@clear-capabilities/agentic-security-scanner 0.153.2 → 0.154.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-dce16625abaef7a52aad4a8d0ca0402d22ea681c9a1479f7378401458e38d55e  agentic-security.mjs
+e460f63891e70f53f1a0d6061a5393cc92c5ade0ddde80bd8bfaf8eb00dbb849  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.153.2",
+  "version": "0.154.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -65,6 +65,8 @@
     "prepare": "node scripts/prepare.mjs",
     "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs && node ../scripts/release-check.mjs",
     "test": "node ../scripts/run-unit-tests.mjs && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",
+    "loop": "node ../scripts/loop-engineering/run.mjs",
+    "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-runbook.test.js",
     "test:python": "node ../scripts/run-python-tests.mjs",
     "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
     "test:ollama-e2e": "AGENTIC_SECURITY_OLLAMA_E2E=1 node --test test/ollama-e2e.test.js",
@@ -77,6 +79,13 @@
     "test:lineage": "node --test test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
     "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
+    "test:haskell": "node --test test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js",
+    "test:nix": "node --test test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js",
+    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js",
+    "test:language-stress": "node --test --test-concurrency=1 test/language/language-stress-offline.test.js",
+    "test:language-tools": "node --test test/haskell/haskell-web-auth.test.js test/haskell/haskell-support-gate.test.js",
+    "bench:language-support:check": "node ../bench/language-support/check.mjs",
+    "bench:language-support:perf": "node ../bench/language-support/perf.mjs",
     "test:lifecycle": "node --test test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js",
@@ -187,7 +196,13 @@
     "bench:independent:merge": "node ../bench/independent/merge-chunks.mjs",
     "bench:independent:agent-delta": "node ../bench/independent/agent-boundary-delta.mjs",
     "bench:independent:deep": "node ../bench/independent/runner.mjs --deep",
-    "test:ci-parity": "CI=true GITHUB_ACTIONS=true node --test test/backward-default.test.js test/ci-parity.test.js test/container-taint.test.js test/deep-taint.test.js test/engine-recall.test.js test/engine-reconnect.test.js test/gate-verdict-cache.test.js test/ignore-pragma.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/py-annotation-sources.test.js test/runscan-deep-option.test.js test/sanitizer-typed-flow.test.js"
+    "test:ci-parity": "CI=true GITHUB_ACTIONS=true node --test test/backward-default.test.js test/ci-parity.test.js test/container-taint.test.js test/deep-taint.test.js test/engine-recall.test.js test/engine-reconnect.test.js test/gate-verdict-cache.test.js test/ignore-pragma.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/py-annotation-sources.test.js test/runscan-deep-option.test.js test/sanitizer-typed-flow.test.js",
+    "docs:render-language": "node ../scripts/render-language-docs.mjs",
+    "docs:capture-language": "node ../scripts/capture-language-examples.mjs",
+    "docs:check-language": "node ../scripts/render-language-docs.mjs --check && node ../scripts/capture-language-examples.mjs --check",
+    "test:nixos-host": "node --test test/nix/nixos-host-runtime.test.js",
+    "test:language-gates": "node --test --test-concurrency=1 test/language/language-benchmark-gates.test.js",
+    "test:language-slow": "node --test --test-concurrency=1 test/language/language-doc-examples-metrics.test.js test/language/language-end-to-end.test.js test/language/language-package-ci.test.js test/language/language-scan-modes.test.js"
   },
   "author": "Ross Young <ross@clearcapabilities.com>",
   "license": "PolyForm-Internal-Use-1.0.0",

package/src/dataflow/CLAUDE.md

@@ -98,3 +98,12 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
 - **`AGENTIC_SECURITY_BLIND_BENCH=1` does NOT disable the deep engine.** It gates the bench-shape detectors; `_deepRequested` in `engine.js` keys on `AGENTIC_SECURITY_DEEP === '1'` alone, so deep mode runs regardless. (This bullet previously claimed the opposite — verified false while building `bench/layer-recall/`, where setting `BLIND_BENCH=1` left taint recall unchanged at 20/210.) To turn the taint engine off, set `AGENTIC_SECURITY_DEEP=0`.
 - **The corpus barely exercises this engine.** `bench/cve-replay` enables deep mode only for its 6 `deep`-tier entries, and with the deep engine off entirely, corpus detection falls only 210 → 204. Taint quality is measured by `npm run bench:layer-recall` (which forces deep on for all 210), not by the corpus gate — see `docs/METRICS.md`.
 - **Resolved: `stub-aware-filter.js` no longer mutates `severity`.** It used to (`f.severity = downgrade[f.severity]`, opt-in via `AGENTIC_SECURITY_TYPE_STUBS=1`), which violated the recall-preserving convention every other precision annotator in this directory follows. Flagged by documentation audit, then fixed on maintainer decision: it now demotes `confidence` (× 0.4, floor 0.01) + `confidenceTier` + `exploitabilityTier` by one step each, mirroring `proof-gate.js`'s own demotion shape exactly (`_confidenceBeforeStubFilter` records the pre-demotion value, a distinct field from `proof-gate.js`'s `_confidenceBeforeProofGate` so the two compose if both fire on the same finding). Severity is never touched.
+
+## Haskell catalog
+
+`catalog-haskell.js` is **generated** from `language/haskell-models.js` (one registry of sources, sinks and sanitizers; entries
+match import-qualified callees, so a user function with the same name cannot match). Two extra sources are annotation- and
+member-based: `hs-src-caller-controlled-param` (a text parameter of an exported function nothing in the module calls) and
+`hs-lin-src-record-parameter` (the lineage form of a record parameter). `engine.js` skips the literal-skeleton filter for Haskell
+catalog entries and requires a markup literal for `htmlSkeleton` sinks. Pinned counts in the lineage registry tests change
+deliberately when the model registry grows. Details: `scanner/src/language/CLAUDE.md`.

package/src/dataflow/catalog-haskell.js

@@ -0,0 +1,37 @@
+// Haskell taint catalog, GENERATED from the model registry (language/haskell-models.js) so there is
+// exactly one list of Haskell sources, sinks and sanitizers. Every entry matches the IMPORT-QUALIFIED
+// callee the Haskell IR produces (`System.Process.callCommand`), never a bare name, so a user's own
+// function with the same name resolves to its own module and cannot match.
+
+import { HS_SOURCES, HS_SINKS, HS_SANITIZERS } from '../language/haskell-models.js';
+
+const idOf = (kind, e, extra = '') => `hs-${kind}-${e.module}.${e.name}${extra}`.replace(/[^A-Za-z0-9.\-_]/g, '-').toLowerCase();
+
+export const HASKELL_CATALOG = Object.freeze([
+  ...HS_SOURCES.map((e) => ({
+    kind: 'source', id: idOf('src', e), language: 'hs', framework: e.framework || 'haskell',
+    match: { type: 'call', callee: `${e.module}.${e.name}` }, label: e.label, provenance: e.provenance,
+  })),
+  ...HS_SINKS.map((e) => ({
+    kind: 'sink', id: idOf('sink', e, `.${e.cwe}.${e.argIndex}`), language: 'hs', framework: e.framework || 'haskell',
+    match: { type: 'call', callee: `${e.module}.${e.name}` }, argIndex: e.argIndex,
+    vuln: { name: e.vuln, severity: e.severity, cwe: e.cwe, remediation: e.remediation },
+    hs: { family: e.family, shell: e.shell === true, argv: e.argv === true, package: e.package, htmlSkeleton: e.htmlSkeleton === true },
+  })),
+  // LINEAGE form of every source: a member read on the synthetic root `$hs` (see lineage/haskell-view.js, which
+  // rewrites a CLONE of each Haskell function so a monadic source read becomes a seedable member read). The
+  // taint engine never sees this form: the shared IR keeps the call form above.
+  ...HS_SOURCES.map((e) => ({
+    kind: 'source', id: idOf('lin-src', e), language: 'hs', framework: e.framework || 'haskell',
+    match: { type: 'member', object: '$hs', prop: `${e.module}.${e.name}` }, label: e.label, provenance: e.provenance,
+  })),
+  // A text-typed parameter of an exported function (see language/haskell-ir.js `callerControlledParams`). The label says what
+  // it is: the caller supplies the value and nothing in the module proves it trusted.
+  // LINEAGE form of a record parameter of an exported function (see lineage/haskell-view.js)
+  { kind: 'source', id: 'hs-lin-src-record-parameter', language: 'hs', framework: 'haskell', match: { type: 'member', object: '$hs', prop: 'hs:record-parameter' }, label: 'record parameter of an exported function (caller-supplied customer data)' },
+  { kind: 'source', id: 'hs-src-caller-controlled-param', language: 'hs', framework: 'haskell', match: { type: 'annotation', name: 'hs:caller-controlled' }, label: 'text parameter of an exported function (caller-controlled)' },
+  ...HS_SANITIZERS.map((e) => ({
+    kind: 'sanitizer', id: idOf('san', e), language: 'hs',
+    match: { type: 'call', callee: `${e.module}.${e.name}` }, effect: 'strip', appliesTo: e.appliesTo, note: e.note,
+  })),
+]);

package/src/dataflow/catalog.js

@@ -2174,6 +2174,7 @@ export const CATALOG = [
 // Lives in catalog-expanded.js to keep the diff reviewable. Merged into
 // the main CATALOG below so the indexer treats them identically.
 import { EXPANDED_SANITIZERS } from './catalog-expanded.js';
+import { HASKELL_CATALOG } from './catalog-haskell.js';
 import { cppExtRe } from '../ir/parser-cpp.js';
 
 // Language-scope guard. `file` is optional — when absent, behavior is
@@ -2200,6 +2201,7 @@ const _LANG_EXT = {
   rb:   /\.rb$/i,
   java: /\.java$/i,
   rs:   /\.rs$/i,
+  hs:   /\.(?:hs|lhs)$/i,
 };
 
 // cpp delegates to cppExtRe() rather than duplicating a literal set, so it
@@ -2395,6 +2397,8 @@ function _receiverTypeConfirms(entry, receiverType) {
     _ids.add(k);
     CATALOG.push(e);
   }
+  // Haskell models (generated from language/haskell-models.js). Entries are import-qualified.
+  for (const e of HASKELL_CATALOG) { const k = String(e.id).toLowerCase(); if (_ids.has(k)) continue; _ids.add(k); CATALOG.push(e); }
 }
 
 // Provenance defaults (Sentinel-parity audit P1-10):

package/src/dataflow/engine.js

@@ -1073,7 +1073,11 @@ function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callC
           ? argTaints.findIndex(Boolean) : e.argIndex;
         const taintedArgExpr = (argExprs || [])[taintedArgIdx];
         // String content analysis: skip if literal skeleton doesn't match injection family
-        if (e.vuln && taintedArgExpr && !literalSkeletonMatchesFamily(taintedArgExpr, e.vuln.cwe)) continue;
+        // Haskell entries are import-qualified, API-specific sinks (`preEscapedToHtml`, `callCommand`), never a generic
+        // `.query()`-style call that may carry an unrelated string, so the literal-skeleton filter does not apply to them.
+        if (e.vuln && taintedArgExpr && !e.hs && !literalSkeletonMatchesFamily(taintedArgExpr, e.vuln.cwe)) continue;
+        // A text-output sink that is an XSS sink ONLY when the string being assembled contains markup (`putStrLn`).
+        if (e.hs && e.hs.htmlSkeleton && !(taintedArgExpr && /<[A-Za-z!\/]/.test(_literalPartsOfExpr(taintedArgExpr).join(' ')))) continue;
         // Taint-recall PRD (80%): `match.requireLiteralArg` — a precision
         // gate for sinks whose danger depends on a SIBLING argument's
         // literal value, not the tainted one. Go's `exec.Command(path,
@@ -1141,6 +1145,9 @@ function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callC
         findings.push({
           ...(_sanNames.size ? { _sanitizersOnPath: [..._sanNames] } : {}),
           ...(_unsanNames.size ? { _unsanitizersOnPath: [..._unsanNames] } : {}),
+          // Haskell: two sinks of the same kind on one line (`if b then f (clean x) else f x`) are distinct
+          // sites; without a site key they share an id and one silently replaces the other.
+          ...(/\.(?:hs|lhs)$/i.test(_currentFile || '') ? { siteKey: _siteKey(taintedArgExpr) } : {}),
           kind: 'taint',
           sinkId: e.id,
           vuln: e.vuln?.name || 'Tainted Sink',
@@ -1742,6 +1749,18 @@ function step(node, stateIn, callContext) {
         findings.push(..._sinkFindingsForCall(
           node.value.callee, node.value.args, cat, argTaints, state, callContext, node.line, node.value.kwargs).findings);
         findings.push(..._nestedSinkFindings(node.value.args, state, callContext, node.line));
+      } else if (node.value && node.value.kind === 'union' && /\.(?:hs|lhs)$/i.test(_currentFile || '')) {
+        // Haskell: `if c then A else B` and guards return a union of the branch ACTIONS, each of which
+        // runs when its branch is taken, so every branch call is a sink site in its own right. (Scoped
+        // to Haskell: other IRs lower conditional expressions differently and are unchanged.)
+        const leaves = [];
+        const walk = (v, d) => { if (!v || d > 40) return; if (v.kind === 'union') (v.branches || []).forEach((b) => walk(b, d + 1)); else if (v.kind === 'call') leaves.push(v); };
+        walk(node.value, 0);
+        for (const c of leaves) {
+          const { cat, argTaints } = _matchCallCatalog(c.callee, c.args, state, callContext);
+          findings.push(..._sinkFindingsForCall(c.callee, c.args, cat, argTaints, state, callContext, c.line || node.line, c.kwargs).findings);
+          findings.push(..._nestedSinkFindings(c.args, state, callContext, c.line || node.line));
+        }
       }
       if (exprTaint(node.value, state, callContext)) {
         callContext._returnTainted = true;
@@ -1764,6 +1783,14 @@ function step(node, stateIn, callContext) {
 // state, never into the SummaryCache key (that stays exactly what the caller
 // supplied). Returns the ORIGINAL Set unchanged when there's nothing to add,
 // so callers that never touch annotation-shaped params pay zero extra cost.
+// Short stable fingerprint of an argument expression (ignores line numbers and IR bookkeeping).
+function _siteKey(expr) {
+  let h = 5381;
+  const str = JSON.stringify(expr, (k, v) => (k === 'line' || k === 'hs' ? undefined : v)) || '';
+  for (let i = 0; i < str.length; i++) h = ((h << 5) + h + str.charCodeAt(i)) >>> 0;
+  return h.toString(16);
+}
+
 function _unionAnnotationTaint(fn, entrySet) {
   if (!fn.paramAnnotations || !fn.paramAnnotations.length) return entrySet;
   const extra = matchAnnotationParams(fn.paramAnnotations, fn.file);
@@ -2541,6 +2568,8 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
     if (!fn) continue;
     if (calledQids.has(f._funcQid)) continue;
     if (fn.name === '<module>' || /handler|route|controller|middleware|endpoint/i.test(fn.name || '')) continue;
+    // Haskell: an exported function or `main` is reachable from outside the analysed files.
+    if (fn.hs && (fn.hs.exported || /\.main$/.test(fn.name || ''))) continue;
     f._inDeadCode = true;
     const dg = { critical: 'high', high: 'medium', medium: 'low', low: 'info' };
     if (dg[f.severity]) f.severity = dg[f.severity];
@@ -2572,12 +2601,13 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
       // every path pushing into `_findings` sets `file` explicitly as of
       // this fix.
       const file = f.file || attributedFn.file;
-      const key = `${f.sinkId}:${file}:${f.line}`;
+      const key = `${f.sinkId}:${file}:${f.line}${f.siteKey ? ':' + f.siteKey : ''}`;
       if (seen.has(key)) continue;
       seen.add(key);
       const fn = attributedFn;
       all.push({
-        id: `ir-taint:${file}:${f.line}:${f.sinkId}`,
+        id: `ir-taint:${file}:${f.line}:${f.sinkId}${f.siteKey ? ':' + f.siteKey : ''}`,
+        ...(f.siteKey ? { siteKey: f.siteKey } : {}),
         file,
         line: f.line,
         vuln: f.vuln,

package/src/dataflow/privacy-catalog-haskell.js

@@ -0,0 +1,50 @@
+// Haskell privacy sinks (X-004), kept SEPARATE from the security sinks of haskell-models.js: a field that is
+// legitimately written to a database or sent to an API is not a vulnerability, it is a privacy-relevant flow
+// that the Data Flow Explorer classifies. Entries use the same shape as privacy-catalog.js and match the
+// IMPORT-QUALIFIED callee the Haskell IR produces (`Database.PostgreSQL.Simple.execute`), so a user's own
+// function of the same name cannot match.
+//
+// Package/function names are curated from each library's documented API; `argIndex` is the position of the
+// DATA argument (the row/parameter tuple, the message, the body), never the query text or a connection.
+
+import { HS_LOG_SINKS } from '../language/haskell-models.js';
+
+const mk = (category, id, module, names, argIndex, framework, vuln, severity = 'high') => names.map((name) => ({
+  kind: 'sink', id: `privacy-hs-${id}-${name}`.toLowerCase(), language: 'hs', framework, category,
+  match: { type: 'call', callee: `${module}.${name}` }, argIndex,
+  vuln: { name: vuln, severity, cwe: 'CWE-359', remediation: 'Regulated data (PII/PHI/PCI) reaching this destination needs a documented purpose, retention and protection; redact, hash or drop the field first.' },
+}));
+
+export const HASKELL_PRIVACY_SINKS = Object.freeze([
+  // log: derived from the same table the sensitive-logging rule reads
+  ...HS_LOG_SINKS.map((e) => ({
+    kind: 'sink', id: `privacy-hs-log-${e.module}.${e.name}`.toLowerCase(), language: 'hs', framework: 'haskell', category: 'log',
+    match: { type: 'call', callee: `${e.module}.${e.name}` }, argIndex: e.argIndex,
+    vuln: { name: `Privacy Leak (${e.channel} log)`, severity: 'medium', cwe: 'CWE-359', remediation: 'Do not log regulated data (PII/PHI/PCI). Redact or hash the field before logging.' },
+  })),
+  // response
+  ...mk('response', 'scotty', 'Web.Scotty', ['text', 'html', 'json', 'raw'], 0, 'scotty', 'Privacy Leak (response body)'),
+  ...mk('response', 'scotty-trans', 'Web.Scotty.Trans', ['text', 'html', 'json', 'raw'], 0, 'scotty', 'Privacy Leak (response body)'),
+  ...mk('response', 'wai', 'Network.Wai', ['responseLBS'], 2, 'wai', 'Privacy Leak (response body)'),
+  // outbound HTTP (the request body is the data carrier)
+  ...mk('outboundHttp', 'http-simple', 'Network.HTTP.Simple', ['setRequestBodyJSON', 'setRequestBodyLBS', 'setRequestBodyURLEncoded'], 0, 'http-conduit', 'Privacy Leak (outbound HTTP request)'),
+  ...mk('outboundHttp', 'wreq', 'Network.Wreq', ['post', 'put'], 1, 'wreq', 'Privacy Leak (outbound HTTP request)'),
+  ...mk('outboundHttp', 'wreq-with', 'Network.Wreq', ['postWith', 'putWith'], 2, 'wreq', 'Privacy Leak (outbound HTTP request)'),
+  // storage
+  ...mk('storage', 'pgsimple', 'Database.PostgreSQL.Simple', ['execute', 'executeMany', 'query', 'returning'], 2, 'postgresql-simple', 'Privacy Leak (database write)', 'medium'),
+  ...mk('storage', 'sqlite', 'Database.SQLite.Simple', ['execute', 'executeMany', 'query', 'executeNamed'], 2, 'sqlite-simple', 'Privacy Leak (database write)', 'medium'),
+  ...mk('storage', 'mysql', 'Database.MySQL.Simple', ['execute', 'executeMany', 'query'], 2, 'mysql-simple', 'Privacy Leak (database write)', 'medium'),
+  ...mk('storage', 'persistent', 'Database.Persist', ['insert', 'insert_', 'insertMany', 'insertMany_', 'repsert', 'replace', 'upsert'], 0, 'persistent', 'Privacy Leak (database write)', 'medium'),
+  ...mk('storage', 'persistent-sql', 'Database.Persist.Sql', ['insert', 'insert_', 'insertMany', 'insertMany_', 'repsert', 'replace', 'upsert'], 0, 'persistent', 'Privacy Leak (database write)', 'medium'),
+  // file write
+  ...mk('fileWrite', 'prelude', 'Prelude', ['writeFile', 'appendFile'], 1, 'base', 'Privacy Leak (file write)', 'medium'),
+  ...mk('fileWrite', 'system-io', 'System.IO', ['writeFile', 'appendFile'], 1, 'base', 'Privacy Leak (file write)', 'medium'),
+  ...mk('fileWrite', 'text-io', 'Data.Text.IO', ['writeFile', 'appendFile'], 1, 'text', 'Privacy Leak (file write)', 'medium'),
+  ...mk('fileWrite', 'bytestring', 'Data.ByteString', ['writeFile', 'appendFile'], 1, 'bytestring', 'Privacy Leak (file write)', 'medium'),
+  // object storage / email / queues
+  ...mk('s3Upload', 'amazonka', 'Amazonka.S3', ['newPutObject'], 2, 'amazonka', 'Privacy Leak (object storage upload)'),
+  ...mk('emailSend', 'smtp', 'Network.Mail.SMTP', ['sendMail', 'simpleMail', 'plainTextPart', 'htmlPart'], 0, 'smtp', 'Privacy Leak (outbound email)', 'medium'),
+  ...mk('emailSend', 'mime', 'Network.Mail.Mime', ['renderSendMail'], 0, 'mime-mail', 'Privacy Leak (outbound email)', 'medium'),
+  ...mk('queue', 'amqp', 'Network.AMQP', ['publishMsg'], 2, 'amqp', 'Privacy Leak (queue publish)', 'medium'),
+  ...mk('queue', 'kafka', 'Kafka.Producer', ['produceMessage'], 1, 'hw-kafka-client', 'Privacy Leak (queue publish)', 'medium'),
+]);

package/src/dataflow/privacy-catalog.js

@@ -36,6 +36,7 @@
 
 import { classifyFieldAgainst } from './privacy-taxonomy.js';
 import { _languageFamilyExtensions } from './catalog.js';
+import { HASKELL_PRIVACY_SINKS } from './privacy-catalog-haskell.js';
 
 export const PRIVACY_SINK_CATALOG = [
   // ── log ──────────────────────────────────────────────────────────────────
@@ -129,6 +130,7 @@ export const PRIVACY_SINK_CATALOG = [
             remediation: 'Regulated data (PII/PHI/PCI) placed on a queue is readable by every consumer with queue access — document who can subscribe before sending it.' } },
 ];
 
+
 // All 9 sink categories FR-403 names (7 already covered by privacy-taint.js's
 // own SINK_PATTERNS, plus storage/queues) — used by this module's own tests
 // to assert coverage is genuinely complete, not just "some entries exist."
@@ -242,7 +244,9 @@ export function matchPrivacySink(calleeExpr, file, receiverType) {
   if (!calleeExpr) return null;
   const { last, full } = _privacyCalleeNames(calleeExpr);
   if (!last && !full) return null;
-  const hits = PRIVACY_SINK_CATALOG.filter((e) => {
+  // Haskell privacy sinks live in their own table (privacy-catalog-haskell.js): the pinned catalog above is the
+  // JS/Python/... surface other suites count, and a new language does not silently change those counts.
+  const hits = [...PRIVACY_SINK_CATALOG, ...HASKELL_PRIVACY_SINKS].filter((e) => {
     if (!e || e.kind !== 'sink') return false;
     const cName = e.match && e.match.callee;
     if (!cName) return false;

package/src/discovery/CLAUDE.md

@@ -46,3 +46,9 @@ panel · `judge.js` shapes findings and dedupes against the prior scan ·
   it was not examined, and the report says so.
 - **Coverage is reported.** Degraded runs and their reasons appear in every
   report. A half-failed pass must never read as a clean one.
+
+## Nix partitioning
+
+`partition.js` `partitionNixFiles` groups `.nix` files by their import structure (a configuration and the modules it imports are
+one area), merged areas are capped, and hunter prompts for Haskell and Nix are redacted (split literals joined first) before they
+leave the process. `hunt` includes `.hs`, `.lhs` and `.nix`. With no endpoint every run is degraded and says so.

package/src/discovery/index.js

@@ -7,7 +7,7 @@
 // planned versus hunted and how many runs degraded, with reasons. A discovery
 // pass that half failed and reports "no findings" is indistinguishable from a
 // clean codebase unless it says so.
-import { partitionCallGraph } from './partition.js';
+import { partitionCallGraph, partitionNixFiles } from './partition.js';
 import { LENSES, lensByKey } from './lenses.js';
 import { runHunter } from './hunter.js';
 import { confirmAll } from './confirm.js';
@@ -131,7 +131,16 @@ export function makeBudget(opts = {}, now = Date.now) {
 }
 
 export async function runDiscovery(ctx = {}, opts = {}) {
-  const areas = partitionCallGraph(ctx.callGraph, { maxAreas: opts.maxAreas ?? 8 });
+  // Call-graph areas (every language the IR covers, Haskell included) plus Nix configuration areas, which have no call
+  // graph. Together they respect the same ceiling.
+  const maxAreas = opts.maxAreas ?? 8;
+  let areas = [...partitionCallGraph(ctx.callGraph, { maxAreas }), ...partitionNixFiles(ctx.fileContents, { maxAreas })];
+  if (areas.length > maxAreas) {
+    const kept = areas.slice(0, maxAreas - 1); const tail = areas.slice(maxAreas - 1);
+    const files = [...new Set(tail.flatMap((a) => a.files))].sort();
+    kept.push({ id: tail.map((a) => a.id).join('+').slice(0, 64), label: 'misc', files, functions: tail.flatMap((a) => a.functions), size: tail.reduce((n, a) => n + a.size, 0) });
+    areas = kept;
+  }
 
   const reasons = [];
   const budget = makeBudget(opts);
@@ -169,7 +178,7 @@ export async function runDiscovery(ctx = {}, opts = {}) {
   for (const area of areas) {
     let areaDegradedCount = 0;
     for (const lens of lenses) {
-      const run = await runHunter(area, lens, { fileContents: ctx.fileContents || {} }, { llmInvoke, scanRoot: opts.scanRoot });
+      const run = await runHunter(area, lens, { fileContents: ctx.fileContents || {}, scanRoot: opts.scanRoot }, { llmInvoke, scanRoot: opts.scanRoot });
       runs.push({ focusAreaId: run.focusAreaId, lens: run.lens, degraded: run.degraded, reason: run.reason, candidateCount: run.candidates.length });
       if (run.degraded && run.reason) reasons.push(`${area.label} × ${lens.key}: ${run.reason}`);
       if (run.degraded) areaDegradedCount += 1;

package/src/discovery/lenses.js

@@ -7,6 +7,7 @@
 // same code than one told to look at crypto, so the union covers failure modes
 // no single prompt reaches. `wildcard` exists because a fixed taxonomy is a
 // ceiling, and the classes worth finding are the ones not on the list.
+import { redactPayload } from '../egress/redact.js';
 export const LENSES = Object.freeze([
   { key: 'injection', title: 'Injection', family: 'injection', cwe: 'CWE-74',
     brief: 'Untrusted input reaching an interpreter: SQL, shell, template, XPath, LDAP, or deserialization. Follow the value, not the function name.' },
@@ -39,7 +40,9 @@ export function buildHunterPrompt(focusArea, lens, ctx = {}) {
   let budget = maxChars;
   const blocks = [];
   for (const f of files) {
-    const src = contents[f];
+    // Everything that leaves the machine is redacted first (secrets, PII/PHI/PCI-shaped fields, operator-declared
+    // customer data, and whole proprietary paths), by the same choke point the validator and the proposers use.
+    const src = redactPayload({ text: contents[f], filePath: f, scanRoot: ctx.scanRoot || null }).text;
     const slice = src.length > budget ? src.slice(0, Math.max(0, budget)) : src;
     const truncated = slice.length < src.length;
     blocks.push(`--- SOURCE FILE (untrusted data): ${f}${truncated ? ' (truncated)' : ''} ---\n${slice}\n--- END SOURCE FILE: ${f} ---`);

package/src/discovery/partition.js

@@ -12,6 +12,7 @@
 // components share a file they are merged, otherwise the same source lands in
 // two hunters' context and the convergence this module exists to prevent
 // comes straight back.
+import { buildImportGraph } from '../language/discovery.js';
 import * as crypto from 'node:crypto';
 
 export function focusAreaId(files) {
@@ -90,3 +91,30 @@ export function partitionCallGraph(callGraph, opts = {}) {
   }
   return areas;
 }
+
+/**
+ * Focus areas for Nix configuration, which has no call graph: files joined by `imports` / path references form one
+ * area, so a NixOS entry point and the modules that decide its options are hunted together. Same shape as a call-graph
+ * area (`functions` is empty: a Nix file has none).
+ */
+export function partitionNixFiles(fileContents, opts = {}) {
+  const maxAreas = Number.isInteger(opts.maxAreas) && opts.maxAreas > 0 ? opts.maxAreas : 8;
+  const nix = {};
+  for (const [f, t] of Object.entries(fileContents || {})) if (/\.nix$/i.test(f) && typeof t === 'string') nix[f] = t;
+  const files = Object.keys(nix).sort();
+  if (!files.length) return [];
+  const { graph } = buildImportGraph(nix);
+  const dsu = makeDSU();
+  for (const f of files) dsu.find(f);
+  for (const [f, deps] of graph) for (const d of deps) dsu.union(f, d);
+  const groups = new Map();
+  for (const f of files) { const r = dsu.find(f); if (!groups.has(r)) groups.set(r, []); groups.get(r).push(f); }
+  let areas = [...groups.values()].map((g) => { const sorted = [...g].sort(); return { id: focusAreaId(sorted), label: labelFor(sorted), files: sorted, functions: [], size: sorted.length, language: 'nix' }; });
+  areas.sort((a, b) => b.size - a.size || (a.id < b.id ? -1 : 1));
+  if (areas.length > maxAreas) {
+    const kept = areas.slice(0, maxAreas - 1); const tail = areas.slice(maxAreas - 1).flatMap((a) => a.files).sort();
+    kept.push({ id: focusAreaId(tail), label: 'misc', files: tail, functions: [], size: tail.length, language: 'nix' });
+    areas = kept;
+  }
+  return areas;
+}

package/src/egress/redact.js

@@ -43,6 +43,7 @@
 // HOW MUCH was removed per category (FR-604's audit metadata wants exactly
 // this: counts, not content) without retaining what was actually removed.
 
+import { redactLanguageSecrets } from '../language/secrets.js';
 import { loadPolicyConfig } from './policy.js';
 import { redactSecrets } from '../llm-validator/redact.js';
 import { loadPrivacyTaxonomy } from '../dataflow/privacy-taxonomy.js';
@@ -159,6 +160,13 @@ export function redactPayload({ text, filePath = null, scanRoot = null, taxonomy
   const secretResult = redactSecrets(out, { filePath });
   out = secretResult.text;
   categories.secrets = secretResult.redactions;
+  // Haskell and Nix: a credential split across string literals (`"sk_live_" ++ "..."`) is invisible to a
+  // single-literal pattern, so those files get a token-based pass as well.
+  if (filePath && /\.(?:l?hs|hs-boot|hsc|nix)$/i.test(filePath)) {
+    const lang = redactLanguageSecrets(filePath, out);
+    out = lang.text;
+    categories.secrets += lang.redactions;
+  }
 
   const piiEnabled = cfg.redactPii !== false; // default ON — this category has a safe built-in default, unlike customerDataPatterns
   if (piiEnabled) {