@clear-capabilities/agentic-security-scanner 0.84.1 → 0.118.2

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-d6b7d0e3b2bad322c0dff29963703601e98bd7d8205281544e7c839543191d73  agentic-security.mjs
+7625811bf6f85d6a9d7dd8b96cded3aff2a57426d1816b1591c3a410d87df8b5  agentic-security.mjs

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.84.1",
-  "description": "Scanner engine for the agentic-security Claude Code plugin \u2014 SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
+  "version": "0.118.2",
+  "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
   "bin": {
@@ -41,6 +41,10 @@
     "js-yaml": "^4.1.1",
     "safe-regex": "^2.1.1"
   },
+  "optionalDependencies": {
+    "web-tree-sitter": "0.20.8",
+    "tree-sitter-wasms": "0.1.13"
+  },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "@vercel/ncc": "^0.38.3"
@@ -50,13 +54,13 @@
     "lodash-es": "^4.18.1"
   },
   "scripts": {
-    "build": "ncc build bin/agentic-security.js -o dist --minify && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
+    "build": "ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
     "prepublishOnly": "npm run build && node -e \"const fs=require('fs');const cur=fs.existsSync('CHANGELOG.md')?fs.readFileSync('CHANGELOG.md','utf8'):'';const src=fs.readFileSync('../CHANGELOG.md','utf8');if(cur && cur!==src){console.error('scanner/CHANGELOG.md has local edits that differ from ../CHANGELOG.md.');console.error('Refusing to overwrite. Either commit the edit upstream first or rm scanner/CHANGELOG.md to accept the upstream copy.');process.exit(1);}fs.writeFileSync('CHANGELOG.md',src);\"",
     "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
     "test:smoke": "node --test test/smoke.test.js",
-    "test:sast": "node --test test/llm.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js",
-    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js",
-    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js",
+    "test:sast": "node --test test/llm.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js",
+    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/coverage-report.test.js test/corpus-status.test.js",
+    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/kcfa-context.test.js test/callgraph-resolve.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js",
     "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js",
@@ -70,6 +74,8 @@
     "bench:llm-goats": "node test/benchmark/llm-goats/bench-llm-goats.js",
     "bench:cve-replay": "node ../bench/cve-replay/runner.mjs",
     "bench:cve-replay:ci": "node ../bench/cve-replay/runner.mjs --ci",
+    "bench:cve-replay:check": "node ../bench/cve-replay/runner.mjs --check-baseline",
+    "bench:cve-replay:update-baseline": "node ../bench/cve-replay/runner.mjs --update-baseline",
     "bench:bigquery:smoke": "node ../bench/bigquery-github/bin/run-cycle.mjs --smoke",
     "bench:bigquery": "node ../bench/bigquery-github/bin/run-cycle.mjs",
     "bench:agent-tasks": "node ../bench/agent-tasks/security-fixer/runner.mjs",

package/src/.agentic-security/dpia.md

@@ -0,0 +1,26 @@
+# Data Protection Impact Assessment (DPIA)
+
+Generated by agentic-security scanner on 2026-06-01.
+
+This is an automated DPIA scaffold derived from static analysis.
+It must be reviewed and completed by a privacy officer before use.
+
+## Data classes identified
+
+## Privacy-related findings
+
+| Severity | File:Line | Class → Sink | Description |
+|---|---|---|---|
+
+## Regulatory framework mapping
+
+- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
+- **CCPA §1798.130** — Notice + access rights for collected personal information.
+
+## Reviewer checklist
+
+- [ ] Confirm each PII field's collection has a documented lawful basis
+- [ ] Confirm retention period for each class is documented
+- [ ] Confirm DSAR (data subject access request) workflow exists
+- [ ] Confirm encryption at rest + in transit for each class
+- [ ] Confirm logging of PII access for audit (where applicable)

package/src/.agentic-security/pqc-migration-plan.json

@@ -0,0 +1,80 @@
+{
+  "generatedAt": "2026-06-01T03:18:44.823Z",
+  "summary": {
+    "total": 2,
+    "hndlCritical": 1,
+    "standard": 1,
+    "filesAffected": 2,
+    "primitivesNeeded": [
+      "ML-KEM-768",
+      "ML-DSA-65"
+    ]
+  },
+  "milestones": [
+    {
+      "id": "M1",
+      "title": "Inventory & policy",
+      "target": "90 days",
+      "owner": "security",
+      "items": [
+        "Confirm scanner findings against design docs",
+        "Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)",
+        "Establish KMS support for hybrid keys"
+      ]
+    },
+    {
+      "id": "M2",
+      "title": "HNDL-critical paths to PQ-hybrid",
+      "target": "180 days",
+      "owner": "platform",
+      "items": [
+        {
+          "finding": "pqc-rsa-encrypt:sast/post-quantum-crypto.js:136",
+          "file": "sast/post-quantum-crypto.js",
+          "line": 136,
+          "replacement": "X25519+ML-KEM-768 (CNSA 2.0 transitional)"
+        }
+      ]
+    },
+    {
+      "id": "M3",
+      "title": "Standard signing/KEX migration",
+      "target": "12 months",
+      "owner": "platform",
+      "items": [
+        {
+          "finding": "pqc-ed25519:posture/rule-pack-signing.js:187",
+          "file": "posture/rule-pack-signing.js",
+          "line": 187,
+          "replacement": "ML-DSA-65"
+        }
+      ]
+    },
+    {
+      "id": "M4",
+      "title": "Deprecate classical primitives",
+      "target": "24 months",
+      "owner": "security",
+      "items": [
+        "Remove dual-stack libraries once peers are PQ-capable",
+        "Rotate root CA / long-lived signing keys to ML-DSA"
+      ]
+    }
+  ],
+  "perFile": {
+    "sast/post-quantum-crypto.js": {
+      "count": 1,
+      "subfamilies": [
+        "pqc-rsa-encrypt"
+      ],
+      "hndlCritical": true
+    },
+    "posture/rule-pack-signing.js": {
+      "count": 1,
+      "subfamilies": [
+        "pqc-ed25519"
+      ],
+      "hndlCritical": false
+    }
+  }
+}

package/src/.agentic-security/pqc-migration-plan.md

@@ -0,0 +1,32 @@
+# Post-quantum cryptography migration plan
+
+Generated 2026-06-01.
+
+**2** pre-quantum primitive sites across **2** files.  
+HNDL-critical: **1** | Standard: **1**
+
+## Recommended PQ primitives
+- ML-KEM-768
+- ML-DSA-65
+
+## M1 — Inventory & policy (target 90 days, owner security)
+- Confirm scanner findings against design docs
+- Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)
+- Establish KMS support for hybrid keys
+
+## M2 — HNDL-critical paths to PQ-hybrid (target 180 days, owner platform)
+- `sast/post-quantum-crypto.js:136` → X25519+ML-KEM-768 (CNSA 2.0 transitional)
+
+## M3 — Standard signing/KEX migration (target 12 months, owner platform)
+- `posture/rule-pack-signing.js:187` → ML-DSA-65
+
+## M4 — Deprecate classical primitives (target 24 months, owner security)
+- Remove dual-stack libraries once peers are PQ-capable
+- Rotate root CA / long-lived signing keys to ML-DSA
+
+## References
+- NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA)
+- NIST IR 8547 — Transition to Post-Quantum Cryptographic Standards
+- CNSA 2.0 — Commercial National Security Algorithm Suite, Sept 2022
+- RFC 9794 — X25519MLKEM768 hybrid key exchange for TLS 1.3
+- Open Quantum Safe project (liboqs, oqs-provider for OpenSSL 3)

package/src/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json

@@ -0,0 +1,6 @@
+{
+  "sha": "0775d96ba4cf814520d02760cfb3010760c7684f",
+  "ts": "2026-06-01T03:18:44.822Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json

@@ -0,0 +1,6 @@
+{
+  "sha": "29300441d3460832137a8e51a92b74068cad2f15",
+  "ts": "2026-05-31T15:11:38.431Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json

@@ -0,0 +1,6 @@
+{
+  "sha": "3852ad2aa0e50951bed0c930c29d1861aa13d048",
+  "ts": "2026-05-31T18:37:10.534Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json

@@ -0,0 +1,6 @@
+{
+  "sha": "3d96e2daec97e3226c9679bac6e64a89ca10bfe9",
+  "ts": "2026-06-01T01:26:20.969Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json

@@ -0,0 +1,6 @@
+{
+  "sha": "5f0b136622fce09b469a1a6137c04d5b18652ea4",
+  "ts": "2026-05-31T17:42:55.528Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json

@@ -0,0 +1,6 @@
+{
+  "sha": "64e30595d447b62344d0d9200760269df2095332",
+  "ts": "2026-05-31T23:00:26.049Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json

@@ -0,0 +1,6 @@
+{
+  "sha": "71f3241902c9e7437764e3caa046ba8a3bcdd32a",
+  "ts": "2026-06-01T02:46:48.787Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json

@@ -0,0 +1,6 @@
+{
+  "sha": "99c372cdc33ecc9dde92960b4ffadf7775860e61",
+  "ts": "2026-05-31T14:15:28.901Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json

@@ -0,0 +1,6 @@
+{
+  "sha": "9c93b15e8cf3ff2ddb8cdae92371b82e178b463c",
+  "ts": "2026-05-31T04:42:20.497Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json

@@ -0,0 +1,6 @@
+{
+  "sha": "a3544abf1863d71776b61302ca74d9ead2b26a9f",
+  "ts": "2026-05-31T21:53:01.453Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json

@@ -0,0 +1,6 @@
+{
+  "sha": "dca15abdec43c508aa342db86dc5db8d7f01fbbe",
+  "ts": "2026-05-31T22:03:18.622Z",
+  "componentCount": 0,
+  "components": []
+}