@clear-capabilities/agentic-security-scanner 0.153.2 → 0.155.0

package/src/language/discovery.js

@@ -0,0 +1,359 @@
+// Shared discovery registry for Haskell and Nix inputs (CORE-002).
+//
+// One place answers "is this path a Haskell/Nix source, a manifest, an explicit
+// export, or build output to stay out of?", so the scan walker (runScan.js), the
+// per-file filter (engine.js shouldScan), the watch filter (posture/watch-mode.js)
+// and the incremental-invalidation key all agree. Before this module the answer
+// was copied into each of those and would have drifted.
+//
+// Everything here is static: nothing is executed and nothing is read outside the
+// scan root. Paths are '/'-separated and relative to the root.
+//
+// Three deliberate rules:
+//
+//   * Build output is out of ordinary traversal. `dist-newstyle/`, `.stack-work/`,
+//     `.direnv/` and anything under `nix/store/` hold generated sources, caches
+//     and a store closure that is neither the project's code nor bounded in size.
+//   * An EXPLICIT export inside such a directory is the one exception, and it is
+//     read by exact path (`readExplicitExports`), never by recursing into the
+//     directory. A tool-written plan file is evidence; the directory around it is
+//     not.
+//   * Every graph walk is bounded (nodes, depth, imports per file) and every
+//     resolved path must stay inside the scan root. A bound hit is reported as
+//     `truncated`, never silently dropped.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+
+const SOURCE_RE = /\.(lhs-boot|hs-boot|lhs|hs|hsig|hsc|nix)$/i;
+const NIX_RE = /\.nix$/i;
+
+const MANIFEST_NAMES = new Set([
+  'cabal.project', 'cabal.project.freeze', 'cabal.project.local', 'cabal.config',
+  'stack.yaml', 'stack.yaml.lock', 'package.yaml', 'hie.yaml',
+  'flake.nix', 'flake.lock', 'default.nix', 'shell.nix',
+]);
+
+// Directory names that hold build output or a store closure. Matched per path
+// segment, plus the two-segment `nix/store`.
+const EXCLUDED_DIRS = new Set(['dist-newstyle', '.stack-work', '.cabal-sandbox', '.direnv']);
+
+// Exact project-relative paths a user or tool writes on purpose. Resolved per
+// project directory, never by walking the excluded directory that holds them.
+export const EXPLICIT_EXPORTS = Object.freeze([
+  'dist-newstyle/cache/plan.json',
+  '.stack-work/dependencies.json',
+  '.direnv/nix-export.json',
+  'nix-export.json',
+]);
+
+export const DEFAULT_BUDGETS = Object.freeze({
+  maxNodes: 5000,
+  maxDepth: 32,
+  maxImportsPerFile: 256,
+  maxExportBytes: 10_000_000,
+  maxProjectDirs: 256,
+});
+
+const norm = (p) => String(p || '').replace(/\\/g, '/');
+const sha = (s) => crypto.createHash('sha256').update(s).digest('hex');
+
+export function isLanguageSource(rel) {
+  return SOURCE_RE.test(norm(rel));
+}
+
+export function isLanguageManifest(rel) {
+  const base = norm(rel).split('/').pop() || '';
+  return MANIFEST_NAMES.has(base) || /\.cabal$/i.test(base);
+}
+
+export function languageOf(rel) {
+  const p = norm(rel);
+  if (NIX_RE.test(p)) return 'nix';
+  if (SOURCE_RE.test(p)) return 'haskell';
+  const base = p.split('/').pop() || '';
+  if (/\.cabal$/i.test(base) || /^(?:cabal\.|stack\.yaml|package\.yaml|hie\.yaml)/.test(base)) return 'haskell';
+  if (base === 'flake.lock') return 'nix';
+  return null;
+}
+
+export function isLanguageExcludedPath(rel) {
+  const p = norm(rel);
+  const segs = p.split('/');
+  for (let i = 0; i < segs.length; i++) {
+    if (EXCLUDED_DIRS.has(segs[i])) return true;
+    if (segs[i] === 'nix' && segs[i + 1] === 'store') return true;
+  }
+  return false;
+}
+
+export function isExplicitExport(rel) {
+  const p = norm(rel);
+  return EXPLICIT_EXPORTS.some((e) => p === e || p.endsWith('/' + e));
+}
+
+// Glob patterns for the walker's ignore list. Pruning only; correctness comes
+// from the per-file predicates above.
+export const WALK_IGNORE_GLOBS = Object.freeze([
+  '**/dist-newstyle/**', '**/.stack-work/**', '**/.cabal-sandbox/**', '**/.direnv/**', '**/nix/store/**',
+]);
+
+function within(root, abs) {
+  const r = path.resolve(root);
+  const a = path.resolve(abs);
+  return a === r || a.startsWith(r + path.sep);
+}
+
+/**
+ * Read the explicit exports for every project directory (root plus the
+ * directory of each manifest in `manifestRels`). Exact-path reads only: lstat
+ * rejects symlinks, realpath must stay inside `root`, and the size is capped.
+ * Returns { contents: {rel: text}, skipped: [{path, reason}] }.
+ */
+export function readExplicitExports(root, manifestRels = [], budgets = {}) {
+  const b = { ...DEFAULT_BUDGETS, ...budgets };
+  const contents = {};
+  const skipped = [];
+  let realRoot;
+  try { realRoot = fs.realpathSync(root); } catch { return { contents, skipped }; }
+  const dirs = new Set(['']);
+  for (const m of manifestRels) {
+    if (dirs.size >= b.maxProjectDirs) { skipped.push({ path: m, reason: 'project-dir-budget' }); break; }
+    const d = path.posix.dirname(norm(m));
+    if (!isLanguageExcludedPath(d)) dirs.add(d === '.' ? '' : d);
+  }
+  for (const d of [...dirs].sort()) {
+    for (const e of EXPLICIT_EXPORTS) {
+      const rel = d ? `${d}/${e}` : e;
+      const abs = path.join(root, rel);
+      let st;
+      try { st = fs.lstatSync(abs); } catch { continue; }
+      if (st.isSymbolicLink()) { skipped.push({ path: rel, reason: 'symlink' }); continue; }
+      if (!st.isFile()) continue;
+      if (st.size > b.maxExportBytes) { skipped.push({ path: rel, reason: 'too-large' }); continue; }
+      let real;
+      try { real = fs.realpathSync(abs); } catch { continue; }
+      if (!within(realRoot, real)) { skipped.push({ path: rel, reason: 'escapes-root' }); continue; }
+      try { contents[rel] = fs.readFileSync(abs, 'utf8'); } catch { /* unreadable */ }
+    }
+  }
+  return { contents, skipped };
+}
+
+/**
+ * Describe a source file's declared scope and keep its source locations.
+ * `code` has exactly the same number of lines as `content` and every code
+ * character stays at its original column, so a position found in `code` is the
+ * same position in the file on disk.
+ *   .lhs / .lhs-boot  bird-track ("> ") and \begin{code} blocks are code
+ *   .hs-boot          scope 'boot-interface'
+ *   .hsig             scope 'signature'
+ *   .hsc              '#' preprocessor lines are blanked, scope 'preprocessed'
+ */
+export function describeSource(rel, content) {
+  const p = norm(rel);
+  const lang = languageOf(p);
+  const text = String(content ?? '');
+  const lower = p.toLowerCase();
+  let kind = 'plain';
+  let scope = lang === 'nix' ? 'nix-expression' : 'module';
+  if (/\.lhs-boot$/.test(lower)) { kind = 'literate-boot'; scope = 'boot-interface'; }
+  else if (/\.hs-boot$/.test(lower)) { kind = 'boot'; scope = 'boot-interface'; }
+  else if (/\.lhs$/.test(lower)) kind = 'literate';
+  else if (/\.hsig$/.test(lower)) { kind = 'signature'; scope = 'signature'; }
+  else if (/\.hsc$/.test(lower)) { kind = 'hsc'; scope = 'preprocessed'; }
+
+  const lines = text.split('\n');
+  let outLines = lines;
+  if (kind === 'literate' || kind === 'literate-boot') {
+    let inBlock = false;
+    outLines = lines.map((l) => {
+      if (/^\s*\\begin\{code\}/.test(l)) { inBlock = true; return ''; }
+      if (/^\s*\\end\{code\}/.test(l)) { inBlock = false; return ''; }
+      if (inBlock) return l;
+      if (l.startsWith('>')) return ' ' + l.slice(1);
+      return '';
+    });
+  } else if (kind === 'hsc') {
+    outLines = lines.map((l) => (/^\s*#/.test(l) ? '' : l));
+  }
+  const code = outLines.join('\n');
+  const m = lang === 'haskell' ? /^\s*(?:module|signature)\s+([A-Z][\w.']*)/m.exec(code) : null;
+  return {
+    language: lang, kind, scope,
+    declaredModule: m ? m[1] : null,
+    code,
+    lineCount: lines.length,
+  };
+}
+
+const HS_IMPORT_RE = /^\s*import\s+(?:\{-#\s*SOURCE\s*#-\}\s+)?(?:safe\s+)?(?:qualified\s+)?(?:"[^"]*"\s+)?([A-Z][\w.']*)/gm;
+const NIX_PATH_RE = /(?<![\w.\/~-])(\.{1,2}\/[\w.\/+@-]+)/g;
+
+// Map module name -> file keys, from the paths themselves. `src/Foo/Bar.hs`
+// registers `Foo.Bar` and `Bar`; lower-case directories end the module path.
+function haskellModuleIndex(keys) {
+  const idx = new Map();
+  for (const k of keys) {
+    if (!/\.(?:lhs-boot|hs-boot|lhs|hs|hsig|hsc)$/i.test(k)) continue;
+    const segs = k.replace(/\.(?:lhs-boot|hs-boot|lhs|hs|hsig|hsc)$/i, '').split('/');
+    const parts = [];
+    for (let i = segs.length - 1; i >= 0 && /^[A-Z]/.test(segs[i]); i--) {
+      parts.unshift(segs[i]);
+      const name = parts.join('.');
+      if (!idx.has(name)) idx.set(name, []);
+      idx.get(name).push(k);
+    }
+  }
+  return idx;
+}
+
+function commonPrefixLen(a, b) {
+  const x = a.split('/'); const y = b.split('/');
+  let n = 0;
+  while (n < x.length - 1 && n < y.length - 1 && x[n] === y[n]) n++;
+  return n;
+}
+
+/**
+ * Local import edges within `fileContents` (the already root-confined scan
+ * set). Returns { graph: Map<rel, string[]>, escaped: [{file, spec}] } where
+ * `escaped` lists Nix path literals that resolve outside the root. Unresolved
+ * imports (packages, store paths) add no edge.
+ */
+export function buildImportGraph(fileContents, budgets = {}) {
+  const b = { ...DEFAULT_BUDGETS, ...budgets };
+  const keys = Object.keys(fileContents).map(norm).filter(isLanguageSource).sort();
+  const keySet = new Set(keys);
+  const modIdx = haskellModuleIndex(keys);
+  const graph = new Map();
+  const escaped = [];
+  for (const k of keys) {
+    const deps = new Set();
+    const text = String(fileContents[k] ?? '');
+    if (languageOf(k) === 'haskell') {
+      const code = describeSource(k, text).code;
+      let n = 0; let m;
+      HS_IMPORT_RE.lastIndex = 0;
+      while ((m = HS_IMPORT_RE.exec(code)) && n++ < b.maxImportsPerFile) {
+        const cands = (modIdx.get(m[1]) || []).filter((c) => c !== k);
+        if (!cands.length) continue;
+        cands.sort((x, y) => commonPrefixLen(k, y) - commonPrefixLen(k, x) || (x < y ? -1 : 1));
+        deps.add(cands[0]);
+      }
+    } else {
+      let n = 0; let m;
+      NIX_PATH_RE.lastIndex = 0;
+      while ((m = NIX_PATH_RE.exec(text)) && n++ < b.maxImportsPerFile) {
+        const spec = m[1].replace(/[.,;]+$/, '');
+        const joined = path.posix.normalize(path.posix.join(path.posix.dirname(k), spec));
+        if (joined.startsWith('../') || joined === '..' || path.posix.isAbsolute(joined)) { escaped.push({ file: k, spec }); continue; }
+        for (const c of [joined, `${joined}.nix`, `${joined}/default.nix`]) {
+          if (keySet.has(c) && c !== k) { deps.add(c); break; }
+        }
+      }
+    }
+    graph.set(k, [...deps].sort());
+  }
+  return { graph, escaped };
+}
+
+/** Transitive closure of `start` over `graph`, cycle-safe and bounded. */
+export function importClosure(graph, start, budgets = {}) {
+  const b = { ...DEFAULT_BUDGETS, ...budgets };
+  const seen = new Set([start]);
+  let frontier = [start];
+  let truncated = false;
+  for (let depth = 0; frontier.length; depth++) {
+    if (depth >= b.maxDepth) { truncated = true; break; }
+    const next = [];
+    for (const f of frontier) {
+      for (const d of graph.get(f) || []) {
+        if (seen.has(d)) continue;
+        if (seen.size >= b.maxNodes) { truncated = true; break; }
+        seen.add(d); next.push(d);
+      }
+    }
+    frontier = next;
+  }
+  seen.delete(start);
+  return { files: [...seen].sort(), truncated };
+}
+
+/**
+ * Per-file invalidation digests. A file's digest covers its own content, the
+ * content of every module it transitively imports, every language manifest
+ * (lockfile, project flags, target/configuration), every explicit export, and
+ * the library-model inputs. Change any of them and every file whose digest
+ * depended on it changes.
+ */
+export function computeLanguageDigests(fileContents, { manifests = {}, models = {}, budgets = {} } = {}) {
+  const { graph, escaped } = buildImportGraph(fileContents, budgets);
+  const project = crypto.createHash('sha256');
+  for (const [label, map] of [['m', manifests], ['l', models]]) {
+    for (const k of Object.keys(map).sort()) {
+      project.update(label + k + '\0' + sha(String(map[k] ?? '')) + '\n');
+    }
+  }
+  const projectDigest = project.digest('hex');
+  const digests = new Map();
+  let truncated = false;
+  for (const k of graph.keys()) {
+    const cl = importClosure(graph, k, budgets);
+    if (cl.truncated) truncated = true;
+    const h = crypto.createHash('sha256');
+    h.update(projectDigest + '\n' + k + '\0' + sha(String(fileContents[k] ?? '')) + '\n');
+    for (const d of cl.files) h.update(d + '\0' + sha(String(fileContents[d] ?? '')) + '\n');
+    digests.set(k, h.digest('hex'));
+  }
+  return { digests, graph, escaped, truncated, projectDigest };
+}
+
+function collectManifests(fileContents, depFileContents) {
+  const out = {};
+  for (const map of [fileContents, depFileContents]) {
+    for (const k of Object.keys(map || {})) {
+      if (isLanguageManifest(k) || isExplicitExport(k)) out[norm(k)] = map[k];
+    }
+  }
+  return out;
+}
+
+/**
+ * A copy of `fileContents` whose Haskell/Nix sources carry their import-closure
+ * digest, for use as the checkpoint's per-file hash input. Other entries keep
+ * their exact value, and with no Haskell/Nix source the SAME object is returned,
+ * so scans of other languages are untouched.
+ */
+export function withLanguageClosure(fileContents, depFileContents = {}, opts = {}) {
+  const hasLang = Object.keys(fileContents || {}).some(isLanguageSource);
+  if (!hasLang) return fileContents;
+  const { digests } = computeLanguageDigests(fileContents, { manifests: collectManifests(fileContents, depFileContents), models: opts.models || {}, budgets: opts.budgets });
+  const out = { ...fileContents };
+  for (const [k, d] of digests) out[k] = `${fileContents[k]}\n\0closure:${d}`;
+  return out;
+}
+
+/**
+ * Files whose cached results are stale after a change: the changed files, every
+ * file that transitively imports one, and (for a manifest, export or model
+ * change) every Haskell/Nix source.
+ */
+export function impactedFiles(fileContents, depFileContents, changedRels, opts = {}) {
+  const changed = new Set([...changedRels].map(norm));
+  const { graph } = buildImportGraph(fileContents, opts.budgets);
+  const all = [...graph.keys()];
+  const broad = [...changed].some((c) => isLanguageManifest(c) || isExplicitExport(c) || (opts.modelRels || []).includes(c));
+  if (broad) return all;
+  const out = new Set([...changed].filter((c) => graph.has(c)));
+  const rev = new Map();
+  for (const [k, ds] of graph) for (const d of ds) { if (!rev.has(d)) rev.set(d, []); rev.get(d).push(k); }
+  let frontier = [...out];
+  while (frontier.length) {
+    const next = [];
+    for (const f of frontier) for (const r of rev.get(f) || []) if (!out.has(r)) { out.add(r); next.push(r); }
+    frontier = next;
+  }
+  return [...out].sort();
+}

package/src/language/engine-pass.js

@@ -0,0 +1,120 @@
+// Language supply-chain pass for the scan engine. Nix fetch/build/cache trust findings are
+// supply-chain entries, so they join the ordinary `supplyChain` bucket (and from there SCA
+// policy, scan health and every report) instead of a side channel. Static only: nothing here
+// evaluates Nix, fetches a URL or runs a builder.
+
+import { resolvedHackageComponents, analyzeNixClosure } from './resolved-pass.js';
+import { analyzeNixBuildTrust } from './nix-build-trust.js';
+import { isLanguageExcludedPath, buildImportGraph } from './discovery.js';
+import { analyzeHaskellSupply } from './haskell-supply.js';
+import { analyzeNixScripts } from './nix-script-taint.js';
+import { analyzeNixSecrets } from './nix-secrets.js';
+import { analyzeNixAgents } from './nix-agents.js';
+import { analyzeNixosHardening } from './nixos-hardening.js';
+
+const isNixSource = (p) => /\.nix$/i.test(p);
+const isFlakeLock = (p) => /(^|\/)flake\.lock$/i.test(p);
+
+/**
+ * @param {Record<string,string>} files rel path -> content (sources and manifests as the engine read them)
+ * @returns {{supplyChain: object[], gaps: object[], analyzed: number}}
+ */
+const NIXOS_OPTION = /(?:^|[\s;{])(?:services|networking|security|systemd|users|environment|programs|boot|virtualisation|nix)\.[A-Za-z_]|(?:^|[\s;{])(?:services|networking|security|systemd|users|environment|programs|boot|virtualisation)\s*=\s*\{/m;
+
+/** NixOS entry points of a Nix file set: every configuration.nix, else every module nothing imports (capped). */
+export function nixosEntries(nix, { max = 15 } = {}) {
+  const conf = Object.keys(nix).filter((p) => /(?:^|\/)configuration\.nix$/i.test(p)).sort().slice(0, 5);
+  const imported = new Set();
+  try { const { graph } = buildImportGraph(nix); for (const deps of graph.values()) for (const d of deps) imported.add(d); } catch { /* no import graph */ }
+  const standalone = Object.keys(nix).filter((p) => !conf.includes(p) && !imported.has(p) && !/(?:^|\/)flake\.nix$/i.test(p) && NIXOS_OPTION.test(nix[p])).sort().slice(0, max);
+  return [...conf, ...standalone];
+}
+
+function _baseSupplyChain(files = {}, opts = {}) {
+  const nix = {};
+  for (const [p, text] of Object.entries(files)) {
+    if (typeof text !== 'string') continue;
+    if (!(isNixSource(p) || isFlakeLock(p))) continue;
+    if (isLanguageExcludedPath(p)) continue;
+    nix[p] = text;
+  }
+  // Haskell: Hackage advisories and source/name policy (manifests, a freeze or a plan, and the .hs imports).
+  const hs = analyzeHaskellSupply(files, { root: opts.scanRoot || null, resolved: opts.resolved || null });
+  const sources = Object.keys(nix).filter(isNixSource);
+  if (!sources.length) {
+    if (!hs.components.length) return { supplyChain: [], gaps: [], analyzed: 0 };
+    return { supplyChain: hs.supplyChain, gaps: hs.gaps, analyzed: hs.components.length, haskell: hs };
+  }
+  // The effective configuration is decided from an ENTRY: configuration.nix when there is one, otherwise each NixOS module that
+  // nothing imports (a flake's host file under any name). With no entry at all only the file-local rules run.
+  const entries = nixosEntries(nix);
+  const reports = entries.length ? entries.map((entry) => analyzeNixBuildTrust({ files: nix, entry })) : [analyzeNixBuildTrust({ files: nix })];
+  const seenIds = new Set(); const merged = []; const gaps = [];
+  for (const r of reports) {
+    for (const f of r.findings) { const k = f.id || `${f.rule}|${f.file}|${f.line}`; if (!seenIds.has(k)) { seenIds.add(k); merged.push(f); } }
+    for (const g of r.gaps) gaps.push(g);
+  }
+  return { supplyChain: [...hs.supplyChain, ...merged], gaps: [...hs.gaps, ...gaps], analyzed: sources.length + hs.components.length, haskell: hs };
+}
+
+/**
+ * Findings (not supply-chain entries) from Nix: embedded-shell taint (NIX-003). Returns the findings plus the
+ * coverage gaps (unsupported shells, scripts built by expressions) so scan health can report them.
+ */
+export function analyzeLanguageFindings(files = {}) {
+  const nix = {};
+  for (const [p, text] of Object.entries(files)) {
+    if (typeof text !== 'string' || !isNixSource(p) || isLanguageExcludedPath(p)) continue;
+    nix[p] = text;
+  }
+  if (!Object.keys(nix).length) return { findings: [], gaps: [], analyzed: 0 };
+  const r = analyzeNixScripts({ files: nix });
+  // secret placement sees referenced data files (sopsFile / agenix file) as well as the Nix sources
+  const sec = analyzeNixSecrets({ files: { ...files, ...nix } });
+  let agents = { findings: [] };
+  try { agents = analyzeNixAgents(files); } catch { /* agent/MCP rules are best effort */ }
+  // NIX-004: effective-configuration hardening, judged per NixOS entry point (configuration.nix). A finding with no
+  // option source (a catalog default decided it) is anchored to the entry file at line 1 and says so, so it can be
+  // reported, attributed and suppressed instead of being lineless. The files that decided the value travel with it.
+  const hardening = [];
+  const effective = [];
+  // Entry points: every configuration.nix, plus NixOS modules NOTHING imports (a standalone module, a flake's host file under any
+  // name): its options are the only place their values are decided, and a file name is not what makes a configuration real.
+  const confEntries = Object.keys(nix).filter((p) => /(?:^|\/)configuration\.nix$/i.test(p)).sort().slice(0, 5);
+  const entryList = nixosEntries(nix);
+  for (const entry of entryList) {
+    try {
+      const h = analyzeNixosHardening({ entry, files: nix });
+      effective.push({ entry, completeness: h.reconciliation && h.reconciliation.completeness, unresolved: (h.reconciliation && h.reconciliation.unanalyzed) || [], truncated: [], target: h.target });
+      for (const f of h.findings) {
+        const ctl = [...new Set((f.evidence || []).flatMap((e) => (e.sources || []).map((x) => x.file)).filter(Boolean))];
+        const anchored = Number.isInteger(f.line) && f.file;
+        hardening.push({ ...f, file: anchored ? f.file : entry, line: anchored ? f.line : 1, locationKind: anchored ? 'option-source' : 'target-level', controlFiles: ctl, entry, entryKind: confEntries.includes(entry) ? 'configuration' : 'standalone-module', optionEvidence: f.evidence, option: f.evidence && f.evidence[0] ? f.evidence[0].option : null });
+      }
+    } catch (e) { r.gaps.push({ kind: 'hardening-failed', file: entry, reason: String((e && e.message) || e) }); }
+  }
+  // Two different rules of one family can land on the same line (a one-line configuration, or several defaults that
+  // anchor at the entry). The engine's per-(file, line, family) de-duplication must not merge them into one finding, so
+  // each carries a site key built from what makes it a different finding. The key also feeds the stable id.
+  const keyed = (list, parts) => list.map((f) => (f && f.siteKey ? f : { ...f, siteKey: parts(f).filter((x) => x !== null && x !== undefined && x !== '').join('|') }));
+  const out = [
+    ...keyed(r.findings, (f) => [f.rule, f.attrPath, f.sink && f.sink.command, f.generatedLocation && `${f.generatedLocation.line}:${f.generatedLocation.startColumn}`]),
+    ...keyed(sec.findings, (f) => [f.rule, f.source && f.source.detail, f.destination && f.destination.label]),
+    ...agents.findings,
+    ...keyed(hardening, (f) => [f.rule, f.subject]),
+  ];
+  return { findings: out, gaps: [...r.gaps, ...sec.gaps], analyzed: r.analyzed, effectiveConfigs: effective };
+}
+
+/**
+ * The language supply chain: declared and resolved Hackage dependencies, Nix inputs and build trust, and (when the project exported
+ * one) the Nix closure matched against an advisory snapshot. The resolved data comes from EXPLICIT export files only.
+ */
+export function analyzeLanguageSupplyChain(files = {}, opts = {}) {
+  let resolved = null; let closure = null;
+  try { resolved = resolvedHackageComponents(files); } catch { resolved = null; }
+  try { closure = analyzeNixClosure(files, { scanRoot: opts.scanRoot || null }); } catch (e) { closure = { findings: [], gaps: [{ kind: 'closure-analysis-failed', detail: String((e && e.message) || e).slice(0, 160) }], statuses: [], sources: [], status: 'failed' }; }
+  const base = _baseSupplyChain(files, { ...opts, resolved });
+  if (!closure) return resolved && resolved.summary ? { ...base, resolved: resolved.summary } : base;
+  return { ...base, supplyChain: [...base.supplyChain, ...closure.findings], gaps: [...(base.gaps || []), ...closure.gaps], analyzed: (base.analyzed || 0) + closure.statuses.length, resolved: resolved && resolved.summary, nixClosure: closure };
+}

package/src/language/fix-lifecycle.js

@@ -0,0 +1,120 @@
+// The verified-remediation lifecycle shared by the language fixers (Haskell, Nix).
+//
+// A fix is APPLIED only after every gate passes:
+//   syntax    the patched file parses with no more errors than before
+//   behavior  an optional caller-supplied check that nothing unrelated changed
+//   rescan    the original finding is gone from a rescan of the patched tree AND nothing at medium or above
+//             is new (a syntactically correct edit that the effective configuration shadows leaves the
+//             finding in place, so it is blocked rather than called fixed)
+//   compile   strictly opt-in; the default path never starts a compiler or evaluator
+// Preview never writes. Apply writes a backup first and refuses a file that changed since planning.
+// Undo restores the backup byte for byte.
+
+import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { statePath } from '../posture/state-dir.js';
+import { maybeEncryptForWrite, maybeDecryptForRead } from '../posture/encryption-provider.js';
+import { recordExternalFix, markRevertedByBackup } from '../posture/fix-history.js';
+
+export const RANK = Object.freeze({ critical: 4, high: 3, medium: 2, low: 1, info: 0 });
+const bump = (m, k) => m.set(k, (m.get(k) || 0) + 1);
+
+export function unifiedDiff(file, a, b) {
+  const x = a.split('\n'), y = b.split('\n'); const out = [`--- a/${file}`, `+++ b/${file}`];
+  let i = 0; while (i < x.length && i < y.length && x[i] === y[i]) i++;
+  let ea = x.length, eb = y.length; while (ea > i && eb > i && x[ea - 1] === y[eb - 1]) { ea--; eb--; }
+  out.push(`@@ -${i + 1},${ea - i} +${i + 1},${eb - i} @@`);
+  for (let k = i; k < ea; k++) out.push(`-${x[k]}`);
+  for (let k = i; k < eb; k++) out.push(`+${y[k]}`);
+  return out.join('\n');
+}
+const safeRel = (root, rel) => { const p = join(root, rel); if (!p.startsWith(join(root) + '/')) throw new Error(`path escapes the root: ${rel}`); return p; };
+
+export function writeWithBackup(root, rel, before, after) {
+  const target = safeRel(root, rel);
+  const id = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  const dir = statePath(root, 'fix-backups', id);
+  const disk = existsSync(target) ? readFileSync(target, 'utf8') : null;
+  if (disk !== before) throw new Error('the file changed on disk since the fix was planned; refusing to overwrite');
+  // The pre-image is customer source: it follows the project's encryption policy for confidential state, and a policy
+  // that REQUIRES encryption with no working provider refuses the fix before anything is written.
+  const enc = maybeEncryptForWrite(root, 'fix-backups', before);
+  if (!enc.ok) throw new Error(enc.reason);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, 'original'), enc.content);
+  writeFileSync(join(dir, 'meta.json'), JSON.stringify({ file: rel, appliedAt: new Date().toISOString(), sizeBefore: before.length, sizeAfter: after.length }));
+  writeFileSync(target, after);
+  return { id, dir };
+}
+
+export function undoFix(root, backupId) {
+  const _afterUndo = () => { try { markRevertedByBackup(root, backupId); } catch { /* history is best effort */ } };
+  const dir = statePath(root, 'fix-backups', backupId);
+  const meta = JSON.parse(readFileSync(join(dir, 'meta.json'), 'utf8'));
+  const target = safeRel(root, meta.file);
+  writeFileSync(target, maybeDecryptForRead(readFileSync(join(dir, 'original'), 'utf8')));
+  _afterUndo();
+  return { ok: true, file: meta.file };
+}
+
+/**
+ * @param {{plan: {file:string, before:string, after:string, label?:string}, files: Record<string,string>, matchKey: (f:object)=>string,
+ *          finding: object, rescan: (files:object)=>Promise<object[]>, syntax: (plan)=>{ok:boolean, detail?:string},
+ *          behaviorCheck?: Function, compile?: (patched)=>{ran:boolean, ok:boolean|null, detail:string}, requireCompile?: boolean,
+ *          apply?: boolean, root?: string, extraWrites?: Array<{file:string,before:string,after:string}>}} o
+ */
+/** A repository-relative path that stays inside the root: not absolute, no `..` segment, no NUL, not empty. */
+export function isRootRelativePath(rel) {
+  if (typeof rel !== 'string' || !rel || rel.includes('\0')) return false;
+  const norm = rel.replace(/\\/g, '/');
+  if (norm.startsWith('/') || /^[A-Za-z]:\//.test(norm)) return false;
+  return !norm.split('/').some((seg) => seg === '..');
+}
+
+export async function runFixLifecycle(o) {
+  const { plan, files, finding } = o;
+  const gates = {};
+  // A patch may only touch a file inside the project: a target that escapes the root is refused before anything else runs.
+  gates.path = { ok: isRootRelativePath(plan.file), detail: plan.file };
+  if (!gates.path.ok) return { status: 'blocked', applied: false, reason: `path-escape: ${String(plan.file).slice(0, 120)} is outside the project root`, plan, gates, label: plan.label };
+  gates.syntax = o.syntax(plan);
+  const patched = { ...files, [plan.file]: plan.after };
+  const blocked = (why) => ({ status: 'blocked', applied: false, reason: why, plan, gates, label: plan.label });
+  if (!gates.syntax.ok) return blocked(`syntax: ${gates.syntax.detail}`);
+  if (o.behaviorCheck) { gates.behavior = o.behaviorCheck(plan); if (gates.behavior && gates.behavior.ok === false) return blocked(`behavior: ${gates.behavior.detail || 'unrelated behavior change'}`); }
+  let before, after;
+  try { before = await o.rescan(files); after = await o.rescan(patched); } catch (e) { return blocked(`rescan failed: ${e.message}`); }
+  const key = o.matchKey;
+  const b = new Map(), a = new Map();
+  for (const f of before) bump(b, key(f));
+  for (const f of after) bump(a, key(f));
+  const k = key(finding);
+  const gone = (a.get(k) || 0) < (b.get(k) || 0);
+  const added = after.filter((f) => RANK[f.severity] >= RANK.medium && (a.get(key(f)) || 0) > (b.get(key(f)) || 0));
+  gates.rescan = { ok: gone && added.length === 0, originalGone: gone, newMediumOrHigher: [...new Set(added.map((f) => `${f.cwe || f.vuln}@${f.file}:${f.line}`))] };
+  if (!gone) return blocked('the original finding is still reported after the patch');
+  if (added.length) return blocked(`the patch introduces ${added.length} new medium-or-higher finding(s)`);
+  // Optional controlled-witness gate (X-009): the hook returns judgeFixWitness(before, after). A patch that STILL
+  // reproduces the effect is blocked; a witness that could not be judged (unsupported, invalid, unavailable) verifies
+  // nothing and, unless `requireWitness` is set, does not block (it is recorded as not-verified).
+  if (o.witness) {
+    gates.witness = o.witness(plan, files, patched) || { ok: false, verified: false, reason: 'no witness result' };
+    if (gates.witness.stillReproduces) return blocked(`witness: ${gates.witness.reason}`);
+    if (o.requireWitness && !gates.witness.verified) return blocked(`witness verification required but ${gates.witness.reason}`);
+  }
+  gates.compile = o.compile ? o.compile(patched) : { ran: false, ok: null, detail: 'not requested (default static scans never start a compiler or evaluator)' };
+  if (gates.compile.ran && !gates.compile.ok) return blocked(`compile: ${gates.compile.detail}`);
+  if (o.requireCompile && !gates.compile.ran) return blocked(`compile verification required but ${gates.compile.detail}`);
+  const verified = { syntax: true, rescan: true, compile: gates.compile.ran ? 'passed' : 'not-run', witness: gates.witness ? (gates.witness.verified ? 'passed' : 'not-verified') : 'not-run' };
+  const res = { status: 'verified', applied: false, plan, gates, label: plan.label, verified, preview: unifiedDiff(plan.file, plan.before, plan.after) };
+  if (o.apply) {
+    if (!o.root) return blocked('apply requires a root directory');
+    res.backup = writeWithBackup(o.root, plan.file, plan.before, plan.after);
+    res.applied = true; res.status = 'applied';
+    // One ledger: the same fix-history `agentic-security undo` reads, with the tier and the gates that passed.
+    try {
+      res.history = await recordExternalFix({ scanRoot: o.root, file: plan.file, originalContent: plan.before, newContent: plan.after, findingId: finding.id || `${finding.file}:${finding.line}`, ruleId: finding.rule || null, vuln: finding.vuln || null, stableId: finding.stableId || null, fixLabel: plan.label || null, verification: verified, backup: res.backup, findingProvenance: finding.findingProvenance || null });
+    } catch { res.history = null; }
+  }
+  return res;
+}

package/src/language/haskell-adapter.js

@@ -0,0 +1,51 @@
+// Adapter that plugs the Haskell parser into the language pipeline contracts
+// (CORE-003), so parse outcomes reach scan health instead of staying inside the
+// parser. A missing or corrupt grammar becomes `missing_grammar`, a budget bound
+// becomes `timed_out` (deadline) or `unresolved` (size/depth), and syntax errors
+// and opaque boundaries become `unresolved-branch` outcomes. Findings from other
+// languages are never touched.
+
+import { isRegisteredLanguageProducer, registerLanguageProducer } from './contracts.js';
+import { parseHaskell } from './haskell-parser.js';
+import { loadHaskellGrammar } from './haskell-grammar.js';
+
+export const HASKELL_PARSE_PRODUCER = 'language:haskell-parse';
+
+// Boundaries whose content the parser could not see. cpp and ffi are disclosed on
+// the parse result but do not make the file unresolved: both CPP branches are
+// parsed and a foreign declaration's own Haskell signature is.
+const OPAQUE_BOUNDARIES = new Set(['th-splice', 'th-quote', 'th-name-quote', 'th-top-level-splice', 'quasiquote', 'hsc', 'generated']);
+
+export function ensureHaskellParseProducer() {
+  if (!isRegisteredLanguageProducer(HASKELL_PARSE_PRODUCER)) {
+    registerLanguageProducer({ id: HASKELL_PARSE_PRODUCER, language: 'haskell', capability: 'parse', evidenceKinds: ['source'], version: '1' });
+  }
+  return HASKELL_PARSE_PRODUCER;
+}
+
+/**
+ * @param {{grammarSource?:Function, budgets?:object, mode?:string, onParse?:(file:string, parse:object)=>void}} [opts]
+ */
+export function createHaskellAdapter(opts = {}) {
+  ensureHaskellParseProducer();
+  return {
+    id: HASKELL_PARSE_PRODUCER,
+    language: 'haskell',
+    hasGrammar: () => loadHaskellGrammar({ grammarSource: opts.grammarSource }).available,
+    analyze(file, content) {
+      const parse = parseHaskell(content, { file, grammarSource: opts.grammarSource, budgets: opts.budgets, mode: opts.mode });
+      if (typeof opts.onParse === 'function') opts.onParse(file, parse);
+      if (parse.status === 'budget_exceeded' && parse.budget && parse.budget.name === 'deadlineMs') {
+        throw Object.assign(new Error(`Haskell parser deadline exceeded for ${file}`), { code: 'LANG_TIMEOUT' });
+      }
+      const unresolved = [];
+      if (parse.status === 'budget_exceeded') unresolved.push({ line: 1, reason: `parser budget exceeded: ${parse.budget.name}` });
+      else if (parse.status === 'failed') throw new Error(parse.errors[0] ? parse.errors[0].detail : 'Haskell parse failed');
+      else {
+        for (const e of parse.errors) unresolved.push({ line: e.span ? e.span.startLine : 1, reason: `syntax-error: ${e.kind}` });
+        for (const b of parse.boundaries) if (OPAQUE_BOUNDARIES.has(b.kind)) unresolved.push({ line: b.span.startLine, reason: `opaque-boundary: ${b.kind}` });
+      }
+      return { findings: [], unresolved, parse };
+    },
+  };
+}