@clear-capabilities/agentic-security-scanner 0.153.2 → 0.155.0

package/src/posture/secret-history.js

@@ -13,6 +13,7 @@
 
 import { execFileSync } from 'node:child_process';
 import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
+import { providerInfo, scanLanguageSecretConcat, scanDependencyUrlCredentials } from '../language/secrets.js';
 
 // Pull the post-image (added) lines out of a unified diff: lines starting with
 // a single '+' (not the '+++' file header). Returns reconstructed text.
@@ -24,25 +25,42 @@ export function extractAddedLines(diffText) {
   return out.join('\n');
 }
 
+// Split a unified diff into per-file sections with the POST-IMAGE line number of every added line, so a
+// finding can name the file and line it was committed at (the combined text alone loses both).
+export function splitDiffByFile(diffText) {
+  const files = [];
+  let cur = null; let next = 0;
+  for (const line of String(diffText || '').split('\n')) {
+    const h = /^diff --git a\/(.+?) b\/(.+)$/.exec(line);
+    if (h) { cur = { path: h[2], added: [] }; files.push(cur); next = 0; continue; }
+    if (!cur) continue;
+    const hh = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hh) { next = parseInt(hh[1], 10); continue; }
+    if (line.startsWith('+++') || line.startsWith('---')) continue;
+    if (line.startsWith('+')) { cur.added.push({ text: line.slice(1), line: next }); next++; }
+    else if (!line.startsWith('-') && !line.startsWith('\\')) next++;
+  }
+  return files;
+}
+
 // Pure: run the injected credential detector over a commit's added lines.
-// detectFn has the scanCredentials(fp, raw) shape and returns Finding[].
-export function scanHistoryDiff(diffText, commit, detectFn) {
+// detectFn has the scanCredentials(fp, raw) shape and returns Finding[]. `extra` are additional detectors
+// ((path, text) => Finding[]) run against each file's added lines WITH the real path, so extension-gated
+// detectors (Haskell/Nix split-secret) apply to history too.
+export function scanHistoryDiff(diffText, commit, detectFn, extra = []) {
   if (typeof detectFn !== 'function') return [];
-  const added = extractAddedLines(diffText);
-  if (!added.trim()) return [];
-  let findings = [];
-  try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
-  return findings.map((f) => {
-    const remediation = 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.';
-    return {
-      ...f,
+  const sections = splitDiffByFile(diffText);
+  const remediation = 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.';
+  const wrap = (f, sec, addedLines) => {
+    const hit = Number.isInteger(f.line) && f.line >= 1 ? addedLines[f.line - 1] : null;
+    const prov = f.rotation ? {} : providerInfo(f._rawProviderValue || '');
+    const out = {
+      ...f, ...prov,
       id: `secret-history:${commit}:${f.id || f.vuln || 'secret'}`,
-      file: `git-history@${commit}`,
-      line: 0,
-      commit,
-      _historical: true,
+      file: `git-history@${commit}`, line: 0, commit, _historical: true,
+      ...(sec ? { sourceFile: sec.path, sourceLine: hit ? hit.line : null } : {}),
       vuln: `${f.vuln || 'Hardcoded Secret'} (in git history)`,
-      description: `${f.description || 'A credential was committed.'} Found in commit ${commit}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
+      description: `${f.description || 'A credential was committed.'} Found in commit ${commit}${sec ? ` (${sec.path}${hit ? `:${hit.line}` : ''})` : ''}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
       remediation,
       // report/index.js's _remediationOf checks `.fix` before `.remediation`
       // — the underlying detector already set `.fix` to a generic "remove
@@ -51,15 +69,41 @@ export function scanHistoryDiff(diffText, commit, detectFn) {
       // insufficient") in every report format.
       fix: remediation,
     };
-  });
+    delete out._rawProviderValue;
+    return out;
+  };
+  const results = [];
+  if (!sections.length) {
+    const added = extractAddedLines(diffText);
+    if (!added.trim()) return [];
+    let findings = [];
+    try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
+    return findings.map((f) => wrap(f, null, []));
+  }
+  for (const sec of sections) {
+    if (!sec.added.length) continue;
+    const text = sec.added.map((a) => a.text).join('\n');
+    if (!text.trim()) continue;
+    let findings = [];
+    try { findings = detectFn(`git-history@${commit}`, text) || []; } catch { findings = []; }
+    for (const f of findings) results.push(wrap(f, sec, sec.added));
+    for (const ex of extra || []) {
+      let more = [];
+      try { more = ex(sec.path, text) || []; } catch { more = []; }
+      for (const f of more) results.push(wrap(f, sec, sec.added));
+    }
+  }
+  return results;
 }
 
+const defaultExtra = [scanLanguageSecretConcat, scanDependencyUrlCredentials];
+
 /**
  * Sweep up to `maxCommits` of recent history for secrets. Best-effort: returns
  * [] when `scanRoot` is not a git repo or git is unavailable. Dedups a secret
  * that recurs across commits to its earliest sighting.
  */
-export function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000 } = {}) {
+export function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000, extraDetectors = null } = {}) {
   if (!scanRoot || typeof detectFn !== 'function') return [];
   let out;
   try {
@@ -78,7 +122,7 @@ export function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs
   const seen = new Set();
   for (let i = 1; i < parts.length; i += 2) {
     const sha = (parts[i] || '').slice(0, 12);
-    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn)) {
+    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn, extraDetectors || defaultExtra)) {
       const key = `${f.vuln}:${(f.snippet || f.match || '').slice(0, 40)}`;
       if (seen.has(key)) continue;
       seen.add(key);

package/src/posture/stable-id.js

@@ -10,6 +10,7 @@
 // that need stability use `stableId`.
 
 import * as crypto from 'node:crypto';
+import { haskellComments, nixComments } from '../language/pragma.js';
 
 function normalizeSnippet(s) {
   if (!s || typeof s !== 'string') return '';
@@ -53,12 +54,30 @@ function ruleId(f) {
   return `vuln:${(f.vuln || '').slice(0, 40)}`;
 }
 
+// Haskell and Nix findings are identified by their code, not by how it is laid out: comments, blank lines,
+// indentation and spacing between tokens never rotate an id. (The generic normaliser keeps spacing next to
+// punctuation, so `f (x)` and `f ( x )` would differ.) Only whitespace and comments are removed; every token stays.
+function normalizeLanguageSnippet(file, s) {
+  if (!s || typeof s !== 'string') return '';
+  const isNix = /\.nix$/i.test(String(file || ''));
+  const spans = isNix ? nixComments(s) : haskellComments(s);
+  let out = ''; let at = 0;
+  for (const c of spans) { out += s.slice(at, c.start); at = c.end; }
+  out += s.slice(at);
+  return out.toLowerCase().replace(/"(?:[^"\\]|\\.)*"/g, '"_S_"').replace(/\s+/g, '');
+}
+
 export function computeStableId(f) {
   const rid = ruleId(f);
-  const sink = normalizeSnippet(f.sink?.snippet || f.snippet || '').slice(0, 200);
+  const isLang = /\.(?:l?hs|hs-boot|hsc|nix)$/i.test(String(f.file || f.sink?.file || ''));
+  const sink = isLang
+    ? normalizeLanguageSnippet(f.file || f.sink?.file, f.sink?.snippet || f.snippet || '').slice(0, 200)
+    : normalizeSnippet(f.sink?.snippet || f.snippet || '').slice(0, 200);
   const shape = pathShape(f);
   const fileHint = basenameLike(f.file || f.sink?.file);
-  const material = `${rid}|${sink}|${shape}|${fileHint}`;
+  // Haskell taint findings carry a site key (a fingerprint of the sink argument), so two sinks of one rule
+  // on one line keep distinct ids. Absent for every other finding, so their ids are unchanged.
+  const material = f.siteKey ? `${rid}|${sink}|${shape}|${fileHint}|${f.siteKey}` : `${rid}|${sink}|${shape}|${fileHint}`;
   return crypto.createHash('sha256').update(material).digest('hex').slice(0, 16);
 }
 

package/src/posture/state-dir.js

@@ -33,8 +33,11 @@ const PROJECT_MARKERS = [
   'build.gradle',
   'composer.json',
   'Gemfile',
+  // Haskell and Nix projects: without these a Cabal, Stack or flake project never got a state directory at all.
+  'cabal.project', 'stack.yaml', 'package.yaml', 'flake.nix', 'configuration.nix', 'default.nix', 'shell.nix',
   '.agentic-security',
 ];
+const PROJECT_MARKER_SUFFIX = /\.cabal$/;
 
 function _findProjectRoot(startDir) {
   let dir = path.resolve(startDir);
@@ -81,8 +84,23 @@ export function statePath(scanRoot, ...parts) {
 // Safety check: refuse to create .agentic-security/ unless the parent
 // directory has at least one project marker. Prevents littering when
 // resolution falls through to a non-project directory.
+// A state directory that is a SYMLINK is never safe: a hostile repository could point `.agentic-security` at a directory elsewhere
+// and have every evidence file written (or overwritten) through it. The state root, and any state directory below it, must be a real
+// directory (or not exist yet); a symlinked file inside it is refused by safeWriteState below.
+function _viaSymlink(dir) {
+  const segments = path.resolve(dir).split(path.sep);
+  const idx = segments.lastIndexOf(STATE_DIR_NAME);
+  if (idx < 0) return false;
+  for (let i = idx; i < segments.length; i++) {
+    const prefix = segments.slice(0, i + 1).join(path.sep) || path.sep;
+    try { if (fs.lstatSync(prefix).isSymbolicLink()) return true; } catch { return false; /* does not exist yet: nothing to follow */ }
+  }
+  return false;
+}
+
 export function isSafeStateDir(dir) {
   if (!dir) return false;
+  if (_viaSymlink(dir)) return false;
   const parent = path.dirname(dir);
   for (const m of PROJECT_MARKERS) {
     if (m === '.agentic-security') continue; // would be circular
@@ -90,6 +108,7 @@ export function isSafeStateDir(dir) {
       if (fs.existsSync(path.join(parent, m))) return true;
     } catch { /* ignore */ }
   }
+  try { if (fs.readdirSync(parent).some((n) => PROJECT_MARKER_SUFFIX.test(n))) return true; } catch { /* ignore */ }
   // A directory NESTED inside an already-valid state root is safe too.
   //
   // Without this the check only ever accepted `<project>/.agentic-security`
@@ -234,6 +253,8 @@ export function safeWriteState(filePath, content, { category } = {}) {
   }
   try {
     fs.mkdirSync(dir, { recursive: true });
+    // never write THROUGH a symlink: an attacker-placed link at the file's own path would redirect the write elsewhere
+    try { if (fs.lstatSync(filePath).isSymbolicLink()) return false; } catch { /* not there yet */ }
     fs.writeFileSync(filePath, content);
     return true;
   } catch {

package/src/posture/threat-model-auto.js

@@ -23,7 +23,7 @@
 // .agentic-security/threat-model.md (human-readable).
 
 import * as fs from 'node:fs';
-import { stateDir, stateWritesEnabled } from './state-dir.js';
+import { stateDir, stateWritesEnabled, safeWriteState } from './state-dir.js';
 import * as path from 'node:path';
 
 // STRIDE category descriptors
@@ -215,9 +215,9 @@ export function persistThreatModel(scanRoot, model) {
   // NON_MUTATING_SCAN_PRD S1 — a scan must not modify the tree it scans.
   if (!stateWritesEnabled()) return;
   const dir = stateDir(scanRoot);
-  try { fs.mkdirSync(dir, { recursive: true }); } catch {}
-  try { fs.writeFileSync(path.join(dir, 'threat-model.json'), JSON.stringify(model, null, 2)); } catch {}
-  try { fs.writeFileSync(path.join(dir, 'threat-model.md'), renderMarkdown(model)); } catch {}
+  // through the state seam: a symlinked state directory or file is refused, never written through
+  safeWriteState(path.join(dir, 'threat-model.json'), JSON.stringify(model, null, 2));
+  safeWriteState(path.join(dir, 'threat-model.md'), renderMarkdown(model));
 }
 
 function renderMarkdown(model) {

package/src/posture/triage.js

@@ -29,13 +29,24 @@ function _save(scanRoot, data) {
 
 // Sync the triage store with the latest scan: new findings become 'open',
 // findings no longer surfaced become 'fixed' (with a transition entry).
-export function syncWithScan(scanRoot, findings) {
+export function syncWithScan(scanRoot, findings, opts = {}) {
   const data = loadTriage(scanRoot);
   const now = new Date().toISOString();
   const seen = new Set();
+  // A finding that is no longer reported is only "fixed" when the scan that stopped reporting it was COMPLETE for the
+  // code it lives in. If its analysis was partial (a parser failed, a required analyzer was off), its absence is
+  // unverified, so it stays open and is marked `unverified` rather than silently closed.
+  const health = opts && opts.scanHealth;
+  const incomplete = !!(health && health.status && health.status !== 'complete');
   for (const f of findings) {
     const id = f.id || `${f.file}:${f.line}:${f.vuln}`;
     seen.add(id);
+    const existing = data.findings[id];
+    // A finding that was closed and is reported again is a regression: reopen it, never leave it 'fixed'.
+    if (existing && existing.state === 'fixed') {
+      existing.state = 'open'; existing.reopened_at = now; delete existing.fixed_at; delete existing.unverified;
+      data.transitions.push({ id, from: 'fixed', to: 'open', at: now, automatic: true, reason: 'reported again by a later scan' });
+    } else if (existing && existing.unverified) { delete existing.unverified; }
     if (!data.findings[id]) {
       data.findings[id] = {
         id,
@@ -56,6 +67,8 @@ export function syncWithScan(scanRoot, findings) {
         ecosystem: f.ecosystem || null,
         osvId: f.osvId || null,
         cveAliases: Array.isArray(f.cveAliases) ? f.cveAliases : [],
+        language: f.language || null,
+        rule: f.rule || null,
       };
       data.transitions.push({ id, from: null, to: 'open', at: now });
     }
@@ -65,6 +78,10 @@ export function syncWithScan(scanRoot, findings) {
     const cur = data.findings[id];
     if (seen.has(id)) continue;
     if (cur.state === 'fixed' || cur.state === 'wont-fix' || cur.state === 'false-positive') continue;
+    if (incomplete) {
+      if (!cur.unverified) { cur.unverified = { since: now, reason: 'not reported, but the scan was not complete' }; data.transitions.push({ id, from: cur.state, to: cur.state, at: now, automatic: true, unverified: true, reason: 'not reported by an incomplete scan' }); }
+      continue;
+    }
     cur.state = 'fixed';
     cur.fixed_at = now;
     data.transitions.push({ id, from: 'open', to: 'fixed', at: now, automatic: true });

package/src/posture/watch-mode.js

@@ -24,6 +24,7 @@ import * as fsSync from 'node:fs';
 import * as path from 'node:path';
 
 import { stateDir, statePath, stateWritesEnabled } from './state-dir.js';
+import { isLanguageSource, isLanguageManifest, isLanguageExcludedPath, isExplicitExport, impactedFiles } from '../language/discovery.js';
 const STATUS_MD   = 'watch-status.md';
 const STATUS_JSON = 'watch-status.json';
 const DEBOUNCE_MS = 350;
@@ -33,10 +34,35 @@ const SCAN_EXT_RE = /\.(?:[jt]sx?|mjs|cjs|py|java|kt|go|rb|php|cs|c|cc|cpp|h|hpp
 const IGNORE_DIR_RE = /(?:^|\/)(?:\.git|node_modules|\.bench-cache|dist|build|\.next|coverage|\.agentic-security)(?:$|\/)/;
 
 function _isScanable(rel) {
-  if (!rel || IGNORE_DIR_RE.test(rel)) return false;
+  if (!rel) return false;
+  // An explicit export is evidence even though it lives in a build directory.
+  if (isExplicitExport(rel)) return true;
+  if (IGNORE_DIR_RE.test(rel)) return false;
+  if (isLanguageSource(rel) || isLanguageManifest(rel)) return !isLanguageExcludedPath(rel);
   return SCAN_EXT_RE.test(rel);
 }
 
+/**
+ * Widen a batch of changed absolute paths to every file whose results the
+ * change can stale: dependents through imports, and all Haskell/Nix sources for
+ * a manifest, lockfile or export change. Batches with no Haskell/Nix path are
+ * returned untouched, so other languages never pay for a tree read.
+ */
+async function expandChangedBatch(scanRoot, batch) {
+  const rels = batch.map((p) => path.relative(scanRoot, p).split(path.sep).join('/'));
+  if (!rels.some((r) => isLanguageSource(r) || isLanguageManifest(r) || isExplicitExport(r))) return batch;
+  try {
+    const { readTree } = await import('../runScan.js');
+    const { fileContents, depFileContents } = await readTree(scanRoot);
+    const hit = impactedFiles(fileContents, depFileContents, rels);
+    const out = new Set(batch);
+    for (const r of hit) out.add(path.join(scanRoot, r));
+    return [...out];
+  } catch {
+    return batch;
+  }
+}
+
 function _readJsonSafe(fp) {
   try { return JSON.parse(fsSync.readFileSync(fp, 'utf8')); } catch { return null; }
 }
@@ -144,7 +170,12 @@ export async function watchProject(scanRoot, onChange, opts = {}) {
     if (pending.size > MAX_BURST) { pending.clear(); return; }
     const batch = Array.from(pending);
     pending.clear();
-    try { onChange(batch); } catch {}
+    const needsExpansion = batch.some((p) => {
+      const r = path.relative(scanRoot, p).split(path.sep).join('/');
+      return isLanguageSource(r) || isLanguageManifest(r) || isExplicitExport(r);
+    });
+    if (!needsExpansion) { try { onChange(batch); } catch {} return; }
+    expandChangedBatch(scanRoot, batch).then((b) => { try { onChange(b); } catch {} });
   };
   let stopped = false;
   (async () => {
@@ -169,4 +200,4 @@ export async function watchProject(scanRoot, onChange, opts = {}) {
   };
 }
 
-export const _internals = { _isScanable, SCAN_EXT_RE, IGNORE_DIR_RE };
+export const _internals = { _isScanable, expandChangedBatch, SCAN_EXT_RE, IGNORE_DIR_RE };

package/src/pr-delta.js

@@ -26,8 +26,9 @@
 import { spawnSync } from 'node:child_process';
 import { hardenGitArgs, hardenGitEnv } from './util/git-hardening.js';
 import { runFullScan } from './engine.js';
+import { isLanguageManifest, isLanguageExcludedPath } from './language/discovery.js';
 
-const FILE_EXT_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs|py|java|cs|kt|go|rb|php|sol|swift|rs|tf|yml|yaml|json|toml|md)$/i;
+const FILE_EXT_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs|py|java|cs|kt|go|rb|php|sol|swift|rs|tf|yml|yaml|json|toml|md|hs|lhs|hsc|hs-boot|nix|cabal)$/i;
 const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
 
 // `root` is the PR's repository — a scan target, not this project's own
@@ -54,23 +55,27 @@ function _listFilesAtRef(root, ref) {
   return r.stdout.trim().split('\n').filter(p => {
     if (!p) return false;
     if (p.includes('/node_modules/') || p.includes('/.venv/')) return false;
-    return FILE_EXT_RE.test(p);
+    if (isLanguageExcludedPath(p)) return false;
+    return FILE_EXT_RE.test(p) || isLanguageManifest(p);
   });
 }
 
 async function _scanAtRef(root, ref) {
   const files = _listFilesAtRef(root, ref);
   const fileContents = {};
+  const depFileContents = {};
   for (const f of files) {
     const c = _readFileAtRef(root, ref, f);
-    if (c != null) fileContents[f] = c;
+    if (c == null) continue;
+    // Haskell/Nix manifests and lock files are dependency inputs, not code (the same split a working-tree scan makes).
+    if (isLanguageManifest(f)) depFileContents[f] = c; else fileContents[f] = c;
   }
   // `provenance:false` — a base-ref snapshot, not the current working state.
   // Beyond the wasted git walks, updateLifecycle marks every open stableId
   // absent from the finding set it is handed as `remediated`; running the PR
   // delta gate would silently rewrite the project's lifecycle store from the
   // base ref's findings.
-  return runFullScan({ fileContents, scanRoot: root, provenance: false }, () => {});
+  return runFullScan({ fileContents, depFileContents, scanRoot: root, provenance: false }, () => {});
 }
 
 function _summary(findings) {

package/src/report/index.js

@@ -110,6 +110,20 @@ function explainParts(f, { verbose = false } = {}) {
 // <confidence>". Nothing here throws on a partially-populated object; every
 // field access is optional-chained or defaulted, because a provenance record
 // that survived a failure path is exactly the input this has to render.
+// Additive Haskell/Nix finding metadata (src/language/contracts.js). Only keys the finding actually carries.
+const _LANGUAGE_KEYS = ['language', 'capability', 'analysisKind', 'evidenceKind', 'originalLocation', 'generatedLocation', 'scope', 'uncertainty', 'resolutionStatus', 'modelVersion', 'trustBoundary', 'route', 'modelNote', 'controls', 'guardNote', 'rule', 'exposure', 'destination', 'source', 'origins', 'sink', 'protection', 'attrPath', 'bridge', 'applicationFlow', 'secretValue', 'environmentVariable', 'provider', 'rotation', 'llmRole', 'llmContext', 'owaspLlm', 'end2endProof', 'chainNote', 'declaredCapability', 'exercised', 'service', 'subject', 'option', 'optionEvidence', 'locationKind', 'entry', 'ignorePragmaIgnored'];
+// Keys that other detectors already use with a different meaning; passed through only for Haskell/Nix findings.
+const _LANGUAGE_ONLY_KEYS = new Set(['rule', 'source', 'sink', 'destination', 'origins', 'protection', 'exposure', 'service']);
+function languageFields(f) {
+  const out = {};
+  const lang = f.language === 'haskell' || f.language === 'nix';
+  for (const k of _LANGUAGE_KEYS) {
+    if (_LANGUAGE_ONLY_KEYS.has(k) && !lang) continue;
+    if (f[k] !== undefined && f[k] !== null) out[k] = f[k];
+  }
+  return out;
+}
+
 export function explainProvenance(f) {
   const fp = f && f.findingProvenance;
   if (!fp) return null;
@@ -274,6 +288,8 @@ export function normalizeFindings(scan){
       unvalidated: f.unvalidated === true,
       cross_language: f.cross_language === true,
       family: f.family || null,
+      // Haskell/Nix language contract (additive; absent for every other finding, so existing output is unchanged).
+      ...languageFields(f),
       // Premortem #8: surface the parser field so downstream consumers
       // (UI, SARIF, calibration) see the value the engine backfilled.
       parser: f.parser || null,
@@ -527,7 +543,8 @@ export function normalizeFindings(scan){
       cveAliases: sc.cveAliases || [],
       osvId: sc.osvId || null,
       advisory: sc.advisory || sc.description || '',
-      fixedIn: sc.range || null,
+      fixedIn: sc.range || (Array.isArray(sc.fixedIn) && sc.fixedIn.length ? sc.fixedIn : null),
+      ...(Number.isInteger(sc.line) && sc.line > 0 ? { declaringLine: sc.line, declaringFile: sc.file || null } : {}),
       // Feat-9: real-world risk signals
       epssScore: sc.epssScore ?? null,
       epssPercentile: sc.epssPercentile ?? null,
@@ -1034,15 +1051,24 @@ export function toSARIF(scan, meta={}){
         const chain = Array.isArray(f.chain) ? f.chain : [];
         const codeFlows = chain.length >= 2 ? [{
           threadFlows: [{
-            locations: chain.map((hop, idx) => ({
-              location: {
-                physicalLocation: {
-                  artifactLocation: { uri: hop.file || f.file },
-                  region: { startLine: Math.max(1, hop.line || 1) },
+            locations: chain.map((hop, idx) => {
+              // A hop inside a GENERATED script (a shell script a Nix string builds) has coordinates in the script
+              // text, not in the file. It is reported at the nearest ORIGINAL span (the interpolation that feeds it)
+              // and carries its generated position and origin in properties, so no reader mistakes script line 1 for
+              // line 1 of the Nix file.
+              const generated = hop.generated === true;
+              const orig = generated && f.originalLocation && Number.isInteger(f.originalLocation.startLine) ? f.originalLocation : null;
+              const region = orig
+                ? { startLine: Math.max(1, orig.startLine), ...(Number.isInteger(orig.startColumn) ? { startColumn: orig.startColumn + 1 } : {}), ...(Number.isInteger(orig.endLine) ? { endLine: orig.endLine } : {}), ...(Number.isInteger(orig.endColumn) ? { endColumn: orig.endColumn + 1 } : {}) }
+                : { startLine: Math.max(1, hop.line || 1), ...(Number.isInteger(hop.column) ? { startColumn: hop.column + 1 } : {}), ...(Number.isInteger(hop.endLine) ? { endLine: hop.endLine } : {}), ...(Number.isInteger(hop.endColumn) ? { endColumn: hop.endColumn + 1 } : {}) };
+              return {
+                location: {
+                  physicalLocation: { artifactLocation: { uri: hop.file || f.file }, region },
+                  message: { text: `${hop.label || (idx === 0 ? 'source' : idx === chain.length - 1 ? 'sink' : 'propagation')}${generated ? ' [generated script]' : ''}` },
                 },
-                message: { text: hop.label || (idx === 0 ? 'source' : idx === chain.length - 1 ? 'sink' : 'propagation') },
-              },
-            })),
+                ...(generated ? { kinds: ['generated'], properties: { generated: true, generatedLocation: { line: hop.line, ...(Number.isInteger(hop.column) ? { startColumn: hop.column } : {}), ...(Number.isInteger(hop.endLine) ? { endLine: hop.endLine } : {}), ...(Number.isInteger(hop.endColumn) ? { endColumn: hop.endColumn } : {}) }, ...(f.attrPath ? { generatedBy: f.attrPath } : {}) } } : {}),
+              };
+            }),
           }],
         }] : undefined;
         const fixes = f.remediation ? [{

package/src/runScan.js

@@ -9,6 +9,7 @@ import { runFullScan, shouldScan, isKubernetesManifest, isCloudFormationTemplate
 import { appendScanSnapshot } from './posture/security-trend.js';
 import { recover as recoverFixHistory } from './posture/fix-history.js';
 import { stampScan } from './posture/ruleset-version.js';
+import { isLanguageManifest, isLanguageExcludedPath, isLanguageSource, readExplicitExports, WALK_IGNORE_GLOBS, impactedFiles, buildImportGraph, importClosure } from './language/discovery.js';
 
 const DEP_FILE_NAMES = new Set([
   'package.json','package-lock.json','yarn.lock','pnpm-lock.yaml',
@@ -40,6 +41,9 @@ export function isDepFile(rel) {
   if (DEP_FILE_NAMES.has(base)) return true;
   if (REQUIREMENTS_FILE.test(base)) return true;
   if (REQUIREMENTS_DIR_FILE.test(rel.split(path.sep).join('/'))) return true;
+  // Haskell/Nix project manifests (cabal, stack, flake, lockfiles): a change to
+  // any of them moves the global checkpoint key via depFileContents.
+  if (isLanguageManifest(rel) && !isLanguageExcludedPath(rel)) return true;
   return false;
 }
 
@@ -68,18 +72,27 @@ const DEFAULT_IGNORE = [
   '**/dist/**','**/build/**','**/.next/**','**/venv/**','**/env/**','**/.venv/**',
   '**/target/**','**/bin/**','**/obj/**','**/.cache/**','**/coverage/**',
   '**/bower_components/**','**/tests/**','**/test/**','**/__tests__/**','**/spec/**','**/mocks/**',
+  // Haskell/Nix build output and store closures; explicit exports inside them
+  // are read by exact path below, never by walking.
+  ...WALK_IGNORE_GLOBS,
 ];
 
 export async function readTree(root, { ignore = [] } = {}) {
   const entries = await listFiles(root, { ignore: [...DEFAULT_IGNORE, ...ignore] });
   const fileContents = {};
   const depFileContents = {};
+  const oversize = [];
   for (const rel of entries) {
     const abs = path.join(root, rel);
     let stat;
     try { stat = await fs.stat(abs); } catch { continue; }
     const dep = isDepFile(rel);
-    if (stat.size > (dep ? MAX_DEP_BYTES : MAX_CODE_BYTES)) continue;
+    if (stat.size > (dep ? MAX_DEP_BYTES : MAX_CODE_BYTES)) {
+      // A Haskell/Nix source or manifest over the read cap is not analysed. That is a coverage gap a reader must be told about,
+      // not a quiet omission: it is listed (path, size, cap) and reaches scan health as a condition.
+      if (isLanguageSource(rel) || isLanguageManifest(rel)) oversize.push({ file: rel, bytes: stat.size, cap: dep ? MAX_DEP_BYTES : MAX_CODE_BYTES });
+      continue;
+    }
     let content;
     try { content = await fs.readFile(abs, 'utf8'); } catch { continue; }
     const base = path.basename(rel);
@@ -107,7 +120,14 @@ export async function readTree(root, { ignore = [] } = {}) {
     // project index parses key=value lines for cross-file lookup.
     else if (/\.properties$/i.test(rel)) fileContents[rel] = content;
   }
-  return { fileContents, depFileContents };
+  // Explicit Cabal plan / Stack / Nix exports live inside directories the walk
+  // prunes. Read them by exact path next to each project manifest.
+  try {
+    const manifests = Object.keys(depFileContents).concat(Object.keys(fileContents)).filter(isLanguageManifest);
+    const { contents } = readExplicitExports(root, manifests);
+    for (const [rel, text] of Object.entries(contents)) depFileContents[rel] = text;
+  } catch { /* exports are best-effort evidence */ }
+  return { fileContents, depFileContents, oversize };
 }
 
 // Feat-10: incremental scan via `--changed-since <git-ref>`. Returns the set of
@@ -146,6 +166,14 @@ export function changedSince(root, gitRef) {
   }
 }
 
+const POLICY_ONLY_HEAVY = ['**/node_modules/**', '**/.git/**', '**/venv/**', '**/.venv/**', '**/__pycache__/**', ...WALK_IGNORE_GLOBS];
+/** Haskell/Nix sources the default ignore list kept out of the scan (relative paths, sorted, capped). */
+export async function languageFilesIgnoredByPolicy(root, fileContents, depFileContents) {
+  const all = await listFiles(root, { ignore: POLICY_ONLY_HEAVY });
+  const seen = new Set([...Object.keys(fileContents), ...Object.keys(depFileContents)]);
+  return all.filter((rel) => (isLanguageSource(rel) || isLanguageManifest(rel)) && !isLanguageExcludedPath(rel) && !seen.has(rel)).sort().slice(0, 500);
+}
+
 export async function runScan(rootDir, opts = {}) {
   const root = path.resolve(rootDir);
   const startedAt = new Date().toISOString();
@@ -173,6 +201,7 @@ export async function runScan(rootDir, opts = {}) {
   // path added later must opt OUT explicitly rather than silently inherit a
   // false claim of coverage.
   let completeScan = true;
+  let sizeSkipped = [];
   if (opts.fileContents) {
     // Caller-supplied file list (MCP `scan_diff`, the LSP's on-save scan): by
     // construction a subset of the tree, not a scan of it.
@@ -180,16 +209,38 @@ export async function runScan(rootDir, opts = {}) {
     depFileContents = opts.depFileContents || {};
     completeScan = false;
   } else {
-    ({ fileContents, depFileContents } = await readTree(root, opts));
+    ({ fileContents, depFileContents, oversize: sizeSkipped } = await readTree(root, opts));
+  }
+
+  // Haskell/Nix sources under a default-ignored directory (tests, specs, mocks, bin, build, dist, vendor) are not
+  // scanned, exactly as for every other language. That policy is kept, but it is never silent: the files it kept
+  // out are listed and reach scan health as a stated limitation.
+  let policyExcluded = [];
+  if (!opts.fileContents && Object.keys(fileContents).some(isLanguageSource)) {
+    try { policyExcluded = await languageFilesIgnoredByPolicy(root, fileContents, depFileContents); } catch { policyExcluded = []; }
   }
 
   // Feat-10: incremental mode — restrict the scan to files changed since a git ref
   if (opts.changedSince) {
     const changed = changedSince(root, opts.changedSince);
     if (changed) {
+      const keep = new Set(changed);
+      // Haskell and Nix results depend on more than the file that changed: a module that imports a changed module
+      // may now be (or stop being) vulnerable, an effective NixOS value is decided by the modules it imports, and a
+      // lock file, Cabal flags or an explicit export can change every file's verdict. So the scan set is the changed
+      // files, everything that transitively imports one (all language sources for a manifest change), and the import
+      // closure of those as context. A deleted language file or manifest widens to every language source, because
+      // its importers can no longer be found from the tree on disk.
+      const langSources = Object.keys(fileContents).filter(isLanguageSource);
+      if (langSources.length) {
+        const deletedLang = [...changed].some((c) => (isLanguageSource(c) || isLanguageManifest(c)) && !(c in fileContents) && !(c in depFileContents));
+        const impacted = deletedLang ? langSources : impactedFiles(fileContents, depFileContents, [...changed]);
+        const { graph } = buildImportGraph(fileContents);
+        for (const f of impacted) { keep.add(f); for (const d of importClosure(graph, f).files) keep.add(d); }
+      }
       const filtered = {};
       for (const f of Object.keys(fileContents)) {
-        if (changed.has(f)) filtered[f] = fileContents[f];
+        if (keep.has(f)) filtered[f] = fileContents[f];
       }
       fileContents = filtered;
       // Only when the filter actually applied. A `changedSince` that resolved
@@ -203,7 +254,7 @@ export async function runScan(rootDir, opts = {}) {
 
   // R8: `resume` is opt-in. Left undefined here, runFullScan falls back to the
   // AGENTIC_SECURITY_RESUME=1 env var, which is off by default.
-  const scan = await runFullScan({ fileContents, depFileContents, scanRoot: root, resume: opts.resume, deep: opts.deep, deepInCi: opts.deepInCi, completeScan }, opts.onProgress || (()=>{}));
+  const scan = await runFullScan({ fileContents, depFileContents, scanRoot: root, resume: opts.resume, deep: opts.deep, deepInCi: opts.deepInCi, completeScan, policyExcluded, sizeSkipped }, opts.onProgress || (()=>{}));
   // Premortem 2R4.2: stamp ruleset version + source on the scan result, and
   // notify if the operator pinned a different version than what's installed.
   try { stampScan(root, scan); } catch {}