@clear-capabilities/agentic-security-scanner 0.185.0 → 0.186.1

package/CHANGELOG.md

@@ -9,6 +9,28 @@
 > make the history less accurate, not more.
 
 
+## 0.186.1 - Git history annotation blames once per file, which restores scan speed (fix)
+
+0.186.0 was tagged but never published: its release workflow stopped at the time-to-first-finding gate (15 to 18 s against a 13 s limit), so the first npm release carrying that work is 0.186.1. Nothing in 0.186.0's content changed apart from the fix below.
+
+- **Why it got slower.** Findings that used to carry no line number now carry one, so the git history step, which asks git who introduced each finding, ran for about twice as many findings. It ran one `git blame` per finding and one `git show` per commit, about 14 ms each. Measured on this repository's own source: 7.9 s on 0.185.0, 10.9 s on 0.186.0.
+- **The fix.** One `git blame` per file for all of its lines and one `git log --no-walk` for all commit messages. A file whose batch fails is blamed line by line, so a bad line number cannot lose the others. The annotations are the same; `test/git-history-batch.test.js` checks the batched answers against per-line `git blame`. Measured after the change: 8.3 s locally.
+- **Also in this release.** Two test fixes found by hosted CI: the artifact CLI tests now warm the OSV cache once, because a cold runner has none, and `owned-build/6` accepts a watchdog stop on a slow runner.
+
+## 0.186.0 - The graph-precision capabilities are reachable from the CLI, a z3 backend checks path feasibility, and demand queries and incremental analysis got faster (Preview)
+
+Everything new is Preview, opt-in and off by default. A default scan's output is unchanged by the new commands and by the solver. No GA capability changed its contract.
+
+- **Reachable from the CLI.** `dataflow view`, `dataflow contracts`, `dataflow sink-query`, `dataflow plan-cuts`, `witness build` and `witness verify` expose the typed graph views, boundary contracts, demand reverse taint, min-cut control planner and signed witness bundles. Every report carries a completion status (`complete`, `partial`, `cancelled`, `unavailable`, `invalid`) and `negativeClaimAllowed`; "no modeled path" is never reported as "no vulnerability". `witness build` exits 1 and writes nothing when no modeled path exists. The graph views other than the dataflow view and a tool in the MCP server remain library-only.
+- **A real z3 feasibility backend (`AGENTIC_SECURITY_LINEAGE_SMT=z3`).** Path conditions are translated to SMT-LIB and checked with a per-query timeout and memory cap. Only a proven `unsat` over a verified encoding can reduce a path's exploitability; a timeout, an unknown result, a missing solver or a condition the encoding cannot express changes nothing. The synchronous graph build does not call it: it is reached through the async path-evidence entry points. NaN and loose-equality coercion are not modeled.
+- **Demand queries are faster.** A query with the index built per query is 23.4x faster than full analysis on this repository (was 1.9x), and 3.7x averaged over a 30-query sample that includes fallbacks. Instance-field reads in JS and TS no longer force a full fallback; 75 of 982 sink sites still use the full path, all at the caller-depth limit. Findings equal full analysis on all 982 sites. Call-graph name resolution got a name index that also speeds up the cold engine.
+- **Incremental analysis is faster.** A per-file IR cache (JS and TS, under `AGENTIC_SECURITY_INCREMENTAL`) removes re-parsing. End to end it is now 4.3x on `scanner/src`; on the two synthetic projects it is 2.5x and 2.4x, still short of the 3x target. Projects above about 5,000 functions still run cold at the default summary budget.
+- **Fewer false positives on the labeled samples.** Flagged sites that were true rose from 5 of 25 to 5 of 8 for JavaScript and from 6 of 17 to 6 of 8 for Nix, with recall unchanged (5 of 5 and 6 of 6). Part of the JavaScript gain is a measurement correction: line-less findings were credited to every same-class label in their file. The rules are general (a literal origin prefix on a redirect, request-input-only reflection, module-load blocking calls, confined file serving, bounded Nix option types) and each has a metamorphic test; the held-out split was not independent, which the benchmark summary now says. The multi-service fixture still finds 3 of 8: the misses need the cross-service join in a normal scan and a queue-consumer source model.
+- **The state-machine heuristic is narrowed.** A `.status` write is compared only with status sets declared in the same file, and test files are skipped. Before, the first set found anywhere in a project was applied to every write.
+- **Fixed.** The lineage deadline tests no longer assume which of two valid cancellations wins on a slow runner, and the regression report no longer embeds the exact bundle size, so a rebuild cannot make it stale. `@babel/core` and `z3-solver` moved to their latest releases and `@azure/msal-node` is pinned past an advisory in the extension's dev tooling.
+- **Self-scan baseline.** The scanner's own source falls to 688 findings; the only increases are three low advisories in the two new files that read files from disk.
+- **Not claimed.** Reachability, satisfiability and runtime observation are not exploit proof. A signature on a witness bundle proves integrity, not that the transfer models are right.
+
 ## 0.185.0 - Graph analysis says when it did not finish, and gains recursion handling, call-site correlation, demand queries, incremental invalidation, boundary contracts, control planning and replayable witnesses (Preview)
 
 All new behavior is Preview and is off by default or purely additive. No GA capability changed its contract.

package/bin/agentic-security.js

@@ -206,6 +206,22 @@ Commands:
   dataflow plan-cuts [path] --candidates <file.json> --output <file> [--query <file.json>] [--format json|markdown]
                                Plan a minimum-cost, hypothetical control placement (graph cut) over the
                                already-scanned lineage graph. Never verifies a remediation.
+                               The plan carries a completion contract (never a negative claim).
+  dataflow view [path] [--node <id> [--direction in|out|both] [--relations a,b] [--origins a,b]] [--output <file>]
+                               Opt-in typed graph view over the already-scanned lineage graph: identity,
+                               completion, SCC condensation of the data-flow relation, or one node's neighbours.
+  dataflow contracts [path] [--contracts <file>] [--output <file>]
+                               Opt-in boundary contracts: bind declared HTTP/queue/storage edges to parsed
+                               consumer sites and seed taint there. A declaration is a modeled input only.
+  dataflow sink-query [path] (--list | --file <rel> --line <n>) [--mode demand|full|compare] [--arg-index <n>]
+                               [--sink-id <id>] [--access-path <p>] [--rule-family <f>] [--max-work <n>]
+                               [--max-caller-depth <n>] [--on-limit full|partial] [--output <file>]
+                               Opt-in demand-driven reverse taint for one sink site. Verdicts: flow-found,
+                               no-flow-in-modeled-scope, unknown. There is no "safe".
+  witness build [path] --out <dir> [--sink <id>] | --list-sinks
+  witness verify <bundle.json> [--public-key <path>] [--artifacts <dir> --root <project>] [--json]
+                               Opt-in signed, replayable path witness bundles (Ed25519, same key as attest).
+                               A valid signature proves integrity only, never that the finding is real.
   dataflow scenario apply [path] --operations <file.json> --output <file> [--format json|markdown]
                                Simulate a hypothetical architecture change against the
                                already-scanned lineage graph — never mutates the real scan.
@@ -5162,6 +5178,8 @@ async function cmdDataflowPlanCuts(args) {
   if (!loaded.ok) { process.stderr.write(`agentic-security dataflow plan-cuts: ${loaded.message}\n`); return 1; }
   const { planCuts } = await import('../src/lineage/cut-planner.js');
   const plan = planCuts(loaded.graph, query, candidates);
+  // Completion contract: a plan is `complete` only for a finite cut over a graph known complete; never a negative claim.
+  plan.contract = (await import('../src/posture/dag-commands.js')).planContract(plan);
   let data;
   if (format === 'json') data = JSON.stringify(plan, null, 2);
   else {
@@ -5171,6 +5189,7 @@ async function cmdDataflowPlanCuts(args) {
     for (const r of plan.validation?.residualPaths ?? []) lines.push(`- to \`${r.sink}\` via ${r.nodes.map((n) => `\`${n}\``).join(' -> ')}`);
     lines.push('', '## Limitations', '');
     for (const l of plan.limitations) lines.push(`- ${l}`);
+    lines.push('', `Completion: ${plan.contract.status}. A negative claim is never allowed for a hypothetical plan.`);
     data = lines.join('\n') + '\n';
   }
   try {
@@ -8012,6 +8031,7 @@ async function main() {
       }
       case 'boundaries': process.exit(await cmdBoundaries(args));
       case 'explore':  process.exit(await cmdExplore(args));
+      case 'witness':  process.exit(await (await import('../src/posture/dag-commands.js')).cmdWitness(args));
       case 'dataflow': {
         const sub = args._[1];
         if (sub === 'export') { process.exit(await cmdDataflowExport(args)); }
@@ -8053,6 +8073,9 @@ async function main() {
           break;
         }
         else if (sub === 'plan-cuts') { process.exit(await cmdDataflowPlanCuts(args)); }
+        else if (sub === 'view') { process.exit(await (await import('../src/posture/dag-commands.js')).cmdDataflowView(args)); }
+        else if (sub === 'contracts') { process.exit(await (await import('../src/posture/dag-commands.js')).cmdDataflowContracts(args)); }
+        else if (sub === 'sink-query') { process.exit(await (await import('../src/posture/dag-commands.js')).cmdDataflowSinkQuery(args)); }
         else if (sub === 'impact') {
           const impactSub = args._[2];
           if (impactSub === 'assess') { process.exit(await cmdDataflowImpactAssess(args)); }
@@ -8073,7 +8096,7 @@ async function main() {
           break;
         }
         else if (sub === 'twin') { process.exit(await cmdDataflowTwin(args)); }
-        process.stderr.write(`agentic-security dataflow: unknown subcommand "${sub}" — only "export", "diff", "watch", "scenario", "impact", "observations", and "twin" are supported.\n`);
+        process.stderr.write(`agentic-security dataflow: unknown subcommand "${sub}" — only "export", "diff", "watch", "scenario", "plan-cuts", "view", "contracts", "sink-query", "impact", "observations", and "twin" are supported.\n`);
         process.exit(2);
       }
       case 'governance': {

package/dist/1128.index.js

@@ -31,10 +31,14 @@ function makeIdentityTokenizer() {
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
   WITNESS_SCHEMA: () => (/* binding */ WITNESS_SCHEMA),
+  buildWitnessBundle: () => (/* binding */ buildWitnessBundle),
+  exportProvenanceArtifact: () => (/* binding */ exportProvenanceArtifact),
+  parseWitnessBundle: () => (/* binding */ parseWitnessBundle),
+  signWitnessBundle: () => (/* binding */ signWitnessBundle),
   verifyWitness: () => (/* binding */ verifyWitness)
 });
 
-// UNUSED EXPORTS: buildWitnessBundle, exportProvenanceArtifact, parseWitnessBundle, replayWitness, signWitnessBundle, transferModelFingerprints, verifyWitnessSignature
+// UNUSED EXPORTS: replayWitness, transferModelFingerprints, verifyWitnessSignature
 
 // EXTERNAL MODULE: external "node:crypto"
 var external_node_crypto_ = __webpack_require__(77598);
@@ -118,7 +122,7 @@ function iso(v) {
  * dropped and only COUNTED (their names could themselves carry a value). Identities are tokenized with the
  * existing keyed-hash convention; a raw identity with no tokenizer is dropped, never kept.
  */
-function witness_runtime_sanitizeCausalGroups(groups, { tokenize = (0,identity_token.makeIdentityTokenizer)() } = {}) {
+function sanitizeCausalGroups(groups, { tokenize = (0,identity_token.makeIdentityTokenizer)() } = {}) {
   const out = []; const rejected = []; let droppedFields = 0;
   const GROUP_KEYS = new Set(['id', 'sessionRef', 'sessionId', 'traceId', 'environment', 'deploymentRef', 'deploymentConfigDigest',
     'identity', 'identityToken', 'firstObservedAt', 'lastObservedAt', 'edgeObservations']);
@@ -218,7 +222,7 @@ function assessRuntimeSupport({ pathEdgeIds, edgeStates, causalGroups = [], expe
   if (!ids.length || !isObj(edgeStates) || !edgeStates.evaluated) {
     return { ...base, status: 'not_consulted', statements: ['No telemetry was consulted for this path. That is not an observation of absence.'] };
   }
-  const sanitized = witness_runtime_sanitizeCausalGroups(causalGroups, { tokenize });
+  const sanitized = sanitizeCausalGroups(causalGroups, { tokenize });
   base.groupsConsidered = sanitized.groups.length; base.rejectedGroups = sanitized.rejected.length; base.droppedFields = sanitized.droppedFields;
 
   for (const id of ids) {
@@ -278,7 +282,7 @@ function assessRuntimeSupport({ pathEdgeIds, edgeStates, causalGroups = [], expe
  * R10.6: external proof references are bound to the sink, the value and the configuration. A reference that is
  * stale or mismatched is REJECTED with its reasons; it is never re-attached to the changed graph.
  */
-function witness_runtime_bindExploitProofs(proofs, expected) {
+function bindExploitProofs(proofs, expected) {
   const bound = []; const rejected = [];
   for (const [i, p] of arr(proofs).entries()) {
     const id = isObj(p) && typeof p.id === 'string' && REF_RE.test(p.id) ? p.id : `proof-${i}`;
@@ -302,7 +306,7 @@ function witness_runtime_bindExploitProofs(proofs, expected) {
 }
 
 /** Validate the nullable DAG-04 slot. Returns { ok, errors }. */
-function witness_runtime_validateControlEvidence(ce, pathEdgeIds) {
+function validateControlEvidence(ce, pathEdgeIds) {
   if (ce === null) return { ok: true, errors: [] };
   const errors = [];
   if (!isObj(ce)) return { ok: false, errors: ['control evidence must be an object or null'] };
@@ -321,7 +325,7 @@ function witness_runtime_validateControlEvidence(ce, pathEdgeIds) {
  * The four statuses, side by side. Returns exactly the four keys in EVIDENCE_STATUS_KEYS and nothing that
  * ranks, scores or combines them.
  */
-function witness_runtime_buildEvidenceStatuses({ pathComplete, controlEvidence, runtime, exploit }) {
+function buildEvidenceStatuses({ pathComplete, controlEvidence, runtime, exploit }) {
   return {
     modeledPath: { status: pathComplete ? 'connected_complete' : 'connected_partial' },
     feasibility: { status: controlEvidence ? controlEvidence.status : 'not_assessed' },
@@ -420,14 +424,14 @@ const fileOfScope = (scope) => (typeof scope === 'string' ? scope.split('::')[0]
 function exportProvenanceArtifact({ hops, incomplete = [] }) {
   const seen = new Map();
   for (const h of witness_bundle_arr(hops)) {
-    const norm = Object.fromEntries(HOP_FIELDS.map((f) => [f, h?.[f] ?? null]));
-    seen.set(canonicalJson(norm), norm);
+    const norm = Object.fromEntries(path_store/* HOP_FIELDS */.KO.map((f) => [f, h?.[f] ?? null]));
+    seen.set((0,evidence_bundle/* canonicalJson */.dj)(norm), norm);
   }
   const hopList = [...seen.keys()].sort().map((k) => seen.get(k));
   const truncations = witness_bundle_arr(incomplete)
     .map((u) => ({ scope: u.qid ?? u.scope ?? null, context: u.context ?? null, reason: u.reasons?.[0] ?? u.reason ?? 'analysis-incomplete' }))
-    .sort((a, b) => (canonicalJson(a) < canonicalJson(b) ? -1 : 1));
-  return { schema: PROVENANCE_ARTIFACT_SCHEMA, hops: hopList, truncations, digest: witness_bundle_sha(canonicalJson({ hops: hopList, truncations })) };
+    .sort((a, b) => ((0,evidence_bundle/* canonicalJson */.dj)(a) < (0,evidence_bundle/* canonicalJson */.dj)(b) ? -1 : 1));
+  return { schema: PROVENANCE_ARTIFACT_SCHEMA, hops: hopList, truncations, digest: witness_bundle_sha((0,evidence_bundle/* canonicalJson */.dj)({ hops: hopList, truncations })) };
 }
 
 function artifactDigest(a) {
@@ -568,8 +572,8 @@ function buildWitnessBundle(o = {}) {
   }
   const budget = { ...result.budget }; delete budget.expansionsUsed;
   const config = { pathQuery: budget, storeLimits: storeLimits.limits, ...(witness_bundle_isObj(o.analysisConfig) ? { extra: o.analysisConfig } : {}) };
-  const analysisConfigDigest = witness_bundle_sha(canonicalJson(config));
-  const graphDigest = computeGraphDigest(graph);
+  const analysisConfigDigest = witness_bundle_sha((0,evidence_bundle/* canonicalJson */.dj)(config));
+  const graphDigest = (0,export_json.computeGraphDigest)(graph);
 
   const files = [...new Set([srcNode, sinkNode, ...edges.flatMap((e) => [store.getNode(e.fromNodeId), store.getNode(e.toNodeId)])].map((n) => fileOfScope(n?.scope)).filter(Boolean))].sort();
   const sources = []; const unboundSourceFiles = [];
@@ -608,7 +612,7 @@ function buildWitnessBundle(o = {}) {
   const ceCheck = validateControlEvidence(ce, edges.map((e) => e.edgeId));
   if (!ceCheck.ok) return { ok: false, reason: `control evidence: ${ceCheck.errors.join('; ')}` };
 
-  const tokenize = o.tokenize ?? makeIdentityTokenizer();
+  const tokenize = o.tokenize ?? (0,identity_token.makeIdentityTokenizer)();
   let runtime;
   if (o.runtime) {
     const groups = sanitizeCausalGroups(o.runtime.causalGroups, { tokenize });
@@ -622,7 +626,7 @@ function buildWitnessBundle(o = {}) {
   const exploitInputs = witness_bundle_arr(o.exploitProofs).map((p) => sanitizeProof(p));
   const exploit = { inputs: exploitInputs, ...bindExploitProofs(exploitInputs, { sinkRef, dataElementId: edges[0].dataElementId, graphDigest, analysisConfigDigest }) };
 
-  const sourcePath = redactString(srcNode.path ?? ''); const sinkPath = redactString(sinkNode.path ?? '');
+  const sourcePath = (0,redact/* redactString */.rd)(srcNode.path ?? ''); const sinkPath = (0,redact/* redactString */.rd)(sinkNode.path ?? '');
   const redactions = (srcNode.path && sourcePath !== srcNode.path ? 1 : 0) + (sinkNode.path && sinkPath !== sinkNode.path ? 1 : 0);
 
   const bundle = jsonSafe({
@@ -669,7 +673,7 @@ function sanitizeProof(p) {
   const ref = (v) => (typeof v === 'string' && /^[A-Za-z0-9._:@/-]{1,160}$/.test(v) ? v : null);
   return {
     id: ref(p.id), kind: ['proof', 'dnr-hunt', 'incident'].includes(p.kind) ? p.kind : null, sinkRef: ref(p.sinkRef), dataElementId: ref(p.dataElementId),
-    graphDigest: ref(p.graphDigest), analysisConfigDigest: ref(p.analysisConfigDigest), note: typeof p.note === 'string' ? redactString(p.note).slice(0, 200) : null,
+    graphDigest: ref(p.graphDigest), analysisConfigDigest: ref(p.analysisConfigDigest), note: typeof p.note === 'string' ? (0,redact/* redactString */.rd)(p.note).slice(0, 200) : null,
   };
 }
 
@@ -693,9 +697,9 @@ function signedBytes(bundle) {
 
 /** Sign with the same Ed25519 key and self-issued trust basis as finding evidence bundles. */
 function signWitnessBundle(bundle, privateKeyPem) {
-  const publicKeyPem = crypto.createPublicKey(privateKeyPem).export({ type: 'spki', format: 'pem' });
-  const withIssuance = { ...bundle, issuance: buildLocalIssuance(publicKeyPem) };
-  const sig = crypto.sign(null, signedBytes(withIssuance), privateKeyPem);
+  const publicKeyPem = external_node_crypto_.createPublicKey(privateKeyPem).export({ type: 'spki', format: 'pem' });
+  const withIssuance = { ...bundle, issuance: (0,evidence_bundle/* buildLocalIssuance */.hc)(publicKeyPem) };
+  const sig = external_node_crypto_.sign(null, signedBytes(withIssuance), privateKeyPem);
   return { ...withIssuance, signature: { algorithm: 'ed25519', canonicalisation: WITNESS_SCHEMA, value: sig.toString('base64') } };
 }
 
@@ -874,16 +878,16 @@ function replayWitness(bundle, artifacts, opts = {}) {
     const gEdges = new Set(witness_bundle_arr(artifacts.graph.edges).map((e) => e.id));
     if (gb.edgeIds.some((id) => !gEdges.has(id))) fail('graph-binding', 'a bound graph edge is not in the graph artifact');
   }
-  const ceCheck = witness_runtime_validateControlEvidence(bundle.controlEvidence, edges.map((e) => e.edgeId));
+  const ceCheck = validateControlEvidence(bundle.controlEvidence, edges.map((e) => e.edgeId));
   if (!ceCheck.ok) fail('control-evidence', ceCheck.errors.join('; '));
   const rt = bundle.runtime;
   const reAssessed = witness_bundle_isObj(rt) ? runtimeAssessment(rt, gb ? gb.edgeIds : []) : null;
   if (!reAssessed || !same(reAssessed, rt.assessment)) fail('runtime-inconsistent', 'the recorded runtime assessment does not follow from its recorded inputs');
   if (rt?.inputs && !gb) fail('runtime-inconsistent', 'runtime inputs without a graph binding');
-  const reBound = witness_runtime_bindExploitProofs(witness_bundle_arr(bundle.exploit?.inputs), { sinkRef: last, dataElementId: edges[0]?.dataElementId, graphDigest: bundle.graphRef.digest, analysisConfigDigest: bundle.graphRef.analysisConfigDigest });
+  const reBound = bindExploitProofs(witness_bundle_arr(bundle.exploit?.inputs), { sinkRef: last, dataElementId: edges[0]?.dataElementId, graphDigest: bundle.graphRef.digest, analysisConfigDigest: bundle.graphRef.analysisConfigDigest });
   if (!same({ status: reBound.status, bound: reBound.bound, rejected: reBound.rejected }, { status: bundle.exploit?.status, bound: bundle.exploit?.bound, rejected: bundle.exploit?.rejected })) fail('proof-binding', 'the recorded proof binding does not follow from the sink, value and configuration it is bound to');
   if (reAssessed && bundle.completion) {
-    const ev = witness_runtime_buildEvidenceStatuses({ pathComplete: bundle.completion.path.complete && derived.overall === 'complete', controlEvidence: bundle.controlEvidence, runtime: reAssessed, exploit: reBound });
+    const ev = buildEvidenceStatuses({ pathComplete: bundle.completion.path.complete && derived.overall === 'complete', controlEvidence: bundle.controlEvidence, runtime: reAssessed, exploit: reBound });
     if (!same(ev, bundle.evidence)) fail('evidence-statuses', 'the four evidence statuses do not follow from their inputs');
   }
   return { ok: failures.length === 0, failures, warnings, derived };

package/dist/2584.index.js

@@ -1430,7 +1430,7 @@ async function diagnosticsOf(scan) {
   try { wanted = JSON.parse(process.env.AGENTIC_SECURITY_DIAG_FILES || '[]'); } catch { wanted = []; }
   if (wanted.length) {
     try {
-      const irMod = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 28149));
+      const irMod = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 98297));
       irMod._resetIrParseFailures();
       const ir = await irMod.buildProjectIRAsync(Object.fromEntries(wanted.filter((f) => scan.fc && typeof scan.fc[f] === 'string').map((f) => [f, scan.fc[f]])));
       for (const f of wanted) {

package/dist/4171.index.js

@@ -22,8 +22,8 @@ var nix_build_trust = __webpack_require__(36668);
 var discovery = __webpack_require__(30951);
 // EXTERNAL MODULE: ./src/language/haskell-supply.js
 var haskell_supply = __webpack_require__(86349);
-// EXTERNAL MODULE: ./src/language/nix-script-taint.js
-var nix_script_taint = __webpack_require__(11793);
+// EXTERNAL MODULE: ./src/language/nix-script-taint.js + 1 modules
+var nix_script_taint = __webpack_require__(98078);
 // EXTERNAL MODULE: ./src/language/nix-secrets.js
 var nix_secrets = __webpack_require__(69466);
 // EXTERNAL MODULE: ./src/language/nix-parser.js