@clear-capabilities/agentic-security-scanner 0.153.2 → 0.154.0

package/src/language/secrets.js

@@ -0,0 +1,323 @@
+// Secrets parity for Haskell and Nix syntax (X-001).
+//
+// What the generic secret scanners already do for these files (known provider tokens, entropy next to a
+// credential word) is kept as is. This module adds what is language-specific and was missing:
+//
+//   * comment/string-aware lexing: Haskell nested `{- {- -} -}` and `--` (an operator run such as `-->` is not a
+//     comment), quasi-quotes, Nix `#`, `/* */`, `"..."` and indented `''...''` strings with their escapes. A
+//     lexer, not a regex, decides what is a comment, so a nested comment cannot swallow or expose live code.
+//   * split secrets: `"AKIA" ++ "..."` and `"ghp_" <> "..."` (Haskell), `"a" + "b"` (Nix)
+//   * dependency-URL credentials in Cabal/Stack manifests, flake.lock and Nix `url`/`fetch*` attributes
+//   * the provider and rotation guidance a response needs, derived from the secret's SHAPE only
+//
+// Nothing here verifies a credential, contacts a provider, or revokes anything: rotation guidance is text.
+// Every finding carries a masked value only, never the secret.
+
+const SECRET_PREFIX = /(?:sk_|sk-|AKIA|ASIA|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|xox[abprs]-|AIza|ya29\.|eyJ[A-Za-z0-9_-]{8,}|-----BEGIN|glpat-|shpat_|shpss_|npm_|dop_v1_|SG\.[A-Za-z0-9_-]{10,})/;
+const SECRET_NAME = /(?:api[_-]?key|secret|token|passwd|password|pwd|credential|private[_-]?key|access[_-]?key|client[_-]?secret|auth[_-]?token|psk)/i;
+const PLACEHOLDER = /(?:placeholder|example|xxx+|your[_-]|changeme|<[A-Za-z_ -]+>|^MY_|INSERT_|REPLACE_|TODO|test_key|fake_|sample_|dummy_)/i;
+
+// ── lexers ───────────────────────────────────────────────────────────────────
+const HS_SYMBOL = /[!#$%&*+./<=>?@\\^|~:-]/;
+
+/**
+ * Replace comment characters with spaces, keeping every newline and every other offset. Strings and
+ * quasi-quotes are skipped, never blanked.
+ */
+export function blankHaskell(src) {
+  const n = src.length; const out = src.split('');
+  const blank = (a, b) => { for (let i = a; i < b; i++) if (out[i] !== '\n' && out[i] !== '\r') out[i] = ' '; };
+  let i = 0;
+  while (i < n) {
+    const c = src[i]; const d = src[i + 1];
+    if (c === '{' && d === '-') {                     // nested block comment (also {-# pragmas #-})
+      let depth = 1; let j = i + 2;
+      while (j < n && depth > 0) { if (src[j] === '{' && src[j + 1] === '-') { depth++; j += 2; } else if (src[j] === '-' && src[j + 1] === '}') { depth--; j += 2; } else j++; }
+      blank(i, j); i = j; continue;
+    }
+    if (c === '-' && d === '-') {                     // a run of >=2 dashes not part of a longer operator
+      let j = i; while (src[j] === '-') j++;
+      const prev = src[i - 1];
+      if (!(prev && HS_SYMBOL.test(prev)) && !(src[j] && HS_SYMBOL.test(src[j]))) { let e = src.indexOf('\n', j); if (e < 0) e = n; blank(i, e); i = e; continue; }
+      i = j; continue;
+    }
+    if (c === '"') { let j = i + 1; while (j < n) { if (src[j] === '\\') { j += 2; continue; } if (src[j] === '"' || src[j] === '\n') break; j++; } i = Math.min(j + 1, n); continue; }
+    if (c === "'") {                                  // a char literal, never a prime after an identifier character
+      const prev = src[i - 1];
+      if (prev && /[A-Za-z0-9_']/.test(prev)) { i++; continue; }
+      const m = /^'(?:[^'\\\n]|\\[^\n]{1,8}?)'/.exec(src.slice(i, i + 12));
+      if (m) { i += m[0].length; continue; }
+      i++; continue;
+    }
+    if (c === '[' && /[A-Za-z_][\w']*\|/.test(src.slice(i + 1, i + 40)) && /^\[[A-Za-z_][\w'.]*\|/.test(src.slice(i, i + 40))) {   // [quote| ... |]
+      const e = src.indexOf('|]', i + 2); i = e < 0 ? n : e + 2; continue;
+    }
+    i++;
+  }
+  return out.join('');
+}
+
+export function blankNix(src) {
+  const n = src.length; const out = src.split('');
+  const blank = (a, b) => { for (let i = a; i < b; i++) if (out[i] !== '\n' && out[i] !== '\r') out[i] = ' '; };
+  // The string states nest through ${ ... }, so scan with an explicit stack.
+  const stack = []; // 'q' (double-quoted), 'i' (indented), '{' (interpolation / attrset brace)
+  let i = 0;
+  while (i < n) {
+    const top = stack[stack.length - 1];
+    const c = src[i]; const d = src[i + 1];
+    if (top === 'q') {
+      if (c === '\\') { i += 2; continue; }
+      if (c === '"') { stack.pop(); i++; continue; }
+      if (c === '$' && d === '{') { stack.push('{'); i += 2; continue; }
+      i++; continue;
+    }
+    if (top === 'i') {
+      if (c === "'" && d === "'") { if (src[i + 2] === "'" || src[i + 2] === '$' || src[i + 2] === '\\') { i += src[i + 2] === '\\' ? 4 : 3; continue; } stack.pop(); i += 2; continue; }
+      if (c === '$' && d === '{') { stack.push('{'); i += 2; continue; }
+      i++; continue;
+    }
+    // code context (top level or inside an interpolation)
+    if (c === '#') { let e = src.indexOf('\n', i); if (e < 0) e = n; blank(i, e); i = e; continue; }
+    if (c === '/' && d === '*') { let e = src.indexOf('*/', i + 2); e = e < 0 ? n : e + 2; blank(i, e); i = e; continue; }
+    if (c === '"') { stack.push('q'); i++; continue; }
+    if (c === "'" && d === "'") { stack.push('i'); i += 2; continue; }
+    if (c === '{') { stack.push('{'); i++; continue; }
+    if (c === '}') { if (stack.length) stack.pop(); i++; continue; }
+    i++;
+  }
+  return out.join('');
+}
+
+export const blankFor = (fp) => (/\.l?hs(?:c|ig)?$|\.hs-boot$/i.test(fp) ? blankHaskell : /\.nix$/i.test(fp) ? blankNix : null);
+
+// ── tokenizers (comments skipped, strings kept whole) ───────────────────────
+/**
+ * Ordered tokens {k:'s'|'i'|'o'|'x', v, start, end, interp?}. `s` is a string literal (its raw body in `v`),
+ * `i` an identifier, `o` a run of operator characters, `x` anything else. Comments never become tokens.
+ */
+export function tokenizeHaskell(src) {
+  const n = src.length; const toks = []; let i = 0;
+  while (i < n) {
+    const c = src[i]; const d = src[i + 1];
+    if (/\s/.test(c)) { i++; continue; }
+    if (c === '{' && d === '-') { let depth = 1; let j = i + 2; while (j < n && depth > 0) { if (src[j] === '{' && src[j + 1] === '-') { depth++; j += 2; } else if (src[j] === '-' && src[j + 1] === '}') { depth--; j += 2; } else j++; } i = j; continue; }
+    if (c === '-' && d === '-') { let j = i; while (src[j] === '-') j++; const prev = src[i - 1]; if (!(prev && HS_SYMBOL.test(prev)) && !(src[j] && HS_SYMBOL.test(src[j]))) { const e = src.indexOf('\n', j); i = e < 0 ? n : e; continue; } }
+    if (c === '"') { let j = i + 1; while (j < n && src[j] !== '"' && src[j] !== '\n') { if (src[j] === '\\') j++; j++; } toks.push({ k: 's', v: src.slice(i + 1, j), start: i, end: j + 1 }); i = j + 1; continue; }
+    if (/[A-Za-z_]/.test(c)) { let j = i + 1; while (j < n && /[\w']/.test(src[j])) j++; toks.push({ k: 'i', v: src.slice(i, j), start: i, end: j }); i = j; continue; }
+    if (c === "'") { const m = /^'(?:[^'\\\n]|\\[^\n]{1,8}?)'/.exec(src.slice(i, i + 12)); if (m) { toks.push({ k: 'x', v: m[0], start: i, end: i + m[0].length }); i += m[0].length; continue; } }
+    if (HS_SYMBOL.test(c)) { let j = i + 1; while (j < n && HS_SYMBOL.test(src[j])) j++; toks.push({ k: 'o', v: src.slice(i, j), start: i, end: j }); i = j; continue; }
+    toks.push({ k: 'x', v: c, start: i, end: i + 1 }); i++;
+  }
+  return toks;
+}
+
+export function tokenizeNix(src) {
+  const n = src.length; const toks = []; let i = 0;
+  // read one string starting at i (either " or ''), returning {end, v, interp}
+  const readString = (start) => {
+    const indented = src[start] === "'";
+    let j = start + (indented ? 2 : 1); let interp = false; const stack = [];
+    for (; j < n; j++) {
+      const c = src[j]; const d = src[j + 1];
+      if (stack.length) { if (c === '{') stack.push('{'); else if (c === '}') stack.pop(); else if (c === '"') { j = readString(j).end - 1; } continue; }
+      if (indented) {
+        if (c === "'" && d === "'") { const e = src[j + 2]; if (e === "'" || e === '$') { j += 2; continue; } if (e === '\\') { j += 3; continue; } return { end: j + 2, v: src.slice(start + 2, j), interp }; }
+      } else {
+        if (c === '\\') { j++; continue; }
+        if (c === '"') return { end: j + 1, v: src.slice(start + 1, j), interp };
+      }
+      if (c === '$' && d === '{') { interp = true; stack.push('{'); j++; }
+    }
+    return { end: n, v: src.slice(start + (indented ? 2 : 1)), interp };
+  };
+  while (i < n) {
+    const c = src[i]; const d = src[i + 1];
+    if (/\s/.test(c)) { i++; continue; }
+    if (c === '#') { const e = src.indexOf('\n', i); i = e < 0 ? n : e; continue; }
+    if (c === '/' && d === '*') { const e = src.indexOf('*/', i + 2); i = e < 0 ? n : e + 2; continue; }
+    if (c === '"' || (c === "'" && d === "'")) { const r = readString(i); toks.push({ k: 's', v: r.v, start: i, end: r.end, interp: r.interp }); i = r.end; continue; }
+    if (/[A-Za-z_]/.test(c)) { let j = i + 1; while (j < n && /[\w'-]/.test(src[j])) j++; toks.push({ k: 'i', v: src.slice(i, j), start: i, end: j }); i = j; continue; }
+    if (/[+=<>!&|-]/.test(c)) { let j = i + 1; while (j < n && /[+=<>!&|-]/.test(src[j])) j++; toks.push({ k: 'o', v: src.slice(i, j), start: i, end: j }); i = j; continue; }
+    toks.push({ k: 'x', v: c, start: i, end: i + 1 }); i++;
+  }
+  return toks;
+}
+
+// ── split secrets ────────────────────────────────────────────────────────────
+const HS_CONCAT_OPS = new Set(['++', '<>']);
+const NIX_CONCAT_OPS = new Set(['+']);
+const lineOf = (text, idx) => { let l = 1; for (let i = 0; i < idx; i++) if (text.charCodeAt(i) === 10) l++; return l; };
+const mask = (v) => (v.length > 8 ? `${v.slice(0, 4)}…${v.slice(-4)}` : '••••');
+
+export function scanLanguageSecretConcat(fp, raw) {
+  const isNix = /\.nix$/i.test(fp); const isHs = /\.l?hs(?:c|ig)?$|\.hs-boot$/i.test(fp);
+  if (!(isNix || isHs) || !raw || raw.length > 500_000) return [];
+  const toks = isNix ? tokenizeNix(raw) : tokenizeHaskell(raw);
+  const ops = isNix ? NIX_CONCAT_OPS : HS_CONCAT_OPS;
+  const lines = raw.split('\n');
+  const out = []; const seen = new Set();
+  for (let i = 0; i < toks.length; i++) {
+    const t = toks[i];
+    if (t.k !== 's' || t.interp || !(toks[i + 1] && toks[i + 1].k === 'o' && ops.has(toks[i + 1].v) && toks[i + 2] && toks[i + 2].k === 's')) continue;
+    if (i > 0 && toks[i - 1].k === 'o' && ops.has(toks[i - 1].v)) continue;                    // not the start of the chain
+    const parts = [t]; let j = i;
+    while (toks[j + 1] && toks[j + 1].k === 'o' && ops.has(toks[j + 1].v) && toks[j + 2] && toks[j + 2].k === 's' && !toks[j + 2].interp) { parts.push(toks[j + 2]); j += 2; }
+    if (parts.length < 2) { i = j; continue; }
+    const ident = toks[i - 1] && toks[i - 1].k === 'o' && /^(?:=|<-|:=)$/.test(toks[i - 1].v) && toks[i - 2] && toks[i - 2].k === 'i' ? toks[i - 2].v : '';
+    const value = parts.map((p) => p.v).join('');
+    i = j;
+    if (PLACEHOLDER.test(value)) continue;
+    const byPrefix = SECRET_PREFIX.test(value);
+    const byName = SECRET_NAME.test(ident) && value.length >= 24 && /[A-Za-z]/.test(value) && /\d/.test(value);
+    if (!byPrefix && !byName) continue;
+    const line = lineOf(raw, parts[0].start);
+    const id = `secret-concat:${fp}:${line}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    const m8 = mask(value);
+    let snippet = (lines[line - 1] || '').trim().slice(0, 200);
+    for (const p of parts) if (p.v) snippet = snippet.split(p.v).join(m8);
+    out.push({
+      id, file: fp, line, language: isNix ? 'nix' : 'haskell',
+      vuln: 'Hardcoded credential — secret split across concatenated literals to evade detection',
+      severity: 'high', cwe: 'CWE-798', family: 'hardcoded-secret', parser: 'SECRET-CONCAT', confidence: 0.78,
+      snippet, masked: m8, ...providerInfo(value),
+      remediation: 'Load the secret from a runtime file or a secrets manager. Splitting the literal across a concatenation does not protect it: rotate the exposed credential.',
+    });
+  }
+  return out;
+}
+
+// ── dependency-URL credentials ───────────────────────────────────────────────
+const URL_CRED = /\b((?:https?|git\+https?|git|ssh|ftp|svn\+https?|hg\+https?):\/\/)([^\s/@:"']{1,100})(?::([^\s/@"']{1,200}))?@([A-Za-z0-9.-]+(?::\d+)?[^\s"']*)/g;
+const BENIGN_USER = /^(?:git|hg|svn|anonymous|ftp|guest)$/i;
+const BENIGN_HOST = /(?:^|\.)(?:localhost|example\.(?:com|org|net))(?::|$|\/)|^127\.|^0\.0\.0\.0|^::1/i;
+
+const MANIFEST_RE = /(?:^|\/)(?:[^/]+\.cabal|cabal\.project(?:\.[a-z]+)?|stack\.yaml(?:\.lock)?|package\.yaml|flake\.(?:nix|lock)|[^/]+\.nix)$/i;
+export const isSecretManifest = (p) => MANIFEST_RE.test(p);
+
+/** Credentials embedded in a dependency or source URL. The value is never kept, only its mask. */
+export function scanDependencyUrlCredentials(fp, raw) {
+  if (!isSecretManifest(fp) || !raw || raw.length > 2_000_000) return [];
+  const code = raw;   // a credential in a comment is still in the repository: comments are NOT blanked here
+  const out = []; const seen = new Set(); const lines = raw.split('\n');
+  const re = new RegExp(URL_CRED.source, 'g'); let m;
+  while ((m = re.exec(code))) {
+    const user = m[2]; const pass = m[3]; const host = m[4];
+    const secretish = pass !== undefined ? pass : user;
+    if (BENIGN_HOST.test(host) || (pass === undefined && BENIGN_USER.test(user)) || PLACEHOLDER.test(secretish) || /^\$\{|^%\w+%$|^\$\w+$/.test(secretish)) continue;
+    if (pass === undefined && !(/^[A-Za-z0-9_-]{20,}$/.test(user) || SECRET_PREFIX.test(user))) continue;   // a bare user name is not a secret
+    const line = lineOf(code, m.index);
+    const id = `dep-url-credential:${fp}:${line}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    const m8 = mask(secretish);
+    const snippet = (lines[line - 1] || '').trim().slice(0, 200).split(secretish).join(m8);
+    const hostOnly = host.replace(/[/?#].*$/, '');
+    out.push({
+      id, file: fp, line, language: /\.nix$|flake\./i.test(fp) ? 'nix' : 'haskell',
+      vuln: 'Credential embedded in a dependency or source URL', severity: 'high', cwe: 'CWE-798', family: 'dependency-url-credential', parser: 'SECRET-DEPURL', confidence: 0.85,
+      snippet, masked: m8, host: hostOnly, scheme: m[1].replace('://', ''),
+      ...providerInfo(secretish, hostOnly),
+      remediation: 'Remove the credential from the URL. Use a credential helper, netrc/ssh-agent or a CI secret that is not written into a manifest, then rotate the exposed token: it is in every clone and every lock.',
+    });
+  }
+  return out;
+}
+
+// ── provider and rotation guidance (shape only; nothing is verified or called) ──
+const PROVIDERS = [
+  [/^AKIA[0-9A-Z]{16}$|^ASIA[0-9A-Z]{16}$/, 'AWS', 'https://console.aws.amazon.com/iam/home#/security_credentials', ['Deactivate the access key in IAM, then delete it.', 'Check CloudTrail for use of the key between its exposure and now.', 'Issue a replacement and update the consumers.']],
+  [/^(?:ghp|gho|ghu|ghs|ghr)_|^github_pat_/, 'GitHub', 'https://github.com/settings/tokens', ['Revoke the token under Settings > Developer settings.', 'Review the audit log for use of the token.', 'Create a fine-scoped replacement.']],
+  [/^glpat-/, 'GitLab', 'https://gitlab.com/-/user_settings/personal_access_tokens', ['Revoke the personal access token.', 'Review the audit events.']],
+  [/^xox[abprs]-/, 'Slack', 'https://api.slack.com/apps', ['Revoke or rotate the token in the Slack app settings.']],
+  [/^sk-ant-/, 'Anthropic', 'https://console.anthropic.com/settings/keys', ['Delete the API key in the console and create a new one.', 'Review usage for the exposure window.']],
+  [/^sk-(?:proj-|live-)?[A-Za-z0-9_-]{16,}/, 'OpenAI', 'https://platform.openai.com/api-keys', ['Revoke the key and create a new one.', 'Check usage for the exposure window.']],
+  [/^sk_live_|^rk_live_|^sk_test_/, 'Stripe', 'https://dashboard.stripe.com/apikeys', ['Roll the key in the Stripe dashboard.']],
+  [/^AIza[0-9A-Za-z_-]{35}$/, 'Google', 'https://console.cloud.google.com/apis/credentials', ['Delete or regenerate the API key and restrict it.']],
+  [/^SG\./, 'SendGrid', 'https://app.sendgrid.com/settings/api_keys', ['Delete the API key and create a new one.']],
+  [/^npm_/, 'npm', 'https://www.npmjs.com/settings/~/tokens', ['Revoke the token.']],
+  [/^dop_v1_/, 'DigitalOcean', 'https://cloud.digitalocean.com/account/api/tokens', ['Revoke the token.']],
+  [/^-----BEGIN/, 'private-key', null, ['Treat the key as compromised: generate a new key pair, replace the public key everywhere it is trusted, and revoke the old one.']],
+];
+const HOST_PROVIDERS = [[/(^|\.)github\.com$/i, 'GitHub'], [/(^|\.)gitlab\.com$/i, 'GitLab'], [/(^|\.)bitbucket\.org$/i, 'Bitbucket'], [/(^|\.)hackage\.haskell\.org$/i, 'Hackage'], [/(^|\.)cachix\.org$/i, 'Cachix']];
+
+/** Provider by SHAPE, plus rotation text. `host` names the provider only when the value's shape does not. */
+export function providerInfo(value, host = null) {
+  const v = String(value || '');
+  for (const [re, provider, url, steps] of PROVIDERS) if (re.test(v)) return { provider, rotation: { provider, revokeUrl: url, steps, automatic: false, liveCheck: 'not performed' } };
+  if (host) for (const [re, provider] of HOST_PROVIDERS) if (re.test(host)) return { provider, rotation: { provider, revokeUrl: null, steps: ['Revoke the token or password for this account at the provider, then update the consumers.'], automatic: false, liveCheck: 'not performed' } };
+  return {};
+}
+
+/** Value-free description of where a secret is, for responders. */
+export function redactSecret(v) { return mask(String(v || '')); }
+
+export const SECRETS_LANGUAGE_VERSION = 'language-secrets/1';
+
+// ── URL credential redaction for inventories and findings ────────────────────
+const URL_USERINFO = /((?:https?|git\+https?|git|ssh|ftp|svn\+https?|hg\+https?):\/\/)[^\s/@"'`]*:[^\s/@"'`]+@/gi;
+const URL_TOKEN_USER = /((?:https?|git\+https?):\/\/)(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}@/gi;
+/** `scheme://user:password@host` -> `scheme://***@host`; any string, never throws. */
+export function stripUrlCredentials(str) {
+  if (typeof str !== 'string' || str.indexOf('@') < 0) return str;
+  return str.replace(URL_USERINFO, '$1***@').replace(URL_TOKEN_USER, '$1***@');
+}
+/** In-place deep redaction of URL credentials in every string of a plain object graph (cycle safe). */
+export function redactUrlsDeep(value, seen = new WeakSet()) {
+  if (typeof value === 'string') return stripUrlCredentials(value);
+  if (!value || typeof value !== 'object' || seen.has(value)) return value;
+  seen.add(value);
+  // Only a CHANGED string is written back, and a frozen container is never assigned to: shared constants (rule tables)
+  // are frozen and contain no credential, so they are left exactly as they are.
+  const frozen = Object.isFrozen(value);
+  if (Array.isArray(value)) { for (let i = 0; i < value.length; i++) { const r = redactUrlsDeep(value[i], seen); if (r !== value[i] && !frozen) value[i] = r; } return value; }
+  for (const k of Object.keys(value)) { const r = redactUrlsDeep(value[k], seen); if (r !== value[k] && !frozen) value[k] = r; }
+  return value;
+}
+
+// ── redaction for text that leaves the machine (model prompts, exports) ─────────
+const SECRET_BINDING = /^(?:[A-Za-z0-9_]*(?:password|passwd|pwd|secret|token|api_?key|apikey|auth|credential|private_?key|passphrase|signing_?key)[A-Za-z0-9_]*)$/i;
+// camelCase and snake_case spellings of a key: stripeKey, signing_key, apiKey; `monkey` and `keyboard` are not
+const isSecretBindingName = (n) => SECRET_BINDING.test(n) || /[a-z0-9]Key$|_key$|^key$|^[A-Z0-9_]*_KEY$/.test(n);
+const CONCAT_OPS_HS = new Set(['++', '<>']);
+const CONCAT_OPS_NIX = new Set(['+']);
+const PLACEHOLDER_TEXT = '[REDACTED-SECRET]';
+
+/**
+ * Replaces the VALUE of a credential-named Haskell/Nix binding with a placeholder, including a value split across
+ * several string literals joined by `++`, `<>` (Haskell) or `+` (Nix), which a single-literal pattern cannot see.
+ * Token based: comments and the text of other strings are never touched. Returns {text, redactions}.
+ */
+export function redactLanguageSecrets(filePath, text) {
+  if (typeof text !== 'string' || !text) return { text: typeof text === 'string' ? text : '', redactions: 0 };
+  const isHs = /\.l?hs$|\.hs-boot$|\.hsc$/i.test(filePath || '');
+  const isNix = /\.nix$/i.test(filePath || '');
+  if (!isHs && !isNix) return { text, redactions: 0 };
+  let toks;
+  try { toks = isHs ? tokenizeHaskell(text) : tokenizeNix(text); } catch { return { text, redactions: 0 }; }
+  const ops = isHs ? CONCAT_OPS_HS : CONCAT_OPS_NIX;
+  const edits = [];
+  for (let i = 0; i < toks.length - 2; i++) {
+    const t = toks[i];
+    if (t.k !== 'i' || !isSecretBindingName(t.v.replace(/^.*\./, ''))) continue;
+    const eq = toks[i + 1];
+    if (!(eq.k === 'o' && eq.v === '=')) continue;
+    let j = i + 2; let total = 0; const pieces = [];
+    while (j < toks.length && toks[j].k === 's') {
+      pieces.push(toks[j]); total += toks[j].v.length;
+      const next = toks[j + 1];
+      if (next && next.k === 'o' && ops.has(next.v) && toks[j + 2] && toks[j + 2].k === 's') j += 2; else { j += 1; break; }
+    }
+    if (!pieces.length || total < 6) continue;
+    for (const p of pieces) if (p.v !== PLACEHOLDER_TEXT && !p.interp) edits.push(p);
+  }
+  if (!edits.length) return { text, redactions: 0 };
+  let out = text; let n = 0;
+  for (const p of edits.sort((a, b) => b.start - a.start)) {
+    const q = out[p.start] === "'" ? "''" : '"';
+    out = out.slice(0, p.start) + q + PLACEHOLDER_TEXT + q + out.slice(p.end); n++;
+  }
+  return { text: out, redactions: n };
+}

package/src/language/state-artifacts.js

@@ -0,0 +1,78 @@
+// Haskell and Nix analysis metadata as registered state artifacts (X-016).
+//
+// An ordinary scan already leaves last-scan.json. Two things a reviewer, auditor or retention policy needs about the
+// Haskell/Nix side were not artifacts of their own: WHAT analysed the sources (parser/resolver outcomes, capability
+// status, limitations, optional modes) and WHICH components the language BOM recorded. They are written beside
+// last-scan.json as `language-analysis.json` and `language-bom.json`, each with a detached signature, registered in
+// posture/artifact-registry.js (so export, retention, legal hold and `reset` all see them), and described by a record
+// that carries sha256 digests of every input and of the artifact bodies. No source text is ever written: paths and
+// digests only, so the file is metadata, not a copy of customer code.
+
+import crypto from 'node:crypto';
+import { statePath, safeWriteState } from '../posture/state-dir.js';
+import { signLastScan } from '../posture/integrity.js';
+import { loadLanguageProject } from './context.js';
+
+export const LANGUAGE_ANALYSIS_FILE = 'language-analysis.json';
+export const LANGUAGE_BOM_FILE = 'language-bom.json';
+export const LANGUAGE_ARTIFACT_SCHEMA = 'agentic-security/language-analysis@1';
+
+const sha256 = (s) => crypto.createHash('sha256').update(s).digest('hex');
+function canonical(v) {
+  if (Array.isArray(v)) return `[${v.map(canonical).join(',')}]`;
+  if (v && typeof v === 'object') return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}`;
+  return JSON.stringify(v === undefined ? null : v);
+}
+
+/** True when the scan has anything Haskell/Nix to record. */
+export function hasLanguageContent(scan) {
+  const lc = scan && scan.scanHealth && scan.scanHealth.languageCoverage;
+  const files = lc && lc.totals && Number(lc.totals.files || lc.totals.analyzed || 0);
+  return !!((lc && (files > 0 || (lc.capabilities && Object.keys(lc.capabilities).length))) || (scan && scan.languageBom && (scan.languageBom.components || []).length));
+}
+
+/**
+ * The analysis record for `scan`, plus the BOM body. `inputs` is [{path, sha256}] over the Haskell/Nix sources and
+ * manifests (digests only). Pure: no I/O.
+ */
+export function buildLanguageArtifacts(scan, inputs = []) {
+  const lc = (scan && scan.scanHealth && scan.scanHealth.languageCoverage) || null;
+  const bom = (scan && scan.languageBom) || null;
+  const bridges = (scan && scan.languageBridges) || null;
+  const bomBody = bom ? JSON.stringify(bom, null, 2) : null;
+  const record = {
+    schema: LANGUAGE_ARTIFACT_SCHEMA,
+    classification: { class: 'scan-metadata', containsSourceText: false, containsSecrets: false },
+    inputs: inputs.map((i) => ({ path: String(i.path), sha256: String(i.sha256) })).sort((a, b) => (a.path < b.path ? -1 : 1)),
+    analysis: lc ? { totals: lc.totals, byKind: lc.byKind, conditions: lc.conditions, limitations: lc.limitations, capabilities: lc.capabilities, optionalModes: lc.optionalModes } : null,
+    bom: bom ? { file: LANGUAGE_BOM_FILE, sha256: sha256(bomBody), components: (bom.components || []).length } : null,
+    bridges: bridges ? { sha256: sha256(canonical(bridges)) } : null,
+  };
+  return { record, bomBody };
+}
+
+/**
+ * Writes the artifacts under the project's state directory, each with a `.sig`. Returns {written:[{name, sha256}], skipped}.
+ * Never throws and never blocks a scan; a project that disallows state writes gets `skipped: 'state-writes-disabled'`.
+ */
+export function persistLanguageArtifacts(root, scan) {
+  if (!hasLanguageContent(scan)) return { written: [], skipped: 'no-language-content' };
+  let inputs = [];
+  try {
+    const proj = loadLanguageProject(root);
+    inputs = [...Object.entries(proj.files), ...Object.entries(proj.manifests)].map(([path, text]) => ({ path, sha256: sha256(text) }));
+  } catch { /* the record then says it has no input digests */ }
+  const { record, bomBody } = buildLanguageArtifacts(scan, inputs);
+  const out = [];
+  const put = (name, body) => {
+    const fp = statePath(root, name);
+    if (!safeWriteState(fp, body)) return false;
+    try { safeWriteState(`${fp}.sig`, signLastScan(body)); } catch { /* the signature is best effort, as for last-scan.json */ }
+    out.push({ name, sha256: sha256(body) });
+    return true;
+  };
+  const body = JSON.stringify(record, null, 2);
+  if (!put(LANGUAGE_ANALYSIS_FILE, body)) return { written: [], skipped: 'state-writes-disabled' };
+  if (bomBody) put(LANGUAGE_BOM_FILE, bomBody);
+  return { written: out, skipped: null };
+}

package/src/language/support-registry.js

@@ -0,0 +1,224 @@
+// Haskell and Nix support registry and promotion gate (HS-011, QA-002).
+//
+// A capability row says what is SUPPORTED, from MEASURED evidence only. The registry never grants support from an installed parser,
+// a structural-only detection, a metric of another kind, or labels that changed after the measurement. `evaluateSupport` is pure:
+// it takes a measurement (bench/language-support/measure.mjs output) plus the results of the named test suites and returns each
+// capability's status with the reasons it is or is not supported. Nothing here runs a scan or reads the corpus.
+//
+//   supported      every criterion for the row has passing evidence of the row's OWN metric kind, on the frozen corpus
+//   partial        measured, some criteria met and some not (the unmet ones are listed)
+//   failed         measured and below target
+//   not-measured   no evidence of the right kind (a zero or absent denominator is never 100%)
+//   blocked        a required tool or host is absent (a compiler, nix, a NixOS host): the criterion could not run, which is a
+//                  failed criterion for support, never a skip
+
+export const SUPPORT_REGISTRY_VERSION = 'language-support/1';
+
+/** The section 9.2 numerical gates. */
+export const TARGETS = Object.freeze({ precision: 0.9, recall: 0.85, f1: 0.8, perFamilyF1: 0.8, minHoldoutPerLabelPerFamily: 5, minPrivacyPositives: 100, minPrivacyNegatives: 100 });
+
+/** The pairs gate is this project's own (the PRD sets none): semantics-changing pairs must ALL flip; preserving pairs may not drift much. */
+export const PAIR_GATE = Object.freeze({ change: 1, preserve: 0.9 });
+
+/** Required capabilities per ecosystem, with the metric kind each one may be promoted from. */
+export const REQUIRED_CAPABILITIES = Object.freeze({
+  haskell: Object.freeze({
+    parser: 'parse-fixtures', sast: 'sast-holdout', taint: 'taint-holdout', 'privacy-lineage': 'privacy-holdout',
+    auth: 'test-suite', sca: 'sca-fixtures', bom: 'test-suite', fix: 'fix-fixtures', integration: 'test-suite',
+  }),
+  nix: Object.freeze({
+    parser: 'parse-fixtures', 'config-sast': 'sast-holdout', 'config-taint': 'taint-holdout', 'privacy-lineage': 'privacy-holdout',
+    sca: 'sca-fixtures', bom: 'test-suite', fix: 'fix-fixtures', integration: 'test-suite', 'nix-eval': 'test-suite', 'nixos-host': 'host-run',
+  }),
+});
+
+/** Capabilities that need an external tool or host to be exercised at all: absent, the row is BLOCKED whatever its tests say. */
+export const REQUIRES_TOOL = Object.freeze({
+  haskell: Object.freeze({ auth: Object.freeze({ tool: 'ghc', why: 'the route fixtures are compiled by GHC (HS-006.AC01)' }) }),
+  nix: Object.freeze({
+    'nix-eval': Object.freeze({ tool: 'nix', why: 'a successful controlled evaluation needs a real nix binary (NIX-011.AC04)' }),
+    'nixos-host': Object.freeze({ tool: 'nixos', why: 'the complete scanner must run on a NixOS host (NIX-012)' }),
+  }),
+});
+
+/** Metric kinds that can NEVER promote a row, whatever their value. */
+export const NON_PROMOTING_EVIDENCE = Object.freeze(['installation', 'grammar-present', 'structural-only', 'documentation', 'model-assertion', 'taint-as-privacy', 'unknown']);
+
+const ratio = (n, d) => (d > 0 ? n / d : null);
+const pct = (x) => (x == null ? 'not measured' : `${(x * 100).toFixed(1)}%`);
+
+function rate(layer) {
+  if (!layer || !layer.measured) return { precision: null, recall: null, f1: null };
+  return { precision: layer.precision, recall: layer.recall, f1: layer.f1 };
+}
+
+/** Section 9.2 gate for one scored layer. Returns {ok, reasons}. `perFamilyCases` supplies the holdout denominators per family. */
+export function gateLayer(layer, perFamilyCases, { kind }) {
+  const reasons = [];
+  if (!layer || !layer.measured) return { ok: false, reasons: [`${kind}: not measured (a zero or absent denominator is never 100%)`] };
+  const r = rate(layer);
+  if (!(r.precision >= TARGETS.precision)) reasons.push(`precision ${pct(r.precision)} < ${pct(TARGETS.precision)} (${layer.tp} TP, ${layer.fp} FP)`);
+  if (!(r.recall >= TARGETS.recall)) reasons.push(`recall ${pct(r.recall)} < ${pct(TARGETS.recall)} (${layer.tp} TP, ${layer.fn} FN)`);
+  if (!(r.f1 >= TARGETS.f1)) reasons.push(`F1 ${pct(r.f1)} < ${pct(TARGETS.f1)}`);
+  const fams = layer.families || {};
+  for (const [name, m] of Object.entries(fams)) {
+    // a family absent from the holdout cannot pass; a family with too few examples of either label cannot pass
+    const f1 = m.f1 == null ? null : m.f1;
+    if (!(f1 >= TARGETS.perFamilyF1)) reasons.push(`family ${name}: F1 ${pct(f1)} < ${pct(TARGETS.perFamilyF1)}`);
+  }
+  for (const [name, c] of Object.entries(perFamilyCases || {})) {
+    if (!(c.vulnerable >= TARGETS.minHoldoutPerLabelPerFamily && c.safe >= TARGETS.minHoldoutPerLabelPerFamily)) reasons.push(`family ${name}: holdout has ${c.vulnerable} vulnerable / ${c.safe} safe (< ${TARGETS.minHoldoutPerLabelPerFamily} each)`);
+  }
+  return { ok: reasons.length === 0, reasons };
+}
+
+function suiteStatus(results, names) {
+  // suites are keyed by file base name; a capability lists the files (paths) that back it
+  const rows = (names || []).map((n) => results && results[String(n).split('/').pop()]);
+  if (!(names || []).length || rows.some((r) => !r)) return { ok: false, status: 'not-measured', reasons: ['no test-suite evidence was recorded for this capability'] };
+  const reasons = [];
+  for (const r of rows) {
+    if (r.blocked) reasons.push(`${r.name}: blocked (${r.blocked})`);
+    else if (r.fail > 0) reasons.push(`${r.name}: ${r.fail} failing test(s)`);
+    if (r.skipped > 0) reasons.push(`${r.name}: ${r.skipped} skipped test(s) (a skip is not a pass)`);
+    if (!(r.tests > 0)) reasons.push(`${r.name}: no tests ran`);
+  }
+  if (reasons.some((x) => /blocked/.test(x))) return { ok: false, status: 'blocked', reasons };
+  return { ok: reasons.length === 0, status: reasons.length ? 'failed' : 'supported', reasons };
+}
+
+/**
+ * @param {string} language 'haskell' | 'nix'
+ * @param {{measurement: object, suites?: Record<string,object>, capabilitySuites?: Record<string,string[]>, frozen?: object}} input
+ *   measurement: the holdout measurement; suites: test-suite results by name; capabilitySuites: which suites back each capability;
+ *   frozen: {holdoutRollup, labelsSha256, privacyLabelsSha256} of the corpus AS IT IS NOW (a measurement on other data cannot promote).
+ */
+export function evaluateSupport(language, input) {
+  const required = REQUIRED_CAPABILITIES[language];
+  if (!required) throw new Error(`unknown language ${language}`);
+  const m = input.measurement || {};
+  const eco = (m.ecosystems && m.ecosystems[language]) || {};
+  const out = { language, version: SUPPORT_REGISTRY_VERSION, rows: {}, summary: {} };
+  const dataOk = (() => {
+    if (!input.frozen) return { ok: false, reasons: ['no frozen corpus hashes were supplied to check the measurement against'] };
+    const h = m.hashes || {};
+    const reasons = [];
+    if (m.split !== 'holdout') reasons.push(`the measurement is on the "${m.split}" split, not the frozen holdout`);
+    if (h.holdoutRollup !== input.frozen.holdoutRollup) reasons.push('the measured holdout hash is not the current frozen holdout');
+    if (h.labelsSha256 !== input.frozen.labelsSha256) reasons.push('the measured labels are not the current labels (changed benchmark labels cannot promote a row)');
+    if (h.privacyLabelsSha256 !== input.frozen.privacyLabelsSha256) reasons.push('the measured privacy labels are not the current privacy labels');
+    return { ok: reasons.length === 0, reasons };
+  })();
+
+  const row = (capability, status, reasons, evidence) => { out.rows[capability] = { capability, status, reasons, evidence: evidence || null }; };
+  const detection = eco.detection || {};
+  const layerKey = (cap) => (/taint/.test(cap) ? 'taint' : 'sast');
+
+  for (const [cap, kind] of Object.entries(required)) {
+    if (kind === 'parse-fixtures') {
+      const p = eco.parser;
+      if (!p || !(p.validFixtures > 0)) { row(cap, 'not-measured', ['no parse-fixture measurement']); continue; }
+      const reasons = [];
+      if (p.validFixturesParsedCleanly !== p.validFixtures) reasons.push(`${p.validFixturesParsedCleanly}/${p.validFixtures} valid fixtures parsed cleanly`);
+      if ((p.crashed || []).length) reasons.push(`${p.crashed.length} crash(es)`);
+      const u = detection.unknownOutcomes;
+      if (u && (u.silentClean > 0 || u.requiredDisclosureMissing > 0)) reasons.push(`unknown cases: ${u.silentClean} silent-clean, ${u.requiredDisclosureMissing} undisclosed required boundary`);
+      row(cap, reasons.length ? 'failed' : 'supported', reasons, { metric: 'parse-fixtures', files: p.files, parsed: p.parsed, validFixtures: p.validFixtures, crashed: (p.crashed || []).length });
+    } else if (kind === 'sast-holdout' || kind === 'taint-holdout') {
+      const key = layerKey(cap);
+      const layer = (detection.layers || {})[key];
+      const g = gateLayer(layer, filterFamilies(detection.perFamilyCases, layer), { kind: key });
+      const reasons = [...g.reasons, ...dataOk.reasons];
+      const u = detection.unknownOutcomes;
+      if (u && u.silentClean > 0) reasons.push(`${u.silentClean} unknown case(s) came back with neither a finding nor a disclosure (false assurance)`);
+      row(cap, !layer || !layer.measured ? 'not-measured' : reasons.length ? 'failed' : 'supported', reasons, layer ? { metric: kind, layer: key, tp: layer.tp, fp: layer.fp, fn: layer.fn, tn: layer.tn, precision: layer.precision, recall: layer.recall, f1: layer.f1, cases: layer.cases, families: layer.families, strictPrecision: layer.strict && layer.strict.precision } : null);
+    } else if (kind === 'privacy-holdout') {
+      const p = eco.privacy;
+      if (!p || !(p.positives > 0 && p.negatives > 0)) { row(cap, 'not-measured', ['no privacy field-to-sink measurement (a security finding or a taint metric is never a privacy metric)']); continue; }
+      const reasons = [...dataOk.reasons];
+      if (!(p.precision >= TARGETS.precision)) reasons.push(`precision ${pct(p.precision)} < ${pct(TARGETS.precision)}`);
+      if (!(p.recall >= TARGETS.recall)) reasons.push(`recall ${pct(p.recall)} < ${pct(TARGETS.recall)}`);
+      if (!(p.f1 >= TARGETS.f1)) reasons.push(`F1 ${pct(p.f1)} < ${pct(TARGETS.f1)}`);
+      const tot = (m.corpusTotals && m.corpusTotals[language] && m.corpusTotals[language].privacy) || null;
+      if (!tot || !(tot.positives >= TARGETS.minPrivacyPositives && tot.negatives >= TARGETS.minPrivacyNegatives)) reasons.push(`the corpus has ${tot ? `${tot.positives} positive / ${tot.negatives} negative` : 'unknown'} field-to-sink expectations (< ${TARGETS.minPrivacyPositives} each)`);
+      row(cap, reasons.length ? 'failed' : 'supported', reasons, { metric: 'privacy-holdout', positives: p.positives, negatives: p.negatives, tp: p.tp, fp: p.fp, fn: p.fn, tn: p.tn, precision: p.precision, recall: p.recall, f1: p.f1, byKind: p.byKind });
+    } else if (kind === 'sca-fixtures') {
+      const s = m.supply || {};
+      const reasons = [];
+      const man = s.manifests; const rng = s.advisoryRanges;
+      if (!man || !man.total) reasons.push('no manifest-resolution measurement');
+      else if (man.exact !== man.total) reasons.push(`${man.exact}/${man.total} manifest fixtures exact`);
+      if (language === 'haskell') { if (!rng || !rng.total) reasons.push('no advisory-range replay'); else if (rng.correct !== rng.total) reasons.push(`${rng.correct}/${rng.total} advisory range checks correct`); }
+      const ts = suiteStatus(input.suites, (input.capabilitySuites || {})[cap]);
+      if (!ts.ok) reasons.push(...ts.reasons);
+      row(cap, reasons.length ? (ts.status === 'blocked' ? 'blocked' : 'failed') : 'supported', reasons, { metric: 'sca-fixtures', manifests: man ? `${man.exact}/${man.total}` : null, advisoryRanges: rng ? `${rng.correct}/${rng.total}` : null });
+    } else if (kind === 'fix-fixtures') {
+      const f = eco.fixes;
+      if (!f) { row(cap, 'not-measured', ['no fix-fixture measurement']); continue; }
+      const reasons = [];
+      if (f.accept.correct !== f.accept.total) reasons.push(`${f.accept.correct}/${f.accept.total} valid proposals accepted`);
+      if (f.reject.correct !== f.reject.total) reasons.push(`${f.reject.correct}/${f.reject.total} bad proposals rejected`);
+      if (f.advertised.verified !== f.advertised.planned) reasons.push(`${f.advertised.verified}/${f.advertised.planned} advertised deterministic fixes verified`);
+      const ts = suiteStatus(input.suites, (input.capabilitySuites || {})[cap]);
+      if (!ts.ok) reasons.push(...ts.reasons);
+      const pairs = eco.pairs;
+      row(cap, reasons.length ? (ts.status === 'blocked' ? 'blocked' : 'failed') : 'supported', reasons, { metric: 'fix-fixtures', accepted: `${f.accept.correct}/${f.accept.total}`, rejected: `${f.reject.correct}/${f.reject.total}`, advertised: `${f.advertised.verified}/${f.advertised.planned}`, unsupportedShapes: f.advertised.unsupported, pairs: pairs ? { preserve: `${pairs.preserve.held}/${pairs.preserve.total}`, change: `${pairs.change.held}/${pairs.change.total}` } : null });
+    } else if (kind === 'test-suite' || kind === 'host-run') {
+      const ts = suiteStatus(input.suites, (input.capabilitySuites || {})[cap]);
+      row(cap, ts.status === 'supported' ? 'supported' : ts.status, ts.reasons, { metric: kind, suites: ((input.capabilitySuites || {})[cap] || []) });
+    }
+  }
+  // a capability whose tool is absent is blocked, not passed and not skipped
+  const tools = input.tools || {};
+  for (const [cap, req] of Object.entries(REQUIRES_TOOL[language] || {})) {
+    const r = out.rows[cap];
+    if (r && !tools[req.tool]) out.rows[cap] = { ...r, status: 'blocked', reasons: [`${req.tool} is not available on the measuring host: ${req.why}`, ...r.reasons] };
+  }
+  const rows = Object.values(out.rows);
+  out.summary = { required: rows.length, supported: rows.filter((r) => r.status === 'supported').length, notSupported: rows.filter((r) => r.status !== 'supported').map((r) => `${r.capability}:${r.status}`), dataOk: dataOk.ok };
+  const pairs = eco.pairs;
+  if (pairs) {
+    const pr = pairs.preserve.total ? pairs.preserve.held / pairs.preserve.total : null; const ch = pairs.change.total ? pairs.change.held / pairs.change.total : null;
+    out.metamorphic = { preserve: pr, change: ch, gate: PAIR_GATE, ok: pr != null && ch != null && pr >= PAIR_GATE.preserve && ch >= PAIR_GATE.change, broken: [...pairs.preserve.broken, ...pairs.change.broken] };
+  }
+  return out;
+}
+
+// Only the families the layer actually scored are held to the holdout-denominator rule.
+function filterFamilies(perFamilyCases, layer) {
+  if (!layer || !layer.families) return perFamilyCases;
+  const wanted = new Set(Object.keys(layer.families));
+  return Object.fromEntries(Object.entries(perFamilyCases || {}).filter(([k]) => wanted.has(k)));
+}
+
+/**
+ * The promotion check applied to one proposed registry row. A row may be marked `supported` only if `evidence.metric` is the kind
+ * the capability requires, the evidence is not of a non-promoting kind, and `evaluateSupport` agrees. Returns {ok, reasons}.
+ */
+export function checkPromotion(language, capability, proposedStatus, evidence, evaluated) {
+  const required = REQUIRED_CAPABILITIES[language];
+  const reasons = [];
+  if (!required || !(capability in required)) return { ok: false, reasons: [`${capability} is not a required capability of ${language}`] };
+  if (proposedStatus !== 'supported') return { ok: true, reasons: [] };
+  const metric = evidence && evidence.metric;
+  if (!metric) reasons.push('no evidence metric was named');
+  else if (NON_PROMOTING_EVIDENCE.includes(metric)) reasons.push(`evidence of kind "${metric}" can never promote a row`);
+  else if (metric !== required[capability]) reasons.push(`the row needs "${required[capability]}" evidence, not "${metric}" (a metric of another kind is not a measurement of this capability)`);
+  const actual = evaluated && evaluated.rows[capability];
+  if (!actual) reasons.push('the evaluated measurement has no such row');
+  else if (actual.status !== 'supported') reasons.push(`the measurement does not support it: ${actual.status}${actual.reasons.length ? ` (${actual.reasons[0]})` : ''}`);
+  return { ok: reasons.length === 0, reasons };
+}
+
+/**
+ * Re-checks a stored registry against the corpus as it is now: a row whose recorded hashes no longer match is demoted to
+ * `unverified` (changed labels never keep a promotion).
+ */
+export function verifyRegistry(registry, frozen) {
+  const stale = [];
+  for (const [lang, entry] of Object.entries((registry && registry.languages) || {})) {
+    const f = entry.frozen || {};
+    for (const k of ['holdoutRollup', 'labelsSha256', 'privacyLabelsSha256']) if (f[k] !== (frozen || {})[k]) { stale.push({ language: lang, field: k }); }
+  }
+  return { ok: stale.length === 0, stale };
+}