@clear-capabilities/agentic-security-scanner 0.184.0 → 0.186.1

package/dist/5496.index.js

@@ -1,377 +0,0 @@
-export const id = 5496;
-export const ids = [5496,4780];
-export const modules = {
-
-/***/ 44780:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   iI: () => (/* binding */ summarizeForBadge),
-/* harmony export */   renderBadge: () => (/* binding */ renderBadge)
-/* harmony export */ });
-/* unused harmony exports badgeFromScanRoot, renderSvg, _internal */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
-/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(69259);
-// Live SVG badge generator (v0.72).
-//
-// Every repo can drop a badge in its README pulling from the latest scan:
-//
-//   ![agentic-security](https://agentic-security.dev/badge?repo=<slug>)
-//
-// or self-hosted via the CLI subcommand emitting an inline <img> URL or
-// a static SVG. The badge format borrows from shields.io for visual
-// consistency. Reads from .agentic-security/last-scan.json or accepts a
-// scan object directly.
-//
-// Output formats:
-//   - 'svg'  — inline SVG string (default; the bytes you'd serve)
-//   - 'json' — { label, count, color, severity } for a frontend renderer
-//
-// Style variants:
-//   - 'flat'         — shields.io flat
-//   - 'for-the-badge' — caps + thicker
-//
-// Color is driven by the highest non-zero severity:
-//   critical → red
-//   high     → orange
-//   medium   → yellow
-//   low      → blue
-//   info     → lightgrey
-//   none     → brightgreen
-
-
-
-
-
-const COLORS = {
-  critical:    '#e05d44',  // red
-  high:        '#fe7d37',  // orange
-  medium:      '#dfb317',  // yellow
-  low:         '#007ec6',  // blue
-  info:        '#9f9f9f',  // grey
-  none:        '#4c1',     // brightgreen
-  label:       '#555',
-};
-
-const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
-
-function _readLastScan(scanRoot) {
-  if (!scanRoot) return null;
-  const fp = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, 'last-scan.json');
-  if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return null;
-  try { return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8')); }
-  catch { return null; }
-}
-
-function _ageString(ts) {
-  if (!ts) return null;
-  const ageMs = Date.now() - new Date(ts).getTime();
-  if (isNaN(ageMs) || ageMs < 0) return null;
-  const min = Math.floor(ageMs / 60_000);
-  if (min < 60) return `${min}m ago`;
-  const hr = Math.floor(min / 60);
-  if (hr < 24) return `${hr}h ago`;
-  const day = Math.floor(hr / 24);
-  return `${day}d ago`;
-}
-
-/**
- * Compute the badge value from a scan object.
- *
- * Returns:
- *   {
- *     label:    'agentic-security',
- *     summary:  'critical 0 · high 2 · medium 5' | 'passing' | 'no scan',
- *     color:    '#fe7d37',
- *     highest:  'high' | 'none' | 'unknown',
- *     ageStr:   '4h ago' | null,
- *     counts:   { critical, high, medium, low, info },
- *     total:    7,
- *   }
- */
-function summarizeForBadge(scan) {
-  if (!scan || !Array.isArray(scan.findings)) {
-    return {
-      label: 'agentic-security',
-      summary: 'no scan',
-      color: COLORS.info,
-      highest: 'unknown',
-      ageStr: null,
-      counts: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
-      total: 0,
-    };
-  }
-  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-  for (const f of scan.findings) {
-    const s = f.severity || 'info';
-    if (counts[s] !== undefined) counts[s]++;
-  }
-  let highest = 'none';
-  for (const s of SEVERITIES) { if (counts[s] > 0) { highest = s; break; } }
-  const color = COLORS[highest] || COLORS.info;
-  const summary = highest === 'none'
-    ? 'passing'
-    : `crit ${counts.critical} · high ${counts.high} · med ${counts.medium}`;
-  const total = SEVERITIES.reduce((a, s) => a + counts[s], 0);
-  return {
-    label: 'agentic-security',
-    summary,
-    color,
-    highest,
-    ageStr: _ageString(scan.timestamp || scan.when || scan.lastScan),
-    counts,
-    total,
-  };
-}
-
-/**
- * Compute the badge from .agentic-security/last-scan.json under `scanRoot`.
- */
-function badgeFromScanRoot(scanRoot) {
-  return summarizeForBadge(_readLastScan(scanRoot));
-}
-
-function _xmlEscape(s) {
-  return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-}
-
-function _textWidth(s) {
-  // Rough character width — works fine for the small badge label range.
-  return s.length * 7 + 10;
-}
-
-/**
- * Render an inline SVG matching shields.io's flat style. Self-contained
- * (no external font references) so the badge works in any README.
- */
-function renderSvg(b, opts = {}) {
-  if (!b) b = summarizeForBadge(null);
-  const style = opts.style || 'flat';
-  const labelText = b.label;
-  const valueText = b.ageStr ? `${b.summary} · ${b.ageStr}` : b.summary;
-  const lblW = _textWidth(labelText);
-  const valW = _textWidth(valueText);
-  const totalW = lblW + valW;
-  const h = style === 'for-the-badge' ? 28 : 20;
-  const fontSize = style === 'for-the-badge' ? 12 : 11;
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${totalW}" height="${h}" role="img" aria-label="${_xmlEscape(labelText)}: ${_xmlEscape(valueText)}">
-  <title>${_xmlEscape(labelText)}: ${_xmlEscape(valueText)}</title>
-  <linearGradient id="s" x2="0" y2="100%">
-    <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
-    <stop offset="1" stop-opacity=".1"/>
-  </linearGradient>
-  <clipPath id="r"><rect width="${totalW}" height="${h}" rx="3" fill="#fff"/></clipPath>
-  <g clip-path="url(#r)">
-    <rect width="${lblW}" height="${h}" fill="${COLORS.label}"/>
-    <rect x="${lblW}" width="${valW}" height="${h}" fill="${b.color}"/>
-    <rect width="${totalW}" height="${h}" fill="url(#s)"/>
-  </g>
-  <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="${fontSize}">
-    <text aria-hidden="true" x="${lblW / 2}" y="${h - 6}" fill="#010101" fill-opacity=".3">${_xmlEscape(labelText)}</text>
-    <text x="${lblW / 2}" y="${h - 7}">${_xmlEscape(labelText)}</text>
-    <text aria-hidden="true" x="${lblW + valW / 2}" y="${h - 6}" fill="#010101" fill-opacity=".3">${_xmlEscape(valueText)}</text>
-    <text x="${lblW + valW / 2}" y="${h - 7}">${_xmlEscape(valueText)}</text>
-  </g>
-</svg>`;
-}
-
-/**
- * Public entry: produce the badge in the requested format.
- *
- *   format: 'svg' (default) | 'json'
- *   style:  'flat' (default) | 'for-the-badge'
- *   scanRoot: directory containing .agentic-security/last-scan.json
- *   scan: pre-loaded scan object (skips disk read)
- */
-function renderBadge({ format = 'svg', style = 'flat', scanRoot, scan } = {}) {
-  const summary = summarizeForBadge(scan || _readLastScan(scanRoot));
-  if (format === 'json') {
-    return JSON.stringify({
-      schemaVersion: 1,
-      label: summary.label,
-      message: summary.summary,
-      color: summary.color,
-      highest: summary.highest,
-      ageStr: summary.ageStr,
-      counts: summary.counts,
-      total: summary.total,
-    });
-  }
-  return renderSvg(summary, { style });
-}
-
-const _internal = { COLORS, _ageString, _readLastScan };
-
-
-/***/ }),
-
-/***/ 55496:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   leaderboardRowFor: () => (/* binding */ leaderboardRowFor)
-/* harmony export */ });
-/* unused harmony exports rankRows, _internal */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
-/* harmony import */ var _badge_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(44780);
-/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(69259);
-// Leaderboard backend (v0.72).
-//
-// Generates the data shape that powers the future public leaderboard at
-// agentic-security.dev/leaderboard. The leaderboard ranks repos by their
-// security posture under our scanner — F1-on-CVE-history when we can
-// compute it, otherwise just last-scan severity counts.
-//
-// Public hosting of the site is deferred — we ship the data side now so
-// the future site is a thin frontend over this JSON.
-//
-// One leaderboard row per repo:
-//
-//   {
-//     repo: 'owner/name',
-//     score: { critical, high, medium, low, info, total },
-//     postureGrade: 'A' | 'B' | 'C' | 'D' | 'F',
-//     lastScanAge: '4h',
-//     topCwe: 'CWE-89',
-//     deltaTrend: 'improving' | 'flat' | 'regressing',
-//     badgeUrl: 'https://agentic-security.dev/badge?repo=…',
-//   }
-//
-// The grader is intentionally coarse — single letter — so the leaderboard
-// stays scannable. Tie-break by lowest critical-count, then by recency.
-
-
-
-
-
-
-// Grade thresholds. Critical findings dominate; high/medium contribute
-// secondarily. These numbers are heuristic — calibrate against the
-// public leaderboard corpus once data lands.
-function _postureGrade(counts) {
-  if (!counts) return 'F';
-  const c = counts.critical || 0;
-  const h = counts.high || 0;
-  const m = counts.medium || 0;
-  if (c === 0 && h === 0 && m === 0) return 'A';
-  if (c === 0 && h === 0 && m <= 5)  return 'B';
-  if (c === 0 && h <= 2)             return 'C';
-  if (c <= 1 && h <= 5)              return 'D';
-  return 'F';
-}
-
-function _ageString(ts) {
-  if (!ts) return null;
-  const ageMs = Date.now() - new Date(ts).getTime();
-  if (isNaN(ageMs) || ageMs < 0) return null;
-  const min = Math.floor(ageMs / 60_000);
-  if (min < 60) return `${min}m`;
-  const hr = Math.floor(min / 60);
-  if (hr < 24) return `${hr}h`;
-  const day = Math.floor(hr / 24);
-  return `${day}d`;
-}
-
-function _topCwe(scan) {
-  if (!scan || !Array.isArray(scan.findings)) return null;
-  const counts = new Map();
-  for (const f of scan.findings) {
-    if (!f.cwe) continue;
-    counts.set(f.cwe, (counts.get(f.cwe) || 0) + 1);
-  }
-  let topCwe = null, topN = 0;
-  for (const [cwe, n] of counts) {
-    if (n > topN) { topCwe = cwe; topN = n; }
-  }
-  return topCwe;
-}
-
-function _deltaTrend(history) {
-  // history: array of past scan summaries with `.timestamp` + `.severityCounts.critical`
-  if (!Array.isArray(history) || history.length < 2) return 'flat';
-  const recent = history.slice(-3);
-  const first = recent[0].severityCounts || {};
-  const last = recent[recent.length - 1].severityCounts || {};
-  const fScore = (first.critical || 0) * 4 + (first.high || 0);
-  const lScore = (last.critical || 0) * 4 + (last.high || 0);
-  if (lScore < fScore - 1) return 'improving';
-  if (lScore > fScore + 1) return 'regressing';
-  return 'flat';
-}
-
-/**
- * Build a single leaderboard row for a repo. Reads the latest scan from
- * `<scanRoot>/.agentic-security/last-scan.json` and (optionally) history
- * from `<scanRoot>/.agentic-security/scan-history.jsonl`.
- *
- * `repo` is the GitHub slug ('owner/name'); used to drive the badge URL.
- */
-function leaderboardRowFor({ scanRoot, repo, badgeBase = 'https://agentic-security.dev/badge' } = {}) {
-  if (!repo) throw new Error('leaderboardRowFor: repo slug is required');
-  const lastScanPath = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__.statePath)(scanRoot || '.', 'last-scan.json');
-  let scan = null;
-  try { scan = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(lastScanPath, 'utf8')); } catch {}
-  const summary = (0,_badge_js__WEBPACK_IMPORTED_MODULE_2__/* .summarizeForBadge */ .iI)(scan);
-  const grade = _postureGrade(summary.counts);
-  const topCwe = _topCwe(scan);
-
-  // Optional scan history for the trend signal.
-  const historyPath = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__.statePath)(scanRoot || '.', 'scan-history.jsonl');
-  let history = [];
-  if (node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(historyPath)) {
-    try {
-      history = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(historyPath, 'utf8').split('\n')
-        .map(l => l.trim()).filter(Boolean)
-        .map(l => { try { return JSON.parse(l); } catch { return null; } })
-        .filter(Boolean);
-    } catch {}
-  }
-  const deltaTrend = _deltaTrend(history);
-
-  return {
-    repo,
-    score: { ...summary.counts, total: summary.total },
-    postureGrade: grade,
-    lastScanAge: _ageString(scan?.timestamp || scan?.when),
-    topCwe,
-    deltaTrend,
-    badgeUrl: `${badgeBase}?repo=${encodeURIComponent(repo)}`,
-    badgeMarkdown: `![agentic-security](${badgeBase}?repo=${encodeURIComponent(repo)})`,
-  };
-}
-
-/**
- * Rank a list of rows for the leaderboard. Sort by:
- *   1. lower critical count
- *   2. lower high count
- *   3. higher postureGrade (A > F)
- *   4. fresher lastScanAge
- *
- * Returns the input rows annotated with `rank` (1-indexed).
- */
-function rankRows(rows) {
-  if (!Array.isArray(rows)) return [];
-  const gradeOrder = { A: 0, B: 1, C: 2, D: 3, F: 4 };
-  const sorted = [...rows].sort((a, b) => {
-    const ac = a.score?.critical || 0;
-    const bc = b.score?.critical || 0;
-    if (ac !== bc) return ac - bc;
-    const ah = a.score?.high || 0;
-    const bh = b.score?.high || 0;
-    if (ah !== bh) return ah - bh;
-    const ag = gradeOrder[a.postureGrade] ?? 5;
-    const bg = gradeOrder[b.postureGrade] ?? 5;
-    if (ag !== bg) return ag - bg;
-    return 0;
-  });
-  return sorted.map((r, i) => ({ ...r, rank: i + 1 }));
-}
-
-const _internal = { _postureGrade, _ageString, _topCwe, _deltaTrend };
-
-
-/***/ })
-
-};

package/dist/5738.index.js

@@ -1,240 +0,0 @@
-export const id = 5738;
-export const ids = [5738];
-export const modules = {
-
-/***/ 35738:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-// ESM COMPAT FLAG
-__webpack_require__.r(__webpack_exports__);
-
-// EXPORTS
-__webpack_require__.d(__webpack_exports__, {
-  cmdProof: () => (/* binding */ cmdProof),
-  cmdProve: () => (/* binding */ cmdProve),
-  formatResult: () => (/* binding */ formatResult),
-  loadReproducerFor: () => (/* binding */ loadReproducerFor)
-});
-
-// EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(73024);
-// EXTERNAL MODULE: external "node:os"
-var external_node_os_ = __webpack_require__(48161);
-// EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __webpack_require__(76760);
-// EXTERNAL MODULE: ./src/posture/state-dir.js
-var state_dir = __webpack_require__(31174);
-// EXTERNAL MODULE: ./src/posture/proof-fabric/orchestrator.js
-var orchestrator = __webpack_require__(3740);
-// EXTERNAL MODULE: ./src/posture/encryption-provider.js
-var encryption_provider = __webpack_require__(39984);
-// EXTERNAL MODULE: ./src/llm-validator/redact.js
-var redact = __webpack_require__(65388);
-// EXTERNAL MODULE: ./src/posture/proof-fabric/reproducer.js
-var reproducer = __webpack_require__(37055);
-;// CONCATENATED MODULE: ./src/posture/proof-fabric/store.js
-// Proof artifact store: `.agentic-security/proofs/<findingKey>/<recordDigest>.json`.
-//
-// Reuses the existing state machinery rather than adding another: `safeWriteState` (refuses unsafe dirs and symlinks),
-// `maybeEncryptForWrite` / `maybeDecryptForRead` (the `proofs` artifact is registered `confidential`), retention
-// (evidence class) and legal holds (a hold on `proofs` blocks purge). Nothing persisted contains a plaintext credential:
-// records are passed through a recursive secret filter first, and the runner never returns its per-run nonce or secrets.
-
-
-
-
-
-
-
-const PROOF_RECORD_SCHEMA = 'agentic-security/proof-record';
-const PROOFS_DIR = 'proofs';
-const MAX_RECORD_BYTES = 512 * 1024;
-
-const findingKey = (id) => `${String(id).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 80)}-${(0,reproducer/* sha256 */.sc)(String(id)).slice(0, 8)}`;
-
-// The shared redactor catches key=value shapes; bare tokens need their own pass, so persisted evidence cannot carry one.
-const BARE_SECRET_RES = [
-  /\b(?:ghp|gho|ghu|ghs|ghr|github_pat)_[A-Za-z0-9_]{20,}\b/g, /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, /\bsk-[A-Za-z0-9_-]{20,}\b/g,
-  /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g, /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, /\bSECRET-[0-9a-f]{24}-[a-z0-9_-]+\b/g,
-];
-function scrubString(text) {
-  let t = String(text);
-  try { t = (0,redact/* redactSecrets */.f)(t).text; } catch { return '[unredactable]'; }
-  for (const re of BARE_SECRET_RES) t = t.replace(re, '[REDACTED-SECRET]');
-  return t;
-}
-
-/** Deep-copy `v` with every string passed through the secret redactor. */
-function scrubDeep(v) {
-  if (typeof v === 'string') return scrubString(v);
-  if (Array.isArray(v)) return v.map(scrubDeep);
-  if (v && typeof v === 'object') return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, scrubDeep(x)]));
-  return v;
-}
-
-function recordDigest(record) {
-  const { recordDigest: _omit, ...rest } = record;
-  return (0,reproducer/* sha256 */.sc)((0,reproducer/* canonicalize */.dw)(rest));
-}
-
-function saveProof(scanRoot, record) {
-  const safe = scrubDeep(record);
-  safe.schema = PROOF_RECORD_SCHEMA;
-  safe.recordDigest = recordDigest(safe);
-  const text = JSON.stringify(safe, null, 2);
-  if (Buffer.byteLength(text) > MAX_RECORD_BYTES) return { ok: false, reason: 'proof record exceeds the size limit' };
-  if (!(0,state_dir/* ensureStateDir */.xH)(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
-  const enc = (0,encryption_provider/* maybeEncryptForWrite */.v2)(scanRoot, PROOFS_DIR, text);
-  if (!enc.ok) return { ok: false, reason: enc.reason };
-  const file = (0,state_dir.statePath)(scanRoot, PROOFS_DIR, findingKey(record.findingId), `${safe.recordDigest}.json`);
-  if (!(0,state_dir/* safeWriteState */.Ep)(file, enc.content)) return { ok: false, reason: 'state write refused' };
-  return { ok: true, file, digest: safe.recordDigest, encrypted: enc.encrypted };
-}
-
-function readRecord(file) {
-  const text = (0,encryption_provider.maybeDecryptForRead)(external_node_fs_.readFileSync(file, 'utf8'));
-  const rec = JSON.parse(text);
-  // A record whose content no longer matches its own digest was modified after it was written.
-  if (rec.recordDigest !== recordDigest(rec)) return { tampered: true, record: rec };
-  return { tampered: false, record: rec };
-}
-
-/** Newest-first records for a finding. Tampered records are returned flagged, never silently dropped or trusted. */
-function listProofs(scanRoot, findingId) {
-  const dir = (0,state_dir.statePath)(scanRoot, PROOFS_DIR, findingKey(findingId));
-  let names = [];
-  try { names = external_node_fs_.readdirSync(dir).filter((n) => n.endsWith('.json')); } catch { return []; }
-  const out = [];
-  for (const n of names) {
-    const f = external_node_path_.join(dir, n);
-    try { const { tampered, record } = readRecord(f); out.push({ file: f, tampered, record, mtime: external_node_fs_.statSync(f).mtimeMs }); } catch { out.push({ file: f, tampered: true, record: null, mtime: 0 }); }
-  }
-  return out.sort((a, b) => b.mtime - a.mtime);
-}
-
-function latestProof(scanRoot, findingId) {
-  return listProofs(scanRoot, findingId).find((p) => p.record) ?? null;
-}
-
-// EXTERNAL MODULE: ./src/posture/proof-fabric/runner.js
-var runner = __webpack_require__(2998);
-;// CONCATENATED MODULE: ./src/posture/proof-fabric/cli.js
-// CLI surface for the proof fabric: `proof show|replay|doctor`, `triage exploit|validate`. Non-interactive by design: no
-// command reads stdin, every run is bounded by the policy timeouts, and a missing reproducer is a typed exit code, not a
-// prompt. Exit codes: 0 confirmed/ok, 1 not confirmed (any reason), 4 usage/precondition.
-
-
-
-
-
-
-
-
-
-
-function loadFinding(root, id) {
-  const p = (0,state_dir.statePath)(root, 'last-scan.json');
-  if (!external_node_fs_.existsSync(p)) return null;
-  const last = JSON.parse(external_node_fs_.readFileSync(p, 'utf8'));
-  return (last.findings || []).find((f) => f.id === id || f.stableId === id) ?? null;
-}
-
-function loadReproducerFor(root, id, flagPath) { return loadReproducer(root, id, flagPath); }
-
-function loadReproducer(root, id, flagPath) {
-  const candidates = [flagPath && external_node_path_.resolve(String(flagPath)), (0,state_dir.statePath)(root, 'reproducers', `${findingKey(id)}.json`)].filter(Boolean);
-  for (const c of candidates) {
-    try { return { reproducer: JSON.parse(external_node_fs_.readFileSync(c, 'utf8')), file: c }; } catch { /* next */ }
-  }
-  return null;
-}
-
-function formatResult(r) {
-  const env = r.environment ? `${r.environment.mode} (${r.environment.assurance} assurance)` : 'none';
-  return [
-    `Finding: ${r.findingId}`,
-    `Evidence: ${r.state}`,
-    `Oracle: ${r.oracle}`,
-    `Reproductions: ${r.attempts?.successes ?? 0}/${r.attempts?.run ?? 0} (required ${r.attempts?.required})`,
-    `Independent replay: ${r.independentReplay?.status ?? 'not-run'}`,
-    `Environment: ${env}`,
-    `Completeness: ${r.completeness}`,
-    `Duration: ${(r.timing.proofMs / 1000).toFixed(1)}s`,
-    ...(r.degradation?.length ? [`Degraded: ${r.degradation.join(', ')}`] : []),
-    ...(r.note ? [`Note: ${r.note}`] : []),
-  ].join('\n');
-}
-
-async function cmdProve(args, root, { json = false } = {}) {
-  const id = String(args._[2] ?? '');
-  if (!id) { console.error('usage: triage exploit <finding-id> --prove [--reproducer file] [--attempts N] [--required N]'); return 4; }
-  const finding = loadFinding(root, id);
-  if (!finding) { console.error(`Finding ${id} not found in last scan.`); return 4; }
-  const loaded = loadReproducer(root, id, args.flags.reproducer);
-  if (!loaded) { console.error(`No reproducer for ${id}. Supply one with --reproducer <file> or place it at .agentic-security/reproducers/. Nothing was executed.`); return 4; }
-  const errs = (0,reproducer/* validateReproducer */.mC)(loaded.reproducer);
-  if (errs.length) { console.error(`Invalid reproducer: ${errs.join('; ')}`); return 4; }
-  const policy = {};
-  if (args.flags.attempts) policy.attempts = Number(args.flags.attempts);
-  if (args.flags.required) policy.required = Number(args.flags.required);
-  if (args.flags.timeout) policy.timeoutMs = Number(args.flags.timeout) * 1000;
-  if (args.flags['require-container']) policy.requireContainer = true;
-  const ac = new AbortController();
-  const onSig = () => ac.abort();
-  process.once('SIGINT', onSig);
-  let result;
-  try { result = await (0,orchestrator/* proveFinding */.kO)({ finding, reproducer: loaded.reproducer, revision: args.flags.revision ?? null, policy, signal: ac.signal }); } finally { process.off('SIGINT', onSig); }
-  const saved = saveProof(root, { ...result, reproducer: loaded.reproducer });
-  if (json || args.flags.json) console.log(JSON.stringify({ ...result, stored: saved.ok ? saved.file : null }, null, 2));
-  else { console.log(formatResult(result)); if (!saved.ok) console.log(`(proof not stored: ${saved.reason})`); }
-  return result.state === 'EXPLOIT_CONFIRMED' ? 0 : 1;
-}
-
-async function cmdProof(args, root) {
-  const sub = args._[1];
-  if (sub === 'doctor') return doctor(args);
-  const id = String(args._[2] ?? '');
-  if (!id) { console.error('usage: proof show <finding-id> | proof replay <finding-id> | proof doctor'); return 4; }
-  if (sub === 'show') {
-    const all = listProofs(root, id);
-    if (!all.length) { console.error(`No stored proof for ${id}.`); return 4; }
-    const latest = all.find((p) => p.record);
-    if (all.some((p) => p.tampered)) console.error(`WARNING: ${all.filter((p) => p.tampered).length} stored record(s) failed their integrity check and are not trusted.`);
-    const good = all.find((p) => p.record && !p.tampered);
-    if (!good) { console.error('No intact proof record.'); return 1; }
-    if (args.flags.json) console.log(JSON.stringify(good.record, null, 2)); else console.log(formatResult(good.record));
-    void latest;
-    return 0;
-  }
-  if (sub === 'replay') {
-    const stored = latestProof(root, id);
-    if (!stored?.record?.reproducer) { console.error(`No stored reproducer for ${id}.`); return 4; }
-    const tmpDir = external_node_fs_.mkdtempSync(external_node_path_.join(external_node_os_.tmpdir(), 'proof-replay-'));
-    const tmp = external_node_path_.join(tmpDir, 'reproducer.json');
-    external_node_fs_.writeFileSync(tmp, JSON.stringify(stored.record.reproducer));
-    args.flags.reproducer = tmp;
-    args._ = ['triage', 'exploit', id];
-    try { return await cmdProve(args, root); } finally { external_node_fs_.rmSync(tmpDir, { recursive: true, force: true }); }
-  }
-  console.error('usage: proof show|replay <finding-id> | proof doctor');
-  return 4;
-}
-
-function doctor(args) {
-  const tools = (0,runner/* hostTools */.qV)();
-  const rows = reproducer/* LANGUAGES */.Yj.map((l) => ({ lang: l, ...(0,runner/* languageSupport */.ql)(l, tools) }));
-  const envs = ['javascript', 'python'].map((l) => ({ lang: l, ...(0,runner/* selectEnvironment */.aP)({ lang: l }) }));
-  if (args.flags.json) { console.log(JSON.stringify({ tools, languages: rows, environments: envs }, null, 2)); return 0; }
-  console.log('Proof fabric doctor');
-  for (const r of rows) console.log(`  ${r.lang.padEnd(11)} ${r.supported ? 'supported' : `unsupported (${r.reason})`}`);
-  for (const e of envs) console.log(`  environment for ${e.lang}: ${e.mode}, ${e.assurance} assurance${e.reason ? ` (${e.reason})` : ''}${e.containerSkipped ? `; container skipped: ${e.containerSkipped}` : ''}`);
-  const usable = envs.some((e) => e.mode !== 'unavailable');
-  if (!usable) console.log('  RESULT: no execution environment available; proofs will report blocked, never clean.');
-  return usable ? 0 : 1;
-}
-
-
-/***/ })
-
-};