@clear-capabilities/agentic-security-scanner 0.153.1 → 0.154.0

package/src/posture/sbom-diff.js

@@ -21,7 +21,7 @@
 // module produces the diff on the next scan.
 
 import * as fs from 'node:fs';
-import { statePath, stateWritesEnabled } from './state-dir.js';
+import { statePath, stateWritesEnabled, safeWriteState } from './state-dir.js';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { execFileSync } from 'node:child_process';
@@ -52,6 +52,9 @@ function _gitHead(scanRoot) {
 }
 
 function _snapshotKey(component) {
+  // Language components carry an identity that survives a version change but keeps two resolved builds apart
+  // (a flag variant, a second store hash); everything else keeps the ecosystem:name key it always had.
+  if (component.identityKey) return component.identityKey;
   return `${component.ecosystem || 'unknown'}:${component.name || ''}`;
 }
 
@@ -65,7 +68,6 @@ export function persistSbom(scanRoot, components) {
   // empty `sbom-history/` in the scanned tree — invisible to `git status`,
   // because git does not track empty directories, and therefore exactly the
   // kind of mutation that passes a clean-status check while still being one.
-  if (stateWritesEnabled()) { try { fs.mkdirSync(dir, { recursive: true }); } catch {} }
   const sha = _gitHead(scanRoot) || crypto.createHash('sha256').update(JSON.stringify(components)).digest('hex').slice(0, 12);
   const snap = {
     sha, ts: new Date().toISOString(),
@@ -73,14 +75,13 @@ export function persistSbom(scanRoot, components) {
     components: components.map(c => ({
       ecosystem: c.ecosystem, name: c.name, version: c.version,
       purl: c.purl, scope: c.scope, isUnpinned: !!c.isUnpinned,
-      sha256: c.sha256 || c.integrity || null,
+      ...(c.identityKey ? { identityKey: c.identityKey, bomRef: c.bomRef || null } : {}),
+      sha256: c.sha256 || c.integrity || ((c.hashes || []).find((h) => h.alg === 'SHA-256') || {}).content || null,
     })),
   };
   // NON_MUTATING_SCAN_PRD S1 — history is a feature, but not at the cost of
   // mutating a tree the caller only asked us to read.
-  if (stateWritesEnabled()) {
-    try { fs.writeFileSync(path.join(dir, `${sha}.json`), JSON.stringify(snap, null, 2)); } catch {}
-  }
+  if (stateWritesEnabled()) safeWriteState(path.join(dir, `${sha}.json`), JSON.stringify(snap, null, 2));   // refuses a symlinked state directory or file
   return snap;
 }
 

package/src/posture/sbom.js

@@ -60,27 +60,49 @@ function _documentUuid(seed) {
   return isDeterministic() ? _stableUuidFrom(seed) : crypto.randomUUID();
 }
 
+// The bom-ref a vulnerability points at: the component's own ref when it has one (language components do), else the
+// derived one. A different resolved build of the same package is a different component and keeps its own ref.
+function _vulnTargetRef(components, s) {
+  const hit = components.find(c => c.bomRef && c.name === s.name && c.version === s.version && (c.ecosystem || '') === (s.ecosystem || ''));
+  return hit ? hit.bomRef : _bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version });
+}
+
 export function toCycloneDX(scan, meta = {}) {
-  const components = scan.components || [];
+  const components = [...(scan.components || []), ...((scan.languageBom && scan.languageBom.components) || [])];
+  scan = scan.languageBom ? { ...scan, bomRoot: scan.languageBom.root || scan.bomRoot, bomDependencies: scan.languageBom.dependencies, bomCompositions: scan.languageBom.compositions, bomProperties: scan.languageBom.properties } : scan;
   const supplyChain = (scan.supplyChain || []).filter(s => s.type === 'vulnerable_dep');
   const serialNumber = `urn:uuid:${_documentUuid(JSON.stringify(components.map(_bomRef)))}`;
 
+  // Language components (Hackage, Nix) carry their own identity, scope, hashes and build provenance; every other
+  // component keeps exactly the shape it always had. A version is written only when one is known (a null or empty
+  // version is not a valid CycloneDX string), and nothing here invents a license.
+  const refOf = (c) => c.bomRef || _bomRef(c);
   const cdxComponents = components.map(c => ({
-    type: 'library',
-    'bom-ref': _bomRef(c),
+    type: c.cdxType || 'library',
+    'bom-ref': refOf(c),
     name: c.name,
-    version: c.version,
-    purl: _purl(c),
+    ...(c.version ? { version: c.version } : (c.bomRef ? {} : { version: c.version })),
+    ...(c.purl || !c.bomRef ? { purl: _purl(c) } : {}),
     ...(c.license ? { licenses: [{ license: { id: c.license } }] } : {}),
-    ...(c.scope ? { scope: c.scope === 'dev' ? 'optional' : 'required' } : {}),
+    ...(c.cdxScope ? { scope: c.cdxScope } : (c.scope ? { scope: c.scope === 'dev' ? 'optional' : 'required' } : {})),
+    ...(Array.isArray(c.hashes) && c.hashes.length ? { hashes: c.hashes } : {}),
+    ...(Array.isArray(c.externalReferences) && c.externalReferences.length ? { externalReferences: c.externalReferences } : {}),
+    ...(Array.isArray(c.properties) && c.properties.length ? { properties: c.properties } : {}),
   }));
+  const knownRefs = new Set([...cdxComponents.map(x => x['bom-ref']), ...(scan.bomRoot ? [scan.bomRoot['bom-ref']] : [])]);
+  const cdxDependencies = (scan.bomDependencies || [])
+    .filter(d => knownRefs.has(d.ref))
+    .map(d => ({ ref: d.ref, dependsOn: (d.dependsOn || []).filter(r => knownRefs.has(r)) }));
+  const cdxCompositions = (scan.bomCompositions || [])
+    .map(c => ({ aggregate: c.aggregate, dependencies: (c.dependencies || []).filter(r => knownRefs.has(r)) }))
+    .filter(c => c.dependencies.length);
 
   const vulnerabilities = supplyChain.map((s, i) => ({
     // The last-resort id was crypto.randomUUID(), which reintroduced
     // per-run drift for any advisory carrying neither an osvId nor an
     // advisory string. Index within the (already deterministically sorted)
     // supplyChain array identifies it just as well and is reproducible.
-    'bom-ref': `${_bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version })}#${s.osvId || s.advisory || `unidentified-${i}`}`,
+    'bom-ref': `${_vulnTargetRef(components, s)}#${s.osvId || s.advisory || `unidentified-${i}`}`,
     id: s.osvId || (s.cveAliases || [])[0] || s.advisory,
     source: { name: 'OSV.dev', url: `https://osv.dev/vulnerability/${s.osvId || ''}` },
     references: (s.cveAliases || []).map(cve => ({ id: cve, source: { name: 'NVD' } })),
@@ -89,7 +111,7 @@ export function toCycloneDX(scan, meta = {}) {
       ...(s.cvssVector ? [{ vector: s.cvssVector, method: 'CVSSv3' }] : []),
     ],
     description: s.description || s.advisory || '',
-    affects: [{ ref: _bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version }) }],
+    affects: [{ ref: _vulnTargetRef(components, s) }],
     properties: [
       ...(s.epssScore != null ? [{ name: 'epss:score', value: String(s.epssScore) }] : []),
       ...(s.epssPercentile != null ? [{ name: 'epss:percentile', value: String(s.epssPercentile) }] : []),
@@ -105,34 +127,53 @@ export function toCycloneDX(scan, meta = {}) {
     metadata: {
       timestamp: meta.startedAt || new Date().toISOString(),
       tools: [{ vendor: 'Clear Capabilities', name: 'agentic-security', version: meta.engineVersion || 'dev' }],
-      component: { type: 'application', name: 'scan-target', version: '1.0.0' },
+      component: scan.bomRoot ? { ...scan.bomRoot } : { type: 'application', name: 'scan-target', version: '1.0.0' },
+      ...(Array.isArray(scan.bomProperties) && scan.bomProperties.length ? { properties: scan.bomProperties } : {}),
     },
     components: cdxComponents,
+    ...(cdxDependencies.length ? { dependencies: cdxDependencies } : {}),
+    ...(cdxCompositions.length ? { compositions: cdxCompositions } : {}),
     ...(vulnerabilities.length ? { vulnerabilities } : {}),
   };
 }
 
 export function toSPDX(scan, meta = {}) {
-  const components = scan.components || [];
+  const components = [...(scan.components || []), ...((scan.languageBom && scan.languageBom.components) || [])];
+  scan = scan.languageBom ? { ...scan, bomRoot: scan.languageBom.root || scan.bomRoot, bomDependencies: scan.languageBom.dependencies } : scan;
   const supplyChain = (scan.supplyChain || []).filter(s => s.type === 'vulnerable_dep');
   const docNamespace = `https://agentic-security.local/spdx/${_documentUuid(JSON.stringify(components.map(_bomRef)))}`;
-  const ts = meta.startedAt || new Date().toISOString();
+  // SPDX 2.3 `created` is YYYY-MM-DDThh:mm:ssZ: fractional seconds are not part of the format.
+  const ts = (meta.startedAt || new Date().toISOString()).replace(/\.\d+(Z|[+-]\d{2}:\d{2})$/, (_m, z) => (z === 'Z' ? 'Z' : z));
 
-  const packages = components.map((c, i) => ({
-    SPDXID: `SPDXRef-Package-${i}`,
-    name: c.name,
-    versionInfo: c.version,
-    downloadLocation: 'NOASSERTION',
-    filesAnalyzed: false,
-    licenseConcluded: c.license || 'NOASSERTION',
-    licenseDeclared: c.license || 'NOASSERTION',
-    copyrightText: 'NOASSERTION',
-    externalRefs: [{
-      referenceCategory: 'PACKAGE-MANAGER',
-      referenceType: 'purl',
-      referenceLocator: _purl(c),
-    }],
-  }));
+  const spdxIdOfRef = new Map();
+  // The described application itself is a package, so dependency edges that start at it have an element to attach to.
+  const rootPackage = scan.bomRoot && scan.bomRoot['bom-ref'] ? [{
+    SPDXID: 'SPDXRef-Package-root', name: scan.bomRoot.name, ...(scan.bomRoot.version ? { versionInfo: scan.bomRoot.version } : {}),
+    downloadLocation: 'NOASSERTION', filesAnalyzed: false, licenseConcluded: 'NOASSERTION', licenseDeclared: 'NOASSERTION', copyrightText: 'NOASSERTION',
+    primaryPackagePurpose: 'APPLICATION', externalRefs: [],
+  }] : [];
+  if (rootPackage.length) spdxIdOfRef.set(scan.bomRoot['bom-ref'], 'SPDXRef-Package-root');
+  const packages = components.map((c, i) => {
+    const id = `SPDXRef-Package-${i}`;
+    if (c.bomRef) spdxIdOfRef.set(c.bomRef, id);
+    return {
+      SPDXID: id,
+      name: c.name,
+      ...((c.version || !c.bomRef) ? { versionInfo: c.version } : {}),
+      downloadLocation: 'NOASSERTION',
+      filesAnalyzed: false,
+      ...(Array.isArray(c.hashes) && c.hashes.length ? { checksums: c.hashes.map(h => ({ algorithm: String(h.alg).replace('-', ''), checksumValue: h.content })) } : {}),
+      licenseConcluded: c.license || 'NOASSERTION',
+      licenseDeclared: c.license || 'NOASSERTION',
+      copyrightText: 'NOASSERTION',
+      ...(c.bomRef ? { primaryPackagePurpose: 'LIBRARY' } : {}),
+      externalRefs: [...((c.purl || !c.bomRef) ? [{
+        referenceCategory: 'PACKAGE-MANAGER',
+        referenceType: 'purl',
+        referenceLocator: _purl(c),
+      }] : [])],
+    };
+  });
 
   // SPDX expresses CVEs as external refs on the package, not separate elements
   const cveByName = {};
@@ -162,11 +203,23 @@ export function toSPDX(scan, meta = {}) {
       created: ts,
       creators: [`Tool: agentic-security-${meta.engineVersion || 'dev'}`],
     },
-    packages,
-    relationships: packages.map(p => ({
-      spdxElementId: 'SPDXRef-DOCUMENT',
-      relatedSpdxElement: p.SPDXID,
-      relationshipType: 'DESCRIBES',
-    })),
+    packages: [...rootPackage, ...packages],
+    relationships: [
+      ...[...rootPackage, ...packages].map(p => ({
+        spdxElementId: 'SPDXRef-DOCUMENT',
+        relatedSpdxElement: p.SPDXID,
+        relationshipType: 'DESCRIBES',
+      })),
+      // Dependency edges between language components. Runtime edges are DEPENDS_ON; a build- or test-only target is
+      // expressed with the SPDX 2.3 *_DEPENDENCY_OF relationship so the scope survives the conversion.
+      ...(scan.bomDependencies || []).flatMap(d => (d.dependsOn || []).map(to => {
+        const a = spdxIdOfRef.get(d.ref); const b = spdxIdOfRef.get(to);
+        if (!a || !b) return null;
+        const kind = (d.kinds || {})[to] || 'runtime';
+        if (kind === 'test') return { spdxElementId: b, relatedSpdxElement: a, relationshipType: 'TEST_DEPENDENCY_OF' };
+        if (kind === 'build') return { spdxElementId: b, relatedSpdxElement: a, relationshipType: 'BUILD_DEPENDENCY_OF' };
+        return { spdxElementId: a, relatedSpdxElement: b, relationshipType: 'DEPENDS_ON' };
+      })).filter(Boolean),
+    ],
   };
 }

package/src/posture/sca-policy.js

@@ -41,6 +41,7 @@ import * as path from 'node:path';
 import * as yaml from '../util/yaml.js';
 
 import { safeWriteState, stateDir, statePath } from './state-dir.js';
+import { BUILD_TRUST_TYPE } from '../language/contracts.js';
 const DEFAULT_POLICY = {
   acceptRisk: [],
   sla: {},
@@ -75,6 +76,7 @@ function _normalizeAccept(entry) {
   return {
     cve: entry.cve ? String(entry.cve).toUpperCase() : null,
     package: entry.package ? String(entry.package).toLowerCase() : null,
+    rule: entry.rule ? String(entry.rule) : null,
     version: entry.version ? String(entry.version) : null,
     ecosystem: entry.ecosystem ? String(entry.ecosystem).toLowerCase() : null,
     reason: entry.reason || '',
@@ -125,6 +127,13 @@ export function matchAcceptRisk(finding, policy, today = new Date()) {
   const pkgName = String(finding.name || '').toLowerCase();
   for (const entry of policy.acceptRisk) {
     if (!_accepted(entry, today)) continue;
+    // A `rule:` entry targets a build-trust policy finding (no CVE, no version) by its rule id.
+    if (entry.rule) {
+      if (finding.type === BUILD_TRUST_TYPE && finding.rule === entry.rule
+          && (!entry.package || pkgName === entry.package)
+          && (!entry.ecosystem || entry.ecosystem === finding.ecosystem)) return entry;
+      continue;
+    }
     if (entry.cve && cves.includes(entry.cve)) return entry;
     if (entry.package && pkgName === entry.package) {
       if (entry.version && finding.version && entry.version !== finding.version) continue;
@@ -144,7 +153,7 @@ export function applyScaPolicy(findings, policy, scanTime = new Date()) {
   const stats = { suppressed: 0, slaTagged: 0, frozen: 0 };
   if (!policy || !Array.isArray(findings)) return stats;
   for (const f of findings) {
-    if (!f || f.type !== 'vulnerable_dep') continue;
+    if (!f || (f.type !== 'vulnerable_dep' && f.type !== BUILD_TRUST_TYPE)) continue;
     // Accept-risk suppression
     const acceptance = matchAcceptRisk(f, policy, scanTime);
     if (acceptance) {

package/src/posture/sca-verdict.js

@@ -13,6 +13,8 @@
 // Verdict enum (must match the agent + downstream /fix --sca):
 //   AUTO_MERGE_PATCH · WAIT_FOR_PATCH · MANUAL_REVIEW · ACCEPT_RISK · WONT_FIX
 
+import { BUILD_TRUST_TYPE } from '../language/contracts.js';
+
 export const SCA_VERDICTS = ['AUTO_MERGE_PATCH', 'WAIT_FOR_PATCH', 'MANUAL_REVIEW', 'ACCEPT_RISK', 'WONT_FIX'];
 
 const REACHABLE_TIERS = new Set(['route-reachable-via-function', 'function-reachable', 'import-reachable']);
@@ -64,6 +66,11 @@ export function computeScaVerdict(sc, opts = {}) {
   if (sc.suppressed || sc.suppressionReason) {
     return { verdict: 'ACCEPT_RISK', reason: sc.suppressionReason || 'matched existing accept-risk in sca-policy.yml' };
   }
+  // 1b. Nix build-trust policy findings have no advisory, fixed version or upgrade
+  // path: the remedy is a configuration or pin change, which is always a human call.
+  if (sc.type === BUILD_TRUST_TYPE) {
+    return { verdict: 'MANUAL_REVIEW', reason: `${sc.rule}: ${sc.remediation || 'review the Nix build-trust setting'}` };
+  }
   // 2. No fixed version exists → nothing to upgrade yet.
   if (!fixed.length) {
     return { verdict: 'WAIT_FOR_PATCH', reason: `no fixed version published${sc.osvId ? ` for ${sc.osvId}` : ''}` };
@@ -116,7 +123,7 @@ export function annotateScaVerdicts(supplyChain, opts = {}) {
   if (!Array.isArray(supplyChain)) return supplyChain;
   const counts = { AUTO_MERGE_PATCH: 0, WAIT_FOR_PATCH: 0, MANUAL_REVIEW: 0, ACCEPT_RISK: 0, WONT_FIX: 0 };
   for (const sc of supplyChain) {
-    if (!sc || sc.type !== 'vulnerable_dep') continue;
+    if (!sc || (sc.type !== 'vulnerable_dep' && sc.type !== BUILD_TRUST_TYPE)) continue;
     const { verdict, reason, expiryDays } = computeScaVerdict(sc, opts);
     sc.scaVerdict = verdict;
     sc.scaVerdictReason = reason;

package/src/posture/secret-history.js

@@ -13,6 +13,7 @@
 
 import { execFileSync } from 'node:child_process';
 import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
+import { providerInfo, scanLanguageSecretConcat, scanDependencyUrlCredentials } from '../language/secrets.js';
 
 // Pull the post-image (added) lines out of a unified diff: lines starting with
 // a single '+' (not the '+++' file header). Returns reconstructed text.
@@ -24,25 +25,42 @@ export function extractAddedLines(diffText) {
   return out.join('\n');
 }
 
+// Split a unified diff into per-file sections with the POST-IMAGE line number of every added line, so a
+// finding can name the file and line it was committed at (the combined text alone loses both).
+export function splitDiffByFile(diffText) {
+  const files = [];
+  let cur = null; let next = 0;
+  for (const line of String(diffText || '').split('\n')) {
+    const h = /^diff --git a\/(.+?) b\/(.+)$/.exec(line);
+    if (h) { cur = { path: h[2], added: [] }; files.push(cur); next = 0; continue; }
+    if (!cur) continue;
+    const hh = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hh) { next = parseInt(hh[1], 10); continue; }
+    if (line.startsWith('+++') || line.startsWith('---')) continue;
+    if (line.startsWith('+')) { cur.added.push({ text: line.slice(1), line: next }); next++; }
+    else if (!line.startsWith('-') && !line.startsWith('\\')) next++;
+  }
+  return files;
+}
+
 // Pure: run the injected credential detector over a commit's added lines.
-// detectFn has the scanCredentials(fp, raw) shape and returns Finding[].
-export function scanHistoryDiff(diffText, commit, detectFn) {
+// detectFn has the scanCredentials(fp, raw) shape and returns Finding[]. `extra` are additional detectors
+// ((path, text) => Finding[]) run against each file's added lines WITH the real path, so extension-gated
+// detectors (Haskell/Nix split-secret) apply to history too.
+export function scanHistoryDiff(diffText, commit, detectFn, extra = []) {
   if (typeof detectFn !== 'function') return [];
-  const added = extractAddedLines(diffText);
-  if (!added.trim()) return [];
-  let findings = [];
-  try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
-  return findings.map((f) => {
-    const remediation = 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.';
-    return {
-      ...f,
+  const sections = splitDiffByFile(diffText);
+  const remediation = 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.';
+  const wrap = (f, sec, addedLines) => {
+    const hit = Number.isInteger(f.line) && f.line >= 1 ? addedLines[f.line - 1] : null;
+    const prov = f.rotation ? {} : providerInfo(f._rawProviderValue || '');
+    const out = {
+      ...f, ...prov,
       id: `secret-history:${commit}:${f.id || f.vuln || 'secret'}`,
-      file: `git-history@${commit}`,
-      line: 0,
-      commit,
-      _historical: true,
+      file: `git-history@${commit}`, line: 0, commit, _historical: true,
+      ...(sec ? { sourceFile: sec.path, sourceLine: hit ? hit.line : null } : {}),
       vuln: `${f.vuln || 'Hardcoded Secret'} (in git history)`,
-      description: `${f.description || 'A credential was committed.'} Found in commit ${commit}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
+      description: `${f.description || 'A credential was committed.'} Found in commit ${commit}${sec ? ` (${sec.path}${hit ? `:${hit.line}` : ''})` : ''}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
       remediation,
       // report/index.js's _remediationOf checks `.fix` before `.remediation`
       // — the underlying detector already set `.fix` to a generic "remove
@@ -51,15 +69,41 @@ export function scanHistoryDiff(diffText, commit, detectFn) {
       // insufficient") in every report format.
       fix: remediation,
     };
-  });
+    delete out._rawProviderValue;
+    return out;
+  };
+  const results = [];
+  if (!sections.length) {
+    const added = extractAddedLines(diffText);
+    if (!added.trim()) return [];
+    let findings = [];
+    try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
+    return findings.map((f) => wrap(f, null, []));
+  }
+  for (const sec of sections) {
+    if (!sec.added.length) continue;
+    const text = sec.added.map((a) => a.text).join('\n');
+    if (!text.trim()) continue;
+    let findings = [];
+    try { findings = detectFn(`git-history@${commit}`, text) || []; } catch { findings = []; }
+    for (const f of findings) results.push(wrap(f, sec, sec.added));
+    for (const ex of extra || []) {
+      let more = [];
+      try { more = ex(sec.path, text) || []; } catch { more = []; }
+      for (const f of more) results.push(wrap(f, sec, sec.added));
+    }
+  }
+  return results;
 }
 
+const defaultExtra = [scanLanguageSecretConcat, scanDependencyUrlCredentials];
+
 /**
  * Sweep up to `maxCommits` of recent history for secrets. Best-effort: returns
  * [] when `scanRoot` is not a git repo or git is unavailable. Dedups a secret
  * that recurs across commits to its earliest sighting.
  */
-export function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000 } = {}) {
+export function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000, extraDetectors = null } = {}) {
   if (!scanRoot || typeof detectFn !== 'function') return [];
   let out;
   try {
@@ -78,7 +122,7 @@ export function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs
   const seen = new Set();
   for (let i = 1; i < parts.length; i += 2) {
     const sha = (parts[i] || '').slice(0, 12);
-    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn)) {
+    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn, extraDetectors || defaultExtra)) {
       const key = `${f.vuln}:${(f.snippet || f.match || '').slice(0, 40)}`;
       if (seen.has(key)) continue;
       seen.add(key);

package/src/posture/stable-id.js

@@ -10,6 +10,7 @@
 // that need stability use `stableId`.
 
 import * as crypto from 'node:crypto';
+import { haskellComments, nixComments } from '../language/pragma.js';
 
 function normalizeSnippet(s) {
   if (!s || typeof s !== 'string') return '';
@@ -53,12 +54,30 @@ function ruleId(f) {
   return `vuln:${(f.vuln || '').slice(0, 40)}`;
 }
 
+// Haskell and Nix findings are identified by their code, not by how it is laid out: comments, blank lines,
+// indentation and spacing between tokens never rotate an id. (The generic normaliser keeps spacing next to
+// punctuation, so `f (x)` and `f ( x )` would differ.) Only whitespace and comments are removed; every token stays.
+function normalizeLanguageSnippet(file, s) {
+  if (!s || typeof s !== 'string') return '';
+  const isNix = /\.nix$/i.test(String(file || ''));
+  const spans = isNix ? nixComments(s) : haskellComments(s);
+  let out = ''; let at = 0;
+  for (const c of spans) { out += s.slice(at, c.start); at = c.end; }
+  out += s.slice(at);
+  return out.toLowerCase().replace(/"(?:[^"\\]|\\.)*"/g, '"_S_"').replace(/\s+/g, '');
+}
+
 export function computeStableId(f) {
   const rid = ruleId(f);
-  const sink = normalizeSnippet(f.sink?.snippet || f.snippet || '').slice(0, 200);
+  const isLang = /\.(?:l?hs|hs-boot|hsc|nix)$/i.test(String(f.file || f.sink?.file || ''));
+  const sink = isLang
+    ? normalizeLanguageSnippet(f.file || f.sink?.file, f.sink?.snippet || f.snippet || '').slice(0, 200)
+    : normalizeSnippet(f.sink?.snippet || f.snippet || '').slice(0, 200);
   const shape = pathShape(f);
   const fileHint = basenameLike(f.file || f.sink?.file);
-  const material = `${rid}|${sink}|${shape}|${fileHint}`;
+  // Haskell taint findings carry a site key (a fingerprint of the sink argument), so two sinks of one rule
+  // on one line keep distinct ids. Absent for every other finding, so their ids are unchanged.
+  const material = f.siteKey ? `${rid}|${sink}|${shape}|${fileHint}|${f.siteKey}` : `${rid}|${sink}|${shape}|${fileHint}`;
   return crypto.createHash('sha256').update(material).digest('hex').slice(0, 16);
 }
 

package/src/posture/state-dir.js

@@ -33,8 +33,11 @@ const PROJECT_MARKERS = [
   'build.gradle',
   'composer.json',
   'Gemfile',
+  // Haskell and Nix projects: without these a Cabal, Stack or flake project never got a state directory at all.
+  'cabal.project', 'stack.yaml', 'package.yaml', 'flake.nix', 'configuration.nix', 'default.nix', 'shell.nix',
   '.agentic-security',
 ];
+const PROJECT_MARKER_SUFFIX = /\.cabal$/;
 
 function _findProjectRoot(startDir) {
   let dir = path.resolve(startDir);
@@ -81,8 +84,23 @@ export function statePath(scanRoot, ...parts) {
 // Safety check: refuse to create .agentic-security/ unless the parent
 // directory has at least one project marker. Prevents littering when
 // resolution falls through to a non-project directory.
+// A state directory that is a SYMLINK is never safe: a hostile repository could point `.agentic-security` at a directory elsewhere
+// and have every evidence file written (or overwritten) through it. The state root, and any state directory below it, must be a real
+// directory (or not exist yet); a symlinked file inside it is refused by safeWriteState below.
+function _viaSymlink(dir) {
+  const segments = path.resolve(dir).split(path.sep);
+  const idx = segments.lastIndexOf(STATE_DIR_NAME);
+  if (idx < 0) return false;
+  for (let i = idx; i < segments.length; i++) {
+    const prefix = segments.slice(0, i + 1).join(path.sep) || path.sep;
+    try { if (fs.lstatSync(prefix).isSymbolicLink()) return true; } catch { return false; /* does not exist yet: nothing to follow */ }
+  }
+  return false;
+}
+
 export function isSafeStateDir(dir) {
   if (!dir) return false;
+  if (_viaSymlink(dir)) return false;
   const parent = path.dirname(dir);
   for (const m of PROJECT_MARKERS) {
     if (m === '.agentic-security') continue; // would be circular
@@ -90,6 +108,7 @@ export function isSafeStateDir(dir) {
       if (fs.existsSync(path.join(parent, m))) return true;
     } catch { /* ignore */ }
   }
+  try { if (fs.readdirSync(parent).some((n) => PROJECT_MARKER_SUFFIX.test(n))) return true; } catch { /* ignore */ }
   // A directory NESTED inside an already-valid state root is safe too.
   //
   // Without this the check only ever accepted `<project>/.agentic-security`
@@ -234,6 +253,8 @@ export function safeWriteState(filePath, content, { category } = {}) {
   }
   try {
     fs.mkdirSync(dir, { recursive: true });
+    // never write THROUGH a symlink: an attacker-placed link at the file's own path would redirect the write elsewhere
+    try { if (fs.lstatSync(filePath).isSymbolicLink()) return false; } catch { /* not there yet */ }
     fs.writeFileSync(filePath, content);
     return true;
   } catch {

package/src/posture/threat-model-auto.js

@@ -23,7 +23,7 @@
 // .agentic-security/threat-model.md (human-readable).
 
 import * as fs from 'node:fs';
-import { stateDir, stateWritesEnabled } from './state-dir.js';
+import { stateDir, stateWritesEnabled, safeWriteState } from './state-dir.js';
 import * as path from 'node:path';
 
 // STRIDE category descriptors
@@ -215,9 +215,9 @@ export function persistThreatModel(scanRoot, model) {
   // NON_MUTATING_SCAN_PRD S1 — a scan must not modify the tree it scans.
   if (!stateWritesEnabled()) return;
   const dir = stateDir(scanRoot);
-  try { fs.mkdirSync(dir, { recursive: true }); } catch {}
-  try { fs.writeFileSync(path.join(dir, 'threat-model.json'), JSON.stringify(model, null, 2)); } catch {}
-  try { fs.writeFileSync(path.join(dir, 'threat-model.md'), renderMarkdown(model)); } catch {}
+  // through the state seam: a symlinked state directory or file is refused, never written through
+  safeWriteState(path.join(dir, 'threat-model.json'), JSON.stringify(model, null, 2));
+  safeWriteState(path.join(dir, 'threat-model.md'), renderMarkdown(model));
 }
 
 function renderMarkdown(model) {

package/src/posture/triage.js

@@ -29,13 +29,24 @@ function _save(scanRoot, data) {
 
 // Sync the triage store with the latest scan: new findings become 'open',
 // findings no longer surfaced become 'fixed' (with a transition entry).
-export function syncWithScan(scanRoot, findings) {
+export function syncWithScan(scanRoot, findings, opts = {}) {
   const data = loadTriage(scanRoot);
   const now = new Date().toISOString();
   const seen = new Set();
+  // A finding that is no longer reported is only "fixed" when the scan that stopped reporting it was COMPLETE for the
+  // code it lives in. If its analysis was partial (a parser failed, a required analyzer was off), its absence is
+  // unverified, so it stays open and is marked `unverified` rather than silently closed.
+  const health = opts && opts.scanHealth;
+  const incomplete = !!(health && health.status && health.status !== 'complete');
   for (const f of findings) {
     const id = f.id || `${f.file}:${f.line}:${f.vuln}`;
     seen.add(id);
+    const existing = data.findings[id];
+    // A finding that was closed and is reported again is a regression: reopen it, never leave it 'fixed'.
+    if (existing && existing.state === 'fixed') {
+      existing.state = 'open'; existing.reopened_at = now; delete existing.fixed_at; delete existing.unverified;
+      data.transitions.push({ id, from: 'fixed', to: 'open', at: now, automatic: true, reason: 'reported again by a later scan' });
+    } else if (existing && existing.unverified) { delete existing.unverified; }
     if (!data.findings[id]) {
       data.findings[id] = {
         id,
@@ -56,6 +67,8 @@ export function syncWithScan(scanRoot, findings) {
         ecosystem: f.ecosystem || null,
         osvId: f.osvId || null,
         cveAliases: Array.isArray(f.cveAliases) ? f.cveAliases : [],
+        language: f.language || null,
+        rule: f.rule || null,
       };
       data.transitions.push({ id, from: null, to: 'open', at: now });
     }
@@ -65,6 +78,10 @@ export function syncWithScan(scanRoot, findings) {
     const cur = data.findings[id];
     if (seen.has(id)) continue;
     if (cur.state === 'fixed' || cur.state === 'wont-fix' || cur.state === 'false-positive') continue;
+    if (incomplete) {
+      if (!cur.unverified) { cur.unverified = { since: now, reason: 'not reported, but the scan was not complete' }; data.transitions.push({ id, from: cur.state, to: cur.state, at: now, automatic: true, unverified: true, reason: 'not reported by an incomplete scan' }); }
+      continue;
+    }
     cur.state = 'fixed';
     cur.fixed_at = now;
     data.transitions.push({ id, from: 'open', to: 'fixed', at: now, automatic: true });

package/src/posture/watch-mode.js

@@ -24,6 +24,7 @@ import * as fsSync from 'node:fs';
 import * as path from 'node:path';
 
 import { stateDir, statePath, stateWritesEnabled } from './state-dir.js';
+import { isLanguageSource, isLanguageManifest, isLanguageExcludedPath, isExplicitExport, impactedFiles } from '../language/discovery.js';
 const STATUS_MD   = 'watch-status.md';
 const STATUS_JSON = 'watch-status.json';
 const DEBOUNCE_MS = 350;
@@ -33,10 +34,35 @@ const SCAN_EXT_RE = /\.(?:[jt]sx?|mjs|cjs|py|java|kt|go|rb|php|cs|c|cc|cpp|h|hpp
 const IGNORE_DIR_RE = /(?:^|\/)(?:\.git|node_modules|\.bench-cache|dist|build|\.next|coverage|\.agentic-security)(?:$|\/)/;
 
 function _isScanable(rel) {
-  if (!rel || IGNORE_DIR_RE.test(rel)) return false;
+  if (!rel) return false;
+  // An explicit export is evidence even though it lives in a build directory.
+  if (isExplicitExport(rel)) return true;
+  if (IGNORE_DIR_RE.test(rel)) return false;
+  if (isLanguageSource(rel) || isLanguageManifest(rel)) return !isLanguageExcludedPath(rel);
   return SCAN_EXT_RE.test(rel);
 }
 
+/**
+ * Widen a batch of changed absolute paths to every file whose results the
+ * change can stale: dependents through imports, and all Haskell/Nix sources for
+ * a manifest, lockfile or export change. Batches with no Haskell/Nix path are
+ * returned untouched, so other languages never pay for a tree read.
+ */
+async function expandChangedBatch(scanRoot, batch) {
+  const rels = batch.map((p) => path.relative(scanRoot, p).split(path.sep).join('/'));
+  if (!rels.some((r) => isLanguageSource(r) || isLanguageManifest(r) || isExplicitExport(r))) return batch;
+  try {
+    const { readTree } = await import('../runScan.js');
+    const { fileContents, depFileContents } = await readTree(scanRoot);
+    const hit = impactedFiles(fileContents, depFileContents, rels);
+    const out = new Set(batch);
+    for (const r of hit) out.add(path.join(scanRoot, r));
+    return [...out];
+  } catch {
+    return batch;
+  }
+}
+
 function _readJsonSafe(fp) {
   try { return JSON.parse(fsSync.readFileSync(fp, 'utf8')); } catch { return null; }
 }
@@ -144,7 +170,12 @@ export async function watchProject(scanRoot, onChange, opts = {}) {
     if (pending.size > MAX_BURST) { pending.clear(); return; }
     const batch = Array.from(pending);
     pending.clear();
-    try { onChange(batch); } catch {}
+    const needsExpansion = batch.some((p) => {
+      const r = path.relative(scanRoot, p).split(path.sep).join('/');
+      return isLanguageSource(r) || isLanguageManifest(r) || isExplicitExport(r);
+    });
+    if (!needsExpansion) { try { onChange(batch); } catch {} return; }
+    expandChangedBatch(scanRoot, batch).then((b) => { try { onChange(b); } catch {} });
   };
   let stopped = false;
   (async () => {
@@ -169,4 +200,4 @@ export async function watchProject(scanRoot, onChange, opts = {}) {
   };
 }
 
-export const _internals = { _isScanable, SCAN_EXT_RE, IGNORE_DIR_RE };
+export const _internals = { _isScanable, expandChangedBatch, SCAN_EXT_RE, IGNORE_DIR_RE };