@clear-capabilities/agentic-security-scanner 0.157.2 → 0.158.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-56d856abb0b6dc7e1c61df986d0c52e0dddf7e196617f21a370f31f32b5f2977  agentic-security.mjs
+18b81da52b654c93c6240dfc2909e049da0accb60cd1b2a8dca439d05cca7fd9  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.157.2",
+  "version": "0.158.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -79,9 +79,9 @@
     "test:lineage": "node --test test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
     "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
-    "test:haskell": "node --test test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js",
-    "test:nix": "node --test test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js",
-    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-gap-fixes.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js test/language/language-trust-boundary.test.js",
+    "test:haskell": "node --test test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-advisory-feed.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js",
+    "test:nix": "node --test test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-haskell-closure-names.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js",
+    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-gap-fixes.test.js test/language/language-gap-fixes-2.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js test/language/language-trust-boundary.test.js",
     "test:language-stress": "node --test --test-concurrency=1 test/language/language-stress-offline.test.js",
     "test:language-tools": "node --test test/haskell/haskell-web-auth.test.js test/haskell/haskell-support-gate.test.js",
     "bench:language-support:check": "node ../bench/language-support/check.mjs",

package/src/dataflow/engine.js

@@ -1148,6 +1148,7 @@ function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callC
           // Haskell: two sinks of the same kind on one line (`if b then f (clean x) else f x`) are distinct
           // sites; without a site key they share an id and one silently replaces the other.
           ...(/\.(?:hs|lhs)$/i.test(_currentFile || '') ? { siteKey: _siteKey(taintedArgExpr) } : {}),
+          ...(/\.(?:hs|lhs)$/i.test(_currentFile || '') && taintedArgExpr && taintedArgExpr.kind === 'call' ? { _argCallee: taintedArgExpr.callee } : {}),
           kind: 'taint',
           sinkId: e.id,
           vuln: e.vuln?.name || 'Tainted Sink',
@@ -1783,6 +1784,26 @@ function step(node, stateIn, callContext) {
 // state, never into the SummaryCache key (that stays exactly what the caller
 // supplied). Returns the ORIGINAL Set unchanged when there's nothing to add,
 // so callers that never touch annotation-shaped params pay zero extra cost.
+// Haskell: a sink whose tainted argument IS a call to another sink of the same CWE on the same line is one flaw reported twice
+// (`readCreateProcess (shell cmd)`: `shell` builds the command, `readCreateProcess` runs it). The INNER sink is kept, because it is
+// where the tainted text enters the command; the outer one is recorded on it, never dropped silently. Only a nested pair collapses:
+// two independent sinks on one line (`if b then f (clean x) else f x`) have different arguments and stay two findings, so a
+// discharged sink still cannot absorb its unprotected sibling.
+function _collapseNestedHsSinks(all) {
+  const base = (c) => String(c && typeof c === 'object' ? (c.name || c.text || '') : (c ?? '')).split('.').pop();
+  for (let i = all.length - 1; i >= 0; i--) {
+    const f = all[i];
+    if (f._argCallee === undefined || !/\.(?:hs|lhs)$/i.test(f.file || '')) continue;
+    const want = base(f._argCallee);
+    const inner = want && all.find((g) => g !== f && g.file === f.file && g.line === f.line && g.cwe === f.cwe && g.callee !== undefined && base(g.callee) === want);
+    if (!inner) continue;
+    inner.dedupedVulns = [...new Set([...(inner.dedupedVulns || []), f.vuln])];
+    inner.alsoSink = [...new Set([...(inner.alsoSink || []), base(f.callee)])];
+    all.splice(i, 1);
+  }
+  for (const f of all) if (f._argCallee !== undefined) delete f._argCallee;
+}
+
 // Short stable fingerprint of an argument expression (ignores line numbers and IR bookkeeping).
 function _siteKey(expr) {
   let h = 5381;
@@ -2575,6 +2596,7 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
     if (dg[f.severity]) f.severity = dg[f.severity];
   }
   Object.defineProperty(all, '_summaryCache', { value: summaryCache, enumerable: false });
+  _collapseNestedHsSinks(all);
   return all;
 
   // Dedup + map a raw findings array (from analyzeFunction's callContext)
@@ -2654,6 +2676,7 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
         // rebuilding the SMT path-feasibility mechanism (next-gen taint
         // capability #5) to depend on a REAL slice for a sound proof.
         ...(f.argIndex !== undefined ? { argIndex: f.argIndex } : {}),
+        ...(f._argCallee !== undefined ? { _argCallee: f._argCallee } : {}),
         // callee: kept as plain `callee` (not underscore-prefixed) to match
         // backward.js's own contract, which reads `f.callee` on both real and
         // fake-fixture findings throughout its module and test suite. It is

package/src/engine.js

@@ -9228,6 +9228,7 @@ function _deterministicFileTimings(timings) {
   const annotatedComponents=components.map(c=>{const key=`${c.ecosystem}:${c.name}:${c.version}`;const vulns=vulnsByKey[key]||[];const riKey=c.ecosystem==='maven'&&c.group?`maven:${c.group}/${c.name}`:`${c.ecosystem}:${c.name}`;const ri=registryInfo.get(riKey)||{};const latestVersion=ri.latestVersion||'';const vd=(ri.versions||{})[c.version]||{};const isDeprecated=typeof vd.deprecated==='string'&&vd.deprecated.length>0;const deprecationMessage=isDeprecated?vd.deprecated:'';const isOutdated=!isDeprecated&&typeof vd.outdated==='string'&&vd.outdated.length>0;const outdatedMessage=isOutdated?vd.outdated:'';const license=ri.license||vd.license||'';return{...c,vulns,hasVulns:vulns.length>0,hasAttackPath:attackResult.flagged.has(key),attackPaths:attackResult.pathsByKey.get(key)||[],latestVersion,isDeprecated,deprecationMessage,isOutdated,outdatedMessage,license};});
   // X-010: Hackage and Nix components, dependency edges and target provenance. Kept beside (not inside) the ordinary
   // component list so the existing consumers are untouched; the BOM emitters and the SBOM diff read it explicitly.
+  try{if(process.env.AGENTIC_SECURITY_HACKAGE_ADVISORIES_LIVE==='1'){const{prefetchHackageFeed}=await import('./language/haskell-supply.js');const{resolvedHackageComponents,nixHaskellPackageNames}=await import('./language/resolved-pass.js');let _rc=[],_nx=[];try{_rc=resolvedHackageComponents(allFileContents).components||[];}catch(_){}try{_nx=nixHaskellPackageNames(allFileContents);}catch(_){}await prefetchHackageFeed(allFileContents,{resolvedComponents:_rc,extraNames:_nx});}}catch(_){/* the live feed is optional: a failure leaves the scan on whatever snapshot exists */}
   let _languageBom=null;try{if(Object.keys(allFileContents).some(f=>/\.(?:l?hs|nix)$|\.cabal$|(?:^|\/)(?:cabal\.project(?:\.freeze)?|package\.yaml|stack\.yaml(?:\.lock)?|flake\.lock)$/i.test(f))){const{languageBom}=await import('./language/bom.js');const{resolvedHaskellGraph,nixClosureOf}=await import('./language/resolved-pass.js');const _rg=resolvedHaskellGraph(allFileContents);const _nc=nixClosureOf(allFileContents);_languageBom=languageBom(allFileContents,{...(_rg?{resolved:_rg.graph}:{}),...(_nc&&!_nc.refused.length?{closure:_nc.closure}:{})});}}catch(_){_languageBom=null;}
   aF.push(...(runDetector(_detectorErrors,'<project>','scanDbTaintCrossFile',()=>scanDbTaintCrossFile(fc))||[]));
   aF.push(...(runDetector(_detectorErrors,'<project>','scanCsharpCrossFile',()=>scanCsharpCrossFile(fc))||[]));

package/src/language/CLAUDE.md

@@ -26,6 +26,11 @@ or a capability.** Product-facing guides: `docs/guides/haskell.md`, `docs/guides
   outside the project root is refused (`fix-lifecycle.js` `isRootRelativePath`).
 - **Secrets never leave redacted.** `secrets.js` `redactLanguageSecrets` joins split literals before masking; egress and model
   prompts use it. Credential values are never written to any output or state file.
+- **The advisory feed is opt-in and records coverage.** `haskell-advisory-feed.js` touches the network only when
+  `AGENTIC_SECURITY_HACKAGE_ADVISORIES_LIVE=1` and never under `AGENTIC_SECURITY_OFFLINE`. Its snapshot lists the packages it actually
+  queried (`covered`); a package it did not cover is `feed-incomplete` and a stale one `feed-stale`, in BOTH matchers
+  (`evaluateComponents` and `nix-sca.js`). Any new consumer of an `AdvisoryDb` must check `db.coverage(name)` before saying "no advisory".
+  The snapshot lives in the operator configuration directory, never the project (`trusted-inputs.js`).
 - **Pragma** (`pragma.js`): comment-aware, line-scoped, exact rule-id match, logged. A line-less finding cannot be suppressed.
 
 ## Module map
@@ -33,7 +38,7 @@ or a capability.** Product-facing guides: `docs/guides/haskell.md`, `docs/guides
 | Group | Files |
 |---|---|
 | Shared | `discovery.js` (sources, manifests, explicit exports, exclusions, import graph, invalidation digests), `contracts.js`, `assurance.js` (scan-health inputs, conditions, limitations), `engine-pass.js` (language supply chain wired into the engine), `resolved-pass.js` (plan / Stack export / Nix closure / opt-in evaluation reachable from the CLI), `context.js` (project context for partial scans, fix previews and dependency upgrades, model prompt extras), `state-artifacts.js`, `pragma.js`, `secrets.js`, `bom.js`, `bom-validate.js`, `aibom.js`, `compliance-map.js`, `bridges.js`, `witness.js`, `fix-lifecycle.js` (the one fix lifecycle: path, syntax, rescan, compile, backup, history, undo) |
-| Haskell | `haskell-parser.js`, `haskell-grammar.js`, `haskell-adapter.js`, `haskell-ir.js`, `haskell-models.js` (the single registry of sources, sinks, sanitizers; `dataflow/catalog-haskell.js` is generated from it), `haskell-guards.js`, `haskell-security-rules.js`, `haskell-web.js`, `haskell-findings.js`, `haskell-syntax.js`, `haskell-sweep.js`, `haskell-disclosure.js`, `haskell-llm.js`, `haskell-manifests.js`, `haskell-resolved-graph.js`, `haskell-sca.js`, `haskell-supply.js`, `haskell-fix.js` |
+| Haskell | `haskell-parser.js`, `haskell-grammar.js`, `haskell-adapter.js`, `haskell-ir.js`, `haskell-models.js` (the single registry of sources, sinks, sanitizers; `dataflow/catalog-haskell.js` is generated from it), `haskell-guards.js`, `haskell-security-rules.js`, `haskell-web.js`, `haskell-findings.js`, `haskell-syntax.js`, `haskell-sweep.js`, `haskell-disclosure.js`, `haskell-llm.js`, `haskell-manifests.js`, `haskell-resolved-graph.js`, `haskell-sca.js`, `haskell-advisory-feed.js` (the opt-in live Hackage feed: OSV fetch, per-package coverage, operator-only snapshot), `haskell-supply.js`, `haskell-fix.js` |
 | Nix | `nix-parser.js`, `nix-grammar.js`, `nix-ir.js`, `nix-adapter.js`, `nixos-module-resolver.js`, `nixos-option-catalog.js`, `nixos-hardening.js`, `nix-build-trust.js`, `nix-secrets.js`, `nix-script-taint.js`, `nix-privacy.js`, `nix-agents.js`, `nix-inventory.js`, `nix-closure.js`, `nix-sca.js`, `nix-eval-isolation.js`, `nix-fix.js` |
 | Measurement | `accuracy.js` (family-scoped scoring, per-layer), `support-registry.js` (status rules, promotion refusals, frozen-hash demotion) |
 

package/src/language/haskell-advisory-feed.js

@@ -0,0 +1,179 @@
+// Live Hackage advisory feed (HS-009 follow-on). The matching logic in haskell-sca.js takes records from its caller and never fetches;
+// this module is the caller that can. It turns the OSV `Hackage` ecosystem (HSEC advisories and their aliases) into the same
+// hash-recorded snapshot the loader already verifies, and writes it where only the operator can: the per-user configuration
+// directory. A scanned project cannot supply or alter it (see trusted-inputs.js).
+//
+// Contract, in the order it matters:
+//   * Opt in. Nothing here touches the network unless AGENTIC_SECURITY_HACKAGE_ADVISORIES_LIVE=1, and never when
+//     AGENTIC_SECURITY_OFFLINE=1. An operator-pinned snapshot (AGENTIC_SECURITY_HACKAGE_ADVISORIES) always wins: it is not refreshed over.
+//   * Coverage is recorded, not assumed. The snapshot lists each package it actually queried and when. A package that was not queried,
+//     or whose query failed part-way, is NOT covered, and the matcher reports it `feed-incomplete` (unknown), never `no-advisories` (clean).
+//   * Failure degrades, it does not abort. An unreachable feed leaves the previous snapshot in place and the scan runs on it, with its age
+//     disclosed; with no previous snapshot the scan reports `feed-unavailable`, exactly as before this module existed.
+//   * Everything from the wire is untrusted: ids and package names are validated before they are placed in a URL or a path, sizes are
+//     bounded, and a record that does not parse as an OSV record is dropped and counted.
+
+import { mkdirSync, readFileSync, writeFileSync, renameSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { buildSnapshot, loadAdvisorySnapshot } from './haskell-sca.js';
+import { operatorConfigDir } from './trusted-inputs.js';
+
+export const FEED_ENV = 'AGENTIC_SECURITY_HACKAGE_ADVISORIES_LIVE';
+export const PINNED_ENV = 'AGENTIC_SECURITY_HACKAGE_ADVISORIES';
+export const SNAPSHOT_FILE = 'hackage-advisories.json';
+export const OSV_BASE = 'https://api.osv.dev';
+
+const DEFAULTS = Object.freeze({
+  ttlMs: 24 * 3600 * 1000,       // a covered package is not queried again inside this window
+  timeoutMs: 8000,
+  concurrency: 10,
+  batchSize: 500,
+  maxPackages: 500,
+  maxRecordBytes: 1 << 20,
+  maxSnapshotRecords: 20000,
+});
+
+const NAME_OK = /^[A-Za-z0-9][A-Za-z0-9-]{0,127}$/;   // Hackage package names
+const ID_OK = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,95}$/;   // HSEC-2023-0001, GHSA-..., CVE-...
+
+let last = null;
+/** What the most recent refresh in this process did, so a "no feed" reason can say why. */
+export const getLastRefresh = () => last;
+export const _resetLastRefresh = () => { last = null; };
+
+export function liveFeedEnabled(env = process.env) {
+  return env[FEED_ENV] === '1' && env.AGENTIC_SECURITY_OFFLINE !== '1';
+}
+
+export function snapshotPath(env = process.env, dir = null) {
+  return join(dir || operatorConfigDir(env), SNAPSHOT_FILE);
+}
+
+function readCurrent(path, maxAgeDays) {
+  let raw;
+  try { raw = JSON.parse(readFileSync(path, 'utf8')); } catch { return { records: new Map(), covered: {}, problem: null }; }
+  // Integrity first: a cache whose records do not match their own hashes is discarded, not repaired.
+  const r = loadAdvisorySnapshot(raw, { maxAgeDays });
+  if (!r.ok) return { records: new Map(), covered: {}, problem: `the cached snapshot was discarded: ${r.reason}` };
+  const covered = raw.covered && typeof raw.covered === 'object' ? { ...raw.covered } : {};
+  return { records: new Map(raw.records.map((x) => [x.id, x])), covered, problem: null };
+}
+
+async function getJson(fetchImpl, url, init, timeoutMs, maxBytes) {
+  const resp = await fetchImpl(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+  if (!resp || resp.status !== 200) throw new Error(`HTTP ${resp ? resp.status : 'none'}`);
+  const text = await resp.text();
+  if (Buffer.byteLength(text) > maxBytes) throw new Error('response too large');
+  return JSON.parse(text);
+}
+
+async function pool(items, limit, worker) {
+  const out = new Array(items.length);
+  let i = 0;
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (i < items.length) { const k = i++; out[k] = await worker(items[k], k); }
+  }));
+  return out;
+}
+
+/**
+ * Refresh the operator's Hackage advisory snapshot for the given package names.
+ * Never throws. Returns a plain result describing what happened; the snapshot file is only rewritten when something changed.
+ *
+ * @param {string[]} names Hackage package names the scan is about to evaluate
+ * @param {{env?: object, fetchImpl?: Function, now?: number, dir?: string, ttlMs?: number, timeoutMs?: number}} [opts]
+ */
+export async function refreshHackageAdvisories(names, opts = {}) {
+  const env = opts.env || process.env;
+  const cfg = { ...DEFAULTS, ...Object.fromEntries(Object.entries(opts).filter(([k]) => k in DEFAULTS)) };
+  const now = opts.now ?? Date.now();
+  const done = (r) => { last = { ...r, at: new Date(now).toISOString() }; return last; };
+
+  if (env[PINNED_ENV]) return done({ status: 'pinned-snapshot-in-use', detail: `${PINNED_ENV} names an operator snapshot; it is used as given and is not refreshed` });
+  if (env[FEED_ENV] !== '1') return done({ status: 'disabled', detail: `set ${FEED_ENV}=1 to fetch Hackage advisories from the OSV feed` });
+  if (env.AGENTIC_SECURITY_OFFLINE === '1') return done({ status: 'offline', detail: 'AGENTIC_SECURITY_OFFLINE=1: no advisory data was fetched' });
+
+  const wanted = [...new Set((names || []).filter((n) => typeof n === 'string' && NAME_OK.test(n)))].sort().slice(0, cfg.maxPackages);
+  if (!wanted.length) return done({ status: 'nothing-to-do', detail: 'no Hackage packages to look up' });
+
+  const path = snapshotPath(env, opts.dir);
+  const cur = readCurrent(path, 36500);
+  const need = wanted.filter((n) => { const t = Date.parse(cur.covered[n]); return !Number.isFinite(t) || now - t > cfg.ttlMs || t > now + 3600000; });
+  if (!need.length) return done({ status: 'current', detail: `${wanted.length} package(s) covered within the last ${Math.round(cfg.ttlMs / 3600000)}h; no request made`, packages: wanted.length, requested: 0 });
+
+  const fetchImpl = opts.fetchImpl || globalThis.fetch;
+  if (typeof fetchImpl !== 'function') return done({ status: 'failed', detail: 'no fetch implementation is available in this runtime' });
+
+  const failures = [];
+  const ok = new Set();           // packages whose whole answer was obtained
+  const refs = new Map();         // package -> [{id, modified}]
+  // 1. which advisories does OSV hold for each package?
+  for (let i = 0; i < need.length; i += cfg.batchSize) {
+    const chunk = need.slice(i, i + cfg.batchSize);
+    try {
+      const data = await getJson(fetchImpl, `${OSV_BASE}/v1/querybatch`, {
+        method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ queries: chunk.map((name) => ({ package: { name, ecosystem: 'Hackage' } })) }),
+      }, cfg.timeoutMs, 8 << 20);
+      const results = Array.isArray(data && data.results) ? data.results : [];
+      chunk.forEach((name, k) => {
+        const res = results[k];
+        if (!res || typeof res !== 'object') { failures.push(`${name}: no result`); return; }
+        if (res.next_page_token) { failures.push(`${name}: more advisories than one page; not treated as covered`); return; }
+        refs.set(name, (Array.isArray(res.vulns) ? res.vulns : []).filter((v) => v && typeof v.id === 'string' && ID_OK.test(v.id)).map((v) => ({ id: v.id, modified: v.modified || null })));
+      });
+    } catch (e) { for (const n of chunk) failures.push(`${n}: ${String((e && e.message) || e).slice(0, 80)}`); }
+  }
+
+  // 2. fetch the records that are new or newer than the cached copy
+  const toFetch = new Map();
+  for (const list of refs.values()) for (const { id, modified } of list) {
+    const have = cur.records.get(id);
+    if (!have || (modified && have.modified && Date.parse(modified) > Date.parse(have.modified)) || (modified && !have.modified)) toFetch.set(id, modified);
+  }
+  const fetched = new Map();
+  const badIds = new Set();
+  await pool([...toFetch.keys()], cfg.concurrency, async (id) => {
+    try {
+      const rec = await getJson(fetchImpl, `${OSV_BASE}/v1/vulns/${encodeURIComponent(id)}`, {}, cfg.timeoutMs, cfg.maxRecordBytes);
+      if (!rec || typeof rec !== 'object' || rec.id !== id) throw new Error('not the requested record');
+      fetched.set(id, rec);
+    } catch (e) { badIds.add(id); failures.push(`${id}: ${String((e && e.message) || e).slice(0, 80)}`); }
+  });
+
+  // 3. a package is covered only if every advisory it references is in hand
+  const records = new Map(cur.records);
+  for (const [id, rec] of fetched) records.set(id, rec);
+  const covered = { ...cur.covered };
+  const iso = new Date(now).toISOString();
+  let newlyCovered = 0;
+  for (const [name, list] of refs) {
+    if (list.some((v) => badIds.has(v.id) || !records.has(v.id))) continue;
+    covered[name] = iso; ok.add(name); newlyCovered++;
+  }
+  const uncovered = need.filter((n) => !ok.has(n));
+
+  if (!ok.size && !fetched.size) {
+    return done({ status: 'failed', detail: `the OSV feed could not be read (${failures.slice(0, 2).join('; ') || 'no response'}); ${cur.records.size ? 'the previous snapshot is used and its age is disclosed' : 'no advisory data is available'}`, packages: wanted.length, requested: need.length, uncovered, failures: failures.slice(0, 10), cacheProblem: cur.problem });
+  }
+  if (records.size > cfg.maxSnapshotRecords) return done({ status: 'failed', detail: `the snapshot would exceed ${cfg.maxSnapshotRecords} records; refusing to write it`, packages: wanted.length, requested: need.length, uncovered });
+
+  // 4. write the snapshot atomically, readable by the operator only
+  const snap = buildSnapshot([...records.values()].sort((a, b) => (a.id < b.id ? -1 : 1)), iso);
+  snap.covered = Object.fromEntries(Object.entries(covered).sort(([a], [b]) => (a < b ? -1 : 1)));
+  try {
+    const dir = opts.dir || operatorConfigDir(env);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(snap), { mode: 0o600 });
+    try { chmodSync(tmp, 0o600); } catch { /* best effort on filesystems without modes */ }
+    renameSync(tmp, path);
+  } catch (e) {
+    return done({ status: 'failed', detail: `the snapshot could not be written: ${e.code || e.message}`, packages: wanted.length, requested: need.length, uncovered });
+  }
+  return done({
+    status: uncovered.length ? 'partial' : 'refreshed',
+    detail: `${newlyCovered} package(s) covered, ${fetched.size} advisory record(s) fetched${uncovered.length ? `; ${uncovered.length} package(s) NOT covered (${uncovered.slice(0, 3).join(', ')}${uncovered.length > 3 ? ', ...' : ''}) and will be reported as unknown` : ''}`,
+    packages: wanted.length, requested: need.length, fetched: fetched.size, records: records.size, uncovered, failures: failures.slice(0, 10), path, cacheProblem: cur.problem,
+  });
+}

package/src/language/haskell-models.js

@@ -40,7 +40,7 @@ export const HS_PACKAGES = Object.freeze({
   yesod: { modules: ['Yesod.Core', 'Yesod'], tested: ['1.6'] },
   'http-client': { modules: ['Network.HTTP.Client', 'Network.HTTP.Client.TLS'], tested: ['0.7'] },
   'http-conduit': { modules: ['Network.HTTP.Simple', 'Network.HTTP.Conduit'], tested: ['2.3'] },
-  wreq: { modules: ['Network.Wreq'], tested: ['0.5'] },
+  wreq: { modules: ['Network.Wreq', 'Network.Wreq.Session'], tested: ['0.5'] },
   'blaze-html': { modules: ['Text.Blaze', 'Text.Blaze.Html', 'Text.Blaze.Html5', 'Text.Blaze.Internal'], tested: ['0.9'] },
   lucid: { modules: ['Lucid', 'Lucid.Base'], tested: ['2.11'] },
   shakespeare: { modules: ['Text.Hamlet', 'Text.Shakespeare'], tested: ['2.0'] },
@@ -127,7 +127,13 @@ sink('Network.HTTP.Simple', ['httpBS', 'httpLBS', 'httpJSON', 'httpNoBody', 'htt
 sink('Network.HTTP.Conduit', ['simpleHttp', 'parseRequest', 'parseUrlThrow', 'parseRequest_', 'httpLbs'], { ...SSRF, package: 'http-conduit' });
 sink('Network.HTTP.Client', ['parseRequest', 'parseUrlThrow', 'parseRequest_', 'requestFromURI'], { ...SSRF, package: 'http-client' });
 sink('Network.HTTP.Client', ['httpLbs', 'httpNoBody', 'withResponse', 'responseOpen'], { ...SSRF, argIndex: 0, package: 'http-client' });
-sink('Network.Wreq', ['get', 'post', 'put', 'delete', 'head', 'getWith', 'postWith', 'putWith'], { ...SSRF, argIndex: 0, package: 'wreq' });
+// wreq: where the URL sits depends on the function. `get url`, but `getWith opts url` (the first argument is the Options, not the target),
+// `customMethod method url`, `customMethodWith method opts url`; the Session forms take the session before the URL.
+sink('Network.Wreq', ['get', 'post', 'put', 'delete', 'head', 'options', 'patch'], { ...SSRF, argIndex: 0, package: 'wreq' });
+sink('Network.Wreq', ['getWith', 'postWith', 'putWith', 'deleteWith', 'headWith', 'optionsWith', 'patchWith', 'customMethod', 'customPayloadMethod'], { ...SSRF, argIndex: 1, package: 'wreq' });
+sink('Network.Wreq', ['customMethodWith', 'customPayloadMethodWith'], { ...SSRF, argIndex: 2, package: 'wreq' });
+sink('Network.Wreq.Session', ['get', 'post', 'put', 'delete', 'head', 'options', 'patch'], { ...SSRF, argIndex: 1, package: 'wreq' });
+sink('Network.Wreq.Session', ['getWith', 'postWith', 'putWith', 'deleteWith', 'headWith', 'optionsWith', 'patchWith'], { ...SSRF, argIndex: 2, package: 'wreq' });
 
 // CWE-1427. Untrusted text placed in a model request body. The call is an ordinary HTTP body setter, so the
 // finding is kept only for a file that shows AI evidence (an AI endpoint, model literal or SDK import):

package/src/language/haskell-sca.js

@@ -147,8 +147,12 @@ const fixedVersions = (ranges) => [...new Set((ranges || []).flatMap((r) => (r.e
 
 // ── advisory database (pinned snapshot / records) ────────────────────────────
 export class AdvisoryDb {
-  constructor({ records = [], source = 'records', generatedAt = null, now = Date.now(), maxAgeDays = 30, integrity = null } = {}) {
+  constructor({ records = [], source = 'records', generatedAt = null, now = Date.now(), maxAgeDays = 30, integrity = null, covered = null } = {}) {
     this.source = source;
+    // `covered` is {package: ISO time it was last queried}. null means the snapshot makes no per-package claim (a hand-built or
+    // operator-pinned snapshot): every package is then treated as covered, as it always was.
+    this.covered = covered && typeof covered === 'object' ? covered : null;
+    this.now = now;
     this.generatedAt = generatedAt;
     this.integrity = integrity;
     this.problems = [];
@@ -167,6 +171,13 @@ export class AdvisoryDb {
     this.maxAgeDays = maxAgeDays;
   }
   forPackage(name) { return this.byPackage.get(name) || []; }
+  /** 'covered' | 'uncovered' | 'stale' for a package; always 'covered' when the snapshot makes no per-package claim. */
+  coverage(name) {
+    if (!this.covered) return 'covered';
+    const t = Date.parse(this.covered[name]);
+    if (!Number.isFinite(t)) return 'uncovered';
+    return (this.now - t) / 86400000 > this.maxAgeDays ? 'stale' : 'covered';
+  }
 }
 
 const sha256 = (b) => createHash('sha256').update(b).digest('hex');
@@ -185,7 +196,7 @@ export function loadAdvisorySnapshot(snapshot, { pinnedSha256 = null, signature
     if (!want) return refuse(`record ${rec.id} has no recorded hash`);
     if (sha256(JSON.stringify(rec)) !== want) return refuse(`record ${rec.id} does not match its recorded hash`);
   }
-  const body = JSON.stringify({ schema: snapshot.schema, generatedAt: snapshot.generatedAt, records: snapshot.records, recordHashes: snapshot.recordHashes });
+  const body = snapshotBody(snapshot);
   const digest = sha256(body);
   if (pinnedSha256 && digest !== pinnedSha256) return refuse('snapshot hash does not match the pinned value');
   let signed = false;
@@ -197,7 +208,7 @@ export function loadAdvisorySnapshot(snapshot, { pinnedSha256 = null, signature
       signed = true;
     } catch (e) { return refuse(`signature check failed: ${e.message}`); }
   }
-  const db = new AdvisoryDb({ records: snapshot.records, source: 'snapshot', generatedAt: snapshot.generatedAt, now, maxAgeDays, integrity: { sha256: digest, hashPinned: !!pinnedSha256, signed } });
+  const db = new AdvisoryDb({ records: snapshot.records, source: 'snapshot', generatedAt: snapshot.generatedAt, now, maxAgeDays, integrity: { sha256: digest, hashPinned: !!pinnedSha256, signed }, covered: snapshot.covered || null });
   return { ok: true, db, digest };
 }
 
@@ -205,7 +216,8 @@ export function buildSnapshot(records, generatedAt) {
   const recordHashes = Object.fromEntries(records.map((r) => [r.id, sha256(JSON.stringify(r))]));
   return { schema: 1, generatedAt, records, recordHashes };
 }
-export const snapshotBody = (s) => JSON.stringify({ schema: s.schema, generatedAt: s.generatedAt, records: s.records, recordHashes: s.recordHashes });
+// `covered` joins the hashed body only when present, so a snapshot without it keeps the digest it always had.
+export const snapshotBody = (s) => JSON.stringify({ schema: s.schema, generatedAt: s.generatedAt, records: s.records, recordHashes: s.recordHashes, ...(s.covered ? { covered: s.covered } : {}) });
 
 // ── matching ─────────────────────────────────────────────────────────────────
 /**
@@ -251,6 +263,8 @@ export function evaluateComponents(components, db, opts = {}) {
   for (const comp of components) {
     const base = { name: comp.name, version: comp.version || null, declaredRange: comp.declaredRange || null, scope: comp.scope || null, target: comp.target || null, purl: hackagePurl(comp.name, comp.version || null) };
     if (!db) { statuses.push({ ...base, status: 'feed-unavailable' }); continue; }
+    const cov = db.coverage(comp.name);
+    if (cov !== 'covered') { statuses.push({ ...base, status: cov === 'stale' ? 'feed-stale' : 'feed-incomplete', reason: cov === 'stale' ? 'this package was last looked up longer ago than the feed age limit; the absence of advisories is not evidence' : 'the advisory feed never covered this package; the absence of advisories is not evidence' }); continue; }
     const hits = db.forPackage(comp.name);
     if (!hits.length) { statuses.push({ ...base, status: 'no-advisories', feed: feed.status }); continue; }
     let any = false;

package/src/language/haskell-security-rules.js

@@ -26,7 +26,7 @@ export const RULES = Object.freeze({
   'hs-ecb-mode': { cwe: 'CWE-327', severity: 'high', family: 'weak-crypto', vuln: 'ECB block cipher mode', remediation: 'ECB leaks plaintext structure. Use an AEAD mode (AES-GCM) with a fresh nonce.' },
   'hs-static-iv': { cwe: 'CWE-329', severity: 'high', family: 'weak-crypto', vuln: 'Static IV or nonce', remediation: 'Generate a fresh random IV/nonce per message with `getRandomBytes`; never reuse one with the same key.' },
   'hs-predictable-random': { cwe: 'CWE-338', severity: 'high', family: 'weak-randomness', vuln: 'Predictable random number generator used for a security value', remediation: 'Use `Crypto.Random.getRandomBytes` or `System.Entropy.getEntropy` (OS CSPRNG). `System.Random` is a deterministic PRNG.' },
-  'hs-unbounded-request-body': { cwe: 'CWE-400', severity: 'medium', family: 'resource-exhaustion', vuln: 'Request body read without a size limit', remediation: 'Apply `requestSizeLimitMiddleware` (wai-extra) or read a bounded number of chunks with `getRequestBodyChunk`.' },
+  'hs-unbounded-request-body': { cwe: 'CWE-770', severity: 'medium', family: 'resource-exhaustion', vuln: 'Request body read without a size limit', remediation: 'Apply `requestSizeLimitMiddleware` (wai-extra) or read a bounded number of chunks with `getRequestBodyChunk`.' },
   'hs-xml-entity-substitution': { cwe: 'CWE-611', severity: 'medium', family: 'xxe', vuln: 'XML parser configured to substitute DTD entities', remediation: 'Disable DTD entity substitution (`withSubstDTDEntities no`) for untrusted XML.' },
   'hs-sensitive-logging': { cwe: 'CWE-532', severity: 'high', family: 'sensitive-logging', vuln: 'Sensitive value written to a log or trace', remediation: 'Do not log credentials or secrets. Log an identifier, or redact the value before it reaches the logger.' },
   'hs-insecure-cookie': { cwe: 'CWE-1004', severity: 'medium', family: 'cookie-attributes', vuln: 'Session cookie without HttpOnly or Secure', remediation: 'Set `setCookieHttpOnly = True`, `setCookieSecure = True` and `setCookieSameSite = Just sameSiteStrict` (or Lax) on a session or token cookie.' },

package/src/language/haskell-supply.js

@@ -6,6 +6,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { analyzeHaskellManifests } from './haskell-manifests.js';
 import { buildHaskellIR } from './haskell-ir.js';
+import { getLastRefresh, refreshHackageAdvisories, liveFeedEnabled, FEED_ENV } from './haskell-advisory-feed.js';
 import { AdvisoryDb, loadAdvisorySnapshot, evaluateComponents, reachability, nearNameCandidates, sourceIntegrity, lifecycle, licensePolicy, hackagePurl, GHC_BOOT_PACKAGES } from './haskell-sca.js';
 
 const MANIFEST = /(?:^|\/)(?:[^/]+\.cabal|cabal\.project(?:\.[a-z]+)?|package\.yaml|stack\.yaml|stack\.yaml\.lock)$/;
@@ -61,7 +62,18 @@ function mergeResolved(declared, resolved) {
 }
 
 /** Advisory data configured for this scan: a hash-pinned snapshot from the environment or the project's state dir. */
+/** The live-feed sentence appended to a "no advisory data" reason: what the refresh did, or how to turn it on. */
+function liveFeedNote(env) {
+  const r = getLastRefresh();
+  if (r && r.status !== 'disabled') return ` Live feed: ${r.status}, ${r.detail}.`;
+  return env[FEED_ENV] === '1' ? '' : ` To fetch advisories from the OSV Hackage feed instead, set ${FEED_ENV}=1 (network, opt-in).`;
+}
+
 export function configuredAdvisoryDb(root, env = process.env) {
+  const c = _configuredAdvisoryDb(root, env);
+  return c.db ? c : { ...c, reason: `${c.reason}${liveFeedNote(env)}` };
+}
+function _configuredAdvisoryDb(root, env = process.env) {
   const sel = resolveOperatorSnapshot({ envVar: 'AGENTIC_SECURITY_HACKAGE_ADVISORIES', fileName: 'hackage-advisories.json', root, env });
   if (!sel.path) return { db: null, reason: `no advisory snapshot configured (set AGENTIC_SECURITY_HACKAGE_ADVISORIES, or place hackage-advisories.json in the operator configuration directory, agentic-security under XDG_CONFIG_HOME)${sel.projectLocalIgnored ? IGNORED_NOTE('hackage-advisories.json') : ''}`, projectLocalIgnored: !!sel.projectLocalIgnored };
   let snap;
@@ -70,6 +82,20 @@ export function configuredAdvisoryDb(root, env = process.env) {
   return r.ok ? { db: r.db, reason: null, source: sel.source } : { db: null, reason: `advisory snapshot refused: ${r.reason}` };
 }
 
+/**
+ * The async step before a scan's synchronous passes: when the live feed is enabled, make sure the operator snapshot covers every
+ * Hackage package this scan will evaluate (declared, frozen, transitive when a plan is present, and Haskell packages inside an imported Nix closure). Does nothing, and costs nothing
+ * (no manifest parsing), unless the feed is enabled. Never throws.
+ */
+export async function prefetchHackageFeed(files, { env = process.env, resolvedComponents = [], extraNames = [], ...opts } = {}) {
+  if (!liveFeedEnabled(env)) return null;
+  try {
+    const names = [...hackageComponents(files).components, ...resolvedComponents].map((c) => c.name).concat(extraNames);
+    if (!names.length) return null;
+    return await refreshHackageAdvisories(names, { env, ...opts });
+  } catch (e) { return { status: 'failed', detail: `the feed step failed: ${String((e && e.message) || e).slice(0, 120)}` }; }
+}
+
 /** Imports and import-qualified callees across the project's Haskell sources. */
 export function collectUsage(files) {
   const hs = {};
@@ -101,6 +127,8 @@ export function analyzeHaskellSupply(files, { db = undefined, root = null, env =
   out.feed = ev.feed;
   if (!db) out.gaps.push({ kind: 'advisory-feed-unavailable', detail: `${feedReason || ev.feed.detail}. ${components.length} Hackage dependencies were NOT checked against any advisory: the absence of findings is not a clean result.` });
   else if (ev.feed.status === 'stale-cache') out.gaps.push({ kind: 'advisory-feed-stale', detail: ev.feed.detail });
+  const notCovered = ev.statuses.filter((x) => x.status === 'feed-incomplete' || x.status === 'feed-stale');
+  if (db && notCovered.length) out.gaps.push({ kind: 'advisory-feed-incomplete', detail: `${notCovered.length} Hackage package(s) were not covered by the advisory feed (${[...new Set(notCovered.map((x) => x.name))].slice(0, 5).join(', ')}${notCovered.length > 5 ? ', ...' : ''}): their status is unknown, and the absence of findings for them is not a clean result.` });
   const unresolved = components.filter((c) => !c.version);
   if (unresolved.length) out.gaps.push({ kind: 'unresolved-dependency-versions', detail: `${unresolved.length} dependency version(s) are only declared ranges (${unresolved.slice(0, 5).map((c) => c.name).join(', ')}${unresolved.length > 5 ? ', ...' : ''}); generate a Cabal plan or a Stack export to resolve them` });
 

package/src/language/haskell-web.js

@@ -221,6 +221,32 @@ function handlerFacts(ctx, fn) {
   };
   const guardIdx = ordered.findIndex((o) => isGuardCall(o.call));
   const sensIdx = ordered.findIndex((o) => isSensitive(o.call));
+  // An INLINE guard: the handler itself reads a credential and, before any sensitive operation, rejects. Scotty's `status` only sets the
+  // code and the handler keeps running, so there a halting call (`finish`, `raise`, ...) must follow, still before the sensitive step;
+  // a WAI response, a Servant throwError or a Yesod permissionDenied ends the handler by itself.
+  // `finish` is usually a bare operand (`status status401 >> finish`, `when bad finish`), which the IR records as an identifier
+  // rather than a call, so halting points are collected from both, by source line.
+  const HALT = /^Web\.Scotty(?:\.Trans)?\.(?:finish|raise|raiseStatus|redirect)$/;
+  const haltLines = [];
+  for (const n of nodes) for (const root of exprsOfNode(n)) for (const e of walkIr(root)) {
+    if ((e.kind === 'call' ? e.callee : e.kind === 'ident' ? e.name : null) && HALT.test(e.kind === 'call' ? e.callee : e.name)) haltLines.push(Number.isFinite(e.line) ? e.line : n.line);
+  }
+  const sensLine = sensIdx >= 0 ? ordered[sensIdx].line : Infinity;
+  const haltsAfter = (line) => haltLines.some((h) => Number.isFinite(h) && h >= line && h < sensLine);
+  // The complete call list (not the node walk, which does not descend into case alternatives), ordered by source line.
+  const allCalls = callsOf(fn).filter((c) => typeof c.callee === 'string' && Number.isFinite(c.line)).sort((x, y) => x.line - y.line);
+  let inlineIdx = -1, inlineKind = null, inlineLine = null, inlineCallee = null;
+  for (let i = 0; i < allCalls.length && inlineIdx < 0; i++) {
+    const k = credentialKind(allCalls[i]);
+    if (!k) continue;
+    for (let j = i + 1; j < allCalls.length && allCalls[j].line < sensLine; j++) {
+      const r = allCalls[j];
+      if (!isRejection(r)) continue;
+      const setsStatusOnly = /^Web\.Scotty(?:\.Trans)?\.status$/.test(r.callee);
+      if (setsStatusOnly && !haltsAfter(allCalls[i].line)) continue;   // an identifier carries its enclosing node's line, so position is judged from the credential read
+      inlineIdx = j; inlineKind = k; inlineLine = r.line; inlineCallee = allCalls[i].callee; break;
+    }
+  }
   const principals = new Set();
   for (const a of assigns) if (a.source.kind === 'call' && isGuardCall(a.source)) principals.add(a.target);
   // ids read from the request
@@ -232,7 +258,7 @@ function handlerFacts(ctx, fn) {
       if (nm && /id$/i.test(nm)) idVars.add(a.target);
     }
   }
-  return { ordered, guardIdx, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
+  return { ordered, guardIdx, inlineIdx, inlineKind, inlineLine, inlineCallee, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
 }
 
 function hasOwnership(ctx, facts) {
@@ -277,6 +303,8 @@ function analyzeRoute(ctx, route, handlerFn, opts) {
       R.auth = { status: 'authenticated', kind: (sub.kinds && sub.kinds[0]) || null, evidence: [{ kind: 'handler-guard', callee: g.callee, line: facts.ordered[facts.guardIdx].line }] };
       (sub.kinds || []).forEach((k) => R.credentialKinds.add(k));
     }
+  } else if (facts.inlineIdx >= 0) {
+    R.auth = { status: 'authenticated', kind: facts.inlineKind, evidence: [{ kind: 'inline-guard', callee: facts.inlineCallee, line: facts.inlineLine }] };
   } else R.auth = { status: 'none', kind: null, evidence: [] };
   // role
   const roleCall = facts.ordered.find((o) => ROLE_CALL.test(o.call.callee || ''));

package/src/language/nix-sca.js

@@ -102,7 +102,7 @@ export class NixAdvisoryData {
 }
 
 // ── upstream identity ────────────────────────────────────────────────────────
-const HASKELL_ENV_HINTS = ['libraryHaskellDepends', 'setupHaskellDepends', 'executableHaskellDepends', 'isLibrary', 'isExecutable', 'enableSeparateDataOutput', 'compilerName', 'enableLibraryProfiling'];
+export const HASKELL_ENV_HINTS = ['libraryHaskellDepends', 'setupHaskellDepends', 'executableHaskellDepends', 'isLibrary', 'isExecutable', 'enableSeparateDataOutput', 'compilerName', 'enableLibraryProfiling'];
 function purlFromUrl(u) {
   const m = /^https?:\/\/(?:www\.)?github\.com\/([^/]+)\/([^/#?]+?)(?:\.git)?(?:\/|$)/.exec(u || '');
   if (m) return { purl: `pkg:github/${m[1].toLowerCase()}/${m[2].toLowerCase()}`, host: 'github' };
@@ -280,9 +280,14 @@ export function matchNixVulnerabilities(opts = {}) {
     if (!data) { push({ status: 'unknown', reason: 'no advisory feed was supplied: absence of a match is not a clean result' }); summary.unmapped++; continue; }
     if (ident.versionRejected && !ident.haskell && !(node.upstream && node.upstream.rev)) { push({ status: 'unknown', reason: `the version cannot be queried: ${ident.versionRejected}` }); summary.unmapped++; continue; }
 
-    let matched = false; let mapped = false;
+    let matched = false; let mapped = false; let hackageGap = null;
     // Hackage (wrapped Haskell packages): reuse the PVP matcher
-    if (ident.haskell && data.hackage && ident.version && parsePvp(ident.version)) {
+    if (ident.haskell && data.hackage && ident.version && parsePvp(ident.version) && data.hackage.coverage(node.pname) !== 'covered') {
+      // A feed that never looked up this package (or looked too long ago) says nothing about it: that is unknown, not "no advisory matches".
+      hackageGap = data.hackage.coverage(node.pname) === 'stale'
+        ? 'the Hackage advisory feed last covered this package longer ago than its age limit: the absence of a match is not a clean result'
+        : 'the Hackage advisory feed never covered this package: the absence of a match is not a clean result';
+    } else if (ident.haskell && data.hackage && ident.version && parsePvp(ident.version)) {
       mapped = true;
       for (const { adv, aff } of data.hackage.forPackage(node.pname)) {
         if (adv.withdrawn) continue;
@@ -316,6 +321,7 @@ export function matchNixVulnerabilities(opts = {}) {
       }
     }
     if (matched) summary.matched++;
+    else if (hackageGap) { summary.unmapped++; push({ status: 'unknown', reason: hackageGap }, { identityMapped: false, feedCoverage: 'incomplete' }); }
     else if (mapped) { summary.mappedNoMatch++; push({ status: 'not-affected', reason: 'mapped to an upstream identity and no advisory in the supplied feed matches this version' }, { identityMapped: true }); }
     else { summary.unmapped++; push({ status: 'unknown', reason: ident.ambiguous ? 'the upstream identity is ambiguous: no verdict' : 'the upstream identity could not be mapped to anything an advisory is keyed by' }, { identityMapped: false }); }
   }