@clear-capabilities/agentic-security-scanner 0.195.27 → 0.195.29

package/CHANGELOG.md

@@ -9,6 +9,30 @@
 > make the history less accurate, not more.
 
 
+## 0.195.29 - `scan --watch` watches, the validator collects callers and configuration, and pilot tooling for the measured targets
+
+**Measured, 0.195.28:** `TIMINGS preflight=3s push=6s pr=1s checks=430s merge=6s verify=6s tag=2s release=131s npm=450s total=1035s release-clock=145s`, shipped from the merge to the published release in 145 s; the run stopped once on a git index lock held by the post-commit gate warm-up, and `ship --resume` continued after it.
+
+- **`scan --watch` exited after its first scan** and never watched anything: the watcher does not block, and the scan command's dispatch exits with whatever the command returns. It now stays running until Ctrl-C or SIGTERM, and says when the first scan is done. A new end-to-end test runs the real CLI with a scope flag: a change to a Git-ignored file does not rescan, and a change to a tracked file under `dist/` (which the default watcher filter skips) does.
+- **The model validator collects callers and configuration** (PRD FR 05). Callers: the nearest function definition above the finding, then up to three call sites of that name in scanned files of the same language, labelled as matched by name rather than resolved. Configuration: environment keys read near the finding, then the scanned configuration files that set them; a real `.env` file is never read, and the value of a secret-like key is masked before redaction. What could not be collected is still stated in the prompt. Prompt version `v2.2-callers-config`, so cached verdicts are not reused.
+- **A Haskell request whose whole destination is a literal is refuted** when the client's text reaches only the query, headers, body, method or authentication: a `constant-input` refutation tied to the file's content hash, kept in the refuted record. A client-chosen path, a concatenation, a custom manager or an unknown record field still only lowers the finding to `info`.
+- **Pilot and benchmark tooling** for the targets that need data the project does not hold. `bench/haskell-pilot/pilot.mjs capture` records what M0 asks for and measures the 95% parse and 90% semantic rates with failures in the denominator, with frozen exclusions; `compare` diffs two reports of one snapshot and says it is not recall. `bench/haskell-core-families/adjudicate.mjs` imports blind two-reviewer labels, reports agreement and Cohen's kappa, adds only unanimous cases, and freezes the manifest and definitions; the runner refuses the holdout without a matching freeze and logs every holdout run, and reports 95% Wilson intervals. No independent case and no pilot snapshot exists yet; every family still reports `insufficient-cases`.
+- **CI**: the cabal store's cache key names the runner's OS release, so packages built on one Ubuntu release are not restored on another.
+
+## 0.195.28 - Git-aware scope, Haskell coverage accounting, and findings that keep their evidence
+
+**Measured, 0.195.27:** `TIMINGS preflight=4s push=8s pr=4s checks=15s merge=6s verify=6s tag=2s release=131s npm=268s total=444s release-clock=145s`, shipped from the merge to the published release in 145 s.
+
+The buildable part of the Haskell coverage and reliable findings plan (FR 01 to FR 03 and FR 05 to FR 11). FR 04's independently labelled benchmark and the pilot measurements are not in this release: every Haskell family still reports `insufficient-cases`. Nothing moved a maturity. Three defaults change, listed first.
+
+- **Default changes.** A dependency finding whose reachability is unknown (`manifest-only`, `transitive-only`) keeps its severity; only an `unreachable` function or a `build-only` dependency lowers it. A model `reject` no longer removes a finding: each finding carries a disposition (`confirmed`, `needs-review`, `refuted`, `hardening`, `unvalidated`), and only evidence or a reviewed suppression refutes. Findings from different detectors about the same weakness at the same line are grouped under one primary with the others listed in `claims`, and the report reconciles raw, grouped, refuted and disposition counts (`candidateReconciliation`); drift compares grouped members too, so grouping never shows a finding as fixed.
+- **Git-aware scope (FR 01).** The scan inventory follows Git: an ignored file is never opened (an instrumented test proves it), a tracked file under a default-skipped directory such as `dist/` or `vendor/` stays eligible, submodules and nested repositories are reported as unscanned units, and `--explain-scope` says why each path is in or out. A finding outside a narrower scan's coverage is out of scope, never fixed. `scan --watch` keeps the scope flags on every rescan and asks the same inventory, rebuilt when `.gitignore` changes.
+- **Haskell coverage (FR 02, FR 03).** Coverage is accounted by stage, package and rule family, listing completed and remaining files. `AGENTIC_SECURITY_HASKELL_PARSE_BUDGETS` raises named parse bounds (unknown names are refused and reported), and `.agentic-security/haskell-budget.json` records the work left so the next scan states what completed, what will hit the same bound again and what changed. There is no resume: every scan re-parses every file. Reviewed project models describe wrappers, and are matched only by the scan of their own root.
+- **Model validation (FR 05).** The model sees numbered spans (the finding, source, sink, path steps, related Haskell and Nix files), each redacted under its own path, plus a stated list of what was not collected (callers, configuration). It must cite span lines: a citation outside what it was shown voids the reply (`escalate`), no citation is recorded as missing evidence, and valid citations are evidence that never confirms on its own. Prompt version `v2.1-cited`, so cached verdicts are not reused. Accepted suppressions are bound to a content fingerprint and reopen when the code changes.
+- **Workflows (FR 06).** GitHub Actions files are parsed as YAML: composite actions, `github-script`, inputs to unknown actions, `workflow_run` artifacts, agent actions with write authority on untrusted triggers, and OIDC trust policy evidence (`restrictive`, `permissive`, `mismatched`, `absent`) with this repository's name taken from its `origin` remote. Reference: `docs/reference/workflow-analysis.md`.
+- **Linux isolated Nix evaluation, tested for the first time.** The hosted runner image moved to Ubuntu 26.04, which ships `bwrap`, so the NIX-011 suite exercised the Linux sandbox instead of reporting `unsupported`, and found three defects. Namespaces did not stop process creation: the probe spawned `/bin/echo`, so evaluation was correctly refused as `blocked`. A seccomp filter now denies fork, vfork and non-thread clone (threads still work) on x86_64 and arm64; another architecture gets no filter, and the probe refuses it. `--clearenv` dropped the clean environment, so the evaluator ran with no `HOME`, `PATH` or `LANG`; it is now set inside the sandbox. The memory ceiling summed the process group, which `--new-session` leaves, so a memory balloon was never counted; it now sums the process tree. On 26.04 the GHC 9.4.8 bindist still asks for the `gold` linker (in its settings and in the `hsc2hs` wrapper), which binutils no longer ships; CI now removes the flag from the GHC install when gold is absent.
+- **Noise, evidence and views (FR 07 to FR 10).** Comment-only developer notes and missing-control findings are classified (`hardening`); dependency findings record their basis and merge advisory aliases with every occurrence kept; JSON output carries a scan record, finding record and disposition; `--exclude-kind` and view filters change what is shown, never the stored evidence.
+
 ## 0.195.27 - GA programme, release G: provenance adverse histories with a frozen contract and an absolute latency budget, promoted-rule regressions that run in CI
 
 **Measured, 0.195.26:** `TIMINGS preflight=3s push=7s pr=4s checks=393s merge=6s verify=5s tag=2s release=161s npm=636s total=1217s release-clock=174s`, shipped from the merge to the published release in 174 s; the npm listing lagged the publish and `ship --resume` confirmed it.

package/bin/agentic-security.js

@@ -11,6 +11,9 @@ const PKG_VERSION = __require('../package.json').version;
 import { signLastScan as _signLastScan, verifyLastScan as _verifyLastScanShared } from '../src/posture/integrity.js';
 import { isProvenanceHealthy, sanitizeForTerminal } from '../src/posture/provenance/schema.js';
 import { runScan } from '../src/runScan.js';
+import { parseScopeFlags, renderScopePreview } from '../src/scope/flags.js';
+import { buildDispositionView, parseExcludeKinds } from '../src/report/disposition-view.js';
+import { buildScanInventory } from '../src/scope/inventory.js';
 import { persistGraphSnapshot, loadSnapshots, loadSnapshot, mostRecentPriorSnapshot } from '../src/lineage/graph-snapshot.js';
 
 // Every command is dispatched as `process.exit(await cmdX(args))`, and
@@ -339,6 +342,9 @@ Options:
   --pr [ref]                   Diff-aware: scan only files changed since ref (auto-detects PR base)
   --deterministic              Reproducible scan: stable sort, no-network, lockfile-checked
   --incremental                Reuse taint summaries from prior scans (speeds up deep mode in CI)
+  --explain-scope              Preview included/skipped paths and ignore reasons, then exit (also --include-path, --exclude-path, --include-ignored-path, --ignore-source all|repository, --no-respect-gitignore)
+  --exclude-kind <k[,k]>       Hide sca, generated, secrets or logic findings from the report view only (still stored; not marked assessed)
+  --view-category/-language/-package/-path/-disposition <v>, --view-min-confidence <n>   Filter the report view
   --set-baseline               Save current findings as baseline (suppresses pre-existing issues)
   --since-baseline             Only show findings NOT in the saved baseline
   --hide-proven-safe           Drop findings discharged by a flow proof (provably safe)
@@ -551,6 +557,7 @@ async function writeMachineOutput(targetAbs, scan, meta, profile, args) {
   }
 }
 
+const SCOPE_BOOLEAN_FLAGS = new Set(['explain-scope', 'respect-gitignore', 'no-respect-gitignore']);
 function parseArgs(argv) {
   const args = { _: [], flags: {} };
   for (let i = 0; i < argv.length; i++) {
@@ -559,6 +566,8 @@ function parseArgs(argv) {
       const [k, v] = a.slice(2).split('=', 2);
       if (v !== undefined) { args.flags[k] = v; continue; }
       const next = argv[i + 1];
+      // Scope switches never take a value, so `--explain-scope .` keeps `.` as the target.
+      if (SCOPE_BOOLEAN_FLAGS.has(k)) { args.flags[k] = true; continue; }
       if (next && !next.startsWith('--')) { args.flags[k] = next; i++; }
       else args.flags[k] = true;
     } else {
@@ -688,6 +697,14 @@ async function cmdScan(args) {
     console.error(`agentic-security scan: "${target}" does not exist (resolved to ${targetAbs}); nothing was scanned.`);
     process.exit(4);
   }
+  // FR 01: Git-aware scope flags. Any of them opts this run into the inventory-based scope;
+  // --explain-scope previews it and exits before any analysis or file read.
+  const scopeFlags = parseScopeFlags(process.argv.slice(2));
+  if (scopeFlags.errors.length) { for (const e of scopeFlags.errors) process.stderr.write(`agentic-security scan: ${e}\n`); return 2; }
+  if (scopeFlags.explain) {
+    process.stdout.write(renderScopePreview(buildScanInventory(targetAbs, scopeFlags.scope)));
+    return 0;
+  }
   // Load persona profile (R1). Persona-aware defaults flow from here.
   const profile = loadPersonaProfile(targetAbs, args);
   const format = args.flags.format || (profile.profile === 'pro' ? 'cli' : 'ship');
@@ -722,14 +739,19 @@ async function cmdScan(args) {
   // normal one-shot scan.
   if (args.flags['watch']) {
     process.env.AGENTIC_SECURITY_INCREMENTAL = '1';
-    const { watchProject, computeDelta, persistStatus, renderStatusLine } = await import('../src/posture/watch-mode.js');
+    const { watchProject, computeDelta, persistStatus, renderStatusLine, createScopeFilter } = await import('../src/posture/watch-mode.js');
     process.stderr.write(`[watch] scanning ${targetAbs} on change — Ctrl-C to stop. Status → .agentic-security/watch-status.md\n`);
-    const seed = await runScan(targetAbs, { onProgress: scanProgressReporter() });
+    // The scope flags apply to the first scan, every rescan and the watcher itself (PRD FR 01): the watcher asks the same
+    // inventory, so an ignored file never triggers a rescan and an eligible one always does.
+    const _watchScoped = scopeFlags.active || process.env.AGENTIC_SECURITY_GIT_SCOPE === '1';
+    const _watchScanOpts = scopeFlags.active ? { gitScope: true, scope: scopeFlags.scope } : {};
+    const seed = await runScan(targetAbs, { onProgress: scanProgressReporter(), ..._watchScanOpts });
     clearScanProgressLine();
     let prevFindings = seed.scan.findings || [];
+    process.stderr.write(`[watch] first scan done (${prevFindings.length} finding(s)); watching for changes${_watchScoped ? ' in the scan scope' : ''}\n`);
     await watchProject(targetAbs, async () => {
       try {
-        const { scan } = await runScan(targetAbs, { onProgress: scanProgressReporter() });
+        const { scan } = await runScan(targetAbs, { onProgress: scanProgressReporter(), ..._watchScanOpts });
         clearScanProgressLine();
         const curr = scan.findings || [];
         const delta = computeDelta(prevFindings, curr);
@@ -739,8 +761,13 @@ async function cmdScan(args) {
       } catch (e) {
         process.stderr.write(`[watch] rescan failed: ${e.message}\n`);
       }
+    }, _watchScoped ? { isEligible: createScopeFilter(targetAbs, scopeFlags.active ? scopeFlags.scope : {}) } : {});
+    // watchProject does NOT block: it starts its loop and returns. The dispatch is `process.exit(await cmdScan(args))`, so returning here
+    // exited right after the first scan and `scan --watch` never watched anything. Stay pending until Ctrl-C or SIGTERM.
+    return await new Promise((resolve) => {
+      process.once('SIGINT', () => resolve(130));
+      process.once('SIGTERM', () => resolve(143));
     });
-    return 0; // watchProject blocks until aborted
   }
 
   // --incremental : reuse taint summaries from prior scans for faster deep mode.
@@ -797,7 +824,10 @@ async function cmdScan(args) {
 
   const { scan, meta } = await runScan(target, {
     changedSince,
+    invocation: process.argv.slice(2),
     onProgress: scanProgressReporter(),
+    ...(scopeFlags.active ? { gitScope: true, scope: scopeFlags.scope } : {}),
+    ...(args.flags['haskell-source-map'] ? { haskellSourceMap: String(args.flags['haskell-source-map']) } : {}),
   });
   // --require-provenance: flag (never fail) any finding whose provenance
   // isn't resolved, via scanHealth — deliberately independent of the
@@ -962,6 +992,13 @@ async function cmdScan(args) {
       if (_line) process.stderr.write(`⚠️  agentic-security: ${_line}\n`);
     }
   } catch { /* reporting must never fail a scan */ }
+  // PRD FR 09: disposition view. Display only; stored buckets are not touched.
+  { const ek = parseExcludeKinds(args.flags['exclude-kind']);
+    if (ek.errors.length) { for (const e of ek.errors) process.stderr.write(`agentic-security scan: ${e}\n`); return 2; }
+    const flt = {};
+    for (const k of ['category', 'language', 'package', 'path', 'disposition']) if (args.flags[`view-${k}`]) flt[k] = String(args.flags[`view-${k}`]);
+    if (args.flags['view-min-confidence'] !== undefined) flt.minConfidence = Number(args.flags['view-min-confidence']);
+    scan.reportView = buildDispositionView(scan, { excludeKinds: ek.kinds, filters: flt }); }
 
   // Curated rule packs: --pack <name> (repeatable). Narrows findings to the
   // CWEs covered by the requested pack(s).