@clear-capabilities/agentic-security-scanner 0.154.0 → 0.155.0

package/CHANGELOG.md

@@ -9,6 +9,19 @@
 > make the history less accurate, not more.
 
 
+## 0.155.0 - premortem remediation (trust boundary, unseen-shape measurement), NixOS VM check
+
+An adversarial premortem of 0.154.0 found the following; each is fixed here and covered by `test/language/language-trust-boundary.test.js`.
+
+- **Trust boundary.** Advisory snapshots are read only from the operator (environment variable or `$XDG_CONFIG_HOME/agentic-security/`). A snapshot inside the scanned project is ignored and the scan says so, so a repository can no longer ship an empty feed to look clean. Nix export freshness is derived by the scanner from `flake.lock`, project-supplied exports and plans are disclosed, a refused export contributes nothing, and a Cabal plan that contradicts the freeze file is flagged.
+- **Unseen-shape split.** The holdout shares its code shapes with development, so it measures robustness to renaming only. A new `unseen` split (300 author-labelled cases, 3 new vulnerable and 3 new safe shapes per family) is measured once and never tuned against. Its result is stored beside every holdout row with 95% Clopper-Pearson intervals and strict precision. It is **below target** for Haskell SAST (R 79.2%), Haskell taint (P 77.8%) and Nix config-sast (P 86.1%); those are engine gaps, not fixed here. The `auth` row is now promoted from its own holdout evidence.
+- **Completion honesty.** A release check (`completion-declared`) fails when `docs/completion-status.json` lists unverified requirements and the changelog has no paragraph naming them. Chrome-dependent export tests are a separate informational job rather than a silent skip.
+- **Nix package fix (found by the first hosted NixOS guest run).** The packaged `agentic-security-mcp` and `agentic-security-lsp` wrappers ran `bin/*.js`, which import `src/` and therefore npm dependencies the Nix package does not ship, so both would have crashed for a Nix user. They now run from the self-contained bundle, and the CLI gained an `lsp` subcommand (the same server the editor plugins start). The flake's package source is now exactly the files it installs, so an offline rebuild elsewhere reproduces the same derivation.
+- **Destructive-command guard.** `hooks/pre-bash-guard.js` judged `rm` by text, so it refused any absolute path (and `docker run --rm -v /abs/...`) while missing nothing it should. Deletion (`rm`, `rmdir`, `unlink`, `find -delete`) is now path-aware: targets are parsed and resolved (`~`, `$HOME`, relative paths, `cd`, symlinks) and allowed only strictly inside an allowed root (default `~/code`, set with `allowedRoots` in `.agentic-security/destructive-guard.json`). Anything outside, anything unresolvable (`$VAR`, command substitution, `xargs`) and the root itself is refused. It cannot see deletion done inside another program, so it guards against mistakes and is not a sandbox. Pinned by `test/pre-bash-guard.test.js`.
+- **Not done.** Peak scan memory is measured under a stated heap cap and was **not reduced**: a lazy-token experiment retained less but changed no measurement, so it was reverted. `flake.nix` is now locked (`flake.lock`), built and checked on aarch64-linux in a `nixos/nix` container (Nix 2.35.2) and on x86_64-linux on a hosted runner; aarch64-darwin is declared but unbuilt, and x86_64-darwin is dropped (current nixpkgs no longer supports it).
+
+Partial release: the loop controller lists NIX-011, NIX-012 and REL-001 as not verified. NIX-011 and NIX-012 passed on hosted CI in this release's pull request (the NIX-011 suite on Nix 2.24.10; the NIX-012 suite inside a real NixOS guest booted by the flake's `nixos-host` check on an x86_64 runner with KVM), but that is CI evidence, not controller-signed evidence, because the controller runs where `nix` and `/etc/NIXOS` are absent. The aarch64 NixOS guest was not run: the arm runner has no KVM and a software-emulated guest does not boot in any usable time. REL-001 is the controller's own final acceptance and needs those two to be controller-verified first.
+
 ## 0.154.0 - Haskell and Nix/NixOS support, with every limit stated
 
 Haskell and Nix/NixOS are now scanned by the same commands as every other language, with no compiler, no `nix` binary and no

package/bin/agentic-security.js

@@ -137,6 +137,7 @@ Commands:
   tickets sync --provider <p>  Two-way sync findings ↔ GitHub Issues / Linear / Jira
   digest --slack <webhook>     Vibecoder: send daily digest to Slack
   mcp                          Start the MCP stdio server (scan_diff, query_taint, explain_finding, apply_fix)
+  lsp                          Start the Language Server Protocol server on stdio (what the editor plugins run)
   validator-cache stats|gc     Inspect / prune .agentic-security/llm-cache/ (use --older-than <days> --dry-run)
   verify [--finding <id>]      Re-run the verifier loop on last-scan findings (use --live --target <url> to execute PoCs)
   ask "<question>" [target]    Bounded local-model Q&A with read-only tool access (requires AGENTIC_SECURITY_LLM_PRESET=ollama)
@@ -7056,6 +7057,13 @@ async function main() {
         runStdio({ sessionRoot: path.resolve(root) });
         return;
       }
+      case 'lsp':      {
+        // The same server as bin/agentic-security-lsp.js, reachable from the self-contained bundle: a package that ships only the bundle
+        // (the Nix package does) has no node_modules for the src/ entry point to import from.
+        const { startLspServer } = await import('../src/lsp/server.js');
+        startLspServer();
+        return;
+      }
       case 'explore':  process.exit(await cmdExplore(args));
       case 'dataflow': {
         const sub = args._[1];

package/dist/1919.index.js

@@ -0,0 +1,445 @@
+export const id = 1919;
+export const ids = [1919];
+export const modules = {
+
+/***/ 21919:
+/***/ ((__webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependencies__, __webpack_async_result__) => { try {
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   startLspServer: () => (/* binding */ startLspServer)
+/* harmony export */ });
+/* unused harmony export _internals */
+/* harmony import */ var _language_discovery_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(30951);
+/* harmony import */ var _language_context_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(15911);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(76760);
+/* harmony import */ var node_readline__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(80481);
+/* harmony import */ var _runScan_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(45950);
+/* harmony import */ var _posture_custom_rules_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9049);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(31174);
+/* harmony import */ var _mcp_redact_js__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(83468);
+/* harmony import */ var _report_index_js__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__(75917);
+var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_runScan_js__WEBPACK_IMPORTED_MODULE_5__, _report_index_js__WEBPACK_IMPORTED_MODULE_8__]);
+([_runScan_js__WEBPACK_IMPORTED_MODULE_5__, _report_index_js__WEBPACK_IMPORTED_MODULE_8__] = __webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__);
+// Minimal LSP server for agentic-security.
+//
+// Speaks the Language Server Protocol over stdio. On every textDocument/
+// didSave (and didOpen), the server runs runScan on the file and emits
+// textDocument/publishDiagnostics with the resulting findings mapped to
+// LSP Diagnostic objects.
+//
+// This is a STARTER implementation — feature-complete enough that JetBrains
+// (via LSP4IJ) and Neovim (via built-in LSP) can both attach and see
+// findings inline. The full feature set (code actions for /fix, inline
+// remediation hover, exploitability tooltip) is future work.
+//
+// Wire-format: vscode-jsonrpc framing (Content-Length headers). Stateless
+// per file — no incremental analysis yet.
+
+
+
+
+
+
+
+
+
+
+
+
+const PROTOCOL_VERSION = '3.17';
+const SERVER_NAME = 'agentic-security-lsp';
+const SERVER_VERSION = '0.1.0';
+
+let _rootUri = null;
+let _rootDir = process.cwd();
+let _stdoutMutex = Promise.resolve();
+const _diagnosticsByUri = new Map();
+
+function uriToPath(uri) {
+  if (!uri) return null;
+  if (uri.startsWith('file://')) return decodeURIComponent(uri.slice(7));
+  return uri;
+}
+
+function pathToUri(p) {
+  if (!p) return null;
+  if (p.startsWith('file://')) return p;
+  return 'file://' + encodeURI(node_path__WEBPACK_IMPORTED_MODULE_3__.resolve(p));
+}
+
+function sevToLsp(sev) {
+  switch ((sev || '').toLowerCase()) {
+    case 'critical': return 1;  // Error
+    case 'high':     return 1;  // Error
+    case 'medium':   return 2;  // Warning
+    case 'low':      return 3;  // Information
+    default:         return 4;  // Hint
+  }
+}
+
+// The most precise location a finding carries. Haskell and Nix findings keep their ORIGINAL span (0-based columns); a
+// finding with only a line is reported across that line, as before.
+function _rangeOf(f) {
+  const o = f && f.originalLocation;
+  if (o && Number.isInteger(o.startLine) && Number.isInteger(o.startColumn)) {
+    return { start: { line: Math.max(0, o.startLine - 1), character: o.startColumn }, end: { line: Math.max(0, (Number.isInteger(o.endLine) ? o.endLine : o.startLine) - 1), character: Number.isInteger(o.endColumn) ? o.endColumn : o.startColumn + 1 } };
+  }
+  if (o && Number.isInteger(o.line) && Number.isInteger(o.column)) {
+    const line = Math.max(0, o.line - 1);
+    return { start: { line, character: o.column }, end: { line, character: 200 } };
+  }
+  const line = Math.max(0, ((f && f.line) || 1) - 1);
+  return { start: { line, character: 0 }, end: { line, character: 200 } };
+}
+
+function findingToDiagnostic(f) {
+  const line = Math.max(0, (f.line || 1) - 1);
+  // Stage 6 correctness audit: this read f.remediation directly, but raw
+  // scan.findings entries (what this consumes, pre-normalizeFindings) come
+  // from two conventions — most posture/*.js and newer sast/*.js modules
+  // set `remediation`, while ~127 of engine.js's own detectors set a `fix`
+  // STRING field instead. _remediationOf carries the same precedence
+  // report/index.js already established for this exact split (CMP-3).
+  const remediation = (0,_report_index_js__WEBPACK_IMPORTED_MODULE_8__/* ._remediationOf */ .uV)(f);
+  return {
+    range: _rangeOf(f),
+    severity: sevToLsp(f.severity),
+    source: 'agentic-security',
+    code: f.cwe || f.family || 'finding',
+    // carried back by the client in codeAction requests, so a fix is offered for exactly this finding
+    data: { id: f.id || null, stableId: f.stableId || null, rule: f.rule || null, family: f.family || null, language: f.language || (0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.languageOfFinding)(f) || null },
+    message: `${f.vuln || 'Security finding'}${remediation ? '\n\n' + remediation : ''}`.slice(0, 2000),
+    tags: [],
+  };
+}
+
+function send(message) {
+  const json = JSON.stringify({ jsonrpc: '2.0', ...message });
+  _stdoutMutex = _stdoutMutex.then(() => new Promise(resolve => {
+    process.stdout.write(`Content-Length: ${Buffer.byteLength(json, 'utf8')}\r\n\r\n${json}`, resolve);
+  }));
+  return _stdoutMutex;
+}
+
+async function publishDiagnostics(uri, findings) {
+  await send({
+    method: 'textDocument/publishDiagnostics',
+    params: { uri, diagnostics: findings.map(findingToDiagnostic) },
+  });
+  _diagnosticsByUri.set(uri, findings);
+}
+
+// Manifest / schema files that downstream passes (SCA, cross-language) read.
+// We walk the project tree once per LSP session and cache these so the
+// per-save scan has them.
+const DEP_BASE_NAMES = new Set([
+  'package.json', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml',
+  'requirements.txt', 'pyproject.toml', 'poetry.lock', 'Pipfile.lock',
+  'composer.json', 'composer.lock', 'Gemfile', 'Gemfile.lock',
+  'go.mod', 'Cargo.toml', 'Cargo.lock',
+  'pom.xml', 'build.gradle', 'build.gradle.kts',
+]);
+const DEP_EXT_RE = /\.(?:proto|graphql|gql|tf|cabal)$/i;
+// Haskell and Nix project manifests and lock files (cabal.project*, stack.yaml*, package.yaml, flake.lock, ...) are
+// recognised by the shared language discovery module, never by a second list here.
+const _isLanguageDep = (base) => (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_0__/* .isLanguageManifest */ .mD)(base);
+const DEP_NAME_RE = /(?:openapi|swagger)\.(?:ya?ml|json)$/i;
+
+let _depCache = { rootDir: null, depFileContents: {} };
+
+function _loadDepFileContents(rootDir) {
+  if (_depCache.rootDir === rootDir) return _depCache.depFileContents;
+  const out = {};
+  const skipDirs = new Set(['node_modules', '.git', 'dist', 'build', '.next', 'target', 'vendor', '.bench-cache']);
+  function walk(dir) {
+    let entries;
+    try { entries = node_fs__WEBPACK_IMPORTED_MODULE_2__.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (skipDirs.has(e.name)) continue;
+      const full = node_path__WEBPACK_IMPORTED_MODULE_3__.join(dir, e.name);
+      if (e.isDirectory()) { walk(full); continue; }
+      if (!e.isFile()) continue;
+      const base = e.name;
+      if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base) || _isLanguageDep(base)) {
+        let stat;
+        try { stat = node_fs__WEBPACK_IMPORTED_MODULE_2__.statSync(full); } catch { continue; }
+        if (stat.size > 500_000) continue;
+        try { out[node_path__WEBPACK_IMPORTED_MODULE_3__.relative(rootDir, full)] = node_fs__WEBPACK_IMPORTED_MODULE_2__.readFileSync(full, 'utf8'); }
+        catch { /* skip unreadable */ }
+      }
+    }
+  }
+  walk(rootDir);
+  _depCache = { rootDir, depFileContents: out };
+  return out;
+}
+
+async function scanFile(uri) {
+  const filePath = uriToPath(uri);
+  if (!filePath || !node_fs__WEBPACK_IMPORTED_MODULE_2__.existsSync(filePath)) return;
+  // Incremental scan (premortem 2R4.5 / 2R-10): hand runScan a single-file
+  // fileContents map for the saved code, AND a cached set of dep-manifest /
+  // schema files so SCA + cross-language passes have their inputs. Without
+  // depFileContents, the LSP path would silently drop CVE / OpenAPI / proto
+  // findings on the saved file.
+  try {
+    const rel = node_path__WEBPACK_IMPORTED_MODULE_3__.relative(_rootDir, filePath);
+    const content = node_fs__WEBPACK_IMPORTED_MODULE_2__.readFileSync(filePath, 'utf8');
+    let fileContents = { [rel]: content };
+    let depFileContents = _loadDepFileContents(_rootDir);
+    // Haskell/Nix: scan the saved file together with the modules it imports and the ones that import it (bounded).
+    const lc = (0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.withLanguageContext)(_rootDir, fileContents, depFileContents);
+    fileContents = lc.fileContents; depFileContents = lc.depFileContents;
+    // Premortem 4R-12 + 4R-15: reset the per-process custom-rules budget at
+    // the start of each LSP scan. Each save is a logical scan session; without
+    // the reset, a long-lived LSP server would accumulate budget across saves
+    // and eventually start skipping custom rules.
+    (0,_posture_custom_rules_js__WEBPACK_IMPORTED_MODULE_6__/* .resetCustomRulesBudget */ .zO)(_rootDir);
+    // PRD R1 (docs/DETECTION_GAP_REMEDIATION_PRD.md): deep mode is
+    // default-on for the interactive CLI scan but was never requested here,
+    // so every on-save diagnostic pass was regex/AST-only — blind to any bug
+    // whose source and sink are connected only through a call. Scoped to
+    // exactly the saved file (fileContents has one entry), so this does not
+    // turn every keystroke's save into a full-project deep scan.
+    // withStateWritesDisabled, for the same reason mcp/tools.js's scan_diff
+    // wraps its own partial-set scan (FR-704). This is a DIAGNOSTIC surface: it
+    // runs on every file save, against the user's real project root, with a
+    // fileContents map holding exactly one file. Without the wrapper,
+    // runFullScan's state writers fire on every keystroke-save — dpia.md,
+    // ropa.md, privacy-framework.json, threat-model.json and the rest, written
+    // into the user's tree by an editor plugin they never asked to mutate
+    // anything.
+    //
+    // The provenance lifecycle store makes that actively destructive rather
+    // than merely noisy: updateLifecycle marks every open stableId ABSENT from
+    // the finding set it is handed as `remediated`, and this set is one file's
+    // worth of findings. Every save would remediate the whole project, and the
+    // next real scan would reintroduce it.
+    //
+    // Chosen over forwarding `provenance:false` through runScan because that
+    // would fix only the lifecycle half and leave the other state writers
+    // firing. The flag is process-global (see its KNOWN LIMITATION), which is
+    // harmless here: this server is a read-only surface whose every scan wants
+    // writes off, so overlapping saves can only ever agree, and the `finally`
+    // restores the prior value either way. exceptCategories:['provenance-cache']
+    // (M2 §2.4) is the one deliberate exception — every OTHER write this scan
+    // would make stays suppressed, but the provenance disk cache stays live so
+    // repeated saves of the same file are not each paying the full uncached
+    // resolution cost.
+    const { scan } = await (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_7__/* .withStateWritesDisabled */ .Ao)(() =>
+      (0,_runScan_js__WEBPACK_IMPORTED_MODULE_5__.runScan)(_rootDir, { fileContents, depFileContents, deep: true, deepInCi: true }),
+      { exceptCategories: ['provenance-cache'] });
+    // Stage 6 correctness audit: this only ever read scan.findings (the SAST
+    // channel). scan.secrets and scan.logicVulns are separate arrays on the
+    // raw runScan() result — normalizeFindings is what merges all four
+    // channels, and that hasn't run here — so a saved file with a hardcoded
+    // credential got a clean problem pane, no diagnostic at all. Unlike the
+    // MCP surface, this server never applied redactFinding either (nothing
+    // here imported mcp/redact.js), which would have been a landmine the
+    // moment secrets/logicVulns were added without it: those channels are
+    // exactly where raw secret material shows up in `snippet`. Both fixed
+    // together — merge the channels AND redact — so the fix for one gap
+    // doesn't open the other.
+    const findings = [...(scan.findings || []), ...(scan.secrets || []), ...(scan.logicVulns || [])]
+      .filter(f => f.file === rel)
+      .map(f => (0,_mcp_redact_js__WEBPACK_IMPORTED_MODULE_9__/* .redactFinding */ .lE)(f));
+    await publishDiagnostics(uri, findings);
+  } catch (e) {
+    process.stderr.write(`agentic-security-lsp: scan failed: ${e.message}\n`);
+  }
+}
+
+function handleInitialize(params) {
+  if (params.rootUri) {
+    _rootUri = params.rootUri;
+    _rootDir = uriToPath(params.rootUri) || process.cwd();
+  } else if (params.rootPath) {
+    _rootDir = params.rootPath;
+  }
+  return {
+    capabilities: {
+      textDocumentSync: {
+        openClose: true,
+        change: 1,
+        save: { includeText: false },
+      },
+      diagnosticProvider: { interFileDependencies: true, workspaceDiagnostics: false },
+      // quick fixes for Haskell and Nix findings (preview edits from the verified language fixers)
+      codeActionProvider: { codeActionKinds: ['quickfix'], resolveProvider: false },
+    },
+    serverInfo: { name: SERVER_NAME, version: SERVER_VERSION },
+  };
+}
+
+/**
+ * textDocument/codeAction: a quick fix for each agentic-security diagnostic in range that a language fixer can repair.
+ * The edit is a PREVIEW the editor applies; nothing is written here. A finding with no safe fix gets a disabled
+ * action that says why, never a silent omission.
+ */
+async function codeActionsFor(params) {
+  const uri = params && params.textDocument && params.textDocument.uri;
+  const diags = ((params && params.context && params.context.diagnostics) || []).filter((d) => d && d.source === 'agentic-security' && d.data && d.data.id);
+  const stored = (uri && _diagnosticsByUri.get(uri)) || [];
+  if (!diags.length || !stored.length) return [];
+  let files = null;
+  const actions = [];
+  for (const d of diags) {
+    const f = stored.find((x) => x && x.id === d.data.id);
+    if (!f || !(0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.languageOfFinding)(f)) continue;
+    if (!files) files = (0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.loadLanguageProject)(_rootDir).files;
+    let prev;
+    try { prev = await (0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.languageFixPreview)(f, files); } catch (e) { prev = { ok: false, reason: String((e && e.message) || e) }; }
+    if (prev && prev.ok && prev.file) {
+      const target = pathToUri(node_path__WEBPACK_IMPORTED_MODULE_3__.join(_rootDir, prev.file));
+      actions.push({
+        title: `Fix${prev.label ? ` (${prev.label})` : ''}: ${f.vuln || f.rule || 'finding'}`,
+        kind: 'quickfix', diagnostics: [d], isPreferred: false,
+        edit: { changes: { [target]: [(0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.minimalEdit)(prev.before, prev.after)] } },
+        data: { stableId: f.stableId || null, verified: { syntax: true, rescan: true } },
+      });
+    } else {
+      actions.push({ title: `No automatic fix: ${f.vuln || f.rule || 'finding'}`, kind: 'quickfix', diagnostics: [d], disabled: { reason: (prev && (prev.reason || prev.status)) || 'no deterministic fix exists for this finding' } });
+    }
+  }
+  return actions;
+}
+
+async function handleMessage(msg) {
+  if (msg.method === 'textDocument/codeAction') {
+    return { id: msg.id, result: await codeActionsFor(msg.params || {}) };
+  }
+  if (msg.method === 'initialize') {
+    return { id: msg.id, result: handleInitialize(msg.params || {}) };
+  }
+  if (msg.method === 'initialized' || msg.method === 'workspace/didChangeConfiguration') {
+    return null;  // notification, no response
+  }
+  if (msg.method === 'shutdown') {
+    return { id: msg.id, result: null };
+  }
+  if (msg.method === 'exit') {
+    process.exit(0);
+  }
+  if (msg.method === 'textDocument/didOpen') {
+    const uri = msg.params?.textDocument?.uri;
+    if (uri) scanFile(uri);
+    return null;
+  }
+  if (msg.method === 'textDocument/didSave') {
+    const uri = msg.params?.textDocument?.uri;
+    if (uri) {
+      // Premortem 3R-9 / 4R-5: when the user saves a manifest file, the
+      // dep-cache entry for THAT file is stale. Granular invalidation (only
+      // re-read the saved file from disk) avoids the O(project) re-walk that
+      // 3R-9 introduced — important in monorepos where mass manifest edits
+      // would otherwise re-scan thousands of files per save.
+      const savedPath = uriToPath(uri);
+      if (savedPath && _depCache.rootDir === _rootDir) {
+        const base = node_path__WEBPACK_IMPORTED_MODULE_3__.basename(savedPath);
+        if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base) || _isLanguageDep(base)) {
+          try {
+            const rel = node_path__WEBPACK_IMPORTED_MODULE_3__.relative(_rootDir, savedPath);
+            const st = node_fs__WEBPACK_IMPORTED_MODULE_2__.statSync(savedPath);
+            if (st.size <= 500_000) {
+              _depCache.depFileContents[rel] = node_fs__WEBPACK_IMPORTED_MODULE_2__.readFileSync(savedPath, 'utf8');
+            } else {
+              delete _depCache.depFileContents[rel];
+            }
+          } catch {
+            // File vanished between save event and stat — drop from cache.
+            try {
+              const rel = node_path__WEBPACK_IMPORTED_MODULE_3__.relative(_rootDir, savedPath);
+              delete _depCache.depFileContents[rel];
+            } catch {}
+          }
+        }
+      }
+      scanFile(uri);
+    }
+    return null;
+  }
+  if (msg.method === 'textDocument/didClose') {
+    const uri = msg.params?.textDocument?.uri;
+    if (uri) await publishDiagnostics(uri, []);
+    return null;
+  }
+  // Unknown method.
+  if (msg.id != null) {
+    return { id: msg.id, error: { code: -32601, message: `Method not found: ${msg.method}` } };
+  }
+  return null;
+}
+
+function startLspServer() {
+  let buffer = Buffer.alloc(0);
+  let expected = -1;
+  process.stdin.on('data', async (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    while (true) {
+      if (expected < 0) {
+        const headerEnd = buffer.indexOf('\r\n\r\n');
+        if (headerEnd < 0) break;
+        const headers = buffer.slice(0, headerEnd).toString('utf8');
+        const m = headers.match(/Content-Length:\s*(\d+)/i);
+        if (!m) {
+          process.stderr.write('agentic-security-lsp: missing Content-Length header\n');
+          buffer = buffer.slice(headerEnd + 4);
+          continue;
+        }
+        expected = parseInt(m[1], 10);
+        buffer = buffer.slice(headerEnd + 4);
+      }
+      if (buffer.length < expected) break;
+      const body = buffer.slice(0, expected).toString('utf8');
+      buffer = buffer.slice(expected);
+      expected = -1;
+      let msg;
+      try { msg = JSON.parse(body); }
+      catch { process.stderr.write('agentic-security-lsp: malformed JSON\n'); continue; }
+      try {
+        const response = await handleMessage(msg);
+        if (response) await send(response);
+      } catch (e) {
+        if (msg.id != null) await send({ id: msg.id, error: { code: -32603, message: e.message } });
+      }
+    }
+  });
+  process.stdin.on('end', () => process.exit(0));
+}
+
+// Allow direct invocation as a bin entry: `node lsp/server.js`.
+//
+// `import.meta.url === file://${process.argv[1]}` looks equivalent but is
+// NOT: when this script is invoked through a symlink (exactly what
+// `npm install -g`, `npx`, and `node_modules/.bin/<name>` all do for a
+// package's `bin` entries — and `agentic-security-lsp` IS one of this
+// package's bin entries), Node resolves `import.meta.url` to the symlink's
+// realpath while `process.argv[1]` stays the symlink path as invoked, so the
+// two never match, the guard is always false, and the server silently exits
+// with no output — an editor would see the language server start and
+// immediately die with nothing on stderr to explain it. `import.meta.main` is
+// resolved correctly through a symlink. It was added in Node v24.2.0
+// (backported to v22.18.0) and is currently Stability 1.0 (early development)
+// per Node's own docs — NOT stable, and NOT available on v20.11. Concretely:
+// it is `undefined` on Node 24.0.0/24.1.x, which satisfy this repo's declared
+// `engines.node: ">=24.0.0"` floor, so `import.meta.main` alone would
+// reproduce this exact bug on a plain non-symlinked invocation under those two
+// point releases. The `??` fallback covers that gap without bumping the
+// engines floor. Identical to bin/agentic-security.js's guard, deliberately —
+// see the long-form note there.
+if (import.meta.main ?? (import.meta.url === `file://${process.argv[1]}`)) {
+  startLspServer();
+}
+
+function _setRootDir(dir) { _rootDir = dir; _depCache = { rootDir: null, depFileContents: {} }; }
+
+const _internals = { findingToDiagnostic, scanFile, uriToPath, pathToUri, _diagnosticsByUri, _setRootDir };
+
+__webpack_async_result__();
+} catch(e) { __webpack_async_result__(e); } });
+
+/***/ })
+
+};

package/dist/2862.index.js

@@ -261,14 +261,14 @@ async function assessLanguageAssurance(input = {}) {
   const scaRequired = (required.haskell || []).includes('sca') && !disabled.has('haskell:sca');
   if (present.has('haskell') && scaRequired && manifests.length) {
     const db = input.advisoryDb;
-    if (!db) conditions.push('no Hackage advisory snapshot is loaded: Haskell dependency vulnerabilities were not assessed');
+    if (!db) conditions.push(`no Hackage advisory snapshot is loaded: Haskell dependency vulnerabilities were not assessed${input.advisoryReason ? `. ${input.advisoryReason}` : ''}`);
     else if (db.stale) conditions.push(`the Hackage advisory snapshot is stale (${db.ageDays == null ? 'age unknown' : `${Math.floor(db.ageDays)} day(s) old`}, limit ${db.maxAgeDays})`);
   }
 
   // 3b. resolved dependency data and the Nix closure: a stale, malformed or unchecked input is stated, never silently dropped
   for (const g of input.supplyGaps || []) {
     if (!g || !g.kind) continue;
-    if (/unavailable|stale|malformed|failed|unverified/.test(g.kind)) conditions.push(`${g.kind.replace(/^(?:resolved|closure)-/, '')}: ${String(g.detail || '').slice(0, 220)}`);
+    if (/unavailable|stale|malformed|failed|unverified|refused|contradicts/.test(g.kind)) conditions.push(`${g.kind.replace(/^(?:resolved|closure)-/, '')}: ${String(g.detail || '').slice(0, 220)}`);
     else limitations.push({ kind: 'supply-gap', gap: g.kind, note: String(g.detail || '').slice(0, 220) });
   }
 

package/dist/8551.index.js

@@ -19,14 +19,14 @@ __webpack_require__.d(__webpack_exports__, {
 
 // EXTERNAL MODULE: external "node:fs"
 var external_node_fs_ = __webpack_require__(73024);
-// EXTERNAL MODULE: ./src/posture/state-dir.js
-var state_dir = __webpack_require__(31174);
+// EXTERNAL MODULE: external "node:crypto"
+var external_node_crypto_ = __webpack_require__(77598);
+// EXTERNAL MODULE: ./src/language/trusted-inputs.js
+var trusted_inputs = __webpack_require__(6342);
 // EXTERNAL MODULE: ./src/language/haskell-manifests.js
 var haskell_manifests = __webpack_require__(16522);
 // EXTERNAL MODULE: ./src/language/haskell-resolved-graph.js
 var haskell_resolved_graph = __webpack_require__(86359);
-// EXTERNAL MODULE: external "node:crypto"
-var external_node_crypto_ = __webpack_require__(77598);
 ;// CONCATENATED MODULE: ./src/language/nix-closure.js
 // Resolved derivation and closure inventory (NIX-008).
 //
@@ -1032,6 +1032,7 @@ function mergeEvaluationHealth(scanHealth, result) {
 
 
 
+
 const RESOLVED_PASS_VERSION = 'resolved-pass/1';
 
 const PLAN = /(?:^|\/)dist-newstyle\/cache\/plan\.json$/;
@@ -1071,6 +1072,12 @@ function resolvedHackageComponents(files) {
   const gaps = (g.gaps || []).map((x) => ({ kind: `resolved-${x.kind}`, detail: x.detail || x.message || x.kind, file: r.file }));
   const summary = { file: r.file, source: g.source, graphAvailable: g.graphAvailable, freshness: g.freshness, closure: g.closure, units: g.units ? g.units.length : null, edges: g.edges ? g.edges.length : null };
   if (!g.graphAvailable || g.freshness.status === 'stale') return { components: [], gaps, summary };
+  // The plan is a file in the scanned project. Where the project's own freeze file also pins a package, the two must agree: a plan that
+  // contradicts the freeze is stale or forged, and contributes no versions.
+  const frozen = new Map(((r.manifests && r.manifests.lockedPackages) || []).filter((l) => l.name && l.version).map((l) => [l.name, l.version]));
+  const clashes = (g.units || []).filter((u) => u.name && u.version && frozen.has(u.name) && frozen.get(u.name) !== u.version).map((u) => `${u.name} ${u.version} (plan) vs ${frozen.get(u.name)} (freeze)`);
+  if (clashes.length) { gaps.push({ kind: 'resolved-stale-plan-contradicts-freeze', detail: `the plan contradicts the freeze file (${clashes.slice(0, 3).join('; ')}): it is stale or forged, so no version was taken from it`, file: r.file }); return { components: [], gaps, summary }; }
+  gaps.push({ kind: 'resolved-project-supplied-plan', detail: 'the plan is a file in the scanned project: it is checked against the declared bounds and the freeze file, but whoever controls the project controls its contents', file: r.file });
   const SCOPE = { runtime: 'required', test: 'optional', benchmark: 'optional', setup: 'optional', 'build-tool': 'optional' };
   const direct = new Set((g.declared || []).map((d) => d.name));
   const components = [];
@@ -1084,24 +1091,39 @@ function resolvedHackageComponents(files) {
 }
 
 // ── Nix closure ──────────────────────────────────────────────────────────────────
-function loadNixExports(files) {
-  const exports = []; const sources = []; const problems = []; let expected = {};
-  for (const p of Object.keys(files).filter((x) => NIX_EXPORT.test(x)).sort()) {
-    const parsed = parseJson(files[p]);
-    sources.push(p);
-    if (!parsed.ok) { problems.push({ kind: 'malformed-export', file: p, detail: parsed.reason }); continue; }
+function loadNixExports(files, env = process.env) {
+  const exports = []; const sources = []; const problems = []; const trust = new Set();
+  const take = (label, text, origin) => {
+    sources.push(label);
+    const parsed = parseJson(text);
+    if (!parsed.ok) { problems.push({ kind: 'malformed-export', file: label, detail: parsed.reason }); return; }
     const j = parsed.value;
-    if (j && Array.isArray(j.exports)) { exports.push(...j.exports.filter((e) => e && typeof e === 'object')); if (j.expected && typeof j.expected === 'object') expected = { ...expected, ...j.expected }; }
+    trust.add(origin);
+    // NOTE: an `expected` block inside the file is IGNORED. The file is the thing under test, so it cannot also say what it should be
+    // checked against; what an export must match is derived by the scanner (below) or comes from the operator.
+    if (j && Array.isArray(j.exports)) exports.push(...j.exports.filter((e) => e && typeof e === 'object'));
     else if (j && typeof j === 'object' && j.schema && (j.data !== undefined || j.text !== undefined)) exports.push(j);
-    else exports.push({ text: files[p] });
+    else exports.push({ text });
+  };
+  if (env.AGENTIC_SECURITY_NIX_EXPORT) {
+    try { take(env.AGENTIC_SECURITY_NIX_EXPORT, (0,external_node_fs_.readFileSync)(env.AGENTIC_SECURITY_NIX_EXPORT, 'utf8'), 'operator'); }
+    catch (e) { sources.push(env.AGENTIC_SECURITY_NIX_EXPORT); problems.push({ kind: 'malformed-export', file: env.AGENTIC_SECURITY_NIX_EXPORT, detail: `unreadable: ${e.code || e.message}` }); }
   }
-  return { exports, sources, problems, expected };
+  for (const p of Object.keys(files).filter((x) => NIX_EXPORT.test(x)).sort()) take(p, files[p], 'project-supplied');
+  // What the export must have been made against: the real flake.lock of this project (a forged export cannot also forge that file's hash
+  // without the lock it claims to describe being the lock that is here).
+  const expected = {};
+  const lockPath = Object.keys(files).filter((p) => /(^|\/)flake\.lock$/.test(p)).sort((a, b) => a.length - b.length)[0];
+  if (lockPath) expected.flakeLockSha256 = (0,external_node_crypto_.createHash)('sha256').update(files[lockPath]).digest('hex');
+  else if (sources.length) problems.push({ kind: 'export-unverified', detail: 'there is no flake.lock to bind the export to, so it cannot be shown to describe this project' });
+  if (env.AGENTIC_SECURITY_NIX_EXPORT_PUBKEY) { try { expected.publicKeyPem = (0,external_node_fs_.readFileSync)(env.AGENTIC_SECURITY_NIX_EXPORT_PUBKEY, 'utf8'); expected.requireSigned = true; } catch { problems.push({ kind: 'malformed-export', detail: 'the configured export public key is unreadable' }); } }
+  return { exports, sources, problems, expected, trust: [...trust] };
 }
 
 /** The imported closure (and each derivation's env block) for a file set, or null when there is no export. Cached per file set. */
 function nixClosureOf(files, { now = Date.now() } = {}) {
   return memoized(files, 'nix-closure', () => {
-    const { exports, sources, problems, expected } = loadNixExports(files);
+    const { exports, sources, problems, expected, trust } = loadNixExports(files);
     if (!sources.length) return null;
     const closure = importNixClosure({ exports, expected, now });
     const drvEnv = {};
@@ -1110,15 +1132,19 @@ function nixClosureOf(files, { now = Date.now() } = {}) {
       let data = ex.data; if (data === undefined && typeof ex.text === 'string') { const p = parseJson(ex.text); data = p.ok ? p.value : null; }
       for (const [k, v] of Object.entries(data || {})) if (v && v.env) drvEnv[k] = v.env;
     }
-    return { closure, drvEnv, sources, problems };
+    // A disclosure that says the export does not describe THIS project (another lock, another target, a bad or missing required
+    // signature) means its contents are not evidence about this build: it is refused, not merely labelled.
+    const REFUSE = new Set(['stale-export', 'foreign-target', 'foreign-revision', 'invalid-signature', 'unsigned']);
+    const refused = (closure.disclosures || []).filter((d) => REFUSE.has(d.kind));
+    return { closure, drvEnv, sources, problems, trust, refused };
   });
 }
 
 /** Advisory records for Nix: a snapshot named by AGENTIC_SECURITY_NIX_ADVISORIES or kept in the project state directory. */
 function configuredNixAdvisories(root, env = process.env, hackageDb = null) {
-  const path = env.AGENTIC_SECURITY_NIX_ADVISORIES || (root && (0,external_node_fs_.existsSync)((0,state_dir.statePath)(root, 'nix-advisories.json')) ? (0,state_dir.statePath)(root, 'nix-advisories.json') : null);
-  if (!path) return { data: null, reason: 'no Nix advisory snapshot is configured (set AGENTIC_SECURITY_NIX_ADVISORIES or provide nix-advisories.json in the project state directory)' };
-  let snap; try { snap = JSON.parse((0,external_node_fs_.readFileSync)(path, 'utf8')); } catch (e) { return { data: null, reason: `the Nix advisory snapshot is unreadable: ${e.code || e.message}` }; }
+  const sel = (0,trusted_inputs/* resolveOperatorSnapshot */.Rn)({ envVar: 'AGENTIC_SECURITY_NIX_ADVISORIES', fileName: 'nix-advisories.json', root, env });
+  if (!sel.path) return { data: null, reason: `no Nix advisory snapshot is configured (set AGENTIC_SECURITY_NIX_ADVISORIES, or place nix-advisories.json in the operator configuration directory, agentic-security under XDG_CONFIG_HOME)${sel.projectLocalIgnored ? (0,trusted_inputs/* IGNORED_NOTE */.cY)('nix-advisories.json') : ''}` };
+  let snap; try { snap = JSON.parse((0,external_node_fs_.readFileSync)(sel.path, 'utf8')); } catch (e) { return { data: null, reason: `the Nix advisory snapshot is unreadable: ${e.code || e.message}` }; }
   const records = Array.isArray(snap) ? snap : (Array.isArray(snap.records) ? snap.records : []);
   return { data: new NixAdvisoryData({ records, hackage: hackageDb, source: 'pinned-snapshot', generatedAt: (snap && snap.generatedAt) || null }), reason: null };
 }
@@ -1134,9 +1160,11 @@ function _analyzeNixClosure(files, { scanRoot = null, env = process.env, now = D
   const adv = configuredNixAdvisories(scanRoot, env, hackage);
   let usage = null; try { usage = (0,haskell_supply/* collectUsage */.c$)(files); } catch { usage = null; }
   let matched = null;
-  try { matched = matchNixVulnerabilities({ closure: c.closure, drvEnv: c.drvEnv, data: adv.data, overlays: overlayEvidence(files), haskellUsage: usage }); } catch (e) { matched = null; c.problems.push({ kind: 'match-failed', detail: String((e && e.message) || e).slice(0, 160) }); }
+  if (!c.refused.length) try { matched = matchNixVulnerabilities({ closure: c.closure, drvEnv: c.drvEnv, data: adv.data, overlays: overlayEvidence(files), haskellUsage: usage }); } catch (e) { matched = null; c.problems.push({ kind: 'match-failed', detail: String((e && e.message) || e).slice(0, 160) }); }
   const gaps = [];
+  if (c.trust.includes('project-supplied') && !c.trust.includes('operator')) gaps.push({ kind: 'closure-project-supplied', detail: 'the closure export is a file in the scanned project, bound to its flake.lock but not signed: whoever controls the project controls its contents, so the ABSENCE of a finding for a component it lists is not evidence the real build is free of it (provide the export through AGENTIC_SECURITY_NIX_EXPORT, signed with AGENTIC_SECURITY_NIX_EXPORT_PUBKEY, to have it treated as operator evidence)' });
   for (const d of c.closure.disclosures || []) gaps.push({ kind: `closure-${d.kind}`, detail: d.detail });
+  for (const d of c.refused) gaps.push({ kind: `closure-refused-${d.kind}`, detail: `${d.detail}; the export was REFUSED and contributes nothing` });
   for (const p of c.problems) gaps.push({ kind: `closure-${p.kind}`, detail: p.detail, file: p.file });
   if (!adv.data) gaps.push({ kind: 'closure-advisory-feed-unavailable', detail: `${adv.reason}. The closure's components were NOT checked against any advisory: the absence of findings is not a clean result.` });
   else if (adv.data.stale) gaps.push({ kind: 'closure-advisory-feed-stale', detail: `the Nix advisory snapshot is stale or undated (${adv.data.ageDays == null ? 'age unknown' : `${Math.floor(adv.data.ageDays)} day(s) old`})` });