@clear-capabilities/agentic-security-scanner 0.86.0 → 0.118.2

package/src/posture/holdout-eval.js

@@ -23,6 +23,25 @@ import { brierScore, computeBrierOnHeldOut, wilsonInterval } from './calibration
 
 const ECE_BINS_DEFAULT = 10;
 
+// Map a labeled sample to a source language. Prefer an explicit `language`
+// field; otherwise derive it from the `file` extension. Keeps per-language
+// metrics meaningful even for older corpora that only carry a file path.
+const EXT_TO_LANG = {
+  js: 'js', jsx: 'js', mjs: 'js', cjs: 'js', ts: 'ts', tsx: 'ts',
+  py: 'py', java: 'java', go: 'go', rb: 'rb', php: 'php',
+  cs: 'cs', kt: 'kt', kts: 'kt', swift: 'swift', rs: 'rs',
+  c: 'c', h: 'c', cpp: 'cpp', cc: 'cpp', cxx: 'cpp', hpp: 'cpp',
+  sol: 'sol', dart: 'dart',
+};
+export function languageOf(o) {
+  if (o && typeof o.language === 'string' && o.language) return o.language;
+  if (o && typeof o.file === 'string') {
+    const ext = o.file.split('.').pop().toLowerCase();
+    if (EXT_TO_LANG[ext]) return EXT_TO_LANG[ext];
+  }
+  return 'unknown';
+}
+
 export function parseLabeledJsonl(text) {
   if (typeof text !== 'string' || !text.length) return [];
   const out = [];
@@ -39,6 +58,7 @@ export function parseLabeledJsonl(text) {
       if (p === null || a === null) continue;
       out.push({
         family: typeof o.family === 'string' ? o.family : 'unknown',
+        language: languageOf(o),
         stableId: typeof o.stableId === 'string' ? o.stableId : null,
         predicted: Math.max(0, Math.min(1, p)),
         actual: a,
@@ -98,6 +118,27 @@ export function perFamily(samples) {
   return fams;
 }
 
+// Per-language precision/recall breakdown (roadmap #9). The "perfect
+// multi-language SAST" claim is only defensible with per-language ground
+// truth — a corpus that's 90% JS can hide poor Ruby precision behind a
+// healthy aggregate. Mirrors perFamily, keyed by sample.language, and adds
+// a per-language precision so a regression in one language is visible.
+export function perLanguage(samples) {
+  const langs = {};
+  for (const s of samples) {
+    const l = s.language || 'unknown';
+    if (!langs[l]) langs[l] = { tp: 0, fp: 0, n: 0, precision: 0 };
+    langs[l].n++;
+    if (s.actual === 1) langs[l].tp++;
+    else if (s.actual === 0) langs[l].fp++;
+  }
+  for (const l of Object.keys(langs)) {
+    const { tp, fp } = langs[l];
+    langs[l].precision = (tp + fp) > 0 ? Number((tp / (tp + fp)).toFixed(4)) : 0;
+  }
+  return langs;
+}
+
 // One-shot evaluation: Brier + ECE + per-family TP/FP + overall precision.
 // Returns null only when there's truly no data; never returns a tautological
 // zero.
@@ -124,14 +165,30 @@ export function evaluateHeldOut(samples) {
     precision,
     precisionCi95: ci,
     perFamily: fams,
+    perLanguage: perLanguage(samples),
     notes: [
       ...(samples.length < 100 ? ['n<100: Brier and ECE have wide confidence; treat as directional, not decision-grade.'] : []),
       ...(brierR.brier !== null && brierR.brier > 0.10 ? [`brier=${brierR.brier.toFixed(3)} exceeds PRD target 0.10`] : []),
       ...(ece && ece.ece > 0.05 ? [`ece=${ece.ece.toFixed(3)} exceeds 0.05 calibration target`] : []),
+      // Per-language regression surfacing: a language with enough samples
+      // whose precision trails the aggregate by >0.15 is the failure the
+      // aggregate would otherwise mask.
+      ...Object.entries(perLanguage(samples))
+        .filter(([, m]) => m.n >= 20 && precision - m.precision > 0.15)
+        .map(([lang, m]) => `language '${lang}' precision=${m.precision.toFixed(3)} (n=${m.n}) trails aggregate ${precision.toFixed(3)}`),
     ],
   };
 }
 
+// Per-language dashboard line: one row per language, sorted by sample count.
+export function summarizePerLanguage(result) {
+  if (!result || !result.ok || !result.perLanguage) return 'per-language: no data';
+  return Object.entries(result.perLanguage)
+    .sort((a, b) => b[1].n - a[1].n)
+    .map(([lang, m]) => `${lang}: precision=${m.precision.toFixed(3)} (tp=${m.tp} fp=${m.fp} n=${m.n})`)
+    .join('\n');
+}
+
 // CLI-friendly summary line.
 export function summarize(result) {
   if (!result || !result.ok) return `held-out: ${result?.reason || 'unknown error'}`;

package/src/posture/router.js

@@ -27,7 +27,34 @@ function ageHours(fp) {
   return (Date.now() - fs.statSync(fp).mtimeMs) / 3_600_000;
 }
 
-export function decide({ scanRoot, intent }) {
+// Compare the two most-recent scan-history entries to tell the user whether
+// they're trending safer or more exposed. Returns {} when there isn't enough
+// history to say anything honest. (premortem: never invent a trend from one
+// data point.)
+export function computeScanTrend(scanRoot) {
+  const hist = readJson(path.join(scanRoot, '.agentic-security', 'scan-history.json'));
+  if (!Array.isArray(hist) || hist.length < 2) return {};
+  const cur = hist[hist.length - 1];
+  const prev = hist[hist.length - 2];
+  const sevOf = (e) => (e?.critical || 0) + (e?.high || 0);
+  const delta = sevOf(cur) - sevOf(prev);
+  let trend = 'flat';
+  if (delta < 0) trend = 'improving';
+  else if (delta > 0) trend = 'regressing';
+  const n = Math.abs(delta);
+  const whatChanged =
+    trend === 'improving' ? `${n} fewer critical+high than last scan — keep going.`
+    : trend === 'regressing' ? `${n} more critical+high than last scan — new risk crept in.`
+    : 'No change in critical+high since last scan.';
+  return { trend, whatChanged };
+}
+
+export function decide(opts) {
+  const base = baseDecision(opts);
+  return { ...base, ...computeScanTrend(opts.scanRoot) };
+}
+
+function baseDecision({ scanRoot, intent }) {
   const stateDir = path.join(scanRoot, '.agentic-security');
   const lastScan = readJson(path.join(stateDir, 'last-scan.json'));
   const scanAge = ageHours(path.join(stateDir, 'last-scan.json'));
@@ -102,8 +129,11 @@ export function explain(decision) {
     ``,
     `  Action:  ${decision.action}`,
     `  Why:     ${decision.reason}`,
-    `  Run:     ${decision.command}`,
-    ``,
   ];
+  if (decision.trend) {
+    const arrow = decision.trend === 'improving' ? '↓' : decision.trend === 'regressing' ? '↑' : '→';
+    lines.push(`  Trend:   ${arrow} ${decision.whatChanged}`);
+  }
+  lines.push(`  Run:     ${decision.command}`, ``);
   return lines.join('\n');
 }

package/src/report/.agentic-security/dpia.md

@@ -0,0 +1,26 @@
+# Data Protection Impact Assessment (DPIA)
+
+Generated by agentic-security scanner on 2026-05-31.
+
+This is an automated DPIA scaffold derived from static analysis.
+It must be reviewed and completed by a privacy officer before use.
+
+## Data classes identified
+
+## Privacy-related findings
+
+| Severity | File:Line | Class → Sink | Description |
+|---|---|---|---|
+
+## Regulatory framework mapping
+
+- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
+- **CCPA §1798.130** — Notice + access rights for collected personal information.
+
+## Reviewer checklist
+
+- [ ] Confirm each PII field's collection has a documented lawful basis
+- [ ] Confirm retention period for each class is documented
+- [ ] Confirm DSAR (data subject access request) workflow exists
+- [ ] Confirm encryption at rest + in transit for each class
+- [ ] Confirm logging of PII access for audit (where applicable)

package/src/report/.agentic-security/sbom-history/f94be839aa6a1011f53da016416a561698b8f338.json

@@ -0,0 +1,6 @@
+{
+  "sha": "f94be839aa6a1011f53da016416a561698b8f338",
+  "ts": "2026-05-31T16:06:10.902Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/report/.agentic-security/threat-model.md

@@ -1,6 +1,6 @@
 # Threat Model (auto-generated)
 
-Generated by agentic-security on 2026-05-30.
+Generated by agentic-security on 2026-05-31.
 
 This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
 

package/src/report/index.js

@@ -1001,6 +1001,23 @@ export function toShipVerdict(scan, options = {}) {
   } else if (advisoryCount > 0) {
     lines.push(c(`  ${advisoryCount} advisory item${advisoryCount === 1 ? '' : 's'} — run /security-scan-all --firehose to see them.`, DIM));
   }
+  // Coverage-honesty line (#5/#6): show the scan's blind spots — which
+  // languages got flow analysis vs pattern-only, what was skipped, and how
+  // many dangerous-looking calls had no finding. One concise line, not bloat.
+  const _covMeta = scan._scanMeta;
+  if (_covMeta && _covMeta.analysisTier) {
+    const t = _covMeta.analysisTier;
+    const pat = Object.keys(t.patternOnly || {});
+    const segs = [`${_covMeta.filesScanned ?? '?'} files`];
+    const ir = Object.keys(t.irTaint || {});
+    if (ir.length) segs.push(`flow=[${ir.join(',')}]`);
+    if (pat.length) segs.push(`pattern-only=[${pat.join(',')}]`);
+    const skipped = (_covMeta.filesSkipped || 0) + (_covMeta.filesDenseSkipped || 0);
+    if (skipped) segs.push(`${skipped} skipped`);
+    if (_covMeta.unmodeledSinkCandidates?.count) segs.push(`${_covMeta.unmodeledSinkCandidates.count} unmodeled-sink candidate${_covMeta.unmodeledSinkCandidates.count === 1 ? '' : 's'}`);
+    lines.push('');
+    lines.push(c('  Coverage: ' + segs.join(' · '), DIM));
+  }
   lines.push('');
   lines.push(c('  🛡  agentic-security · created by ClearCapabilities.Com', DIM));
   return lines.join('\n');

package/src/sast/.agentic-security/dpia.md

@@ -0,0 +1,26 @@
+# Data Protection Impact Assessment (DPIA)
+
+Generated by agentic-security scanner on 2026-06-01.
+
+This is an automated DPIA scaffold derived from static analysis.
+It must be reviewed and completed by a privacy officer before use.
+
+## Data classes identified
+
+## Privacy-related findings
+
+| Severity | File:Line | Class → Sink | Description |
+|---|---|---|---|
+
+## Regulatory framework mapping
+
+- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
+- **CCPA §1798.130** — Notice + access rights for collected personal information.
+
+## Reviewer checklist
+
+- [ ] Confirm each PII field's collection has a documented lawful basis
+- [ ] Confirm retention period for each class is documented
+- [ ] Confirm DSAR (data subject access request) workflow exists
+- [ ] Confirm encryption at rest + in transit for each class
+- [ ] Confirm logging of PII access for audit (where applicable)

package/src/sast/.agentic-security/pqc-migration-plan.json

@@ -0,0 +1,65 @@
+{
+  "generatedAt": "2026-06-01T03:15:31.819Z",
+  "summary": {
+    "total": 1,
+    "hndlCritical": 1,
+    "standard": 0,
+    "filesAffected": 1,
+    "primitivesNeeded": [
+      "ML-KEM-768"
+    ]
+  },
+  "milestones": [
+    {
+      "id": "M1",
+      "title": "Inventory & policy",
+      "target": "90 days",
+      "owner": "security",
+      "items": [
+        "Confirm scanner findings against design docs",
+        "Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)",
+        "Establish KMS support for hybrid keys"
+      ]
+    },
+    {
+      "id": "M2",
+      "title": "HNDL-critical paths to PQ-hybrid",
+      "target": "180 days",
+      "owner": "platform",
+      "items": [
+        {
+          "finding": "pqc-rsa-encrypt:post-quantum-crypto.js:136",
+          "file": "post-quantum-crypto.js",
+          "line": 136,
+          "replacement": "X25519+ML-KEM-768 (CNSA 2.0 transitional)"
+        }
+      ]
+    },
+    {
+      "id": "M3",
+      "title": "Standard signing/KEX migration",
+      "target": "12 months",
+      "owner": "platform",
+      "items": []
+    },
+    {
+      "id": "M4",
+      "title": "Deprecate classical primitives",
+      "target": "24 months",
+      "owner": "security",
+      "items": [
+        "Remove dual-stack libraries once peers are PQ-capable",
+        "Rotate root CA / long-lived signing keys to ML-DSA"
+      ]
+    }
+  ],
+  "perFile": {
+    "post-quantum-crypto.js": {
+      "count": 1,
+      "subfamilies": [
+        "pqc-rsa-encrypt"
+      ],
+      "hndlCritical": true
+    }
+  }
+}

package/src/sast/.agentic-security/pqc-migration-plan.md

@@ -0,0 +1,30 @@
+# Post-quantum cryptography migration plan
+
+Generated 2026-06-01.
+
+**1** pre-quantum primitive sites across **1** files.  
+HNDL-critical: **1** | Standard: **0**
+
+## Recommended PQ primitives
+- ML-KEM-768
+
+## M1 — Inventory & policy (target 90 days, owner security)
+- Confirm scanner findings against design docs
+- Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)
+- Establish KMS support for hybrid keys
+
+## M2 — HNDL-critical paths to PQ-hybrid (target 180 days, owner platform)
+- `post-quantum-crypto.js:136` → X25519+ML-KEM-768 (CNSA 2.0 transitional)
+
+## M3 — Standard signing/KEX migration (target 12 months, owner platform)
+
+## M4 — Deprecate classical primitives (target 24 months, owner security)
+- Remove dual-stack libraries once peers are PQ-capable
+- Rotate root CA / long-lived signing keys to ML-DSA
+
+## References
+- NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA)
+- NIST IR 8547 — Transition to Post-Quantum Cryptographic Standards
+- CNSA 2.0 — Commercial National Security Algorithm Suite, Sept 2022
+- RFC 9794 — X25519MLKEM768 hybrid key exchange for TLS 1.3
+- Open Quantum Safe project (liboqs, oqs-provider for OpenSSL 3)

package/src/sast/.agentic-security/sbom-history/043a7b401c68f5a298c83d4c42e94f118ff2a89a.json

@@ -0,0 +1,6 @@
+{
+  "sha": "043a7b401c68f5a298c83d4c42e94f118ff2a89a",
+  "ts": "2026-05-31T23:19:07.127Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json

@@ -0,0 +1,6 @@
+{
+  "sha": "0775d96ba4cf814520d02760cfb3010760c7684f",
+  "ts": "2026-06-01T03:15:31.817Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/20d77ad7363a82777d506dedbbb1ecfed52f094a.json

@@ -0,0 +1,6 @@
+{
+  "sha": "20d77ad7363a82777d506dedbbb1ecfed52f094a",
+  "ts": "2026-06-01T01:23:04.006Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json

@@ -0,0 +1,6 @@
+{
+  "sha": "29300441d3460832137a8e51a92b74068cad2f15",
+  "ts": "2026-05-31T15:11:55.419Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json

@@ -0,0 +1,6 @@
+{
+  "sha": "3852ad2aa0e50951bed0c930c29d1861aa13d048",
+  "ts": "2026-05-31T18:27:58.109Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/3c6b3205f04e26f7654943d465281d00e0fa395e.json

@@ -0,0 +1,6 @@
+{
+  "sha": "3c6b3205f04e26f7654943d465281d00e0fa395e",
+  "ts": "2026-06-01T02:32:18.105Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json

@@ -0,0 +1,6 @@
+{
+  "sha": "3d96e2daec97e3226c9679bac6e64a89ca10bfe9",
+  "ts": "2026-06-01T01:30:24.496Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/5282502e090013219eb006f7e02d8c983bc29c8e.json

@@ -0,0 +1,6 @@
+{
+  "sha": "5282502e090013219eb006f7e02d8c983bc29c8e",
+  "ts": "2026-06-01T01:37:31.644Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json

@@ -0,0 +1,6 @@
+{
+  "sha": "5f0b136622fce09b469a1a6137c04d5b18652ea4",
+  "ts": "2026-05-31T17:45:32.183Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json

@@ -0,0 +1,6 @@
+{
+  "sha": "64e30595d447b62344d0d9200760269df2095332",
+  "ts": "2026-05-31T23:04:22.450Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json

@@ -0,0 +1,6 @@
+{
+  "sha": "71f3241902c9e7437764e3caa046ba8a3bcdd32a",
+  "ts": "2026-06-01T02:53:45.965Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/73514b485d4770f3c5ee57d87338bccd1c61d8b7.json

@@ -0,0 +1,6 @@
+{
+  "sha": "73514b485d4770f3c5ee57d87338bccd1c61d8b7",
+  "ts": "2026-05-31T17:03:16.200Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/96fa584fc3134512237d58aac63d6f3778b0cbcb.json

@@ -0,0 +1,6 @@
+{
+  "sha": "96fa584fc3134512237d58aac63d6f3778b0cbcb",
+  "ts": "2026-06-01T01:53:20.629Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json

@@ -0,0 +1,6 @@
+{
+  "sha": "99c372cdc33ecc9dde92960b4ffadf7775860e61",
+  "ts": "2026-05-31T14:19:38.559Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json

@@ -0,0 +1,6 @@
+{
+  "sha": "a3544abf1863d71776b61302ca74d9ead2b26a9f",
+  "ts": "2026-05-31T21:58:18.964Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/a4a34ab8b3d758de2adc8c3dc3e42d4cb0db00a3.json

@@ -0,0 +1,6 @@
+{
+  "sha": "a4a34ab8b3d758de2adc8c3dc3e42d4cb0db00a3",
+  "ts": "2026-06-01T02:13:24.420Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/ac236ec3602cfc8fb133f389ec3687e409084673.json

@@ -0,0 +1,6 @@
+{
+  "sha": "ac236ec3602cfc8fb133f389ec3687e409084673",
+  "ts": "2026-05-31T17:31:27.530Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/b57b3e1292f1f9f0de6c5a34a436e330c78008a3.json

@@ -0,0 +1,6 @@
+{
+  "sha": "b57b3e1292f1f9f0de6c5a34a436e330c78008a3",
+  "ts": "2026-06-01T01:47:59.160Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json

@@ -0,0 +1,6 @@
+{
+  "sha": "dca15abdec43c508aa342db86dc5db8d7f01fbbe",
+  "ts": "2026-05-31T22:05:36.857Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/dcbfd4935922dd165093c08a1003c338eed937c5.json

@@ -0,0 +1,6 @@
+{
+  "sha": "dcbfd4935922dd165093c08a1003c338eed937c5",
+  "ts": "2026-06-01T02:02:21.209Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/sast/.agentic-security/sbom-history/fa017f725615b0293814344c8ef7dfeb06775ca0.json

@@ -0,0 +1,6 @@
+{
+  "sha": "fa017f725615b0293814344c8ef7dfeb06775ca0",
+  "ts": "2026-06-01T02:21:07.710Z",
+  "componentCount": 0,
+  "components": []
+}