@clear-capabilities/agentic-security-scanner 0.190.0 → 0.192.0

package/CHANGELOG.md

@@ -9,6 +9,20 @@
 > make the history less accurate, not more.
 
 
+## 0.192.0 - Faster pushes: a fast gate tier, an early release gate, and the bench gates on the pull request
+
+- **What a push runs.** The default pre-push tier no longer repeats work the hosted pull-request CI already runs and blocks the merge on. It skips the CVE-replay corpus and layer-recall locally, runs self-scan and the Haskell precision check live only when the change touches code they measure (the first hosted run of the new \`bench-gates\` job failed on a self-scan drift that the fast tier had skipped, which is why self-scan stays local for scripts, hooks and engine changes), and runs only the unit-test files that can see the change (reverse import graph plus named-path mentions in `scripts/gate-select.mjs`) instead of the whole suite. A change it cannot bound, or a selection over 60% of the suite, runs everything. `--full` or `AGENTIC_SECURITY_PUSH_GATE=full` restores the old gate. Every skipped check is printed with its reason and is never reported as passed.
+- **Those checks now run on the pull request.** A new `bench-gates` job (self-scan, mutation, fix verification, layer recall, Haskell precision) runs in parallel with the test shards and is a required check, so a regression the local push no longer catches turns the pull request red instead of failing an hour into a release.
+- **Overlapping the waits in `ship`.** The part of the release gate that hosted CI does not cover (chiefly the release closure, 18 of the last 22 minutes of the verify phase) now starts on the pull-request head while the hosted checks run, and a failure stops the run before the merge instead of after it. After the merge only the two checks that need it remain. Dependency currency is also checked before anything is pushed: it failed an hour into the 0.190.0 release on a newly published advisory.
+- **Measured, with a caveat.** On the one real change tried (a one-line edit to a Haskell engine module, base set to the previous commit), the fast tier selected 390 of 1,028 test files and passed in 1,633 s, but the machine was heavily loaded by other applications, so the benches ran 1.2 to 5 times slower than in an earlier idle profile of the old gate (1,155 s, of which the full suite was 704 s). Estimated idle time for that change is under 10 minutes, **not** the under-5-minute target. A change to a central module still reaches about 40% of the suite through static imports. Getting a central change under 5 minutes needs per-test line coverage so a comment-only or unexercised edit selects almost nothing; that is not built.
+- **Not changed:** the hosted release workflow still runs the whole gate with caching off before it publishes, and the tag-time trust model is unchanged.
+
+## 0.191.0 - GitHub Release pages from the changelog
+
+- **A Release page for every tag.** The `publish` job now creates a GitHub Release after `npm publish`, with its body taken from this file's section for the version (one shared `changelogSection` extractor, which no longer lets `1.2.3` match a `1.2.3-rc1` heading). An existing Release is edited, never recreated; `--verify-tag` means the step cannot create or move a tag; a dry run never creates one; `contents: write` is held by `publish` alone. **This step has not run on hosted infrastructure yet.** It is first exercised by this release's own tag, and if it fails after npm has published, the workflow run fails while the package stays published.
+- **Backfill.** `scripts/backfill-github-releases.mjs` creates the missing pages from existing tags and changelog sections. It is a dry run by default, applies only with `--apply`, and never touches a tag.
+- **Haskell container leg: still not verified.** The proof-fabric skip for the `haskell:9` image stays, because the machine used has no running container engine. The skip message now says exactly that. Closing it needs a host with an engine and the blocking `proof-container` CI job.
+
 ## 0.190.0 - Haskell remediation: four more verified fixers, and refusals that name the decision
 
 - **Four new fixers (ten in total).** TLS validation (`connection` `TLSSettingsSimple` literal `True` to `False`), cookie attributes (a `Set-Cookie` header literal, a `Web.Cookie` record update, servant-auth `NotSecure`, scotty simple cookies), predictable randomness (`randomIO` replaced by OS entropy, only for a fixed-width integer in a file that already imports `System.Entropy`) and an unbounded request body (a mitigation: a bounded reader with a 1 MiB limit that is a declared default, not a measured need). Each has a paired refusal case and is checked by a rescan, an independent effective-change check and a compile against declared stubs of the package API. The randomness, cookie-header and request-body fixes are also run against benign and hostile inputs under GHC.

package/dist/{2d84fed7f6258f8552e1.json → 3847777b54ce83d484ee.json}

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.190.0",
+  "version": "0.192.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -131,7 +131,7 @@
     "verification:conformance:check": "node ../scripts/verification-conformance-check.mjs",
     "verification:conformance:static": "node ../scripts/verification-conformance-check.mjs --static",
     "verification:replay-example": "node ../scripts/verification-replay-example.mjs",
-    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/gate-warm.test.js test/docs-positioning.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js",
+    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/gate-select.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/gate-warm.test.js test/docs-positioning.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/premortem.test.js test/context-intelligence/git-diff-candidates.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",