@clear-capabilities/agentic-security-scanner 0.153.1 → 0.154.0

package/src/lineage/nix-view.js

@@ -0,0 +1,198 @@
+// Nix configuration lineage (X-004 / X-005). Contributes nodes, data elements, edges, flows and evidence to an
+// EXISTING DataFlowGraph v1; it never forks the schema. The inputs are the NIX-006 secret-placement findings
+// (which already include secrets interpolated into generated scripts), so a credential-bearing option is followed
+// to where the Nix evaluation puts it: the world-readable store, a derivation environment, a log, or the source
+// file itself.
+//
+// Scope and honesty:
+//   * Every contribution is STATIC CONFIGURATION evidence. A node carries `analysis: {language: 'nix',
+//     kind: 'configuration', scope: 'static-configuration', runtime: false}`: a declared service or a store
+//     path is not proof that a value is exposed at runtime, and nothing here claims it is.
+//   * A runtime reference (a `…File` option, EnvironmentFile, sops/agenix path) is not a flow; the secret analyzer
+//     already treats it as safe and so does this view.
+//   * The original location is the Nix source; a generated-script location is kept as `generatedLocation` when the
+//     value lands in a generated shell script. Neither is invented.
+//   * No application-level link is inferred: a Nix store file does not become an application read by name.
+
+import * as ids from './ids.js';
+import { classifyDataElementName } from './classification.js';
+import { analyzeNixSecrets } from '../language/nix-secrets.js';
+import { analyzeNixPersonalData, destinationOf } from '../language/nix-privacy.js';
+
+export const NIX_VIEW_VERSION = 'nix-lineage/1';
+
+const ANALYSIS = Object.freeze({ language: 'nix', kind: 'configuration', scope: 'static-configuration', runtime: false });
+
+// exposure -> sink decision. Each is a registry-shaped decision (kind + subtype), never a call site.
+const SINKS = {
+  store: { kind: 'store', subtype: 'file', label: 'Nix store (world-readable)', stage: 'storage' },
+  build: { kind: 'store', subtype: 'file', label: 'Derivation environment (recorded in the .drv)', stage: 'storage' },
+  log: { kind: 'log', subtype: 'log', label: 'Evaluation or script log output', stage: 'storage' },
+  'plaintext-source': { kind: 'store', subtype: 'file', label: 'Configuration source file', stage: 'storage' },
+};
+
+const lastSegment = (detail) => String(detail || '').replace(/^option\s+/, '').replace(/^config\./, '').split('.').filter(Boolean).pop() || 'secret';
+
+/**
+ * Adds Nix configuration lineage to `graph` in place. Returns `{added, nixFiles, gaps}`.
+ * @param {object} graph a DataFlowGraph v1 (mutated)
+ * @param {Record<string,string>} files every file handed to the scan
+ * @param {{repository?: string}} opts
+ */
+export function contributeNixConfigLineage(graph, files, opts = {}) {
+  const nixFiles = Object.keys(files || {}).filter((f) => /\.nix$/i.test(f));
+  const result = { added: { nodes: 0, edges: 0, flows: 0, dataElements: 0 }, nixFiles: nixFiles.length, gaps: [] };
+  if (!nixFiles.length) return result;
+  const repository = opts.repository || '';
+  let analysis;
+  try { analysis = analyzeNixSecrets({ files }); } catch (e) { result.gaps.push(`nix secret analysis failed: ${String((e && e.message) || e)}`); return result; }
+  result.gaps.push(...(analysis.gaps || []).map((g) => (typeof g === 'string' ? g : (g && (g.reason || g.message)) || 'unresolved Nix construct')));
+
+  const nodes = new Map(graph.nodes.map((n) => [n.id, n]));
+  const els = new Map(graph.dataElements.map((d) => [d.id, d]));
+  const edges = new Map(graph.edges.map((e) => [e.id, e]));
+  const flows = new Map(graph.flows.map((f) => [f.id, f]));
+  const evidence = new Map(graph.evidence.map((e) => [e.id, e]));
+
+  const mint = (kind, subtype, label, stage, externality = 'internal') => {
+    const id = ids.nodeId(kind, [repository, `nix:${subtype}`, 'modeled', externality, '']);
+    let n = nodes.get(id);
+    if (!n) {
+      n = {
+        id, kind, subtype, label, aliases: [], location: null,
+        system: { application: repository, environment: null }, destination: null, storeDetail: null, queueDetail: null,
+        externality: { value: externality, evidenceRefs: [] }, lifecycleStages: [stage], governanceRefs: {},
+        dataElementIds: [], evidenceRefs: [], confidence: { score: 0.8, tier: 'high' }, coverageStatus: 'modeled', coverageReason: null,
+        analysis: ANALYSIS,
+      };
+      nodes.set(id, n); result.added.nodes++;
+    }
+    return n;
+  };
+  const source = mint('source', 'declared', 'Nix configuration value', 'collection');
+
+  for (const f of analysis.findings || []) {
+    const sink = SINKS[f.exposure];
+    if (!sink || !f.source) continue;                                   // runtime references and unclassified exposures are not flows
+    const name = lastSegment(f.source.detail);
+    const deId = ids.dataElementId(name, [repository, f.source.file || f.file || '']);
+    let de = els.get(deId);
+    if (!de) {
+      const cls = classifyDataElementName(name).classes;
+      de = {
+        id: deId, name, aliases: [], declaredType: null, dataClasses: cls.length ? cls : ['CREDENTIALS'], aiContexts: [],
+        sourceLocations: [{ file: f.source.file || f.file, line: f.line, scope: 'nix', path: f.source.detail }],
+        dataSubjectCategory: null, classificationEvidence: [], manualOverride: false,
+      };
+      els.set(deId, de); result.added.dataElements++;
+    }
+    const snk = mint(sink.kind, sink.subtype, sink.label, sink.stage);
+    if (!source.dataElementIds.includes(deId)) source.dataElementIds.push(deId);
+    if (!snk.dataElementIds.includes(deId)) snk.dataElementIds.push(deId);
+
+    const edgeIdStr = ids.edgeId(source.id, snk.id, 'data_flow', [f.source.detail, f.exposure, deId, 'identity']);
+    if (!edges.has(edgeIdStr)) {
+      edges.set(edgeIdStr, {
+        id: edgeIdStr, from: source.id, to: snk.id, relationship: 'data_flow',
+        fieldMappings: [{ fromPath: f.source.detail, toPath: null, dataElementIds: [deId], mappingType: 'identity', transformationIds: [] }],
+        protocol: { name: 'nix-evaluation', destinationResolution: 'resolved_from_config' },
+        boundaryCrossings: [], provenance: 'code',
+        protection: { transit: { verdict: 'not_applicable', evidenceGrade: 'none' }, atRest: { verdict: f.exposure === 'log' ? 'not_assessed' : 'unprotected', evidenceGrade: 'config' }, handling: { verdict: 'not_assessed', evidenceGrade: 'none' } },
+        evidenceRefs: [], coverageStatus: 'modeled', analysis: ANALYSIS,
+      });
+      result.added.edges++;
+    }
+    const claim = `${f.rule}: ${f.source.detail} reaches ${sink.label}`;
+    const evId = ids.evidenceId(claim, `${f.file}:${f.line}`, [deId, f.exposure]);
+    if (!evidence.has(evId)) {
+      evidence.set(evId, {
+        id: evId, claim, evidenceType: 'configuration', location: { file: f.file, line: f.line, column: f.column ?? null, generatedLocation: f.generatedLocation || null },
+        producer: 'nix-secrets', confidenceTier: null, snippet: null, timestamp: null, commit: null,
+        limitations: ['static configuration evidence: the value is not proven to be present on a running host'], conflict: null,
+      });
+    }
+    const fId = ids.flowId(source.id, snk.id, [deId], [f.exposure, f.rule]);
+    if (!flows.has(fId)) {
+      flows.set(fId, {
+        id: fId, dataElementIds: [deId], source: source.id, sink: snk.id, edgeIds: [edgeIdStr], transformationIds: [],
+        alternatePathCount: 0, policyVerdict: 'not_evaluated', protectionSummary: f.exposure === 'log' ? 'not_assessed' : 'unprotected',
+        evidenceRefs: [evId], confidence: { score: 0.8, tier: 'high' }, coverageStatus: 'modeled', findingRefs: [], governanceRefs: {},
+        limitations: ['static Nix configuration evidence', ...(f.generatedLocation ? ['the value lands in a generated script; both the original and generated locations are recorded'] : [])],
+        evidenceGrade: 'explicit', handling: 'raw', analysis: ANALYSIS,
+      });
+      result.added.flows++;
+    } else {
+      const ex = flows.get(fId);
+      if (!ex.evidenceRefs.includes(evId)) ex.evidenceRefs.push(evId);
+    }
+  }
+
+  // Personal data (PII, PHI, PCI, financial) written into configuration: a field-to-store flow per unprotected reference.
+  let personal = { references: [], gaps: [] };
+  try { personal = analyzeNixPersonalData({ files }); } catch (e) { result.gaps.push(`nix personal-data analysis failed: ${String((e && e.message) || e)}`); }
+  result.gaps.push(...personal.gaps);
+  for (const ref of personal.references) {
+    if (ref.protected) continue;                                    // hashed, measured or only compared: no flow of the value
+    const dest = destinationOf(ref.attr);
+    const sink = { kind: 'store', subtype: 'file', label: dest.label, stage: 'storage' };
+    const deId = ids.dataElementId(ref.field, [repository, ref.file]);
+    let de = els.get(deId);
+    if (!de) {
+      de = {
+        id: deId, name: ref.field, aliases: [], declaredType: null, dataClasses: ref.classes, aiContexts: [],
+        sourceLocations: [{ file: ref.file, line: ref.line, scope: 'nix', path: ref.option }],
+        dataSubjectCategory: null, classificationEvidence: [], manualOverride: false,
+      };
+      els.set(deId, de); result.added.dataElements++;
+    }
+    const snk = mint(sink.kind, sink.subtype, sink.label, sink.stage);
+    if (!source.dataElementIds.includes(deId)) source.dataElementIds.push(deId);
+    if (!snk.dataElementIds.includes(deId)) snk.dataElementIds.push(deId);
+    const edgeIdStr = ids.edgeId(source.id, snk.id, 'data_flow', [ref.option, 'personal-data', deId, 'identity']);
+    if (!edges.has(edgeIdStr)) {
+      edges.set(edgeIdStr, {
+        id: edgeIdStr, from: source.id, to: snk.id, relationship: 'data_flow',
+        fieldMappings: [{ fromPath: ref.option, toPath: ref.attr.join('.'), dataElementIds: [deId], mappingType: 'identity', transformationIds: [] }],
+        protocol: { name: 'nix-evaluation', destinationResolution: 'resolved_from_config' },
+        boundaryCrossings: [], provenance: 'code',
+        protection: { transit: { verdict: 'not_applicable', evidenceGrade: 'none' }, atRest: { verdict: 'unprotected', evidenceGrade: 'config' }, handling: { verdict: 'not_assessed', evidenceGrade: 'none' } },
+        evidenceRefs: [], coverageStatus: 'modeled', analysis: ANALYSIS,
+      });
+      result.added.edges++;
+    }
+    const claim = `nix-personal-data-in-store: ${ref.option} reaches ${sink.label}`;
+    const evId = ids.evidenceId(claim, `${ref.file}:${ref.line}`, [deId, 'personal-data']);
+    if (!evidence.has(evId)) {
+      evidence.set(evId, {
+        id: evId, claim, evidenceType: 'configuration', location: { file: ref.file, line: ref.line, column: null, generatedLocation: null },
+        producer: 'nix-privacy', confidenceTier: null, snippet: null, timestamp: null, commit: null,
+        limitations: ['static configuration evidence: the option may hold no real personal data, and the value is not proven present on a running host'], conflict: null,
+      });
+    }
+    const fId = ids.flowId(source.id, snk.id, [deId], ['personal-data', ref.attr.join('.')]);
+    if (!flows.has(fId)) {
+      flows.set(fId, {
+        id: fId, dataElementIds: [deId], source: source.id, sink: snk.id, edgeIds: [edgeIdStr], transformationIds: [],
+        alternatePathCount: 0, policyVerdict: 'not_evaluated', protectionSummary: 'unprotected',
+        evidenceRefs: [evId], confidence: { score: 0.7, tier: 'medium' }, coverageStatus: 'modeled', findingRefs: [], governanceRefs: {},
+        limitations: ['static Nix configuration evidence', 'classified by the option name only'],
+        evidenceGrade: 'inferred', handling: 'raw', analysis: ANALYSIS,
+      });
+      result.added.flows++;
+    } else {
+      const ex = flows.get(fId);
+      if (!ex.evidenceRefs.includes(evId)) ex.evidenceRefs.push(evId);
+    }
+  }
+
+  const byId = (a, b) => (a.id < b.id ? -1 : 1);
+  graph.nodes = [...nodes.values()].sort(byId);
+  graph.dataElements = [...els.values()].sort(byId);
+  graph.edges = [...edges.values()].sort(byId);
+  graph.flows = [...flows.values()].sort(byId);
+  graph.evidence = [...evidence.values()].sort(byId);
+  if (result.added.flows) {
+    graph.limitations = [...graph.limitations, 'Nix configuration lineage is static: a store path or declared service is not proof of runtime exposure.'];
+  }
+  return result;
+}

package/src/lineage/sink-registry.js

@@ -116,6 +116,10 @@ export const CWE_MAP = Object.freeze({
   'CWE-22':   Object.freeze({ category: 'file',          status: 'modeled',     why: 'path traversal sinks are filesystem reads/writes' }),
   'CWE-73':   Object.freeze({ category: 'file',          status: 'modeled',     why: 'arbitrary file write' }),
   'CWE-918':  Object.freeze({ category: 'external-api',  status: 'modeled',     why: 'SSRF sinks are outbound HTTP client calls' }),
+  // X-004 / haskell-models.js: untrusted text placed in a model request BODY. The call is an ordinary outbound HTTP
+  // body setter, so it is an external-api destination; whether the destination is a model provider is decided by
+  // the AI-evidence overlay (lineage/haskell-ai.js), never by this table.
+  'CWE-1427': Object.freeze({ category: 'external-api',  status: 'modeled',     why: 'a model request body is an outbound HTTP request body' }),
   'CWE-601':  Object.freeze({ category: 'http-response', status: 'modeled',     why: 'a redirect is written as a response header' }),
   'CWE-113':  Object.freeze({ category: 'http-response', status: 'modeled',     why: 'response splitting — the sink IS the response header writer' }),
   // The sink side's ONE documented refinement (§5.2). `status: 'split'` is
@@ -136,6 +140,7 @@ export const CWE_MAP = Object.freeze({
   // memory). FR-201's category list is an EGRESS taxonomy and models none
   // of them — the single largest structural finding of D1 (§3/§7.1).
   'CWE-78':   Object.freeze({ category: null, status: 'unsupported', why: 'shell/process execution — no FR-201 category models process execution' }),
+  'CWE-88':   Object.freeze({ category: null, status: 'unsupported', why: 'process-argument injection (Haskell argv sinks), no FR-201 category models process execution' }),
   'CWE-95':   Object.freeze({ category: null, status: 'unsupported', why: 'code evaluation (eval/Function/exec/compile) — destination is an interpreter' }),
   'CWE-94':   Object.freeze({ category: null, status: 'unsupported', why: 'code injection / template compilation — destination is an interpreter or template engine' }),
   // PHP SARD catalog addition: include/require executes the included file
@@ -291,7 +296,11 @@ export function reclassifySink(entry, opts = {}) {
   }
   if (row.status === 'split') {
     // The single documented refinement on the sink side (§5.2).
-    row = DOM_FRAMEWORKS.has(entry.framework)
+    // A Haskell text-output sink (`putStrLn`) that is an XSS sink only when the string being assembled carries markup
+    // (`hs.htmlSkeleton`): the destination is standard output (a log), not a browser response.
+    row = entry.hs && entry.hs.htmlSkeleton
+      ? { category: 'log', status: 'modeled', why: 'text written to standard output (the console is a log destination); an XSS sink to the taint engine only when the assembled string carries markup' }
+      : DOM_FRAMEWORKS.has(entry.framework)
       ? { category: 'client-storage', status: 'partial', why: "LOSSY: the destination is the rendered browser DOM; schema.js's `client-storage` is its encoding of FR-201's 'browser DOM or client storage' bullet, and under-names the DOM half" }
       : { category: 'http-response', status: 'modeled', why: 'a server-side response writer (res.send / PrintWriter / echo / Fprintf)' };
   }

package/src/lineage/source-registry.js

@@ -144,6 +144,9 @@ export const NO_PROVENANCE_OVERRIDES = Object.freeze({
   'py-os-getenv': 'env-value',
   'py-os-environ': 'env-value',
   'py-input': 'user-input',
+  // Haskell: a parameter of an exported function carries caller-supplied text or a customer record (no request is modelled)
+  'hs-src-caller-controlled-param': 'user-input',
+  'hs-lin-src-record-parameter': 'user-input',
   // Java / Servlet
   'java-request-getParameter': 'http-query',
   'java-request-getHeader': 'http-header',

package/src/lineage/transform-catalog.js

@@ -195,6 +195,18 @@ export const TRANSFORM_CATALOG = Object.freeze([
   { id: 'py-hashlib-md5',         language: 'py',   kind: 'hash', reversibility: 'irreversible', algorithm: 'md5',      confidence: 'high',   match: { type: 'member-call', object: 'hashlib', method: 'md5' },         evidence: "call to '{name}' — Python's stdlib hashlib; the callee name itself states the digest algorithm (recognized, not endorsed: MD5 is broken)", examples: ['hashlib.md5'] },
   { id: 'java-message-digest',    language: 'java', kind: 'hash', reversibility: 'irreversible', algorithm: null,       confidence: 'high',   match: { type: 'member-call', object: 'MessageDigest', method: 'getInstance' }, evidence: "call to '{name}' — the JCA MessageDigest factory (the digest algorithm is an argument, not read here)", examples: ['MessageDigest.getInstance'] },
 
+  // Haskell (cryptonite / crypton / bcrypt / argon2 packages). A dotted callee is matched on its last two segments, so
+  // `Crypto.Hash.hashWith` is object `Hash`, method `hashWith`.
+  { id: 'hs-crypto-hash',           language: 'hs',   kind: 'hash', reversibility: 'irreversible', algorithm: null,     confidence: 'high', match: { type: 'member-call', object: 'Hash', method: 'hash' },          evidence: "call to '{name}', Crypto.Hash digest (the algorithm is a type or argument)", examples: ['Crypto.Hash.hash'] },
+  { id: 'hs-crypto-hashwith',       language: 'hs',   kind: 'hash', reversibility: 'irreversible', algorithm: null,     confidence: 'high', match: { type: 'member-call', object: 'Hash', method: 'hashWith' },      evidence: "call to '{name}', Crypto.Hash digest with an explicit algorithm value", examples: ['Crypto.Hash.hashWith'] },
+  { id: 'hs-crypto-hashlazy',       language: 'hs',   kind: 'hash', reversibility: 'irreversible', algorithm: null,     confidence: 'high', match: { type: 'member-call', object: 'Hash', method: 'hashlazy' },      evidence: "call to '{name}', Crypto.Hash digest of a lazy value", examples: ['Crypto.Hash.hashlazy'] },
+  { id: 'hs-crypto-sha256',         language: 'hs',   kind: 'hash', reversibility: 'irreversible', algorithm: 'sha256', confidence: 'high', match: { type: 'member-call', object: 'SHA256', method: 'hash' },        evidence: "call to '{name}', Crypto.Hash.SHA256", examples: ['Crypto.Hash.SHA256.hash'] },
+  { id: 'hs-crypto-sha512',         language: 'hs',   kind: 'hash', reversibility: 'irreversible', algorithm: 'sha512', confidence: 'high', match: { type: 'member-call', object: 'SHA512', method: 'hash' },        evidence: "call to '{name}', Crypto.Hash.SHA512", examples: ['Crypto.Hash.SHA512.hash'] },
+  { id: 'hs-crypto-blake2',         language: 'hs',   kind: 'hash', reversibility: 'irreversible', algorithm: 'blake2', confidence: 'high', match: { type: 'member-call', object: 'Blake2b_256', method: 'hash' },   evidence: "call to '{name}', Crypto.Hash BLAKE2", examples: ['Crypto.Hash.Blake2b_256.hash'] },
+  { id: 'hs-hmac',                  language: 'hs',   kind: 'hash', reversibility: 'irreversible', algorithm: null,     confidence: 'high', match: { type: 'member-call', object: 'HMAC', method: 'hmac' },       evidence: "call to '{name}', Crypto.MAC.HMAC keyed digest; still one-way", examples: ['Crypto.MAC.HMAC.hmac'] },
+  { id: 'hs-bcrypt-hash',           language: 'hs',   kind: 'hash', reversibility: 'irreversible', algorithm: 'bcrypt', confidence: 'high', match: { type: 'member-call', object: 'BCrypt', method: 'hashPassword' }, evidence: "call to '{name}', Crypto.KDF.BCrypt", examples: ['Crypto.KDF.BCrypt.hashPassword'] },
+  { id: 'hs-argon2-hash',           language: 'hs',   kind: 'hash', reversibility: 'irreversible', algorithm: 'argon2', confidence: 'high', match: { type: 'member-call', object: 'Argon2', method: 'hash' },        evidence: "call to '{name}', Crypto.KDF.Argon2", examples: ['Crypto.KDF.Argon2.hash'] },
+
   // ─── encrypt — reversible by design ────────────────────────────────────
   { id: 'js-node-cipheriv',       language: 'js',   kind: 'encrypt', reversibility: 'reversible', algorithm: null,      confidence: 'high',   match: { type: 'member-call', object: 'crypto', method: 'createCipheriv' }, evidence: "call to '{name}' — Node's built-in symmetric cipher factory (the cipher suite is an argument, not read here)", examples: ['crypto.createCipheriv'] },
   { id: 'js-node-cipher-legacy',  language: 'js',   kind: 'encrypt', reversibility: 'reversible', algorithm: null,      confidence: 'high',   match: { type: 'member-call', object: 'crypto', method: 'createCipher' },   evidence: "call to '{name}' — Node's deprecated symmetric cipher factory (removed in Node 22; still present in legacy code)", examples: ['crypto.createCipher'] },

package/src/llm-validator/index.js

@@ -61,6 +61,7 @@
 // Cache key includes the prompt template version + model id, so any change
 // to the hardened prompt invalidates the cache.
 
+import { languageClosureDigest, languagePromptExtras } from '../language/context.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
@@ -288,6 +289,12 @@ function fileHashOf(fileContents, file) {
   if (!file) return '';
   const c = fileContents?.[file];
   if (!c) return '';
+  // Haskell/Nix: a model verdict about one file depends on the modules it imports and the manifests around it, so the
+  // key covers that closure. Otherwise a cached `reject` would survive a change to the very module that made the
+  // finding true.
+  if (/\.(?:l?hs|hs-boot|hsc|nix)$/i.test(file)) {
+    try { return languageClosureDigest(fileContents, file); } catch { /* fall back to the file alone */ }
+  }
   return crypto.createHash('sha256').update(c).digest('hex').slice(0, 32);
 }
 
@@ -319,6 +326,10 @@ function renderPrompt(finding, fileContents, challenge, nonce, scanRoot) {
     : `${finding.file}:${finding.line} [single-point detection, no cross-file path]`;
   // Defensive: strip the delimiter literally from the untrusted excerpt so
   // an attacker can't close it early by embedding our token.
+  // Related files on the finding's own evidence chain (Haskell/Nix), under the same untrusted-excerpt rules.
+  try {
+    for (const x of languagePromptExtras(finding, fileContents)) context += `${context ? '\n' : ''}--- related excerpt: ${x.file} ---\n${redactPayload({ text: x.text, filePath: x.file, scanRoot }).text}`;
+  } catch { /* extra context is advisory */ }
   let sterileContext = String(context || '')
     .replace(/BEGIN-UNTRUSTED-CODE-EXCERPT-[a-f0-9]+/gi, '[stripped-delimiter]')
     .replace(/END-UNTRUSTED-CODE-EXCERPT-[a-f0-9]+/gi, '[stripped-delimiter]');
@@ -394,12 +405,15 @@ async function callEndpoint(endpoint, apiKey, model, prompt, preset = null, shap
     else headers['Authorization'] = `Bearer ${apiKey}`;
   }
   try {
-    const r = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body) });
+    // A model that accepts the connection and never answers must not hold a scan open forever: every call is bounded.
+    // The result is an UNAVAILABLE finding (kept, unvalidated), never a silent pass.
+    const ms = Number(process.env.AGENTIC_SECURITY_LLM_TIMEOUT_MS) > 0 ? Number(process.env.AGENTIC_SECURITY_LLM_TIMEOUT_MS) : 60_000;
+    const r = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body), signal: AbortSignal.timeout(ms) });
     if (!r.ok) return { ok: false, error: `HTTP ${r.status}` };
     const j = await r.json().catch(() => null);
     return { ok: true, text: String(extractText(j) || ''), usage: extractUsage ? extractUsage(j) : null };
   } catch (e) {
-    return { ok: false, error: e.message };
+    return { ok: false, error: e && e.name === 'TimeoutError' ? 'timeout' : e.message };
   }
 }
 

package/src/lsp/server.js

@@ -13,6 +13,8 @@
 // Wire-format: vscode-jsonrpc framing (Content-Length headers). Stateless
 // per file — no incremental analysis yet.
 
+import { isLanguageManifest } from '../language/discovery.js';
+import { withLanguageContext, loadLanguageProject, languageOfFinding, languageFixPreview, minimalEdit } from '../language/context.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as readline from 'node:readline';
@@ -53,6 +55,21 @@ function sevToLsp(sev) {
   }
 }
 
+// The most precise location a finding carries. Haskell and Nix findings keep their ORIGINAL span (0-based columns); a
+// finding with only a line is reported across that line, as before.
+function _rangeOf(f) {
+  const o = f && f.originalLocation;
+  if (o && Number.isInteger(o.startLine) && Number.isInteger(o.startColumn)) {
+    return { start: { line: Math.max(0, o.startLine - 1), character: o.startColumn }, end: { line: Math.max(0, (Number.isInteger(o.endLine) ? o.endLine : o.startLine) - 1), character: Number.isInteger(o.endColumn) ? o.endColumn : o.startColumn + 1 } };
+  }
+  if (o && Number.isInteger(o.line) && Number.isInteger(o.column)) {
+    const line = Math.max(0, o.line - 1);
+    return { start: { line, character: o.column }, end: { line, character: 200 } };
+  }
+  const line = Math.max(0, ((f && f.line) || 1) - 1);
+  return { start: { line, character: 0 }, end: { line, character: 200 } };
+}
+
 function findingToDiagnostic(f) {
   const line = Math.max(0, (f.line || 1) - 1);
   // Stage 6 correctness audit: this read f.remediation directly, but raw
@@ -63,13 +80,12 @@ function findingToDiagnostic(f) {
   // report/index.js already established for this exact split (CMP-3).
   const remediation = _remediationOf(f);
   return {
-    range: {
-      start: { line, character: 0 },
-      end:   { line, character: 200 },
-    },
+    range: _rangeOf(f),
     severity: sevToLsp(f.severity),
     source: 'agentic-security',
     code: f.cwe || f.family || 'finding',
+    // carried back by the client in codeAction requests, so a fix is offered for exactly this finding
+    data: { id: f.id || null, stableId: f.stableId || null, rule: f.rule || null, family: f.family || null, language: f.language || languageOfFinding(f) || null },
     message: `${f.vuln || 'Security finding'}${remediation ? '\n\n' + remediation : ''}`.slice(0, 2000),
     tags: [],
   };
@@ -101,7 +117,10 @@ const DEP_BASE_NAMES = new Set([
   'go.mod', 'Cargo.toml', 'Cargo.lock',
   'pom.xml', 'build.gradle', 'build.gradle.kts',
 ]);
-const DEP_EXT_RE = /\.(?:proto|graphql|gql|tf)$/i;
+const DEP_EXT_RE = /\.(?:proto|graphql|gql|tf|cabal)$/i;
+// Haskell and Nix project manifests and lock files (cabal.project*, stack.yaml*, package.yaml, flake.lock, ...) are
+// recognised by the shared language discovery module, never by a second list here.
+const _isLanguageDep = (base) => isLanguageManifest(base);
 const DEP_NAME_RE = /(?:openapi|swagger)\.(?:ya?ml|json)$/i;
 
 let _depCache = { rootDir: null, depFileContents: {} };
@@ -119,7 +138,7 @@ function _loadDepFileContents(rootDir) {
       if (e.isDirectory()) { walk(full); continue; }
       if (!e.isFile()) continue;
       const base = e.name;
-      if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base)) {
+      if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base) || _isLanguageDep(base)) {
         let stat;
         try { stat = fs.statSync(full); } catch { continue; }
         if (stat.size > 500_000) continue;
@@ -144,8 +163,11 @@ async function scanFile(uri) {
   try {
     const rel = path.relative(_rootDir, filePath);
     const content = fs.readFileSync(filePath, 'utf8');
-    const fileContents = { [rel]: content };
-    const depFileContents = _loadDepFileContents(_rootDir);
+    let fileContents = { [rel]: content };
+    let depFileContents = _loadDepFileContents(_rootDir);
+    // Haskell/Nix: scan the saved file together with the modules it imports and the ones that import it (bounded).
+    const lc = withLanguageContext(_rootDir, fileContents, depFileContents);
+    fileContents = lc.fileContents; depFileContents = lc.depFileContents;
     // Premortem 4R-12 + 4R-15: reset the per-process custom-rules budget at
     // the start of each LSP scan. Each save is a logical scan session; without
     // the reset, a long-lived LSP server would accumulate budget across saves
@@ -220,12 +242,50 @@ function handleInitialize(params) {
         save: { includeText: false },
       },
       diagnosticProvider: { interFileDependencies: true, workspaceDiagnostics: false },
+      // quick fixes for Haskell and Nix findings (preview edits from the verified language fixers)
+      codeActionProvider: { codeActionKinds: ['quickfix'], resolveProvider: false },
     },
     serverInfo: { name: SERVER_NAME, version: SERVER_VERSION },
   };
 }
 
+/**
+ * textDocument/codeAction: a quick fix for each agentic-security diagnostic in range that a language fixer can repair.
+ * The edit is a PREVIEW the editor applies; nothing is written here. A finding with no safe fix gets a disabled
+ * action that says why, never a silent omission.
+ */
+async function codeActionsFor(params) {
+  const uri = params && params.textDocument && params.textDocument.uri;
+  const diags = ((params && params.context && params.context.diagnostics) || []).filter((d) => d && d.source === 'agentic-security' && d.data && d.data.id);
+  const stored = (uri && _diagnosticsByUri.get(uri)) || [];
+  if (!diags.length || !stored.length) return [];
+  let files = null;
+  const actions = [];
+  for (const d of diags) {
+    const f = stored.find((x) => x && x.id === d.data.id);
+    if (!f || !languageOfFinding(f)) continue;
+    if (!files) files = loadLanguageProject(_rootDir).files;
+    let prev;
+    try { prev = await languageFixPreview(f, files); } catch (e) { prev = { ok: false, reason: String((e && e.message) || e) }; }
+    if (prev && prev.ok && prev.file) {
+      const target = pathToUri(path.join(_rootDir, prev.file));
+      actions.push({
+        title: `Fix${prev.label ? ` (${prev.label})` : ''}: ${f.vuln || f.rule || 'finding'}`,
+        kind: 'quickfix', diagnostics: [d], isPreferred: false,
+        edit: { changes: { [target]: [minimalEdit(prev.before, prev.after)] } },
+        data: { stableId: f.stableId || null, verified: { syntax: true, rescan: true } },
+      });
+    } else {
+      actions.push({ title: `No automatic fix: ${f.vuln || f.rule || 'finding'}`, kind: 'quickfix', diagnostics: [d], disabled: { reason: (prev && (prev.reason || prev.status)) || 'no deterministic fix exists for this finding' } });
+    }
+  }
+  return actions;
+}
+
 async function handleMessage(msg) {
+  if (msg.method === 'textDocument/codeAction') {
+    return { id: msg.id, result: await codeActionsFor(msg.params || {}) };
+  }
   if (msg.method === 'initialize') {
     return { id: msg.id, result: handleInitialize(msg.params || {}) };
   }
@@ -254,7 +314,7 @@ async function handleMessage(msg) {
       const savedPath = uriToPath(uri);
       if (savedPath && _depCache.rootDir === _rootDir) {
         const base = path.basename(savedPath);
-        if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base)) {
+        if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base) || _isLanguageDep(base)) {
           try {
             const rel = path.relative(_rootDir, savedPath);
             const st = fs.statSync(savedPath);

package/src/mcp/CLAUDE.md

@@ -65,3 +65,10 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 - **Lifecycle.** `_codeFingerprint()` reads source files at module-load time. New files added to the MCP source set won't be in the fingerprint until they're added to the `files = […]` array in `server.js`.
 - **Audit log.** The chain hashes plain JSON lines; a full-file rewrite is not detectable without a remote sink. Acknowledged limitation.
 - **Concurrency.** `stdio.js`'s `'data'` handler is async; concurrent `apply_fix` calls can race on `fix-history/`. Today benign because fixed-fix-history is idempotent on retry, but a future stateful tool needs serialization.
+
+## Haskell and Nix context
+
+`scan_diff`, `verify_fix` and `synthesize_fix` add the import closure of a Haskell or Nix file and the manifests as context
+(`language/context.js` `withLanguageContext`, bounded in files and bytes, read-only) and still report only the files asked
+about. The tool that previews a fix for these files uses the language fixers; `apply_fix` is unchanged (its generic confined-write
+path), and the language-aware apply with backup and `undo` is the CLI's `fix --apply`.

package/src/mcp/tools.js

@@ -371,6 +371,10 @@ export const scan_diff = {
     const abs = files.map(f => _confine(sessionRoot, f, 'files[]'));
 
     const fileContents = {};
+    // `_confine` returns real paths; the session root may itself be a symlink (macOS /tmp, /var), so keys are made
+    // relative to the REAL root. A key built from the unresolved root climbs out of the tree and no finding ever
+    // matches the file it was asked about.
+    const rootReal = fs.realpathSync(path.resolve(sessionRoot));
     let totalBytes = 0;
     for (const a of abs) {
       let stat;
@@ -383,7 +387,7 @@ export const scan_diff = {
       }
       let content;
       try { content = fs.readFileSync(a, 'utf8'); } catch { continue; }
-      const rel = path.relative(sessionRoot, a).replace(/\\/g, '/');
+      const rel = path.relative(rootReal, a).replace(/\\/g, '/');
       fileContents[rel] = content;
     }
 
@@ -403,9 +407,13 @@ export const scan_diff = {
     // user's real project on every pre-write self-correction scan. Confirmed
     // by direct execution before this fix (11 state artifacts written by a
     // single scan_diff-shaped call).
-    const result = await withStateWritesDisabled(() =>
-      runScan(sessionRoot, { network: false, fileContents, deep: true, deepInCi: true }));
+    // Haskell and Nix results depend on imported modules and manifests, so the files asked about are scanned together
+    // with their import closure (read from disk, bounded). Findings are still reported only for the requested files.
     const wantSet = new Set(Object.keys(fileContents));
+    const { withLanguageContext } = await import('../language/context.js');
+    const lc = withLanguageContext(sessionRoot, fileContents, {});
+    const result = await withStateWritesDisabled(() =>
+      runScan(sessionRoot, { network: false, fileContents: lc.fileContents, depFileContents: lc.depFileContents, deep: true, deepInCi: true }));
     const sevRank = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
     const min = sevRank[severity] ?? 0;
     // Stage 6 correctness audit (historical): this used to only read
@@ -1055,12 +1063,26 @@ export const synthesize_fix = {
     // even a mis-attributed swap can't land a bad edit. No stored replacement,
     // no per-finding bloat in last-scan.json.
     let autofix = null;
+    let languageFix = null;
     if (!hasReplacement) {
       try {
         const abs = _confine(ctx.sessionRoot, f.file, 'finding.file');
         const det = synthesizeDeterministicPatch(f, fs.readFileSync(abs, 'utf8'));
         if (det) autofix = { deterministic: true, ruleId: det.ruleId, patch: det.patch };
       } catch { /* best-effort — no file / no rule → no autofix */ }
+      // Haskell and Nix: a read-only preview from the language fixer, with the verification gates' verdict and the
+      // FULL / MITIGATION / WORKAROUND tier. It writes nothing; apply_fix re-verifies before anything lands.
+      if (!autofix) {
+        try {
+          const lc = await import('../language/context.js');
+          if (lc.languageOfFinding(f)) {
+            const proj = lc.loadLanguageProject(ctx.sessionRoot);
+            const prev = await lc.languageFixPreview(f, proj.files);
+            languageFix = { status: prev.status, ok: prev.ok, label: prev.label || null, tier: prev.tier || null, reason: prev.reason || null, diff: prev.diff || null, explanation: prev.explanation || null, consequences: prev.consequences || [] };
+            if (prev.ok) autofix = { deterministic: true, ruleId: f.rule || f.family || null, patch: prev.after, file: prev.file, label: prev.label || null, verified: true };
+          }
+        } catch { /* best-effort: the preview is advisory */ }
+      }
     }
     // Premortem #2: `replacement` is a *patch* (the code we'll write to disk),
     // not a finding excerpt. Running it through redactString silently corrupts
@@ -1079,6 +1101,7 @@ export const synthesize_fix = {
       replacement: hasReplacement ? fix.replacement : null,
       template: fix.code || null,
       autofix,
+      languageFix,
       // #15 — the regression test the scan annotator already generated for this
       // finding (present when a PoC was built). Surfaced here so the fix flow
       // writes the test alongside the patch; fix-verify-loop then runs it, so an

package/src/pipeline/scan-health.js

@@ -42,7 +42,7 @@ export const SCAN_HEALTH_SCHEMA_VERSION = 1;
  *   never a fabricated all-zero summary.
  * @returns {object} scanHealth per PRD §10.3, additive fields only.
  */
-export function computeScanHealth({ scanMeta = null, annotatorErrors = [], engineErrors = null, deepStatus = null, analyzerCoverage = null, lineageStatus = null } = {}) {
+export function computeScanHealth({ scanMeta = null, annotatorErrors = [], engineErrors = null, deepStatus = null, analyzerCoverage = null, lineageStatus = null, languageCoverage = null, supplyChain = null } = {}) {
   const conditions = [];
   const safeAnnotatorErrors = Array.isArray(annotatorErrors) ? annotatorErrors : [];
   const filesTimedOut = Number(scanMeta?.filesTimedOut) || 0;
@@ -84,11 +84,29 @@ export function computeScanHealth({ scanMeta = null, annotatorErrors = [], engin
     conditions.push(`${analyzerCoverage.failed} analyzer(s) threw on at least one file`);
   }
 
+  // CORE-003: Haskell/Nix coverage outcomes (missing grammar, adapter
+  // exception, timeout, unresolved branch) from language/contracts.js.
+  // Additive: absent input leaves the output shape and conditions untouched.
+  if (languageCoverage && Array.isArray(languageCoverage.conditions)) {
+    conditions.push(...languageCoverage.conditions);
+  }
+
+  // NIX-005: build-trust findings ride in the ordinary supplyChain bucket. A finding that
+  // rests on an unresolved branch or a partial module graph is an analysis gap, so it is
+  // surfaced here rather than counted as a settled result.
+  const trustFindings = Array.isArray(supplyChain) ? supplyChain.filter((f) => f && f.type === 'nix_build_trust') : [];
+  const trustUncertain = trustFindings.filter((f) => Array.isArray(f.uncertainty) && f.uncertainty.length > 0).length;
+  if (trustUncertain > 0) {
+    conditions.push(`${trustUncertain} Nix build-trust finding(s) rest on an unresolved branch or partial module graph`);
+  }
+
   const status = conditions.length > 0 ? 'partial' : 'complete';
 
   return {
     schemaVersion: SCAN_HEALTH_SCHEMA_VERSION,
     status,
+    ...(trustFindings.length ? { buildTrust: { findings: trustFindings.length, uncertain: trustUncertain } } : {}),
+    ...(languageCoverage ? { languageCoverage: { totals: languageCoverage.totals ?? null, byKind: languageCoverage.byKind ?? null, ...(languageCoverage.limitations ? { limitations: languageCoverage.limitations } : {}), ...(languageCoverage.capabilities ? { capabilities: languageCoverage.capabilities } : {}), ...(languageCoverage.optionalModes ? { optionalModes: languageCoverage.optionalModes } : {}) } } : {}),
     files: {
       expected: scanMeta?.checkpoint?.total ?? null,
       scanned: scanMeta?.filesScanned ?? null,