@clear-capabilities/agentic-security-scanner 0.195.25 → 0.195.27

package/dist/9560.index.js

@@ -5812,7 +5812,7 @@ function findSiblings({ root, finding, scanFindings = [], limits = SIBLING_LIMIT
 
 /**
  * @param {string} scanRoot
- * @returns {{ok:true, graph:object} | {ok:false, reason:'missing'|'unsigned'|'tampered'|'malformed', message:string}}
+ * @returns {{ok:true, graph:object} | {ok:false, reason:'missing'|'unsigned'|'tampered'|'malformed'|'wrong-revision', message:string}}
  *
  * Four, and only four, distinct failure reasons — each with its own clear
  * message so an operator knows exactly what to do next:
@@ -5829,7 +5829,7 @@ function findSiblings({ root, finding, scanFindings = [], limits = SIBLING_LIMIT
  *                  valid JSON. Should not happen from a normal scan; the
  *                  file may be corrupted on disk after signing.
  */
-function loadSignedGraph(scanRoot) {
+function loadSignedGraph(scanRoot, { expectRevision = null } = {}) {
   const graphPath = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(scanRoot, 'lineage-graph.json');
   const sigPath = graphPath + '.sig';
 
@@ -5879,6 +5879,23 @@ function loadSignedGraph(scanRoot) {
     };
   }
 
+  // GA-03.7 (0.195.26): wrong-revision refusal. A caller that knows which
+  // revision it expects (`dataflow view --expect-revision`) gets a graph
+  // only when the graph records that revision; a graph that records none
+  // cannot prove it and is refused for the same reason, never served on
+  // the hope that it matches.
+  if (expectRevision) {
+    const have = graph && graph.scope && graph.scope.revision ? graph.scope.revision.commit : null;
+    if (have !== expectRevision) {
+      return {
+        ok: false,
+        reason: 'wrong-revision',
+        message: have
+          ? `Lineage graph at ${graphPath} was built from revision ${have}, not the expected ${expectRevision}. Re-run the scan on the expected revision.`
+          : `Lineage graph at ${graphPath} records no revision, so it cannot be shown to match the expected ${expectRevision}. Re-run the scan inside the repository (AGENTIC_SECURITY_LINEAGE_DEEP=1) so the graph records its revision.`,
+      };
+    }
+  }
   return { ok: true, graph };
 }