node)) { for (const n of node) yield* walk(n, parent); return; }
+  if (typeof node.type !== 'string') return;
+  yield { node, parent };
+  for (const [k, v] of Object.entries(node)) if (k !== 'loc' && k !== 'leadingComments' && k !== 'trailingComments' && v && typeof v === 'object') yield* walk(v, node);
+}
+
+/** Every module this file loads: built-ins pass, relative files are collected, anything else is a dependency the proof cannot provide. */
+function dependencies(ast) {
+  const specs = [];
+  for (const { node } of walk(ast.program)) {
+    if (node.type === 'ImportDeclaration' || ((node.type === 'ExportNamedDeclaration' || node.type === 'ExportAllDeclaration') && node.source)) specs.push(node.source.value);
+    else if (node.type === 'CallExpression' && node.callee.type === 'Identifier' && node.callee.name === 'require' && node.arguments[0]?.type === 'StringLiteral') specs.push(node.arguments[0].value);
+    else if (node.type === 'ImportExpression' && node.source?.type === 'StringLiteral') specs.push(node.source.value);
+  }
+  return specs;
+}
+
+/** Every function that contains the line, innermost first: the flagged call is often inside a callback of the function that can be called. */
+function functionsAround(ast, line) {
+  const all = [];
+  for (const { node, parent } of walk(ast.program)) {
+    if (!/^(?:FunctionDeclaration|FunctionExpression|ArrowFunctionExpression|ObjectMethod|ClassMethod)$/.test(node.type)) continue;
+    if (node.loc && node.loc.start.line <= line && node.loc.end.line >= line) all.push({ node, parent });
+  }
+  return all.sort((a, b) => (a.node.loc.end.line - a.node.loc.start.line) - (b.node.loc.end.line - b.node.loc.start.line) || (b.node.loc.start.line - a.node.loc.start.line));
+}
+
+const paramNames = (fn) => fn.params.map((p) => (p.type === 'Identifier' ? p.name : p.type === 'AssignmentPattern' && p.left.type === 'Identifier' ? p.left.name : null));
+
+/** How the function is reachable from outside: its exported name, or null. */
+function exportName(ast, fnInfo) {
+  const { node, parent } = fnInfo;
+  const idName = node.id?.name ?? (parent?.type === 'VariableDeclarator' && parent.id.type === 'Identifier' ? parent.id.name : null);
+  let found = null;
+  for (const { node: n } of walk(ast.program)) {
+    if (n.type === 'ExportNamedDeclaration' && n.declaration) {
+      if (n.declaration === node || (n.declaration.type === 'FunctionDeclaration' && n.declaration.id?.name === idName)) found = { kind: 'named', name: idName };
+      if (n.declaration.type === 'VariableDeclaration' && n.declaration.declarations.some((d) => d.init === node)) found = { kind: 'named', name: n.declaration.declarations.find((d) => d.init === node).id.name };
+    }
+    if (n.type === 'ExportNamedDeclaration' && n.specifiers?.length && idName) for (const s of n.specifiers) if (s.local?.name === idName) found = { kind: 'named', name: s.exported.name };
+    if (n.type === 'ExportDefaultDeclaration' && (n.declaration === node || n.declaration?.name === idName)) found = { kind: 'default' };
+    if (n.type === 'AssignmentExpression' && n.left.type === 'MemberExpression') {
+      const l = n.left; const obj = l.object; const prop = l.property?.name ?? l.property?.value;
+      const isModuleExports = obj.type === 'Identifier' && obj.name === 'module' && prop === 'exports';
+      if (isModuleExports && (n.right === node || (n.right.type === 'Identifier' && n.right.name === idName))) found = { kind: 'module' };
+      if (isModuleExports && n.right.type === 'ObjectExpression') for (const p of n.right.properties) if ((p.value === node || p.value?.name === idName || (p.shorthand && p.key.name === idName)) && p.key) found = { kind: 'named', name: p.key.name ?? p.key.value };
+      const isExportsProp = (obj.type === 'Identifier' && obj.name === 'exports') || (obj.type === 'MemberExpression' && obj.object?.name === 'module' && obj.property?.name === 'exports');
+      if (isExportsProp && prop && (n.right === node || (n.right.type === 'Identifier' && n.right.name === idName))) found = { kind: 'named', name: prop };
+    }
+  }
+  return found;
+}
+
+function harness({ esm, entry, exp, args }) {
+  const load = esm ? `const mod = await import('./${entry}');` : `import { createRequire } from 'node:module';\nconst require = createRequire(import.meta.url);\nconst mod = require('./${entry}');`;
+  const pick = exp.kind === 'named' ? `mod[${JSON.stringify(exp.name)}] ?? mod.default?.[${JSON.stringify(exp.name)}]` : exp.kind === 'default' ? 'mod.default ?? mod' : 'typeof mod === \'function\' ? mod : mod.default';
+  return `// Generated by the proof fabric from the finding's own evidence. It loads the flagged function and calls it with the payload.
+${load}
+const payload = process.argv[2] ?? '';
+const P = new Proxy({}, { get: (_t, k) => (k === Symbol.toPrimitive ? () => payload : k === 'toString' ? () => payload : payload), has: () => true });
+const res = new Proxy(function () {}, { get: () => res, apply: () => res });
+const fn = ${pick};
+if (typeof fn !== 'function') { console.error('the exported value is not a function'); process.exit(3); }
+let timer; try { await Promise.race([Promise.resolve(fn(${args.join(', ')})), new Promise((r) => { timer = setTimeout(r, 5000); })]); } catch (e) { console.error('target threw:', String(e && e.message).slice(0, 200)); }
+clearTimeout(timer);
+`;
+}
+
+export function generateReproducer({ finding, root }) {
+  const cwe = normCwe(finding?.cwe);
+  const cls = CLASSES[cwe];
+  if (!cls) return fail(`no payload and oracle exist for ${cwe ?? 'this finding'}; supported: ${Object.keys(CLASSES).join(', ')} (others need a database, a deserializer or a native harness)`);
+  const rel = String(finding?.file ?? '');
+  const isPy = /\.py$/i.test(rel);
+  if (!isPy && !/\.(?:js|mjs|cjs)$/i.test(rel)) return fail(`no harness builder for ${path.extname(rel) || 'this file type'}; JavaScript and Python only`);
+  if (!Number.isInteger(finding?.line)) return fail('the finding has no line number');
+  if (isPy) return generatePythonReproducer({ finding, root, cls });
+  const src = readSource(root, rel);
+  if (!src) return fail('the flagged file is missing, outside the repository, or too large');
+  const ast = parseSource(src.text);
+  if (!ast) return fail('the flagged file could not be parsed');
+  const lines = src.text.split('\n');
+  const sinkLine = lines[finding.line - 1] ?? '';
+  if (cls.needs && !cls.needs.test(sinkLine) && !cls.needs.test(lines.slice(Math.max(0, finding.line - 3), finding.line + 2).join('\n'))) return fail(`${cls.name}: the flagged code is not a write, and the oracle can only observe a write (a read leaves no trace unless the program prints it)`);
+
+  // dependencies the sandbox can satisfy
+  const sources = {}; const external = [];
+  const entryDir = path.dirname(src.real);
+  const rootReal = fs.realpathSync(root); // the repository root as the filesystem names it (a temp dir can sit behind a symlink)
+  const collect = (realFile, ast0, count) => {
+    for (const spec of dependencies(ast0)) {
+      if (BUILTINS.has(spec)) continue;
+      if (!spec.startsWith('.')) { external.push(spec); continue; }
+      let found = null;
+      for (const e of EXTS) { const cand = inside(root, path.relative(rootReal, path.resolve(path.dirname(realFile), spec + e))); if (cand && fs.statSync(cand).isFile()) { found = cand; break; } }
+      if (!found) return fail(`the relative import "${spec}" was not found inside the repository`);
+      const destRel = path.relative(entryDir, found);
+      if (destRel.startsWith('..')) return fail(`"${spec}" lives outside the flagged file's directory, which a proof workspace cannot mirror`);
+      if (sources[destRel] || found === src.real) continue;
+      if (Object.keys(sources).length >= MAX_FILES) return fail(`the file pulls in more than ${MAX_FILES} repository files`);
+      const dep = readSource(root, path.relative(rootReal, found));
+      if (!dep) return fail(`"${spec}" is too large or unreadable`);
+      sources[destRel] = path.relative(rootReal, found);
+      const depAst = parseSource(dep.text);
+      if (!depAst) return fail(`"${spec}" could not be parsed`);
+      const r = collect(found, depAst, count + 1); if (r) return r;
+    }
+    return null;
+  };
+  const bad = collect(src.real, ast, 0);
+  if (bad) return bad;
+  if (external.length) return fail(`the flagged code needs ${[...new Set(external)].slice(0, 4).join(', ')}, which is not installed in the proof environment; only Node built-ins and repository files can be loaded`, { missing: [...new Set(external)] });
+
+  const esm = MODULE_SYNTAX.test(src.text) || path.extname(rel).toLowerCase() === '.mjs';
+  const entry = `target${esm ? '.mjs' : '.cjs'}`;
+  sources[entry] = rel;
+  const assumptions = [];
+  const base = { schema: 'agentic-security/reproducer', version: 1, findingId: String(finding.stableId ?? finding.id ?? 'generated'), lang: 'javascript', oracle: cls.oracle, network: cls.network ?? 'none', ...(cls.watch ? { watch: cls.watch } : {}) };
+  if (cls.watch) assumptions.push('the write target is assumed to be one directory below the working directory (the payload is ../escaped.txt); if the code uses another base, the proof will not confirm');
+
+  // shape 1: a script that reads its payload from argv
+  if (/process\.argv\s*\[\s*2\s*\]|process\.argv\.slice\(\s*2\s*\)/.test(src.text) && !/\bmodule\.exports\b|^\s*export\s/m.test(src.text)) {
+    const reproducer = { ...base, sources, run: ['{{NODE}}', entry, cls.payload] };
+    const errs = validateReproducer(reproducer);
+    return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'script', class: cls.name, entry: rel, line: finding.line, assumptions } };
+  }
+
+  // shape 2: an exported function around the flagged line
+  const candidates = functionsAround(ast, finding.line);
+  if (!candidates.length) return fail('the flagged line is not inside a function, and the file does not read its payload from process.argv[2]');
+  let around = null; let exp = null;
+  for (const c of candidates) { const e = exportName(ast, c); if (e) { around = c; exp = e; break; } }
+  if (!around) return fail('the function around the flagged line is not exported, so nothing outside the file can call it');
+  const names = paramNames(around.node);
+  if (!names.length) return fail('the function around the flagged line takes no parameters, so the payload has no way in');
+  const window = lines.slice(Math.max(0, around.node.loc.start.line - 1), Math.min(lines.length, finding.line + 1)).join('\n');
+  const requestLike = names.findIndex((n) => n && /^(?:req|request)$/.test(n) && new RegExp(`\\b${n}\\.(?:body|query|params)\\b`).test(sinkLine));
+  const direct = requestLike >= 0 ? -1 : names.findIndex((n) => n && new RegExp(`\\b${n}\\b`).test(sinkLine));
+  const fallback = direct < 0 && requestLike < 0 ? names.findIndex((n) => n && new RegExp(`\\b${n}\\b`).test(window)) : -1;
+  const idx = requestLike >= 0 ? requestLike : direct >= 0 ? direct : fallback;
+  if (idx < 0) return fail('none of the function\'s parameters appears in the flagged code, so there is no tainted parameter to fill');
+  if (fallback >= 0) assumptions.push(`the tainted parameter "${names[idx]}" was chosen because it appears in the function body near the flagged line, not on the line itself`);
+  const args = names.map((_, i) => (i !== idx ? (/^(?:res|response)$/.test(names[i] ?? '') ? 'res' : 'undefined') : requestLike >= 0 ? '{ body: P, query: P, params: P, headers: P, cookies: P }' : 'payload'));
+  const files = { 'harness.mjs': harness({ esm, entry, exp, args }) };
+  const reproducer = { ...base, sources, files, run: ['{{NODE}}', 'harness.mjs', cls.payload] };
+  const errs = validateReproducer(reproducer);
+  return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'function', class: cls.name, entry: rel, line: finding.line, function: names.length ? `${exp.kind === 'named' ? exp.name : exp.kind}(${names.join(', ')})` : exp.kind, taintedParameter: names[idx], requestLike: requestLike >= 0, assumptions } };
+}

package/src/posture/proof-fabric/reproducer.js

@@ -4,6 +4,7 @@
 // and a target cannot learn the values in advance.
 import { createHash } from 'node:crypto';
 import { ORACLE_TYPES } from './oracles.js';
+import { validateAttackFacts } from '../dnr/attack-facts.js';
 
 const REPRODUCER_SCHEMA = 'agentic-security/reproducer';
 const REPRODUCER_VERSION = 1;
@@ -80,6 +81,8 @@ export function validateReproducer(r) {
     else for (const [dest, src] of Object.entries(r.sources)) if (!isSafeRelPath(dest) || !isSafeRelPath(src)) errs.push(`bad sources entry: ${dest}`);
   }
   if (r.network != null && !['none', 'callback'].includes(r.network)) errs.push('network must be none or callback');
+  // Optional request-level facts for the detection-and-response loop. The runner never reads them.
+  errs.push(...validateAttackFacts(r.attack));
   return errs;
 }
 

package/src/posture/proof-fabric/runner.js

@@ -15,6 +15,7 @@ import { runInBoundary } from '../../sandbox/trust-boundary.js';
 import { detectBackend } from '../../sandbox/index.js';
 import { evaluateOracle } from './oracles.js';
 import { validateReproducer, substitute } from './reproducer.js';
+import { runInContainer, CONTAINER_ROOT, CONTAINER_TOOLS } from './container.js';
 
 export const DEFAULT_LIMITS = Object.freeze({
   timeoutMs: 20_000, buildTimeoutMs: 60_000, graceMs: 1000, maxOutputBytes: 256 * 1024,
@@ -28,11 +29,33 @@ const CONTAINER_IMAGES = Object.freeze({
 
 const SIGNALS = { 134: 'SIGABRT', 135: 'SIGBUS', 136: 'SIGFPE', 132: 'SIGILL', 139: 'SIGSEGV' };
 
+// only language toolchains are probed; the container engine has its own, richer health check (`container.js`)
+const PROBED_TOOLS = new Set(['java', 'javac', 'python3', 'cc', 'gcc', 'dotnet']);
+const probeCache = new Map();
+/** A launcher that exists is not a toolchain that works: macOS ships /usr/bin/java and /usr/bin/python3 as stubs that only prompt for an
+ * install. A tool counts only if it answers its version flag, within a short timeout, with exit 0. */
+function toolWorks(file, name) {
+  if (probeCache.has(file)) return probeCache.get(file);
+  const args = name === 'java' || name === 'javac' ? ['-version'] : ['--version'];
+  let ok = false;
+  try { const r = spawnSync(file, args, { stdio: 'ignore', timeout: 8000 }); ok = r.status === 0; } catch { ok = false; }
+  probeCache.set(file, ok);
+  return ok;
+}
+
 function findTool(name, pathEnv = process.env.PATH || '') {
-  for (const dir of pathEnv.split(path.delimiter)) {
+  const dirs = pathEnv.split(path.delimiter);
+  // a configured JDK wins over whatever stub sits on PATH
+  if ((name === 'java' || name === 'javac') && process.env.JAVA_HOME) dirs.unshift(path.join(process.env.JAVA_HOME, 'bin'));
+  for (const dir of dirs) {
     if (!dir) continue;
     const p = path.join(dir, name);
-    try { fs.accessSync(p, fs.constants.X_OK); if (fs.statSync(p).isFile()) return fs.realpathSync(p); } catch { /* next */ }
+    try {
+      fs.accessSync(p, fs.constants.X_OK);
+      if (!fs.statSync(p).isFile()) continue;
+      const real = fs.realpathSync(p);
+      if (!PROBED_TOOLS.has(name) || toolWorks(real, name)) return real;
+    } catch { /* next */ }
   }
   return null;
 }
@@ -58,7 +81,7 @@ export function selectEnvironment({ lang, preferContainer = true, requireContain
   if (preferContainer && dockerBin) {
     const image = docker?.images?.[lang] ?? CONTAINER_IMAGES[lang];
     const probe = (docker?.probe ?? defaultDockerProbe)(dockerBin, image);
-    if (probe.ok) return { mode: 'container', assurance: 'high', runtime: dockerBin, image, reason: null };
+    if (probe.ok) return { mode: 'container', assurance: 'high', runtime: dockerBin, image, imageId: probe.imageId ?? null, reason: null };
     if (requireContainer) return { mode: 'unavailable', assurance: 'none', reason: `container required but unavailable: ${probe.reason}` };
     const local = localEnv(force);
     return { ...local, containerSkipped: probe.reason };
@@ -76,8 +99,9 @@ function localEnv(force) {
 function defaultDockerProbe(bin, image) {
   const info = spawnSync(bin, ['info', '--format', '{{.ServerVersion}}'], { encoding: 'utf8', timeout: 5000, killSignal: 'SIGKILL' });
   if (info.status !== 0) return { ok: false, reason: 'container daemon not responding' };
-  const img = spawnSync(bin, ['image', 'inspect', image], { encoding: 'utf8', timeout: 5000, killSignal: 'SIGKILL' });
-  return img.status === 0 ? { ok: true } : { ok: false, reason: `image ${image} is not present locally (proofs never pull)` };
+  const img = spawnSync(bin, ['image', 'inspect', '--format', '{{.Id}}', image], { encoding: 'utf8', timeout: 5000, killSignal: 'SIGKILL' });
+  // the image id is the environment's identity: two proofs with the same id ran on the same base
+  return img.status === 0 ? { ok: true, imageId: /^(?:sha256:)?[0-9a-f]{12,64}$/i.test(String(img.stdout).trim()) ? String(img.stdout).trim() : null } : { ok: false, reason: `image ${image} is not present locally (proofs never pull)` };
 }
 
 // ---------------------------------------------------------------------------------------------------------------
@@ -134,10 +158,13 @@ export async function runAttempt(reproducer, opts = {}) {
   if (!sup.supported) return done({ status: 'unsupported', reasons: [sup.reason] });
   const env = opts.environment ?? selectEnvironment({ lang: reproducer.lang, requireContainer: opts.requireContainer, preferContainer: opts.preferContainer ?? true, force: opts.force });
   if (env.mode === 'unavailable') return done({ status: 'blocked', environment: env, reasons: [env.reason] });
-  if (env.mode === 'container') {
-    return done({ status: 'blocked', environment: env, reasons: ['container execution is selected but the container runner is not enabled in this build; use requireContainer:false for local-confined proof'] });
+  const inContainer = env.mode === 'container';
+  if (inContainer && reproducer.network === 'callback') {
+    // the container has no network by design, so it cannot reach the runner's loopback listener
+    if (opts.requireContainer) return done({ status: 'blocked', environment: env, reasons: ['this reproducer needs the loopback callback listener, which a container (no network) cannot reach, and a container was required'] });
+    return done({ status: 'unsupported', environment: env, reasons: ['a reproducer that needs the loopback callback listener cannot run in a container (no network); run it without a container requirement to use the local confined backend'] });
   }
-  if (reproducer.network === 'callback' && env.backend !== 'userspace') {
+  if (!inContainer && reproducer.network === 'callback' && env.backend !== 'userspace') {
     return done({ status: 'unsupported', environment: env, reasons: [`loopback callback needs the userspace backend; this host uses ${env.backend}`] });
   }
 
@@ -154,9 +181,10 @@ export async function runAttempt(reproducer, opts = {}) {
     const secrets = {};
     const canaries = {};
     const ctx = {
-      nonce, root, tools,
+      nonce, root: inContainer ? CONTAINER_ROOT : root, tools: inContainer ? CONTAINER_TOOLS : tools,
       secret: (n) => (secrets[n] ??= `SECRET-${nonce}-${n}`),
-      canary: (n) => { canaries[n] ??= { path: path.join(root, 'canary', `${nonce}-${n}`) }; return canaries[n].path; },
+      // the host path is what the oracle reads; inside a container the same file is seen under /work
+      canary: (n) => { canaries[n] ??= { path: path.join(root, 'canary', `${nonce}-${n}`) }; return inContainer ? path.posix.join(CONTAINER_ROOT, 'canary', `${nonce}-${n}`) : canaries[n].path; },
     };
     if (reproducer.network === 'callback') {
       listener = await startListener(aux);
@@ -194,20 +222,23 @@ export async function runAttempt(reproducer, opts = {}) {
       const p = path.join(root, rel);
       watch[name] = { path: p, existedBefore: fs.existsSync(p), digestBefore: digestFile(p) };
     }
-    const runEnv = { PATH: '/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/opt/homebrew/bin', HOME: root, TMPDIR: path.join(root, 'tmp'), LANG: 'C.UTF-8', CI: '1' };
+    const runEnv = inContainer ? { LANG: 'C.UTF-8' } : { PATH: '/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/opt/homebrew/bin', HOME: root, TMPDIR: path.join(root, 'tmp'), LANG: 'C.UTF-8', CI: '1' };
     for (const [k, v] of Object.entries(reproducer.env || {})) runEnv[k] = substitute(v, ctx);
     const boundary = { root, timeoutMs: limits.timeoutMs, graceMs: limits.graceMs, maxOutputBytes: limits.maxOutputBytes, env: runEnv, force: opts.force, signal: opts.signal, controlProbes: opts.controlProbes };
 
     const degraded = [];
     if (env.assurance === 'lower') degraded.push('lower-assurance-local-confinement');
 
+    const execute = (cmd, extra) => (inContainer
+      ? runInContainer({ runtime: env.runtime, image: env.image, name: `proof-${nonce}-${extra.stage}`, hostRoot: root, argv: cmd, env: runEnv, limits, timeoutMs: extra.timeoutMs, signal: opts.signal, maxOutputBytes: limits.maxOutputBytes, user: opts.containerUser })
+      : runInBoundary(cmd, { ...boundary, ...extra.boundary }));
     if (reproducer.build) {
-      const b = await runInBoundary(argv(reproducer.build), { ...boundary, timeoutMs: limits.buildTimeoutMs, cwd: undefined });
+      const b = await execute(argv(reproducer.build), { stage: 'build', timeoutMs: limits.buildTimeoutMs, boundary: { timeoutMs: limits.buildTimeoutMs, cwd: undefined } });
       if (b.blocked) return done({ status: 'blocked', environment: env, reasons: b.reasons, degraded });
       if (b.timedOut || b.exitCode !== 0) return done({ status: 'build-failed', executed: true, environment: env, reasons: [b.timedOut ? 'build timed out' : `build exited ${b.exitCode}`], degraded, observation: { buildStderr: trimOut(b.targetOutput?.stderr, 2000) } });
     }
 
-    const r = await runInBoundary(argv(reproducer.run), { ...boundary, ...(listener ? { networkProxyPort: listener.port } : {}) });
+    const r = await execute(argv(reproducer.run), { stage: 'run', timeoutMs: limits.timeoutMs, boundary: listener ? { networkProxyPort: listener.port } : {} });
     if (r.blocked) return done({ status: 'blocked', environment: env, reasons: r.reasons, degraded });
     if (!r.executed) return done({ status: 'error', environment: env, reasons: [`target did not execute (${r.status})`], degraded });
 

package/src/posture/proof-fabric/siblings.js

@@ -0,0 +1,77 @@
+// Sibling-exposure search for a verified fix (PRD 1, requirement 6, step 8: "look for equivalent sibling exposures").
+//
+// A fix that closes one instance of a flaw says nothing about the same shape written somewhere else. This finds candidates two ways,
+// and reports where each came from:
+//   * `scan`       other findings from the last scan with the same weakness or title (what the engine already believes);
+//   * `structural` other places in the repository whose line has the SAME SHAPE as the vulnerable line: the vulnerable line is
+//                  generalized (call names kept, strings and other identifiers become classes) by the rule compiler's own
+//                  generalizer and searched across the source files. This finds copies the engine did not flag.
+// The result is a list of CANDIDATES for a person to look at, not a verdict that each one is exploitable. Bounded in files, bytes,
+// matches and time; a bound that is hit is reported (`truncated`), because "no siblings found" must never mean "stopped looking".
+import fs from 'node:fs';
+import path from 'node:path';
+import { generalizeLine } from '../rule-compiler/proposal.js';
+import { STATE_DIR_NAME } from '../state-dir.js';
+
+const SOURCE_EXT = /\.(?:js|mjs|cjs|jsx|ts|tsx|py|rb|php|java|kt|go|rs|cs|c|cc|cpp|h|hpp|sh|swift|scala)$/i;
+const SKIP = new Set(['.git', 'node_modules', 'dist', 'build', 'vendor', STATE_DIR_NAME, 'coverage', '__pycache__']);
+const SIBLING_LIMITS = Object.freeze({ maxFiles: 5000, maxFileBytes: 512 * 1024, maxMatches: 100, budgetMs: 8000 });
+
+const sameSpot = (a, b) => path.resolve(a) === path.resolve(b);
+
+/**
+ * @param {object} o
+ * @param {string} o.root           repository root
+ * @param {{file: string, line: number, id?: string, cwe?: string, vuln?: string}} o.finding
+ * @param {object[]} [o.scanFindings] findings from the last scan
+ * @returns {{siblings: object[], truncated: string[], pattern: string|null}}
+ */
+export function findSiblings({ root, finding, scanFindings = [], limits = SIBLING_LIMITS, now = Date.now }) {
+  const out = []; const seen = new Set(); const truncated = [];
+  const add = (s) => { const k = `${s.file}:${s.line ?? ''}`; if (!seen.has(k)) { seen.add(k); out.push(s); } };
+  for (const x of scanFindings) {
+    if (!x || x.id === finding.id || x.stableId === finding.stableId && finding.stableId) continue;
+    if (x.file === finding.file && x.line === finding.line) continue;
+    if ((finding.cwe && x.cwe === finding.cwe) || (finding.vuln && x.vuln === finding.vuln)) add({ source: 'scan', file: x.file, line: x.line ?? null, id: x.id ?? null });
+  }
+  let pattern = null;
+  let line = '';
+  try {
+    const abs = path.resolve(root, finding.file);
+    line = (fs.readFileSync(abs, 'utf8').split('\n')[finding.line - 1] ?? '').trim();
+  } catch { /* the flagged file is gone; only the scan-based siblings are available */ }
+  if (line.length >= 8) {
+    pattern = generalizeLine(line);
+    let rx = null;
+    try { rx = new RegExp(pattern); } catch { rx = null; }
+    if (rx) {
+      const deadline = now() + limits.budgetMs; let files = 0; let matches = 0;
+      const base = fs.realpathSync(root);
+      const walk = (dir) => {
+        if (truncated.length) return;
+        let ents = [];
+        try { ents = fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name)); } catch { return; }
+        for (const e of ents) {
+          if (truncated.length) return;
+          if (SKIP.has(e.name) || e.isSymbolicLink()) continue;
+          const p = path.join(dir, e.name);
+          if (e.isDirectory()) { walk(p); continue; }
+          if (!e.isFile() || !SOURCE_EXT.test(e.name)) continue;
+          if (++files > limits.maxFiles) { truncated.push(`file limit (${limits.maxFiles})`); return; }
+          if (now() > deadline) { truncated.push('time budget'); return; }
+          let text; try { const st = fs.statSync(p); if (st.size > limits.maxFileBytes) continue; text = fs.readFileSync(p, 'utf8'); } catch { continue; }
+          const lines = text.split('\n');
+          for (let i = 0; i < lines.length; i++) {
+            if (lines[i].length > 2000 || !rx.test(lines[i].trim())) continue;
+            const rel = path.relative(base, fs.realpathSync(p));
+            if (sameSpot(path.resolve(base, rel), path.resolve(base, finding.file)) && i + 1 === finding.line) continue;
+            add({ source: 'structural', file: rel, line: i + 1, text: lines[i].trim().slice(0, 160) });
+            if (++matches >= limits.maxMatches) { truncated.push(`match limit (${limits.maxMatches})`); return; }
+          }
+        }
+      };
+      walk(base);
+    }
+  }
+  return { siblings: out, truncated, pattern };
+}

package/src/posture/routing/policy-router.js

@@ -0,0 +1,103 @@
+// Per-task model routing from MEASURED results (PRD 6, requirements 7 and 8).
+//
+// The router reads the scoreboard the Eval Lab writes and picks a model for each task independently, under one of four policies:
+//
+//   best-quality                          the highest measured quality
+//   balanced                              the cheapest model whose quality is within `tolerance` of the best
+//   lowest-cost-above-quality-threshold   the cheapest model whose quality meets `qualityThreshold`
+//   local-only                            the best-quality LOCAL model; a non-local model is never a candidate
+//
+// What it will not do:
+//   * guess. A model with fewer than `minRuns` measured runs, or with unknown cost under a cost-based policy, is excluded with
+//     the reason stated, and when nothing is eligible the answer is `blocked`, not a default;
+//   * invent a benchmark. `threat-model` has no evaluation task, so routing it is blocked as `no-benchmark-for-task`;
+//   * route around the egress policy. A non-local candidate is checked against it, and a denial excludes the model;
+//   * fall back from a local model to a cloud one. `local-only` has no non-local path at all.
+// This is the policy layer over measurements. The calibrated, per-stratum router in `decide.js` keeps its own job (quality LOWER
+// bounds on held-out outcomes); the two do not call each other.
+import { evaluateEgress } from '../../egress/policy.js';
+
+export const ROUTER_TASKS = Object.freeze({ 'threat-model': null, hunt: 'detect', falsification: 'falsify', 'exploit-generation': 'exploit', 'patch-generation': 'patch' });
+export const ROUTER_POLICIES = Object.freeze(['best-quality', 'balanced', 'lowest-cost-above-quality-threshold', 'local-only']);
+const DEFAULT_TOLERANCE = 0.02;
+export const DEFAULT_MIN_RUNS = 3;
+const QUALITY_LABEL = { hunt: 'Detection quality', falsification: 'Falsification quality', 'exploit-generation': 'Exploit quality', 'patch-generation': 'Patch quality' };
+
+const cmpCost = (a, b) => (a.medianCostUsd == null ? 1 : b.medianCostUsd == null ? -1 : a.medianCostUsd - b.medianCostUsd);
+
+export function routeTask({ task, policy = 'balanced', scoreboard, tolerance = DEFAULT_TOLERANCE, qualityThreshold = null, minRuns = DEFAULT_MIN_RUNS, datasetHash = null, scanRoot, egress = evaluateEgress } = {}) {
+  const base = { schema: 'agentic-security/model-route', version: 1, task, policy };
+  if (!(task in ROUTER_TASKS)) return { ...base, ok: false, blocked: 'unknown-task', reason: `unknown task "${task}"; choose one of ${Object.keys(ROUTER_TASKS).join(', ')}` };
+  if (!ROUTER_POLICIES.includes(policy)) return { ...base, ok: false, blocked: 'invalid-policy', reason: `unknown policy "${policy}"; choose one of ${ROUTER_POLICIES.join(', ')}` };
+  if (ROUTER_TASKS[task] === null) return { ...base, ok: false, blocked: 'no-benchmark-for-task', reason: `there is no evaluation task for ${task}, so no model has measured quality for it and none is recommended` };
+  if (policy === 'lowest-cost-above-quality-threshold' && !(typeof qualityThreshold === 'number' && qualityThreshold > 0 && qualityThreshold <= 1)) return { ...base, ok: false, blocked: 'invalid-policy', reason: 'lowest-cost-above-quality-threshold needs a quality threshold between 0 and 1' };
+  if (!(typeof tolerance === 'number' && tolerance >= 0 && tolerance < 1)) return { ...base, ok: false, blocked: 'invalid-policy', reason: 'tolerance must be between 0 and 1' };
+
+  const all = (scoreboard?.entries ?? []).filter((e) => e.routerTask === task);
+  if (!all.length) return { ...base, ok: false, blocked: 'no-evidence', reason: `no model has been benchmarked for ${task}; run: agentic-security models benchmark` };
+
+  // entries measured on different datasets are not comparable: use one dataset, the one with the most candidates unless named
+  const byDs = new Map();
+  for (const e of all) { const g = byDs.get(e.datasetHash) ?? []; g.push(e); byDs.set(e.datasetHash, g); }
+  let ds = datasetHash;
+  if (ds && !byDs.has(ds)) return { ...base, ok: false, blocked: 'no-evidence', reason: `no benchmark for ${task} on dataset ${ds}` };
+  if (!ds) ds = [...byDs.entries()].sort((a, b) => b[1].length - a[1].length || String(b[1][0].evidence?.measuredAt).localeCompare(String(a[1][0].evidence?.measuredAt)))[0][0];
+  const pool = byDs.get(ds);
+
+  const excluded = []; const eligible = [];
+  for (const e of pool) {
+    const why = [];
+    if (e.quality.mean == null) why.push('no measured quality');
+    if ((e.quality.n ?? 0) < minRuns) why.push(`only ${e.quality.n ?? 0} measured run(s); ${minRuns} are required`);
+    if (policy === 'local-only' && e.local !== true) why.push('not a local model');
+    if (e.local !== true && policy !== 'local-only') {
+      if (!e.endpoint) why.push('no declared endpoint, so the egress policy cannot judge it');
+      else { const d = egress({ scanRoot, purpose: 'model-routing', endpoint: e.endpoint, model: e.model.split('/').slice(1).join('/'), provider: e.model.split('/')[0], role: `route-${task}`, dataClass: 'source-code' }); if (!d.allowed) why.push(`egress policy: ${d.reason}`); }
+    }
+    if (['balanced', 'lowest-cost-above-quality-threshold'].includes(policy) && e.medianCostUsd == null && !e.local) why.push('cost is unknown, and this policy ranks by cost');
+    if (policy === 'lowest-cost-above-quality-threshold' && e.quality.mean != null && e.quality.mean < qualityThreshold) why.push(`quality ${(e.quality.mean * 100).toFixed(0)}% is below the ${(qualityThreshold * 100).toFixed(0)}% threshold`);
+    (why.length ? excluded.push({ model: e.model, reasons: why }) : eligible.push(e));
+  }
+  const evidence = { datasetHash: ds, datasetId: pool[0].datasetId, candidates: pool.length, runs: [...new Set(pool.map((e) => e.evidence?.runId))].filter(Boolean) };
+  if (!eligible.length) return { ...base, ok: false, blocked: 'no-eligible-model', reason: 'no benchmarked model satisfies the policy and the evidence requirements', excluded, evidence };
+
+  const byQuality = [...eligible].sort((a, b) => b.quality.mean - a.quality.mean || cmpCost(a, b) || a.model.localeCompare(b.model));
+  const best = byQuality[0];
+  let chosen = best; let rule;
+  if (policy === 'best-quality' || policy === 'local-only') rule = policy === 'local-only' ? 'it has the highest measured quality among local models' : 'it has the highest measured quality';
+  else if (policy === 'balanced') {
+    const within = eligible.filter((e) => e.quality.mean >= best.quality.mean - tolerance);
+    chosen = [...within].sort((a, b) => cmpCost(a, b) || b.quality.mean - a.quality.mean || a.model.localeCompare(b.model))[0];
+    rule = chosen === best ? `no cheaper model is within ${(tolerance * 100).toFixed(0)} points of its quality` : `quality is within ${(tolerance * 100).toFixed(0)} points of the best and it is the cheapest such model`;
+  } else {
+    chosen = [...eligible].sort((a, b) => cmpCost(a, b) || b.quality.mean - a.quality.mean || a.model.localeCompare(b.model))[0];
+    rule = `it is the cheapest model with quality at or above ${(qualityThreshold * 100).toFixed(0)}%`;
+  }
+  const view = (e) => ({ model: e.model, local: e.local, quality: e.quality.mean, qualityCi95: e.quality.ci95, runs: e.quality.n, medianCostUsd: e.medianCostUsd, medianLatencyMs: e.medianLatencyMs });
+  const costReduction = chosen !== best && best.medianCostUsd != null && chosen.medianCostUsd != null && best.medianCostUsd > 0 ? 1 - chosen.medianCostUsd / best.medianCostUsd : null;
+  return {
+    ...base, ok: true, recommended: view(chosen), alternatives: byQuality.filter((e) => e !== chosen).map(view), excluded, evidence,
+    comparison: chosen === best ? null : { against: best.model, qualityDifference: best.quality.mean - chosen.quality.mean, costReduction },
+    rationale: rule, label: QUALITY_LABEL[task], parameters: { tolerance, qualityThreshold, minRuns },
+  };
+}
+
+/** The text `models route explain <task>` prints. */
+export function explainRoute(r) {
+  if (!r.ok) return [`Task: ${r.task}`, `Policy: ${r.policy}`, `No recommendation (${r.blocked}): ${r.reason}`, ...(r.excluded?.length ? ['', 'Excluded:', ...r.excluded.map((e) => `  ${e.model}: ${e.reasons.join('; ')}`)] : [])].join('\n');
+  const pc = (x) => (x == null ? 'n/a' : `${(x * 100).toFixed(0)}%`);
+  const usd = (x) => (x == null ? 'unknown' : x === 0 ? '$0.00' : x < 0.01 ? `$${x.toFixed(4)}` : `$${x.toFixed(2)}`);
+  const sec = (x) => (x == null ? 'unknown' : `${(x / 1000).toFixed(1)}s`);
+  const rec = r.recommended;
+  const L = [`Recommended: ${rec.model}${rec.local ? ' (local)' : ''}`, `${r.label}: ${pc(rec.quality)}`, `Median cost: ${usd(rec.medianCostUsd)}`, `Median latency: ${sec(rec.medianLatencyMs)}`, `Measured runs: ${rec.runs}`];
+  for (const a of r.alternatives) L.push('', `${a.model}${a.local ? ' (local)' : ''}:`, `Quality: ${pc(a.quality)}`, `Cost: ${usd(a.medianCostUsd)}`);
+  L.push('');
+  if (!r.comparison) L.push(`${rec.model} selected because ${r.rationale}.`);
+  else {
+    const qd = (r.comparison.qualityDifference * 100).toFixed(0);
+    L.push(`${rec.model} selected because ${r.rationale}${r.comparison.costReduction != null ? `: quality difference is ${qd} point${qd === '1' ? '' : 's'} and cost is ${(r.comparison.costReduction * 100).toFixed(0)}% lower than ${r.comparison.against}` : ''}.`);
+  }
+  if (r.excluded.length) L.push('', 'Not considered:', ...r.excluded.map((e) => `  ${e.model}: ${e.reasons.join('; ')}`));
+  L.push('', `Evidence: dataset ${r.evidence.datasetId} (${String(r.evidence.datasetHash).slice(-12)}), ${r.evidence.runs.length} run record(s).`);
+  return L.join('\n');
+}