@clear-capabilities/agentic-security-scanner 0.154.0 → 0.156.0

package/CHANGELOG.md

@@ -9,6 +9,35 @@
 > make the history less accurate, not more.
 
 
+## 0.156.0 - the three below-target rows fixed, measured on a fresh unseen set
+
+0.155.0 reported Haskell SAST recall (79.2%), Haskell taint precision (77.8%) and Nix config-sast precision (86.1%) below target on shapes the templates did not contain, while the frozen holdout said 100%. Each gap was read against the code and fixed in the engine, not in the scoring.
+
+- **Haskell, structural rules.** A function named for a PIN or password is a security value for the randomness rule (matched as a whole word, so `spinWheel` is not); `replicateM`/`replicateM_` sized by parsed caller text is an unbounded allocation; `xs !! n` on a caller-supplied list is a partial function; a log argument labelled `"token=" ++ x` or `"password: " ++ x` is a credential, unless it is redacted.
+- **Haskell, route authentication.** A wrapper guard (`guarded $ do ...`) now dominates the handler it encloses: program order is source order, not control-flow node order. A guard that runs AFTER the write is still reported.
+- **Haskell, taint.** `lookup key table` returns an element of the table, so only the table flows to the result (the key stays visible to rules as `hs.selector`, so `fromJust (lookup key t)` is still a partial-function finding); `length`, `null`, `ord` and similar return numbers and carry no caller text; a host allow-list (`uriRegName a `elem` [...]`) over a URL parsed from the checked value is a URL guard.
+- **Nix.** `security.sudo.extraRules` with `NOPASSWD` for `ALL` is a finding (one named command is not); a TLS key produced by `writeText`/`toFile` is in the store like a path literal; wpa_supplicant's `ext:NAME` is a reference to a runtime variable, not a credential.
+- **The measurement.** The unseen-v1 shapes were used to make these fixes, so they are now the `shape-dev` regression set. A fresh unseen-v2 set (3 vulnerable and 3 safe NEW single-flaw shapes per family, 2 nouns each, written after the fixes) was measured ONCE with the fixed engine: Haskell SAST P 91.7% / R 91.7%, Haskell taint P 93.3% / R 93.3%, Nix config-sast P 100% / R 97.0%; all three meet the targets (precision 90%, recall 85%). The frozen holdout is unchanged at 100% (re-measured after the engine change, which counts as repeated holdout use; nothing was tuned against it). Intervals on the unseen numbers are now over shapes, not near-identical cases.
+- **What the fresh set still misses (not fixed, because fixing them would consume it).** Haskell: `strictRequestBody` read through an explicit import list, `fromJust (lookup k t)` (measured before the key-visibility fix above), `when (isNothing h) (... >> finish)` and `X-Api-Key` header checks reported as missing authentication, `getWith opts url` (the URL is the second argument), and duplicate findings for `readCreateProcess (shell ...)`. Nix: a firewall opened by a full-range `allowedTCPPortRanges`. The causes were not investigated (that would consume the set); these are the next known gaps. One engine change, the `fromJust (lookup ...)` regression fix, was made after the unseen measurement because the `lookup` change itself had caused it; the stored numbers were not re-measured, so they are conservative, and the set should be treated as consumed for anything after this release (an unseen-v3 is needed for the next round).
+- **Author errors in the retired set, named.** A cookie called `usersses` (nothing in the code says it is a session), an HTML shape that prints to stdout, vulnerable Nix shapes with a second real flaw, and a path shape with two sinks. They stay in `shape-dev` with a note; they were not "fixed" in the engine.
+
+- **A flaky probe, fixed.** The Haskell witness runner's `runghc --version` probe gave up after 10 s, which a cold CI runner exceeded once: the toolchain then read as absent in one call and present in the next, failing a test that asked twice. The probe now allows 60 s, says so when it times out, and the test decides availability once.
+
+Partial release: the loop controller still lists NIX-011, NIX-012 and REL-001 as not verified. NIX-011 and NIX-012 passed on hosted CI (the NIX-012 suite inside a real NixOS guest on x86_64; no aarch64 guest was run), which is CI evidence, not controller-signed evidence. REL-001 needs those to be controller-verified first.
+
+## 0.155.0 - premortem remediation (trust boundary, unseen-shape measurement), NixOS VM check
+
+An adversarial premortem of 0.154.0 found the following; each is fixed here and covered by `test/language/language-trust-boundary.test.js`.
+
+- **Trust boundary.** Advisory snapshots are read only from the operator (environment variable or `$XDG_CONFIG_HOME/agentic-security/`). A snapshot inside the scanned project is ignored and the scan says so, so a repository can no longer ship an empty feed to look clean. Nix export freshness is derived by the scanner from `flake.lock`, project-supplied exports and plans are disclosed, a refused export contributes nothing, and a Cabal plan that contradicts the freeze file is flagged.
+- **Unseen-shape split.** The holdout shares its code shapes with development, so it measures robustness to renaming only. A new `unseen` split (300 author-labelled cases, 3 new vulnerable and 3 new safe shapes per family) is measured once and never tuned against. Its result is stored beside every holdout row with 95% Clopper-Pearson intervals and strict precision. It is **below target** for Haskell SAST (R 79.2%), Haskell taint (P 77.8%) and Nix config-sast (P 86.1%); those are engine gaps, not fixed here. The `auth` row is now promoted from its own holdout evidence.
+- **Completion honesty.** A release check (`completion-declared`) fails when `docs/completion-status.json` lists unverified requirements and the changelog has no paragraph naming them. Chrome-dependent export tests are a separate informational job rather than a silent skip.
+- **Nix package fix (found by the first hosted NixOS guest run).** The packaged `agentic-security-mcp` and `agentic-security-lsp` wrappers ran `bin/*.js`, which import `src/` and therefore npm dependencies the Nix package does not ship, so both would have crashed for a Nix user. They now run from the self-contained bundle, and the CLI gained an `lsp` subcommand (the same server the editor plugins start). The flake's package source is now exactly the files it installs, so an offline rebuild elsewhere reproduces the same derivation.
+- **Destructive-command guard.** `hooks/pre-bash-guard.js` judged `rm` by text, so it refused any absolute path (and `docker run --rm -v /abs/...`) while missing nothing it should. Deletion (`rm`, `rmdir`, `unlink`, `find -delete`) is now path-aware: targets are parsed and resolved (`~`, `$HOME`, relative paths, `cd`, symlinks) and allowed only strictly inside an allowed root (default `~/code`, set with `allowedRoots` in `.agentic-security/destructive-guard.json`). Anything outside, anything unresolvable (`$VAR`, command substitution, `xargs`) and the root itself is refused. It cannot see deletion done inside another program, so it guards against mistakes and is not a sandbox. Pinned by `test/pre-bash-guard.test.js`.
+- **Not done.** Peak scan memory is measured under a stated heap cap and was **not reduced**: a lazy-token experiment retained less but changed no measurement, so it was reverted. `flake.nix` is now locked (`flake.lock`), built and checked on aarch64-linux in a `nixos/nix` container (Nix 2.35.2) and on x86_64-linux on a hosted runner; aarch64-darwin is declared but unbuilt, and x86_64-darwin is dropped (current nixpkgs no longer supports it).
+
+Partial release: the loop controller lists NIX-011, NIX-012 and REL-001 as not verified. NIX-011 and NIX-012 passed on hosted CI in this release's pull request (the NIX-011 suite on Nix 2.24.10; the NIX-012 suite inside a real NixOS guest booted by the flake's `nixos-host` check on an x86_64 runner with KVM), but that is CI evidence, not controller-signed evidence, because the controller runs where `nix` and `/etc/NIXOS` are absent. The aarch64 NixOS guest was not run: the arm runner has no KVM and a software-emulated guest does not boot in any usable time. REL-001 is the controller's own final acceptance and needs those two to be controller-verified first.
+
 ## 0.154.0 - Haskell and Nix/NixOS support, with every limit stated
 
 Haskell and Nix/NixOS are now scanned by the same commands as every other language, with no compiler, no `nix` binary and no

package/bin/agentic-security.js

@@ -137,6 +137,7 @@ Commands:
   tickets sync --provider <p>  Two-way sync findings ↔ GitHub Issues / Linear / Jira
   digest --slack <webhook>     Vibecoder: send daily digest to Slack
   mcp                          Start the MCP stdio server (scan_diff, query_taint, explain_finding, apply_fix)
+  lsp                          Start the Language Server Protocol server on stdio (what the editor plugins run)
   validator-cache stats|gc     Inspect / prune .agentic-security/llm-cache/ (use --older-than <days> --dry-run)
   verify [--finding <id>]      Re-run the verifier loop on last-scan findings (use --live --target <url> to execute PoCs)
   ask "<question>" [target]    Bounded local-model Q&A with read-only tool access (requires AGENTIC_SECURITY_LLM_PRESET=ollama)
@@ -7056,6 +7057,13 @@ async function main() {
         runStdio({ sessionRoot: path.resolve(root) });
         return;
       }
+      case 'lsp':      {
+        // The same server as bin/agentic-security-lsp.js, reachable from the self-contained bundle: a package that ships only the bundle
+        // (the Nix package does) has no node_modules for the src/ entry point to import from.
+        const { startLspServer } = await import('../src/lsp/server.js');
+        startLspServer();
+        return;
+      }
       case 'explore':  process.exit(await cmdExplore(args));
       case 'dataflow': {
         const sub = args._[1];

package/dist/1919.index.js

@@ -0,0 +1,445 @@
+export const id = 1919;
+export const ids = [1919];
+export const modules = {
+
+/***/ 21919:
+/***/ ((__webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependencies__, __webpack_async_result__) => { try {
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   startLspServer: () => (/* binding */ startLspServer)
+/* harmony export */ });
+/* unused harmony export _internals */
+/* harmony import */ var _language_discovery_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(30951);
+/* harmony import */ var _language_context_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(15911);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(76760);
+/* harmony import */ var node_readline__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(80481);
+/* harmony import */ var _runScan_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(45950);
+/* harmony import */ var _posture_custom_rules_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9049);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(31174);
+/* harmony import */ var _mcp_redact_js__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(83468);
+/* harmony import */ var _report_index_js__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__(75917);
+var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_runScan_js__WEBPACK_IMPORTED_MODULE_5__, _report_index_js__WEBPACK_IMPORTED_MODULE_8__]);
+([_runScan_js__WEBPACK_IMPORTED_MODULE_5__, _report_index_js__WEBPACK_IMPORTED_MODULE_8__] = __webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__);
+// Minimal LSP server for agentic-security.
+//
+// Speaks the Language Server Protocol over stdio. On every textDocument/
+// didSave (and didOpen), the server runs runScan on the file and emits
+// textDocument/publishDiagnostics with the resulting findings mapped to
+// LSP Diagnostic objects.
+//
+// This is a STARTER implementation — feature-complete enough that JetBrains
+// (via LSP4IJ) and Neovim (via built-in LSP) can both attach and see
+// findings inline. The full feature set (code actions for /fix, inline
+// remediation hover, exploitability tooltip) is future work.
+//
+// Wire-format: vscode-jsonrpc framing (Content-Length headers). Stateless
+// per file — no incremental analysis yet.
+
+
+
+
+
+
+
+
+
+
+
+
+const PROTOCOL_VERSION = '3.17';
+const SERVER_NAME = 'agentic-security-lsp';
+const SERVER_VERSION = '0.1.0';
+
+let _rootUri = null;
+let _rootDir = process.cwd();
+let _stdoutMutex = Promise.resolve();
+const _diagnosticsByUri = new Map();
+
+function uriToPath(uri) {
+  if (!uri) return null;
+  if (uri.startsWith('file://')) return decodeURIComponent(uri.slice(7));
+  return uri;
+}
+
+function pathToUri(p) {
+  if (!p) return null;
+  if (p.startsWith('file://')) return p;
+  return 'file://' + encodeURI(node_path__WEBPACK_IMPORTED_MODULE_3__.resolve(p));
+}
+
+function sevToLsp(sev) {
+  switch ((sev || '').toLowerCase()) {
+    case 'critical': return 1;  // Error
+    case 'high':     return 1;  // Error
+    case 'medium':   return 2;  // Warning
+    case 'low':      return 3;  // Information
+    default:         return 4;  // Hint
+  }
+}
+
+// The most precise location a finding carries. Haskell and Nix findings keep their ORIGINAL span (0-based columns); a
+// finding with only a line is reported across that line, as before.
+function _rangeOf(f) {
+  const o = f && f.originalLocation;
+  if (o && Number.isInteger(o.startLine) && Number.isInteger(o.startColumn)) {
+    return { start: { line: Math.max(0, o.startLine - 1), character: o.startColumn }, end: { line: Math.max(0, (Number.isInteger(o.endLine) ? o.endLine : o.startLine) - 1), character: Number.isInteger(o.endColumn) ? o.endColumn : o.startColumn + 1 } };
+  }
+  if (o && Number.isInteger(o.line) && Number.isInteger(o.column)) {
+    const line = Math.max(0, o.line - 1);
+    return { start: { line, character: o.column }, end: { line, character: 200 } };
+  }
+  const line = Math.max(0, ((f && f.line) || 1) - 1);
+  return { start: { line, character: 0 }, end: { line, character: 200 } };
+}
+
+function findingToDiagnostic(f) {
+  const line = Math.max(0, (f.line || 1) - 1);
+  // Stage 6 correctness audit: this read f.remediation directly, but raw
+  // scan.findings entries (what this consumes, pre-normalizeFindings) come
+  // from two conventions — most posture/*.js and newer sast/*.js modules
+  // set `remediation`, while ~127 of engine.js's own detectors set a `fix`
+  // STRING field instead. _remediationOf carries the same precedence
+  // report/index.js already established for this exact split (CMP-3).
+  const remediation = (0,_report_index_js__WEBPACK_IMPORTED_MODULE_8__/* ._remediationOf */ .uV)(f);
+  return {
+    range: _rangeOf(f),
+    severity: sevToLsp(f.severity),
+    source: 'agentic-security',
+    code: f.cwe || f.family || 'finding',
+    // carried back by the client in codeAction requests, so a fix is offered for exactly this finding
+    data: { id: f.id || null, stableId: f.stableId || null, rule: f.rule || null, family: f.family || null, language: f.language || (0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.languageOfFinding)(f) || null },
+    message: `${f.vuln || 'Security finding'}${remediation ? '\n\n' + remediation : ''}`.slice(0, 2000),
+    tags: [],
+  };
+}
+
+function send(message) {
+  const json = JSON.stringify({ jsonrpc: '2.0', ...message });
+  _stdoutMutex = _stdoutMutex.then(() => new Promise(resolve => {
+    process.stdout.write(`Content-Length: ${Buffer.byteLength(json, 'utf8')}\r\n\r\n${json}`, resolve);
+  }));
+  return _stdoutMutex;
+}
+
+async function publishDiagnostics(uri, findings) {
+  await send({
+    method: 'textDocument/publishDiagnostics',
+    params: { uri, diagnostics: findings.map(findingToDiagnostic) },
+  });
+  _diagnosticsByUri.set(uri, findings);
+}
+
+// Manifest / schema files that downstream passes (SCA, cross-language) read.
+// We walk the project tree once per LSP session and cache these so the
+// per-save scan has them.
+const DEP_BASE_NAMES = new Set([
+  'package.json', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml',
+  'requirements.txt', 'pyproject.toml', 'poetry.lock', 'Pipfile.lock',
+  'composer.json', 'composer.lock', 'Gemfile', 'Gemfile.lock',
+  'go.mod', 'Cargo.toml', 'Cargo.lock',
+  'pom.xml', 'build.gradle', 'build.gradle.kts',
+]);
+const DEP_EXT_RE = /\.(?:proto|graphql|gql|tf|cabal)$/i;
+// Haskell and Nix project manifests and lock files (cabal.project*, stack.yaml*, package.yaml, flake.lock, ...) are
+// recognised by the shared language discovery module, never by a second list here.
+const _isLanguageDep = (base) => (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_0__/* .isLanguageManifest */ .mD)(base);
+const DEP_NAME_RE = /(?:openapi|swagger)\.(?:ya?ml|json)$/i;
+
+let _depCache = { rootDir: null, depFileContents: {} };
+
+function _loadDepFileContents(rootDir) {
+  if (_depCache.rootDir === rootDir) return _depCache.depFileContents;
+  const out = {};
+  const skipDirs = new Set(['node_modules', '.git', 'dist', 'build', '.next', 'target', 'vendor', '.bench-cache']);
+  function walk(dir) {
+    let entries;
+    try { entries = node_fs__WEBPACK_IMPORTED_MODULE_2__.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (skipDirs.has(e.name)) continue;
+      const full = node_path__WEBPACK_IMPORTED_MODULE_3__.join(dir, e.name);
+      if (e.isDirectory()) { walk(full); continue; }
+      if (!e.isFile()) continue;
+      const base = e.name;
+      if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base) || _isLanguageDep(base)) {
+        let stat;
+        try { stat = node_fs__WEBPACK_IMPORTED_MODULE_2__.statSync(full); } catch { continue; }
+        if (stat.size > 500_000) continue;
+        try { out[node_path__WEBPACK_IMPORTED_MODULE_3__.relative(rootDir, full)] = node_fs__WEBPACK_IMPORTED_MODULE_2__.readFileSync(full, 'utf8'); }
+        catch { /* skip unreadable */ }
+      }
+    }
+  }
+  walk(rootDir);
+  _depCache = { rootDir, depFileContents: out };
+  return out;
+}
+
+async function scanFile(uri) {
+  const filePath = uriToPath(uri);
+  if (!filePath || !node_fs__WEBPACK_IMPORTED_MODULE_2__.existsSync(filePath)) return;
+  // Incremental scan (premortem 2R4.5 / 2R-10): hand runScan a single-file
+  // fileContents map for the saved code, AND a cached set of dep-manifest /
+  // schema files so SCA + cross-language passes have their inputs. Without
+  // depFileContents, the LSP path would silently drop CVE / OpenAPI / proto
+  // findings on the saved file.
+  try {
+    const rel = node_path__WEBPACK_IMPORTED_MODULE_3__.relative(_rootDir, filePath);
+    const content = node_fs__WEBPACK_IMPORTED_MODULE_2__.readFileSync(filePath, 'utf8');
+    let fileContents = { [rel]: content };
+    let depFileContents = _loadDepFileContents(_rootDir);
+    // Haskell/Nix: scan the saved file together with the modules it imports and the ones that import it (bounded).
+    const lc = (0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.withLanguageContext)(_rootDir, fileContents, depFileContents);
+    fileContents = lc.fileContents; depFileContents = lc.depFileContents;
+    // Premortem 4R-12 + 4R-15: reset the per-process custom-rules budget at
+    // the start of each LSP scan. Each save is a logical scan session; without
+    // the reset, a long-lived LSP server would accumulate budget across saves
+    // and eventually start skipping custom rules.
+    (0,_posture_custom_rules_js__WEBPACK_IMPORTED_MODULE_6__/* .resetCustomRulesBudget */ .zO)(_rootDir);
+    // PRD R1 (docs/DETECTION_GAP_REMEDIATION_PRD.md): deep mode is
+    // default-on for the interactive CLI scan but was never requested here,
+    // so every on-save diagnostic pass was regex/AST-only — blind to any bug
+    // whose source and sink are connected only through a call. Scoped to
+    // exactly the saved file (fileContents has one entry), so this does not
+    // turn every keystroke's save into a full-project deep scan.
+    // withStateWritesDisabled, for the same reason mcp/tools.js's scan_diff
+    // wraps its own partial-set scan (FR-704). This is a DIAGNOSTIC surface: it
+    // runs on every file save, against the user's real project root, with a
+    // fileContents map holding exactly one file. Without the wrapper,
+    // runFullScan's state writers fire on every keystroke-save — dpia.md,
+    // ropa.md, privacy-framework.json, threat-model.json and the rest, written
+    // into the user's tree by an editor plugin they never asked to mutate
+    // anything.
+    //
+    // The provenance lifecycle store makes that actively destructive rather
+    // than merely noisy: updateLifecycle marks every open stableId ABSENT from
+    // the finding set it is handed as `remediated`, and this set is one file's
+    // worth of findings. Every save would remediate the whole project, and the
+    // next real scan would reintroduce it.
+    //
+    // Chosen over forwarding `provenance:false` through runScan because that
+    // would fix only the lifecycle half and leave the other state writers
+    // firing. The flag is process-global (see its KNOWN LIMITATION), which is
+    // harmless here: this server is a read-only surface whose every scan wants
+    // writes off, so overlapping saves can only ever agree, and the `finally`
+    // restores the prior value either way. exceptCategories:['provenance-cache']
+    // (M2 §2.4) is the one deliberate exception — every OTHER write this scan
+    // would make stays suppressed, but the provenance disk cache stays live so
+    // repeated saves of the same file are not each paying the full uncached
+    // resolution cost.
+    const { scan } = await (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_7__/* .withStateWritesDisabled */ .Ao)(() =>
+      (0,_runScan_js__WEBPACK_IMPORTED_MODULE_5__.runScan)(_rootDir, { fileContents, depFileContents, deep: true, deepInCi: true }),
+      { exceptCategories: ['provenance-cache'] });
+    // Stage 6 correctness audit: this only ever read scan.findings (the SAST
+    // channel). scan.secrets and scan.logicVulns are separate arrays on the
+    // raw runScan() result — normalizeFindings is what merges all four
+    // channels, and that hasn't run here — so a saved file with a hardcoded
+    // credential got a clean problem pane, no diagnostic at all. Unlike the
+    // MCP surface, this server never applied redactFinding either (nothing
+    // here imported mcp/redact.js), which would have been a landmine the
+    // moment secrets/logicVulns were added without it: those channels are
+    // exactly where raw secret material shows up in `snippet`. Both fixed
+    // together — merge the channels AND redact — so the fix for one gap
+    // doesn't open the other.
+    const findings = [...(scan.findings || []), ...(scan.secrets || []), ...(scan.logicVulns || [])]
+      .filter(f => f.file === rel)
+      .map(f => (0,_mcp_redact_js__WEBPACK_IMPORTED_MODULE_9__/* .redactFinding */ .lE)(f));
+    await publishDiagnostics(uri, findings);
+  } catch (e) {
+    process.stderr.write(`agentic-security-lsp: scan failed: ${e.message}\n`);
+  }
+}
+
+function handleInitialize(params) {
+  if (params.rootUri) {
+    _rootUri = params.rootUri;
+    _rootDir = uriToPath(params.rootUri) || process.cwd();
+  } else if (params.rootPath) {
+    _rootDir = params.rootPath;
+  }
+  return {
+    capabilities: {
+      textDocumentSync: {
+        openClose: true,
+        change: 1,
+        save: { includeText: false },
+      },
+      diagnosticProvider: { interFileDependencies: true, workspaceDiagnostics: false },
+      // quick fixes for Haskell and Nix findings (preview edits from the verified language fixers)
+      codeActionProvider: { codeActionKinds: ['quickfix'], resolveProvider: false },
+    },
+    serverInfo: { name: SERVER_NAME, version: SERVER_VERSION },
+  };
+}
+
+/**
+ * textDocument/codeAction: a quick fix for each agentic-security diagnostic in range that a language fixer can repair.
+ * The edit is a PREVIEW the editor applies; nothing is written here. A finding with no safe fix gets a disabled
+ * action that says why, never a silent omission.
+ */
+async function codeActionsFor(params) {
+  const uri = params && params.textDocument && params.textDocument.uri;
+  const diags = ((params && params.context && params.context.diagnostics) || []).filter((d) => d && d.source === 'agentic-security' && d.data && d.data.id);
+  const stored = (uri && _diagnosticsByUri.get(uri)) || [];
+  if (!diags.length || !stored.length) return [];
+  let files = null;
+  const actions = [];
+  for (const d of diags) {
+    const f = stored.find((x) => x && x.id === d.data.id);
+    if (!f || !(0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.languageOfFinding)(f)) continue;
+    if (!files) files = (0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.loadLanguageProject)(_rootDir).files;
+    let prev;
+    try { prev = await (0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.languageFixPreview)(f, files); } catch (e) { prev = { ok: false, reason: String((e && e.message) || e) }; }
+    if (prev && prev.ok && prev.file) {
+      const target = pathToUri(node_path__WEBPACK_IMPORTED_MODULE_3__.join(_rootDir, prev.file));
+      actions.push({
+        title: `Fix${prev.label ? ` (${prev.label})` : ''}: ${f.vuln || f.rule || 'finding'}`,
+        kind: 'quickfix', diagnostics: [d], isPreferred: false,
+        edit: { changes: { [target]: [(0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.minimalEdit)(prev.before, prev.after)] } },
+        data: { stableId: f.stableId || null, verified: { syntax: true, rescan: true } },
+      });
+    } else {
+      actions.push({ title: `No automatic fix: ${f.vuln || f.rule || 'finding'}`, kind: 'quickfix', diagnostics: [d], disabled: { reason: (prev && (prev.reason || prev.status)) || 'no deterministic fix exists for this finding' } });
+    }
+  }
+  return actions;
+}
+
+async function handleMessage(msg) {
+  if (msg.method === 'textDocument/codeAction') {
+    return { id: msg.id, result: await codeActionsFor(msg.params || {}) };
+  }
+  if (msg.method === 'initialize') {
+    return { id: msg.id, result: handleInitialize(msg.params || {}) };
+  }
+  if (msg.method === 'initialized' || msg.method === 'workspace/didChangeConfiguration') {
+    return null;  // notification, no response
+  }
+  if (msg.method === 'shutdown') {
+    return { id: msg.id, result: null };
+  }
+  if (msg.method === 'exit') {
+    process.exit(0);
+  }
+  if (msg.method === 'textDocument/didOpen') {
+    const uri = msg.params?.textDocument?.uri;
+    if (uri) scanFile(uri);
+    return null;
+  }
+  if (msg.method === 'textDocument/didSave') {
+    const uri = msg.params?.textDocument?.uri;
+    if (uri) {
+      // Premortem 3R-9 / 4R-5: when the user saves a manifest file, the
+      // dep-cache entry for THAT file is stale. Granular invalidation (only
+      // re-read the saved file from disk) avoids the O(project) re-walk that
+      // 3R-9 introduced — important in monorepos where mass manifest edits
+      // would otherwise re-scan thousands of files per save.
+      const savedPath = uriToPath(uri);
+      if (savedPath && _depCache.rootDir === _rootDir) {
+        const base = node_path__WEBPACK_IMPORTED_MODULE_3__.basename(savedPath);
+        if (DEP_BASE_NAMES.has(base) || DEP_EXT_RE.test(base) || DEP_NAME_RE.test(base) || _isLanguageDep(base)) {
+          try {
+            const rel = node_path__WEBPACK_IMPORTED_MODULE_3__.relative(_rootDir, savedPath);
+            const st = node_fs__WEBPACK_IMPORTED_MODULE_2__.statSync(savedPath);
+            if (st.size <= 500_000) {
+              _depCache.depFileContents[rel] = node_fs__WEBPACK_IMPORTED_MODULE_2__.readFileSync(savedPath, 'utf8');
+            } else {
+              delete _depCache.depFileContents[rel];
+            }
+          } catch {
+            // File vanished between save event and stat — drop from cache.
+            try {
+              const rel = node_path__WEBPACK_IMPORTED_MODULE_3__.relative(_rootDir, savedPath);
+              delete _depCache.depFileContents[rel];
+            } catch {}
+          }
+        }
+      }
+      scanFile(uri);
+    }
+    return null;
+  }
+  if (msg.method === 'textDocument/didClose') {
+    const uri = msg.params?.textDocument?.uri;
+    if (uri) await publishDiagnostics(uri, []);
+    return null;
+  }
+  // Unknown method.
+  if (msg.id != null) {
+    return { id: msg.id, error: { code: -32601, message: `Method not found: ${msg.method}` } };
+  }
+  return null;
+}
+
+function startLspServer() {
+  let buffer = Buffer.alloc(0);
+  let expected = -1;
+  process.stdin.on('data', async (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    while (true) {
+      if (expected < 0) {
+        const headerEnd = buffer.indexOf('\r\n\r\n');
+        if (headerEnd < 0) break;
+        const headers = buffer.slice(0, headerEnd).toString('utf8');
+        const m = headers.match(/Content-Length:\s*(\d+)/i);
+        if (!m) {
+          process.stderr.write('agentic-security-lsp: missing Content-Length header\n');
+          buffer = buffer.slice(headerEnd + 4);
+          continue;
+        }
+        expected = parseInt(m[1], 10);
+        buffer = buffer.slice(headerEnd + 4);
+      }
+      if (buffer.length < expected) break;
+      const body = buffer.slice(0, expected).toString('utf8');
+      buffer = buffer.slice(expected);
+      expected = -1;
+      let msg;
+      try { msg = JSON.parse(body); }
+      catch { process.stderr.write('agentic-security-lsp: malformed JSON\n'); continue; }
+      try {
+        const response = await handleMessage(msg);
+        if (response) await send(response);
+      } catch (e) {
+        if (msg.id != null) await send({ id: msg.id, error: { code: -32603, message: e.message } });
+      }
+    }
+  });
+  process.stdin.on('end', () => process.exit(0));
+}
+
+// Allow direct invocation as a bin entry: `node lsp/server.js`.
+//
+// `import.meta.url === file://${process.argv[1]}` looks equivalent but is
+// NOT: when this script is invoked through a symlink (exactly what
+// `npm install -g`, `npx`, and `node_modules/.bin/<name>` all do for a
+// package's `bin` entries — and `agentic-security-lsp` IS one of this
+// package's bin entries), Node resolves `import.meta.url` to the symlink's
+// realpath while `process.argv[1]` stays the symlink path as invoked, so the
+// two never match, the guard is always false, and the server silently exits
+// with no output — an editor would see the language server start and
+// immediately die with nothing on stderr to explain it. `import.meta.main` is
+// resolved correctly through a symlink. It was added in Node v24.2.0
+// (backported to v22.18.0) and is currently Stability 1.0 (early development)
+// per Node's own docs — NOT stable, and NOT available on v20.11. Concretely:
+// it is `undefined` on Node 24.0.0/24.1.x, which satisfy this repo's declared
+// `engines.node: ">=24.0.0"` floor, so `import.meta.main` alone would
+// reproduce this exact bug on a plain non-symlinked invocation under those two
+// point releases. The `??` fallback covers that gap without bumping the
+// engines floor. Identical to bin/agentic-security.js's guard, deliberately —
+// see the long-form note there.
+if (import.meta.main ?? (import.meta.url === `file://${process.argv[1]}`)) {
+  startLspServer();
+}
+
+function _setRootDir(dir) { _rootDir = dir; _depCache = { rootDir: null, depFileContents: {} }; }
+
+const _internals = { findingToDiagnostic, scanFile, uriToPath, pathToUri, _diagnosticsByUri, _setRootDir };
+
+__webpack_async_result__();
+} catch(e) { __webpack_async_result__(e); } });
+
+/***/ })
+
+};

package/dist/2862.index.js

@@ -261,14 +261,14 @@ async function assessLanguageAssurance(input = {}) {
   const scaRequired = (required.haskell || []).includes('sca') && !disabled.has('haskell:sca');
   if (present.has('haskell') && scaRequired && manifests.length) {
     const db = input.advisoryDb;
-    if (!db) conditions.push('no Hackage advisory snapshot is loaded: Haskell dependency vulnerabilities were not assessed');
+    if (!db) conditions.push(`no Hackage advisory snapshot is loaded: Haskell dependency vulnerabilities were not assessed${input.advisoryReason ? `. ${input.advisoryReason}` : ''}`);
     else if (db.stale) conditions.push(`the Hackage advisory snapshot is stale (${db.ageDays == null ? 'age unknown' : `${Math.floor(db.ageDays)} day(s) old`}, limit ${db.maxAgeDays})`);
   }
 
   // 3b. resolved dependency data and the Nix closure: a stale, malformed or unchecked input is stated, never silently dropped
   for (const g of input.supplyGaps || []) {
     if (!g || !g.kind) continue;
-    if (/unavailable|stale|malformed|failed|unverified/.test(g.kind)) conditions.push(`${g.kind.replace(/^(?:resolved|closure)-/, '')}: ${String(g.detail || '').slice(0, 220)}`);
+    if (/unavailable|stale|malformed|failed|unverified|refused|contradicts/.test(g.kind)) conditions.push(`${g.kind.replace(/^(?:resolved|closure)-/, '')}: ${String(g.detail || '').slice(0, 220)}`);
     else limitations.push({ kind: 'supply-gap', gap: g.kind, note: String(g.detail || '').slice(0, 220) });
   }