@clear-capabilities/agentic-security-scanner 0.153.2 → 0.155.0

package/src/posture/execution-proof.js

@@ -80,6 +80,21 @@ export async function proveFinding(finding, { timeoutMs = DEFAULT_PROOF_TIMEOUT_
   if (!poc?.code) {
     return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: 'no proof-of-concept attached' }));
   }
+  // X-009: language witnesses (generated Nix shell scripts; Haskell programs when a toolchain exists). The proof is the
+  // same marker file; the SCOPE is recorded so a configuration/generated-script proof is never read as runtime
+  // exploitation of a deployed system.
+  if (poc.lang === 'nix-shell' || poc.lang === 'haskell') {
+    const W = await import('../language/witness.js');
+    const r = poc.lang === 'haskell' ? W.runHaskellWitness(poc.code, { timeoutMs, force }) : W.runNixScriptWitness(poc.witness, { timeoutMs, force });
+    const scope = poc.lang === 'nix-shell'
+      ? { proofKind: 'generated-script-execution', doesNotProve: 'that a deployed host evaluates this configuration or that the interpolated option is attacker-controlled there' }
+      : { proofKind: 'source-witness-execution', doesNotProve: 'that the deployed application receives attacker input on this path' };
+    return attachProofTier(finding, _evidence({
+      tier: r.status === 'reproduced' ? 'execution-proven' : r.status === 'not-reproduced' ? 'proof-failed' : proofTierOf(finding),
+      backend: r.backend || detectBackend(), ran: !!r.ran, observed: r.observed || null, reason: r.reason || null, exitCode: r.exitCode ?? null, timedOut: !!r.timedOut,
+      witnessStatus: r.status, ...scope,
+    }));
+  }
   if (poc.lang !== 'js') {
     return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: `unsupported poc language: ${poc.lang}` }));
   }

package/src/posture/falsification.js

@@ -90,6 +90,13 @@ export function classifyFinding(finding, fileContents) {
   if (finding.sanitizerMismatch) {
     return { verdict: 'survived', reasons: ['wrong-context sanitizer does not neutralize this sink'] };
   }
+  // Haskell and Nix findings are judged on the IR / effective configuration, never on adjacent text: the taint
+  // engine already refuses a flow that a DOMINATING, context-matched guard covers (language/haskell-guards.js), and
+  // a NixOS value is decided by option precedence. A sanitizer-looking word near the sink (a comment, a helper that
+  // is not on the path, a control for a different family) is not control evidence, so text proximity never blocks.
+  if (/\.(?:l?hs|nix)$/i.test(String(finding.file || ''))) {
+    return { verdict: 'survived', reasons: ['judged on the IR/effective configuration: adjacent text is not control evidence'] };
+  }
   const window = _pathWindow(finding, fileContents);
   if (!window || !window.trim()) {
     return { verdict: 'unproven', reasons: ['no source context available to attempt falsification'] };

package/src/posture/family-resolve.js

@@ -10,6 +10,8 @@
 //
 // One definition, no cycle, both callers import from here.
 
+import { LANGUAGE_FAMILY_ALIASES } from '../language/compliance-map.js';
+
 export const COMPLIANCE_FAMILY_ALIAS = {
   // ASVS spells it `sqli`; every detector emits `sql-injection` (or a
   // language-prefixed variant, which the suffix rule below does NOT cover
@@ -45,3 +47,8 @@ export function resolveFamilyKeys(fam, availableKeys) {
   return out;
 }
 
+// Haskell/Nix producers emit finer families than the frameworks name; those are evidence for the framework family
+// (language/compliance-map.js). Merged without disturbing any existing alias.
+for (const [fam, extra] of Object.entries(LANGUAGE_FAMILY_ALIASES)) {
+  COMPLIANCE_FAMILY_ALIAS[fam] = [...new Set([...(COMPLIANCE_FAMILY_ALIAS[fam] || []), ...extra])];
+}

package/src/posture/fix-history.js

@@ -356,6 +356,46 @@ export async function applyFix({ scanRoot, file, originalContent, newContent, fi
   });
 }
 
+/**
+ * Records a fix that a language lifecycle (Haskell, Nix) has ALREADY written, with its own backup, so one ledger
+ * serves every ecosystem: `agentic-security undo` reverts it, the attempt budget counts it, and its tier (FULL,
+ * MITIGATION, WORKAROUND) and the gates it passed are kept on the entry beside the timestamp. No second write happens
+ * here; `backup.original` is the file the lifecycle saved before it wrote.
+ */
+export async function recordExternalFix({ scanRoot, file, originalContent, newContent, findingId, ruleId, vuln, stableId, fixLabel = null, verification = null, backup = null, source = 'language-lifecycle', findingProvenance = null }) {
+  return _withLogLock(scanRoot, async () => {
+    if (!ensure(scanRoot)) return null;
+    const log = readLog(scanRoot);
+    const priorAttempts = _countPriorAttempts(log, stableId || null, findingId);
+    const bakAbs = backup && backup.dir ? path.join(backup.dir, 'original') : null;
+    const entry = {
+      id: `fix-${Date.now().toString(36)}-${sha(file + findingId).slice(0, 6)}`,
+      findingId, stableId: stableId || null, ruleId: ruleId || null, vuln: vuln || null, file, fileExisted: true,
+      backupPath: bakAbs ? path.relative(scanRoot, bakAbs) : null,
+      originalSha: sha(originalContent), newSha: sha(newContent),
+      appliedAt: new Date().toISOString(), status: 'applied', reverted: false, attemptOrdinal: priorAttempts + 1,
+      provenanceAtFix: _snapshotProvenanceAtFix(findingProvenance, new Date().toISOString()),
+      fixLabel, verification, source, languageBackupId: backup ? backup.id : null,
+    };
+    log.push(entry);
+    await _writeLogAndSync(scanRoot, log);
+    return entry;
+  });
+}
+
+/** Marks the history entry written for a language-lifecycle backup as reverted (sync: the lifecycle's undo is sync). */
+export function markRevertedByBackup(scanRoot, backupId) {
+  try {
+    const fp = logPath(scanRoot);
+    if (!fs.existsSync(fp)) return false;
+    const log = JSON.parse(fs.readFileSync(fp, 'utf8'));
+    let hit = false;
+    for (const e of log) if (e && e.languageBackupId === backupId && !e.reverted) { e.reverted = true; e.revertedAt = new Date().toISOString(); hit = true; }
+    if (hit) { const tmp = `${fp}.tmp-${process.pid}`; fs.writeFileSync(tmp, JSON.stringify(log, null, 2)); fs.renameSync(tmp, fp); }
+    return hit;
+  } catch { return false; }
+}
+
 async function _writeAndSync(fp, content) {
   await fsp.mkdir(path.dirname(fp), { recursive: true });
   const handle = await fsp.open(fp, 'w');

package/src/posture/fix-verify.js

@@ -35,8 +35,17 @@ export async function verifyPatch({
   depFileContents = {},
 } = {}) {
   if (!files || typeof files !== 'object') return { ok: false, reason: 'no-files-provided' };
-  const fileContents = { ...files };
+  let fileContents = { ...files };
   let scan;
+  // Haskell/Nix findings come from the deep (IR) layer and depend on imported modules: verifying a patch without
+  // either would never see the original finding at all, so a patch that fixes nothing would read "verified". The
+  // patched files are scanned deep, together with their import closure and manifests read from disk.
+  let deep;
+  if (Object.keys(fileContents).some((f) => /\.(?:l?hs|hs-boot|hsc|nix)$/i.test(f))) {
+    const { withLanguageContext } = await import('../language/context.js');
+    const lc = withLanguageContext(scanRoot, fileContents, depFileContents);
+    fileContents = lc.fileContents; depFileContents = lc.depFileContents; deep = true;
+  }
   try {
     // `provenance:false` is REQUIRED here, not an optimisation. This scan is
     // deliberately scoped to just the patched file(s), so its finding set is a
@@ -46,7 +55,7 @@ export async function verifyPatch({
     // would mass-mark the rest of the project as remediated, then
     // `reintroduced` on the next real scan. The patched content is also not
     // committed, so there is no history to resolve provenance against anyway.
-    scan = await runFullScan({ fileContents, depFileContents, scanRoot, provenance: false }, () => {});
+    scan = await runFullScan({ fileContents, depFileContents, scanRoot, provenance: false, ...(deep ? { deep: true } : {}) }, () => {});
   } catch (e) {
     return { ok: false, reason: 'rescan-failed', error: e.message };
   }
@@ -56,8 +65,11 @@ export async function verifyPatch({
   if (stillHasOriginal) {
     return { ok: false, reason: 'original-finding-still-present', stableId: originalFindingStableId };
   }
+  // With language context in play, files that were only read for context carry findings that predate the patch;
+  // only findings in the PATCHED files can be introduced by it.
+  const patchedSet = new Set(Object.keys(files));
   const introducedHighOrAbove = findings.filter(f =>
-    (SEVERITY_RANK[f.severity] ?? 9) <= SEVERITY_RANK.medium);
+    (SEVERITY_RANK[f.severity] ?? 9) <= SEVERITY_RANK.medium && (!deep || patchedSet.has(f.file)));
   // Don't count findings on lines outside the patched files — but our
   // fileContents map IS the patched files, so every finding is in-scope.
   return {

package/src/posture/provenance/git-evidence.js

@@ -233,6 +233,30 @@ export function getBlobAtCommit(scanRoot, sha, file) {
   return r.ok ? r.stdout : null;
 }
 
+/** Files in the tree at `sha` (relative to scanRoot) whose path matches `re`, capped. Empty on any failure. */
+export function listFilesAtCommit(scanRoot, sha, re, { max = 400 } = {}) {
+  if (!_isSha(sha) || !(re instanceof RegExp)) return [];
+  const r = _run(scanRoot, ['ls-tree', '-r', '--name-only', sha, '--', '.']);
+  if (!r.ok) return [];
+  return r.stdout.split('\n').map((x) => x.trim()).filter((x) => x && re.test(x)).slice(0, max);
+}
+
+/**
+ * Commits, oldest first, that touched ANY of `files`. Used when a finding is decided by several files (an import
+ * chain, a module graph) so the commit that changed any of them is a candidate origin. No rename following.
+ */
+export function candidateCommitsForFiles(scanRoot, files, { since } = {}) {
+  const rels = (files || []).map((f) => _relPath(scanRoot, f)).filter(Boolean);
+  if (!rels.length) return [];
+  if (since && !_isSafeRevision(since)) return [];
+  const args = ['log', '--format=%H', '--reverse'];
+  if (since) args.push(`${since}..HEAD`);
+  args.push('--', ...rels);
+  const r = _run(scanRoot, args);
+  if (!r.ok) return [];
+  return [...new Set(r.stdout.split('\n').map((x) => x.trim()).filter(Boolean))];
+}
+
 export function candidateCommitsForLine(scanRoot, file, line, { since } = {}) {
   const rel = _relPath(scanRoot, file);
   if (!rel) return [];

package/src/posture/provenance/origin-resolver.js

@@ -23,7 +23,7 @@
 // that disambiguates them; see the branch below for exactly how each is
 // handled.
 
-import { candidateCommitsForLine, commitMeta, getBlobAtCommit, isAncestor } from './git-evidence.js';
+import { candidateCommitsForLine, candidateCommitsForFiles, commitMeta, getBlobAtCommit, isAncestor } from './git-evidence.js';
 import { replayAt } from './predicate-replay.js';
 import { PROVENANCE_METHOD } from './schema.js';
 import { checkAbsentInSomeParent, detectRevert, detectCherryPick } from './dag-walk.js';
@@ -38,6 +38,11 @@ function relevantFiles(finding) {
   if (Array.isArray(finding.pathSteps)) {
     for (const step of finding.pathSteps) if (step.file) files.add(step.file);
   }
+  // Haskell/Nix findings are decided by more than the line they point at: a taint chain crosses modules, and a
+  // NixOS option is decided by imported modules. Replaying only the anchor file would attribute the finding to the
+  // commit that last touched that one file, so the files that decided it are replayed together.
+  if (Array.isArray(finding.chain)) for (const step of finding.chain) if (step && typeof step.file === 'string' && step.file) files.add(step.file);
+  if (Array.isArray(finding.controlFiles)) for (const f of finding.controlFiles) if (typeof f === 'string' && f) files.add(f);
   return [...files];
 }
 
@@ -173,7 +178,14 @@ export async function resolveOrigin(scanRoot, finding, { since, deadlineAt, repo
     return { status: 'not_available', reason: 'missing-file-line-or-stableId', commitsConsidered: 0 };
   }
 
-  const candidates = candidateCommitsForLine(scanRoot, file, line, { since });
+  let candidates = candidateCommitsForLine(scanRoot, file, line, { since });
+  // Haskell/Nix: more than the anchor line decides a finding (an import chain, a module graph), so the commits that
+  // touched ANY of the deciding files are candidates too, in chronological order.
+  const decidingFiles = relevantFiles(finding);
+  if (/\.nix$/i.test(file) || (decidingFiles.length > 1 && /\.l?hs$/i.test(file))) {
+    const wide = candidateCommitsForFiles(scanRoot, decidingFiles, { since });
+    if (wide.length) candidates = [...new Set([...wide, ...candidates])];
+  }
   if (candidates.length === 0) {
     return { status: 'not_available', reason: 'no-candidate-commits', commitsConsidered: 0 };
   }

package/src/posture/provenance/predicate-replay.js

@@ -11,7 +11,7 @@
 
 import { runFullScan, _snapshotSuppressionLog, _restoreSuppressionLog } from '../../engine.js';
 import { computeStableId } from '../stable-id.js';
-import { getBlobAtCommit } from './git-evidence.js';
+import { getBlobAtCommit, listFilesAtCommit } from './git-evidence.js';
 
 // Task 11 concurrency fix: `coordinator.js` resolves several findings' origins
 // CONCURRENTLY (its own comment: "the scheduler runs these four at a time"),
@@ -59,6 +59,12 @@ export function _runExclusive(fn) {
 
 export async function replayAt(scanRoot, sha, files, targetStableId) {
   const fileContents = {};
+  // A NixOS option is decided by every module the configuration imports, including ones deleted later, so a Nix
+  // finding is replayed against ALL Nix sources and the lock file as they existed at that commit.
+  if (files.some((f) => /\.nix$/i.test(f))) {
+    const all = listFilesAtCommit(scanRoot, sha, /(?:\.nix|(?:^|\/)flake\.lock)$/i);
+    files = [...new Set([...files, ...all])];
+  }
   for (const f of files) {
     const content = getBlobAtCommit(scanRoot, sha, f);
     if (content != null) fileContents[f] = content;
@@ -100,7 +106,10 @@ export async function replayAt(scanRoot, sha, files, targetStableId) {
         // identical computeStableId output with and without annotators, over
         // a real scan) before this was wired in — see the FR-PROV-029 commit
         // message for methodology.
-        return await runFullScan({ fileContents, scanRoot, provenance: false, skipAnnotators: true }, () => {});
+        // Haskell/Nix findings come from the IR-taint layer, which only runs in deep mode: a replay that skips it
+        // can never see the finding at ANY commit, so origin resolution would end "never confirmed" for every one.
+        const _langDeep = Object.keys(fileContents).some((f) => /\.(?:l?hs|nix)$/i.test(f)) ? { deep: true } : {};
+        return await runFullScan({ fileContents, scanRoot, provenance: false, skipAnnotators: true, ..._langDeep }, () => {});
       } finally {
         _restoreSuppressionLog(_suppSnapshot);
       }

package/src/posture/provenance/sca-origin.js

@@ -1,6 +1,7 @@
 import * as crypto from 'node:crypto';
 import { candidateCommitsForFile, getFirstParent, getBlobAtCommit, commitMeta } from './git-evidence.js';
 import { PROVENANCE_METHOD } from './schema.js';
+import { compareVersions } from '../../language/haskell-manifests.js';
 
 function parseSemver(v) {
   const m = String(v || '').replace(/^[^\d]*/, '').match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -13,7 +14,17 @@ function cmpSemver(a, b) {
   return 0;
 }
 
-export function versionInRange(version, range) {
+// Hackage versions follow the PVP: any number of components, compared numerically component by component. The
+// three-component semver comparison below would call 2.1.2.1 and 2.1.2.9 equal.
+function pvpInRange(version, range) {
+  if (!version) return false;
+  if (range.introduced && compareVersions(version, range.introduced) < 0) return false;
+  if (range.fixed && compareVersions(version, range.fixed) >= 0) return false;
+  return true;
+}
+
+export function versionInRange(version, range, ecosystem = null) {
+  if (ecosystem && String(ecosystem).toLowerCase() === 'hackage') return pvpInRange(version, range);
   const v = parseSemver(version);
   if (!v) return false;
   if (range.introduced) {
@@ -42,6 +53,12 @@ function extractDeclaredVersion(blobText, depName, filePath) {
       return null;
     }
   }
+  // Hackage: the version is exact only where a freeze, a Stack lock or an extra-deps pin states it.
+  const esc = String(depName).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  if (base === 'cabal.project.freeze') { const m = new RegExp(`any\\.${esc}\\s*==\\s*([0-9][0-9.]*)`).exec(blobText); return m ? m[1] : null; }
+  if (base === 'stack.yaml.lock') { const m = new RegExp(`hackage:\\s*${esc}-([0-9][0-9.]*)(?:@|\\s|$)`).exec(blobText); return m ? m[1] : null; }
+  if (base === 'stack.yaml') { const m = new RegExp(`^\\s*-\\s*${esc}-([0-9][0-9.]*)\\s*$`, 'm').exec(blobText); return m ? m[1] : null; }
+  if (/\.cabal$/i.test(base)) { const m = new RegExp(`(?:^|[\\s,:])${esc}\\s*==\\s*([0-9][0-9.]*)(?![\\w.*])`, 'm').exec(blobText); return m ? m[1] : null; }
   if (/^requirements(?:[._-][\w.-]+)?\.txt$/i.test(base)) {
     for (const line of blobText.split('\n')) {
       const m = line.trim().match(/^([A-Za-z0-9_.-]+)\s*[=~<>!]+\s*([^\s;#,]*)/);
@@ -98,7 +115,7 @@ export async function resolveDirectSCAOrigin(scanRoot, scaEntry, { since, deadli
     const blob = getBlobAtCommit(scanRoot, sha, file);
     if (blob == null) continue;
     const declaredVersion = extractDeclaredVersion(blob, scaEntry.name, file);
-    if (!declaredVersion || !versionInRange(declaredVersion, range)) continue;
+    if (!declaredVersion || !versionInRange(declaredVersion, range, scaEntry.ecosystem)) continue;
 
     const parent = getFirstParent(scanRoot, sha);
     if (!parent) {
@@ -111,7 +128,7 @@ export async function resolveDirectSCAOrigin(scanRoot, scaEntry, { since, deadli
 
     const parentBlob = getBlobAtCommit(scanRoot, parent, file);
     const parentVersion = parentBlob ? extractDeclaredVersion(parentBlob, scaEntry.name, file) : null;
-    const parentOutOfRange = !parentVersion || !versionInRange(parentVersion, range);
+    const parentOutOfRange = !parentVersion || !versionInRange(parentVersion, range, scaEntry.ecosystem);
     if (!parentOutOfRange) {
       // Parent was already in the vulnerable range too. If the declared value
       // actually changed here, this is the ambiguous "still-vulnerable bump"

package/src/posture/sbom-diff.js

@@ -21,7 +21,7 @@
 // module produces the diff on the next scan.
 
 import * as fs from 'node:fs';
-import { statePath, stateWritesEnabled } from './state-dir.js';
+import { statePath, stateWritesEnabled, safeWriteState } from './state-dir.js';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { execFileSync } from 'node:child_process';
@@ -52,6 +52,9 @@ function _gitHead(scanRoot) {
 }
 
 function _snapshotKey(component) {
+  // Language components carry an identity that survives a version change but keeps two resolved builds apart
+  // (a flag variant, a second store hash); everything else keeps the ecosystem:name key it always had.
+  if (component.identityKey) return component.identityKey;
   return `${component.ecosystem || 'unknown'}:${component.name || ''}`;
 }
 
@@ -65,7 +68,6 @@ export function persistSbom(scanRoot, components) {
   // empty `sbom-history/` in the scanned tree — invisible to `git status`,
   // because git does not track empty directories, and therefore exactly the
   // kind of mutation that passes a clean-status check while still being one.
-  if (stateWritesEnabled()) { try { fs.mkdirSync(dir, { recursive: true }); } catch {} }
   const sha = _gitHead(scanRoot) || crypto.createHash('sha256').update(JSON.stringify(components)).digest('hex').slice(0, 12);
   const snap = {
     sha, ts: new Date().toISOString(),
@@ -73,14 +75,13 @@ export function persistSbom(scanRoot, components) {
     components: components.map(c => ({
       ecosystem: c.ecosystem, name: c.name, version: c.version,
       purl: c.purl, scope: c.scope, isUnpinned: !!c.isUnpinned,
-      sha256: c.sha256 || c.integrity || null,
+      ...(c.identityKey ? { identityKey: c.identityKey, bomRef: c.bomRef || null } : {}),
+      sha256: c.sha256 || c.integrity || ((c.hashes || []).find((h) => h.alg === 'SHA-256') || {}).content || null,
     })),
   };
   // NON_MUTATING_SCAN_PRD S1 — history is a feature, but not at the cost of
   // mutating a tree the caller only asked us to read.
-  if (stateWritesEnabled()) {
-    try { fs.writeFileSync(path.join(dir, `${sha}.json`), JSON.stringify(snap, null, 2)); } catch {}
-  }
+  if (stateWritesEnabled()) safeWriteState(path.join(dir, `${sha}.json`), JSON.stringify(snap, null, 2));   // refuses a symlinked state directory or file
   return snap;
 }
 

package/src/posture/sbom.js

@@ -60,27 +60,49 @@ function _documentUuid(seed) {
   return isDeterministic() ? _stableUuidFrom(seed) : crypto.randomUUID();
 }
 
+// The bom-ref a vulnerability points at: the component's own ref when it has one (language components do), else the
+// derived one. A different resolved build of the same package is a different component and keeps its own ref.
+function _vulnTargetRef(components, s) {
+  const hit = components.find(c => c.bomRef && c.name === s.name && c.version === s.version && (c.ecosystem || '') === (s.ecosystem || ''));
+  return hit ? hit.bomRef : _bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version });
+}
+
 export function toCycloneDX(scan, meta = {}) {
-  const components = scan.components || [];
+  const components = [...(scan.components || []), ...((scan.languageBom && scan.languageBom.components) || [])];
+  scan = scan.languageBom ? { ...scan, bomRoot: scan.languageBom.root || scan.bomRoot, bomDependencies: scan.languageBom.dependencies, bomCompositions: scan.languageBom.compositions, bomProperties: scan.languageBom.properties } : scan;
   const supplyChain = (scan.supplyChain || []).filter(s => s.type === 'vulnerable_dep');
   const serialNumber = `urn:uuid:${_documentUuid(JSON.stringify(components.map(_bomRef)))}`;
 
+  // Language components (Hackage, Nix) carry their own identity, scope, hashes and build provenance; every other
+  // component keeps exactly the shape it always had. A version is written only when one is known (a null or empty
+  // version is not a valid CycloneDX string), and nothing here invents a license.
+  const refOf = (c) => c.bomRef || _bomRef(c);
   const cdxComponents = components.map(c => ({
-    type: 'library',
-    'bom-ref': _bomRef(c),
+    type: c.cdxType || 'library',
+    'bom-ref': refOf(c),
     name: c.name,
-    version: c.version,
-    purl: _purl(c),
+    ...(c.version ? { version: c.version } : (c.bomRef ? {} : { version: c.version })),
+    ...(c.purl || !c.bomRef ? { purl: _purl(c) } : {}),
     ...(c.license ? { licenses: [{ license: { id: c.license } }] } : {}),
-    ...(c.scope ? { scope: c.scope === 'dev' ? 'optional' : 'required' } : {}),
+    ...(c.cdxScope ? { scope: c.cdxScope } : (c.scope ? { scope: c.scope === 'dev' ? 'optional' : 'required' } : {})),
+    ...(Array.isArray(c.hashes) && c.hashes.length ? { hashes: c.hashes } : {}),
+    ...(Array.isArray(c.externalReferences) && c.externalReferences.length ? { externalReferences: c.externalReferences } : {}),
+    ...(Array.isArray(c.properties) && c.properties.length ? { properties: c.properties } : {}),
   }));
+  const knownRefs = new Set([...cdxComponents.map(x => x['bom-ref']), ...(scan.bomRoot ? [scan.bomRoot['bom-ref']] : [])]);
+  const cdxDependencies = (scan.bomDependencies || [])
+    .filter(d => knownRefs.has(d.ref))
+    .map(d => ({ ref: d.ref, dependsOn: (d.dependsOn || []).filter(r => knownRefs.has(r)) }));
+  const cdxCompositions = (scan.bomCompositions || [])
+    .map(c => ({ aggregate: c.aggregate, dependencies: (c.dependencies || []).filter(r => knownRefs.has(r)) }))
+    .filter(c => c.dependencies.length);
 
   const vulnerabilities = supplyChain.map((s, i) => ({
     // The last-resort id was crypto.randomUUID(), which reintroduced
     // per-run drift for any advisory carrying neither an osvId nor an
     // advisory string. Index within the (already deterministically sorted)
     // supplyChain array identifies it just as well and is reproducible.
-    'bom-ref': `${_bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version })}#${s.osvId || s.advisory || `unidentified-${i}`}`,
+    'bom-ref': `${_vulnTargetRef(components, s)}#${s.osvId || s.advisory || `unidentified-${i}`}`,
     id: s.osvId || (s.cveAliases || [])[0] || s.advisory,
     source: { name: 'OSV.dev', url: `https://osv.dev/vulnerability/${s.osvId || ''}` },
     references: (s.cveAliases || []).map(cve => ({ id: cve, source: { name: 'NVD' } })),
@@ -89,7 +111,7 @@ export function toCycloneDX(scan, meta = {}) {
       ...(s.cvssVector ? [{ vector: s.cvssVector, method: 'CVSSv3' }] : []),
     ],
     description: s.description || s.advisory || '',
-    affects: [{ ref: _bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version }) }],
+    affects: [{ ref: _vulnTargetRef(components, s) }],
     properties: [
       ...(s.epssScore != null ? [{ name: 'epss:score', value: String(s.epssScore) }] : []),
       ...(s.epssPercentile != null ? [{ name: 'epss:percentile', value: String(s.epssPercentile) }] : []),
@@ -105,34 +127,53 @@ export function toCycloneDX(scan, meta = {}) {
     metadata: {
       timestamp: meta.startedAt || new Date().toISOString(),
       tools: [{ vendor: 'Clear Capabilities', name: 'agentic-security', version: meta.engineVersion || 'dev' }],
-      component: { type: 'application', name: 'scan-target', version: '1.0.0' },
+      component: scan.bomRoot ? { ...scan.bomRoot } : { type: 'application', name: 'scan-target', version: '1.0.0' },
+      ...(Array.isArray(scan.bomProperties) && scan.bomProperties.length ? { properties: scan.bomProperties } : {}),
     },
     components: cdxComponents,
+    ...(cdxDependencies.length ? { dependencies: cdxDependencies } : {}),
+    ...(cdxCompositions.length ? { compositions: cdxCompositions } : {}),
     ...(vulnerabilities.length ? { vulnerabilities } : {}),
   };
 }
 
 export function toSPDX(scan, meta = {}) {
-  const components = scan.components || [];
+  const components = [...(scan.components || []), ...((scan.languageBom && scan.languageBom.components) || [])];
+  scan = scan.languageBom ? { ...scan, bomRoot: scan.languageBom.root || scan.bomRoot, bomDependencies: scan.languageBom.dependencies } : scan;
   const supplyChain = (scan.supplyChain || []).filter(s => s.type === 'vulnerable_dep');
   const docNamespace = `https://agentic-security.local/spdx/${_documentUuid(JSON.stringify(components.map(_bomRef)))}`;
-  const ts = meta.startedAt || new Date().toISOString();
+  // SPDX 2.3 `created` is YYYY-MM-DDThh:mm:ssZ: fractional seconds are not part of the format.
+  const ts = (meta.startedAt || new Date().toISOString()).replace(/\.\d+(Z|[+-]\d{2}:\d{2})$/, (_m, z) => (z === 'Z' ? 'Z' : z));
 
-  const packages = components.map((c, i) => ({
-    SPDXID: `SPDXRef-Package-${i}`,
-    name: c.name,
-    versionInfo: c.version,
-    downloadLocation: 'NOASSERTION',
-    filesAnalyzed: false,
-    licenseConcluded: c.license || 'NOASSERTION',
-    licenseDeclared: c.license || 'NOASSERTION',
-    copyrightText: 'NOASSERTION',
-    externalRefs: [{
-      referenceCategory: 'PACKAGE-MANAGER',
-      referenceType: 'purl',
-      referenceLocator: _purl(c),
-    }],
-  }));
+  const spdxIdOfRef = new Map();
+  // The described application itself is a package, so dependency edges that start at it have an element to attach to.
+  const rootPackage = scan.bomRoot && scan.bomRoot['bom-ref'] ? [{
+    SPDXID: 'SPDXRef-Package-root', name: scan.bomRoot.name, ...(scan.bomRoot.version ? { versionInfo: scan.bomRoot.version } : {}),
+    downloadLocation: 'NOASSERTION', filesAnalyzed: false, licenseConcluded: 'NOASSERTION', licenseDeclared: 'NOASSERTION', copyrightText: 'NOASSERTION',
+    primaryPackagePurpose: 'APPLICATION', externalRefs: [],
+  }] : [];
+  if (rootPackage.length) spdxIdOfRef.set(scan.bomRoot['bom-ref'], 'SPDXRef-Package-root');
+  const packages = components.map((c, i) => {
+    const id = `SPDXRef-Package-${i}`;
+    if (c.bomRef) spdxIdOfRef.set(c.bomRef, id);
+    return {
+      SPDXID: id,
+      name: c.name,
+      ...((c.version || !c.bomRef) ? { versionInfo: c.version } : {}),
+      downloadLocation: 'NOASSERTION',
+      filesAnalyzed: false,
+      ...(Array.isArray(c.hashes) && c.hashes.length ? { checksums: c.hashes.map(h => ({ algorithm: String(h.alg).replace('-', ''), checksumValue: h.content })) } : {}),
+      licenseConcluded: c.license || 'NOASSERTION',
+      licenseDeclared: c.license || 'NOASSERTION',
+      copyrightText: 'NOASSERTION',
+      ...(c.bomRef ? { primaryPackagePurpose: 'LIBRARY' } : {}),
+      externalRefs: [...((c.purl || !c.bomRef) ? [{
+        referenceCategory: 'PACKAGE-MANAGER',
+        referenceType: 'purl',
+        referenceLocator: _purl(c),
+      }] : [])],
+    };
+  });
 
   // SPDX expresses CVEs as external refs on the package, not separate elements
   const cveByName = {};
@@ -162,11 +203,23 @@ export function toSPDX(scan, meta = {}) {
       created: ts,
       creators: [`Tool: agentic-security-${meta.engineVersion || 'dev'}`],
     },
-    packages,
-    relationships: packages.map(p => ({
-      spdxElementId: 'SPDXRef-DOCUMENT',
-      relatedSpdxElement: p.SPDXID,
-      relationshipType: 'DESCRIBES',
-    })),
+    packages: [...rootPackage, ...packages],
+    relationships: [
+      ...[...rootPackage, ...packages].map(p => ({
+        spdxElementId: 'SPDXRef-DOCUMENT',
+        relatedSpdxElement: p.SPDXID,
+        relationshipType: 'DESCRIBES',
+      })),
+      // Dependency edges between language components. Runtime edges are DEPENDS_ON; a build- or test-only target is
+      // expressed with the SPDX 2.3 *_DEPENDENCY_OF relationship so the scope survives the conversion.
+      ...(scan.bomDependencies || []).flatMap(d => (d.dependsOn || []).map(to => {
+        const a = spdxIdOfRef.get(d.ref); const b = spdxIdOfRef.get(to);
+        if (!a || !b) return null;
+        const kind = (d.kinds || {})[to] || 'runtime';
+        if (kind === 'test') return { spdxElementId: b, relatedSpdxElement: a, relationshipType: 'TEST_DEPENDENCY_OF' };
+        if (kind === 'build') return { spdxElementId: b, relatedSpdxElement: a, relationshipType: 'BUILD_DEPENDENCY_OF' };
+        return { spdxElementId: a, relatedSpdxElement: b, relationshipType: 'DEPENDS_ON' };
+      })).filter(Boolean),
+    ],
   };
 }

package/src/posture/sca-policy.js

@@ -41,6 +41,7 @@ import * as path from 'node:path';
 import * as yaml from '../util/yaml.js';
 
 import { safeWriteState, stateDir, statePath } from './state-dir.js';
+import { BUILD_TRUST_TYPE } from '../language/contracts.js';
 const DEFAULT_POLICY = {
   acceptRisk: [],
   sla: {},
@@ -75,6 +76,7 @@ function _normalizeAccept(entry) {
   return {
     cve: entry.cve ? String(entry.cve).toUpperCase() : null,
     package: entry.package ? String(entry.package).toLowerCase() : null,
+    rule: entry.rule ? String(entry.rule) : null,
     version: entry.version ? String(entry.version) : null,
     ecosystem: entry.ecosystem ? String(entry.ecosystem).toLowerCase() : null,
     reason: entry.reason || '',
@@ -125,6 +127,13 @@ export function matchAcceptRisk(finding, policy, today = new Date()) {
   const pkgName = String(finding.name || '').toLowerCase();
   for (const entry of policy.acceptRisk) {
     if (!_accepted(entry, today)) continue;
+    // A `rule:` entry targets a build-trust policy finding (no CVE, no version) by its rule id.
+    if (entry.rule) {
+      if (finding.type === BUILD_TRUST_TYPE && finding.rule === entry.rule
+          && (!entry.package || pkgName === entry.package)
+          && (!entry.ecosystem || entry.ecosystem === finding.ecosystem)) return entry;
+      continue;
+    }
     if (entry.cve && cves.includes(entry.cve)) return entry;
     if (entry.package && pkgName === entry.package) {
       if (entry.version && finding.version && entry.version !== finding.version) continue;
@@ -144,7 +153,7 @@ export function applyScaPolicy(findings, policy, scanTime = new Date()) {
   const stats = { suppressed: 0, slaTagged: 0, frozen: 0 };
   if (!policy || !Array.isArray(findings)) return stats;
   for (const f of findings) {
-    if (!f || f.type !== 'vulnerable_dep') continue;
+    if (!f || (f.type !== 'vulnerable_dep' && f.type !== BUILD_TRUST_TYPE)) continue;
     // Accept-risk suppression
     const acceptance = matchAcceptRisk(f, policy, scanTime);
     if (acceptance) {

package/src/posture/sca-verdict.js

@@ -13,6 +13,8 @@
 // Verdict enum (must match the agent + downstream /fix --sca):
 //   AUTO_MERGE_PATCH · WAIT_FOR_PATCH · MANUAL_REVIEW · ACCEPT_RISK · WONT_FIX
 
+import { BUILD_TRUST_TYPE } from '../language/contracts.js';
+
 export const SCA_VERDICTS = ['AUTO_MERGE_PATCH', 'WAIT_FOR_PATCH', 'MANUAL_REVIEW', 'ACCEPT_RISK', 'WONT_FIX'];
 
 const REACHABLE_TIERS = new Set(['route-reachable-via-function', 'function-reachable', 'import-reachable']);
@@ -64,6 +66,11 @@ export function computeScaVerdict(sc, opts = {}) {
   if (sc.suppressed || sc.suppressionReason) {
     return { verdict: 'ACCEPT_RISK', reason: sc.suppressionReason || 'matched existing accept-risk in sca-policy.yml' };
   }
+  // 1b. Nix build-trust policy findings have no advisory, fixed version or upgrade
+  // path: the remedy is a configuration or pin change, which is always a human call.
+  if (sc.type === BUILD_TRUST_TYPE) {
+    return { verdict: 'MANUAL_REVIEW', reason: `${sc.rule}: ${sc.remediation || 'review the Nix build-trust setting'}` };
+  }
   // 2. No fixed version exists → nothing to upgrade yet.
   if (!fixed.length) {
     return { verdict: 'WAIT_FOR_PATCH', reason: `no fixed version published${sc.osvId ? ` for ${sc.osvId}` : ''}` };
@@ -116,7 +123,7 @@ export function annotateScaVerdicts(supplyChain, opts = {}) {
   if (!Array.isArray(supplyChain)) return supplyChain;
   const counts = { AUTO_MERGE_PATCH: 0, WAIT_FOR_PATCH: 0, MANUAL_REVIEW: 0, ACCEPT_RISK: 0, WONT_FIX: 0 };
   for (const sc of supplyChain) {
-    if (!sc || sc.type !== 'vulnerable_dep') continue;
+    if (!sc || (sc.type !== 'vulnerable_dep' && sc.type !== BUILD_TRUST_TYPE)) continue;
     const { verdict, reason, expiryDays } = computeScaVerdict(sc, opts);
     sc.scaVerdict = verdict;
     sc.scaVerdictReason = reason;