@clear-capabilities/agentic-security-scanner 0.195.28 → 0.195.30

package/CHANGELOG.md

@@ -9,6 +9,47 @@
 > make the history less accurate, not more.
 
 
+## 0.195.30 - Threat model hardening: verdicts bound to what they tested, honest path limits, a fail-closed restricted profile, and candidate qualification
+
+**Measured, 0.195.29:** `TIMINGS preflight=6s push=13s pr=4s checks=737s merge=5s verify=10s tag=2s release=254s npm=146s total=1177s release-clock=271s`, shipped from the merge to the published release in 271 s; the npm listing lagged the publish and `ship --resume` confirmed it.
+
+The locally verifiable part of the threat model hardening plan. Each of the nine reproduced baseline behaviours (TM-01 to TM-09) has a failing control that now passes. Staging delivery, independent accuracy measurement, attested execution and owner approvals are separate qualifications and are not claimed: the candidate packet records each as blocked. Nothing moved a maturity. Per-requirement state: `docs/implementation-status/threat-model-hardening.md`.
+
+- **Changed results, listed first.**
+  - A hunt's target counter counts only events with the matched route template and method, so an unrelated route no longer inflates it.
+  - An authoritative `authenticated: false` survives a redacted authorization header: a header alone shows a credential was present, not that it was accepted.
+  - An IAM deny blocks only the action, resource and condition it matches; a conditional or opaque deny that can affect the action leaves the path `unresolved` instead of blocked.
+  - A family or directory triage bucket is advisory: a new high finding keeps its confidence.
+  - Corroboration is counted by independent evidence group, not by lens.
+- **Detection (FR-07).** Credential presence and authentication outcome are separate. A new `object-authz` rule detects an authenticated actor receiving another tenant's object. Hunts report window gaps, and a detection signal is never reported as a corroborated effect on its own. CWE-639 moved to the new payload class; the detection IR documents the change.
+- **Scope (FR-01).** Standard JSON carries the `scope` object and a deterministic `inventoryDigest` over every eligibility decision before display caps. Scope preview agrees with it. A release scope reconciliation reports each critical route or unit as covered, excluded, unsupported or unknown.
+- **IAM and paths (FR-03).** Per-action deny evaluation, the `StringEquals`, `StringNotEquals`, `Bool` and `ArnEquals` condition subset, and `truncation.reasons` that tell depth, expansion, result-count and deadline cutoffs apart. A search that hit a bound cannot certify the absence of a path. `boundaries --action` queries one action. The boundary context version is 1.1.0, with optional fields only.
+- **Proof binding (FR-04).** A deployed path is promoted only by an Ed25519-signed proof binding from a trusted issuer. The binding covers the revision, artifact, policy, actor, tenant, route, scenario and oracle. A receipt from another revision or context keeps its stable id with a distinct diagnostic.
+- **Learned decisions (FR-05).** Exact, scoped, HMAC-signed triage decisions apply; bucket matches, expired, copied, cross-tenant and unsigned records do not. A confirmed root cause yields a sibling review queue with six separate states. The legacy `mitigated` count keeps its detector-coverage meaning.
+- **Restricted egress (FR-06).** `AGENTIC_SECURITY_EGRESS_PROFILE=restricted` requires its authoritative policy and fails closed on a malformed, unreadable, missing or unsupported one before any model request. An operator deny always wins. High-impact MCP approvals can be bound to tool, action, target and change, with an expiry; the restricted profile requires that binding.
+- **Pilot (FR-02, FR-08).** Loopback fixtures cover:
+  - a two-tenant records service (PILOT-01 to PILOT-08);
+  - the order approval invariant (wrong guard, then patched);
+  - an app-to-cloud chain whose object store adjudicates with its own evaluator;
+  - a bounded SQLite injection proof (PILOT-12).
+- **Candidate qualification (FR-10).**
+  - A signed candidate packet; gates G-01 to G-07 are recomputed from case evidence, never read from the packet.
+  - `agentic-security release-package qualify <packet> --public-key <pem>` exits 0 only when qualified.
+  - Each case carries a `local`, `staging` or `independent` tier, and a gate that requires a tier (`--require-tier G-05=staging`) counts only cases of that tier.
+  - `revalidateDecision` refuses a decision for another artifact, policy, scanner bundle or packet, or after its evidence expires.
+  - `npm run pilot:qualify` writes one signed packet per deployment identity. On a developer host it reports "not qualified", with the blocked staging, independent and attested-runner cases named.
+- **Evaluation scoring (FR-09.2).** Every enrolled label is reconciled to one status. A negative label whose target the run never reached used to leave the count without a trace; it is now counted as `negativesOutsideRun`.
+
+## 0.195.29 - `scan --watch` watches, the validator collects callers and configuration, and pilot tooling for the measured targets
+
+**Measured, 0.195.28:** `TIMINGS preflight=3s push=6s pr=1s checks=430s merge=6s verify=6s tag=2s release=131s npm=450s total=1035s release-clock=145s`, shipped from the merge to the published release in 145 s; the run stopped once on a git index lock held by the post-commit gate warm-up, and `ship --resume` continued after it.
+
+- **`scan --watch` exited after its first scan** and never watched anything: the watcher does not block, and the scan command's dispatch exits with whatever the command returns. It now stays running until Ctrl-C or SIGTERM, and says when the first scan is done. A new end-to-end test runs the real CLI with a scope flag: a change to a Git-ignored file does not rescan, and a change to a tracked file under `dist/` (which the default watcher filter skips) does.
+- **The model validator collects callers and configuration** (PRD FR 05). Callers: the nearest function definition above the finding, then up to three call sites of that name in scanned files of the same language, labelled as matched by name rather than resolved. Configuration: environment keys read near the finding, then the scanned configuration files that set them; a real `.env` file is never read, and the value of a secret-like key is masked before redaction. What could not be collected is still stated in the prompt. Prompt version `v2.2-callers-config`, so cached verdicts are not reused.
+- **A Haskell request whose whole destination is a literal is refuted** when the client's text reaches only the query, headers, body, method or authentication: a `constant-input` refutation tied to the file's content hash, kept in the refuted record. A client-chosen path, a concatenation, a custom manager or an unknown record field still only lowers the finding to `info`.
+- **Pilot and benchmark tooling** for the targets that need data the project does not hold. `bench/haskell-pilot/pilot.mjs capture` records what M0 asks for and measures the 95% parse and 90% semantic rates with failures in the denominator, with frozen exclusions; `compare` diffs two reports of one snapshot and says it is not recall. `bench/haskell-core-families/adjudicate.mjs` imports blind two-reviewer labels, reports agreement and Cohen's kappa, adds only unanimous cases, and freezes the manifest and definitions; the runner refuses the holdout without a matching freeze and logs every holdout run, and reports 95% Wilson intervals. No independent case and no pilot snapshot exists yet; every family still reports `insufficient-cases`.
+- **CI**: the cabal store's cache key names the runner's OS release, so packages built on one Ubuntu release are not restored on another.
+
 ## 0.195.28 - Git-aware scope, Haskell coverage accounting, and findings that keep their evidence
 
 **Measured, 0.195.27:** `TIMINGS preflight=4s push=8s pr=4s checks=15s merge=6s verify=6s tag=2s release=131s npm=268s total=444s release-clock=145s`, shipped from the merge to the published release in 145 s.

package/bin/agentic-security.js

@@ -147,6 +147,7 @@ Commands:
   release-view <package.json>  Developer, CISO and auditor views of one signed release package (--view, --format text|json|html, --previous, --public-key)
   metrics [path]               Assurance Coverage, Evidence Conversion and Verified Remediation Rate for the last scan, each with numerator and denominator (--format text|json)
   release-package build|verify Build a signed release package from the last scan (--private-key, --output, --fix-records), or check one offline (--public-key)
+                               release-package qualify <packet.json> --public-key <pem>: recompute candidate gates G-01..G-07 from a signed candidate packet (exit 0 only when qualified; --require-case, --require-gate, --require-tier G-05=staging, --output, --format json)
   reset [--yes] [--keep ...]   Right-to-delete: wipe accumulated learned state under .agentic-security/ (preserves operator-authored config)
                                --expired    only remove artifacts past their retention-class TTL
                                Every run writes a deletion-report.json proving what was planned/deleted/preserved/failed.
@@ -181,7 +182,7 @@ Commands:
   scan-baseline --current <f> --previous <f>
                                Finding-level diff between two scan JSON outputs.
                                Reports added / removed / changed findings.
-  boundaries --from <dir> [--findings <last-scan.json>] [--environment <name>] [--out <file>] [--json]
+  boundaries --from <dir> [--findings <last-scan.json>] [--environment <name>] [--out <file>] [--json] [--action <iam-action>]
                                Build a deployment boundary graph from local configuration
                                (and optional sanitized traces) and attach a boundary context
                                to each finding of a scan result. Read-only, local files only.
@@ -748,6 +749,7 @@ async function cmdScan(args) {
     const seed = await runScan(targetAbs, { onProgress: scanProgressReporter(), ..._watchScanOpts });
     clearScanProgressLine();
     let prevFindings = seed.scan.findings || [];
+    process.stderr.write(`[watch] first scan done (${prevFindings.length} finding(s)); watching for changes${_watchScoped ? ' in the scan scope' : ''}\n`);
     await watchProject(targetAbs, async () => {
       try {
         const { scan } = await runScan(targetAbs, { onProgress: scanProgressReporter(), ..._watchScanOpts });
@@ -761,7 +763,12 @@ async function cmdScan(args) {
         process.stderr.write(`[watch] rescan failed: ${e.message}\n`);
       }
     }, _watchScoped ? { isEligible: createScopeFilter(targetAbs, scopeFlags.active ? scopeFlags.scope : {}) } : {});
-    return 0; // watchProject blocks until aborted
+    // watchProject does NOT block: it starts its loop and returns. The dispatch is `process.exit(await cmdScan(args))`, so returning here
+    // exited right after the first scan and `scan --watch` never watched anything. Stay pending until Ctrl-C or SIGTERM.
+    return await new Promise((resolve) => {
+      process.once('SIGINT', () => resolve(130));
+      process.once('SIGTERM', () => resolve(143));
+    });
   }
 
   // --incremental : reuse taint summaries from prior scans for faster deep mode.
@@ -4160,9 +4167,9 @@ Do not suppress anything you are not certain is a false positive. When in doubt,
 // 3 the feature is disabled, blocked or unsupported on this platform (nothing was read).
 async function cmdBoundaries(args) {
   const f = args.flags;
-  const usage = 'Usage: agentic-security boundaries --from <dir> [--findings <last-scan.json>] [--environment <name>] [--repository <name>] [--revision <sha>] [--root <project>] [--out <file>] [--json] [--now <iso>]';
+  const usage = 'Usage: agentic-security boundaries --from <dir> [--findings <last-scan.json>] [--environment <name>] [--repository <name>] [--revision <sha>] [--root <project>] [--out <file>] [--json] [--now <iso>] [--action <iam-action>]';
   if (typeof f.from !== 'string' || !f.from) { console.error(usage); return 2; }
-  for (const k of ['findings', 'environment', 'repository', 'revision', 'out', 'now', 'root']) {
+  for (const k of ['findings', 'environment', 'repository', 'revision', 'out', 'now', 'root', 'action']) {
     if (f[k] !== undefined && (typeof f[k] !== 'string' || !f[k])) { console.error(`agentic-security boundaries: --${k} needs a value\n${usage}`); return 2; }
   }
   const scanRoot = path.resolve(f.root || '.');
@@ -4172,6 +4179,8 @@ async function cmdBoundaries(args) {
   const result = runBoundaries({
     config, from: path.resolve(f.from), environment: f.environment || 'prod', repository: f.repository || null, revision: f.revision || null,
     findingsFile: f.findings ? path.resolve(f.findings) : null, verifySignature: _verifyLastScan, now: f.now,
+    // threat-model FR-03.2: an action-specific query (`--action s3:GetObject`) decides each IAM hop for that action only
+    action: f.action || null,
   });
   if (result.status === 'disabled' || result.status === 'blocked' || result.status === 'unsupported') {
     console.error(`agentic-security boundaries: not run (${result.status}): ${result.reason}`);

package/dist/1340.index.js

@@ -666,6 +666,8 @@ function parseCompose(text, fileCtx) {
   return kit.result();
 }
 
+// EXTERNAL MODULE: ./src/lineage/deployment/iam-eval.js
+var iam_eval = __webpack_require__(1086);
 ;// CONCATENATED MODULE: ./src/lineage/deployment/adapter-cloud.js
 // adapter-cloud.js: Terraform plan JSON and IAM policy documents into
 // deployment boundary nodes and edges (X-302).
@@ -679,6 +681,7 @@ function parseCompose(text, fileCtx) {
 
 
 
+
 const TERRAFORM_PARSER = 'terraform-plan-json';
 const TERRAFORM_PARSER_VERSION = '1';
 const IAM_PARSER = 'iam-policy-json';
@@ -708,10 +711,12 @@ function applyPolicy(kit, identity, policy, subject) {
     const conditioned = isObject(st.Condition) && Object.keys(st.Condition).length > 0;
     read += 1;
     if (resources.length > MAX_RESOURCES_PER_STATEMENT) kit.gap('limit-exceeded', subject, `a statement lists ${resources.length} resources; only the first ${MAX_RESOURCES_PER_STATEMENT} are read`);
+    if (actions.join(',').length > 250) kit.gap('limit-exceeded', subject, 'a statement\'s action list is longer than the graph records; the clipped list leaves decisions about the missing actions unresolved');
+    if (conditioned && (0,iam_eval/* statementAttrs */.c2)(actions, st.Condition).conditionSupported !== true) kit.gap('unsupported-syntax', subject, 'a statement condition uses an operator or value outside the supported subset (StringEquals, StringNotEquals, Bool, ArnEquals); decisions it can affect stay unresolved');
     for (const r of resources.slice(0, MAX_RESOURCES_PER_STATEMENT)) {
       const target = kit.node('resource', `aws/${r}`, { trustZone: 'internal', attrs: r === '*' ? { wildcard: true } : {} });
-      const attrs = { actions: actions.join(',').slice(0, 250) };
-      if (conditioned) attrs.conditioned = true;
+      // threat-model FR-03.1: the action list (and whether it was clipped) and the condition, in a form the path search can decide
+      const attrs = (0,iam_eval/* statementAttrs */.c2)(actions, conditioned ? st.Condition : null);
       kit.edge('grants', identity, target, {
         effect, confidence: conditioned ? 'low' : 'high', discriminator: `${actions.join(',')}${conditioned ? ';cond' : ''}`.slice(0, 250), attrs,
       });
@@ -1638,8 +1643,8 @@ function applyCorrelation(graph, correlation) {
   return (0,boundary_graph/* buildBoundaryGraph */.v4)({ repository: graph.repository, revision: graph.revision, nodes, edges, gaps: graph.gaps, sources: graph.sources });
 }
 
-// EXTERNAL MODULE: ./src/lineage/deployment/projection.js + 1 modules
-var projection = __webpack_require__(73596);
+// EXTERNAL MODULE: ./src/lineage/deployment/projection.js + 2 modules
+var projection = __webpack_require__(83929);
 ;// CONCATENATED MODULE: ./src/lineage/deployment/boundaries-run.js
 // boundaries-run.js: the operator entry point that builds a boundary context for scanned findings (X-308 wiring).
 //
@@ -1741,7 +1746,7 @@ function readScanFindings(file, { maxBytes, verify } = {}) {
  * @param {string} [o.now]         ISO time used to judge trace staleness; defaults to the current time
  * @returns {object} typed result; `status` is ok | disabled | blocked | unsupported | error. Never throws.
  */
-function runBoundaries({ config, from, environment = 'prod', repository = null, revision = null, findingsFile = null, findings: suppliedFindings = null, verifySignature, now } = {}) {
+function runBoundaries({ config, from, environment = 'prod', repository = null, revision = null, findingsFile = null, findings: suppliedFindings = null, verifySignature, now, action = null } = {}) {
   const gate = (0,assurance_config/* featureStatus */.FX)(config, DEPLOYMENT_FEATURE);
   if (gate.status !== 'ok') return { ...gate, report: null };
   const limits = (0,assurance_config/* limitValues */.OH)(config);
@@ -1818,7 +1823,7 @@ function runBoundaries({ config, from, environment = 'prod', repository = null,
     if (integrity === 'unsigned') notes.push('the scan result carries no signature, so its integrity was not verified');
   }
 
-  const attached = (0,projection/* attachBoundaryContext */.Nu)({ config, findings, graph, bindings, now: clock });
+  const attached = (0,projection/* attachBoundaryContext */.Nu)({ config, findings, graph, bindings, now: clock, action });
   if (attached.status !== 'ok') return { ...attached, report: null };
   const contexts = attached.findings.map((f) => f.boundaryContext).filter(Boolean);
   const rows = attached.findings.map((f) => ({