@clear-capabilities/agentic-security-scanner 0.195.26 → 0.195.28

package/dist/7033.index.js

@@ -1152,7 +1152,7 @@ const real = (p) => { try { return (0,external_node_fs_.realpathSync)(p); } catc
  * The sandboxed command for a backend. Reads are an ALLOWLIST (the listed roots, system library paths and the
  * evaluator); writes are an allowlist of one scratch directory; network and process creation are denied.
  * @param {{backend:string, path?:string}} sb
- * @param {{execFile:string, args:string[], readOnly:string[], readFiles?:string[], writable:string[], cwd:string}} spec
+ * @param {{execFile:string, args:string[], readOnly:string[], readFiles?:string[], writable:string[], cwd:string, env?:Record<string,string>}} spec
  */
 function sandboxCommand(sb, spec) {
   const ro = [...new Set(spec.readOnly.map(real))];
@@ -1175,34 +1175,94 @@ function sandboxCommand(sb, spec) {
     for (const p of ro) a.push('--ro-bind', p, p);
     for (const p of files) a.push('--ro-bind', p, p);
     for (const p of rw) a.push('--bind', p, p);
+    // --clearenv empties the environment bwrap itself was given, so the clean one is set explicitly inside.
+    for (const [k, v] of Object.entries(spec.env || {})) a.push('--setenv', k, String(v));
+    // Namespaces do not stop process creation; the seccomp filter does. Before it, a sandboxed process could spawn anything the
+    // read-only binds expose (found the first time a CI runner had bwrap installed). On an architecture with no filter there is
+    // none, and the probe then reports the spawn and refuses to evaluate.
+    const seccomp = seccompNoProcesses(sb.arch || process.arch);
+    if (seccomp) a.push('--seccomp', '3');
     a.push('--chdir', spec.cwd, exec, ...spec.args);
-    return { file: sb.path, args: a, profile: null };
+    return { file: sb.path, args: a, profile: null, fd3: seccomp };
   }
   return null;
 }
 
+// ── seccomp: threads yes, processes no ──────────────────────────────────────
+// A classic-BPF seccomp program, as `bwrap --seccomp FD` reads it (struct sock_filter, native little-endian). It denies fork and vfork,
+// denies clone unless CLONE_THREAD is set (so pthread_create works and posix_spawn, fork and vfork through clone do not), answers clone3
+// with ENOSYS (its flags are behind a pointer a filter cannot read; glibc then falls back to clone), denies x32 syscalls, and kills a
+// process that switches to another syscall ABI.
+const SECCOMP_ARCH = {
+  x64: { audit: 0xc000003e, clone: 56, clone3: 435, deny: [57, 58], x32: true },
+  arm64: { audit: 0xc00000b7, clone: 220, clone3: 435, deny: [], x32: false },
+};
+const CLONE_THREAD = 0x10000;
+function seccompNoProcesses(arch) {
+  const A = SECCOMP_ARCH[arch];
+  if (!A) return null;
+  const LD = 0x20, JEQ = 0x15, JGE = 0x35, JSET = 0x45, RET = 0x06;
+  const ALLOW = 0x7fff0000, EPERM = 0x00050000 | 1, ENOSYS = 0x00050000 | 38, KILL = 0x80000000;
+  // Instructions with symbolic jump targets, resolved to relative offsets below.
+  const prog = [
+    [LD, 0, 0, 4],                                         // arch
+    [JEQ, null, 'kill', A.audit],
+    [LD, 0, 0, 0],                                         // syscall number
+    ...(A.x32 ? [[JGE, 'eperm', null, 0x40000000]] : []),
+    [JEQ, 'enosys', null, A.clone3],
+    ...A.deny.map((nr) => [JEQ, 'eperm', null, nr]),
+    [JEQ, null, 'allow', A.clone],
+    [LD, 0, 0, 16],                                        // clone flags, args[0] low word
+    [JSET, 'allow', 'eperm', CLONE_THREAD],
+    ['allow', RET, ALLOW], ['eperm', RET, EPERM], ['enosys', RET, ENOSYS], ['kill', RET, KILL],
+  ];
+  const at = {};
+  prog.forEach((ins, i) => { if (typeof ins[0] === 'string') at[ins[0]] = i; });
+  const buf = Buffer.alloc(prog.length * 8);
+  prog.forEach((ins, i) => {
+    const [code, jt, jf, k] = typeof ins[0] === 'string' ? [ins[1], 0, 0, ins[2]] : ins;
+    const rel = (t) => (t === null || t === 0 ? 0 : at[t] - i - 1);
+    buf.writeUInt16LE(code, i * 8); buf.writeUInt8(rel(jt), i * 8 + 2); buf.writeUInt8(rel(jf), i * 8 + 3); buf.writeUInt32LE(k >>> 0, i * 8 + 4);
+  });
+  return buf;
+}
+
 // ── process supervisor ───────────────────────────────────────────────────────
-function rssOfGroup(pgid) {
-  const r = (0,external_node_child_process_.spawnSync)('/bin/ps', ['-o', 'rss=', '-g', String(pgid)], { encoding: 'utf8', timeout: 2000 });
+// The memory of the whole process tree under `root`, in MB. Not the process group: bwrap's --new-session puts the sandboxed process in
+// a session and group of its own, so a group sum never saw the evaluator on Linux.
+function rssOfTree(root) {
+  const r = (0,external_node_child_process_.spawnSync)('/bin/ps', ['-A', '-o', 'pid=,ppid=,rss='], { encoding: 'utf8', timeout: 2000 });
   if (r.status !== 0) return 0;
-  return r.stdout.split('\n').map((x) => parseInt(x, 10)).filter(Number.isFinite).reduce((a, b) => a + b, 0) / 1024;
+  const kids = new Map(); const rss = new Map();
+  for (const line of r.stdout.split('\n')) {
+    const [pid, ppid, kb] = line.trim().split(/\s+/).map((x) => parseInt(x, 10));
+    if (!Number.isFinite(pid) || !Number.isFinite(ppid)) continue;
+    rss.set(pid, Number.isFinite(kb) ? kb : 0);
+    if (!kids.has(ppid)) kids.set(ppid, []);
+    kids.get(ppid).push(pid);
+  }
+  let total = 0; const seen = new Set(); const stack = [root];
+  while (stack.length) { const p = stack.pop(); if (seen.has(p)) continue; seen.add(p); total += rss.get(p) || 0; stack.push(...(kids.get(p) || [])); }
+  return total / 1024;
 }
 function killGroup(pid, sig) { try { process.kill(-pid, sig); } catch { try { process.kill(pid, sig); } catch { /* gone */ } } }
 
 /** Run a command to completion under a deadline, an output cap and a memory ceiling. Never throws. */
-function supervise(file, args, { env, cwd, deadlineMs, maxOutputBytes, maxRssMb, killGraceMs = 1500 }) {
+function supervise(file, args, { env, cwd, deadlineMs, maxOutputBytes, maxRssMb, killGraceMs = 1500, fd3 = null }) {
   return new Promise((resolveP) => {
     const t0 = Date.now();
     let child;
-    try { child = (0,external_node_child_process_.spawn)(file, args, { env, cwd, detached: true, stdio: ['ignore', 'pipe', 'pipe'] }); }
+    try { child = (0,external_node_child_process_.spawn)(file, args, { env, cwd, detached: true, stdio: ['ignore', 'pipe', 'pipe', ...(fd3 ? ['pipe'] : [])] }); }
     catch (e) { return resolveP({ status: 'failed', reason: `could not start: ${e.message}`, stdout: '', stderr: '', exitCode: null, signal: null, ms: 0 }); }
+    // fd 3 carries the seccomp program to bwrap; a child that exits before reading it closes the pipe, which is not an error here.
+    if (fd3) { child.stdio[3].on('error', () => {}); child.stdio[3].end(fd3); }
     let out = ''; let err = ''; let bytes = 0; let state = null; let done = false;
     const finish = (extra = {}) => { if (done) return; done = true; clearInterval(poll); clearTimeout(dl); resolveP({ stdout: out, stderr: err.slice(0, 4000), ms: Date.now() - t0, ...extra }); };
     const stop = (why) => { if (state) return; state = why; killGroup(child.pid, 'SIGTERM'); setTimeout(() => killGroup(child.pid, 'SIGKILL'), killGraceMs).unref(); };
     child.stdout.on('data', (d) => { bytes += d.length; if (bytes > maxOutputBytes) { stop('output-limit'); return; } out += d.toString('utf8'); });
     child.stderr.on('data', (d) => { if (err.length < 8000) err += d.toString('utf8'); });
     const dl = setTimeout(() => stop('timed-out'), deadlineMs);
-    const poll = setInterval(() => { if (!state && maxRssMb && rssOfGroup(child.pid) > maxRssMb) stop('resource-limit'); }, 250);
+    const poll = setInterval(() => { if (!state && maxRssMb && rssOfTree(child.pid) > maxRssMb) stop('resource-limit'); }, 250);
     child.on('error', (e) => finish({ status: 'failed', reason: e.message, exitCode: null, signal: null }));
     child.on('close', (code, signal) => {
       killGroup(child.pid, 'SIGKILL');                                          // reap any descendants
@@ -1280,8 +1340,8 @@ async function probeSandbox(sb, opts = {}) {
   const port = tcp.address().port;
   try {
     const exe = opts.nodePath || process.execPath;
-    const cmd = sandboxCommand(sb, { execFile: exe, args: [script, (0,external_node_path_.join)(allowed, 'a.txt'), (0,external_node_path_.join)(outside, 'secret.txt'), (0,external_node_path_.join)(outside, 'w.txt'), (0,external_node_path_.join)(scratch, 'w.txt'), String(port), sockPath], readOnly: [allowed, (0,external_node_path_.dirname)((0,external_node_path_.dirname)(real(exe)))], readFiles: [script], writable: [scratch], cwd: scratch });
-    const r = await supervise(cmd.file, cmd.args, { env: cleanEnv(scratch), cwd: scratch, deadlineMs: limits.probeDeadlineMs, maxOutputBytes: 64 * 1024, maxRssMb: limits.maxRssMb, killGraceMs: limits.killGraceMs });
+    const cmd = sandboxCommand(sb, { env: cleanEnv(scratch), execFile: exe, args: [script, (0,external_node_path_.join)(allowed, 'a.txt'), (0,external_node_path_.join)(outside, 'secret.txt'), (0,external_node_path_.join)(outside, 'w.txt'), (0,external_node_path_.join)(scratch, 'w.txt'), String(port), sockPath], readOnly: [allowed, (0,external_node_path_.dirname)((0,external_node_path_.dirname)(real(exe)))], readFiles: [script], writable: [scratch], cwd: scratch });
+    const r = await supervise(cmd.file, cmd.args, { fd3: cmd.fd3, env: cleanEnv(scratch), cwd: scratch, deadlineMs: limits.probeDeadlineMs, maxOutputBytes: 64 * 1024, maxRssMb: limits.maxRssMb, killGraceMs: limits.killGraceMs });
     let attempts = null;
     try { attempts = JSON.parse(r.stdout.trim()); } catch { /* unparseable: not verified */ }
     if (!attempts) return { verified: false, backend: sb.backend, reason: `the probe did not complete inside the sandbox (${r.reason || r.stderr.slice(0, 120) || 'no output'})`, attempts: {} };
@@ -1304,8 +1364,8 @@ async function probeSandbox(sb, opts = {}) {
 /** @param {{file:string, prefixArgs?:string[]}} nix  the evaluator command (a stand-in in tests) */
 async function detectEvaluator(nix, sb, ctx) {
   const run = async (args) => {
-    const cmd = sandboxCommand(sb, { execFile: nix.file, args: [...(nix.prefixArgs || []), ...args], readOnly: ctx.readOnly, readFiles: [...(ctx.readFiles || []), ...(nix.prefixArgs || []).filter((a) => !a.startsWith('-'))], writable: [ctx.work], cwd: ctx.work });
-    return supervise(cmd.file, cmd.args, { env: cleanEnv(ctx.work), cwd: ctx.work, deadlineMs: 10_000, maxOutputBytes: 64 * 1024, maxRssMb: ctx.limits.maxRssMb, killGraceMs: ctx.limits.killGraceMs });
+    const cmd = sandboxCommand(sb, { env: cleanEnv(ctx.work), execFile: nix.file, args: [...(nix.prefixArgs || []), ...args], readOnly: ctx.readOnly, readFiles: [...(ctx.readFiles || []), ...(nix.prefixArgs || []).filter((a) => !a.startsWith('-'))], writable: [ctx.work], cwd: ctx.work });
+    return supervise(cmd.file, cmd.args, { fd3: cmd.fd3, env: cleanEnv(ctx.work), cwd: ctx.work, deadlineMs: 10_000, maxOutputBytes: 64 * 1024, maxRssMb: ctx.limits.maxRssMb, killGraceMs: ctx.limits.killGraceMs });
   };
   const v = await run(['--version']);
   const ver = (/(\d+\.\d+(?:\.\d+)?)/.exec(v.stdout) || [])[1] || null;
@@ -1359,8 +1419,8 @@ async function runIsolatedEval(o) {
     const feat = await detectEvaluator(o.nix, sb, ctx);
     if (!feat.ok) return stopBefore('unsupported', `${feat.reason}; the project's Nix code was NOT evaluated`, { sandbox: sb, probe: { verified: true }, evaluator: feat });
     const args = [...(o.nix.prefixArgs || []), ...buildEvalArgs(target)];
-    const cmd = sandboxCommand(sb, { execFile: o.nix.file, args, readOnly: ctx.readOnly, readFiles: nixFiles, writable: [ctx.work], cwd: ctx.work });
-    const r = await supervise(cmd.file, cmd.args, { env: cleanEnv(ctx.work, o.env || {}), cwd: ctx.work, deadlineMs: limits.deadlineMs, maxOutputBytes: limits.maxOutputBytes, maxRssMb: limits.maxRssMb, killGraceMs: limits.killGraceMs });
+    const cmd = sandboxCommand(sb, { env: cleanEnv(ctx.work, o.env || {}), execFile: o.nix.file, args, readOnly: ctx.readOnly, readFiles: nixFiles, writable: [ctx.work], cwd: ctx.work });
+    const r = await supervise(cmd.file, cmd.args, { fd3: cmd.fd3, env: cleanEnv(ctx.work, o.env || {}), cwd: ctx.work, deadlineMs: limits.deadlineMs, maxOutputBytes: limits.maxOutputBytes, maxRssMb: limits.maxRssMb, killGraceMs: limits.killGraceMs });
     const base = { ...keep, projectCodeEvaluated: true, sandbox: { backend: sb.backend }, evaluator: { version: feat.version }, ms: r.ms, target: { attribute: target.attribute, system: target.system, installable: target.installable } };
     if (r.status !== 'ok') return { ...base, status: r.status === 'failed' ? 'failed' : r.status, reason: r.reason || r.stderr.slice(0, 200) };
     let data;

package/dist/7838.index.js

@@ -396,6 +396,7 @@ function mutatorCoverage(code) {
 /* harmony export */   r_: () => (/* binding */ checkLeakage),
 /* harmony export */   z: () => (/* binding */ gatePromotion)
 /* harmony export */ });
+/* unused harmony export dependentExamples */
 /* harmony import */ var _corpus_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(43556);
 // Promotion gate (PRD 3 "Promotion Gate"): precision/recall thresholds, zero protected-negative failures, zero
 // benchmark leakage. A candidate rule does NOT automatically become a production rule — `evaluateRule` only
@@ -468,9 +469,30 @@ function gatePromotion({ ir, corpus, leakageCheck, thresholds } = {}) {
   else if (ind.detected < ind.positives) reasons.push(`misses ${ind.positives - ind.detected} of ${ind.positives} independent vulnerable example(s)`);
   if (ind.negatives < t.minIndependentClean) reasons.push(`${ind.negatives} independent safe example(s) (min ${t.minIndependentClean}): supply independentCleanCode`);
   else if (ind.falseAlarms > 0) reasons.push(`fires on ${ind.falseAlarms} of ${ind.negatives} independent safe example(s)`);
+  for (const dup of dependentExamples(corpus)) reasons.push(`${dup.label} is not independent: it is the same code as ${dup.sameAs} (the source finding, its patch or a generated mutation), so it grades nothing the source did not`);
   return { pass: reasons.length === 0, reasons, evaluation: evalResult, independent: ind };
 }
 
+// GA-07 §2 (0.195.27): an "independent" example that is the original snippet, its patch, or one of the compiler's own mutations
+// (whitespace aside) is circular grading, which the independent-example rule exists to prevent. Compared after collapsing
+// whitespace so a re-indented copy is caught; a genuinely different example with the same shape is not (that is what a rule is for).
+const squash = (s) => String(s ?? '').replace(/\s+/g, ' ').trim();
+function dependentExamples(corpus) {
+  const known = new Map();
+  for (const item of [...(corpus?.positives ?? []), ...(corpus?.negatives ?? [])]) {
+    if (item.label.startsWith('independent-')) continue;
+    const k = squash(item.code);
+    if (k && !known.has(k)) known.set(k, item.label);
+  }
+  const out = [];
+  for (const item of [...(corpus?.positives ?? []), ...(corpus?.negatives ?? [])]) {
+    if (!item.label.startsWith('independent-')) continue;
+    const sameAs = known.get(squash(item.code));
+    if (sameAs) out.push({ label: item.label, sameAs });
+  }
+  return out;
+}
+
 
 /***/ }),
 

package/dist/9220.index.js

@@ -7,6 +7,7 @@ export const modules = {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   computeDelta: () => (/* binding */ computeDelta),
+/* harmony export */   createScopeFilter: () => (/* binding */ createScopeFilter),
 /* harmony export */   persistStatus: () => (/* binding */ persistStatus),
 /* harmony export */   renderStatusLine: () => (/* binding */ renderStatusLine),
 /* harmony export */   watchProject: () => (/* binding */ watchProject)
@@ -17,6 +18,7 @@ export const modules = {
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
 /* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(31174);
 /* harmony import */ var _language_discovery_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(30951);
+/* harmony import */ var _scope_inventory_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(58585);
 // Watch mode — continuous incremental scan as the developer edits.
 //
 // Spawns a long-running scan watcher that:
@@ -44,6 +46,7 @@ export const modules = {
 
 
 
+
 const STATUS_MD   = 'watch-status.md';
 const STATUS_JSON = 'watch-status.json';
 const DEBOUNCE_MS = 350;
@@ -52,6 +55,25 @@ const MAX_BURST   = 50; // ignore beyond this # of rapid events
 const SCAN_EXT_RE = /\.(?:[jt]sx?|mjs|cjs|py|java|kt|go|rb|php|cs|c|cc|cpp|h|hpp|rs|sol|vy|swift|dart|toml|yml|yaml|json|tf|tfvars|bicep)$/i;
 const IGNORE_DIR_RE = /(?:^|\/)(?:\.git|node_modules|\.bench-cache|dist|build|\.next|coverage|\.agentic-security)(?:$|\/)/;
 
+// Under Git scope (PRD FR 01) the watcher asks the same inventory the scan uses, so a change to a Git-ignored file does not
+// trigger a rescan, and a tracked file under a directory the default list would skip (`dist/`, `build/`) still does. A change
+// to an ignore source rebuilds the inventory. A path the inventory has not seen (a new file) rebuilds it, at most once a second.
+const IGNORE_SOURCE = /(?:^|\/)\.gitignore$|^\.git\/info\/exclude$/;
+function createScopeFilter(scanRoot, scope = {}, { build = _scope_inventory_js__WEBPACK_IMPORTED_MODULE_5__/* .buildScanInventory */ .mP, now = Date.now } = {}) {
+  let included = null;
+  let builtAt = -Infinity;
+  const rebuild = () => { included = new Set(build(scanRoot, scope).included); builtAt = now(); };
+  rebuild();
+  return (rel) => {
+    if (!rel || /^\.agentic-security(?:\/|$)/.test(rel)) return false;
+    if (IGNORE_SOURCE.test(rel)) { rebuild(); return true; }
+    if (/^\.git(?:\/|$)/.test(rel)) return false;
+    if (included.has(rel)) return true;
+    if (now() - builtAt >= 1000) rebuild();
+    return included.has(rel);
+  };
+}
+
 function _isScanable(rel) {
   if (!rel) return false;
   // An explicit export is evidence even though it lives in a build directory.
@@ -181,6 +203,7 @@ function readStatus(scanRoot) {
 async function watchProject(scanRoot, onChange, opts = {}) {
   if (process.env.AGENTIC_SECURITY_NO_WATCH === '1') return { stop: async () => {}, _disabled: true };
   const recursive = opts.recursive !== false;
+  const eligible = typeof opts.isEligible === 'function' ? opts.isEligible : _isScanable;
   const ac = new AbortController();
   let timer = null;
   const pending = new Set();
@@ -202,7 +225,7 @@ async function watchProject(scanRoot, onChange, opts = {}) {
       for await (const evt of node_fs_promises__WEBPACK_IMPORTED_MODULE_0__.watch(scanRoot, { recursive, signal: ac.signal })) {
         if (stopped) break;
         const rel = String(evt.filename || '').replace(/\\/g, '/');
-        if (!_isScanable(rel)) continue;
+        if (!eligible(rel)) continue;
         pending.add(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, rel));
         if (timer) clearTimeout(timer);
         timer = setTimeout(flush, DEBOUNCE_MS);