@clear-capabilities/agentic-security-scanner 0.84.1 → 0.118.2

package/src/dataflow/proof-gate.js

@@ -0,0 +1,95 @@
+// Proof-gate precision pass — roadmap item #6 ("perfect multi-language SAST").
+//
+// The engine produces two INDEPENDENT flow-proof signals that, until now,
+// were either informational-only or wired in isolation:
+//
+//   f.provenClean        (proven-clean.js)   — every reaching path to a SQL
+//                                              sink passes a parameterizer.
+//   f._provenUnreachable (exploit-prover.js) — a sanitizer on the path emits
+//                                              output that cannot contain the
+//                                              vuln family's metacharacters.
+//
+// This pass consolidates them into ONE verdict per finding and applies a
+// precision demotion — the central idea of the precision gate:
+//
+//   "Report only provably-feasible flows. A flow we can PROVE is clean or
+//    infeasible is demoted, not dropped — the auditor still sees it, and a
+//    severity-based CI gate still fires, but it stops dominating the risk
+//    ranking and stops tripping confidence filters."
+//
+// Output stamped on every finding:
+//   f.proof = { verdict, reasons[] }
+//     verdict ∈ 'proven-clean' | 'proven-infeasible' | 'feasible' | 'unproven'
+//   f.proofGated = true            (only when a demotion was applied)
+//
+// Demotion policy is deliberately RECALL-PRESERVING:
+//   - lower `confidence` by DEMOTE_FACTOR and recompute its tier,
+//   - drop `confidenceTier` / `exploitabilityTier` one notch,
+//   - record an `exploitabilityFactors` breadcrumb,
+//   - leave `severity` UNTOUCHED. The proofs here are heuristic (path-
+//     existence / regex-exclusion), so they must never hide a finding from a
+//     severity gate. Confidence/exploitability are the safe levers.
+
+const DEMOTE_FACTOR = 0.4;
+
+// Tier ladders, lowest → highest. demoteTier moves one step down.
+const CONFIDENCE_TIERS = ['very-low', 'low', 'medium', 'high'];
+const EXPLOITABILITY_TIERS = ['low', 'medium', 'high', 'critical'];
+
+function demoteTier(tier, ladder) {
+  const i = ladder.indexOf(tier);
+  if (i <= 0) return ladder[0];
+  return ladder[i - 1];
+}
+
+// Decide the proof verdict for a single finding from the upstream signals.
+export function verdictForFinding(f) {
+  if (f.provenClean === true) {
+    const sanitizers = (f.provenanceProof && f.provenanceProof.sanitizers) || [];
+    return { verdict: 'proven-clean', reason: sanitizers.length ? `parameterized via ${sanitizers.join(', ')}` : 'sql-parameterizer-on-path' };
+  }
+  if (f._provenUnreachable === true) {
+    return { verdict: 'proven-infeasible', reason: f._provenUnreachableReason || 'sanitizer-excludes-metacharacters' };
+  }
+  // A taint finding that reached a sink with attributed sources, for which we
+  // could NOT discharge a clean/infeasible proof, is "feasible" — the flows
+  // a precision-gated report should lead with. Non-taint findings are simply
+  // outside the proof model → "unproven" (no demotion, no claim).
+  if (f.parser === 'IR-TAINT') return { verdict: 'feasible', reason: 'reaches-sink, no clean/infeasible proof discharged' };
+  return { verdict: 'unproven', reason: 'no flow-proof applicable to this finding class' };
+}
+
+// Annotate findings in place. Returns the same array with a non-enumerable
+// `_proofGateStats` for benchmarking.
+export function annotateProofGate(findings, opts = {}) {
+  if (!Array.isArray(findings)) return findings;
+  const factor = typeof opts.demoteFactor === 'number' ? opts.demoteFactor : DEMOTE_FACTOR;
+  const stats = { gated: 0, feasible: 0, provenClean: 0, provenInfeasible: 0, unproven: 0 };
+
+  for (const f of findings) {
+    if (!f || typeof f !== 'object') continue;
+    const { verdict, reason } = verdictForFinding(f);
+    f.proof = { verdict, reasons: [reason] };
+
+    if (verdict === 'feasible') { stats.feasible++; continue; }
+    if (verdict === 'unproven') { stats.unproven++; continue; }
+
+    // proven-clean | proven-infeasible → recall-preserving demotion.
+    if (verdict === 'proven-clean') stats.provenClean++; else stats.provenInfeasible++;
+
+    if (typeof f.confidence === 'number') {
+      f._confidenceBeforeProofGate = f.confidence;
+      f.confidence = Math.max(0.01, Number((f.confidence * factor).toFixed(4)));
+    }
+    if (f.confidenceTier) f.confidenceTier = demoteTier(f.confidenceTier, CONFIDENCE_TIERS);
+    if (f.exploitabilityTier) f.exploitabilityTier = demoteTier(f.exploitabilityTier, EXPLOITABILITY_TIERS);
+    if (Array.isArray(f.exploitabilityFactors)) f.exploitabilityFactors.push(`proof:${verdict}`);
+    f.proofGated = true;
+    stats.gated++;
+  }
+
+  Object.defineProperty(findings, '_proofGateStats', { value: stats, enumerable: false, configurable: true });
+  return findings;
+}
+
+export const _internals = { DEMOTE_FACTOR, CONFIDENCE_TIERS, EXPLOITABILITY_TIERS, demoteTier };

package/src/dataflow/summaries.js

@@ -1,9 +1,18 @@
 // Function-summary cache for context-sensitive interprocedural taint.
 //
-// PRD §6.2: "k-CFA configurable per analysis." This module implements the
-// k=1 monovariant version — each function gets ONE summary per distinct
-// entry-taint-state, cached by hash. Higher k = exponential blowup we don't
-// pay yet.
+// PRD §6.2: "k-CFA configurable per analysis." This module is VALUE-context
+// sensitive (FR-SEM-2): a function gets a distinct summary PER distinct
+// entry-taint-state, cached by hash and computed lazily at the call sites
+// that need it (see engine.js). So a helper that is pure when called with
+// clean args but vulnerable when called with tainted args is modelled
+// correctly at each call site, not collapsed to one empty-entry result.
+//
+// To bound the blowup that per-context computation invites, the number of
+// distinct NON-empty contexts kept per function is capped
+// (`_maxContextsPerFn`, env `AGENTIC_SECURITY_KCFA_MAX_CONTEXTS`, default 16;
+// 0 = pure monovariant). Over the cap we reuse the empty-entry summary.
+// Call-string (k>1) sensitivity is still not modelled — context is the
+// value-abstraction (which params are tainted), not the call stack.
 //
 // A summary captures, given a set of tainted parameter names at function
 // entry, what the function does:
@@ -43,6 +52,18 @@ export class SummaryCache {
     this._stack = new Set(); // qids currently being analyzed (recursion guard)
     this._iter = 0;
     this._maxIter = 5000;
+    // FR-SEM-2 (roadmap #2): the engine computes a distinct summary per
+    // entry-taint-state (value-context sensitivity), computed lazily at call
+    // sites. To stop that from blowing up when a hot helper is reached under
+    // many distinct tainted-arg combinations, cap the number of NON-empty
+    // entry contexts kept per function. Over the cap we reuse the empty-entry
+    // (monovariant) summary — the conservative base the pre-pass computed.
+    //   AGENTIC_SECURITY_KCFA_MAX_CONTEXTS=N  (default 16)
+    //   ...=0  disables context-sensitivity (pure monovariant).
+    this._contextsByQid = new Map(); // qid → Set<stateHash> of computed contexts
+    const envCap = Number(process.env.AGENTIC_SECURITY_KCFA_MAX_CONTEXTS);
+    this._maxContextsPerFn = Number.isFinite(envCap) && envCap >= 0 ? envCap : 16;
+    this._contextCapHits = 0;
   }
 
   _key(qid, taintedParams, receiverType) {
@@ -77,6 +98,24 @@ export class SummaryCache {
       const cached = this._cache.get(k);
       if (!cached._recursive) return cached;
     }
+    // Context cap (FR-SEM-2). Empty entry is always allowed — it's the base
+    // summary the pre-pass computes for every function. For a NON-empty
+    // context that's new and over budget, reuse the empty-entry summary
+    // instead of computing a fresh one.
+    const stateHash = _hashState(taintedParams);
+    if (stateHash !== 'empty') {
+      let ctxs = this._contextsByQid.get(qid);
+      if (!ctxs) { ctxs = new Set(); this._contextsByQid.set(qid, ctxs); }
+      if (!ctxs.has(stateHash) && ctxs.size >= this._maxContextsPerFn) {
+        this._contextCapHits++;
+        const base = this._cache.get(this._key(qid, new Set()));
+        if (base && !base._recursive) return base;
+        // No base summary yet → fall through and compute this one (we need a
+        // result), but don't grow the context set.
+      } else {
+        ctxs.add(stateHash);
+      }
+    }
     if (this._stack.has(qid)) {
       this._hitRecursion = true;
       return { returnTainted: false, mutatedParams: new Set(), taintedGlobals: new Set(), findings: [], _recursive: true };
@@ -125,7 +164,7 @@ export class SummaryCache {
   }
 
   size() { return this._cache.size; }
-  clear() { this._cache.clear(); this._iter = 0; }
+  clear() { this._cache.clear(); this._iter = 0; this._contextsByQid.clear(); this._contextCapHits = 0; }
 }
 
 function _summaryEq(a, b) {

package/src/engine.js

@@ -81,6 +81,20 @@ import { scanLDAPInjection } from './sast/ldap-injection.js';
 import { scanXPathInjection } from './sast/xpath-injection.js';
 import { scanSSTI } from './sast/ssti.js';
 import { scanOpenRedirect } from './sast/open-redirect.js';
+import { scanWrongContextSanitizer } from './sast/wrong-context-sanitizer.js';
+import { scanFrontendHygiene } from './sast/frontend-hygiene.js';
+import { scanCsvInjection } from './sast/csv-injection.js';
+import { scanStoredTaint } from './sast/stored-taint.js';
+import { scanTreeSitterSinks } from './sast/tree-sitter-sinks.js';
+import { scanJavaStructural } from './sast/java-structural.js';
+import { scanCsharpStructural } from './sast/csharp-structural.js';
+import { scanJsFrameworkStructural } from './sast/js-framework-structural.js';
+import { scanPythonStructural } from './sast/python-structural.js';
+import { scanGoStructural } from './sast/go-structural.js';
+import { scanSecretConcat } from './sast/secret-concat.js';
+import { scanXssReflectedMultilang } from './sast/xss-reflected-multilang.js';
+import { scanCodeInjectionMultilang } from './sast/code-injection-multilang.js';
+import { scanRegexReDoS } from './sast/redos-nfa.js';
 import { scanResponseSplitting } from './sast/response-splitting.js';
 import { scanStoredPromptInjection, scanStoredPromptInjectionCrossFile } from './sast/llm-stored-prompt.js';
 import { scanRAGPoisoning } from './sast/rag-poisoning.js';
@@ -148,6 +162,8 @@ import { annotateRuntimeCorrelation } from './posture/runtime-correlation.js';
 import { applyLearnedCalibration } from './posture/triage-learning.js';
 import { annotateFormalVerification } from './dataflow/formal-verify.js';
 import { annotatePathFeasibility } from './dataflow/smt-feasibility.js';
+import { annotateProofGate } from './dataflow/proof-gate.js';
+import { computeAnalysisTiers, countUnmodeledSinkCandidates } from './posture/coverage-report.js';
 import { annotatePrivacyTaint, emitDpiaArtifact } from './dataflow/privacy-taint.js';
 import { buildThreatModel as buildAutoThreatModel, persistThreatModel as persistAutoThreatModel } from './posture/threat-model-auto.js';
 import { runApiContractScan } from './posture/api-contract.js';
@@ -1187,6 +1203,111 @@ function _hasPostLookupOwnershipCheck(lines, sinkLine){
   return false;
 }
 
+// An SSRF host allow/deny guard near the request sink: a hostname checked
+// against an allow/deny-list, an RFC1918 / loopback / link-local / metadata
+// prefix check, or a known SSRF-filter helper. Control-flow (not assignment),
+// so it isn't caught by the sanitizer-on-assignment path. Recall-safe: an
+// unguarded fetch still has no guard in its window.
+const _SSRF_HOST_GUARD_RE = /\b(?:DENY|ALLOW(?:ED)?|allow_?list|deny_?list|block_?list|allowed_?hosts?|blocked_?hosts?|ALLOWED_HOSTS)\b|\.(?:hostname|host|getHost\s*\(\s*\))\b[\s\S]{0,60}?(?:\bin\b|\.has\s*\(|\.includes\s*\(|\.contains\s*\(|[!=]=|\.startsWith\s*\(|\.startswith\s*\()|\b(?:startsWith|startswith)\s*\(\s*['"](?:10\.|192\.168\.|127\.|169\.254\.|172\.(?:1[6-9]|2\d|3[01])\.|::1|fc00|fd)|\bipaddress\b|\bis_private\b|\bis_loopback\b|getaddrinfo|gethostbyname|ssrf[-_]?req[-_]?filter|isSafeUrl|isPrivateIp|validateUrl|_is_metadata_or_private|urlparse\s*\([^)]*\)\s*\.\s*(?:hostname|netloc)/i;
+
+// A comment-stripped window around the sink. Comments must not read as guards
+// (e.g. a "no host allow-list / 169.254.169.254" comment describing the vuln).
+function _guardWindow(ctx, before = 25, after = 5) {
+  if (!ctx || !Array.isArray(ctx.lines)) return '';
+  const line = ctx.line || 1;
+  const lo = Math.max(0, line - before);
+  const hi = Math.min(ctx.lines.length, line + after);
+  return ctx.lines.slice(lo, hi).join('\n')
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/\/\/[^\n]*/g, ' ')
+    .replace(/(^|[^\w'"`])#[^\n]*/g, '$1 ');
+}
+
+function _hasSsrfHostGuard(ctx) { return _SSRF_HOST_GUARD_RE.test(_guardWindow(ctx)); }
+
+// A path-traversal containment guard near the file sink: a basename/strip
+// helper that removes directory components, a framework safe-join, or a
+// canonicalize-then-startsWith containment check.
+const _PATH_GUARD_RE = /\b(?:basename|GetFileName|secure_filename|sanitize_filename|send_from_directory|safe_join)\s*\(|\b(?:startsWith|startswith|StartsWith|HasPrefix)\s*\(|\bgetCanonicalPath\b|\btoRealPath\b|\bfilepath\s*\.\s*(?:Clean|Base|Abs)\b/;
+function _hasPathGuard(ctx) { return _PATH_GUARD_RE.test(_guardWindow(ctx)); }
+
+// Reflected-XSS output-encoding guard: an HTML escaper applied near the sink.
+const _XSS_ESCAPER = String.raw`(?:escapeHtml|escape_html|escape-html|sanitizeHtml|sanitize_html|DOMPurify\.sanitize|he\.encode|he\.escape|_\.escape|validator\.escape|bleach\.clean|markupsafe|htmlspecialchars|htmlentities|html\.escape|escapeHTML|encodeURIComponent|escape)\s*\(`;
+const _XSS_ESCAPE_RE = new RegExp(_XSS_ESCAPER);
+// An escaper whose RESULT is captured (assigned / returned) — not a bare,
+// return-discarded `escapeHtml(s);` call, which does nothing for the reflected
+// value (FP-3 in smoke). Requires `… = <escaper>(` or `return <escaper>(`.
+const _XSS_ASSIGNED_ESCAPE_RE = new RegExp(String.raw`(?:[:=]|\breturn\b)\s*[^=;\n]*?` + _XSS_ESCAPER);
+// A raw request source appearing on the sink line itself (not via a prior
+// escaped var). If present, the reflection is unescaped — keep the finding.
+const _XSS_RAW_SOURCE_RE = /\breq(?:uest)?\s*\.|\bctx\s*\.\s*(?:query|params|request|body)\b|\$_(?:GET|POST|REQUEST|COOKIE)\b|\bparams\s*\[|\.(?:query|body|params)\s*\.[A-Za-z_$]/;
+function _hasXssOutputEncoding(ctx) {
+  if (!ctx || !Array.isArray(ctx.lines)) return false;
+  const line = ctx.lines[(ctx.line || 1) - 1] || '';
+  // The reflected-XSS finding is anchored either on the escaped-assignment line
+  // (`const safe = escape(req.query.x)`) or on the response sink line
+  // (`res.send('…' + safe + '…')`).
+  //  - If the finding line itself captures the escaped value (`const safe =
+  //    escape(req.query.x)`), the reflection is encoded → safe. A bare,
+  //    return-discarded `escapeHtml(s);` does NOT count.
+  if (_XSS_ASSIGNED_ESCAPE_RE.test(line)) return true;
+  //  - A raw, unescaped request source on the finding line is the real vuln
+  //    shape (`res.send('…' + req.query.x)`) → keep it.
+  if (_XSS_RAW_SOURCE_RE.test(line)) return false;
+  //  - Otherwise the sink reflects a variable; drop only if that variable was
+  //    escaped (and the result captured) in the surrounding window. A bare
+  //    `escapeHtml(s);` with a discarded return does NOT count.
+  return _XSS_ASSIGNED_ESCAPE_RE.test(_guardWindow(ctx, 8, 2));
+}
+
+// Centralized guard-recognition pass (#1). SSRF (CWE-918) and path-traversal
+// (CWE-22) are emitted by several independent detectors (regex, structural,
+// per-language flow, PY-SAST, CSHARP, GO) — none of which shared a notion of
+// "the sink is hardened by a host allow/deny check or a path containment
+// guard." This single pass drops such findings uniformly, regardless of which
+// detector produced them, using the same comment-stripped window guards.
+// Recall-safe: a genuinely-unguarded sink has no guard in its window (the
+// cve-replay vulnerable-tier TP count is the invariant that proves this).
+export function dropGuardedFindings(findings, fileContents) {
+  if (!Array.isArray(findings)) return findings;
+  const cache = new Map();
+  const linesOf = (file) => {
+    if (cache.has(file)) return cache.get(file);
+    const c = fileContents && fileContents[file];
+    const arr = typeof c === 'string' ? c.split('\n') : null;
+    cache.set(file, arr);
+    return arr;
+  };
+  return findings.filter((f) => {
+    if (!f || !f.file) return true;
+    // Already-sanitized findings (isSanitized / info) are owned by the
+    // sanitizer-dataflow pipeline, which records them in scan.suppressions.
+    // Don't hard-drop them here or that bookkeeping is lost (smoke FP-3).
+    if (f.isSanitized) return true;
+    const cwe = f.cwe || '';
+    const isXss = cwe === 'CWE-79' && /reflected xss/i.test(f.vuln || '');
+    if (cwe !== 'CWE-918' && cwe !== 'CWE-22' && !isXss) return true;
+    // Flow-pair findings (REGEX parser) carry the line on sink/source, not at
+    // the top level; fall back to those before parsing it out of the id.
+    let line = f.line;
+    if (typeof line !== 'number') {
+      line = (f.sink && f.sink.line) ?? (f.source && f.source.line);
+      if (typeof line !== 'number') {
+        const m = /:(\d+):/.exec(f.id || '');
+        if (m) line = Number(m[1]);
+      }
+    }
+    if (typeof line !== 'number') return true;
+    const lines = linesOf(f.file);
+    if (!lines) return true;
+    const ctx = { lines, line };
+    if (cwe === 'CWE-918' && _hasSsrfHostGuard(ctx)) return false;
+    if (cwe === 'CWE-22' && _hasPathGuard(ctx)) return false;
+    if (isXss && _hasXssOutputEncoding(ctx)) return false;
+    return true;
+  });
+}
+
 function _detectSafeSinkShape(vuln, args, ctx){
   // 1.1: Reflected XSS / SSRF / Path Traversal / Open Redirect / Code Injection
   // sinks with empty or whitespace-only args cannot reflect user input — skip
@@ -1221,6 +1342,8 @@ function _detectSafeSinkShape(vuln, args, ctx){
     if (_isSafeExecFileCall(args)) return 'execFile-list';
   }
   if(/SSRF/.test(vuln) && _isStaticUrlFirstArg(args)) return 'static-url';
+  if(/SSRF/.test(vuln) && _hasSsrfHostGuard(ctx)) return 'ssrf-host-guard';
+  if(/Path Traversal/.test(vuln) && _hasPathGuard(ctx)) return 'path-contained';
   if(/Open Redirect/.test(vuln)) {
     // Static redirect targets (env var or string literal) are not user-controlled
     if (/^\s*process\.env\b/.test(args)) return 'static-redirect-target';
@@ -1959,6 +2082,17 @@ function scanStructuralVulns(fp, raw) {
         }
         effectiveSeverity = s;
       }
+      // Guard recognition (precision, #1): a structural SSRF/path finding on
+      // hardened code — an SSRF host allow/deny check, or a path
+      // basename/containment guard near the sink — is a false positive.
+      if (/SSRF/.test(pat.vuln) && _hasSsrfHostGuard({ lines, line })) {
+        _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'ssrf-host-guard'});
+        continue;
+      }
+      if (/Path Traversal/.test(pat.vuln) && _hasPathGuard({ lines, line })) {
+        _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'path-contained'});
+        continue;
+      }
       const id = `struct:${fp}:${line}:${pat.vuln.replace(/\s/g, '_')}`;
       if (!findings.find(f => f.id === id)) {
         findings.push({
@@ -5512,8 +5646,17 @@ function dedupeFindingsWithEvidence(findings){
     const key=`${file}:${sinkLine}:${fam}`;
     if(!buckets.has(key)){buckets.set(key,f);continue;}
     const kept=buckets.get(key);
-    // Keep highest-severity entry; preserve evidence from both.
-    const keepNew = (SEV_RANK[f.severity]??9) < (SEV_RANK[kept.severity]??9);
+    // Winner selection: an interprocedural flow finding (carries source→sink
+    // attribution) is the better carrier than a flat structural/regex match at
+    // the same sink — keep its chain/source-line attribution. When neither or
+    // both carry flow, fall back to severity. The winner keeps its own severity
+    // (we must not resurrect a rating that ownership/reachability analysis
+    // deliberately downgraded on one of the two findings).
+    const fHasFlow = !!(f.source && f.sink);
+    const kHasFlow = !!(kept.source && kept.sink);
+    const keepNew = (fHasFlow !== kHasFlow)
+      ? fHasFlow
+      : (SEV_RANK[f.severity]??9) < (SEV_RANK[kept.severity]??9);
     const winner = keepNew ? f : kept;
     const loser  = keepNew ? kept : f;
     if(!winner.evidence)winner.evidence=[winner.parser||"UNKNOWN"];
@@ -7202,8 +7345,8 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   catch { _GLOBAL_JAVA_TAINTED_METHODS = new Set(); }
   const _perFileTimeoutMs = parseInt(process.env.AGENTIC_SECURITY_PER_FILE_TIMEOUT_MS || '10000', 10);
   const _fileTimings = [];
-  let _filesSkipped = 0, _filesTimedOut = 0;
-  const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000)continue;fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));
+  let _filesSkipped = 0, _filesTimedOut = 0, _filesDenseSkipped = 0;
+  const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
       aLogic.push(...scanBusinessLogic(p,c));
@@ -7265,6 +7408,18 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
       aF.push(...scanXPathInjection(p,c));
       aF.push(...scanSSTI(p,c));
       aF.push(...scanOpenRedirect(p,c));
+      aF.push(...scanWrongContextSanitizer(p,c));
+      aF.push(...scanFrontendHygiene(p,c));
+      aF.push(...scanCsvInjection(p,c));
+      aF.push(...scanStoredTaint(p,c));
+      aF.push(...scanJavaStructural(p,c));
+      aF.push(...scanCsharpStructural(p,c));
+      aF.push(...scanJsFrameworkStructural(p,c));
+      aF.push(...scanPythonStructural(p,c));
+      aF.push(...scanGoStructural(p,c));
+      aF.push(...scanSecretConcat(p,c));
+      aF.push(...scanXssReflectedMultilang(p,c));
+      aF.push(...scanCodeInjectionMultilang(p,c));
       aF.push(...scanResponseSplitting(p,c));
       aF.push(...scanStoredPromptInjection(p,c));
       aF.push(...scanRAGPoisoning(p,c));
@@ -7552,7 +7707,14 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   const annotatedComponents=components.map(c=>{const key=`${c.ecosystem}:${c.name}:${c.version}`;const vulns=vulnsByKey[key]||[];const riKey=c.ecosystem==='maven'&&c.group?`maven:${c.group}/${c.name}`:`${c.ecosystem}:${c.name}`;const ri=registryInfo.get(riKey)||{};const latestVersion=ri.latestVersion||'';const vd=(ri.versions||{})[c.version]||{};const isDeprecated=typeof vd.deprecated==='string'&&vd.deprecated.length>0;const deprecationMessage=isDeprecated?vd.deprecated:'';const isOutdated=!isDeprecated&&typeof vd.outdated==='string'&&vd.outdated.length>0;const outdatedMessage=isOutdated?vd.outdated:'';const license=ri.license||vd.license||'';return{...c,vulns,hasVulns:vulns.length>0,hasAttackPath:attackResult.flagged.has(key),attackPaths:attackResult.pathsByKey.get(key)||[],latestVersion,isDeprecated,deprecationMessage,isOutdated,outdatedMessage,license};});
   try{aF.push(...scanDbTaintCrossFile(fc));}catch(_){}
   try{aF.push(...scanStoredPromptInjectionCrossFile(fc));}catch(_){}
+  // Roadmap #8 — tree-sitter sinks for long-tail languages (opt-in,
+  // AGENTIC_SECURITY_TREE_SITTER=1; degrades to no-op without the optional dep).
+  if(process.env.AGENTIC_SECURITY_TREE_SITTER==='1'){try{aF.push(...await scanTreeSitterSinks(fc));}catch(_){}}
   let finalFindings;try{finalFindings=dedupeFindingsWithEvidence(aF);}catch(_){finalFindings=dd(aF,f=>f.id);}
+  // #1 — centralized SSRF/path guard recognition: drop CWE-918/CWE-22 findings
+  // on code hardened by a host allow/deny check or a path containment guard,
+  // regardless of which detector emitted them. Opt out: AGENTIC_SECURITY_NO_GUARD_RECOGNITION=1.
+  if(process.env.AGENTIC_SECURITY_NO_GUARD_RECOGNITION!=='1'){try{finalFindings=dropGuardedFindings(finalFindings,fc);}catch(_){}}
   // 0.34.6: filter out Java FPs where a sanitizer pattern (argv-form ProcessBuilder,
   // parameterized prepareStatement, constant-folded dead-branch) is present.
   // applyJavaBenchSuppressions is a no-op on non-.java files.
@@ -7670,6 +7832,14 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   _runAnnotator("annotateCalibratedConfidence", () => { annotateCalibratedConfidence(finalFindings, { scanRoot }); });
   const _projectCtx = (() => { try { return detectProjectContext(fc, aR); } catch { return {}; } })();
   _runAnnotator("annotateExploitability", () => { annotateExploitability(finalFindings, _projectCtx); });
+  // Roadmap #6 — proof-gate precision pass. Runs AFTER confidence +
+  // exploitability so it can demote their tiers, and BEFORE mitigation /
+  // composite-risk so the demotion flows into the canonical ranking. Default
+  // on; opt out with AGENTIC_SECURITY_NO_PROOF_GATE=1. Demotes proven-clean /
+  // proven-infeasible flows (confidence + tiers only, never severity).
+  if (process.env.AGENTIC_SECURITY_NO_PROOF_GATE !== '1') {
+    _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
+  }
   // v3 next-gen: production-aware context ingest (Pillar 9). Must run BEFORE
   // the mitigation composite, persona prioritization, and final why-fired
   // record so those see the demotion signals.
@@ -8150,6 +8320,25 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   finalFindings = finalFindings.filter(_shouldKeep);
   _filterInPlace(aLogic);
   _filterInPlace(aSecrets);
+  // Drop a generic High-Entropy Credential Candidate when a named/structural
+  // secret detector (e.g. secret-concat, hardcoded-secret) already flagged the
+  // SAME file:line — otherwise one split/hardcoded key is reported twice (the
+  // named finding lives in `findings`, the entropy candidate in `secrets`).
+  {
+    const _namedSecretLines = new Set();
+    for (const f of finalFindings) {
+      const ln = f.line ?? f.source?.line;
+      if (typeof ln === 'number' && (f.cwe === 'CWE-798' || /hardcoded|credential|secret/i.test(f.vuln || ''))) {
+        _namedSecretLines.add(`${f.file}:${ln}`);
+      }
+    }
+    const _kept = aSecrets.filter((s) => {
+      if (!/High-Entropy|entropy/i.test(s.vuln || '')) return true;
+      return !_namedSecretLines.has(`${s.file}:${s.line}`);
+    });
+    aSecrets.length = 0;
+    aSecrets.push(..._kept);
+  }
   _filterInPlace(supplyChain);
   classifyOrphans(aSrc,aSink,finalFindings,fc);
   // v3 next-gen: capture scan-level reports (counterfactual, threat model,
@@ -8255,7 +8444,12 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
     }
   }
 
-  const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesTimedOut:_filesTimedOut,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length}};
+  // Coverage-honesty report (#5 + #6): per-language analysis tier (IR-taint vs
+  // pattern-only), dense/large/timeout skips, and unmodeled-sink candidates.
+  let _analysisTier = null, _unmodeledSinks = null;
+  try { _analysisTier = computeAnalysisTiers(Object.keys(fc)); } catch {}
+  try { _unmodeledSinks = countUnmodeledSinkCandidates(fc, finalFindings); } catch {}
+  const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length}};
   return{routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,threatModel:_threatModel,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".

package/src/ir/.agentic-security/dpia.md

@@ -0,0 +1,26 @@
+# Data Protection Impact Assessment (DPIA)
+
+Generated by agentic-security scanner on 2026-05-31.
+
+This is an automated DPIA scaffold derived from static analysis.
+It must be reviewed and completed by a privacy officer before use.
+
+## Data classes identified
+
+## Privacy-related findings
+
+| Severity | File:Line | Class → Sink | Description |
+|---|---|---|---|
+
+## Regulatory framework mapping
+
+- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
+- **CCPA §1798.130** — Notice + access rights for collected personal information.
+
+## Reviewer checklist
+
+- [ ] Confirm each PII field's collection has a documented lawful basis
+- [ ] Confirm retention period for each class is documented
+- [ ] Confirm DSAR (data subject access request) workflow exists
+- [ ] Confirm encryption at rest + in transit for each class
+- [ ] Confirm logging of PII access for audit (where applicable)

package/src/ir/.agentic-security/exploit-bundles.json

@@ -0,0 +1,77 @@
+{
+  "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)": {
+    "family": "mass-assignment",
+    "exploitable": "unknown",
+    "pocs": {
+      "curl": null
+    },
+    "tests": {
+      "jest": null,
+      "pytest": null
+    },
+    "remediation": {
+      "summary": "no template for this family yet — manual review required"
+    },
+    "stub": true
+  },
+  "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)": {
+    "family": "mass-assignment",
+    "exploitable": "unknown",
+    "pocs": {
+      "curl": null
+    },
+    "tests": {
+      "jest": null,
+      "pytest": null
+    },
+    "remediation": {
+      "summary": "no template for this family yet — manual review required"
+    },
+    "stub": true
+  },
+  "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)": {
+    "family": "mass-assignment",
+    "exploitable": "unknown",
+    "pocs": {
+      "curl": null
+    },
+    "tests": {
+      "jest": null,
+      "pytest": null
+    },
+    "remediation": {
+      "summary": "no template for this family yet — manual review required"
+    },
+    "stub": true
+  },
+  "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)": {
+    "family": "mass-assignment",
+    "exploitable": "unknown",
+    "pocs": {
+      "curl": null
+    },
+    "tests": {
+      "jest": null,
+      "pytest": null
+    },
+    "remediation": {
+      "summary": "no template for this family yet — manual review required"
+    },
+    "stub": true
+  },
+  "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)": {
+    "family": "mass-assignment",
+    "exploitable": "unknown",
+    "pocs": {
+      "curl": null
+    },
+    "tests": {
+      "jest": null,
+      "pytest": null
+    },
+    "remediation": {
+      "summary": "no template for this family yet — manual review required"
+    },
+    "stub": true
+  }
+}

package/src/ir/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json

@@ -0,0 +1,6 @@
+{
+  "sha": "73166872888d9ddcbe98645af818ecc7d8917b07",
+  "ts": "2026-05-31T15:37:04.152Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/ir/.agentic-security/sbom-history/b5f468a158f6a145aedd8680841c106b9809f16b.json

@@ -0,0 +1,6 @@
+{
+  "sha": "b5f468a158f6a145aedd8680841c106b9809f16b",
+  "ts": "2026-05-31T16:25:21.141Z",
+  "componentCount": 0,
+  "components": []
+}