@clear-capabilities/agentic-security-scanner 0.86.0 → 0.118.2

package/CHANGELOG.md

@@ -1,5 +1,409 @@
 # Changelog
 
+## 0.103.0 — Go recall: structural detectors (PRD Tier 1)
+
+- **`go-structural.js`** (new): SQL injection via a `database/sql` query method
+  built with `fmt.Sprintf` or string concat (CWE-89), and path traversal via
+  `os.Open`/`os.ReadFile`/etc. built with concat or `fmt.Sprintf` (CWE-22).
+  High precision: parameterized queries (`db.Query("… ?", x)`) and
+  canonicalized paths (`filepath.Base` + `strings.HasPrefix`) have no
+  Sprintf/concat in the sink argument, so they don't match.
+- The centralized guard pass (`dropGuardedFindings`) gained Go path-guard
+  tokens (`filepath.Base`/`Abs`, `HasPrefix`).
+- **Measured: 2 FN → TP** (gin-sqli, go-path). **Go F1 0.75 → 1.000;** corpus
+  FN 12 → 10; aggregate **F1 0.916 → 0.929.** No new FPs; full gate green.
+
+## 0.102.0 — JS/Python framework recall: structural detectors (PRD Tier 1)
+
+JavaScript and Python were the weakest languages (F1 ~0.75) — their remaining
+FNs were framework handlers where input arrives via a framework source
+(`@Query`, `ctx.query`, `request.GET`) and is concatenated into a sink, which
+the taint engine misses without a modeled source.
+
+- **`js-framework-structural.js`** (new): SQLi via `.query`/`.execute` concat /
+  template-literal (TypeORM/mysql/NestJS, CWE-89); koa-send path traversal
+  (CWE-22); `ctx.body` reflected XSS, suppressed by `escape()` (CWE-79);
+  NestJS `HttpService.get` SSRF (CWE-918); deep-merge prototype pollution,
+  suppressed by a `__proto__`/`FORBIDDEN_KEYS` filter (CWE-1321).
+- **`python-structural.js`** (new): Flask `render_template_string` built from
+  input — reflected XSS + SSTI (CWE-79; a Jinja `{{ }}` template is safe and
+  does NOT match); Django `.raw`/`.extra` and `cursor.execute` built with
+  concat / f-string / `%`-operator format (CWE-89; the `%s` parameterized
+  placeholder form does NOT match).
+- High precision (verified on the corpus pre/post pairs + a regression the
+  unit test caught: `execute("… %s", [v])` is the *safe* DB-API placeholder,
+  not `%`-format injection).
+- **Measured: 8 FN → TP** (flask-xss, hoek, koa-path, koa-xss, nestjs-sqli,
+  node-sqli, django, nestjs-ssrf). **Corpus FN 20 → 12; aggregate F1 0.861 →
+  0.916.** JavaScript 0.76 → 0.90, Python 0.82 → 0.88. No new FPs; full gate green.
+
+## 0.101.0 — SSRF/path guard recognition: precision (PRD #1)
+
+The recall work (v0.98–v0.100) lifted aggregate F1 ~0.50 → ~0.80 but surfaced a
+precision problem: the scanner flagged **14 *fixed* files as still-vulnerable**
+(precision ~0.83) — mostly SSRF, where the fix adds a host allow/deny check, and
+path traversal, where the fix adds a containment guard. Multiple independent
+detectors decided SSRF/path with no shared notion of "this sink is hardened."
+
+- **`ssrf-cloud-metadata.js`**: rule #1 no longer flags the `169.254.169.254`
+  literal when it sits in a deny-list / host-comparison guard (the remediation,
+  not the vuln).
+- **`engine.js` `dropGuardedFindings(findings, fc)`** — a single, centralized
+  pass after all detectors that drops a CWE-918 finding when the sink window has
+  a host allow/deny check (deny/allow-list, `getHost`/`hostname` comparison,
+  RFC1918/metadata prefix check, `ipaddress`/`getaddrinfo`/`ssrf-req-filter`), or
+  a CWE-22 finding when the window has a path containment guard
+  (`basename`/`GetFileName`/`secure_filename`/`send_from_directory`, or
+  canonicalize + `startsWith`). Uniform across every emitter (regex, structural,
+  per-language flow, PY-SAST, CSHARP, GO). The window is **comment-stripped** so
+  a "no allow-list / 169.254…" vuln comment can't read as a guard. Opt out:
+  `AGENTIC_SECURITY_NO_GUARD_RECOGNITION=1`.
+- **Measured: corpus false-positives 14 → 2** (the 2 remaining are XSS
+  escape-html recognition — a different family, next up). **Precision ≈ 0.97;
+  aggregate F1 0.80 → 0.861 — past the 0.85 target.** Java + C# now 1.000;
+  Python/Go/PHP at 0 FP. **Zero recall loss** (vulnerable-tier TP=68 unchanged) —
+  the invariant that proves the guards don't hide real flows.
+- New `guard-recognition.test.js`; full gate green.
+
+## 0.100.0 — Java/Spring + C# recall: structural detectors (PRD Tier 1)
+
+Continues the recall-led PRD. The flow-based `csharp.js` and AST/bench Java
+modules miss standalone methods whose tainted-by-convention parameter has no
+in-file source; Java has no string templates, so the shape is concatenation.
+
+- **`java-structural.js`** (new): SQLi (executeQuery/createQuery + concat,
+  CWE-89), command injection (Runtime.exec/ProcessBuilder + concat, CWE-78),
+  path traversal (new File/Paths.get + concat, CWE-22, suppressed by
+  canonical/normalize/startsWith guards), SSRF (new URL/URI from a non-literal,
+  CWE-918, suppressed by a host allow/deny guard).
+- **`csharp-structural.js`** (new): hardcoded credential in a const/static
+  field — including the **split-concat evasion** (`"sk_" + "live_…"`) that
+  defeats plain secret regexes (CWE-798, value gated on length/known-prefix so
+  header-name constants aren't flagged); guarded SSRF via WebClient/HttpClient
+  (CWE-918).
+- **Measured: 5 more FN → TP** (spring-path, spring-ssrf, spring-sqli,
+  cs-hardcoded, cs-ssrf). Both modules return clean on the fixed versions.
+- **Session total: corpus false-negatives 35 → 20** (Kotlin 6 + Ruby/PHP 4 +
+  Java/C# 5 = 15 FN closed). Additive, language-scoped, no regressions. New
+  `java-csharp-structural.test.js` + fixtures; full gate green.
+
+Note: spring-ssrf / cs-ssrf still show a pre-existing `post:FP` from other
+detectors on the fixed file (not introduced here) — a precision item for later.
+
+## 0.99.0 — Ruby + PHP recall: structural injection detectors (PRD Tier 1)
+
+Continues the recall-led PRD down the corpus FN list. Same root cause as
+Kotlin: the fixtures route request data through a local var
+(`name = params[:name]` / `$f = $r->query->get(...)`) before the sink, so the
+existing rules — which require the literal `params`/`$_GET` token on the sink
+line — miss them.
+
+- **`ruby.js`**: structural ActiveRecord SQLi (`.where("… #{x}")` / concat,
+  CWE-89) and shell cmdi (backtick / `system` / `exec` with `#{}` or concat,
+  CWE-78).
+- **`php.js`**: structural shell cmdi (`shell_exec`/`exec`/`system`/`proc_open`
+  with `'…' .` concat or `"… $var"` interpolation, CWE-78) and raw SQLi
+  (`DB::raw`/`whereRaw`/`mysqli_query` with concat/interp, CWE-89).
+- High precision: parameterized queries (`.where('… ?', x)`,
+  `DB::select('…?', [$x])`), array-form exec (`proc_open(['gzip',$f])`,
+  `Open3.capture2('finger', user)`) do **not** match.
+- **Measured: 4 more FN → TP** (rails-sqli, rails-cmdi, symfony-cmdi,
+  laravel-sqli). **Total corpus FN this session: 35 → 25** (Kotlin 6 + Ruby/PHP
+  4). Purely additive, language-scoped, no regressions. New
+  `ruby-php-structural.test.js` + fixtures; full gate green.
+
+Deferred: symfony-csrf (CSRF is a state-change/token detector, FP-prone as a
+regex — needs framework-aware modeling, not a structural injection rule).
+
+## 0.98.0 — Kotlin recall: close all 6 corpus false-negatives (roadmap Tier 1)
+
+First execution of the "perfect SAST" PRD, which leads with **recall** (the
+measured CVE-replay F1 ≈ 0.50 is a missed-detection problem). Kotlin was the
+worst single language — 6 FNs across SQLi/cmdi/path/SSRF/XXE/deser — because
+those fixtures are standalone DAO/handler methods with a tainted-by-convention
+parameter and no in-file taint source, so the taint engine saw nothing.
+
+- **`sast/kotlin.js`** gains taint-independent **structural** detectors: a
+  dangerous sink built with a Kotlin string template (`${x}`) or concat
+  (`"…" +`) is the injection shape regardless of variable names —
+  SQLi (CWE-89), command injection (CWE-78), path traversal (CWE-22). Plus
+  guarded SSRF (CWE-918, suppressed when a host allow/deny check is present),
+  insecure XML config XXE (CWE-611, suppressed when secure-processing is set),
+  and `ObjectInputStream.readObject` deserialization (CWE-502).
+- High precision: a parameterized query / array-form exec / literal URL / XML
+  factory with `setFeature(...)` does **not** match. Verified on the corpus
+  pre/post pairs — all 6 vulnerable fixtures fire, all 6 fixed versions stay
+  clean (scanner-level).
+- **Measured result: 6 Kotlin FN → TP; total corpus false-negatives 35 → 29.**
+  No regressions (purely additive, `.kt`-scoped). New `kotlin-structural.test.js`
+  + fixtures; full gate green.
+
+Establishes the per-family/per-language porting pattern; next: Rails/Laravel/
+Symfony/Gin/Spring SQLi+cmdi and the remaining second-tier FNs.
+
+## 0.97.0 — Tree-sitter foundation for long-tail languages (roadmap #8)
+
+First step of bringing languages with no first-class IR parser
+(rust/solidity/cpp/c/go/swift/dart) onto real AST analysis.
+
+- **Optional, ABI-pinned dependency:** `web-tree-sitter` 0.20.8 +
+  `tree-sitter-wasms` 0.1.13 as **optionalDependencies**, marked `--external`
+  in the ncc build so the committed bundle never embeds WASM (verified: bundle
+  stays ~3.5 MB and contains only the external `require`, not the grammars).
+- **`ir/tree-sitter-loader.js`** — lazy, cached, graceful. Loads the runtime +
+  grammar at runtime and returns null when absent, so the scanner stays fully
+  bootable offline / without the optional deps (long-tail languages fall back
+  to the existing pattern detectors).
+- **`sast/tree-sitter-sinks.js`** — first AST-accurate detector, gated behind
+  `AGENTIC_SECURITY_TREE_SITTER=1`: Rust shell-spawn command injection (CWE-78,
+  `Command::new("sh").arg("-c").arg(<dynamic>)`). Anchoring on real AST nodes
+  means the same pattern in a comment or string literal does NOT false-match —
+  the precision win over regex.
+- Opt-in + optional-dep gated ⇒ default scan behavior and the committed bundle
+  are unchanged. Tests + full gate green.
+
+Next on #8: more languages/rules (Solidity dangerous primitives, Go `exec`),
+and eventually CFG construction to route long-tail languages through the full
+taint engine.
+
+## 0.96.0 — Surface coverage honesty + make the corpus reporter runnable
+
+Completes the measurement threads from 0.91/0.95 — the data existed but wasn't
+usable. No detection changes.
+
+- **Coverage line in the scan report.** `toCLI` now renders a one-line
+  blind-spot summary from `_scanMeta`: files scanned, which languages got flow
+  analysis (`flow=[…]`) vs pattern-only, how many files were skipped, and the
+  unmodeled-sink-candidate count. The #5/#6 data is finally visible to users
+  instead of sitting unread in the JSON.
+- **`bench/cve-replay/corpus-status.mjs`** — a runnable report for #10:
+  `node bench/cve-replay/corpus-status.mjs [--gaps|--json]` prints progress
+  toward the 500-entry target and the empty CWE×language cells. On the current
+  corpus: 88/500 entries, 64/160 cells covered, 96 gaps (thinnest: ruby/go/php).
+
+### Deliberately NOT done this round
+- **#8 long-tail languages onto the IR** — needs a tree-sitter dependency
+  (can't be installed/bundle-validated in this environment) or five hand-written
+  parsers. A dependency decision, not a safe single-pass change.
+- **#1 full** — context-tagged taint lattice (core-engine rewrite).
+
+## 0.95.0 — Stored taint (#2, opt-in) + corpus coverage reporter (#10)
+
+- **#2 — Second-order / stored taint** (`sast/stored-taint.js`, **opt-in** via
+  `AGENTIC_SECURITY_STORED_TAINT=1`). Flags a value read from a persistence
+  store (DB/cache) that flows into an injection sink (XSS/SQLi/cmd/code)
+  without re-validation — the stored-XSS / second-order-SQLi shape the forward
+  taint engine can't see across the persistence boundary. Lower confidence by
+  design (stored data isn't always attacker-controlled), so OFF by default:
+  enabling it cannot change default scan behavior.
+- **#10 — Corpus coverage reporter** (`posture/corpus-status.js`). Turns the
+  CVE-replay corpus into an actionable map: progress toward the 500-entry
+  target and exactly which CWE×language cells have zero ground-truth entries.
+  Measures the existing corpus only — it never fabricates entries. This is the
+  measurement substrate that makes scaling the corpus prioritizable.
+
+Tests for both; full gate green.
+
+### Still genuinely open (need a decision or are research-grade)
+- **#8 long-tail languages onto the IR** — five net-new IR parsers, or a
+  tree-sitter dependency (which conflicts with the offline-degradation rule).
+  This is a dependency decision, not a quick fix.
+- **#1 full** — context-tagged taint lattice (a core-engine rewrite); the
+  practical wrong-context slice already ships.
+
+## 0.94.0 — Same-file-preference call resolution (roadmap #3)
+
+The cross-file resolver (`ir/callgraph.js` `resolve()`) was name-based: a bare
+name defined in several files (`handler`, `save`, `query`, …) resolved to
+whichever file Map was iterated first, mis-targeting interprocedural taint to a
+same-named function in an unrelated file (wrong-target FPs and missed-target
+FNs).
+
+- `resolve(name, callerFile)` now **prefers the caller's own file** when it
+  defines the name — overwhelmingly the intended callee. The taint engine
+  threads the caller's file at all three resolution sites (assign-call,
+  plain-call, higher-order callback).
+- **Backward-compatible by construction:** with no `callerFile` or no local
+  match, the original resolution order is unchanged, so no resolution edge is
+  ever dropped (no new false negatives). The full gate — incl. interproc-k2's
+  context test, deep-taint, calibration — stays green.
+- New `test/callgraph-resolve.test.js`.
+
+## 0.93.0 — CSV/formula injection (CWE-1236) + scoped validation-lib sanitizers (#7)
+
+- **CSV / formula injection** (`sast/csv-injection.js`, CWE-1236): flags user
+  data written to a CSV/spreadsheet writer without neutralizing leading formula
+  characters (`= + - @` / tab). High precision — requires a CSV-write API + a
+  user-taint hint on the same statement and no formula-escape helper nearby.
+- **#7 validation-library sanitizers (correct, narrow):** zod `safeParse`/
+  `parseAsync` and class-validator `validateOrReject` are now modeled as
+  sanitizers **scoped to `mongo-operator` (NoSQL/operator injection) ONLY**.
+  Validating a typed shape defeats operator injection, but a validated string
+  is still an XSS/SQL payload — so they are deliberately NOT tagged for those
+  families (a blanket tag would cause false negatives). Distinctive callees
+  only, to avoid colliding with `JSON.parse`.
+
+Fixtures + tests for both; full gate green.
+
+## 0.92.0 — Front-end hygiene detectors (3 verified-missing, additive)
+
+New `sast/frontend-hygiene.js` — three high-precision client-side detectors,
+each a verified coverage gap (no prior matches in the detector tree). All
+additive: they emit new finding classes and cannot reduce existing detection.
+
+- **Reverse tabnabbing (CWE-1022):** `<a target="_blank">` without
+  `rel="noopener"` — the opened page can rewrite `window.opener`. (low)
+- **Missing Subresource Integrity (CWE-353):** a cross-origin
+  `<script>` / stylesheet `<link>` with no `integrity=` — a compromised CDN
+  runs in your origin. Skips same-origin/relative assets. (medium/low)
+- **Angular sanitizer bypass (CWE-79):** `DomSanitizer.bypassSecurityTrust*`
+  on a non-literal value explicitly disables Angular's XSS protection on
+  attacker-influenced data. Skips constant-string arguments. (high)
+
+Fixtures + 6 tests; full gate green.
+
+## 0.91.0 — Coverage honesty (#5+#6) + wrong-context encoding (#1 slice)
+
+Additive precision/trust features that cannot reduce existing detection.
+
+### #5 + #6 — Analysis-coverage honesty report
+- New `posture/coverage-report.js`. `_scanMeta` now publishes the scanner's
+  blind spots: per-language **analysis tier** (which languages got the IR +
+  taint engine vs. pattern-only — c/c++/rust/swift/solidity/dart are
+  pattern-only today), a `filesDenseSkipped` counter (dense files were
+  previously dropped with no count), and **unmodeled-sink candidates** —
+  dangerous-call shapes (eval/exec/deserialize/yaml.load/…) with no finding on
+  their line, i.e. recall blind spots to verify.
+
+### #1 (practical slice) — Wrong-context output encoding (CWE-79)
+- New `sast/wrong-context-sanitizer.js` flags an HTML-entity encoder
+  (`escapeHtml`/`htmlspecialchars`/`he.encode`/`lodash.escape`) applied to a
+  value used in a URL context (`href`/`src`/`location`). HTML-entity encoding
+  does NOT neutralize `javascript:`/`data:` schemes, so the value is still XSS
+  while looking sanitized. High precision: excludes `encodeURIComponent` (a
+  different, non-XSS mistake) and suppresses when a URL-scheme allow-list is
+  near. Fixtures + tests; full gate green.
+
+### Deferred (need core-engine work or carry correctness traps — not faked)
+- **#1 (full):** context-tagged taint through the lattice — the engine's taint
+  is binary and can't express "sanitized-for-HTML vs -for-JS". Core change.
+- **#7 validation libraries:** modeling zod/joi/etc. as blanket sanitizers
+  would cause FALSE NEGATIVES — a schema-validated string is still an XSS/SQL
+  payload. Needs schema-type awareness (validation defeats type-confusion /
+  NoSQL-operator injection, not output injection). Deferred deliberately.
+- **#2 stored/second-order taint, #3 import/type-aware call resolution,
+  #8 long-tail languages onto the IR, #10 corpus scale** — each its own lift.
+
+## 0.90.0 — Context-sensitive taint completed + bounded (roadmap #2, FR-SEM-2)
+
+The interprocedural engine was already value-context sensitive at the
+assign-call site (a distinct summary per entry-taint-state, computed lazily;
+v0.66). This release completes and bounds it.
+
+- **Plain-call sites now lazily compute context-specific summaries too.**
+  Previously the plain (non-assign) call site only did a cache `get`, so a
+  param mutated *only* when the callee is invoked with tainted input was
+  missed there. It now mirrors the assign-call site (compute under the actual
+  tainted-arg context on a miss).
+- **Per-function context cap** in `SummaryCache` bounds the number of distinct
+  non-empty entry contexts kept per function so lazy per-call-site computation
+  can't blow up. Over the cap → reuse the empty-entry (monovariant) summary.
+  Tunable via `AGENTIC_SECURITY_KCFA_MAX_CONTEXTS` (default 16; **0 = pure
+  monovariant**, a clean kill-switch).
+- **Docs corrected:** `summaries.js` and `dataflow/CLAUDE.md` previously called
+  the engine "k=1 monovariant / one summary under empty entry." It is in fact
+  value-context sensitive; the real remaining limits are call-string (k>1)
+  sensitivity and param-level (not access-path-level) entry granularity.
+- New `test/kcfa-context.test.js` (context-sensitivity + cap + kill-switch +
+  clear); full gate green.
+
+## 0.89.0 — Per-language metrics (#9) + roadmap audit (#3, #5 already shipped)
+
+Continuing the multi-language SAST roadmap. Investigation revealed several
+items were already implemented — so this release delivers the one genuinely
+missing safe item (#9) and corrects the record, rather than re-building what
+exists.
+
+### #9 — Per-language precision/recall (new)
+- `holdout-eval.js` now records a `language` per labeled sample (explicit
+  `language` field or derived from the `file` extension) and exposes
+  `perLanguage()` + `summarizePerLanguage()`.
+- `evaluateHeldOut` returns a `perLanguage` breakdown and **flags any language
+  whose precision trails the aggregate by >0.15** (n≥20) — the regression an
+  aggregate would otherwise mask (a 90%-JS corpus hiding poor Ruby precision).
+- New tests in `test/holdout-eval.test.js`.
+
+### #3 — Already implemented; doc corrected
+Audit found mutated-parameter taint (`applyAtCallSite`), higher-order callback
+taint (`_higherOrderInvocations` fed back into the worklist), and recursion via
+a multi-pass fixed point (`MAX_FP_ITERS`) were all shipped in v0.66 and covered
+by `interproc-k2` / `closure-capture` / `phase6-taint` tests. The stale
+`dataflow/CLAUDE.md` "what we do NOT model" section is corrected.
+
+### #5 — Already at parity
+The source/sink catalog already spans Spring, ASP.NET, Gin, Echo, Fiber, Chi,
+Gorilla, Buffalo, Laravel, Symfony, Rails, Sinatra, Ktor, JDBC/JPA/Hibernate,
+Dapper/ADO across all 8 languages. No new work needed.
+
+### Still deferred (research-grade; will ship as their own releases)
+#1 universal IR (no tree-sitter dep; `universal-ir.js` unwired), #2 k-CFA
+context-sensitivity (FR-SEM-2), #4 auto-derived library summaries, #7 dynamic
+dispatch + type inference, #8 incremental-by-default (needs a cold==warm gate),
+#10 LLM closed-loop validator. These are not faked into the engine.
+
+## 0.88.0 — Proof-gate precision pass (multi-language SAST roadmap #6)
+
+First flagship of the "perfect multi-language SAST" program: report only
+provably-feasible flows, and demote — never drop — flows we can prove are
+clean or infeasible.
+
+- **New `dataflow/proof-gate.js`** consolidates the engine's two independent
+  flow-proof signals (`provenClean` from `proven-clean.js`, `_provenUnreachable`
+  from `exploit-prover.js`) into one verdict per finding:
+  `finding.proof = { verdict: 'feasible' | 'proven-clean' | 'proven-infeasible' | 'unproven', reasons[] }`.
+- **Wired the previously-dead `proven-clean.js`** into `runDeepAnalysis` — SQL
+  sinks reached only through a parameterizer are now proven clean by default.
+- **Recall-preserving demotion:** proven-clean / proven-infeasible findings get
+  lowered `confidence` + `confidenceTier` + `exploitabilityTier` (and rank below
+  feasible findings), but **`severity` is left untouched** so a heuristic proof
+  can never hide a finding from a severity-based CI gate.
+- Default on; opt out with `AGENTIC_SECURITY_NO_PROOF_GATE=1`. New
+  `test/proof-gate.test.js`; full gate green.
+
+Remaining roadmap items (#1 universal IR, #2 k-CFA, #3 dormant taint paths,
+#4 library summaries, #5 framework catalog parity, #7 dynamic dispatch,
+#8 incremental-by-default, #9 per-language metrics, #10 LLM gate) ship as
+their own benchmarked releases.
+
+## 0.87.0 — Sharpen the 12
+
+Ergonomics + power features for the 12-command surface left after the
+v0.86.0 consolidation.
+
+### Cross-cutting
+- **Legacy-alias redirect hook** (`UserPromptSubmit`, `hooks/legacy-alias-redirect.js`):
+  typing a removed alias (`/status`, `/show-findings`, `/harden`, …) now
+  injects context that maps it to the new dispatcher mode, so the request
+  still runs. Covers all 44 removed aliases.
+- **Trend-aware `/secure` router**: compares the last two scans and shows a
+  `↑ / → / ↓` arrow with what changed (never invents a trend from one scan).
+- **Bare-invocation mode menus** and uniform `--json` documented across the
+  dispatchers.
+- **Task-oriented `/secure --help`** + an old→new alias map.
+
+### Per-command
+- `/scan --pick` — interactive mode menu.
+- `/fix --checkpoint` — run a batch fix on a throwaway git branch (atomic revert).
+- `/compliance --gap` — Not-Compliant worklist with the exact closing command per control; `--format oscal|json` machine-readable export.
+- `/supply` — offer to bundle safe patch/minor upgrades into one PR after `--check`.
+- `/posture` (bare) — combined dashboard (status + grade + trend).
+- `/find-and-fix-everything` — auto checkpoint branch + PR-ready summary.
+- `/triage` — order findings likely-FP-first from triage history.
+- `/three-agent-review` — echo the call/wall-time budget before running.
+- `/ci` — validate generated workflow YAML + offer a PR.
+- `/labs` — graduation-status table for experimental modes.
+- `/setup --all` — install hooks + CI + bodyguard + destructive-guard in one pass.
+
 ## 0.76.0 — Command consolidation: 80 → 38 slash commands
 
 Simplified the command surface from 80 individual slash commands down to

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2271);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4097);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2271);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(4097);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/637.index.js

@@ -10,7 +10,7 @@ export const modules = {
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2271);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(4097);
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings

package/dist/838.index.js

@@ -14,7 +14,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2271);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4097);
 // Closed-loop /fix verification (Sentinel-parity FR-L4-4, FR-L4-5).
 //
 // Given a candidate patch (the new file content + the finding stableId being