@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

package/bin/agentic-security.js

@@ -9,7 +9,7 @@ const __require = createRequire(import.meta.url);
 const PKG_VERSION = __require('../package.json').version;
 import { signLastScan as _signLastScan, verifyLastScan as _verifyLastScanShared } from '../src/posture/integrity.js';
 import { runScan } from '../src/runScan.js';
-import { toJSON, toMarkdown, toSARIF, toSTIX, toCSV, toJUnit, toCLI, toCLIByProfile, toShipVerdict, toProTable, toHTML, toSummary, exitCodeFor, normalizeFindings } from '../src/report/index.js';
+import { toJSON, toMarkdown, toSARIF, toSTIX, toCSV, toJUnit, toCLI, toCLIByProfile, toShipVerdict, toProTable, toHTML, toSummary, toVex, exitCodeFor, normalizeFindings } from '../src/report/index.js';
 import { toCycloneDX, toSPDX } from '../src/posture/sbom.js';
 import { toPBOM } from '../src/sast/pipeline.js';
 import { buildAIBOM, aibomToMarkdown } from '../src/posture/aibom.js';
@@ -82,6 +82,8 @@ Options:
   --pack <name>                Focus on a curated rule pack (repeatable): owasp-top-10 | cwe-top-25 | llm-security | supply-chain
   --baseline <ref>             Diff against a git ref; only findings new vs. that ref count (ci subcommand)
   --fail-on critical|high|medium|low|none  ci-mode exit policy (default: critical)
+  --fail-on-new                (ci) block ONLY on findings this PR introduced vs
+                               the baseline ref — never the pre-existing backlog
   --policy <file.rego>         ci-mode policy-as-code gate; deny[] rules fail the build (FR-SDLC-9)
   --columns standard|mitre|capec|owasp  Pro-mode column set (default: standard)
   --confidence <0..1>          Override per-profile confidence threshold
@@ -109,6 +111,10 @@ Options:
   --incremental                Reuse taint summaries from prior scans (speeds up deep mode in CI)
   --set-baseline               Save current findings as baseline (suppresses pre-existing issues)
   --since-baseline             Only show findings NOT in the saved baseline
+  --hide-proven-safe           Drop findings discharged by a flow proof (provably safe)
+  --secret-history             Also sweep recent git history for committed secrets
+                               (removed from HEAD but recoverable from .git)
+  --history-depth <n>          Commits to sweep with --secret-history (default 50)
   --no-epss                    Skip EPSS exploit-prediction enrichment (default: enabled)
   --no-blast-radius            Skip blast-radius / cost framing (default: enabled)
   --verbose                    Include fix bodies + taxonomy in CLI output
@@ -330,6 +336,27 @@ async function cmdScan(args) {
     process.env.AGENTIC_SECURITY_INCREMENTAL = '1';
   }
 
+  // R1 (PRD §5): deep interprocedural taint (IR + field-sensitive, value-context-
+  // sensitive dataflow — src/dataflow/) is ON by default for local/interactive CLI
+  // scans, bounded by the existing wall-clock budget (AGENTIC_SECURITY_DEEP_TIMEOUT_MS,
+  // default 5 min) and function cap (AGENTIC_SECURITY_DEEP_FN_LIMIT, default 5000). It
+  // is the engine's strongest analysis and was previously gated off, so the default
+  // scan ran pattern/structural-only. Precedence (highest first):
+  //   --no-deep / AGENTIC_SECURITY_DEEP=0  → stays off (degrade to structural-only)
+  //   --deep    / AGENTIC_SECURITY_DEEP=1  → stays on (even in CI? no — see engine gate)
+  //   unset + not in CI                    → default ON here
+  //   unset + in CI                        → left unset; the engine keeps deep off in CI
+  //                                          unless AGENTIC_SECURITY_DEEP_IN_CI=1
+  // The in-process test/bench harnesses call runScan() directly (not this CLI entry),
+  // so they are unaffected and remain deterministic regression gates.
+  if (args.flags['no-deep']) process.env.AGENTIC_SECURITY_DEEP = '0';
+  else if (args.flags['deep']) process.env.AGENTIC_SECURITY_DEEP = '1';
+  else if (process.env.AGENTIC_SECURITY_DEEP == null || process.env.AGENTIC_SECURITY_DEEP === '') {
+    const inCi = !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
+                    process.env.BUILDKITE || process.env.CIRCLECI || process.env.JENKINS_URL);
+    if (!inCi) process.env.AGENTIC_SECURITY_DEEP = '1';
+  }
+
   // --pr [ref] : friendlier alias for --changed-since that auto-detects the PR
   // base ref (GitHub/GitLab/Buildkite/Bitbucket env vars) when no value is given.
   let changedSince = args.flags['changed-since'] || null;
@@ -374,6 +401,32 @@ async function cmdScan(args) {
     } catch { /* baseline file unreadable, skip */ }
   }
 
+  // R13 (PRD §5): --hide-proven-safe drops findings a flow proof discharged
+  // (parameterizer on every path / sanitizer excludes metacharacters) for a
+  // clean report. They are kept (demoted) by default so nothing is hidden silently.
+  if (args.flags['hide-proven-safe']) {
+    const before = (scan.findings || []).length;
+    scan.findings = (scan.findings || []).filter(f => !f.provablySafe);
+    process.stderr.write(`[proof] hid ${before - (scan.findings || []).length} provably-safe finding(s)\n`);
+  }
+
+  // R15 (PRD §5): --secret-history sweeps recent git history for secrets that
+  // may have been removed from HEAD but remain recoverable from .git.
+  if (args.flags['secret-history']) {
+    try {
+      const { sweepGitHistory } = await import('../src/posture/secret-history.js');
+      const { scanCredentials } = await import('../src/secrets/index.js');
+      const depth = parseInt(args.flags['history-depth'] || '50', 10);
+      const hist = sweepGitHistory(targetAbs, scanCredentials, { maxCommits: depth });
+      if (hist.length) {
+        scan.secrets = [...(scan.secrets || []), ...hist];
+        process.stderr.write(`[secret-history] ${hist.length} secret(s) found in the last ${depth} commits — rotate even if removed from HEAD\n`);
+      } else {
+        process.stderr.write(`[secret-history] no secrets found in the last ${depth} commits\n`);
+      }
+    } catch (e) { if (process.env.AGENTIC_SECURITY_DEBUG === '1') process.stderr.write(`[secret-history] ${e && e.message}\n`); }
+  }
+
   // 0.9.0 Feat-18: --scorecard flag enables OSSF Scorecard enrichment
   if (args.flags['scorecard']) process.env.AGENTIC_SECURITY_SCORECARD = '1';
 
@@ -481,6 +534,7 @@ async function cmdScan(args) {
   else if (format === 'html') body = toHTML(scan, meta);
   else if (format === 'cyclonedx' || format === 'sbom') body = JSON.stringify(toCycloneDX(scan, meta), null, 2);
   else if (format === 'spdx')                            body = JSON.stringify(toSPDX(scan, meta), null, 2);
+  else if (format === 'vex' || format === 'openvex')     body = JSON.stringify(toVex(scan, meta), null, 2);
   else if (format === 'pbom')                            body = JSON.stringify(toPBOM(scan.fc || {}, meta), null, 2);
   else if (format === 'aibom')                           body = JSON.stringify(buildAIBOM(scan, scan.fc || {}, meta), null, 2);
   else if (format === 'aibom-md')                        body = aibomToMarkdown(buildAIBOM(scan, scan.fc || {}, meta));
@@ -637,6 +691,29 @@ async function cmdCi(args) {
     }
     process.stderr.write(`[ci] policy gate PASSED (${r.runner}, 0 denials)\n`);
   }
+  // R24 (PRD §5): PR-native net-new gate. With --fail-on-new and a baseline
+  // ref, block ONLY on findings this PR INTRODUCED (vs the base ref), never on
+  // the pre-existing backlog — the posture teams actually leave enabled.
+  if (args.flags['fail-on-new']) {
+    const baseRef = baseline;
+    if (!baseRef) {
+      process.stderr.write('[ci] --fail-on-new requires a baseline ref (--baseline <ref> or a CI base-branch env var)\n');
+      return 1;
+    }
+    try {
+      const { computePrDelta, netNewGate } = await import('../src/pr-delta.js');
+      const delta = await computePrDelta(target, { baseRef });
+      const gate = netNewGate(delta, failOn);
+      process.stderr.write(
+        `[ci] net-new vs ${baseRef}: +${delta.introduced.length} introduced · -${delta.resolved.length} resolved · ${delta.persistent.length} pre-existing (not gated)\n` +
+        `[ci] net-new gate fail-on=${failOn} → ${gate.fail ? 'FAIL' : 'pass'}${gate.blocked.length ? ' (' + gate.blocked.length + ' blocking)' : ''}\n`);
+      for (const f of gate.blocked.slice(0, 20)) process.stderr.write(`  + [${(f.severity || '').toUpperCase()}] ${f.vuln || f.type} ${f.file}:${f.line}\n`);
+      return gate.fail ? 1 : 0;
+    } catch (e) {
+      process.stderr.write(`[ci] net-new gate error: ${(e && e.message) || e} — falling back to full --fail-on gate\n`);
+      // Fall through to the full gate rather than passing silently.
+    }
+  }
   return ciExitCode(scanCode, failOn);
 }
 

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2271);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5099);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2271);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5099);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/415.index.js

@@ -0,0 +1,90 @@
+export const id = 415;
+export const ids = [415];
+export const modules = {
+
+/***/ 5796:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   extractImagePackages: () => (/* binding */ extractImagePackages)
+/* harmony export */ });
+/* unused harmony exports parseDpkgStatus, parseApkInstalled */
+// R8 (PRD §5) — container-image OS-package inventory.
+//
+// container.js reads the Dockerfile (FROM + apt/apk install lines). This reads
+// the ACTUAL installed-package databases from an extracted image filesystem
+// (or the host), catching packages baked into the base image that the
+// Dockerfile never names. Components flow into the existing OSV pipeline + SBOM.
+//
+// Pure parsers (unit-tested) + a path-matching extractor. No daemon; reads the
+// package-DB files that appear when an image layer/tarball is unpacked.
+
+// Debian/Ubuntu: /var/lib/dpkg/status — RFC822-style blocks separated by blank
+// lines. Only "install ok installed" entries count (not removed/config-files).
+function parseDpkgStatus(text) {
+  const out = [];
+  for (const block of String(text || '').split(/\n\s*\n/)) {
+    const name = (block.match(/^Package:\s*(.+)$/m) || [])[1];
+    const version = (block.match(/^Version:\s*(.+)$/m) || [])[1];
+    const status = (block.match(/^Status:\s*(.+)$/m) || [])[1] || '';
+    if (!name || !version) continue;
+    if (!/\binstalled\b/.test(status)) continue;
+    out.push({ name: name.trim(), version: version.trim(), ecosystem: 'Debian' });
+  }
+  return out;
+}
+
+// Alpine: /lib/apk/db/installed — blocks separated by blank lines; P:=name V:=version.
+function parseApkInstalled(text) {
+  const out = [];
+  for (const block of String(text || '').split(/\n\s*\n/)) {
+    const name = (block.match(/^P:(.+)$/m) || [])[1];
+    const version = (block.match(/^V:(.+)$/m) || [])[1];
+    if (!name || !version) continue;
+    out.push({ name: name.trim(), version: version.trim(), ecosystem: 'Alpine' });
+  }
+  return out;
+}
+
+const _PURL = { Debian: (n, v) => `pkg:deb/debian/${n}@${v}`, Alpine: (n, v) => `pkg:apk/alpine/${n}@${v}` };
+
+// File-path tells for an unpacked image. Match on path suffix so it works
+// whether the scan root is the rootfs or a subdirectory of it.
+function _dbKind(path) {
+  const p = path.replace(/\\/g, '/');
+  if (/(?:^|\/)var\/lib\/dpkg\/status$/.test(p)) return 'dpkg';
+  if (/(?:^|\/)lib\/apk\/db\/installed$/.test(p)) return 'apk';
+  return null;
+}
+
+/**
+ * Extract OS-package components from any image package-DBs present in the scanned
+ * files. Returns components in the engine's component shape so they ride the
+ * existing OSV/SBOM pipeline. De-dups by ecosystem:name:version.
+ */
+function extractImagePackages(fileContents) {
+  const comps = [];
+  const seen = new Set();
+  for (const [file, content] of Object.entries(fileContents || {})) {
+    const kind = _dbKind(file);
+    if (!kind) continue;
+    const pkgs = kind === 'dpkg' ? parseDpkgStatus(content) : parseApkInstalled(content);
+    for (const p of pkgs) {
+      const key = `${p.ecosystem}:${p.name}:${p.version}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      comps.push({
+        name: p.name, version: p.version, group: '', ecosystem: p.ecosystem,
+        purl: (_PURL[p.ecosystem] || (() => null))(p.name, p.version),
+        filePath: file, isUnpinned: false, isTransitive: false, isOsPackage: true,
+        scope: 'required', reachable: true,
+      });
+    }
+  }
+  return comps;
+}
+
+
+/***/ })
+
+};

package/dist/444.index.js

@@ -0,0 +1,89 @@
+export const id = 444;
+export const ids = [444];
+export const modules = {
+
+/***/ 1444:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   sweepGitHistory: () => (/* binding */ sweepGitHistory)
+/* harmony export */ });
+/* unused harmony exports extractAddedLines, scanHistoryDiff */
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
+// R15 (PRD §5) — git-history secret sweep.
+//
+// A secret removed from HEAD but present in any past commit is still
+// recoverable from `.git` and must be rotated — the most dangerous secret case,
+// and one a working-tree-only scan misses entirely. This sweeps recent history
+// (bounded), feeding the ADDED lines of each commit through the same credential
+// detector the file scan uses.
+//
+// The detector is INJECTED (detectFn) rather than imported, so this module has
+// no dependency back into engine.js (avoids a circular import) and the parsing
+// stays pure + unit-testable. Live-credential validation (is the key active?)
+// needs network and is deferred — see the rollup.
+
+
+
+// Pull the post-image (added) lines out of a unified diff: lines starting with
+// a single '+' (not the '+++' file header). Returns reconstructed text.
+function extractAddedLines(diffText) {
+  const out = [];
+  for (const line of String(diffText || '').split('\n')) {
+    if (line.startsWith('+') && !line.startsWith('+++')) out.push(line.slice(1));
+  }
+  return out.join('\n');
+}
+
+// Pure: run the injected credential detector over a commit's added lines.
+// detectFn has the scanCredentials(fp, raw) shape and returns Finding[].
+function scanHistoryDiff(diffText, commit, detectFn) {
+  if (typeof detectFn !== 'function') return [];
+  const added = extractAddedLines(diffText);
+  if (!added.trim()) return [];
+  let findings = [];
+  try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
+  return findings.map((f) => ({
+    ...f,
+    id: `secret-history:${commit}:${f.id || f.vuln || 'secret'}`,
+    file: `git-history@${commit}`,
+    line: 0,
+    commit,
+    _historical: true,
+    vuln: `${f.vuln || 'Hardcoded Secret'} (in git history)`,
+    description: `${f.description || 'A credential was committed.'} Found in commit ${commit}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
+    remediation: 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.',
+  }));
+}
+
+/**
+ * Sweep up to `maxCommits` of recent history for secrets. Best-effort: returns
+ * [] when `scanRoot` is not a git repo or git is unavailable. Dedups a secret
+ * that recurs across commits to its earliest sighting.
+ */
+function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000 } = {}) {
+  if (!scanRoot || typeof detectFn !== 'function') return [];
+  let out;
+  try {
+    out = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.execFileSync)('git', ['-C', scanRoot, 'log', '-p', '-n', String(maxCommits), '--no-color', '--no-merges', '--no-textconv'],
+      { encoding: 'utf8', maxBuffer: 96 * 1024 * 1024, timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch { return []; }
+  const parts = out.split(/^commit ([0-9a-f]{7,40})/m); // [pre, sha, body, sha, body, ...]
+  const findings = [];
+  const seen = new Set();
+  for (let i = 1; i < parts.length; i += 2) {
+    const sha = (parts[i] || '').slice(0, 12);
+    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn)) {
+      const key = `${f.vuln}:${(f.snippet || f.match || '').slice(0, 40)}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push(f);
+    }
+  }
+  return findings;
+}
+
+
+/***/ })
+
+};

package/dist/503.index.js

@@ -0,0 +1,288 @@
+export const id = 503;
+export const ids = [503];
+export const modules = {
+
+/***/ 9503:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   augmentReachabilityViaImports: () => (/* binding */ augmentReachabilityViaImports)
+/* harmony export */ });
+/* unused harmony exports languageOfFile, pkgMatches, extractJsImports, extractPyImports, extractImports, findImportAwareCallSites */
+/* harmony import */ var _sast_comment_strip_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(8455);
+// R7 — import-aware SCA function-reachability (JS/TS + Python).
+//
+// The default reachability pass (engine.js#markUsedVulnFunctions) is a regex
+// over `pkg.fn` / bare function names. It has two documented failure modes:
+//   - FALSE NEGATIVE on aliased / namespace imports:
+//       import { merge as deepMerge } from 'lodash'; deepMerge(a, b)   // missed
+//       import * as _ from 'lodash'; _.merge(a, b)                      // member ok
+//   - FALSE POSITIVE on coincidental names: a bare `parse(` in a file that never
+//     imports the vulnerable package is matched anyway.
+//
+// This module parses the import statements of each JS/TS and Python file into an
+// alias map, then finds call sites of a package's vulnerable functions resolved
+// THROUGH that map and GATED to files that actually import the package. It does
+// not decide `functionReachable` itself — it augments `vulnerableFunctionCallSites`
+// so the existing route-reachability classifier (which distinguishes
+// reachable / unreachable / unknown) sees the calls the regex missed.
+//
+// Other ecosystems keep the regex pass (this module is a no-op for them).
+
+
+
+const JS_RE = /\.(?:m|c)?[jt]sx?$/i;
+const PY_RE = /\.py$/i;
+
+function languageOfFile(file) {
+  if (JS_RE.test(file)) return 'js';
+  if (PY_RE.test(file)) return 'py';
+  return null;
+}
+
+// Normalize an import source to a package base name.
+//   '@scope/pkg/sub' -> '@scope/pkg'   'pkg/sub' -> 'pkg'   (npm)
+//   'pkg.sub.mod'     -> 'pkg'                              (python)
+function pkgBase(source, lang) {
+  let s = String(source || '').trim();
+  if (lang === 'py') return s.split('.')[0];
+  if (s.startsWith('@')) {
+    const parts = s.split('/');
+    return parts.slice(0, 2).join('/');
+  }
+  return s.split('/')[0];
+}
+
+// Loose package-name equivalence. npm is case-sensitive; PyPI dist names differ
+// from import names by case and -/_ (PyYAML→yaml is NOT covered — that needs a
+// dist→import table; documented limitation).
+function pkgMatches(depName, importedPkg, lang) {
+  if (!depName || !importedPkg) return false;
+  if (depName === importedPkg) return true;
+  if (lang === 'py') {
+    const norm = (x) => x.toLowerCase().replace(/[-_.]/g, '');
+    return norm(depName) === norm(importedPkg);
+  }
+  return false;
+}
+
+// Split a named-imports clause body ("a, b as c, default as d") into pairs.
+function parseNamedClause(body) {
+  const out = [];
+  for (const raw of body.split(',')) {
+    const t = raw.trim();
+    if (!t) continue;
+    const m = t.match(/^([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)$/);
+    if (m) out.push({ imported: m[1], local: m[2] });
+    else if (/^[A-Za-z_$][\w$]*$/.test(t)) out.push({ imported: t, local: t });
+  }
+  return out;
+}
+
+/**
+ * Parse JS/TS imports into:
+ *   named: Map<localName, { pkg, imported }>
+ *   ns:    Map<localName, pkg>            (namespace/default whole-module binding)
+ *   packages: Set<pkg>
+ * Handles ESM (named / default / namespace) and CJS require (destructure / whole).
+ */
+function extractJsImports(content) {
+  const code = (0,_sast_comment_strip_js__WEBPACK_IMPORTED_MODULE_0__/* .blankComments */ .$)(content);
+  const named = new Map();
+  const ns = new Map();
+  const packages = new Set();
+  const add = (pkg) => { if (pkg) packages.add(pkg); };
+
+  // ESM: import ... from 'pkg'
+  const esm = /\bimport\s+([^;'"]+?)\s+from\s*['"]([^'"]+)['"]/g;
+  let m;
+  while ((m = esm.exec(code))) {
+    const clause = m[1].trim();
+    const pkg = pkgBase(m[2], 'js');
+    add(pkg);
+    // namespace: * as ns
+    const nsM = clause.match(/\*\s+as\s+([A-Za-z_$][\w$]*)/);
+    if (nsM) ns.set(nsM[1], pkg);
+    // named: { ... }
+    const braceM = clause.match(/\{([^}]*)\}/);
+    if (braceM) for (const p of parseNamedClause(braceM[1])) named.set(p.local, { pkg, imported: p.imported });
+    // default: leading bare identifier (before any { or *)
+    const defM = clause.match(/^([A-Za-z_$][\w$]*)\s*(?:,|$)/);
+    if (defM && !nsM) ns.set(defM[1], pkg);
+  }
+  // CJS: const X = require('pkg')  /  const { a, b: c } = require('pkg')
+  const cjs = /(?:const|let|var)\s+(\{[^}]*\}|[A-Za-z_$][\w$]*)\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  while ((m = cjs.exec(code))) {
+    const bind = m[1].trim();
+    const pkg = pkgBase(m[2], 'js');
+    add(pkg);
+    if (bind.startsWith('{')) {
+      // require destructure uses `orig: local`
+      for (const raw of bind.slice(1, -1).split(',')) {
+        const t = raw.trim(); if (!t) continue;
+        const mm = t.match(/^([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*)$/);
+        if (mm) named.set(mm[2], { pkg, imported: mm[1] });
+        else if (/^[A-Za-z_$][\w$]*$/.test(t)) named.set(t, { pkg, imported: t });
+      }
+    } else {
+      ns.set(bind, pkg);
+    }
+  }
+  return { named, ns, packages };
+}
+
+/**
+ * Parse Python imports. Same return shape as extractJsImports.
+ *   from pkg import a, b as c        -> named: a->{pkg,a}, c->{pkg,b}
+ *   from pkg.sub import a            -> named: a->{pkg,a}  (pkg base)
+ *   import pkg / import pkg as p     -> ns: pkg->pkg / p->pkg
+ */
+function extractPyImports(content) {
+  const code = (0,_sast_comment_strip_js__WEBPACK_IMPORTED_MODULE_0__/* .blankComments */ .$)(content);
+  const named = new Map();
+  const ns = new Map();
+  const packages = new Set();
+
+  const from = /^[ \t]*from\s+([A-Za-z_][\w.]*)\s+import\s+(.+)$/gm;
+  let m;
+  while ((m = from.exec(code))) {
+    const pkg = pkgBase(m[1], 'py');
+    packages.add(pkg);
+    let names = m[2].trim();
+    if (names === '*') continue;
+    names = names.replace(/[()]/g, '');
+    for (const p of parseNamedClause(names)) named.set(p.local, { pkg, imported: p.imported });
+  }
+  const imp = /^[ \t]*import\s+(.+)$/gm;
+  while ((m = imp.exec(code))) {
+    if (/^\s*import\s+/.test(m[0]) && /\bfrom\b/.test(m[0])) continue;
+    for (const raw of m[1].split(',')) {
+      const t = raw.trim(); if (!t) continue;
+      const mm = t.match(/^([A-Za-z_][\w.]*)(?:\s+as\s+([A-Za-z_]\w*))?$/);
+      if (!mm) continue;
+      const pkg = pkgBase(mm[1], 'py');
+      packages.add(pkg);
+      ns.set(mm[2] || mm[1].split('.')[0], pkg);
+    }
+  }
+  return { named, ns, packages };
+}
+
+function extractImports(content, lang) {
+  return lang === 'py' ? extractPyImports(content) : extractJsImports(content);
+}
+
+/**
+ * Find call sites in `content` of `vulnFns` belonging to `pkg`, resolved through
+ * this file's import map. Returns [{ fn, line, via }]. Empty if the file does
+ * not import `pkg` (the precision gate).
+ */
+function findImportAwareCallSites(content, lang, imports, pkg, vulnFns) {
+  if (!imports || !vulnFns || !vulnFns.length) return [];
+  const importsPkg = [...imports.packages].some((p) => pkgMatches(pkg, p, lang));
+  if (!importsPkg) return [];
+  const want = new Set(vulnFns);
+  const code = (0,_sast_comment_strip_js__WEBPACK_IMPORTED_MODULE_0__/* .blankComments */ .$)(content);
+  const lines = code.split('\n');
+  const sites = [];
+  const lineOf = (idx) => code.slice(0, idx).split('\n').length;
+
+  // 1) named/aliased imports: localName bound to {pkg, imported} where imported ∈ want
+  for (const [local, info] of imports.named) {
+    if (!pkgMatches(pkg, info.pkg, lang)) continue;
+    if (!want.has(info.imported)) continue;
+    const re = new RegExp(`\\b${local.replace(/[$]/g, '\\$&')}\\s*\\(`, 'g');
+    let mm;
+    while ((mm = re.exec(code))) sites.push({ fn: info.imported, line: lineOf(mm.index), via: local === info.imported ? 'named' : 'alias' });
+  }
+  // 2) namespace/default member access: ns.fn( where ns→pkg and fn ∈ want
+  for (const [local, p] of imports.ns) {
+    if (!pkgMatches(pkg, p, lang)) continue;
+    for (const fn of want) {
+      const sep = lang === 'py' ? '\\.' : '\\.';
+      const re = new RegExp(`\\b${local.replace(/[$]/g, '\\$&')}\\s*${sep}\\s*${fn.replace(/[^\w]/g, '\\$&')}\\s*\\(`, 'g');
+      let mm;
+      while ((mm = re.exec(code))) sites.push({ fn, line: lineOf(mm.index), via: 'namespace' });
+    }
+  }
+  // Dedup by fn+line.
+  const seen = new Set();
+  return sites.filter((s) => { const k = `${s.fn}:${s.line}`; if (seen.has(k)) return false; seen.add(k); return true; });
+}
+
+/**
+ * Augment supplyChain findings (npm/pypi only) with import-aware call sites the
+ * regex pass missed, gated to files that import the package. Additive: it never
+ * removes existing sites, so it cannot regress the route-reachability classifier
+ * that runs next — it only gives it more (and more accurate) call sites.
+ *
+ * Mutates and returns `supplyChain`. Records `sc._importAwareCallSites` (count)
+ * for observability.
+ */
+function augmentReachabilityViaImports(supplyChain, fileContents, vulnFnHints = {}) {
+  if (!Array.isArray(supplyChain)) return supplyChain;
+  // Collect the hardcoded/generated hint function names for a package. The
+  // hint map is keyed by `pkg` and by versioned `pkg@range` (and packages may
+  // be scoped `@scope/pkg`). The vulnerability decision already happened
+  // upstream; here we only need candidate function NAMES to locate call sites,
+  // so we gather version-agnostically.
+  const hintFnsFor = (name) => {
+    const out = [];
+    for (const [k, v] of Object.entries(vulnFnHints || {})) {
+      if (!Array.isArray(v)) continue;
+      const atIdx = k.lastIndexOf('@');
+      const base = atIdx > 0 ? k.slice(0, atIdx) : k; // >0 keeps a leading-@ scope intact
+      if (base === name) out.push(...v);
+    }
+    return out;
+  };
+  // Pre-parse imports per JS/PY file once.
+  const importsByFile = new Map();
+  for (const [file, content] of Object.entries(fileContents || {})) {
+    const lang = languageOfFile(file);
+    if (!lang) continue;
+    try { importsByFile.set(file, { lang, imports: extractImports(content, lang) }); } catch { /* skip unparseable */ }
+  }
+  if (!importsByFile.size) return supplyChain;
+
+  for (const sc of supplyChain) {
+    if (!sc || sc.type !== 'vulnerable_dep') continue;
+    if (sc.ecosystem !== 'npm' && sc.ecosystem !== 'pypi') continue;
+    const lang = sc.ecosystem === 'npm' ? 'js' : 'py';
+    const vulnFns = (sc.osvVulnFunctions || []).map((f) => {
+      const d = String(f).lastIndexOf('.'); return d > 0 ? String(f).slice(d + 1) : String(f);
+    }).concat(sc.usedVulnerableFunctions || []).concat(hintFnsFor(sc.name));
+    const uniqFns = [...new Set(vulnFns.filter(Boolean))];
+    if (!uniqFns.length) continue;
+
+    const existing = Array.isArray(sc.vulnerableFunctionCallSites) ? sc.vulnerableFunctionCallSites : [];
+    const seen = new Set(existing.map((s) => `${s.file}:${s.line}:${s.fn}`));
+    let added = 0;
+    for (const [file, { lang: fl, imports }] of importsByFile) {
+      if (fl !== lang) continue;
+      const content = fileContents[file];
+      const sites = findImportAwareCallSites(content, lang, imports, sc.name, uniqFns);
+      for (const s of sites) {
+        const key = `${file}:${s.line}:${s.fn}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        existing.push({ pkg: sc.name, fn: s.fn, file, line: s.line, via: s.via, _r7: true });
+        added++;
+      }
+    }
+    if (added > 0) {
+      sc.vulnerableFunctionCallSites = existing;
+      const usedSet = new Set(sc.usedVulnerableFunctions || []);
+      for (const s of existing) usedSet.add(s.fn);
+      sc.usedVulnerableFunctions = [...usedSet];
+      sc.noKnownCallSite = false;
+      sc._importAwareCallSites = (sc._importAwareCallSites || 0) + added;
+    }
+  }
+  return supplyChain;
+}
+
+
+/***/ })
+
+};

package/dist/637.index.js

@@ -7,10 +7,11 @@ export const modules = {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   computePrDelta: () => (/* binding */ computePrDelta),
+/* harmony export */   netNewGate: () => (/* binding */ netNewGate),
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2271);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(5099);
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings
@@ -183,6 +184,19 @@ async function computePrDelta(root, { baseRef, headRef = 'HEAD' } = {}) {
 /**
  * Lightweight text summary used as a CLI fallback when --json isn't set.
  */
+// R24 (PRD §5) — net-new CI gate. Blocks the build ONLY on findings the PR
+// INTRODUCED (delta.introduced), at or above `failOn` severity — never on the
+// pre-existing backlog. This is the only SAST CI posture teams tolerate
+// long-term. Pure + deterministic: takes a delta, returns the gate decision.
+const _NETNEW_SEV_RANK = { critical: 3, high: 2, medium: 1, low: 0, info: -1 };
+function netNewGate(delta, failOn = 'critical') {
+  const introduced = (delta && Array.isArray(delta.introduced)) ? delta.introduced : [];
+  if (failOn === 'none') return { fail: false, failOn, introducedCount: introduced.length, blocked: [] };
+  const threshold = _NETNEW_SEV_RANK[failOn] ?? 3;
+  const blocked = introduced.filter((f) => (_NETNEW_SEV_RANK[f.severity] ?? -1) >= threshold);
+  return { fail: blocked.length > 0, failOn, introducedCount: introduced.length, blocked };
+}
+
 function renderPrDeltaText(delta) {
   const i = delta.summary.introduced;
   const r = delta.summary.resolved;

package/dist/838.index.js

@@ -14,7 +14,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2271);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5099);
 // Closed-loop /fix verification (Sentinel-parity FR-L4-4, FR-L4-5).
 //
 // Given a candidate patch (the new file content + the finding stableId being