@clear-capabilities/agentic-security-scanner 0.78.0 → 0.80.0

package/src/posture/suppressions.js

@@ -8,9 +8,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as yaml from 'js-yaml';
-
-const VIBECODER_PATH = '.agentic-security/accepted.json';
-const PRO_PATH = '.agentic-security/suppressions.yml';
+import { statePath, safeWriteState } from './state-dir.js';
 
 const MS_PER_DAY = 86400000;
 const SOFT_TTL_DAYS = 30;
@@ -22,7 +20,7 @@ function _dateOnly(iso) {
 }
 
 export function loadSoftAccepted(scanRoot) {
-  const fp = path.join(scanRoot || process.cwd(), VIBECODER_PATH);
+  const fp = statePath(scanRoot, 'accepted.json');
   if (!fs.existsSync(fp)) return [];
   try {
     const raw = JSON.parse(fs.readFileSync(fp, 'utf8'));
@@ -31,9 +29,8 @@ export function loadSoftAccepted(scanRoot) {
 }
 
 export function saveSoftAccepted(scanRoot, items) {
-  const fp = path.join(scanRoot || process.cwd(), VIBECODER_PATH);
-  fs.mkdirSync(path.dirname(fp), { recursive: true });
-  fs.writeFileSync(fp, JSON.stringify({ accepted: items }, null, 2));
+  const fp = statePath(scanRoot, 'accepted.json');
+  safeWriteState(fp, JSON.stringify({ accepted: items }, null, 2));
 }
 
 export function addSoftAcceptance(scanRoot, finding, reason) {
@@ -53,7 +50,7 @@ export function addSoftAcceptance(scanRoot, finding, reason) {
 }
 
 export function loadProSuppressions(scanRoot) {
-  const fp = path.join(scanRoot || process.cwd(), PRO_PATH);
+  const fp = statePath(scanRoot, 'suppressions.yml');
   if (!fs.existsSync(fp)) return [];
   try {
     const parsed = yaml.load(fs.readFileSync(fp, 'utf8'));

package/src/posture/threat-model-auto.js

@@ -0,0 +1,268 @@
+// Auto-generated threat model — Recommendation #2 of the world-class+2 plan.
+//
+// Builds a STRIDE threat model from the scan's findings + IR + privacy
+// taint. Outputs Mermaid diagrams + per-asset attack trees grounded in
+// actual scanner evidence. The model is "live" — regenerated every scan
+// so it can't bit-rot.
+//
+// Pipeline:
+//   1. Identify external entities — every route, message-queue consumer,
+//      file ingest, S3 listener, etc.
+//   2. Identify trust boundaries — entity → handler boundary, internal-
+//      service → external-service boundary
+//   3. Identify assets — every PII/PHI/PCI field, every credential, every
+//      authoritative DB/cache, every secret-bearing service
+//   4. Apply STRIDE per (entity, asset) pair using template-driven rules
+//   5. Generate attack trees rooted at each high-value asset with leaves
+//      grounded in actual scanner findings
+//
+// Output:
+//   { entities, boundaries, assets, threats, attackTrees, mermaid }
+//
+// Persisted to .agentic-security/threat-model.json (machine-readable) and
+// .agentic-security/threat-model.md (human-readable).
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+// STRIDE category descriptors
+const STRIDE = {
+  S: { label: 'Spoofing',         control: 'Authentication / Identity' },
+  T: { label: 'Tampering',        control: 'Integrity / Authorization' },
+  R: { label: 'Repudiation',      control: 'Audit logs / Non-repudiation' },
+  I: { label: 'Information Disclosure', control: 'Confidentiality / Encryption' },
+  D: { label: 'Denial of Service',control: 'Availability / Rate limiting' },
+  E: { label: 'Elevation of Privilege', control: 'Authorization / Least privilege' },
+};
+
+// Map CWE → STRIDE categories. Multi-mapping is allowed.
+const CWE_TO_STRIDE = {
+  'CWE-22':  ['I'],            // path-traversal
+  'CWE-78':  ['E', 'T'],       // command-injection
+  'CWE-79':  ['T'],            // xss
+  'CWE-89':  ['T', 'I'],       // sql-injection
+  'CWE-90':  ['T'],            // ldap-injection
+  'CWE-94':  ['E'],            // code-injection
+  'CWE-113': ['T'],            // header injection
+  'CWE-134': ['I'],            // format-string
+  'CWE-200': ['I'],            // information-exposure
+  'CWE-287': ['S'],            // improper authentication
+  'CWE-307': ['S'],            // brute-force
+  'CWE-327': ['I'],            // weak-crypto
+  'CWE-330': ['S'],            // weak-rng
+  'CWE-352': ['T'],            // csrf
+  'CWE-359': ['I'],            // private-info exposure
+  'CWE-415': ['D', 'E'],       // double-free
+  'CWE-416': ['D', 'E'],       // use-after-free
+  'CWE-434': ['E'],            // file upload
+  'CWE-502': ['E'],            // insecure-deserialization
+  'CWE-601': ['T'],            // open-redirect
+  'CWE-611': ['I'],            // xxe
+  'CWE-639': ['E'],            // IDOR
+  'CWE-643': ['T'],            // xpath injection
+  'CWE-798': ['I', 'S'],       // hardcoded-secret
+  'CWE-918': ['I', 'E'],       // ssrf
+  'CWE-1004':['I'],            // missing cookie hardening
+  'CWE-1321':['T', 'E'],       // prototype-pollution
+  'CWE-1333':['D'],            // ReDoS
+  'CWE-1427':['T'],            // prompt injection
+};
+
+function _stridesForFinding(f) {
+  const c = f.cwe || '';
+  if (CWE_TO_STRIDE[c]) return CWE_TO_STRIDE[c];
+  // Family-based fallback
+  if (f.family === 'sql-injection') return ['T', 'I'];
+  if (f.family === 'command-injection') return ['E', 'T'];
+  if (f.family === 'xss') return ['T'];
+  if (f.family === 'hardcoded-secret') return ['I'];
+  return ['T'];
+}
+
+/**
+ * Build the threat-model graph. `scan` is the engine's scan result
+ * structure (findings + routes + supplyChain).
+ */
+export function buildThreatModel(scan, opts = {}) {
+  const entities = [];   // external entities: routes, queue consumers, file ingest
+  const boundaries = []; // trust boundary edges
+  const assets = [];     // valuables: PII, credentials, DBs
+  const threats = [];    // (entity, asset, stride) tuples
+
+  // Step 1: external entities — routes
+  for (const r of (scan.routes || [])) {
+    entities.push({
+      kind: 'http-route',
+      id: `route:${r.method || 'ANY'}:${r.path || r.file + ':' + r.line}`,
+      method: r.method || 'ANY',
+      path: r.path || null,
+      file: r.file, line: r.line,
+      requiresAuth: !!r.requiresAuth,
+    });
+  }
+  // External entities — message queues / consumers / file ingest (best-effort
+  // heuristic from findings).
+  for (const f of (scan.findings || [])) {
+    if (/kafka|sqs|sns|rabbit|pubsub|kinesis/i.test(f.snippet || '')) {
+      entities.push({ kind: 'queue-consumer', id: `queue:${f.file}:${f.line}`, file: f.file, line: f.line });
+    }
+  }
+
+  // Step 2: assets — PII / credentials / DBs
+  for (const f of (scan.findings || [])) {
+    if (f.family === 'hardcoded-secret') {
+      assets.push({ kind: 'credential', id: `cred:${f.file}:${f.line}`, file: f.file, line: f.line, name: (f.vuln||'').slice(0, 80) });
+    }
+    if (f.family === 'pii-exposure') {
+      assets.push({ kind: 'pii', id: `pii:${f.file}:${f.line}`, file: f.file, line: f.line, classes: f.piiClass || [] });
+    }
+  }
+  // DB-shaped assets: routes that touch SQL.
+  const dbAsset = { kind: 'datastore', id: 'datastore:default', name: 'Application Database' };
+  let hasDbFinding = false;
+  for (const f of (scan.findings || [])) {
+    if (f.family === 'sql-injection' || /SqlCommand|prepareStatement|EntityManager/i.test(f.snippet || '')) {
+      hasDbFinding = true; break;
+    }
+  }
+  if (hasDbFinding) assets.push(dbAsset);
+
+  // Step 3: trust boundaries
+  for (const e of entities) {
+    boundaries.push({ from: 'external', to: e.id, kind: 'trust-boundary', requiresAuth: e.requiresAuth });
+  }
+  for (const a of assets) {
+    boundaries.push({ from: 'application', to: a.id, kind: 'asset-boundary' });
+  }
+
+  // Step 4: STRIDE per finding (each finding implies one or more threats)
+  for (const f of (scan.findings || [])) {
+    const sts = _stridesForFinding(f);
+    for (const st of sts) {
+      threats.push({
+        stride: st,
+        strideLabel: STRIDE[st]?.label || st,
+        cwe: f.cwe || null,
+        family: f.family,
+        severity: f.severity,
+        file: f.file, line: f.line,
+        vuln: f.vuln,
+        finding_id: f.id,
+        affectsAsset: assets.find(a =>
+          (a.kind === 'credential' && f.family === 'hardcoded-secret') ||
+          (a.kind === 'pii' && f.family === 'pii-exposure') ||
+          (a.kind === 'datastore' && (f.family === 'sql-injection' || f.family === 'insecure-deserialization'))
+        )?.id || null,
+        atEntity: entities.find(e => e.file === f.file && Math.abs((e.line||0) - (f.line||0)) <= 50)?.id || null,
+      });
+    }
+  }
+
+  // Step 5: attack trees — per high-value asset
+  const attackTrees = assets.map(a => {
+    const leaves = threats
+      .filter(t => t.affectsAsset === a.id)
+      .map(t => ({
+        label: `${t.strideLabel} via ${t.family} (${t.cwe || '—'})`,
+        severity: t.severity,
+        file: t.file, line: t.line,
+        finding_id: t.finding_id,
+      }));
+    return {
+      root: `Compromise ${a.kind}: ${a.name || a.id}`,
+      asset_id: a.id,
+      leaves,
+      severity: leaves.some(l => l.severity === 'critical') ? 'critical'
+              : leaves.some(l => l.severity === 'high')     ? 'high' : 'medium',
+    };
+  });
+
+  return { entities, boundaries, assets, threats, attackTrees };
+}
+
+/**
+ * Render the model as a Mermaid flowchart for visual review.
+ */
+export function renderMermaid(model) {
+  const lines = ['flowchart TB'];
+  lines.push('  subgraph External');
+  for (const e of model.entities.slice(0, 30)) {
+    lines.push(`    ${_mid(e.id)}["${e.kind}: ${e.method || ''} ${e.path || (e.file||'') + ':' + (e.line||'')}"]`);
+  }
+  lines.push('  end');
+  lines.push('  subgraph Application');
+  for (const a of model.assets.slice(0, 30)) {
+    lines.push(`    ${_mid(a.id)}{{"${a.kind}: ${a.name || a.id}"}}`);
+  }
+  lines.push('  end');
+  for (const b of model.boundaries.slice(0, 100)) {
+    if (b.kind === 'trust-boundary') {
+      lines.push(`  External --> ${_mid(b.to)}`);
+    } else if (b.kind === 'asset-boundary') {
+      lines.push(`  ${_mid(b.from)} -.-> ${_mid(b.to)}`);
+    }
+  }
+  return lines.join('\n');
+}
+
+function _mid(id) { return String(id).replace(/[^A-Za-z0-9]/g, '_').slice(0, 60); }
+
+/**
+ * Persist threat model to disk: JSON for tooling, Markdown for review.
+ */
+export function persistThreatModel(scanRoot, model) {
+  const dir = path.join(scanRoot, '.agentic-security');
+  try { fs.mkdirSync(dir, { recursive: true }); } catch {}
+  try { fs.writeFileSync(path.join(dir, 'threat-model.json'), JSON.stringify(model, null, 2)); } catch {}
+  try { fs.writeFileSync(path.join(dir, 'threat-model.md'), renderMarkdown(model)); } catch {}
+}
+
+function renderMarkdown(model) {
+  const lines = [];
+  lines.push('# Threat Model (auto-generated)');
+  lines.push('');
+  lines.push(`Generated by agentic-security on ${new Date().toISOString().slice(0,10)}.`);
+  lines.push('');
+  lines.push('This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.');
+  lines.push('');
+  lines.push('## Entities + boundaries');
+  lines.push('');
+  lines.push('```mermaid');
+  lines.push(renderMermaid(model));
+  lines.push('```');
+  lines.push('');
+  lines.push('## Assets');
+  lines.push('');
+  for (const a of model.assets.slice(0, 100)) {
+    lines.push(`- **${a.kind}**: ${a.name || a.id} — at \`${a.file || '(global)'}${a.line ? ':'+a.line : ''}\``);
+  }
+  lines.push('');
+  lines.push('## STRIDE threats');
+  lines.push('');
+  const byStride = {};
+  for (const t of model.threats) (byStride[t.stride] ||= []).push(t);
+  for (const [st, threats] of Object.entries(byStride)) {
+    lines.push(`### ${STRIDE[st]?.label || st} (${threats.length})`);
+    lines.push('');
+    for (const t of threats.slice(0, 25)) {
+      lines.push(`- [${t.severity}] **${t.family}** (${t.cwe || '—'}) at \`${t.file}:${t.line}\` — ${t.vuln}`);
+    }
+    if (threats.length > 25) lines.push(`- … and ${threats.length - 25} more`);
+    lines.push('');
+  }
+  lines.push('## Attack trees');
+  lines.push('');
+  for (const tree of model.attackTrees) {
+    lines.push(`### ${tree.root}`);
+    lines.push(`Severity rollup: **${tree.severity}**`);
+    lines.push('');
+    for (const leaf of tree.leaves.slice(0, 20)) {
+      lines.push(`- [${leaf.severity}] ${leaf.label} — \`${leaf.file}:${leaf.line}\``);
+    }
+    if (tree.leaves.length > 20) lines.push(`- … and ${tree.leaves.length - 20} more leaves`);
+    lines.push('');
+  }
+  return lines.join('\n');
+}
+
+export const _internals = { STRIDE, CWE_TO_STRIDE };

package/src/posture/triage-learning.js

@@ -0,0 +1,170 @@
+// Continuous learning from triage decisions — Recommendation #8 of the
+// world-class roadmap.
+//
+// Every triage transition (open → fixed | wont-fix | false-positive)
+// auto-tunes a per-(project, family, file-glob, sink-method) calibration
+// store. The store directly modifies finding confidence scores on
+// subsequent scans, so the scanner's precision on each individual
+// codebase improves monotonically the longer it runs.
+//
+// Calibration shape:
+//
+//   { "global": {  // per-(family, sink-method) prior across all projects
+//       "sql-injection|.executeQuery": { tp: 142, fp: 7, lastUpdated: "..." }
+//     },
+//     "perProject": {  // per-(file-glob, family) project-specific delta
+//       "src/admin/**|hardcoded-secret": { tp: 0, fp: 23, lastUpdated: "..." }
+//     }
+//   }
+//
+// Update rule on triage:
+//   transition → 'fixed' / 'wont-fix-because-not-exploitable' counts as TP+1
+//   transition → 'false-positive' counts as FP+1
+//
+// Application rule at scan time:
+//   confidence *= bayesianFactor(prior, project)
+// where bayesianFactor uses a beta-distribution update of the priors.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { statePath, safeWriteState } from './state-dir.js';
+
+const CALIBRATION_FILE = 'triage-calibration.json';
+
+// Minimum sample size before per-project calibration takes effect. With
+// fewer than this many triage decisions, we fall back to global priors.
+const MIN_PROJECT_SAMPLES = 5;
+
+// Bayesian prior — beta(α, β) over the precision rate. α=1, β=1 is a
+// uniform prior (no opinion); α=2, β=1 mildly favors precision.
+const PRIOR_ALPHA = 2;
+const PRIOR_BETA = 1;
+
+function _storePath(scanRoot) {
+  return statePath(scanRoot, CALIBRATION_FILE);
+}
+
+export function loadCalibration(scanRoot) {
+  const fp = _storePath(scanRoot);
+  if (!fs.existsSync(fp)) return { global: {}, perProject: {} };
+  try { return JSON.parse(fs.readFileSync(fp, 'utf8')); }
+  catch { return { global: {}, perProject: {} }; }
+}
+
+function _save(scanRoot, data) {
+  const fp = _storePath(scanRoot);
+  safeWriteState(fp, JSON.stringify(data, null, 2));
+}
+
+function _bucketKey(family, sinkMethod) {
+  return `${family || 'unknown'}|${sinkMethod || ''}`;
+}
+
+function _projectKey(fileGlob, family) {
+  return `${fileGlob || '*'}|${family || 'unknown'}`;
+}
+
+/**
+ * Record a triage decision. Called by the triage transition path.
+ *   verdict ∈ { 'true-positive', 'false-positive' }
+ */
+export function recordTriageDecision(scanRoot, finding, verdict) {
+  if (!finding || !verdict) return null;
+  const data = loadCalibration(scanRoot);
+  const family = finding.family;
+  const sinkMethod = _extractSinkMethod(finding);
+  const fileGlob = _fileGlobFor(finding.file);
+  const now = new Date().toISOString();
+
+  const gk = _bucketKey(family, sinkMethod);
+  data.global[gk] ||= { tp: 0, fp: 0, lastUpdated: now };
+  if (verdict === 'true-positive') data.global[gk].tp++;
+  if (verdict === 'false-positive') data.global[gk].fp++;
+  data.global[gk].lastUpdated = now;
+
+  const pk = _projectKey(fileGlob, family);
+  data.perProject[pk] ||= { tp: 0, fp: 0, lastUpdated: now };
+  if (verdict === 'true-positive') data.perProject[pk].tp++;
+  if (verdict === 'false-positive') data.perProject[pk].fp++;
+  data.perProject[pk].lastUpdated = now;
+
+  _save(scanRoot, data);
+  return { gk, pk, data };
+}
+
+/**
+ * Apply learned calibration to a fresh batch of findings. Modifies
+ * confidence in place. Returns { adjusted: int, suppressed: int }
+ * — findings whose adjusted confidence drops below `suppressThreshold`
+ * are filtered out (added to the suppression log instead).
+ */
+export function applyLearnedCalibration(scanRoot, findings, opts = {}) {
+  if (!Array.isArray(findings)) return { adjusted: 0, suppressed: 0 };
+  const data = loadCalibration(scanRoot);
+  const suppressThreshold = opts.suppressThreshold ?? 0.2;
+  let adjusted = 0;
+  const suppressedList = [];
+  for (const f of findings) {
+    const factor = _learnedFactor(data, f);
+    if (factor === 1.0) continue;
+    const before = typeof f.confidence === 'number' ? f.confidence : 0.85;
+    const after = Math.max(0.01, Math.min(0.99, before * factor));
+    f.confidence = after;
+    f._learnedCalibration = { factor, before, samples: _sampleCount(data, f) };
+    adjusted++;
+    if (after < suppressThreshold) {
+      f._suppressed_by = 'triage-learning';
+      suppressedList.push(f);
+    }
+  }
+  return { adjusted, suppressed: suppressedList.length, suppressedList, data };
+}
+
+function _learnedFactor(data, finding) {
+  const family = finding.family;
+  const sinkMethod = _extractSinkMethod(finding);
+  const fileGlob = _fileGlobFor(finding.file);
+
+  // Per-project: beta-distribution precision estimate when N is large enough.
+  const pk = _projectKey(fileGlob, family);
+  const proj = data.perProject?.[pk];
+  if (proj && proj.tp + proj.fp >= MIN_PROJECT_SAMPLES) {
+    const p = (PRIOR_ALPHA + proj.tp) / (PRIOR_ALPHA + PRIOR_BETA + proj.tp + proj.fp);
+    return p / 0.5;  // 0.5 = neutral prior precision
+  }
+  // Global: same formula, less aggressive scaling.
+  const gk = _bucketKey(family, sinkMethod);
+  const glob = data.global?.[gk];
+  if (glob && glob.tp + glob.fp >= MIN_PROJECT_SAMPLES) {
+    const p = (PRIOR_ALPHA + glob.tp) / (PRIOR_ALPHA + PRIOR_BETA + glob.tp + glob.fp);
+    return (0.7 * (p / 0.5)) + 0.3; // weight: 70% global, 30% neutral
+  }
+  return 1.0;
+}
+
+function _sampleCount(data, finding) {
+  const family = finding.family;
+  const sinkMethod = _extractSinkMethod(finding);
+  const fileGlob = _fileGlobFor(finding.file);
+  const pk = _projectKey(fileGlob, family);
+  const gk = _bucketKey(family, sinkMethod);
+  const proj = data.perProject?.[pk] || { tp: 0, fp: 0 };
+  const glob = data.global?.[gk] || { tp: 0, fp: 0 };
+  return { perProject: proj.tp + proj.fp, global: glob.tp + glob.fp };
+}
+
+function _extractSinkMethod(finding) {
+  if (finding.sink?.method) return finding.sink.method;
+  // Try to parse from the vuln string ("SQL Injection — executeQuery").
+  const m = (finding.vuln || '').match(/\b([A-Za-z_]\w*)\s*\(/);
+  return m ? m[1] : '';
+}
+
+function _fileGlobFor(file) {
+  if (!file) return '*';
+  const parts = file.split('/');
+  if (parts.length <= 2) return file;
+  return parts.slice(0, 2).join('/') + '/**';
+}
+
+export const _internals = { _bucketKey, _projectKey, _extractSinkMethod, _fileGlobFor, MIN_PROJECT_SAMPLES };

package/src/posture/triage.js

@@ -4,13 +4,13 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-
-const STORE_PATH = '.agentic-security/triage.json';
+import { statePath, safeWriteState } from './state-dir.js';
+import { appendAcceptRiskFromTriage } from './sca-policy.js';
 
 export const STATES = ['open', 'in-progress', 'fixed', 'wont-fix', 'false-positive'];
 
 function _storePath(scanRoot) {
-  return path.join(scanRoot || process.cwd(), STORE_PATH);
+  return statePath(scanRoot, 'triage.json');
 }
 
 export function loadTriage(scanRoot) {
@@ -22,8 +22,7 @@ export function loadTriage(scanRoot) {
 
 function _save(scanRoot, data) {
   const fp = _storePath(scanRoot);
-  fs.mkdirSync(path.dirname(fp), { recursive: true });
-  fs.writeFileSync(fp, JSON.stringify(data, null, 2));
+  safeWriteState(fp, JSON.stringify(data, null, 2));
 }
 
 // Sync the triage store with the latest scan: new findings become 'open',
@@ -46,6 +45,15 @@ export function syncWithScan(scanRoot, findings) {
         assignee: null,
         opened_at: now,
         comments: [],
+        // Phase 4 / Item 7: capture SCA-relevant fields so the
+        // triage → sca-policy bridge has enough data to materialize an
+        // accept-risk entry on wont-fix. No-ops for SAST findings.
+        type: f.type || null,
+        name: f.name || null,
+        version: f.version || null,
+        ecosystem: f.ecosystem || null,
+        osvId: f.osvId || null,
+        cveAliases: Array.isArray(f.cveAliases) ? f.cveAliases : [],
       };
       data.transitions.push({ id, from: null, to: 'open', at: now });
     }
@@ -82,7 +90,22 @@ export function transition(scanRoot, id, toState, comment) {
   if (toState === 'fixed') cur.fixed_at = new Date().toISOString();
   data.transitions.push({ id, from, to: toState, at: new Date().toISOString(), comment });
   _save(scanRoot, data);
-  return { ok: true };
+
+  // Phase 4 / Item 7 of the SCA improvement plan — bridge wont-fix
+  // transitions on SCA findings into sca-policy.yml accept-risk entries
+  // so the suppression is durable across rescans. The finding object on
+  // the triage store has a `type` field when it was synced from a scan
+  // via syncWithScan; we only bridge type === 'vulnerable_dep'.
+  let policyBridge = null;
+  if (toState === 'wont-fix' && cur.type === 'vulnerable_dep') {
+    try {
+      const reason = comment || `Marked wont-fix in triage on ${new Date().toISOString().slice(0,10)}`;
+      policyBridge = appendAcceptRiskFromTriage(scanRoot, cur, reason);
+    } catch (e) {
+      policyBridge = { ok: false, reason: String(e && e.message || e) };
+    }
+  }
+  return { ok: true, policyBridge };
 }
 
 export function comment(scanRoot, id, author, body) {

package/src/posture/validator-metrics.js

@@ -24,11 +24,11 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { statePath, safeWriteState } from './state-dir.js';
 
-const FILE = '.agentic-security/validator-metrics.json';
 const HISTORY_CAP = 100;
 
-function _filePath(scanRoot) { return path.join(scanRoot || process.cwd(), FILE); }
+function _filePath(scanRoot) { return statePath(scanRoot, 'validator-metrics.json'); }
 
 function _read(scanRoot) {
   const fp = _filePath(scanRoot);
@@ -39,10 +39,7 @@ function _read(scanRoot) {
 
 function _write(scanRoot, data) {
   const fp = _filePath(scanRoot);
-  try {
-    fs.mkdirSync(path.dirname(fp), { recursive: true });
-    fs.writeFileSync(fp, JSON.stringify(data, null, 2));
-  } catch { /* swallow — telemetry is best-effort */ }
+  safeWriteState(fp, JSON.stringify(data, null, 2));
 }
 
 function _round(n) { return Math.round(n * 10000) / 10000; }