@clear-capabilities/agentic-security-scanner 0.153.2 → 0.155.0

package/CHANGELOG.md

@@ -9,6 +9,53 @@
 > make the history less accurate, not more.
 
 
+## 0.155.0 - premortem remediation (trust boundary, unseen-shape measurement), NixOS VM check
+
+An adversarial premortem of 0.154.0 found the following; each is fixed here and covered by `test/language/language-trust-boundary.test.js`.
+
+- **Trust boundary.** Advisory snapshots are read only from the operator (environment variable or `$XDG_CONFIG_HOME/agentic-security/`). A snapshot inside the scanned project is ignored and the scan says so, so a repository can no longer ship an empty feed to look clean. Nix export freshness is derived by the scanner from `flake.lock`, project-supplied exports and plans are disclosed, a refused export contributes nothing, and a Cabal plan that contradicts the freeze file is flagged.
+- **Unseen-shape split.** The holdout shares its code shapes with development, so it measures robustness to renaming only. A new `unseen` split (300 author-labelled cases, 3 new vulnerable and 3 new safe shapes per family) is measured once and never tuned against. Its result is stored beside every holdout row with 95% Clopper-Pearson intervals and strict precision. It is **below target** for Haskell SAST (R 79.2%), Haskell taint (P 77.8%) and Nix config-sast (P 86.1%); those are engine gaps, not fixed here. The `auth` row is now promoted from its own holdout evidence.
+- **Completion honesty.** A release check (`completion-declared`) fails when `docs/completion-status.json` lists unverified requirements and the changelog has no paragraph naming them. Chrome-dependent export tests are a separate informational job rather than a silent skip.
+- **Nix package fix (found by the first hosted NixOS guest run).** The packaged `agentic-security-mcp` and `agentic-security-lsp` wrappers ran `bin/*.js`, which import `src/` and therefore npm dependencies the Nix package does not ship, so both would have crashed for a Nix user. They now run from the self-contained bundle, and the CLI gained an `lsp` subcommand (the same server the editor plugins start). The flake's package source is now exactly the files it installs, so an offline rebuild elsewhere reproduces the same derivation.
+- **Destructive-command guard.** `hooks/pre-bash-guard.js` judged `rm` by text, so it refused any absolute path (and `docker run --rm -v /abs/...`) while missing nothing it should. Deletion (`rm`, `rmdir`, `unlink`, `find -delete`) is now path-aware: targets are parsed and resolved (`~`, `$HOME`, relative paths, `cd`, symlinks) and allowed only strictly inside an allowed root (default `~/code`, set with `allowedRoots` in `.agentic-security/destructive-guard.json`). Anything outside, anything unresolvable (`$VAR`, command substitution, `xargs`) and the root itself is refused. It cannot see deletion done inside another program, so it guards against mistakes and is not a sandbox. Pinned by `test/pre-bash-guard.test.js`.
+- **Not done.** Peak scan memory is measured under a stated heap cap and was **not reduced**: a lazy-token experiment retained less but changed no measurement, so it was reverted. `flake.nix` is now locked (`flake.lock`), built and checked on aarch64-linux in a `nixos/nix` container (Nix 2.35.2) and on x86_64-linux on a hosted runner; aarch64-darwin is declared but unbuilt, and x86_64-darwin is dropped (current nixpkgs no longer supports it).
+
+Partial release: the loop controller lists NIX-011, NIX-012 and REL-001 as not verified. NIX-011 and NIX-012 passed on hosted CI in this release's pull request (the NIX-011 suite on Nix 2.24.10; the NIX-012 suite inside a real NixOS guest booted by the flake's `nixos-host` check on an x86_64 runner with KVM), but that is CI evidence, not controller-signed evidence, because the controller runs where `nix` and `/etc/NIXOS` are absent. The aarch64 NixOS guest was not run: the arm runner has no KVM and a software-emulated guest does not boot in any usable time. REL-001 is the controller's own final acceptance and needs those two to be controller-verified first.
+
+## 0.154.0 - Haskell and Nix/NixOS support, with every limit stated
+
+Haskell and Nix/NixOS are now scanned by the same commands as every other language, with no compiler, no `nix` binary and no
+network. This entry records what is **measured** and what is **not**; nothing here announces completion beyond the evidence.
+
+- **Analysis.** Dependency-free Haskell and Nix parsers over SHA-256-pinned grammar tables; Haskell taint (SQL, command, path,
+  SSRF, HTML), weak crypto, logging, resource and web-route authentication rules; the NixOS effective-configuration resolver with
+  hardening, build-trust and store-secret rules; Haskell and Nix personal-data flows in the Data Flow Explorer; a Haskell
+  catalog generated from one model registry. Unresolved constructs, conditional options, stale inputs and missing feeds become
+  scan-health conditions, so a scan that could not check something is `partial`, never complete.
+- **Supply chain and BOM.** Hackage components with PVP-aware advisory matching (a snapshot you provide), a resolved graph from a
+  fresh Cabal plan or Stack export, Nix flake inputs, an exported closure matched by upstream identity with patch evidence, and
+  AI-BOM entries for model calls and inference services. License data is absent for these records and is disclosed, not guessed.
+- **Fixes.** Verified, tiered, reversible fixes for five Haskell shapes and for Nix effective settings, plus dependency-bound
+  and flake-input edits labelled as needing a re-resolve or re-lock. The planner now follows a flow into the callee that holds
+  the dangerous call. A fix a gate refuses is reported, not applied.
+- **CLI reach.** `fix` and `undo` now work for these languages, `hunt` includes `.hs`/`.nix`, `--since-baseline` filters every
+  bucket (a baselined dependency finding no longer reappears as new), the edit hook catches credentials split across literals, and
+  a Cabal or Nix project is recognised as a project root for state.
+- **Support, measured.** `docs/language-support.md` records per-capability status from a frozen holdout. On the synthetic,
+  template-generated QA-001 corpus every measured layer scores P/R/F1 100%, which says the engine is robust over those shapes and
+  **not** that it is accurate on arbitrary real code. `auth` (Haskell) and `nix-eval` / `nixos-host` (Nix) are **blocked**: no
+  `ghc`, `nix` or NixOS host was available where this was built.
+- **Tooling.** The `npm test` gate now runs the Haskell, Nix and language scopes; `language-stress` and `language-tools` have
+  their own scripts. New CI jobs (`language-suites`, `language-tools-ghc`, `nixos-runtime`) carry explicit deadlines; a
+  `language-support-gate` joins pre-push and the release check. A bounded background-loop controller and runbook
+  (`docs/guides/loop-engineering.md`) are a development tool, not part of the package.
+- **Docs.** New Haskell, Nix/NixOS, NixOS-install and loop guides; tables and example outputs are generated from the registries and
+  from the built bundle, and stale ones fail `npm run docs:check-language`.
+- **Verified and not verified.** The Haskell route fixtures compile under GHC 9.4.8 and the Haskell support table is 9 of 9. NIX-011 (a
+  real controlled evaluation) and NIX-012 (the scanner on a NixOS host, VM checks, and the new `flake.nix`) need Nix and NixOS, which
+  were never available where this was built: they stay blocked rather than faked, and the flake has never been built. The CI jobs
+  that would exercise them are written but have not run.
+
 ## 0.153.2 - Scanner F1 benchmark and dependency-currency CI repaired
 
 The daily `Scanner F1 benchmark` workflow had failed every run since about 2026-08-10. Root causes, each

package/bin/agentic-security.js

@@ -50,9 +50,11 @@ import { toOSCAL } from '../src/report/oscal.js';
 // format had to be added to all three or it silently got human chatter
 // interleaved into its stdout/stderr. One list, one place to update.
 const MACHINE_FORMATS = new Set([
-  'json', 'sarif', 'oscal', 'cyclonedx', 'sbom', 'spdx', 'vex', 'openvex', 'pbom', 'aibom',
+  'json', 'sarif', 'oscal', 'cyclonedx', 'sbom', 'spdx', 'vex', 'openvex', 'pbom', 'aibom', 'mlbom',
 ]);
 function isMachineFormat(fmt) { return MACHINE_FORMATS.has(String(fmt)); }
+// Every output label `scan` produces (the body of cmdScan has one branch per entry).
+const SCAN_FORMATS = new Set(['cli', 'json', 'md', 'markdown', 'sarif', 'oscal', 'stix', 'junit', 'csv', 'html', 'cyclonedx', 'sbom', 'spdx', 'vex', 'openvex', 'pbom', 'aibom', 'aibom-md', 'mlbom', 'ship', 'pro', 'summary']);
 
 // Shared stderr progress reporter for any command that runs a fresh scan —
 // the same `\r[phase] current/total file` status line the default `scan`
@@ -75,7 +77,7 @@ function clearScanProgressLine() {
 }
 import { toCycloneDX, toSPDX } from '../src/posture/sbom.js';
 import { toPBOM } from '../src/sast/pipeline.js';
-import { buildAIBOM, aibomToMarkdown } from '../src/posture/aibom.js';
+import { buildAIBOM, aibomToMarkdown, toCycloneDXMLBOM } from '../src/posture/aibom.js';
 import { recordScan, formatStreakLine, formatGradeDelta } from '../src/posture/streak.js';
 import { loadProfile, saveProfile, detectProfile, renderAttributionLine, ATTRIBUTION, ATTRIBUTION_URL } from '../src/posture/profile.js';
 import { applySuppressions, addSoftAcceptance, expiredSoftAcceptances } from '../src/posture/suppressions.js';
@@ -93,6 +95,16 @@ import * as triage from '../src/posture/triage.js';
 import { buildSlackDigest, buildDiscordDigest, postWebhook, buildJiraIssue, buildPrComment, buildSiemEvent, loadIntegrationConfig } from '../src/integrations/index.js';
 
 import { stateDir, statePath, withStateWritesDisabled } from '../src/posture/state-dir.js';
+
+// A state file is never written THROUGH a symlink: a hostile tree could place a link at `.agentic-security/last-scan.json` and have a
+// scan overwrite whatever it points to. O_NOFOLLOW makes the open itself refuse a link (no check-then-write race); where the flag does
+// not exist an lstat check stands in for it.
+const _NOFOLLOW_FLAGS = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC | (fs.constants.O_NOFOLLOW || 0);
+async function _writeStateNoFollow(file, body) {
+  if (!fs.constants.O_NOFOLLOW) { try { if ((await fsp.lstat(file)).isSymbolicLink()) return false; } catch { /* absent */ } }
+  try { await fsp.writeFile(file, body, { flag: _NOFOLLOW_FLAGS, mode: 0o644 }); return true; }
+  catch (e) { if (e && (e.code === 'ELOOP' || e.code === 'EMLINK')) return false; throw e; }
+}
 import { listGeneratedArtifacts } from '../src/posture/artifact-registry.js';
 // last-scan.json integrity helpers — implementation in posture/integrity.js
 // so the MCP server tools can share verification.
@@ -125,6 +137,7 @@ Commands:
   tickets sync --provider <p>  Two-way sync findings ↔ GitHub Issues / Linear / Jira
   digest --slack <webhook>     Vibecoder: send daily digest to Slack
   mcp                          Start the MCP stdio server (scan_diff, query_taint, explain_finding, apply_fix)
+  lsp                          Start the Language Server Protocol server on stdio (what the editor plugins run)
   validator-cache stats|gc     Inspect / prune .agentic-security/llm-cache/ (use --older-than <days> --dry-run)
   verify [--finding <id>]      Re-run the verifier loop on last-scan findings (use --live --target <url> to execute PoCs)
   ask "<question>" [target]    Bounded local-model Q&A with read-only tool access (requires AGENTIC_SECURITY_LLM_PRESET=ollama)
@@ -194,6 +207,8 @@ Commands:
                                --remote-node <node-id> [--repository <label>]
                                [--relationship data_flow] [--rationale <text>]
                                [--output <file>] [--yes] [--base-digest <hex>]
+                               [--local-target <t>] [--local-config <c>]
+                               [--remote-target <t>] [--remote-config <c>]
                                Declare a CrossRepoLink between a node in the
                                current locally-scanned graph and a node in a
                                remote graph export (dataflow export --format
@@ -234,7 +249,7 @@ Commands:
 Options:
   --profile vibecoder|pro      Override profile for this run
   --only sast|sca|secrets      Limit scan to one pillar
-  --format <fmt>               cli | json | md | sarif | oscal | stix | junit | csv | html | cyclonedx | spdx | pbom | aibom | aibom-md
+  --format <fmt>               cli | json | md | sarif | oscal | stix | junit | csv | html | cyclonedx | spdx | pbom | aibom | aibom-md | mlbom
   --pack <name>                Focus on a curated rule pack (repeatable): owasp-top-10 | cwe-top-25 | llm-security | supply-chain
   --baseline <ref>             Diff against a git ref; only findings new vs. that ref count (ci subcommand)
   --fail-on critical|high|medium|low|none  ci-mode exit policy (default: critical)
@@ -470,12 +485,12 @@ async function writeMachineOutput(targetAbs, scan, meta, profile, args) {
   }
   await fsp.mkdir(stateDirPath, { recursive: true });
   // Always JSON (used by /security-fix and /security-report).
-  await fsp.writeFile(path.join(stateDirPath, 'findings.json'),
+  await _writeStateNoFollow(path.join(stateDirPath, 'findings.json'),
     JSON.stringify(toJSON(scan, meta), null, 2));
   if (profile.profile === 'pro' || profile.machineOutput || (args && args.flags['machine-output'])) {
-    await fsp.writeFile(path.join(stateDirPath, 'findings.sarif'),
+    await _writeStateNoFollow(path.join(stateDirPath, 'findings.sarif'),
       JSON.stringify(toSARIF(scan, meta), null, 2));
-    await fsp.writeFile(path.join(stateDirPath, 'findings.csv'), toCSV(scan));
+    await _writeStateNoFollow(path.join(stateDirPath, 'findings.csv'), toCSV(scan));
   }
 }
 
@@ -613,6 +628,12 @@ async function cmdScan(args) {
   // Load persona profile (R1). Persona-aware defaults flow from here.
   const profile = loadPersonaProfile(targetAbs, args);
   const format = args.flags.format || (profile.profile === 'pro' ? 'cli' : 'ship');
+  // An output label this command does not produce is an error, not a quiet fallback to the summary: a CI job that
+  // asked for `sarif ` or `junit-xml` and got human text would upload garbage and report success.
+  if (!SCAN_FORMATS.has(String(format))) {
+    process.stderr.write(`agentic-security scan: unsupported --format ${JSON.stringify(String(format))}. Supported: ${[...SCAN_FORMATS].join(' | ')}.\n`);
+    return 2;
+  }
   const verbose = !!args.flags.verbose;
   const output = args.flags.output;
   const noNet = !!args.flags['no-network'];
@@ -782,6 +803,9 @@ async function cmdScan(args) {
   if (args.flags['set-baseline']) {
     const { normalizeFindings } = await import('../src/report/index.js');
     const baselineIds = new Set(normalizeFindings(scan).map(f => f.stableId || f.id));
+    // A supply-chain, secret or logic finding's normalised id includes its line, so an unrelated edit above it would make it
+    // look new. Its own producer id (when it has one) does not, so both are recorded.
+    for (const bucket of ['secrets', 'supplyChain', 'logicVulns']) for (const f of scan[bucket] || []) if (f && typeof f.id === 'string' && f.id.includes(':')) baselineIds.add(f.id);
     fs.mkdirSync(path.dirname(baselinePath), { recursive: true });
     fs.writeFileSync(baselinePath, JSON.stringify({ ids: [...baselineIds], createdAt: new Date().toISOString(), count: baselineIds.size }, null, 2));
     process.stderr.write(`[baseline] saved ${baselineIds.size} findings as baseline\n`);
@@ -793,6 +817,20 @@ async function cmdScan(args) {
       const baselineSet = new Set(baseline.ids || []);
       const before = scan.findings.length;
       scan.findings = (scan.findings || []).filter(f => !baselineSet.has(f.stableId || f.id));
+      // The baseline is built from every bucket (findings, secrets, supply chain, logic), so it must be applied to every bucket:
+      // filtering only `findings` left a baselined dependency or secret finding reappearing as "new" on every run.
+      // Identity is the one the baseline was written with: the NORMALISED id (raw supply-chain entries carry a different one).
+      const { normalizeFindings: _norm } = await import('../src/report/index.js');
+      const _empty = { findings: [], secrets: [], supplyChain: [], logicVulns: [], suppressions: [], components: [], routes: [], filesScanned: 0 };
+      for (const bucket of ['secrets', 'supplyChain', 'logicVulns']) {
+        if (!Array.isArray(scan[bucket])) continue;
+        scan[bucket] = scan[bucket].filter((f) => {
+          if (!f) return true;
+          let id = f.stableId || f.id;
+          try { const n = _norm({ ..._empty, [bucket]: [f] })[0]; if (n) id = n.stableId || n.id; } catch { /* keep the raw identity */ }
+          return !baselineSet.has(id) && !(typeof f.id === 'string' && f.id.includes(':') && baselineSet.has(f.id));
+        });
+      }
       process.stderr.write(`[baseline] filtered ${before - scan.findings.length} baseline findings, ${scan.findings.length} new\n`);
     } catch { /* baseline file unreadable, skip */ }
   }
@@ -997,9 +1035,10 @@ async function cmdScan(args) {
   else if (format === 'cyclonedx' || format === 'sbom') body = JSON.stringify(toCycloneDX(scan, meta), null, 2);
   else if (format === 'spdx')                            body = JSON.stringify(toSPDX(scan, meta), null, 2);
   else if (format === 'vex' || format === 'openvex')     body = JSON.stringify(toVex(scan, meta), null, 2);
-  else if (format === 'pbom')                            body = JSON.stringify(toPBOM(scan.fc || {}, meta), null, 2);
-  else if (format === 'aibom')                           body = JSON.stringify(buildAIBOM(scan, scan.fc || {}, meta), null, 2);
-  else if (format === 'aibom-md')                        body = aibomToMarkdown(buildAIBOM(scan, scan.fc || {}, meta));
+  else if (format === 'pbom')                            body = JSON.stringify(toPBOM(scan.fc || {}, meta, { languageBuild: (await import('../src/language/bom.js')).languagePbom({ ...(scan.fc || {}), ...(scan.depFileContents || {}) }) }), null, 2);
+  else if (format === 'aibom')                           body = JSON.stringify(buildAIBOM(scan, scan.fc || {}, { ...meta, manifests: scan.depFileContents || {} }), null, 2);
+  else if (format === 'mlbom')                           body = JSON.stringify(toCycloneDXMLBOM(buildAIBOM(scan, scan.fc || {}, { ...meta, manifests: scan.depFileContents || {} }), meta), null, 2);
+  else if (format === 'aibom-md')                        body = aibomToMarkdown(buildAIBOM(scan, scan.fc || {}, { ...meta, manifests: scan.depFileContents || {} }));
   else if (format === 'ship')  body = toShipVerdict(scan, { profile: effProfile });
   else if (format === 'pro')   body = toProTable(scan, { profile: effProfile, columns: args.flags.columns });
   else if (format === 'cli')   body = toCLIByProfile(scan, { profile: effProfile, columns: args.flags.columns, verbose });
@@ -1143,10 +1182,16 @@ async function cmdScan(args) {
       } catch { /* best-effort, offline-degrading — never block a scan */ }
     }
     const lastScanBody = JSON.stringify(persistedScan, null, 2);
-    await fsp.writeFile(path.join(stateDirPath, 'last-scan.json'), lastScanBody);
+    await _writeStateNoFollow(path.join(stateDirPath, 'last-scan.json'), lastScanBody);
     try {
-      await fsp.writeFile(path.join(stateDirPath, 'last-scan.json.sig'), _signLastScan(lastScanBody));
+      await _writeStateNoFollow(path.join(stateDirPath, 'last-scan.json.sig'), _signLastScan(lastScanBody));
     } catch { /* non-fatal — sig file is best-effort */ }
+    // X-016: Haskell/Nix analysis metadata and BOM as registered, signed artifacts. Written only when the scan has
+    // Haskell or Nix content, so every other project's state directory is unchanged.
+    try {
+      const { persistLanguageArtifacts } = await import('../src/language/state-artifacts.js');
+      persistLanguageArtifacts(path.resolve(target), { ...scan, scanHealth: persistedScan.scanHealth || scan.scanHealth });
+    } catch { /* non-fatal: metadata artifacts never block a scan */ }
     // Sub-project E, increment 5: persist the lineage graph as its own
     // artifact, mirroring last-scan.json's own write+sign pattern exactly
     // — signLastScan/verifyLastScan are fully generic (an arbitrary string
@@ -1158,9 +1203,9 @@ async function cmdScan(args) {
     if (scan.lineageGraph) {
       try {
         const lineageBody = JSON.stringify(scan.lineageGraph, null, 2);
-        await fsp.writeFile(path.join(stateDirPath, 'lineage-graph.json'), lineageBody);
+        await _writeStateNoFollow(path.join(stateDirPath, 'lineage-graph.json'), lineageBody);
         try {
-          await fsp.writeFile(path.join(stateDirPath, 'lineage-graph.json.sig'), _signLastScan(lineageBody));
+          await _writeStateNoFollow(path.join(stateDirPath, 'lineage-graph.json.sig'), _signLastScan(lineageBody));
         } catch { /* non-fatal — sig file is best-effort, same precedent as last-scan.json.sig above */ }
       } catch { /* non-fatal — the lineage artifact write is best-effort and must never block a scan */ }
       // M4 deliverable #8 (FR-503 §14, DFG-022, sub-project 8a): ADDITIVELY
@@ -1301,11 +1346,11 @@ async function cmdCi(args) {
     if (process.env.AGENTIC_SECURITY_DEBUG === '1') process.stderr.write(`[agentic-security] refusing to write CI artifacts at ${stateDirPath} — no project marker\n`);
   } else {
     await fsp.mkdir(stateDirPath, { recursive: true });
-    await fsp.writeFile(path.join(stateDirPath, 'findings.json'),
+    await _writeStateNoFollow(path.join(stateDirPath, 'findings.json'),
       JSON.stringify(toJSON(scan, meta), null, 2));
-    await fsp.writeFile(path.join(stateDirPath, 'findings.sarif'),
+    await _writeStateNoFollow(path.join(stateDirPath, 'findings.sarif'),
       JSON.stringify(toSARIF(scan, meta), null, 2));
-    await fsp.writeFile(path.join(stateDirPath, 'findings.junit.xml'),
+    await _writeStateNoFollow(path.join(stateDirPath, 'findings.junit.xml'),
       toJUnit(scan, meta));
   }
 
@@ -1534,7 +1579,7 @@ async function cmdTriage(args) {
   const lastScanPath = statePath(target, 'findings.json');
   if (fs.existsSync(lastScanPath)) {
     const last = JSON.parse(await fsp.readFile(lastScanPath, 'utf8'));
-    triage.syncWithScan(target, last.findings || []);
+    triage.syncWithScan(target, last.findings || [], { scanHealth: last.scanHealth || null });
   }
   if (sub === 'list') {
     const filter = {};
@@ -2587,8 +2632,8 @@ async function cmdCalibrationReport(args) {
 // Languages the Layer-1 IR parses. Anything else cannot be partitioned into a
 // call-graph focus area, so feeding it to a hunter would spend tokens on files
 // the confirmation gate can never corroborate.
-const HUNT_EXTS = /\.(?:js|jsx|mjs|cjs|ts|tsx|py|java|cs|kt|go|php|rb)$/i;
-const HUNT_IGNORE = ['node_modules/**', '.git/**', 'dist/**', 'build/**', 'vendor/**', '**/.agentic-security/**'];
+const HUNT_EXTS = /\.(?:js|jsx|mjs|cjs|ts|tsx|py|java|cs|kt|go|php|rb|l?hs|nix)$/i;
+const HUNT_IGNORE = ['node_modules/**', '.git/**', 'dist/**', 'build/**', 'vendor/**', '**/.agentic-security/**', 'dist-newstyle/**', '.stack-work/**', '.direnv/**'];
 const HUNT_MAX_FILES = 2000;
 
 async function cmdHunt(args) {
@@ -3408,6 +3453,41 @@ async function cmdFix(args) {
     return 0;
   }
 
+  // Haskell and Nix findings have their own verified fixers (tiered, rescanned, reversible by `undo`); the generic path below
+  // knows nothing about them and used to answer "no mechanical fix" for every one.
+  {
+    const { languageOfFinding, languageFixPreview, loadLanguageProject, isLanguageDependencyFinding, languageUpgradePreview } = await import('../src/language/context.js');
+    if (isLanguageDependencyFinding(f)) {
+      if (isApply && sigVerified !== true) {
+        console.error(`Refusing to apply: last-scan.json integrity check ${sigVerified === false ? 'failed (tampered)' : 'could not verify (unsigned)'} — re-run \`agentic-security scan\` to refresh.`);
+        return 4;
+      }
+      const proj = loadLanguageProject(scanRoot);
+      const res = await languageUpgradePreview(f, { ...proj.files, ...proj.manifests }, { apply: isApply, root: scanRoot, toRef: args.flags.to || null });
+      if (!res.ok) { console.error(`No dependency fix for this finding (${res.status}${res.tier ? `, ${res.tier}` : ''}): ${res.reason || 'unsupported'}`); return 4; }
+      console.log(`${res.label} (${res.tier}): ${res.explanation}`);
+      console.log(res.diff);
+      for (const c of res.consequences || []) console.log(`  note: ${c}`);
+      console.log(isApply ? '\nApplied. This is a source edit only: re-resolve or re-lock, then rescan. Revert with `agentic-security undo`.' : '\nRun with --apply to write this change. Use `agentic-security undo` to revert.');
+      return 0;
+    }
+    if (languageOfFinding(f)) {
+      if (isApply && sigVerified !== true) {
+        console.error(`Refusing to apply: last-scan.json integrity check ${sigVerified === false ? 'failed (tampered)' : 'could not verify (unsigned)'} — re-run \`agentic-security scan\` to refresh.`);
+        return 4;
+      }
+      const proj = loadLanguageProject(scanRoot);
+      const res = await languageFixPreview(f, proj.files, { apply: isApply, root: scanRoot });
+      if (!res.ok) { console.error(`No verified fix for this finding (${res.status}${res.tier ? `, ${res.tier}` : ''}): ${res.reason || 'unsupported'}`); return 4; }
+      console.log(`${res.label || 'FIX'}${res.tier ? ` (${res.tier})` : ''}: ${res.explanation || ''}`.trim());
+      console.log(res.diff);
+      for (const c of res.consequences || []) console.log(`  note: ${c}`);
+      if (isApply) { console.log(`\nApplied. Verified: ${Object.entries(res.gates || {}).map(([k, v]) => `${k}=${v && v.ok === false ? 'FAILED' : (v && v.ran === false ? 'not-run' : 'ok')}`).join(' ')}. Revert with \`agentic-security undo\`.`); }
+      else console.log('\nVerified (syntax, rescan: the finding is gone and nothing new appears). Run with --apply to write this change. Use `agentic-security undo` to revert.');
+      return 0;
+    }
+  }
+
   // FR-303 (assurance-hardening PRD): confine BEFORE the first read, not just
   // before the write — a traversal or symlink-planted f.file was previously
   // followed unquestioned for both the preview diff and the apply write (no
@@ -5558,6 +5638,21 @@ async function cmdGovernancePropose(args) {
 // through to main()'s own outer catch/process.exit(4), the identical,
 // deliberate non-pattern cmdGovernancePropose itself relies on (no local
 // try/catch here either).
+function _federateEndpointScope(node, target, config, graph) {
+  // Node-level limitations when present, plus those of every flow that starts or ends at the node: a Nix or Haskell
+  // flow states its own limits (static configuration evidence, generated-script locations) and a link must not lose them.
+  const lim = new Set(Array.isArray(node && node.limitations) ? node.limitations.filter((x) => typeof x === 'string') : []);
+  for (const f of (graph && Array.isArray(graph.flows) ? graph.flows : [])) {
+    if (f && (f.source === (node && node.id) || f.sink === (node && node.id)) && Array.isArray(f.limitations)) for (const x of f.limitations) if (typeof x === 'string') lim.add(x);
+  }
+  return {
+    target: typeof target === 'string' ? target : null,
+    config: typeof config === 'string' ? config : null,
+    analysis: (node && node.analysis && typeof node.analysis === 'object') ? node.analysis : null,
+    limitations: [...lim].sort(),
+  };
+}
+
 async function cmdFederateDeclare(args) {
   const target = args._[2] || '.'; // args._ = ['federate', 'declare', <path>?]
   const targetAbs = path.resolve(target);
@@ -5680,6 +5775,14 @@ async function cmdFederateDeclare(args) {
       sourceFile: path.resolve(remoteGraphFlag),
       graphId: remote.graph.graphId, graphDigest: remote.digest, nodeId: remoteNodeFlag,
     },
+    // Scope and limitations of both endpoints, copied from the nodes themselves (a Haskell/Nix configuration node says it
+    // is static configuration evidence), plus the operator's own target/config labels. A declared link is an assertion by
+    // an operator, never an observed data flow, and the record says so.
+    scope: {
+      local: _federateEndpointScope(localNode, args.flags['local-target'], args.flags['local-config'], local.graph),
+      remote: _federateEndpointScope(remoteNode, args.flags['remote-target'], args.flags['remote-config'], remote.graph),
+    },
+    evidence: { declared: true, observed: false },
     rationale: args.flags.rationale ?? null,
     declaredBy: process.env.USER || process.env.USERNAME || '(unspecified)',
     declaredAt: new Date().toISOString(),
@@ -5798,6 +5901,8 @@ async function cmdFederateList(args) {
       id: record?.id ?? null,
       local: { nodeId: record?.local?.nodeId ?? null, stillValid: localStillValid },
       remote: { sourceFile: sourceFile ?? null, nodeId: record?.remote?.nodeId ?? null, ...remoteStatus },
+      scope: record?.scope ?? null,
+      evidence: record?.evidence ?? { declared: true, observed: false },
       rationale: record?.rationale ?? null,
       declaredBy: record?.declaredBy ?? null,
       declaredAt: record?.declaredAt ?? null,
@@ -6952,6 +7057,13 @@ async function main() {
         runStdio({ sessionRoot: path.resolve(root) });
         return;
       }
+      case 'lsp':      {
+        // The same server as bin/agentic-security-lsp.js, reachable from the self-contained bundle: a package that ships only the bundle
+        // (the Nix package does) has no node_modules for the src/ entry point to import from.
+        const { startLspServer } = await import('../src/lsp/server.js');
+        startLspServer();
+        return;
+      }
       case 'explore':  process.exit(await cmdExplore(args));
       case 'dataflow': {
         const sub = args._[1];

package/dist/1444.index.js

@@ -8,9 +8,10 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   sweepGitHistory: () => (/* binding */ sweepGitHistory)
 /* harmony export */ });
-/* unused harmony exports extractAddedLines, scanHistoryDiff */
+/* unused harmony exports extractAddedLines, splitDiffByFile, scanHistoryDiff */
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
 /* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(78844);
+/* harmony import */ var _language_secrets_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(95108);
 // R15 (PRD §5) — git-history secret sweep.
 //
 // A secret removed from HEAD but present in any past commit is still
@@ -27,6 +28,7 @@ export const modules = {
 
 
 
+
 // Pull the post-image (added) lines out of a unified diff: lines starting with
 // a single '+' (not the '+++' file header). Returns reconstructed text.
 function extractAddedLines(diffText) {
@@ -37,25 +39,42 @@ function extractAddedLines(diffText) {
   return out.join('\n');
 }
 
+// Split a unified diff into per-file sections with the POST-IMAGE line number of every added line, so a
+// finding can name the file and line it was committed at (the combined text alone loses both).
+function splitDiffByFile(diffText) {
+  const files = [];
+  let cur = null; let next = 0;
+  for (const line of String(diffText || '').split('\n')) {
+    const h = /^diff --git a\/(.+?) b\/(.+)$/.exec(line);
+    if (h) { cur = { path: h[2], added: [] }; files.push(cur); next = 0; continue; }
+    if (!cur) continue;
+    const hh = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hh) { next = parseInt(hh[1], 10); continue; }
+    if (line.startsWith('+++') || line.startsWith('---')) continue;
+    if (line.startsWith('+')) { cur.added.push({ text: line.slice(1), line: next }); next++; }
+    else if (!line.startsWith('-') && !line.startsWith('\\')) next++;
+  }
+  return files;
+}
+
 // Pure: run the injected credential detector over a commit's added lines.
-// detectFn has the scanCredentials(fp, raw) shape and returns Finding[].
-function scanHistoryDiff(diffText, commit, detectFn) {
+// detectFn has the scanCredentials(fp, raw) shape and returns Finding[]. `extra` are additional detectors
+// ((path, text) => Finding[]) run against each file's added lines WITH the real path, so extension-gated
+// detectors (Haskell/Nix split-secret) apply to history too.
+function scanHistoryDiff(diffText, commit, detectFn, extra = []) {
   if (typeof detectFn !== 'function') return [];
-  const added = extractAddedLines(diffText);
-  if (!added.trim()) return [];
-  let findings = [];
-  try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
-  return findings.map((f) => {
-    const remediation = 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.';
-    return {
-      ...f,
+  const sections = splitDiffByFile(diffText);
+  const remediation = 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.';
+  const wrap = (f, sec, addedLines) => {
+    const hit = Number.isInteger(f.line) && f.line >= 1 ? addedLines[f.line - 1] : null;
+    const prov = f.rotation ? {} : (0,_language_secrets_js__WEBPACK_IMPORTED_MODULE_2__/* .providerInfo */ .cf)(f._rawProviderValue || '');
+    const out = {
+      ...f, ...prov,
       id: `secret-history:${commit}:${f.id || f.vuln || 'secret'}`,
-      file: `git-history@${commit}`,
-      line: 0,
-      commit,
-      _historical: true,
+      file: `git-history@${commit}`, line: 0, commit, _historical: true,
+      ...(sec ? { sourceFile: sec.path, sourceLine: hit ? hit.line : null } : {}),
       vuln: `${f.vuln || 'Hardcoded Secret'} (in git history)`,
-      description: `${f.description || 'A credential was committed.'} Found in commit ${commit}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
+      description: `${f.description || 'A credential was committed.'} Found in commit ${commit}${sec ? ` (${sec.path}${hit ? `:${hit.line}` : ''})` : ''}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
       remediation,
       // report/index.js's _remediationOf checks `.fix` before `.remediation`
       // — the underlying detector already set `.fix` to a generic "remove
@@ -64,15 +83,41 @@ function scanHistoryDiff(diffText, commit, detectFn) {
       // insufficient") in every report format.
       fix: remediation,
     };
-  });
+    delete out._rawProviderValue;
+    return out;
+  };
+  const results = [];
+  if (!sections.length) {
+    const added = extractAddedLines(diffText);
+    if (!added.trim()) return [];
+    let findings = [];
+    try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
+    return findings.map((f) => wrap(f, null, []));
+  }
+  for (const sec of sections) {
+    if (!sec.added.length) continue;
+    const text = sec.added.map((a) => a.text).join('\n');
+    if (!text.trim()) continue;
+    let findings = [];
+    try { findings = detectFn(`git-history@${commit}`, text) || []; } catch { findings = []; }
+    for (const f of findings) results.push(wrap(f, sec, sec.added));
+    for (const ex of extra || []) {
+      let more = [];
+      try { more = ex(sec.path, text) || []; } catch { more = []; }
+      for (const f of more) results.push(wrap(f, sec, sec.added));
+    }
+  }
+  return results;
 }
 
+const defaultExtra = [_language_secrets_js__WEBPACK_IMPORTED_MODULE_2__/* .scanLanguageSecretConcat */ ._d, _language_secrets_js__WEBPACK_IMPORTED_MODULE_2__/* .scanDependencyUrlCredentials */ .y6];
+
 /**
  * Sweep up to `maxCommits` of recent history for secrets. Best-effort: returns
  * [] when `scanRoot` is not a git repo or git is unavailable. Dedups a secret
  * that recurs across commits to its earliest sighting.
  */
-function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000 } = {}) {
+function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000, extraDetectors = null } = {}) {
   if (!scanRoot || typeof detectFn !== 'function') return [];
   let out;
   try {
@@ -91,7 +136,7 @@ function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 2000
   const seen = new Set();
   for (let i = 1; i < parts.length; i += 2) {
     const sha = (parts[i] || '').slice(0, 12);
-    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn)) {
+    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn, extraDetectors || defaultExtra)) {
       const key = `${f.vuln}:${(f.snippet || f.match || '').slice(0, 40)}`;
       if (seen.has(key)) continue;
       seen.add(key);

package/dist/1905.index.js

@@ -13,6 +13,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 // UNUSED EXPORTS: makeBudget, makeTaintProbe
 
+// EXTERNAL MODULE: ./src/language/discovery.js
+var discovery = __webpack_require__(30951);
 // EXTERNAL MODULE: external "node:crypto"
 var external_node_crypto_ = __webpack_require__(77598);
 ;// CONCATENATED MODULE: ./src/discovery/partition.js
@@ -32,6 +34,7 @@ var external_node_crypto_ = __webpack_require__(77598);
 // comes straight back.
 
 
+
 function focusAreaId(files) {
   const canon = [...new Set(files || [])].sort().join('\n');
   return external_node_crypto_.createHash('sha256').update(canon).digest('hex').slice(0, 12);
@@ -109,6 +112,33 @@ function partitionCallGraph(callGraph, opts = {}) {
   return areas;
 }
 
+/**
+ * Focus areas for Nix configuration, which has no call graph: files joined by `imports` / path references form one
+ * area, so a NixOS entry point and the modules that decide its options are hunted together. Same shape as a call-graph
+ * area (`functions` is empty: a Nix file has none).
+ */
+function partitionNixFiles(fileContents, opts = {}) {
+  const maxAreas = Number.isInteger(opts.maxAreas) && opts.maxAreas > 0 ? opts.maxAreas : 8;
+  const nix = {};
+  for (const [f, t] of Object.entries(fileContents || {})) if (/\.nix$/i.test(f) && typeof t === 'string') nix[f] = t;
+  const files = Object.keys(nix).sort();
+  if (!files.length) return [];
+  const { graph } = (0,discovery/* buildImportGraph */.oK)(nix);
+  const dsu = makeDSU();
+  for (const f of files) dsu.find(f);
+  for (const [f, deps] of graph) for (const d of deps) dsu.union(f, d);
+  const groups = new Map();
+  for (const f of files) { const r = dsu.find(f); if (!groups.has(r)) groups.set(r, []); groups.get(r).push(f); }
+  let areas = [...groups.values()].map((g) => { const sorted = [...g].sort(); return { id: focusAreaId(sorted), label: labelFor(sorted), files: sorted, functions: [], size: sorted.length, language: 'nix' }; });
+  areas.sort((a, b) => b.size - a.size || (a.id < b.id ? -1 : 1));
+  if (areas.length > maxAreas) {
+    const kept = areas.slice(0, maxAreas - 1); const tail = areas.slice(maxAreas - 1).flatMap((a) => a.files).sort();
+    kept.push({ id: focusAreaId(tail), label: 'misc', files: tail, functions: [], size: tail.length, language: 'nix' });
+    areas = kept;
+  }
+  return areas;
+}
+
 // EXTERNAL MODULE: ./src/discovery/lenses.js
 var discovery_lenses = __webpack_require__(33499);
 // EXTERNAL MODULE: ./src/egress/policy.js
@@ -1057,7 +1087,16 @@ function makeBudget(opts = {}, now = Date.now) {
 }
 
 async function runDiscovery(ctx = {}, opts = {}) {
-  const areas = partitionCallGraph(ctx.callGraph, { maxAreas: opts.maxAreas ?? 8 });
+  // Call-graph areas (every language the IR covers, Haskell included) plus Nix configuration areas, which have no call
+  // graph. Together they respect the same ceiling.
+  const maxAreas = opts.maxAreas ?? 8;
+  let areas = [...partitionCallGraph(ctx.callGraph, { maxAreas }), ...partitionNixFiles(ctx.fileContents, { maxAreas })];
+  if (areas.length > maxAreas) {
+    const kept = areas.slice(0, maxAreas - 1); const tail = areas.slice(maxAreas - 1);
+    const files = [...new Set(tail.flatMap((a) => a.files))].sort();
+    kept.push({ id: tail.map((a) => a.id).join('+').slice(0, 64), label: 'misc', files, functions: tail.flatMap((a) => a.functions), size: tail.reduce((n, a) => n + a.size, 0) });
+    areas = kept;
+  }
 
   const reasons = [];
   const budget = makeBudget(opts);
@@ -1095,7 +1134,7 @@ async function runDiscovery(ctx = {}, opts = {}) {
   for (const area of areas) {
     let areaDegradedCount = 0;
     for (const lens of lenses) {
-      const run = await runHunter(area, lens, { fileContents: ctx.fileContents || {} }, { llmInvoke, scanRoot: opts.scanRoot });
+      const run = await runHunter(area, lens, { fileContents: ctx.fileContents || {}, scanRoot: opts.scanRoot }, { llmInvoke, scanRoot: opts.scanRoot });
       runs.push({ focusAreaId: run.focusAreaId, lens: run.lens, degraded: run.degraded, reason: run.reason, candidateCount: run.candidates.length });
       if (run.degraded && run.reason) reasons.push(`${area.label} × ${lens.key}: ${run.reason}`);
       if (run.degraded) areaDegradedCount += 1;
@@ -1267,6 +1306,7 @@ async function runDiscovery(ctx = {}, opts = {}) {
 /* harmony export */   LENSES: () => (/* binding */ LENSES),
 /* harmony export */   j: () => (/* binding */ buildHunterPrompt)
 /* harmony export */ });
+/* harmony import */ var _egress_redact_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(74831);
 //
 // The seven hunting lenses. Each hunter run is one (focus area × lens) pair.
 //
@@ -1276,6 +1316,7 @@ async function runDiscovery(ctx = {}, opts = {}) {
 // same code than one told to look at crypto, so the union covers failure modes
 // no single prompt reaches. `wildcard` exists because a fixed taxonomy is a
 // ceiling, and the classes worth finding are the ones not on the list.
+
 const LENSES = Object.freeze([
   { key: 'injection', title: 'Injection', family: 'injection', cwe: 'CWE-74',
     brief: 'Untrusted input reaching an interpreter: SQL, shell, template, XPath, LDAP, or deserialization. Follow the value, not the function name.' },
@@ -1308,7 +1349,9 @@ function buildHunterPrompt(focusArea, lens, ctx = {}) {
   let budget = maxChars;
   const blocks = [];
   for (const f of files) {
-    const src = contents[f];
+    // Everything that leaves the machine is redacted first (secrets, PII/PHI/PCI-shaped fields, operator-declared
+    // customer data, and whole proprietary paths), by the same choke point the validator and the proposers use.
+    const src = (0,_egress_redact_js__WEBPACK_IMPORTED_MODULE_0__/* .redactPayload */ .cy)({ text: contents[f], filePath: f, scanRoot: ctx.scanRoot || null }).text;
     const slice = src.length > budget ? src.slice(0, Math.max(0, budget)) : src;
     const truncated = slice.length < src.length;
     blocks.push(`--- SOURCE FILE (untrusted data): ${f}${truncated ? ' (truncated)' : ''} ---\n${slice}\n--- END SOURCE FILE: ${f} ---`);