@clear-capabilities/agentic-security-scanner 0.153.2 → 0.155.0

package/src/llm-validator/index.js

@@ -61,6 +61,7 @@
 // Cache key includes the prompt template version + model id, so any change
 // to the hardened prompt invalidates the cache.
 
+import { languageClosureDigest, languagePromptExtras } from '../language/context.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
@@ -288,6 +289,12 @@ function fileHashOf(fileContents, file) {
   if (!file) return '';
   const c = fileContents?.[file];
   if (!c) return '';
+  // Haskell/Nix: a model verdict about one file depends on the modules it imports and the manifests around it, so the
+  // key covers that closure. Otherwise a cached `reject` would survive a change to the very module that made the
+  // finding true.
+  if (/\.(?:l?hs|hs-boot|hsc|nix)$/i.test(file)) {
+    try { return languageClosureDigest(fileContents, file); } catch { /* fall back to the file alone */ }
+  }
   return crypto.createHash('sha256').update(c).digest('hex').slice(0, 32);
 }
 
@@ -319,6 +326,10 @@ function renderPrompt(finding, fileContents, challenge, nonce, scanRoot) {
     : `${finding.file}:${finding.line} [single-point detection, no cross-file path]`;
   // Defensive: strip the delimiter literally from the untrusted excerpt so
   // an attacker can't close it early by embedding our token.
+  // Related files on the finding's own evidence chain (Haskell/Nix), under the same untrusted-excerpt rules.
+  try {
+    for (const x of languagePromptExtras(finding, fileContents)) context += `${context ? '\n' : ''}--- related excerpt: ${x.file} ---\n${redactPayload({ text: x.text, filePath: x.file, scanRoot }).text}`;
+  } catch { /* extra context is advisory */ }
   let sterileContext = String(context || '')
     .replace(/BEGIN-UNTRUSTED-CODE-EXCERPT-[a-f0-9]+/gi, '[stripped-delimiter]')
     .replace(/END-UNTRUSTED-CODE-EXCERPT-[a-f0-9]+/gi, '[stripped-delimiter]');
@@ -394,12 +405,15 @@ async function callEndpoint(endpoint, apiKey, model, prompt, preset = null, shap
     else headers['Authorization'] = `Bearer ${apiKey}`;
   }
   try {
-    const r = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body) });
+    // A model that accepts the connection and never answers must not hold a scan open forever: every call is bounded.
+    // The result is an UNAVAILABLE finding (kept, unvalidated), never a silent pass.
+    const ms = Number(process.env.AGENTIC_SECURITY_LLM_TIMEOUT_MS) > 0 ? Number(process.env.AGENTIC_SECURITY_LLM_TIMEOUT_MS) : 60_000;
+    const r = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(body), signal: AbortSignal.timeout(ms) });
     if (!r.ok) return { ok: false, error: `HTTP ${r.status}` };
     const j = await r.json().catch(() => null);
     return { ok: true, text: String(extractText(j) || ''), usage: extractUsage ? extractUsage(j) : null };
   } catch (e) {
-    return { ok: false, error: e.message };
+    return { ok: false, error: e && e.name === 'TimeoutError' ? 'timeout' : e.message };
   }
 }
 

package/src/lsp/server.js

@@ -13,6 +13,8 @@
 // Wire-format: vscode-jsonrpc framing (Content-Length headers). Stateless
 // per file — no incremental analysis yet.
 
+import { isLanguageManifest } from '../language/discovery.js';
+import { withLanguageContext, loadLanguageProject, languageOfFinding, languageFixPreview, minimalEdit } from '../language/context.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as readline from 'node:readline';
@@ -53,6 +55,21 @@ function sevToLsp(sev) {
   }
 }
 
+// The most precise location a finding carries. Haskell and Nix findings keep their ORIGINAL span (0-based columns); a
+// finding with only a line is reported across that line, as before.
+function _rangeOf(f) {
+  const o = f && f.originalLocation;
+  if (o && Number.isInteger(o.startLine) && Number.isInteger(o.startColumn)) {
+    return { start: { line: Math.max(0, o.startLine - 1), character: o.startColumn }, end: { line: Math.max(0, (Number.isInteger(o.endLine) ? o.endLine : o.startLine) - 1), character: Number.isInteger(o.endColumn) ? o.endColumn : o.startColumn + 1 } };
+  }
+  if (o && Number.isInteger(o.line) && Number.isInteger(o.column)) {
+    const line = Math.max(0, o.line - 1);
+    return { start: { line, character: o.column }, end: { line, character: 200 } };
+  }
+  const line = Math.max(0, ((f && f.line) || 1) - 1);
+  return { start: { line, character: 0 }, end: { line, character: 200 } };
+}
+
 function findingToDiagnostic(f) {
   const line = Math.max(0, (f.line || 1) - 1);
   // Stage 6 correctness audit: this read f.remediation directly, but raw
@@ -63,13 +80,12 @@ function findingToDiagnostic(f) {
   // report/index.js already established for this exact split (CMP-3).
   const remediation = _remediationOf(f);
   return {
-    range: {
-      start: { line, character: 0 },
-      end:   { line, character: 200 },
-    },
+    range: _rangeOf(f),
     severity: sevToLsp(f.severity),
     source: 'agentic-security',
     code: f.cwe || f.family || 'finding',
+    // carried back by the client in codeAction requests, so a fix is offered for exactly this finding
+    data: { id: f.id || null, stableId: f.stableId || null, rule: f.rule || null, family: f.family || null, language: f.language || languageOfFinding(f) || null },
     message: `${f.vuln || 'Security finding'}${remediation ? '\n\n' + remediation : ''}`.slice(0, 2000),
     tags: [],
   };
@@ -101,7 +117,10 @@ const DEP_BASE_NAMES = new Set([
   'go.mod', 'Cargo.toml', 'Cargo.lock',
   'pom.xml', 'build.gradle', 'build.gradle.kts',
 ]);
-const DEP_EXT_RE = /\.(?:proto|graphql|gql|tf)$/i;
+const DEP_EXT_RE = /\.(?:proto|graphql|gql|tf|cabal)$/i;
+// Haskell and Nix project manifests and lock files (cabal.project*, stack.yaml*, package.yaml, flake.lock, ...) are
+// recognised by the shared language discovery module, never by a second list here.
+const _isLanguageDep = (base) => isLanguageManifest(base);
 const DEP_NAME_RE = /(?:openapi|swagger)\.(?:ya?ml|json)$/i;
 
 let _depCache = { rootDir: null, depFileContents: {} };
@@ -119,7 +138,7 @@ function _loadDepFileContents(rootDir) {
       if (e.isDirectory()) { walk(full); continue; }
       if (!e.isFile()) continue;
       const base = e.name;
-      if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base)) {
+      if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base) || _isLanguageDep(base)) {
         let stat;
         try { stat = fs.statSync(full); } catch { continue; }
         if (stat.size > 500_000) continue;
@@ -144,8 +163,11 @@ async function scanFile(uri) {
   try {
     const rel = path.relative(_rootDir, filePath);
     const content = fs.readFileSync(filePath, 'utf8');
-    const fileContents = { [rel]: content };
-    const depFileContents = _loadDepFileContents(_rootDir);
+    let fileContents = { [rel]: content };
+    let depFileContents = _loadDepFileContents(_rootDir);
+    // Haskell/Nix: scan the saved file together with the modules it imports and the ones that import it (bounded).
+    const lc = withLanguageContext(_rootDir, fileContents, depFileContents);
+    fileContents = lc.fileContents; depFileContents = lc.depFileContents;
     // Premortem 4R-12 + 4R-15: reset the per-process custom-rules budget at
     // the start of each LSP scan. Each save is a logical scan session; without
     // the reset, a long-lived LSP server would accumulate budget across saves
@@ -220,12 +242,50 @@ function handleInitialize(params) {
         save: { includeText: false },
       },
       diagnosticProvider: { interFileDependencies: true, workspaceDiagnostics: false },
+      // quick fixes for Haskell and Nix findings (preview edits from the verified language fixers)
+      codeActionProvider: { codeActionKinds: ['quickfix'], resolveProvider: false },
     },
     serverInfo: { name: SERVER_NAME, version: SERVER_VERSION },
   };
 }
 
+/**
+ * textDocument/codeAction: a quick fix for each agentic-security diagnostic in range that a language fixer can repair.
+ * The edit is a PREVIEW the editor applies; nothing is written here. A finding with no safe fix gets a disabled
+ * action that says why, never a silent omission.
+ */
+async function codeActionsFor(params) {
+  const uri = params && params.textDocument && params.textDocument.uri;
+  const diags = ((params && params.context && params.context.diagnostics) || []).filter((d) => d && d.source === 'agentic-security' && d.data && d.data.id);
+  const stored = (uri && _diagnosticsByUri.get(uri)) || [];
+  if (!diags.length || !stored.length) return [];
+  let files = null;
+  const actions = [];
+  for (const d of diags) {
+    const f = stored.find((x) => x && x.id === d.data.id);
+    if (!f || !languageOfFinding(f)) continue;
+    if (!files) files = loadLanguageProject(_rootDir).files;
+    let prev;
+    try { prev = await languageFixPreview(f, files); } catch (e) { prev = { ok: false, reason: String((e && e.message) || e) }; }
+    if (prev && prev.ok && prev.file) {
+      const target = pathToUri(path.join(_rootDir, prev.file));
+      actions.push({
+        title: `Fix${prev.label ? ` (${prev.label})` : ''}: ${f.vuln || f.rule || 'finding'}`,
+        kind: 'quickfix', diagnostics: [d], isPreferred: false,
+        edit: { changes: { [target]: [minimalEdit(prev.before, prev.after)] } },
+        data: { stableId: f.stableId || null, verified: { syntax: true, rescan: true } },
+      });
+    } else {
+      actions.push({ title: `No automatic fix: ${f.vuln || f.rule || 'finding'}`, kind: 'quickfix', diagnostics: [d], disabled: { reason: (prev && (prev.reason || prev.status)) || 'no deterministic fix exists for this finding' } });
+    }
+  }
+  return actions;
+}
+
 async function handleMessage(msg) {
+  if (msg.method === 'textDocument/codeAction') {
+    return { id: msg.id, result: await codeActionsFor(msg.params || {}) };
+  }
   if (msg.method === 'initialize') {
     return { id: msg.id, result: handleInitialize(msg.params || {}) };
   }
@@ -254,7 +314,7 @@ async function handleMessage(msg) {
       const savedPath = uriToPath(uri);
       if (savedPath && _depCache.rootDir === _rootDir) {
         const base = path.basename(savedPath);
-        if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base)) {
+        if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base) || _isLanguageDep(base)) {
           try {
             const rel = path.relative(_rootDir, savedPath);
             const st = fs.statSync(savedPath);

package/src/mcp/CLAUDE.md

@@ -65,3 +65,10 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 - **Lifecycle.** `_codeFingerprint()` reads source files at module-load time. New files added to the MCP source set won't be in the fingerprint until they're added to the `files = […]` array in `server.js`.
 - **Audit log.** The chain hashes plain JSON lines; a full-file rewrite is not detectable without a remote sink. Acknowledged limitation.
 - **Concurrency.** `stdio.js`'s `'data'` handler is async; concurrent `apply_fix` calls can race on `fix-history/`. Today benign because fixed-fix-history is idempotent on retry, but a future stateful tool needs serialization.
+
+## Haskell and Nix context
+
+`scan_diff`, `verify_fix` and `synthesize_fix` add the import closure of a Haskell or Nix file and the manifests as context
+(`language/context.js` `withLanguageContext`, bounded in files and bytes, read-only) and still report only the files asked
+about. The tool that previews a fix for these files uses the language fixers; `apply_fix` is unchanged (its generic confined-write
+path), and the language-aware apply with backup and `undo` is the CLI's `fix --apply`.

package/src/mcp/tools.js

@@ -371,6 +371,10 @@ export const scan_diff = {
     const abs = files.map(f => _confine(sessionRoot, f, 'files[]'));
 
     const fileContents = {};
+    // `_confine` returns real paths; the session root may itself be a symlink (macOS /tmp, /var), so keys are made
+    // relative to the REAL root. A key built from the unresolved root climbs out of the tree and no finding ever
+    // matches the file it was asked about.
+    const rootReal = fs.realpathSync(path.resolve(sessionRoot));
     let totalBytes = 0;
     for (const a of abs) {
       let stat;
@@ -383,7 +387,7 @@ export const scan_diff = {
       }
       let content;
       try { content = fs.readFileSync(a, 'utf8'); } catch { continue; }
-      const rel = path.relative(sessionRoot, a).replace(/\\/g, '/');
+      const rel = path.relative(rootReal, a).replace(/\\/g, '/');
       fileContents[rel] = content;
     }
 
@@ -403,9 +407,13 @@ export const scan_diff = {
     // user's real project on every pre-write self-correction scan. Confirmed
     // by direct execution before this fix (11 state artifacts written by a
     // single scan_diff-shaped call).
-    const result = await withStateWritesDisabled(() =>
-      runScan(sessionRoot, { network: false, fileContents, deep: true, deepInCi: true }));
+    // Haskell and Nix results depend on imported modules and manifests, so the files asked about are scanned together
+    // with their import closure (read from disk, bounded). Findings are still reported only for the requested files.
     const wantSet = new Set(Object.keys(fileContents));
+    const { withLanguageContext } = await import('../language/context.js');
+    const lc = withLanguageContext(sessionRoot, fileContents, {});
+    const result = await withStateWritesDisabled(() =>
+      runScan(sessionRoot, { network: false, fileContents: lc.fileContents, depFileContents: lc.depFileContents, deep: true, deepInCi: true }));
     const sevRank = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
     const min = sevRank[severity] ?? 0;
     // Stage 6 correctness audit (historical): this used to only read
@@ -1055,12 +1063,26 @@ export const synthesize_fix = {
     // even a mis-attributed swap can't land a bad edit. No stored replacement,
     // no per-finding bloat in last-scan.json.
     let autofix = null;
+    let languageFix = null;
     if (!hasReplacement) {
       try {
         const abs = _confine(ctx.sessionRoot, f.file, 'finding.file');
         const det = synthesizeDeterministicPatch(f, fs.readFileSync(abs, 'utf8'));
         if (det) autofix = { deterministic: true, ruleId: det.ruleId, patch: det.patch };
       } catch { /* best-effort — no file / no rule → no autofix */ }
+      // Haskell and Nix: a read-only preview from the language fixer, with the verification gates' verdict and the
+      // FULL / MITIGATION / WORKAROUND tier. It writes nothing; apply_fix re-verifies before anything lands.
+      if (!autofix) {
+        try {
+          const lc = await import('../language/context.js');
+          if (lc.languageOfFinding(f)) {
+            const proj = lc.loadLanguageProject(ctx.sessionRoot);
+            const prev = await lc.languageFixPreview(f, proj.files);
+            languageFix = { status: prev.status, ok: prev.ok, label: prev.label || null, tier: prev.tier || null, reason: prev.reason || null, diff: prev.diff || null, explanation: prev.explanation || null, consequences: prev.consequences || [] };
+            if (prev.ok) autofix = { deterministic: true, ruleId: f.rule || f.family || null, patch: prev.after, file: prev.file, label: prev.label || null, verified: true };
+          }
+        } catch { /* best-effort: the preview is advisory */ }
+      }
     }
     // Premortem #2: `replacement` is a *patch* (the code we'll write to disk),
     // not a finding excerpt. Running it through redactString silently corrupts
@@ -1079,6 +1101,7 @@ export const synthesize_fix = {
       replacement: hasReplacement ? fix.replacement : null,
       template: fix.code || null,
       autofix,
+      languageFix,
       // #15 — the regression test the scan annotator already generated for this
       // finding (present when a PoC was built). Surfaced here so the fix flow
       // writes the test alongside the patch; fix-verify-loop then runs it, so an

package/src/pipeline/scan-health.js

@@ -42,7 +42,7 @@ export const SCAN_HEALTH_SCHEMA_VERSION = 1;
  *   never a fabricated all-zero summary.
  * @returns {object} scanHealth per PRD §10.3, additive fields only.
  */
-export function computeScanHealth({ scanMeta = null, annotatorErrors = [], engineErrors = null, deepStatus = null, analyzerCoverage = null, lineageStatus = null } = {}) {
+export function computeScanHealth({ scanMeta = null, annotatorErrors = [], engineErrors = null, deepStatus = null, analyzerCoverage = null, lineageStatus = null, languageCoverage = null, supplyChain = null } = {}) {
   const conditions = [];
   const safeAnnotatorErrors = Array.isArray(annotatorErrors) ? annotatorErrors : [];
   const filesTimedOut = Number(scanMeta?.filesTimedOut) || 0;
@@ -84,11 +84,29 @@ export function computeScanHealth({ scanMeta = null, annotatorErrors = [], engin
     conditions.push(`${analyzerCoverage.failed} analyzer(s) threw on at least one file`);
   }
 
+  // CORE-003: Haskell/Nix coverage outcomes (missing grammar, adapter
+  // exception, timeout, unresolved branch) from language/contracts.js.
+  // Additive: absent input leaves the output shape and conditions untouched.
+  if (languageCoverage && Array.isArray(languageCoverage.conditions)) {
+    conditions.push(...languageCoverage.conditions);
+  }
+
+  // NIX-005: build-trust findings ride in the ordinary supplyChain bucket. A finding that
+  // rests on an unresolved branch or a partial module graph is an analysis gap, so it is
+  // surfaced here rather than counted as a settled result.
+  const trustFindings = Array.isArray(supplyChain) ? supplyChain.filter((f) => f && f.type === 'nix_build_trust') : [];
+  const trustUncertain = trustFindings.filter((f) => Array.isArray(f.uncertainty) && f.uncertainty.length > 0).length;
+  if (trustUncertain > 0) {
+    conditions.push(`${trustUncertain} Nix build-trust finding(s) rest on an unresolved branch or partial module graph`);
+  }
+
   const status = conditions.length > 0 ? 'partial' : 'complete';
 
   return {
     schemaVersion: SCAN_HEALTH_SCHEMA_VERSION,
     status,
+    ...(trustFindings.length ? { buildTrust: { findings: trustFindings.length, uncertain: trustUncertain } } : {}),
+    ...(languageCoverage ? { languageCoverage: { totals: languageCoverage.totals ?? null, byKind: languageCoverage.byKind ?? null, ...(languageCoverage.limitations ? { limitations: languageCoverage.limitations } : {}), ...(languageCoverage.capabilities ? { capabilities: languageCoverage.capabilities } : {}), ...(languageCoverage.optionalModes ? { optionalModes: languageCoverage.optionalModes } : {}) } } : {}),
     files: {
       expected: scanMeta?.checkpoint?.total ?? null,
       scanned: scanMeta?.filesScanned ?? null,

package/src/posture/accuracy-scorecard.js

@@ -205,6 +205,23 @@ export function buildScorecard(inputs) {
       corpusBaseline: committed.corpusBaseline
         ? { source: 'bench/cve-replay/corpus-baseline.json', generatedAt: committed.corpusBaseline.generatedAt, total: committed.corpusBaseline.total, passing: committed.corpusBaseline.passing }
         : null,
+      // Haskell and Nix support (HASKELL_NIXOS_FULL_CAPABILITY_PRD.md DOC-002): the committed support registry, passed through with
+      // its denominators, layers, corpus revision, date and tool availability. Read, never re-measured here.
+      languageSupport: committed.languageSupport
+        ? {
+          source: 'docs/language-support.json',
+          generatedAt: committed.languageSupport.generatedAt || null,
+          node: committed.languageSupport.node || null,
+          tools: committed.languageSupport.tools || null,
+          targets: committed.languageSupport.targets || null,
+          limits: committed.languageSupport.limits || [],
+          languages: Object.fromEntries(Object.entries(committed.languageSupport.languages || {}).map(([k, v]) => [k, {
+            frozen: v.frozen || null, measuredOn: v.measuredOn || null,
+            rows: Object.values(v.rows || {}).map((r) => ({ capability: r.capability, status: r.status, reasons: r.reasons || [], evidence: r.evidence ? { metric: r.evidence.metric || null, layer: r.evidence.layer || null, tp: r.evidence.tp ?? null, fp: r.evidence.fp ?? null, fn: r.evidence.fn ?? null, tn: r.evidence.tn ?? null, precision: r.evidence.precision ?? null, recall: r.evidence.recall ?? null, f1: r.evidence.f1 ?? null, cases: r.evidence.cases ?? null, familyCount: r.evidence.families ? Object.keys(r.evidence.families).length : null } : null })),
+            unknownOutcomes: v.unknownOutcomes || null, metamorphic: v.metamorphic || null,
+          }])),
+        }
+        : null,
       independent: committed.independent
         ? {
           source: 'bench/independent/RESULT.json',
@@ -621,6 +638,40 @@ export function renderScorecardMarkdown(m) {
     }
   }
 
+  const ls = m.committedInputs.languageSupport;
+  if (ls) {
+    L.push('## Haskell and Nix/NixOS support');
+    L.push('');
+    L.push(`*Committed artifact:* \`${ls.source}\`, measured ${ls.generatedAt || 'unknown date'} on node ${ls.node || '?'}. It is read here, not re-measured by this command.`);
+    L.push('');
+    L.push('Every row is **supported** only from passing evidence of its own metric kind. Layers are scored independently (the taint layer');
+    L.push('is the injection families, the SAST layer is every other family) and a finding of a different family inside a case is counted');
+    L.push('separately (family-scoped scoring); the strict precision that counts it is stored in the registry. Denominators are cases, with');
+    L.push('TP/FP/FN/TN shown; a row without a denominator carries a different kind of evidence (parse counts, fix gates, manifests).');
+    L.push('');
+    for (const [lang, v] of Object.entries(ls.languages)) {
+      L.push(`### ${lang === 'haskell' ? 'Haskell' : 'Nix and NixOS'}`);
+      L.push('');
+      L.push('| Capability | Status | Layer | Cases | TP | FP | FN | TN | Precision | Recall | F1 | Families |');
+      L.push('| --- | --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |');
+      const pct = (x) => (typeof x === 'number' ? `${(x * 100).toFixed(1)}%` : ', ');
+      for (const r of v.rows) {
+        const e = r.evidence;
+        L.push(`| ${r.capability} | ${r.status} | ${e && e.layer ? e.layer : '—'} | ${e && e.cases != null ? e.cases : '—'} | ${e && e.tp != null ? e.tp : '—'} | ${e && e.fp != null ? e.fp : '—'} | ${e && e.fn != null ? e.fn : '—'} | ${e && e.tn != null ? e.tn : '—'} | ${e ? pct(e.precision) : '—'} | ${e ? pct(e.recall) : '—'} | ${e ? pct(e.f1) : '—'} | ${e && e.familyCount != null ? e.familyCount : '—'} |`);
+      }
+      L.push('');
+      const blocked = v.rows.filter((r) => r.status !== 'supported');
+      if (blocked.length) { L.push(`Not supported here: ${blocked.map((r) => `${r.capability} (${r.status}: ${(r.reasons[0] || '').slice(0, 140)})`).join('; ')}.`); L.push(''); }
+      if (v.unknownOutcomes) L.push(`Unknown and unmodelled cases: ${JSON.stringify(v.unknownOutcomes)}.`);
+      if (v.metamorphic) L.push(`Metamorphic pairs: ${JSON.stringify(v.metamorphic)}.`);
+      L.push('');
+    }
+    if (ls.tools) L.push(`Tools present where this was measured: ${Object.entries(ls.tools).map(([k, x]) => `${k}=${x === false ? 'absent' : x}`).join(', ')}.`);
+    L.push('');
+    for (const lim of ls.limits) L.push(`- ${lim}`);
+    L.push('');
+  }
+
   const ind = m.committedInputs.independent;
   if (ind && ind.overall) {
     L.push('## Independent evaluation population — the number that matters');

package/src/posture/aibom.js

@@ -20,6 +20,7 @@
 // scan.components. Extraction precision is verified by a smoke test against
 // a labelled fixture set.
 
+import { extractLanguageAI } from '../language/aibom.js';
 import * as crypto from 'node:crypto';
 import { statePath, safeWriteState } from './state-dir.js';
 
@@ -199,6 +200,16 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
     if (classes.includes('vector-store')) vectorStores.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
     if (classes.includes('embedding-provider')) embeddings.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
   }
+  // 4. Haskell and Nix (X-002): declared / installed / enabled / invoked are kept apart, evidence is a list,
+  //    and anything source does not spell out is `unresolved` rather than guessed.
+  let lang = { models: [], endpoints: [], services: [], frameworks: [], vectorStores: [], embeddings: [], promptTemplates: [], unresolved: [], links: [], gaps: [] };
+  try { lang = extractLanguageAI({ ...(meta.manifests || {}), ...(fileContents || {}) }); } catch { /* best effort: the JS/Python inventory above stands */ }
+  const knownModel = new Set(models.map((m) => `${m.provider}:${m.modelId}`));
+  for (const m of lang.models) { const k = `${m.provider}:${m.modelId}`; if (!knownModel.has(k)) { knownModel.add(k); models.push({ ...m, file: (m.evidence && m.evidence[0] && m.evidence[0].file) || null, line: (m.evidence && m.evidence[0] && m.evidence[0].line) || null }); } }
+  promptTemplates.push(...lang.promptTemplates);
+  const knownFw = new Set(frameworks.map((f) => `${f.ecosystem}:${f.name}`));
+  for (const f of lang.frameworks) { const k = `${f.ecosystem}:${f.name}`; if (!knownFw.has(k)) { knownFw.add(k); frameworks.push(f); } }
+  vectorStores.push(...lang.vectorStores); embeddings.push(...lang.embeddings);
   return {
     aibomFormat: 'agentic-security AI-BOM',
     version: '1',
@@ -221,6 +232,15 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
     frameworks,
     vectorStores,
     embeddings,
+    endpoints: lang.endpoints,
+    services: lang.services,
+    unresolved: lang.unresolved,
+    links: lang.links,
+    limits: [
+      'an AI component being declared, installed or enabled does not show that a model is called or that data is sent to it',
+      'models, endpoints and providers that source does not spell out are listed under `unresolved`, not guessed',
+      ...(lang.gaps || []).map((g) => g.detail || g.kind),
+    ],
     summary: {
       totalModels: models.length,
       totalProviders: new Set(models.map(m => m.provider)).size,
@@ -229,6 +249,10 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
       promptTemplates: promptTemplates.length,
       frameworks: frameworks.length,
       vectorStores: vectorStores.length,
+      endpoints: lang.endpoints.length,
+      services: lang.services.length,
+      embeddings: embeddings.length,
+      unresolved: lang.unresolved.length,
     },
   };
 }
@@ -297,6 +321,30 @@ export function aibomToMarkdown(aibom) {
     out.push('');
   }
 
+  const row = (cells) => `| ${cells.map((c) => String(c ?? '—').replace(/\|/g, '\\|').replace(/\n/g, ' ')).join(' | ')} |`;
+  if ((aibom.endpoints || []).length) {
+    out.push('## Endpoints'); out.push(''); out.push('| Provider | Purpose | URL (redacted) | Evidence |'); out.push('|---|---|---|---|');
+    for (const e of aibom.endpoints) out.push(row([e.provider, e.purpose, e.url, (e.evidence || []).map((x) => `${x.file}:${x.line}`).join(', ')]));
+    out.push('');
+  }
+  if ((aibom.services || []).length) {
+    out.push('## Services'); out.push(''); out.push('| Service | Kind | Status | Evidence |'); out.push('|---|---|---|---|');
+    for (const x of aibom.services) out.push(row([x.name, x.kind, x.status, (x.evidence || []).map((e) => `${e.file}:${e.line}`).join(', ')]));
+    out.push('');
+  }
+  if ((aibom.embeddings || []).length) {
+    out.push('## Embeddings'); out.push(''); out.push('| Name | Provider | Status |'); out.push('|---|---|---|');
+    for (const e of aibom.embeddings) out.push(row([e.name, e.provider, e.status]));
+    out.push('');
+  }
+  if ((aibom.unresolved || []).length) {
+    out.push('## Unresolved'); out.push(''); out.push('| Kind | Location | Reason |'); out.push('|---|---|---|');
+    for (const u of aibom.unresolved) out.push(row([u.kind, `${u.file}:${u.line}`, u.reason]));
+    out.push('');
+  }
+  if ((aibom.limits || []).length) { out.push('## Limits'); out.push(''); for (const l of aibom.limits) out.push(`- ${l}`); out.push(''); }
+  out.push('> This document is the proprietary agentic-security AI-BOM, not a CycloneDX document. A CycloneDX 1.6 ML-BOM view is available separately.');
+  out.push('');
   return out.join('\n');
 }
 
@@ -324,9 +372,9 @@ export function toCycloneDXMLBOM(aibom, meta = {}) {
   const models = (aibom && aibom.models) || [];
   const components = models.map((m) => ({
     type: 'machine-learning-model',
-    'bom-ref': `model:${m.provider || 'unknown'}/${m.name || 'unknown'}${m.version ? `@${m.version}` : ''}`,
-    name: m.name || 'unknown',
-    ...(m.version ? { version: m.version } : {}),
+    'bom-ref': `model:${m.provider || 'unknown'}/${m.name || m.modelId || 'unknown'}${m.version || m.revision ? `@${m.version || m.revision}` : ''}`,
+    name: m.name || m.modelId || 'unknown',
+    ...(m.version || m.revision ? { version: m.version || m.revision } : {}),
     modelCard: {
       modelParameters: {
         ...(m.provider ? { approach: { type: 'supervised' } } : {}),
@@ -359,6 +407,10 @@ export function toCycloneDXMLBOM(aibom, meta = {}) {
       component: { type: 'application', name: 'scan-target', version: '1.0.0' },
     },
     components,
+    ...(((aibom && aibom.services) || []).length || ((aibom && aibom.endpoints) || []).length ? { services: [
+      ...(aibom.services || []).map((x) => ({ 'bom-ref': `service:${x.name}`, name: x.name, provider: { name: x.provider || 'unknown' }, description: `${x.kind} (${x.status})`, properties: [{ name: 'agentic-security:status', value: String(x.status) }, { name: 'agentic-security:egress', value: 'not-established' }] })),
+      ...(aibom.endpoints || []).map((e) => ({ 'bom-ref': `endpoint:${e.url}`, name: `${e.provider} ${e.purpose}`, provider: { name: e.provider }, endpoints: [e.url], properties: [{ name: 'agentic-security:status', value: String(e.status) }] })),
+    ] } : {}),
   };
 }
 
@@ -394,6 +446,12 @@ export function validateMLBOM(doc) {
         `components[${i}] is a machine-learning-model but carries no modelCard — that is the whole ML-BOM extension`);
     }
   }
+  for (const [i, sv] of (Array.isArray(doc.services) ? doc.services : []).entries()) {
+    req(typeof sv.name === 'string' && sv.name, `services[${i}].name is required`);
+    if (sv.endpoints !== undefined) req(Array.isArray(sv.endpoints) && sv.endpoints.every((u) => typeof u === 'string' && !/\/\/[^/@]*:[^/@]*@/.test(u)), `services[${i}].endpoints must be URL strings without credentials`);
+  }
+  const refs = (Array.isArray(doc.components) ? doc.components : []).concat(Array.isArray(doc.services) ? doc.services : []).map((c) => c && c['bom-ref']).filter(Boolean);
+  req(new Set(refs).size === refs.length, 'bom-ref values must be unique');
   return { ok: errors.length === 0, errors, checked: 'structural (required fields + ML-BOM component shape), NOT full JSON-Schema validation' };
 }
 

package/src/posture/artifact-registry.js

@@ -95,6 +95,16 @@ export const ARTIFACT_REGISTRY = [
   // clears by default, same as last-scan.json itself.
   { name: 'lineage-graph.json', kind: 'file', classification: 'generated', retentionClass: 'scan' },
   { name: 'lineage-graph.json.sig', kind: 'file', classification: 'generated', retentionClass: 'scan' },
+  // X-016: Haskell/Nix analysis metadata (capability status, parser/resolver ledger, limitations, input digests) and the
+  // language BOM, written by src/language/state-artifacts.js beside last-scan.json. Paths and digests only, never source
+  // text. Scan-class retention for the metadata; the BOM is evidence.
+  { name: 'language-analysis.json', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'src/language/state-artifacts.js (persistLanguageArtifacts)' },
+  { name: 'language-analysis.json.sig', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'src/language/state-artifacts.js (persistLanguageArtifacts)' },
+  { name: 'language-bom.json', kind: 'file', classification: 'generated', retentionClass: 'evidence', source: 'src/language/state-artifacts.js (persistLanguageArtifacts)' },
+  { name: 'language-bom.json.sig', kind: 'file', classification: 'generated', retentionClass: 'evidence', source: 'src/language/state-artifacts.js (persistLanguageArtifacts)' },
+  // X-016: pre-image of every file a Haskell/Nix fix rewrote (original text + meta), the undo source. It holds customer
+  // source, so it is a backup-class artifact and marked confidential for the encryption policy.
+  { name: 'fix-backups', kind: 'dir', classification: 'generated', retentionClass: 'backup', confidential: true, source: 'src/language/fix-lifecycle.js (writeWithBackup)' },
   // M4 deliverable #8 (FR-503 §14, DFG-022, sub-project 8a): the "Data-Flow
   // Time Machine" foundation — one commit-keyed GraphSnapshot per scan,
   // written by src/lineage/graph-snapshot.js's persistGraphSnapshot(),
@@ -237,6 +247,8 @@ export const ARTIFACT_REGISTRY = [
   { name: 'provenance-providers.yml', kind: 'file', classification: 'operator-config', note: 'Finding Provenance M3 §3.4 GitHub/GitLab provider enrichment opt-in ({token} or provider-scoped tokens) — read by posture/provenance/providers/config.js, never written by the scanner; env vars (AGENTIC_SECURITY_GITHUB_TOKEN/AGENTIC_SECURITY_GITLAB_TOKEN) take precedence when set' },
   { name: 'repo-lineage.json', kind: 'file', classification: 'operator-config', note: 'Finding Provenance M4 §4.2 cross-repository lineage declaration ({linkedFrom: {path, atCommit}}) — read by posture/provenance/repo-lineage.js, never written by the scanner; the linked path is verified as a real local git repo before use, no remote fetch' },
   { name: 'recipient-profiles.json', kind: 'file', classification: 'operator-config', note: 'FR-506 recipient/subprocessor governance profiles — hand- or agent-authored via `governance propose-edit`, never scanner-regenerable, so a routine reset must never delete it' },
+  { name: 'hackage-advisories.json', kind: 'file', classification: 'operator-config', note: 'X-016: operator-supplied Hackage advisory snapshot read by language/haskell-supply.js; never written by the scanner, so `reset` preserves it' },
+  { name: 'nix-advisories.json', kind: 'file', classification: 'operator-config', note: 'QA-005: operator-supplied Nix advisory snapshot read by language/resolved-pass.js; never written by the scanner, so `reset` preserves it' },
   { name: 'cross-repo-links.json', kind: 'file', classification: 'operator-config', note: 'M5 deliverable #8 (FR-304 "declared" half) — declared local<->remote node links between two independently-scanned repos, written via `federate declare --yes`, never scanner-regenerable, so a routine reset must never delete it' },
   { name: 'logic-claims.json', kind: 'file', classification: 'operator-config', note: 'authored by an external reviewing agent; engine.js only ever reads it (fs.readFileSync, never written)' },
   { name: 'current-intent.md', kind: 'file', classification: 'operator-config', note: 'developer-authored; no writer exists anywhere in src/ or bin/' },

package/src/posture/auditor-walkthrough.js

@@ -43,11 +43,13 @@
 // attestation" describes independent certification, not attestation).
 
 import * as fs from 'node:fs';
+import * as crypto from 'node:crypto';
 import * as path from 'node:path';
 
 import { statePath, stateWritesEnabled } from './state-dir.js';
 import { EVIDENCE_GRADE_DISCLAIMER_SHORT } from './evidence-grade-wording.js';
 import { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys } from './family-resolve.js';
+import { LANGUAGE_COMPLIANCE_FAMILIES, languageAnalysisGaps } from '../language/compliance-map.js';
 import { strengthOfControl as _strengthOfControl } from './coverage-strength.js';
 // FR-PROV-026: earliestOrigin.authorName below is untrusted git commit
 // metadata. renderWalkthrough()'s output is console.log'd verbatim by
@@ -497,6 +499,7 @@ export function evaluateFramework(scanRoot, fw, scan) {
     || logicVulns.length > 0
     || supplyChain.length > 0;
 
+  const langIncomplete = languageAnalysisGaps(scan);
   const results = [];
   for (const c of fw.controls || []) {
     const obs = [];
@@ -599,6 +602,12 @@ export function evaluateFramework(scanRoot, fw, scan) {
           allCleared = false;
           contributingFindings.push(...open);
           obs.push(`${open.length} open ${fam} finding(s) at ${minSeverity}+.`);
+        } else if (langIncomplete.incomplete && LANGUAGE_COMPLIANCE_FAMILIES.has(fam)) {
+          // Empty bucket, but Haskell/Nix analysis in this scan did not complete (a parser failed, a required analyzer
+          // was off, an effective configuration is partial): an empty bucket is then not evidence, and an unknown
+          // option or an unresolved taint result must never read as satisfied.
+          obs.push(`⚠ ${fam}: Haskell/Nix analysis was incomplete (${langIncomplete.reasons[0]}${langIncomplete.reasons.length > 1 ? `; +${langIncomplete.reasons.length - 1} more` : ''}), so an empty finding bucket is not evidence (not assessed).`);
+          hasUnverifiableMapping = true;
         } else if (!assessable) {
           // Empty bucket, but the scan examined nothing — see the guard above.
           // Not evidence, and deliberately not a failure either.
@@ -855,4 +864,36 @@ export function persistWalkthrough(scanRoot, fw, body) {
   return fp;
 }
 
+/**
+ * A signable evidence document for one framework evaluation (the same shape `signComplianceEvidence` covers), so a
+ * walkthrough can be handed to an auditor with an integrity signature. Statuses, observations and finding references
+ * are copied from the evaluation; nothing is added. The language-analysis gaps that capped any control travel in
+ * `provenance`, so a reader of the signed document sees why a control is "partial".
+ */
+export function walkthroughToEvidenceJsonLd(fw, evaluation, { scan = null, engineVersion = null, generatedAt = null } = {}) {
+  const controls = (evaluation || []).map((e) => ({
+    '@type': 'Control', id: e.control && e.control.id, title: e.control && e.control.summary, status: e.status,
+    observations: e.observations || [], controlRefs: e.controlRefs || [],
+    codeTestable: (e.control && e.control.codeTestable) || null,
+  }));
+  const count = (st) => controls.filter((c) => c.status === st).length;
+  const gaps = languageAnalysisGaps(scan);
+  const digest = crypto.createHash('sha256').update(JSON.stringify(controls)).digest('hex');
+  return {
+    '@context': { '@vocab': 'https://agentic-security.io/compliance/v1/', schema: 'https://schema.org/' },
+    '@type': 'ComplianceEvidence',
+    schemaVersion: 1,
+    statusSemantics: 'present = no open findings on every mapped family and nothing capped it; partial = evidence with a gap or an unverifiable mapping; absent = nothing checked out; manual = no automated mapping',
+    policySource: `bundled:${fw.id}`,
+    framework: fw.id,
+    version: fw.controlsDigest || null,
+    generatedAt: generatedAt || new Date().toISOString(),
+    disclaimer: EVIDENCE_GRADE_DISCLAIMER_SHORT,
+    provenance: { engineVersion, languageAnalysis: { present: gaps.present, incomplete: gaps.incomplete, reasons: gaps.reasons } },
+    evidenceDigest: digest,
+    summary: { total: controls.length, present: count('present'), partial: count('partial'), absent: count('absent'), manual: count('manual') },
+    controls,
+  };
+}
+
 export const _internals = { _readJson, _resolveOpenFindingMinSeverity, SEVERITY_POLICY_FILE };

package/src/posture/clustering.js

@@ -38,8 +38,8 @@ function sinkKey(f) {
   // finding reaching this point has a distinct line — folding the line into
   // the key here can only split buckets more finely, never wrongly merge one.
   const sinkExpr = (parser === 'IR-TAINT'
-    ? `L${f.sink?.line || f.line || 0}:${f.sink?.label || ''}`
-    : (f.sink?.label || f.sink?.snippet || f.snippet || ''))
+    ? `L${f.sink?.line || f.line || 0}:${f.sink?.label || ''}${f.siteKey ? `:${f.siteKey}` : ''}`   // Haskell: distinct sinks on one line stay distinct
+    : `${f.sink?.label || f.sink?.snippet || f.snippet || ''}${f.siteKey ? `|${f.siteKey}` : ''}`)
     .replace(/['"`][^'"`]*['"`]/g, '_S_')
     .replace(/\s+/g, ' ')
     .trim()

package/src/posture/evidence-bundle.js

@@ -197,6 +197,12 @@ export function buildEvidenceBundle(finding, { engineVersion, rulesetVersion, bu
       cwe: finding.cwe ?? null,
       family: finding.family ?? null,
       parser: finding.parser ?? null,
+      // Haskell/Nix findings carry where the code is and what kind of evidence decided them. Added only when present, so
+      // the canonical bytes (and signatures) of every existing bundle are unchanged.
+      ...(finding.language ? { language: finding.language } : {}),
+      ...(finding.evidenceKind ? { evidenceKind: finding.evidenceKind } : {}),
+      ...(finding.originalLocation ? { originalLocation: finding.originalLocation } : {}),
+      ...(finding.generatedLocation ? { generatedLocation: finding.generatedLocation } : {}),
     },
     evidence: {
       // The honest chain, in the vocabulary the engine already uses.
@@ -206,7 +212,7 @@ export function buildEvidenceBundle(finding, { engineVersion, rulesetVersion, bu
       exploitability: finding.exploitability ?? null,
       unreachable: finding.unreachable ?? null,
       // Present only for the layers that produce them; absent means absent.
-      taintPath: finding.pathSteps ?? finding.exampleFlows ?? null,
+      taintPath: finding.pathSteps ?? finding.exampleFlows ?? (Array.isArray(finding.chain) && finding.language ? finding.chain : null),
       discovery: finding.discovery ?? null,
     },
     engine: {