@clear-capabilities/agentic-security-scanner 0.183.1 → 0.185.0

package/dist/2923.index.js

@@ -443,9 +443,10 @@ function parseOtelJsonObservations(text, context) {
  * `destination.service`), `protocol` (normalized — Envoy writes
  * `"HTTP/1.1"`, which contains `/` and is not an approved identifier
  * shape; lowercased and `/` stripped, e.g. `"http1.1"`), and
- * `response_flags` (`'-'`/empty means no flag, i.e. allowed; a non-empty
- * flags string, e.g. `"UAEX"` for unauthorized, is treated as `'denied'`
- * via `network.securityDecision`). `start_time`/`end_time` (or
+ * `response_flags` (`'-'`/empty means no flag, i.e. allowed; `"UAEX"`, the
+ * external authorization service denying the request, is `'denied'` via
+ * `network.securityDecision`; any other flag, such as an upstream failure or
+ * a missing route, is an operational outcome and carries no decision). `start_time`/`end_time` (or
  * `start_time` alone, with `duration` in milliseconds added) feed
  * `firstObservedAt`/`lastObservedAt`. Everything else — client address,
  * request path/query, user agent, request id, response code's own exact
@@ -488,7 +489,13 @@ function parseEnvoyAccessLogObservations(text, context) {
     if (cluster) attributes['destination.service'] = cluster;
     if (protocol) attributes['network.protocol'] = protocol;
     if (typeof record.response_flags === 'string') {
-      attributes['network.securityDecision'] = record.response_flags.trim().length === 0 || record.response_flags.trim() === '-' ? 'allowed' : 'denied';
+      // Only a flag that records an authorization decision is a security decision. UAEX is the external authorization service
+      // denying the request. Every other flag (UF upstream connection failure, NR no route, UT timeout, DC client disconnect) is
+      // an operational outcome, and calling it "denied" would invent a denial, so those make no claim either way.
+      const flags = record.response_flags.trim();
+      const tokens = flags.split(',').map((t) => t.trim()).filter(Boolean);
+      if (flags.length === 0 || flags === '-') attributes['network.securityDecision'] = 'allowed';
+      else if (tokens.includes('UAEX')) attributes['network.securityDecision'] = 'denied';
     }
 
     if (Object.keys(attributes).length === 0) continue; // nothing safe/present to report for this line
@@ -520,10 +527,8 @@ function parseEnvoyAccessLogObservations(text, context) {
  * `destination.service` — never `objectRef.name`, which is frequently a
  * user-chosen, potentially sensitive resource name) and
  * `responseStatus.code` (mapped to `network.securityDecision`: `< 400`
- * is `'allowed'`, `>= 400` is `'denied'` — a client error is treated as a
- * decision here because the audit log's own admission/authorization
- * failures surface as 401/403/409, which is exactly the "security
- * decision" fact this adapter exists to carry). `requestReceivedTimestamp`/
+ * is `'allowed'`, `401`/`403` is `'denied'`, anything else carries no
+ * decision: a not-found or a conflict is not an authorization outcome). `requestReceivedTimestamp`/
  * `stageTimestamp` feed the observed-at window. **`user.username` and
  * every request/response body field are deliberately never read** — a
  * K8s audit event's `user` block is exactly the "authenticated identity"
@@ -565,7 +570,10 @@ function parseK8sAuditLogObservations(text, context) {
     if (namespace && resource) attributes['destination.service'] = `${namespace}:${resource}`;
     else if (resource) attributes['destination.service'] = resource;
     if (typeof code === 'number' && Number.isFinite(code)) {
-      attributes['network.securityDecision'] = code < 400 ? 'allowed' : 'denied';
+      // 401 and 403 are the authentication and authorization outcomes. Any other client or server error (404 not found, 409 conflict,
+      // 422 invalid, 5xx) is an operational outcome and makes no claim, the same rule as the proxy adapters.
+      if (code < 400) attributes['network.securityDecision'] = 'allowed';
+      else if (code === 401 || code === 403) attributes['network.securityDecision'] = 'denied';
     }
 
     if (Object.keys(attributes).length === 0) continue;

package/dist/9382.index.js

@@ -1442,6 +1442,9 @@ const AUTH_NAME = /(?:^|[.:])(?:(?:require|ensure|check|assert|verify|validate|e
 
 const SENSITIVE_NAME = /(?:^|[.:])(?:query|queryOne|queryRow|exec|execute|executeQuery|raw|rawQuery|prepare|find|findAll|findOne|findById|findByPk|findUnique|findFirst|findMany|get|getById|getBy|select|selectList|selectFirst|insert|insertOne|insertMany|insert_|update|updateOne|updateMany|upsert|delete|deleteOne|deleteMany|remove|destroy|save|create|createMany|aggregate|runDB|writeFile|writeFileSync|appendFile|unlink|rm|rmdir|spawn|spawnSync|execSync|execFile|system|popen|fetch|request|post|put|patch)$/i;
 const DB_RECEIVER = /(?:^|\b)(?:db|database|conn|connection|pool|client|cursor|session|repo|repository|dao|model|models|collection|table|prisma|knex|sequelize|orm|store|objects|manager|em|entityManager|mongo|redis|cache|conn|stmt|statement|fs|child_process|cp|axios|http|https|requests|httpx|got|superagent|Database|Persist|Yesod|System)\b/;
+// Flask-SQLAlchemy `Model.query...`, SQLAlchemy `session.query/add/delete/merge/execute/get`, and the query-builder methods that end a chain.
+const PY_ORM = /(?:\b[A-Z]\w*\.query\b|\b(?:db\.)?session\.(?:query|add|add_all|delete|merge|execute|get|bulk_save_objects)\b|\.(?:filter_by|get_or_404|first_or_404|one_or_404)\()/;
+const PY_ORM_WRITE = /\.(?:delete|update|bulk_update_mappings|bulk_insert_mappings)\(|\b(?:db\.)?session\.(?:add|add_all|delete|merge|bulk_save_objects)\b/;
 const SQL_TEXT = /\b(?:select\s[\s\S]{1,120}\sfrom|insert\s+into|update\s+\w+\s+set|delete\s+from)\b/i;
 const HS_SENSITIVE = /(?:^|\.)(?:runDB|selectList|selectFirst|getBy|getJust|insert_?|insertEntity|update|updateWhere|delete|deleteWhere|replace|upsert|query|query_|execute|execute_|readFile|writeFile|callProcess|readProcess)$|^(?:Database\.|System\.Process\.|System\.Directory\.)/;
 
@@ -1601,6 +1604,18 @@ function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
         }
       }
     }
+    // Python ORM calls. `Model.query.filter_by(...).delete()` and `db.session.add(x)` name no database receiver the call-name rule
+    // recognises, and the chained `.delete()` is not a call on one, so the data operation was invisible and a route that
+    // deletes a row read as touching nothing sensitive. A write is a chained mutation or a session write; anything else is a read.
+    if (!haskell && PY_ORM.test(raw)) {
+      const orm = PY_ORM_WRITE.test(raw) ? 'write' : 'read';
+      push({ line: ln, category: 'sensitive', kind: `data-${orm}`, subkind: orm, evidence: 'observed', basis: 'orm-call', rejectionSeen: null, text: clip(raw) });
+      const stmt = statementAt(lines, ln);
+      const pr = ownerBinding(stmt, extraPrincipal);
+      if (pr) {
+        push({ line: ln, category: 'control', kind: pr.tenant ? 'tenant-scope' : 'ownership', subkind: null, evidence: pr.level === 'qualified' ? 'observed' : 'inferred', basis: pr.level === 'qualified' ? 'query-filter' : 'query-filter-unqualified', rejectionSeen: null, text: clip(raw) });
+      }
+    }
     if (SQL_TEXT.test(raw)) {
       const verb = /\b(?:insert|update|delete)\b/i.test(raw) ? 'write' : 'read';
       push({ line: ln, category: 'sensitive', kind: `data-${verb}`, subkind: verb, evidence: 'observed', basis: 'sql-text', rejectionSeen: null, text: clip(raw) });
@@ -3474,8 +3489,14 @@ function evaluateProtection({ facts, unknowns, omittedWithControls = false, capp
     const ctl = facts.filter(f => f.category === 'control' && kinds.includes(f.kind));
     // A control whose answer is visibly thrown away (a predicate called as a bare statement) guards nothing.
     const effective = (f) => f.rejectionSeen !== false;
-    const before = ctl.filter(f => effective(f) && (firstSens === null || f.effLine < firstSens || (f.basis === 'query-filter' && f.effLine <= firstSens)));
-    const after = ctl.filter(f => firstSens !== null && f.effLine > firstSens);
+    // Ownership is the one dimension where reading before checking is the ordinary safe shape: load the record by id, refuse unless the
+    // principal owns it, and only then act on it. What an unchecked read can do is bounded by the check that follows before anything is
+    // written, so for ownership and tenant scope the line that must be preceded is the first WRITE. With no write in view the first
+    // sensitive operation of any kind still applies, so a read returned without a check is not excused.
+    const writes = sens.filter(f => f.subkind === 'write' || f.kind === 'filesystem' || f.kind === 'process');
+    const gate = dim === 'ownership' && writes.length ? Math.min(...writes.map(f => f.effLine)) : firstSens;
+    const before = ctl.filter(f => effective(f) && (gate === null || f.effLine < gate || (f.basis === 'query-filter' && f.effLine <= gate)));
+    const after = ctl.filter(f => gate !== null && f.effLine > gate);
     let state; let why;
     if (before.length) { state = 'present'; why = 'a control precedes the first sensitive operation'; }
     else if (after.length) { state = 'evaluated_and_ineffective'; why = 'every control of this kind runs after the first sensitive operation'; }

package/dist/9579.index.js

@@ -271,8 +271,12 @@ async function runHunter(focusArea, lens, ctx = {}, opts = {}) {
   }
 
   const candidates = candidatesFromParsed(parsed, focusArea, lens);
-  appendEntry(transcript, { phase: 'result', candidateCount: candidates.length });
-  return { ...base, candidates, degraded: false, reason: null };
+  // A proposed candidate with no file and line has nowhere to point and is dropped; say how many, so a reply full of them
+  // does not read as a reply that found nothing.
+  const proposed = Array.isArray(parsed?.candidates) ? parsed.candidates.length : 0;
+  const discarded = proposed - candidates.length;
+  appendEntry(transcript, { phase: 'result', candidateCount: candidates.length, discarded });
+  return { ...base, candidates, degraded: false, reason: null, discarded };
 }
 
 // EXTERNAL MODULE: ./src/discovery/confirm.js
@@ -733,7 +737,7 @@ function makeTaintProbe(perFileIR, callGraph) {
 
 async function runDeepAnalysisSafe(perFileIR, callGraph) {
   try {
-    const { runDeepAnalysis } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 72555));
+    const { runDeepAnalysis } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 18561));
     return runDeepAnalysis(perFileIR, callGraph, {});
   } catch {
     return null;
@@ -835,7 +839,9 @@ async function runDiscovery(ctx = {}, opts = {}) {
   const budget = makeBudget(opts);
   // PRD C4 — what previous runs already judged. scanRoot absent => no memory,
   // which is the correct default for a library call with nowhere to persist.
-  const memory = opts.scanRoot ? loadMemory(opts.scanRoot) : null;
+  let memory = opts.scanRoot ? loadMemory(opts.scanRoot) : null;
+  // `--forget-refuted`: a model, a ruleset or the code changed, so what an earlier run refuted is worth examining again.
+  if (memory && opts.forgetRefuted) memory = forgetRefuted(memory);
   // Every LLM call in this pipeline goes through this one wrapped callback.
   const llmInvoke = budget.wrap(opts.llmInvoke);
 
@@ -870,6 +876,7 @@ async function runDiscovery(ctx = {}, opts = {}) {
       const run = await runHunter(area, lens, { fileContents: ctx.fileContents || {}, scanRoot: opts.scanRoot }, { llmInvoke, scanRoot: opts.scanRoot });
       runs.push({ focusAreaId: run.focusAreaId, lens: run.lens, degraded: run.degraded, reason: run.reason, candidateCount: run.candidates.length });
       if (run.degraded && run.reason) reasons.push(`${area.label} × ${lens.key}: ${run.reason}`);
+      if (run.discarded > 0) reasons.push(`${area.label} × ${lens.key}: ${run.discarded} proposed candidate(s) had no usable file and line and were discarded`);
       if (run.degraded) areaDegradedCount += 1;
       else hunted.add(area.id);
       candidates = candidates.concat(run.candidates);