@clear-capabilities/agentic-security-scanner 0.184.0 → 0.186.1

package/dist/9481.index.js

@@ -1,220 +0,0 @@
-export const id = 9481;
-export const ids = [9481];
-export const modules = {
-
-/***/ 39481:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-__webpack_require__.r(__webpack_exports__);
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   PROOF_MARKER: () => (/* binding */ PROOF_MARKER),
-/* harmony export */   WITNESS_STATUS: () => (/* binding */ WITNESS_STATUS),
-/* harmony export */   WITNESS_VERSION: () => (/* binding */ WITNESS_VERSION),
-/* harmony export */   buildNixScriptWitness: () => (/* binding */ buildNixScriptWitness),
-/* harmony export */   haskellRunner: () => (/* binding */ haskellRunner),
-/* harmony export */   judgeFixWitness: () => (/* binding */ judgeFixWitness),
-/* harmony export */   nixFixWitness: () => (/* binding */ nixFixWitness),
-/* harmony export */   nixFlowTarget: () => (/* binding */ nixFlowTarget),
-/* harmony export */   runHaskellWitness: () => (/* binding */ runHaskellWitness),
-/* harmony export */   runNixScriptWitness: () => (/* binding */ runNixScriptWitness),
-/* harmony export */   witnessNixFlow: () => (/* binding */ witnessNixFlow),
-/* harmony export */   witnessPayload: () => (/* binding */ witnessPayload)
-/* harmony export */ });
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
-/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(48161);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(31421);
-/* harmony import */ var _sandbox_index_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(99583);
-/* harmony import */ var _nix_script_taint_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(89928);
-// Controlled proof witnesses for Haskell and Nix findings (X-009).
-//
-// A witness is a small, bounded program that DEMONSTRATES the predicted effect inside the confinement sandbox
-// (src/sandbox: writes confined to a temporary root, no network, wall-clock and resource limits, fail-closed when no
-// primitive is available). The effect is always the same observable: the witness payload creates the marker file
-// `PROVEN` in its working directory. Nothing else counts.
-//
-// Supported witnesses, stated explicitly:
-//
-//   nix-shell   A shell script a Nix expression generates (systemd script, build phase). The generated script text is
-//               taken from the NIX-003 analysis, the interpolation the finding concerns is replaced by an attacker
-//               payload shaped for its shell context and passed through the SAME escaping the Nix code applies
-//               (lib.escapeShellArg), and the script is run for real by the host shell. The payload is only shell
-//               text: it runs only inside the sandbox, and only `touch PROVEN` is ever asked of it.
-//   haskell     Needs a Haskell toolchain (runghc). Without one the result is `unavailable`, which is neither proof
-//               nor refutation. This module never installs or downloads a toolchain.
-//
-// What is NOT proof, ever: a syntax error in the witness, a missing executable, a sandbox that could not start or was
-// refused, a timeout or resource limit, or an output cap. Each is reported as `invalid` with its reason and leaves
-// the finding's static proof tier unchanged. Only the marker proves; its absence after a clean run is
-// `not-reproduced`, which is evidence about THIS witness, not a proof that the code is safe.
-
-
-
-
-
-
-
-
-const WITNESS_VERSION = 'language-witness/1';
-const PROOF_MARKER = 'PROVEN';
-const WITNESS_STATUS = Object.freeze(['reproduced', 'not-reproduced', 'invalid', 'unavailable', 'unsupported']);
-const SHELLS = new Set(['bash', 'sh', 'dash', 'ash', 'ksh', 'mksh']);
-const DEFAULT_TIMEOUT_MS = 20_000;
-const MAX_SCRIPT_BYTES = 256 * 1024;
-
-const shEscape = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
-
-/** The text one placeholder takes in the generated script, given the Nix-side protection and the shell context. */
-function witnessPayload(context, protection) {
-  const cmd = `touch ${PROOF_MARKER}`;
-  let raw;
-  if (context === 'single') raw = `'; ${cmd}; echo '`;
-  else if (context === 'double') raw = `$(${cmd})`;
-  else raw = `$(${cmd})`;
-  // escapeShellArg(s) wraps in single quotes at EVALUATION time, before the shell ever sees the text. The shell then
-  // reads that result inside whatever quote context the script put it in, which is exactly the wrong-context case.
-  if (protection === 'escapeShellArg') return shEscape(raw);
-  if (protection === 'escapeShellArgs') return shEscape(raw);
-  return raw;
-}
-
-const placeholderIndexes = (text) => { const out = []; for (let i = 0; i < text.length; i++) if (text[i] === _nix_script_taint_js__WEBPACK_IMPORTED_MODULE_5__/* .SHELL_PLACEHOLDER */ .v0) out.push(i); return out; };
-const indexOfPosition = (text, line, col) => { let l = 1; let i = 0; while (i < text.length && l < line) { if (text[i] === '\n') l++; i++; } return i + col; };
-
-/**
- * Builds a witness for one flow of one generated script.
- * @param {{script:{generated:string, shell:string|null, attrPath:string, file:string}, flow:{generatedLocation:{line:number,startColumn:number}, context:string, protection:string|null}}} t
- */
-function buildNixScriptWitness({ script, flow }) {
-  if (!script || typeof script.generated !== 'string' || !flow || !flow.generatedLocation) return { status: 'unsupported', reason: 'the flow has no generated-script location' };
-  const shell = script.shell || 'bash';
-  if (!SHELLS.has(shell)) return { status: 'unsupported', reason: `shell "${shell}" is not supported by the witness runner` };
-  if (Buffer.byteLength(script.generated) > MAX_SCRIPT_BYTES) return { status: 'unsupported', reason: 'the generated script exceeds the witness size limit' };
-  const all = placeholderIndexes(script.generated);
-  const at = indexOfPosition(script.generated, flow.generatedLocation.line, flow.generatedLocation.startColumn);
-  const ordinal = all.indexOf(at);
-  if (ordinal < 0) return { status: 'unsupported', reason: 'the flow location does not match an interpolation in the generated script' };
-  const payload = witnessPayload(flow.context, flow.protection);
-  let out = ''; let n = 0;
-  for (const ch of script.generated) { if (ch === _nix_script_taint_js__WEBPACK_IMPORTED_MODULE_5__/* .SHELL_PLACEHOLDER */ .v0) { out += n === ordinal ? payload : 'benign'; n++; } else out += ch; }
-  const body = out.replace(/^#!.*\n/, '');
-  return { status: 'ready', lang: 'nix-shell', shell, ordinal, attrPath: script.attrPath, file: script.file, payload, code: `${body}\n`, context: flow.context, protection: flow.protection || null };
-}
-
-function which(name) {
-  for (const d of String(process.env.PATH || '').split(node_path__WEBPACK_IMPORTED_MODULE_2__.delimiter)) { const p = node_path__WEBPACK_IMPORTED_MODULE_2__.join(d, name); try { node_fs__WEBPACK_IMPORTED_MODULE_0__.accessSync(p, node_fs__WEBPACK_IMPORTED_MODULE_0__.constants.X_OK); return p; } catch { /* next */ } }
-  return null;
-}
-
-/** Runs a witness built by buildNixScriptWitness inside the confinement sandbox. Never throws. */
-function runNixScriptWitness(w, { timeoutMs = DEFAULT_TIMEOUT_MS, force } = {}) {
-  const base = { witness: WITNESS_VERSION, lang: 'nix-shell', ran: false, backend: null, marker: PROOF_MARKER };
-  if (!w || w.status !== 'ready') return { ...base, status: w && w.status === 'unsupported' ? 'unsupported' : 'invalid', reason: (w && w.reason) || 'no witness' };
-  const shellBin = which(w.shell);
-  if (!shellBin) return { ...base, status: 'invalid', reason: `executable not found: ${w.shell}` };
-  if (!(0,_sandbox_index_js__WEBPACK_IMPORTED_MODULE_4__/* .sandboxAvailable */ .$G)()) return { ...base, status: 'invalid', reason: 'no confinement primitive available; refusing to execute' };
-  let root;
-  try {
-    root = node_fs__WEBPACK_IMPORTED_MODULE_0__.realpathSync(node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(node_os__WEBPACK_IMPORTED_MODULE_1__.tmpdir(), 'witness-')));
-    node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(root, 'witness.sh'), w.code, 'utf8');
-    // 1. a witness that does not parse proves nothing in either direction
-    const syn = (0,_sandbox_index_js__WEBPACK_IMPORTED_MODULE_4__/* .runConfined */ .id)([shellBin, '-n', 'witness.sh'], { root, timeoutMs, force });
-    if (syn.status === 'disabled' || syn.status === 'error') return { ...base, backend: syn.backend, status: 'invalid', reason: `the sandbox could not run the syntax check (${syn.backend}): ${String(syn.stderr || '').trim() || 'no detail'}` };
-    if (syn.timedOut) return { ...base, backend: syn.backend, status: 'invalid', reason: 'the syntax check exceeded its time budget', timedOut: true };
-    if (syn.exitCode !== 0) return { ...base, backend: syn.backend, status: 'invalid', reason: `syntax error in the generated witness: ${String(syn.stderr || '').trim().split('\n')[0] || 'shell rejected it'}` };
-    // 2. the real run
-    const r = (0,_sandbox_index_js__WEBPACK_IMPORTED_MODULE_4__/* .runConfined */ .id)([shellBin, 'witness.sh'], { root, timeoutMs, force });
-    const ran = !r.timedOut && r.status !== 'disabled' && r.status !== 'error';
-    if (!ran) return { ...base, backend: r.backend, status: 'invalid', reason: r.timedOut ? 'the witness exceeded its time budget' : `the sandbox could not execute it (${r.backend}): ${String(r.stderr || '').trim() || r.status}`, timedOut: !!r.timedOut };
-    const proven = node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(root, PROOF_MARKER));
-    return { ...base, ran: true, backend: r.backend, status: proven ? 'reproduced' : 'not-reproduced', exitCode: r.exitCode,
-      observed: proven ? `the payload created '${PROOF_MARKER}' by running inside the generated script` : null,
-      reason: proven ? null : 'the script ran and the marker was not created: this witness did not reproduce the effect' };
-  } catch (e) {
-    return { ...base, status: 'invalid', reason: `witness harness error: ${String((e && e.message) || e)}` };
-  } finally { if (root) node_fs__WEBPACK_IMPORTED_MODULE_0__.rmSync(root, { recursive: true, force: true }); }
-}
-
-/** Finds the flow for (attrPath, ordinal) in a fresh analysis of `files`, and builds+runs its witness. */
-function witnessNixFlow(files, target, opts = {}) {
-  const a = (0,_nix_script_taint_js__WEBPACK_IMPORTED_MODULE_5__/* .analyzeNixScripts */ .S3)({ files });
-  const script = a.scripts.find((s) => s.attrPath === target.attrPath && (!target.file || s.file === target.file));
-  if (!script) return { status: 'unsupported', ran: false, reason: `no generated script ${target.attrPath}` };
-  const idx = placeholderIndexes(script.generated);
-  const flow = a.flows.find((f) => f.attrPath === script.attrPath && f.generatedLocation && idx.indexOf(indexOfPosition(script.generated, f.generatedLocation.line, f.generatedLocation.startColumn)) === target.ordinal);
-  if (!flow) return { status: 'unsupported', ran: false, reason: `no interpolation #${target.ordinal} in ${target.attrPath}` };
-  return runNixScriptWitness(buildNixScriptWitness({ script, flow }), opts);
-}
-
-/** The (attrPath, ordinal) of the flow a finding describes, taken from a fresh analysis. */
-function nixFlowTarget(files, finding) {
-  const a = (0,_nix_script_taint_js__WEBPACK_IMPORTED_MODULE_5__/* .analyzeNixScripts */ .S3)({ files });
-  const flow = a.flows.find((f) => f.file === finding.file && f.line === finding.line && f.attrPath && f.generatedLocation)
-    || a.flows.find((f) => f.file === finding.file && f.attrPath === finding.attrPath && f.generatedLocation);
-  if (!flow) return null;
-  const script = a.scripts.find((s) => s.attrPath === flow.attrPath && s.file === (flow.generatedLocation.file || finding.file));
-  if (!script) return null;
-  const ordinal = placeholderIndexes(script.generated).indexOf(indexOfPosition(script.generated, flow.generatedLocation.line, flow.generatedLocation.startColumn));
-  return ordinal < 0 ? null : { attrPath: script.attrPath, file: script.file, ordinal };
-}
-
-/**
- * Before/after judgement for a fix. A fix is witness-verified only when the ORIGINAL reproduced and the PATCHED code
- * ran cleanly without reproducing. Anything invalid on either side verifies nothing.
- */
-function judgeFixWitness(before, after) {
-  if (!before || before.status !== 'reproduced') return { ok: false, verified: false, reason: `the original code did not reproduce (${(before && before.status) || 'no witness'}${before && before.reason ? `: ${before.reason}` : ''}), so the fix cannot be witness-verified` };
-  if (!after || after.status === 'invalid' || after.status === 'unavailable' || after.status === 'unsupported') return { ok: false, verified: false, reason: `the patched witness could not be judged (${(after && after.status) || 'no witness'}${after && after.reason ? `: ${after.reason}` : ''})` };
-  if (after.status === 'reproduced') return { ok: false, verified: false, stillReproduces: true, reason: 'the patched code still reproduces the effect' };
-  return { ok: true, verified: true, reason: null, note: 'the witness reproduced before the patch and not after; this is evidence about this witness, not a proof of safety' };
-}
-
-// ── Haskell: optional, toolchain-gated ───────────────────────────────────────
-/** Whether a Haskell runner exists. Never installs anything. */
-function haskellRunner() {
-  const p = which('runghc') || which('runhaskell');
-  if (!p) return { available: false, reason: 'no Haskell toolchain (runghc) on PATH; witnesses for Haskell findings are unavailable here' };
-  // GHC's first start on a cold, loaded machine (a CI runner) has taken more than 10 s; a probe that gives up there reports a toolchain
-  // that is installed as absent, and the answer then differs between two calls in one run.
-  const v = (0,node_child_process__WEBPACK_IMPORTED_MODULE_3__.spawnSync)(p, ['--version'], { encoding: 'utf8', timeout: 60_000 });
-  return v.status === 0 ? { available: true, path: p, version: String(v.stdout || v.stderr).trim() } : { available: false, reason: v.error && v.error.code === 'ETIMEDOUT' ? 'the Haskell runner did not start within 60 s' : 'the Haskell runner did not start' };
-}
-
-/**
- * Runs a Haskell program text as a witness. `main` must create PROVEN in its working directory when the effect is
- * reproduced. Without a toolchain the answer is `unavailable`: not proof, not refutation.
- */
-function runHaskellWitness(source, { timeoutMs = 60_000, force } = {}) {
-  const base = { witness: WITNESS_VERSION, lang: 'haskell', ran: false, backend: null, marker: PROOF_MARKER };
-  const hr = haskellRunner();
-  if (!hr.available) return { ...base, status: 'unavailable', reason: hr.reason };
-  if (!(0,_sandbox_index_js__WEBPACK_IMPORTED_MODULE_4__/* .sandboxAvailable */ .$G)()) return { ...base, status: 'invalid', reason: 'no confinement primitive available; refusing to execute' };
-  let root;
-  try {
-    root = node_fs__WEBPACK_IMPORTED_MODULE_0__.realpathSync(node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(node_os__WEBPACK_IMPORTED_MODULE_1__.tmpdir(), 'witness-hs-')));
-    node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(root, 'Witness.hs'), source, 'utf8');
-    const r = (0,_sandbox_index_js__WEBPACK_IMPORTED_MODULE_4__/* .runConfined */ .id)([hr.path, 'Witness.hs'], { root, timeoutMs, force });
-    if (r.status === 'disabled' || r.status === 'error') return { ...base, backend: r.backend, status: 'invalid', reason: `the sandbox could not execute it: ${String(r.stderr || '').trim() || r.status}` };
-    if (r.timedOut) return { ...base, backend: r.backend, status: 'invalid', reason: 'the witness exceeded its time budget', timedOut: true };
-    if (/error|parse error|Could not find module/i.test(String(r.stderr || '')) && r.exitCode !== 0) return { ...base, backend: r.backend, status: 'invalid', reason: `the program did not compile or run: ${String(r.stderr).trim().split('\n')[0]}` };
-    const proven = node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(root, PROOF_MARKER));
-    return { ...base, ran: true, backend: r.backend, status: proven ? 'reproduced' : 'not-reproduced', exitCode: r.exitCode, reason: proven ? null : 'the program ran and the marker was not created' };
-  } catch (e) {
-    return { ...base, status: 'invalid', reason: `witness harness error: ${String((e && e.message) || e)}` };
-  } finally { if (root) node_fs__WEBPACK_IMPORTED_MODULE_0__.rmSync(root, { recursive: true, force: true }); }
-}
-
-/** A `witness` hook for runFixLifecycle over a Nix generated-script finding: runs the original and the patched tree. */
-function nixFixWitness(finding, opts = {}) {
-  return (plan, files, patched) => {
-    const nixOnly = (t) => Object.fromEntries(Object.entries(t).filter(([p, x]) => /\.nix$/i.test(p) && typeof x === 'string'));
-    const target = nixFlowTarget(nixOnly(files), finding);
-    if (!target) return { ok: false, verified: false, reason: 'the finding is not a generated-script interpolation, so no witness applies' };
-    return judgeFixWitness(witnessNixFlow(nixOnly(files), target, opts), witnessNixFlow(nixOnly(patched), target, opts));
-  };
-}
-
-
-/***/ })
-
-};

package/dist/9539.index.js

@@ -1,100 +0,0 @@
-export const id = 9539;
-export const ids = [9539];
-export const modules = {
-
-/***/ 89539:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   diffScenarioGraph: () => (/* binding */ diffScenarioGraph)
-/* harmony export */ });
-/* unused harmony export WATCHED_SCENARIO_FIELDS */
-// scenario-diff.js — M5 deliverable #3a (FR-502): a dedicated
-// comparison for a Scenario's own simulated graph delta. Deliberately
-// NOT graph-diff.js's computeGraphDiff — see this sub-project's own
-// scoping doc for the full reasoning: computeGraphDiff's flow-
-// reidentification pairing and causeClassification vocabulary
-// (`'application_change'`, `'possible_coverage_regression'`,
-// `'reidentified'`) are shaped for a REAL rescan across two commits,
-// where the cause of a change is genuinely ambiguous. A Scenario's own
-// delta has no such ambiguity — every difference between the base graph
-// and a scenario clone IS the declared hypothetical operation that
-// produced it — so this module reports only "what differs", with no
-// cause classification and no reidentification.
-
-const WATCHED_SCENARIO_FIELDS = Object.freeze({
-  // 'destination' + 'storeDetail' are exhaustive by construction, not by
-  // convention: change_storage_fact/change_governance_fact write into an
-  // already-watched CONTAINER object, so any field they set is caught
-  // regardless of key; replace_recipient_fact is the one operation that
-  // writes directly onto the node's own top level, and scenario-engine.js
-  // restricts it, at the applier level, to exactly node.destination (any
-  // other `field` value is skipped, never applied) — so this list never
-  // needs to name a field replace_recipient_fact could reach beyond
-  // 'destination'. See scenario-engine.js's _applyReplaceRecipientFact.
-  node: Object.freeze(['destination', 'storeDetail']),
-  edge: Object.freeze(['protection.transit', 'protection.atRest', 'protection.handling']),
-  flow: Object.freeze(['policyVerdict', 'protectionSummary', 'governanceRefs']),
-});
-
-function _get(obj, dottedPath) {
-  return dottedPath.split('.').reduce((v, k) => (v == null ? v : v[k]), obj);
-}
-
-function _deepEqual(a, b) { return JSON.stringify(a) === JSON.stringify(b); }
-
-function _byId(arr) { return new Map((arr ?? []).map((x) => [x.id, x])); }
-
-function _diffKind(beforeArr, afterArr, kind) {
-  const beforeMap = _byId(beforeArr);
-  const afterMap = _byId(afterArr);
-  const changed = [];
-  const removed = [];
-  for (const [id, beforeEntity] of beforeMap) {
-    const afterEntity = afterMap.get(id);
-    if (!afterEntity) { removed.push(id); continue; }
-    const changedFields = [];
-    for (const field of WATCHED_SCENARIO_FIELDS[kind]) {
-      const before = _get(beforeEntity, field);
-      const after = _get(afterEntity, field);
-      if (!_deepEqual(before, after)) changedFields.push({ field, before, after });
-    }
-    if (changedFields.length) changed.push({ id, kind, changedFields });
-  }
-  return { changed, removed };
-}
-
-// AC-26 ("What-if changes cannot masquerade as implementation"): a
-// simulated edge must be LABELED `HYPOTHETICAL`, not merely carry an
-// `evidenceGrade: 'assumed'` value a reader has to notice buried inside
-// a before/after diff. Mirrors AC-29's own precedent
-// (`observation-correlation.js`'s literal `'runtime_observed'` layer
-// value) — a named acceptance criterion that specifies an exact string
-// gets an exact string in the shipped output, not an inference left to
-// the reader.
-function _hasAssumedEvidence(changedEntity) {
-  return changedEntity.changedFields.some((f) => f.after && typeof f.after === 'object' && f.after.evidenceGrade === 'assumed');
-}
-
-/**
- * Compare `baseGraph` against `scenarioGraph` (either a real
- * applyScenario({graph}) result, or another Scenario's own graph, for a
- * scenario-vs-scenario comparison). Never throws — an empty/missing
- * entity array on either side is treated as zero entities.
- */
-function diffScenarioGraph(baseGraph, scenarioGraph) {
-  const nodeDiff = _diffKind(baseGraph.nodes ?? [], scenarioGraph.nodes ?? [], 'node');
-  const edgeDiff = _diffKind(baseGraph.edges ?? [], scenarioGraph.edges ?? [], 'edge');
-  const flowDiff = _diffKind(baseGraph.flows ?? [], scenarioGraph.flows ?? [], 'flow');
-  const changedEntities = [...nodeDiff.changed, ...edgeDiff.changed, ...flowDiff.changed]
-    .map((e) => (e.kind === 'edge' && _hasAssumedEvidence(e) ? { ...e, label: 'HYPOTHETICAL' } : e));
-  return {
-    changedEntities,
-    removedEntityIds: [...nodeDiff.removed, ...edgeDiff.removed, ...flowDiff.removed],
-  };
-}
-
-
-/***/ })
-
-};

package/dist/9547.index.js

@@ -1,103 +0,0 @@
-export const id = 9547;
-export const ids = [9547];
-export const modules = {
-
-/***/ 89547:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   sweepHaskellSiblings: () => (/* binding */ sweepHaskellSiblings)
-/* harmony export */ });
-/* unused harmony export HS_SWEEP_VERSION */
-/* harmony import */ var _dataflow_catalog_haskell_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(93722);
-/* harmony import */ var _lineage_source_seeding_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(31284);
-// Root-cause sweep for Haskell (X-008). The generic sweep anchors on a `callee(args)` text shape, which Haskell's
-// juxtaposition syntax never produces, so a confirmed Haskell finding swept nothing. This sweep works on the IR: for
-// each confirmed finding it takes the RESOLVED sink callee from the model catalog and lists every other call of that
-// same callee in the project, then accounts for all of them:
-//
-//     found === candidates + mitigated
-//
-// `found` is every other call site of the callee (the finding's own site, and the sites of other findings in the same
-// group, are the origins and are excluded). `mitigated` is a site where a detector already produced a finding for a
-// different reason, `candidates` is the rest. A candidate whose argument is a literal constant is flagged
-// (`constantArgument`) and stays a candidate: the flag is information, not a verdict. Nothing is dropped.
-//
-// Resolution is by import-qualified callee, so an unrelated function that merely shares a name is not a sibling.
-
-
-
-
-const HS_SWEEP_VERSION = 'haskell-sweep/1';
-const SAMPLE_LIMIT = 100;
-const isHs = (f) => /\.l?hs$/i.test(f || '');
-const BY_ID = new Map(_dataflow_catalog_haskell_js__WEBPACK_IMPORTED_MODULE_0__/* .HASKELL_CATALOG */ .R.filter((e) => e.kind === 'sink').map((e) => [e.id, e]));
-
-const allConstant = (e) => {
-  let constant = true; let sawLiteral = false;
-  (0,_lineage_source_seeding_js__WEBPACK_IMPORTED_MODULE_1__/* .walkExpr */ .lN)(e, (x) => {
-    if (x.kind === 'literal') sawLiteral = true;
-    else if (x.kind === 'ident' && !(x.hs && x.hs.functionRef)) constant = false;
-    else if (x.kind === 'member') constant = false;
-  });
-  return constant && sawLiteral;
-};
-
-/**
- * @param {object[]} findings confirmed findings (only Haskell IR-taint findings are swept)
- * @param {{functions: Map}} callGraph the project call graph (ir/index.js buildProjectIR)
- */
-function sweepHaskellSiblings(findings, callGraph) {
-  const groups = new Map();
-  for (const f of findings || []) {
-    if (!f || !isHs(f.file) || f.parser !== 'IR-TAINT' || !f.sink || !f.sink.label) continue;
-    const entry = BY_ID.get(f.sink.label);
-    if (!entry || !entry.match || !entry.match.callee) continue;
-    const key = entry.match.callee;
-    if (!groups.has(key)) groups.set(key, { callee: key, entry, findings: [] });
-    groups.get(key).findings.push(f);
-  }
-  const sites = new Map();                                  // callee -> [{file, line, constantArgument}]
-  const wanted = new Set(groups.keys());
-  for (const fn of callGraph && callGraph.functions ? callGraph.functions.values() : []) {
-    if (!isHs(fn.file) || !fn.cfg) continue;
-    for (const node of Object.values(fn.cfg.nodes)) {
-      const visit = (e) => {
-        if (e.kind === 'call' && typeof e.callee === 'string' && wanted.has(e.callee)) {
-          const entry = groups.get(e.callee).entry;
-          const arg = (e.args || [])[entry.argIndex || 0];
-          if (!sites.has(e.callee)) sites.set(e.callee, []);
-          sites.get(e.callee).push({ file: fn.file, line: e.line || node.line || null, constantArgument: arg ? allConstant(arg) : false });
-        }
-      };
-      if (node.kind === 'call' && typeof node.callee === 'string' && wanted.has(node.callee)) visit(node);
-      for (const root of (0,_lineage_source_seeding_js__WEBPACK_IMPORTED_MODULE_1__/* .exprRoots */ .Zf)(node)) (0,_lineage_source_seeding_js__WEBPACK_IMPORTED_MODULE_1__/* .walkExpr */ .lN)(root, visit);
-    }
-  }
-  const covered = new Map();                                // "file:line" -> true, any finding at that site
-  for (const f of findings || []) if (f && f.file && Number.isInteger(f.line)) covered.set(`${f.file}:${f.line}`, true);
-  const sweeps = [];
-  const totals = { found: 0, candidates: 0, mitigated: 0 };
-  for (const [callee, g] of [...groups.entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
-    const origin = new Set(g.findings.map((f) => `${f.file}:${f.line}`));
-    const seen = new Set(); const all = [];
-    for (const s of sites.get(callee) || []) { const k = `${s.file}:${s.line}`; if (origin.has(k) || seen.has(k)) continue; seen.add(k); all.push(s); }
-    all.sort((a, b) => (a.file + String(a.line)).localeCompare(b.file + String(b.line), undefined, { numeric: true }));
-    const instances = all.map((s) => ({ ...s, status: covered.has(`${s.file}:${s.line}`) ? 'mitigated' : 'candidate' }));
-    const mitigated = instances.filter((i) => i.status === 'mitigated').length;
-    const candidates = instances.length - mitigated;
-    sweeps.push({
-      callee, cwe: g.entry.vuln.cwe, family: g.entry.hs && g.entry.hs.family, origins: [...origin].sort(), findingIds: g.findings.map((f) => f.id).sort(),
-      found: instances.length, candidates, mitigated, constantArgumentCandidates: instances.filter((i) => i.status === 'candidate' && i.constantArgument).length,
-      instances: instances.slice(0, SAMPLE_LIMIT), instancesTruncated: instances.length > SAMPLE_LIMIT, remaining: candidates,
-      note: 'siblings are other calls of the same import-qualified sink; a candidate is unreviewed, not vulnerable',
-    });
-    totals.found += instances.length; totals.candidates += candidates; totals.mitigated += mitigated;
-  }
-  return { version: HS_SWEEP_VERSION, sweeps, totals };
-}
-
-
-/***/ })
-
-};

package/dist/9692.index.js

@@ -1,90 +0,0 @@
-export const id = 9692;
-export const ids = [9692];
-export const modules = {
-
-/***/ 99692:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   extractImagePackages: () => (/* binding */ extractImagePackages)
-/* harmony export */ });
-/* unused harmony exports parseDpkgStatus, parseApkInstalled */
-// R8 (PRD §5) — container-image OS-package inventory.
-//
-// container.js reads the Dockerfile (FROM + apt/apk install lines). This reads
-// the ACTUAL installed-package databases from an extracted image filesystem
-// (or the host), catching packages baked into the base image that the
-// Dockerfile never names. Components flow into the existing OSV pipeline + SBOM.
-//
-// Pure parsers (unit-tested) + a path-matching extractor. No daemon; reads the
-// package-DB files that appear when an image layer/tarball is unpacked.
-
-// Debian/Ubuntu: /var/lib/dpkg/status — RFC822-style blocks separated by blank
-// lines. Only "install ok installed" entries count (not removed/config-files).
-function parseDpkgStatus(text) {
-  const out = [];
-  for (const block of String(text || '').split(/\n\s*\n/)) {
-    const name = (block.match(/^Package:\s*(.+)$/m) || [])[1];
-    const version = (block.match(/^Version:\s*(.+)$/m) || [])[1];
-    const status = (block.match(/^Status:\s*(.+)$/m) || [])[1] || '';
-    if (!name || !version) continue;
-    if (!/\binstalled\b/.test(status)) continue;
-    out.push({ name: name.trim(), version: version.trim(), ecosystem: 'Debian' });
-  }
-  return out;
-}
-
-// Alpine: /lib/apk/db/installed — blocks separated by blank lines; P:=name V:=version.
-function parseApkInstalled(text) {
-  const out = [];
-  for (const block of String(text || '').split(/\n\s*\n/)) {
-    const name = (block.match(/^P:(.+)$/m) || [])[1];
-    const version = (block.match(/^V:(.+)$/m) || [])[1];
-    if (!name || !version) continue;
-    out.push({ name: name.trim(), version: version.trim(), ecosystem: 'Alpine' });
-  }
-  return out;
-}
-
-const _PURL = { Debian: (n, v) => `pkg:deb/debian/${n}@${v}`, Alpine: (n, v) => `pkg:apk/alpine/${n}@${v}` };
-
-// File-path tells for an unpacked image. Match on path suffix so it works
-// whether the scan root is the rootfs or a subdirectory of it.
-function _dbKind(path) {
-  const p = path.replace(/\\/g, '/');
-  if (/(?:^|\/)var\/lib\/dpkg\/status$/.test(p)) return 'dpkg';
-  if (/(?:^|\/)lib\/apk\/db\/installed$/.test(p)) return 'apk';
-  return null;
-}
-
-/**
- * Extract OS-package components from any image package-DBs present in the scanned
- * files. Returns components in the engine's component shape so they ride the
- * existing OSV/SBOM pipeline. De-dups by ecosystem:name:version.
- */
-function extractImagePackages(fileContents) {
-  const comps = [];
-  const seen = new Set();
-  for (const [file, content] of Object.entries(fileContents || {})) {
-    const kind = _dbKind(file);
-    if (!kind) continue;
-    const pkgs = kind === 'dpkg' ? parseDpkgStatus(content) : parseApkInstalled(content);
-    for (const p of pkgs) {
-      const key = `${p.ecosystem}:${p.name}:${p.version}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      comps.push({
-        name: p.name, version: p.version, group: '', ecosystem: p.ecosystem,
-        purl: (_PURL[p.ecosystem] || (() => null))(p.name, p.version),
-        filePath: file, isUnpinned: false, isTransitive: false, isOsPackage: true,
-        scope: 'required', reachable: true,
-      });
-    }
-  }
-  return comps;
-}
-
-
-/***/ })
-
-};