@clear-capabilities/agentic-security-scanner 0.195.22 → 0.195.24

package/src/lineage/lineage-source-catalog.js

@@ -0,0 +1,143 @@
+//
+// lineage-source-catalog.js — JavaScript data collection points that are
+// lineage sources but NOT taint sources (GA plan, GA-03.1: "address
+// source-category omissions without broadening the main taint catalog
+// incorrectly").
+//
+// Four of the fourteen reachable `SOURCE_CATEGORIES` had no `language: 'js'`
+// entry in `dataflow/catalog.js` at all: `cli-argument` (only `py-sys-argv`
+// and the argparse entries), `http-upload` (only Django and Symfony),
+// `storage-read` (only `py-open-read` and the C `read`/`fread`/`fgets`
+// entries) and `user-input` (only `py-input`, `gets`, `scanf`). The lineage
+// corpus therefore could not mint a source node for any of them from a
+// JavaScript fixture, and the four corpus entries that name them were
+// written in Python syntax on purpose, as a disclosed limitation.
+//
+// Why these entries live HERE and not in `dataflow/catalog.js`'s `CATALOG`:
+// that catalog is the taint engine's source list, and every entry in it
+// becomes an attacker-controlled input for every SAST and taint finding the
+// engine emits. A file's contents (`fs.readFileSync`) and a console prompt
+// (`prompt()`, `readlineSync.question()`) are places personal data ENTERS a
+// program, which is what a lineage graph records, but treating them as
+// attacker-controlled would turn every configuration read into a taint
+// source and flood the SAST output with findings nobody asked for. The
+// Data Flow Explorer already keeps a second, isolated catalog for the same
+// reason (`dataflow/privacy-catalog.js`, never merged into `CATALOG`); this
+// module follows that precedent on the source side. `test/lineage/
+// lineage-source-catalog.test.js` pins that `dataflow/catalog.js`'s own
+// `matchSource` returns null for every shape listed here, so adding an
+// entry here can never widen the taint engine by accident.
+//
+// Reuse boundary: imports nothing from `dataflow/`. The matcher below is a
+// deliberately small structural match over the parser's expression shape
+// (`ident`/`member`/`call`), not a copy of `catalog.js`'s index machinery;
+// an entry that needs receiver types, keyword arguments or a language family
+// other than JavaScript belongs in the main catalog, with the taint
+// consequences weighed there.
+
+import { reclassifySource } from './source-registry.js';
+
+const JS_FILE = /\.(?:[cm]?js|jsx|tsx?)$/i;
+
+/**
+ * Each entry mirrors the main catalog's source shape (`kind`, `id`,
+ * `language`, `framework`, `match`, `label`, `provenance`) so
+ * `reclassifySource` reads it unchanged: `provenance` is the key the
+ * registry's `PROVENANCE_MAP` resolves to a `SOURCE_CATEGORIES` value.
+ * `lineageOnly: true` is the marker a reader greps for; nothing consults it.
+ */
+export const LINEAGE_SOURCE_CATALOG = Object.freeze([
+  {
+    kind: 'source', id: 'js-process-argv', language: 'js', framework: 'node', lineageOnly: true,
+    match: { type: 'member', object: 'process', prop: 'argv' }, label: 'process.argv', provenance: 'cli',
+    why: 'a positional command-line argument; the value is whatever the operator typed, not attacker-controlled in the taint sense, so it is a collection point for lineage only',
+  },
+  {
+    kind: 'source', id: 'js-multer-req-file', language: 'js', framework: 'express', lineageOnly: true,
+    match: { type: 'member', object: 'req', prop: 'file' }, label: 'req.file', provenance: 'upload',
+    why: 'the single uploaded file multer attaches to the request (name, type, buffer, path)',
+  },
+  {
+    kind: 'source', id: 'js-multer-req-files', language: 'js', framework: 'express', lineageOnly: true,
+    match: { type: 'member', object: 'req', prop: 'files' }, label: 'req.files', provenance: 'upload',
+    why: 'the uploaded files multer attaches to the request, keyed by field name',
+  },
+  {
+    kind: 'source', id: 'js-fs-readFileSync', language: 'js', framework: 'node', lineageOnly: true,
+    match: { type: 'call', callee: 'readFileSync' }, label: 'fs.readFileSync()', provenance: 'file-read',
+    why: 'the contents of a file; the callback form `fs.readFile(p, cb)` delivers its contents to a callback and is not seeded (its path argument is already a sink in the main catalog)',
+  },
+  {
+    kind: 'source', id: 'js-window-prompt', language: 'js', framework: 'browser', lineageOnly: true,
+    match: { type: 'call', callee: 'prompt', bare: true }, label: 'prompt()', provenance: 'stdin',
+    why: 'text a person typed into the browser prompt dialog; only the bare global, never `x.prompt()` (inquirer and friends return a promise of an answers object)',
+  },
+  {
+    kind: 'source', id: 'js-readline-sync-question', language: 'js', framework: 'node', lineageOnly: true,
+    match: { type: 'call', callee: 'question', receiver: 'readlineSync' }, label: 'readlineSync.question()', provenance: 'stdin',
+    why: 'text a person typed at the console; the readline module\'s own `rl.question(q, cb)` delivers the answer to a callback and is not seeded',
+  },
+]);
+
+/** The receiver chain of a member-call callee, outermost first (`a.b.c()` -> ['a', 'b']). */
+function receiverSegments(callee) {
+  const segs = [];
+  let cur = callee && callee.kind === 'member' ? callee.object : null;
+  let depth = 0;
+  while (cur && depth++ < 8) {
+    if (cur.kind === 'ident') { segs.unshift(cur.name); break; }
+    if (cur.kind === 'member') { if (typeof cur.prop === 'string') segs.unshift(cur.prop); cur = cur.object; continue; }
+    break;
+  }
+  return segs;
+}
+
+function calleeName(callee) {
+  if (!callee) return null;
+  if (typeof callee === 'string') return callee.slice(callee.lastIndexOf('.') + 1);
+  if (callee.kind === 'ident') return callee.name ?? null;
+  if (callee.kind === 'member') return typeof callee.prop === 'string' ? callee.prop : null;
+  return null;
+}
+
+function entryMatches(entry, expr) {
+  const m = entry.match;
+  if (m.type === 'member') {
+    return expr.kind === 'member' && expr.object?.kind === 'ident' && expr.object.name === m.object && expr.prop === m.prop;
+  }
+  if (m.type === 'call') {
+    if (expr.kind !== 'call') return false;
+    if (calleeName(expr.callee) !== m.callee) return false;
+    if (m.bare) return expr.callee && expr.callee.kind === 'ident';
+    if (m.receiver) return receiverSegments(expr.callee).includes(m.receiver);
+    return true;
+  }
+  return false;
+}
+
+/**
+ * The lineage-only counterpart of `dataflow/catalog.js`'s `matchSource`:
+ * returns the first catalog entry whose `match` fits `expr`, or null.
+ * Gated to JavaScript and TypeScript files (an entry here is JavaScript by
+ * construction); a missing `file` is permissive, matching `matchSource`.
+ * Never throws on a malformed expression.
+ */
+export function matchLineageSource(expr, file) {
+  if (!expr || typeof expr !== 'object') return null;
+  if (file && !JS_FILE.test(file)) return null;
+  for (const entry of LINEAGE_SOURCE_CATALOG) {
+    if (entryMatches(entry, expr)) return entry;
+  }
+  return null;
+}
+
+/** The registry decision for every entry, computed once: proves at load time that each `provenance` resolves. */
+export const LINEAGE_SOURCE_DECISIONS = Object.freeze(Object.fromEntries(
+  LINEAGE_SOURCE_CATALOG.map((e) => {
+    const d = reclassifySource(e);
+    if (!d || !d.category || d.coverageStatus === 'unsupported') {
+      throw new Error(`lineage-source-catalog: ${e.id} has a provenance (${e.provenance}) the source registry cannot classify`);
+    }
+    return [e.id, d];
+  }),
+));

package/src/lineage/source-seeding.js

@@ -30,6 +30,25 @@ import { emptyState, addIdentity } from './field-identity.js';
 import { reclassifySource } from './source-registry.js';
 import { classifyDataElementName } from './classification.js';
 import { dataElementId } from './ids.js';
+import { matchLineageSource } from './lineage-source-catalog.js';
+
+// ── Seed kinds (GA-03.1, 0.195.24) ──────────────────────────────────────────
+//
+// `entry`: the identity is placed in the function's ENTRY state at
+// `seedPath` (a member-shaped source such as `req.body.card_number`, whose
+// path is stable for the whole function). This is §3's original mechanism.
+//
+// `after-node`: the identity is placed at `seedPath` in the state leaving
+// CFG node `nodeId`, by `engine.js`'s worklist through `ctx.seedAfterNode`.
+// Used for a CALL-shaped source assigned straight to a variable
+// (`const record = fs.readFileSync(p)`, `const ssn = prompt('SSN')`,
+// `const data = res.json()`): the call has no access path, so an entry seed
+// has nowhere to land, and the value only exists in the target variable
+// AFTER the assignment (an entry seed at the target would be killed by the
+// assignment's own strong update). Before 0.195.24 every such match was
+// recorded in `unseedable[]`; a call-shaped source anywhere else (nested
+// inside another call's arguments, returned directly) still is.
+export const SEED_KINDS = Object.freeze(['entry', 'after-node']);
 
 // ── §3.1: where the matched expressions come from ──────────────────────────
 //
@@ -169,6 +188,26 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
     if (seeds.length >= seedCap) { stopReason = 'seeding-limit'; continue; }
     if (nodesVisited >= nodeCap) { stopReason = 'seeding-limit'; continue; }
     functionsScanned += 1;
+    const fnSeeds = [];
+    const mint = ({ nid, node, entry, decision, seedPath, seedKind }) => {
+      const canonicalName = seedPath.slice(seedPath.lastIndexOf('.') + 1);
+      const seed = {
+        file: fn.file, qid: fn.qid, nodeId: nid, line: node.line ?? null,
+        entryId: entry.id, seedPath, canonicalName, seedKind,
+        category: decision.category, coverageStatus: decision.coverageStatus,
+        externality: decision.externality, reason: decision.reason,
+        // §3.4's minting rule. `canonicalName` alone is forbidden by
+        // PRD §10.4; the discriminator carries the system proxy
+        // (repository + file), the access path, and the category.
+        // Function scope (`qid`) is deliberately NOT in the
+        // discriminator (§3.4).
+        dataElementId: dataElementId(canonicalName, [repository, fn.file, seedPath, decision.category ?? '']),
+        dataClasses: classifyDataElementName(canonicalName).classes,
+      };
+      seeds.push(seed);
+      fnSeeds.push(seed);
+      return seed;
+    };
     for (const [nid, node] of Object.entries(fn.cfg?.nodes ?? {})) {
       nodesVisited += 1;
       if (seeds.length >= seedCap) { stopReason = 'seeding-limit'; break; }
@@ -176,10 +215,21 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
       for (const root of exprRoots(node)) walkExpr(root, (e, p) => { if (p) parentOf.set(e, p); });
       for (const root of exprRoots(node)) {
         walkExpr(root, (e) => {
-          const entry = matchSource(e, fn.file);
+          // The main taint catalog first (unchanged), then the lineage-only
+          // catalog for the JavaScript collection points the main catalog
+          // deliberately does not treat as taint sources.
+          const entry = matchSource(e, fn.file) ?? matchLineageSource(e, fn.file);
           if (!entry) return;
           const decision = reclassifySource(entry);
-          const seedPath = seedPathFor(e, parentOf);
+          let seedPath = seedPathFor(e, parentOf);
+          let seedKind = 'entry';
+          if (!seedPath && node.kind === 'assign' && node.source === e && typeof node.target === 'string') {
+            // A call-shaped source that IS the whole right-hand side of an
+            // assignment: the value lands in the target, so seed the target
+            // once the node has run (see SEED_KINDS).
+            seedPath = node.target;
+            seedKind = 'after-node';
+          }
           if (!seedPath) {
             unseedable.push({
               file: fn.file, qid: fn.qid, nodeId: nid, line: node.line ?? null,
@@ -187,23 +237,24 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
             });
             return;
           }
-          const canonicalName = seedPath.slice(seedPath.lastIndexOf('.') + 1);
-          seeds.push({
-            file: fn.file, qid: fn.qid, nodeId: nid, line: node.line ?? null,
-            entryId: entry.id, seedPath, canonicalName,
-            category: decision.category, coverageStatus: decision.coverageStatus,
-            externality: decision.externality, reason: decision.reason,
-            // §3.4's minting rule. `canonicalName` alone is forbidden by
-            // PRD §10.4; the discriminator carries the system proxy
-            // (repository + file), the access path, and the category.
-            // Function scope (`qid`) is deliberately NOT in the
-            // discriminator (§3.4).
-            dataElementId: dataElementId(canonicalName, [repository, fn.file, seedPath, decision.category ?? '']),
-            dataClasses: classifyDataElementName(canonicalName).classes,
-          });
+          mint({ nid, node, entry, decision, seedPath, seedKind });
         });
       }
     }
+    // GA-03.1 (0.195.24): a container seed read through an ALIAS. §3.2's
+    // rule extends a match outward only through member accesses enclosing
+    // it in the SAME statement, so `const body = req.body;` seeds the
+    // container `req.body` (data element `body`, no classes) and the later
+    // `body.card_number` read is a field nothing seeded. Follow the alias
+    // within the function: an assignment of a pure access path that starts
+    // at a container seed (or at an earlier alias of one) names an alias,
+    // and every outermost pure member read rooted at an alias mints the
+    // field seed on the ORIGINAL container path. The alias assignment's own
+    // byPath forwarding (`engine.js`, the structure-preserving `ident` and
+    // `member` cases) then carries the field identity through the hop.
+    // Bounded: the alias table is rebuilt at most four rounds (one per
+    // hop of chained aliases) and a wildcard segment is never seeded.
+    if (fnSeeds.length) extendThroughAliases(fn, fnSeeds, mint);
   }
   const notScanned = functionsTotal - functionsScanned;
   const completion = {
@@ -219,6 +270,61 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
   return { seeds, unseedable, completion };
 }
 
+const MAX_ALIAS_ROUNDS = 4;
+
+/** `(fn, fnSeeds, mint)`: see the comment at the call site in `planSeeds`. */
+function extendThroughAliases(fn, fnSeeds, mint) {
+  const nodes = Object.entries(fn.cfg?.nodes ?? {});
+  const containers = fnSeeds.filter((s) => s.seedKind === 'entry');
+  if (!containers.length) return;
+  const containerFor = (p) => containers.find((s) => p === s.seedPath || p.startsWith(`${s.seedPath}.`)) ?? null;
+  // ident -> { basePath, seed }: the container path the alias stands for.
+  const aliases = new Map();
+  const resolve = (p) => {
+    if (!p || p.includes('*')) return null;
+    const root = p.slice(0, p.indexOf('.') === -1 ? p.length : p.indexOf('.'));
+    const a = aliases.get(root);
+    if (a) return { basePath: a.basePath + p.slice(root.length), seed: a.seed };
+    const c = containerFor(p);
+    return c ? { basePath: p, seed: c } : null;
+  };
+  for (let round = 0; round < MAX_ALIAS_ROUNDS; round++) {
+    let changed = false;
+    for (const [, node] of nodes) {
+      if (node.kind !== 'assign' || typeof node.target !== 'string' || node.target.includes('.') || node.target.includes('*')) continue;
+      if (aliases.has(node.target)) continue;
+      const r = resolve(accessPathOf(node.source));
+      if (!r) continue;
+      aliases.set(node.target, r);
+      changed = true;
+    }
+    if (!changed) break;
+  }
+  if (!aliases.size) return;
+  const minted = new Set(fnSeeds.map((s) => s.seedPath));
+  for (const [, node] of nodes) {
+    const parentOf = new Map();
+    for (const root of exprRoots(node)) walkExpr(root, (e, p) => { if (p) parentOf.set(e, p); });
+    for (const root of exprRoots(node)) {
+      walkExpr(root, (e) => {
+        if (e.kind !== 'member') return;
+        const parent = parentOf.get(e);
+        if (parent && parent.kind === 'member' && parent.object === e) return; // not outermost
+        const p = accessPathOf(e);
+        if (!p || p.includes('*')) return;
+        const root = p.slice(0, p.indexOf('.'));
+        const a = aliases.get(root);
+        if (!a) return;
+        const fieldPath = a.basePath + p.slice(root.length);
+        if (fieldPath === a.seed.seedPath || minted.has(fieldPath)) return;
+        minted.add(fieldPath);
+        const site = fn.cfg.nodes[a.seed.nodeId];
+        mint({ nid: a.seed.nodeId, node: site ?? node, entry: { id: a.seed.entryId }, decision: a.seed, seedPath: fieldPath, seedKind: 'entry' });
+      });
+    }
+  }
+}
+
 // ── §3.5: seedEntryStateFactory — the driver.js opts.seedEntryState hook ──
 
 /**
@@ -233,6 +339,7 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
 export function seedEntryStateFactory(seeds) {
   const byQid = new Map();
   for (const s of seeds) {
+    if (s.seedKind === 'after-node') continue;
     if (!byQid.has(s.qid)) byQid.set(s.qid, []);
     byQid.get(s.qid).push(s);
   }
@@ -244,3 +351,22 @@ export function seedEntryStateFactory(seeds) {
     return st;
   };
 }
+
+/**
+ * Builds the `ctx.seedAfterNode(qid, nodeId) -> [{path, id}] | undefined`
+ * function `engine.js`'s worklist consults after every CFG node (GA-03.1,
+ * 0.195.24): the `after-node` seeds of that function, grouped by node.
+ * Keyed by `qid` rather than bound to one function so the same function
+ * works for a callee analysed through `createCallSummaryResolver`.
+ */
+export function seedAfterNodeFactory(seeds) {
+  const byKey = new Map();
+  for (const s of seeds) {
+    if (s.seedKind !== 'after-node') continue;
+    const k = `${s.qid}\u0000${s.nodeId}`;
+    if (!byKey.has(k)) byKey.set(k, []);
+    byKey.get(k).push({ path: s.seedPath, id: s.dataElementId });
+  }
+  if (!byKey.size) return undefined;
+  return (qid, nodeId) => byKey.get(`${qid}\u0000${nodeId}`);
+}

package/src/lineage/summaries.js

@@ -1,4 +1,4 @@
-import { hashState, emptyState, addIdentity } from './field-identity.js';
+import { hashState, emptyState, addIdentity, joinStates } from './field-identity.js';
 import {
   resolveExprIdentities, residualFlat, analyzeFunctionFieldIdentity,
   argumentContext, callInvocationId, calleeRecorder,
@@ -425,7 +425,8 @@ export function applyAtCallSite(summary, paramNames, callArgs) {
 // integration will pass a resolver backed by `scanner/src/ir/callgraph.js`
 // instead, without this function (or `resolveExprIdentities`) needing to
 // change at all.
-export function createCallSummaryResolver(cache, lookupCallee) {
+export function createCallSummaryResolver(cache, lookupCallee, resolverOpts = {}) {
+  const seedEntryState = typeof resolverOpts.seedEntryState === 'function' ? resolverOpts.seedEntryState : null;
   return function resolveCallSummary(calleeExpr, callArgs, callerState, ctx) {
     const resolved = lookupCallee(calleeExpr);
     if (!resolved) return null;
@@ -435,7 +436,18 @@ export function createCallSummaryResolver(cache, lookupCallee) {
     // own header comment) — this call site forwards the caller's `ctx`
     // unmodified; the hazard cannot reappear here because the strip
     // happens one level down, not at each call site.
-    const entryState = entryStateFromCall(fn.params, callArgs, callerState, ctx);
+    const boundState = entryStateFromCall(fn.params, callArgs, callerState, ctx);
+    // GA-03.1 (0.195.24): the callee's OWN source seeds are facts about
+    // expressions in its body (`req.body.card_number` is a source wherever
+    // `extractCard` is called from), so they hold under every entry context,
+    // not only the driver's top-level one. Join them onto the call-derived
+    // state. The cache key is the JOINED state, so a clean call site and the
+    // driver's own analysis of the callee share one key and one summary;
+    // DESIGN_GRAPH_BUILDER.md §3.6's rule stands: no seeded summary is ever
+    // stored under the empty-entry key. The bind hops below enumerate only
+    // the call-derived half (`boundState`): a seed is not an argument.
+    const ownSeeds = seedEntryState ? seedEntryState(fn) : null;
+    const entryState = ownSeeds ? joinStates(boundState, ownSeeds) : boundState;
     // §13.2's first half: the callee's own entry context, computed once so
     // both the bind hop below and the return-direction wrapper at the
     // bottom of this function can reference the exact same value.
@@ -454,7 +466,7 @@ export function createCallSummaryResolver(cache, lookupCallee) {
     // C4 would collide this binding's target with any caller-local
     // variable of the same name (Decision 5's bug class).
     if (ctx?.recordHop) {
-      for (const [path, ids] of entryState) {
+      for (const [path, ids] of boundState) {
         for (const id of ids) {
           ctx.recordHop({
             kind: 'write-out', subKind: 'call-arg-bind',
@@ -508,6 +520,10 @@ export function createCallSummaryResolver(cache, lookupCallee) {
             ...(ctx.correlationVersion === 2 ? { correlationVersion: 2 } : null),
           }
         : { resolveCallSummary };
+      // GA-03.1 (0.195.24): the callee's after-node seeds are body facts
+      // too (source-seeding.js, SEED_KINDS); the hook is keyed by qid, so
+      // forwarding the caller's is exact.
+      if (ctx?.seedAfterNode) calleeCtx.seedAfterNode = ctx.seedAfterNode;
       const result = analyzeFunctionFieldIdentity(fn, es, calleeCtx);
       return summaryFromAnalysisResult(result);
     });
@@ -524,7 +540,7 @@ export function createCallSummaryResolver(cache, lookupCallee) {
     // under §2.2's rule (or, when there is no path-shaped argument, as
     // edge-forming in its own right) — never dropped either way.
     if (summary?.degradedReason && ctx?.recordHop) {
-      for (const [, ids] of entryState) {
+      for (const [, ids] of boundState) {
         for (const id of ids) {
           ctx.recordHop({
             kind: 'production', subKind: 'call-resolved',

package/src/llm-validator/index.js

@@ -77,6 +77,7 @@ import { localEndpointConfig } from './local-endpoint.js';
 import { resolveProvider, buildProviderRequest, providerMatrix } from './providers.js';
 import { evaluateEgress } from '../egress/policy.js';
 import { recordEgressCall, payloadMetrics } from '../egress/audit.js';
+import { modelFetch } from '../egress/transport.js';
 import { MODEL_STATUS, summarizeModelStatus } from './model-status.js';
 import { callOllamaChat } from './ollama-provider.js';
 
@@ -408,12 +409,13 @@ async function callEndpoint(endpoint, apiKey, model, prompt, preset = null, shap
     // A model that accepts the connection and never answers must not hold a scan open forever: every call is bounded.
     // The result is an UNAVAILABLE finding (kept, unvalidated), never a silent pass.
     const ms = Number(process.env.AGENTIC_SECURITY_LLM_TIMEOUT_MS) > 0 ? Number(process.env.AGENTIC_SECURITY_LLM_TIMEOUT_MS) : 60_000;
-    const r = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body), signal: AbortSignal.timeout(ms) });
+    const r = await modelFetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body) }, { timeoutMs: ms });
     if (!r.ok) return { ok: false, error: `HTTP ${r.status}` };
     const j = await r.json().catch(() => null);
     return { ok: true, text: String(extractText(j) || ''), usage: extractUsage ? extractUsage(j) : null };
   } catch (e) {
-    return { ok: false, error: e && e.name === 'TimeoutError' ? 'timeout' : e.message };
+    // a redirect, an oversized body or a spent budget is an unavailable validator, named by its transport code, never a pass
+    return { ok: false, error: e && e.code === 'timeout' ? 'timeout' : (e && e.code ? `${e.code}: ${e.message}` : e.message) };
   }
 }
 

package/src/llm-validator/local-endpoint.js

@@ -22,7 +22,10 @@
 // The connect timeout is short for the same reason — a dead port must not hang
 // a scan.
 
-const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0']);
+// `localhost` is the one name accepted; `[::1]` is how the URL parser spells the IPv6 loopback (a bare `::1` never reaches this set).
+// `0.0.0.0` is NOT here (GA-06.3): it is the unspecified address, and a connect to it reaches a local interface only by an operating
+// system convention, not by the address's meaning. The promise is "literal loopback", so it is refused like `[::]` and `http://0/`.
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
 
 export const DEFAULT_LOCAL_ENDPOINT = 'http://127.0.0.1:11434/v1/chat/completions';
 export const DEFAULT_LOCAL_TIMEOUT_MS = 20000;

package/src/llm-validator/ollama-provider.js

@@ -32,6 +32,7 @@
 // never to this module's error path. See ollama-offline-egress.test.js.
 
 import { isLoopbackUrl } from './local-endpoint.js';
+import { modelFetch } from '../egress/transport.js';
 import { recordOOMEvent } from './oom-feedback.js';
 
 export const DEFAULT_OLLAMA_HOST = 'http://127.0.0.1:11434';
@@ -199,16 +200,17 @@ export function parseOllamaChatResponse(json, model) {
  * "slow to generate" without a lower-level HTTP client.
  */
 async function _fetchOllama(url, init, { connectTimeoutMs, requestTimeoutMs }) {
-  const controller = new AbortController();
-  const totalTimer = setTimeout(() => controller.abort('total-timeout'), requestTimeoutMs);
+  void connectTimeoutMs; // see the note above: the client exposes no connect-only phase to bound separately
   try {
-    const res = await fetch(url, { ...init, signal: controller.signal });
+    // the shared transport: no redirect is followed, the reply is capped while it is read, the deadline is the total timeout
+    const res = await modelFetch(url, init, { timeoutMs: requestTimeoutMs });
     return { ok: true, res };
   } catch (e) {
-    if (controller.signal.aborted) return _err('ollama-timeout', `Ollama request timed out after ${requestTimeoutMs}ms.`);
+    if (e?.code === 'timeout') return _err('ollama-timeout', `Ollama request timed out after ${requestTimeoutMs}ms.`);
+    if (e?.code === 'redirect') return _err('ollama-unreachable', `Ollama answered with a redirect, which is never followed: ${e.message}`);
+    if (e?.code === 'response-too-large') return _err('ollama-malformed-response', e.message);
+    if (e?.code === 'budget-exhausted') return _err('ollama-timeout', e.message);
     return _err('ollama-unreachable', e?.message || String(e));
-  } finally {
-    clearTimeout(totalTimer);
   }
 }
 

package/src/posture/adversary-agent.js

@@ -26,6 +26,8 @@
 
 import * as crypto from 'node:crypto';
 import { evaluateEgress } from '../egress/policy.js';
+import { modelFetch } from '../egress/transport.js';
+import { resolveProvider } from '../llm-validator/providers.js';
 
 const MAX_CALLS_DEFAULT = 50;
 const MAX_WALL_MS_DEFAULT = 15 * 60 * 1000;
@@ -96,11 +98,21 @@ export function isExceeded(transcript, budget) {
 // and parses the response as a single tool-call request. The endpoint is
 // expected to follow an OpenAI-style chat-completions shape; we extract a
 // JSON object of `{ tool, args }` from the model's reply.
+// GA-06.3: the provider is resolved like the validator's, so the `local` preset's loopback refusal applies here, and a vendor key is
+// sent only with that vendor's own preset (a bare OPENAI_API_KEY is never attached to an arbitrary endpoint). Ollama's protocol is not
+// implemented here, so that preset counts as not configured for this agent.
+export function _agentProvider(env = process.env) {
+  const r = resolveProvider({ role: 'verify', env });
+  if (!r.ok || r.config.provider === 'ollama') return null;
+  return r.config;
+}
+
 export async function defaultLlmInvoke(transcript) {
-  const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
-  if (!endpoint) return null;
-  const model = process.env.AGENTIC_SECURITY_LLM_MODEL || 'gpt-4o-mini';
-  const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY || process.env.OPENAI_API_KEY || '';
+  const provider = _agentProvider();
+  if (!provider) return null;
+  const { endpoint } = provider;
+  const model = provider.model || 'gpt-4o-mini';
+  const apiKey = provider.apiKey || '';
   const headers = { 'Content-Type': 'application/json' };
   if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`;
   const tools = [...TOOL_ACL].map(t => ({ tool: t, description: TOOL_HELP[t] || '' }));
@@ -115,7 +127,7 @@ export async function defaultLlmInvoke(transcript) {
   };
   let res;
   try {
-    res = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body) });
+    res = await modelFetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body) });
   } catch (e) {
     return null;
   }
@@ -136,6 +148,9 @@ const TOOL_HELP = {
   'record_outcome': 'Terminate the run with a verdict (outcome: one of OUTCOMES)',
 };
 
+/** Bounds for a tool probe against the target: a reply is kept to 4000 characters anyway, so 64 KiB and 30 s are generous. */
+const PROBE_BOUNDS = Object.freeze({ timeoutMs: 30_000, maxResponseBytes: 64 * 1024 });
+
 // Default executeTool — wraps http.get / http.post against `transcript.target`.
 // Falls back to refusal when the tool is db.read_sandbox_copy (we do not ship
 // a sandboxed DB by default; the caller must supply one).
@@ -144,7 +159,8 @@ export async function defaultExecuteTool(call, transcript) {
   if (call.tool === 'http.get') {
     const url = (transcript?.target || '').replace(/\/$/, '') + (call.args?.path || '/');
     try {
-      const r = await fetch(url, { method: 'GET', headers: call.args?.headers || {} });
+      // the probe goes through the shared transport too: no redirect off the target, a capped reply, a deadline
+      const r = await modelFetch(url, { method: 'GET', headers: call.args?.headers || {} }, PROBE_BOUNDS);
       const body = await r.text();
       return { status: r.status, headers: Object.fromEntries(r.headers), body: body.slice(0, 4000) };
     } catch (e) { return { error: String(e?.message || e) }; }
@@ -152,11 +168,11 @@ export async function defaultExecuteTool(call, transcript) {
   if (call.tool === 'http.post') {
     const url = (transcript?.target || '').replace(/\/$/, '') + (call.args?.path || '/');
     try {
-      const r = await fetch(url, {
+      const r = await modelFetch(url, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', ...(call.args?.headers || {}) },
         body: typeof call.args?.body === 'string' ? call.args.body : JSON.stringify(call.args?.body || {}),
-      });
+      }, PROBE_BOUNDS);
       const body = await r.text();
       return { status: r.status, headers: Object.fromEntries(r.headers), body: body.slice(0, 4000) };
     } catch (e) { return { error: String(e?.message || e) }; }
@@ -176,8 +192,9 @@ export async function runAgent(finding, opts = {}) {
   // called later in the loop below) never runs at all.
   let egressDecision = null;
   let llmInvoke = opts.llmInvoke || null;
-  if (!llmInvoke && process.env.AGENTIC_SECURITY_LLM_ENDPOINT) {
-    egressDecision = evaluateEgress({ scanRoot: opts.scanRoot, purpose: 'adversary-agent', endpoint: process.env.AGENTIC_SECURITY_LLM_ENDPOINT });
+  const provider = llmInvoke ? null : _agentProvider();
+  if (!llmInvoke && provider) {
+    egressDecision = evaluateEgress({ scanRoot: opts.scanRoot, purpose: 'adversary-agent', endpoint: provider.endpoint });
     if (egressDecision.allowed) llmInvoke = defaultLlmInvoke;
   }
   const executeTool = opts.executeTool || (transcript.target ? (call) => defaultExecuteTool(call, transcript) : null);

package/src/posture/custom-rules.js

@@ -39,6 +39,7 @@ import * as path from 'node:path';
 import * as yaml from '../util/yaml.js';
 import { globFiles } from '../util/glob.js';
 import { loadTrustedKeys, verifyRulePack } from './rule-pack-signing.js';
+import { isUnsafeRegex } from '../sast/redos-nfa.js';
 
 import { statePath, safeWriteState } from './state-dir.js';
 const LANG_EXTS = {
@@ -156,8 +157,19 @@ export function loadCustomRules(scanRoot) {
 // Catches (a+)+, (a*)*, (.+)+, (\w+)+, (a|b)+, (a+|b)* etc.
 // Not exhaustive but eliminates the vast majority of catastrophic patterns.
 const _REDOS_NESTED_RE = /\([^)]*[+*][^)]*\)[+*?{]/;
+// The textual heuristic above misses an ambiguous alternation under a quantifier (`(a|a)*b`) and the polynomial shapes; since
+// 0.195.23 (GA-07) the NFA-based detector the SAST layer already ships (`sast/redos-nfa.js`) is consulted as well, so a custom or
+// compiled rule is held to the same bar as the code the scanner flags for CWE-1333.
 function _isSafePattern(p) {
-  return !_REDOS_NESTED_RE.test(p);
+  if (_REDOS_NESTED_RE.test(p)) return false;
+  return !isUnsafeRegex(p).unsafe;
+}
+/** Why a pattern is refused, for the loader's message and the rule compiler's validation. Null when it is safe. */
+export function unsafePatternReason(p) {
+  if (typeof p !== 'string') return 'not a string';
+  if (_REDOS_NESTED_RE.test(p)) return 'nested quantifiers';
+  const r = isUnsafeRegex(p);
+  return r.unsafe ? (r.reason || 'superlinear matching') : null;
 }
 
 /** The loader's own rule normalizer, exported so anything that scores or validates a rule uses the SAME one the scanner loads

package/src/posture/fleet/cli.js

@@ -15,7 +15,7 @@ import { rollupFleet, renderFleetSummary } from '../fleet.js';
 import { statePath, ensureStateDir, safeWriteState } from '../state-dir.js';
 import { createSqliteJobStore } from './job-store.js';
 import { planRun, runJobs, loadArtifacts, reclaimDeadWorkers, childScan } from './job-runner.js';
-import { computeOrgHealth, renderOrgHealth } from './org-health.js';
+import { computeOrgHealth, renderOrgHealth, applyArtifactProblems } from './org-health.js';
 import { discoverEdges, splitDeclared } from './discover-edges.js';
 import { buildEnterpriseGraph, finalizeGraph, validateEnterpriseGraph, attackPaths, vulnerableSet, componentBlastRadius, renderBlastRadius, INTERNET } from './enterprise-graph.js';
 
@@ -90,9 +90,7 @@ function runOfJob(store, id) {
 async function finishRun({ args, root, store, runId, manifest, manifestFile, interrupted }) {
   const { artifacts, problems } = loadArtifacts({ store, runId, root });
   const jobs = store.listJobs(runId);
-  const health = computeOrgHealth({ manifest, jobs });
-  for (const p of problems) { const r = health.repositories.find((x) => x.id === p.repoId); if (r) { r.state = 'failed'; r.error = p.problem; } }
-  if (problems.length) { health.counts.complete -= problems.filter((p) => health.repositories.find((x) => x.id === p.repoId)).length; health.counts.failed += problems.length; if (health.assurance !== 'red' && manifest.repositories.some((r) => r.required && problems.some((p) => p.repoId === r.id))) health.assurance = 'red'; health.reasons.push(`${problems.length} result(s) could not be verified: ${problems.map((p) => `${p.repoId} (${p.problem})`).join(', ')}`); }
+  const health = applyArtifactProblems(computeOrgHealth({ manifest, jobs }), manifest, problems);
 
   let previous = null;
   const rollupFile = statePath(root, ROLLUP_FILE);