@clear-capabilities/agentic-security-scanner 0.157.2 → 0.159.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-56d856abb0b6dc7e1c61df986d0c52e0dddf7e196617f21a370f31f32b5f2977  agentic-security.mjs
+6a0bcec455607538bd4485ce3b9cd5a266f51daf636b0ef6260cdc3bacf01776  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.157.2",
+  "version": "0.159.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -79,14 +79,15 @@
     "test:lineage": "node --test test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
     "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
-    "test:haskell": "node --test test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js",
-    "test:nix": "node --test test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js",
-    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-gap-fixes.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js test/language/language-trust-boundary.test.js",
+    "test:haskell": "node --test test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-sca-severity.test.js test/haskell/haskell-web-guards.test.js test/haskell/haskell-advisory-feed.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js test/haskell/haskell-boundaries.test.js test/haskell/haskell-live-feed-scan.test.js",
+    "test:nix": "node --test test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-sca-severity.test.js test/nix/nix-haskell-closure-names.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js test/nix/nix-fix-multifile.test.js test/nix/nixos-evaluator-forms.test.js test/nix/nix-advisory-feed.test.js",
+    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-gap-fixes.test.js test/language/language-gap-fixes-2.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js test/language/language-trust-boundary.test.js",
     "test:language-stress": "node --test --test-concurrency=1 test/language/language-stress-offline.test.js",
     "test:language-tools": "node --test test/haskell/haskell-web-auth.test.js test/haskell/haskell-support-gate.test.js",
     "bench:language-support:check": "node ../bench/language-support/check.mjs",
+    "bench:live-feed": "node ../bench/live-feed/run.mjs",
     "bench:language-support:perf": "node ../bench/language-support/perf.mjs",
-    "test:lifecycle": "node --test test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs",
+    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
@@ -186,6 +187,7 @@
     "release:check": "node ../scripts/release-check.mjs",
     "release:check:fast": "node ../scripts/release-check.mjs --fast",
     "gate:prepush": "node ../scripts/pre-push-gate.mjs",
+    "gate:trace": "node ../scripts/gate-trace-reads.mjs",
     "gate:prepush:install": "node ../scripts/pre-push-gate.mjs --install-hook",
     "bench:independent": "node ../bench/independent/runner.mjs",
     "bench:independent:fetch": "node ../bench/independent/fetch.mjs",

package/src/dataflow/engine.js

@@ -1148,6 +1148,7 @@ function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callC
           // Haskell: two sinks of the same kind on one line (`if b then f (clean x) else f x`) are distinct
           // sites; without a site key they share an id and one silently replaces the other.
           ...(/\.(?:hs|lhs)$/i.test(_currentFile || '') ? { siteKey: _siteKey(taintedArgExpr) } : {}),
+          ...(/\.(?:hs|lhs)$/i.test(_currentFile || '') && taintedArgExpr && taintedArgExpr.kind === 'call' ? { _argCallee: taintedArgExpr.callee } : {}),
           kind: 'taint',
           sinkId: e.id,
           vuln: e.vuln?.name || 'Tainted Sink',
@@ -1783,6 +1784,26 @@ function step(node, stateIn, callContext) {
 // state, never into the SummaryCache key (that stays exactly what the caller
 // supplied). Returns the ORIGINAL Set unchanged when there's nothing to add,
 // so callers that never touch annotation-shaped params pay zero extra cost.
+// Haskell: a sink whose tainted argument IS a call to another sink of the same CWE on the same line is one flaw reported twice
+// (`readCreateProcess (shell cmd)`: `shell` builds the command, `readCreateProcess` runs it). The INNER sink is kept, because it is
+// where the tainted text enters the command; the outer one is recorded on it, never dropped silently. Only a nested pair collapses:
+// two independent sinks on one line (`if b then f (clean x) else f x`) have different arguments and stay two findings, so a
+// discharged sink still cannot absorb its unprotected sibling.
+function _collapseNestedHsSinks(all) {
+  const base = (c) => String(c && typeof c === 'object' ? (c.name || c.text || '') : (c ?? '')).split('.').pop();
+  for (let i = all.length - 1; i >= 0; i--) {
+    const f = all[i];
+    if (f._argCallee === undefined || !/\.(?:hs|lhs)$/i.test(f.file || '')) continue;
+    const want = base(f._argCallee);
+    const inner = want && all.find((g) => g !== f && g.file === f.file && g.line === f.line && g.cwe === f.cwe && g.callee !== undefined && base(g.callee) === want);
+    if (!inner) continue;
+    inner.dedupedVulns = [...new Set([...(inner.dedupedVulns || []), f.vuln])];
+    inner.alsoSink = [...new Set([...(inner.alsoSink || []), base(f.callee)])];
+    all.splice(i, 1);
+  }
+  for (const f of all) if (f._argCallee !== undefined) delete f._argCallee;
+}
+
 // Short stable fingerprint of an argument expression (ignores line numbers and IR bookkeeping).
 function _siteKey(expr) {
   let h = 5381;
@@ -2575,6 +2596,7 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
     if (dg[f.severity]) f.severity = dg[f.severity];
   }
   Object.defineProperty(all, '_summaryCache', { value: summaryCache, enumerable: false });
+  _collapseNestedHsSinks(all);
   return all;
 
   // Dedup + map a raw findings array (from analyzeFunction's callContext)
@@ -2654,6 +2676,7 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
         // rebuilding the SMT path-feasibility mechanism (next-gen taint
         // capability #5) to depend on a REAL slice for a sound proof.
         ...(f.argIndex !== undefined ? { argIndex: f.argIndex } : {}),
+        ...(f._argCallee !== undefined ? { _argCallee: f._argCallee } : {}),
         // callee: kept as plain `callee` (not underscore-prefixed) to match
         // backward.js's own contract, which reads `f.callee` on both real and
         // fake-fixture findings throughout its module and test suite. It is

package/src/engine.js

@@ -8436,6 +8436,9 @@ function genHAR(routes,sources){const baseUrl="http://localhost:3000";const entr
 
 async function queryRegistries(components){
   const infoMap=new Map();
+  // Registry metadata (latest version, deprecation, age) is optional enrichment. Offline mode (--no-network, --deterministic, AGENTIC_SECURITY_OFFLINE=1)
+  // must not touch the network for it: found by the live Hackage feed bench, where an "offline" scan still fetched registry.npmjs.org/jquery.
+  if(process.env.AGENTIC_SECURITY_OFFLINE==='1')return infoMap;
   const npmNames=[...new Set(components.filter(c=>c.ecosystem==='npm').map(c=>c.name))];
   const pypiNames=[...new Set(components.filter(c=>c.ecosystem==='pypi').map(c=>c.name))];
   const CHUNK=8;
@@ -9228,6 +9231,8 @@ function _deterministicFileTimings(timings) {
   const annotatedComponents=components.map(c=>{const key=`${c.ecosystem}:${c.name}:${c.version}`;const vulns=vulnsByKey[key]||[];const riKey=c.ecosystem==='maven'&&c.group?`maven:${c.group}/${c.name}`:`${c.ecosystem}:${c.name}`;const ri=registryInfo.get(riKey)||{};const latestVersion=ri.latestVersion||'';const vd=(ri.versions||{})[c.version]||{};const isDeprecated=typeof vd.deprecated==='string'&&vd.deprecated.length>0;const deprecationMessage=isDeprecated?vd.deprecated:'';const isOutdated=!isDeprecated&&typeof vd.outdated==='string'&&vd.outdated.length>0;const outdatedMessage=isOutdated?vd.outdated:'';const license=ri.license||vd.license||'';return{...c,vulns,hasVulns:vulns.length>0,hasAttackPath:attackResult.flagged.has(key),attackPaths:attackResult.pathsByKey.get(key)||[],latestVersion,isDeprecated,deprecationMessage,isOutdated,outdatedMessage,license};});
   // X-010: Hackage and Nix components, dependency edges and target provenance. Kept beside (not inside) the ordinary
   // component list so the existing consumers are untouched; the BOM emitters and the SBOM diff read it explicitly.
+  try{if(process.env.AGENTIC_SECURITY_HACKAGE_ADVISORIES_LIVE==='1'){const{prefetchHackageFeed}=await import('./language/haskell-supply.js');const{resolvedHackageComponents,nixHaskellPackageNames}=await import('./language/resolved-pass.js');let _rc=[],_nx=[];try{_rc=resolvedHackageComponents(allFileContents).components||[];}catch(_){}try{_nx=nixHaskellPackageNames(allFileContents);}catch(_){}await prefetchHackageFeed(allFileContents,{resolvedComponents:_rc,extraNames:_nx});}}catch(_){/* the live feed is optional: a failure leaves the scan on whatever snapshot exists */}
+  try{if(process.env.AGENTIC_SECURITY_NIX_ADVISORIES_LIVE==='1'){const{prefetchNixAdvisoryFeed}=await import('./language/resolved-pass.js');await prefetchNixAdvisoryFeed(allFileContents);}}catch(_){/* the live feed is optional: a failure leaves the scan on whatever snapshot exists */}
   let _languageBom=null;try{if(Object.keys(allFileContents).some(f=>/\.(?:l?hs|nix)$|\.cabal$|(?:^|\/)(?:cabal\.project(?:\.freeze)?|package\.yaml|stack\.yaml(?:\.lock)?|flake\.lock)$/i.test(f))){const{languageBom}=await import('./language/bom.js');const{resolvedHaskellGraph,nixClosureOf}=await import('./language/resolved-pass.js');const _rg=resolvedHaskellGraph(allFileContents);const _nc=nixClosureOf(allFileContents);_languageBom=languageBom(allFileContents,{...(_rg?{resolved:_rg.graph}:{}),...(_nc&&!_nc.refused.length?{closure:_nc.closure}:{})});}}catch(_){_languageBom=null;}
   aF.push(...(runDetector(_detectorErrors,'<project>','scanDbTaintCrossFile',()=>scanDbTaintCrossFile(fc))||[]));
   aF.push(...(runDetector(_detectorErrors,'<project>','scanCsharpCrossFile',()=>scanCsharpCrossFile(fc))||[]));
@@ -11030,6 +11035,7 @@ function _deterministicFileTimings(timings) {
     if (Object.keys(allFileContents).some(f => /\.(?:l?hs|hs-boot|hsc|nix)$|\.cabal$|(?:^|\/)(?:cabal\.project|package\.yaml|stack\.yaml)/i.test(f))) {
       const { assessLanguageAssurance } = await import('./language/assurance.js');
       const { configuredAdvisoryDb } = await import('./language/haskell-supply.js');
+      const { liveFeedOptionalState } = await import('./language/haskell-advisory-feed.js');
       const env = process.env;
       const { resolvedHackageComponents, analyzeNixClosure, runSelectedNixEval } = await import('./language/resolved-pass.js');
       let _languageSupplyGaps = [];
@@ -11043,7 +11049,7 @@ function _deterministicFileTimings(timings) {
         sizeSkipped,
         supplyGaps: _languageSupplyGaps,
         licenseUnavailable: ((_languageBom && _languageBom.components) || []).filter((c) => c && !c.license && !(Array.isArray(c.licenses) && c.licenses.length)).length,
-        optional: { 'nix-eval': { selected: env.AGENTIC_SECURITY_NIX_EVAL === '1', result: _nixEvalResult }, 'cabal-plan': { selected: false }, 'hackage-live': { selected: false } },
+        optional: { 'nix-eval': { selected: env.AGENTIC_SECURITY_NIX_EVAL === '1', result: _nixEvalResult }, 'cabal-plan': { selected: false }, 'hackage-live': liveFeedOptionalState(env)},
       })).languageCoverage;
     }
   } catch (e) { _languageCoverage = { totals: null, byKind: null, conditions: [`language assurance could not be computed: ${String((e && e.message) || e)}`] }; }

package/src/language/CLAUDE.md

@@ -26,6 +26,36 @@ or a capability.** Product-facing guides: `docs/guides/haskell.md`, `docs/guides
   outside the project root is refused (`fix-lifecycle.js` `isRootRelativePath`).
 - **Secrets never leave redacted.** `secrets.js` `redactLanguageSecrets` joins split literals before masking; egress and model
   prompts use it. Credential values are never written to any output or state file.
+- **The advisory feed is opt-in and records coverage.** `haskell-advisory-feed.js` touches the network only when
+  `AGENTIC_SECURITY_HACKAGE_ADVISORIES_LIVE=1` and never under `AGENTIC_SECURITY_OFFLINE`. Its snapshot lists the packages it actually
+  queried (`covered`); a package it did not cover is `feed-incomplete` and a stale one `feed-stale`, in BOTH matchers
+  (`evaluateComponents` and `nix-sca.js`). Any new consumer of an `AdvisoryDb` must check `db.coverage(name)` before saying "no advisory".
+  The snapshot lives in the operator configuration directory, never the project (`trusted-inputs.js`).
+- **Auth guards must stop the handler.** In `haskell-web.js` a Scotty `status 40x` only sets the code, so both the named-guard path (`guardSummary`) and the inline path (`handlerFacts`) need a halting call (`finish`, `raise`, `raiseStatus`, `redirect`; `finish` is an IR identifier with no line of its own). WAI, Servant and Yesod inline guards order the credential READ against the first sensitive call, because a tail-position rejection reports the enclosing line (a disclosed gap, pinned in `test/haskell/haskell-web-guards.test.js`). A WAI `responseLBS` rejection counts only when handed back (`respond`/`return`).
+- **Severity is the advisory's own** (`cvss.js`): CVSS v3.x base score, else a named `database_specific.severity`, else `medium` with the basis stated. Never guess from an unparseable or v4 vector.
+- **Option fixes work on the effective configuration, across files.** `nix-fix.js` edits EVERY contributing definition of an option
+  (all winners at the winning priority, plus conditional branches holding the weak literal), never one line: editing one of two
+  equal-priority winners turns a finding into a module-system conflict that a rescan alone reports as "fixed". Verification is
+  the `effective` gate (`makeEffectiveCheck`: resolve the option again over the patched tree). A plan may carry `edits` (several
+  files); `runFixLifecycle` applies them through `writeManyWithBackup` (checks everything and backs up everything before the
+  first write, rolls back on a failed write) and records one history entry per file sharing `languageGroupId`; `undoFix` and
+  `posture/fix-history.js` `undoLast`/`revertEntryById` restore a group as a unit. A winner outside the root or not a single
+  literal is refused with an `override` suggestion (`overrideSuggestion`), never an automatic edit. Any new consumer of a fix
+  plan (LSP, MCP, CLI) must honour `plan.edits`: `apply_fix` writes one file, so a multi-file fix is not offered there.
+- **Boundaries are narrowed only by sound, closed rules.** `haskell-cpp.js` decides a CPP conditional only from the file, a project-stated
+  compiler (`with-compiler` pin; `tested-with` only when every item is an exact version and all agree, recorded as an assumption) or the hull
+  of cabal `build-depends` bounds; an unknown macro is undecided, never 0, and an undecided conditional keeps every branch. `haskell-boundaries.js`
+  accepts a TH declaration splice only when the generator is IMPORTED from its upstream module (not shadowed/hidden) and every token is a name
+  quote, literal, documented setting or restricted option update; a quasi-quote only when it is a raw-string or non-interpolating quoter. The
+  accepted kinds (`th-safe-splice`, `quasiquote-inert`) are disclosed, never in the adapter's opaque set, and `preprocessForSyntax` feeds the same
+  decisions to the semantic IR. Widening any allowlist needs a both-directions test in `test/haskell/haskell-boundaries.test.js`.
+- **The Nix feed is the same contract over a different source.** `nix-advisory-feed.js` uses the NVD CVE API 2.0 keyed by CPE
+  `vendor:product` (OSV has no nixpkgs ecosystem), behind `AGENTIC_SECURITY_NIX_ADVISORIES_LIVE=1`. Coverage is per CPE identity
+  (`NixAdvisoryData.cpeCoverage`), and `nix-sca.js` reports an uncovered identity, or a component with no CPE, as `unknown` with
+  `feedCoverage: 'incomplete'`, never `not-affected`. A snapshot with no `covered` table (pinned, hand-written) is matched exactly as
+  before. The prefetch (`prefetchNixAdvisoryFeed`, `resolved-pass.js`) asks only for identities `closureIdentities` says the matcher
+  will use; metadata comes only from the operator (`AGENTIC_SECURITY_NIX_META`). NVD is rate limited (5/30 s keyless): never raise
+  the request caps or lower the spacing in `nix-advisory-feed.js` without re-reading the NVD limits.
 - **Pragma** (`pragma.js`): comment-aware, line-scoped, exact rule-id match, logged. A line-less finding cannot be suppressed.
 
 ## Module map
@@ -33,13 +63,34 @@ or a capability.** Product-facing guides: `docs/guides/haskell.md`, `docs/guides
 | Group | Files |
 |---|---|
 | Shared | `discovery.js` (sources, manifests, explicit exports, exclusions, import graph, invalidation digests), `contracts.js`, `assurance.js` (scan-health inputs, conditions, limitations), `engine-pass.js` (language supply chain wired into the engine), `resolved-pass.js` (plan / Stack export / Nix closure / opt-in evaluation reachable from the CLI), `context.js` (project context for partial scans, fix previews and dependency upgrades, model prompt extras), `state-artifacts.js`, `pragma.js`, `secrets.js`, `bom.js`, `bom-validate.js`, `aibom.js`, `compliance-map.js`, `bridges.js`, `witness.js`, `fix-lifecycle.js` (the one fix lifecycle: path, syntax, rescan, compile, backup, history, undo) |
-| Haskell | `haskell-parser.js`, `haskell-grammar.js`, `haskell-adapter.js`, `haskell-ir.js`, `haskell-models.js` (the single registry of sources, sinks, sanitizers; `dataflow/catalog-haskell.js` is generated from it), `haskell-guards.js`, `haskell-security-rules.js`, `haskell-web.js`, `haskell-findings.js`, `haskell-syntax.js`, `haskell-sweep.js`, `haskell-disclosure.js`, `haskell-llm.js`, `haskell-manifests.js`, `haskell-resolved-graph.js`, `haskell-sca.js`, `haskell-supply.js`, `haskell-fix.js` |
+| Haskell | `haskell-parser.js`, `haskell-grammar.js`, `haskell-adapter.js`, `haskell-ir.js`, `haskell-models.js` (the single registry of sources, sinks, sanitizers; `dataflow/catalog-haskell.js` is generated from it), `haskell-guards.js`, `haskell-security-rules.js`, `haskell-web.js`, `haskell-findings.js`, `haskell-syntax.js`, `haskell-sweep.js`, `haskell-disclosure.js`, `haskell-llm.js`, `haskell-manifests.js`, `haskell-resolved-graph.js`, `haskell-sca.js`, `cvss.js` (CVSS v3.x base-score calculator and advisory-severity selection, shared by the Haskell and Nix matchers; v4 is not scored and says so), `haskell-advisory-feed.js` (the opt-in live Hackage feed: OSV fetch, per-package coverage, operator-only snapshot), `haskell-supply.js`, `haskell-fix.js` |
+| Haskell | `haskell-parser.js`, `haskell-cpp.js` (three-valued CPP conditional evaluation + project context from cabal), `haskell-boundaries.js` (closed set of safe TH declaration splices and inert quasi-quotes), `haskell-grammar.js`, `haskell-adapter.js`, `haskell-ir.js`, `haskell-models.js` (the single registry of sources, sinks, sanitizers; `dataflow/catalog-haskell.js` is generated from it), `haskell-guards.js`, `haskell-security-rules.js`, `haskell-web.js`, `haskell-findings.js`, `haskell-syntax.js`, `haskell-sweep.js`, `haskell-disclosure.js`, `haskell-llm.js`, `haskell-manifests.js`, `haskell-resolved-graph.js`, `haskell-sca.js`, `haskell-advisory-feed.js` (the opt-in live Hackage feed: OSV fetch, per-package coverage, operator-only snapshot), `haskell-supply.js`, `haskell-fix.js` |
 | Nix | `nix-parser.js`, `nix-grammar.js`, `nix-ir.js`, `nix-adapter.js`, `nixos-module-resolver.js`, `nixos-option-catalog.js`, `nixos-hardening.js`, `nix-build-trust.js`, `nix-secrets.js`, `nix-script-taint.js`, `nix-privacy.js`, `nix-agents.js`, `nix-inventory.js`, `nix-closure.js`, `nix-sca.js`, `nix-eval-isolation.js`, `nix-fix.js` |
+| Haskell | `haskell-parser.js`, `haskell-grammar.js`, `haskell-adapter.js`, `haskell-ir.js`, `haskell-models.js` (the single registry of sources, sinks, sanitizers; `dataflow/catalog-haskell.js` is generated from it), `haskell-guards.js`, `haskell-security-rules.js`, `haskell-web.js`, `haskell-findings.js`, `haskell-syntax.js`, `haskell-sweep.js`, `haskell-disclosure.js`, `haskell-llm.js`, `haskell-manifests.js`, `haskell-resolved-graph.js`, `haskell-sca.js`, `haskell-advisory-feed.js` (the opt-in live Hackage feed: OSV fetch, per-package coverage, operator-only snapshot), `haskell-supply.js`, `haskell-fix.js` |
+| Nix | `nix-parser.js`, `nix-grammar.js`, `nix-ir.js`, `nix-adapter.js`, `nixos-module-resolver.js`, `nixos-eval-forms.js`, `nixos-option-catalog.js`, `nixos-hardening.js`, `nix-build-trust.js`, `nix-secrets.js`, `nix-script-taint.js`, `nix-privacy.js`, `nix-agents.js`, `nix-inventory.js`, `nix-closure.js`, `nix-sca.js`, `nix-eval-isolation.js`, `nix-fix.js` |
+| Haskell | `haskell-parser.js`, `haskell-grammar.js`, `haskell-adapter.js`, `haskell-ir.js`, `haskell-models.js` (the single registry of sources, sinks, sanitizers; `dataflow/catalog-haskell.js` is generated from it), `haskell-guards.js`, `haskell-security-rules.js`, `haskell-web.js`, `haskell-findings.js`, `haskell-syntax.js`, `haskell-sweep.js`, `haskell-disclosure.js`, `haskell-llm.js`, `haskell-manifests.js`, `haskell-resolved-graph.js`, `haskell-sca.js`, `haskell-advisory-feed.js` (the opt-in live Hackage feed: OSV fetch, per-package coverage, operator-only snapshot), `haskell-supply.js`, `haskell-fix.js` |
+| Nix | `nix-parser.js`, `nix-grammar.js`, `nix-ir.js`, `nix-adapter.js`, `nixos-module-resolver.js`, `nixos-option-catalog.js`, `nixos-hardening.js`, `nix-build-trust.js`, `nix-secrets.js`, `nix-script-taint.js`, `nix-privacy.js`, `nix-agents.js`, `nix-inventory.js`, `nix-closure.js`, `nix-sca.js`, `nix-advisory-feed.js`, `nix-eval-isolation.js`, `nix-fix.js` |
 | Measurement | `accuracy.js` (family-scoped scoring, per-layer), `support-registry.js` (status rules, promotion refusals, frozen-hash demotion) |
 
 Related, outside this directory: `dataflow/catalog-haskell.js`, `lineage/haskell-view.js`, `lineage/nix-view.js`,
 `ir/` Haskell/Nix adapters, `report/` format handling, `egress/redact.js`, `llm-validator/`, `discovery/` (hunt partitions Nix).
 
+## NixOS option evaluator (soundness rules)
+
+`nixos-module-resolver.js` `evalExpr` is a soundness-first subset; `nixos-eval-forms.js` holds its value classes and the
+**allow-list** of library functions (there is no deny-list to forget an entry in). Rules to keep when extending it:
+
+- **Any unknown part makes the whole value unknown.** Never default, never pick a branch you cannot decide.
+- **Scope is a correctness issue.** Lexical bindings (let, lambda) beat every `with`; innermost `with` beats outer; the module's
+  own `let`s are IR bindings (`ir.bindings`, `scope: 'let'`) and are used only when unique in the file, not also a function
+  parameter, not in a `rec` set, and when their `letSpan` encloses `env.pos` (the absolute span of the text being evaluated).
+  `evalSpan` on a definition (set by `nix-ir.js` when a leaf sits under let/with/assert only) makes the resolver evaluate the
+  whole wrapper. A priority/condition/merge combinator clears it, because those are the collector's job.
+- **Final values must be plain data** (`sealed`/`isPlain`): a closure, partial application or namespace is `unknown`. A
+  priority wrapper inside a value is unknown (priority is not recoverable); at the top of a definition the collector reads it.
+- **Bounded**: `maxEvaluations`, `maxExprDepth`, `maxValueSize` are caps that surface as `truncated`, not as a guess.
+- Assumption stated, not proven: `lib` is nixpkgs' `lib` whenever the module declares a `lib` parameter and the file does not rebind it.
+
 ## Tests and benches
 
 | Scope | Command | Notes |
@@ -50,6 +101,7 @@ Related, outside this directory: `dataflow/catalog-haskell.js`, `lineage/haskell
 | Stress | `npm run test:language-stress` | offline scale and a peak-memory ceiling; excluded from `npm test` (it must own the machine) |
 | Needs a compiler | `npm run test:language-tools` | HS-006.AC01 and the support gate; excluded from `npm test`; **fails** without `ghc` |
 | Support registry | `npm run bench:language-support:check` | recomputes the registry from the STORED measurement; fails on any difference |
+| Live feed | `npm run bench:live-feed -- <fetch\|plan\|scan\|merge\|sample\|report>` | `bench/live-feed/`: the opt-in Hackage feed against real projects and real OSV. Needs the network and is NOT in `npm test` or any gate. `RESULTS.md` is a dated measurement; labels in it are model-assessed |
 
 The support registry is measured **once per promotion** on a frozen holdout (`bench/language-support/promote.mjs`); never tune
 against the holdout, and any further holdout run counts as repeated use. A change to the engine, the corpus or a label changes the

package/src/language/assurance.js

@@ -19,6 +19,7 @@
 
 import { runLanguageAnalysis, reconcileLanguageLedger, languageHealth } from './contracts.js';
 import { createHaskellAdapter } from './haskell-adapter.js';
+import { deriveCppContext } from './haskell-cpp.js';
 import { createNixAdapter } from './nix-adapter.js';
 import { analyzeHaskellManifests } from './haskell-manifests.js';
 import { packageOfModule } from './haskell-models.js';
@@ -71,14 +72,21 @@ export async function assessLanguageAssurance(input = {}) {
   // 1. parse adapters over every language source
   // Boundaries that do not make a file unresolved but that a reader must be told about: CPP (every branch was parsed, the
   // chosen one is not known) and FFI (the foreign code is not analysed).
+  const DISCLOSED_KINDS = new Set(['cpp', 'ffi', 'th-safe-splice', 'quasiquote-inert']);
   const disclosed = new Map();   // boundary kind -> {count, files:Set}
   const projectModules = new Set(); const importedModules = new Map();   // module -> files
   const onParse = (file, parse) => {
     if (parse && parse.module && parse.module.name) projectModules.add(parse.module.name);
     for (const i of (parse && parse.imports) || []) if (i && i.module) { const e = importedModules.get(i.module) || new Set(); e.add(file); importedModules.set(i.module, e); }
-    for (const b of (parse && parse.boundaries) || []) if (b.kind === 'cpp' || b.kind === 'ffi') { const e = disclosed.get(b.kind) || { count: 0, files: new Set() }; e.count += b.count || 1; e.files.add(file); disclosed.set(b.kind, e); }
+    for (const b of (parse && parse.boundaries) || []) {
+      if (!DISCLOSED_KINDS.has(b.kind)) continue;
+      const e = disclosed.get(b.kind) || { count: 0, files: new Set(), decided: 0, undecided: 0, assumptions: new Set() };
+      e.count += b.count || 1; e.files.add(file);
+      if (b.kind === 'cpp') { e.decided += b.decided || 0; e.undecided += b.undecided || 0; for (const a of b.assumptions || []) e.assumptions.add(a); }
+      disclosed.set(b.kind, e);
+    }
   };
-  const adapters = input.adapters || [createHaskellAdapter({ onParse }), createNixAdapter()];
+  const adapters = input.adapters || [createHaskellAdapter({ onParse, cpp: deriveCppContext(files) }), createNixAdapter()];
   const run = await runLanguageAnalysis({ files, adapters, timeoutMs: input.timeoutMs || 0 });
   const reconcile = reconcileLanguageLedger(run.ledger, files);
   const base = languageHealth({ ledger: run.ledger, outcomes: run.outcomes });
@@ -97,8 +105,17 @@ export async function assessLanguageAssurance(input = {}) {
     for (const o of opaque) { const k = String(o.detail).replace(/^opaque-boundary:\s*/, ''); kinds[k] = (kinds[k] || 0) + 1; }
     for (const [k, n] of Object.entries(kinds).sort()) limitations.push({ kind: 'opaque-boundary', boundary: k, count: n, note: 'a documented limit of static analysis: this code is not analysed, and is not reported clean' });
   }
-  const DISCLOSED_NOTE = { cpp: 'preprocessor conditionals: every branch was parsed, but which branch is compiled is not known', ffi: 'foreign declarations: the foreign code is not analysed and its effects are not modelled' };
-  for (const [k, e] of [...disclosed.entries()].sort()) limitations.push({ kind: 'opaque-boundary', boundary: k, count: e.count, files: [...e.files].sort().slice(0, 20), note: `a documented limit of static analysis (${DISCLOSED_NOTE[k]})` });
+  const DISCLOSED_NOTE = {
+    cpp: 'preprocessor conditionals: a conditional the file or the project decides keeps only its live branch, every other one keeps all of its branches, and which branch is compiled is then not known',
+    ffi: 'foreign declarations: the foreign code is not analysed and its effects are not modelled',
+    'th-safe-splice': 'declaration-level Template Haskell splices of a known generator applied to names and literals only: assumed to be the upstream generator, nothing is run and the generated declarations are not modelled',
+    'quasiquote-inert': 'quasi-quotes of a known raw-string or non-interpolating quoter: read as a string literal on the assumption that the quoter is the upstream one',
+  };
+  for (const [k, e] of [...disclosed.entries()].sort()) {
+    const extra = k === 'cpp' ? { decidedConditionals: e.decided, undecidedConditionals: e.undecided, ...(e.assumptions.size ? { assumptions: [...e.assumptions].sort() } : {}) } : {};
+    const assumed = k === 'cpp' && e.assumptions.size ? `; some conditionals were decided on a stated project assumption (${[...e.assumptions].sort().join(', ')}), so a branch dead under it was not analysed` : '';
+    limitations.push({ kind: 'opaque-boundary', boundary: k, count: e.count, files: [...e.files].sort().slice(0, 20), ...extra, note: `a documented limit of static analysis (${DISCLOSED_NOTE[k]}${assumed})` });
+  }
   // Imported modules this scan has no model for: their functions are ordinary, opaque calls (never a source, sink or
   // sanitizer), so a taint flow through them is widened and disclosed on the finding. Listed so a reader knows how much of the
   // import surface the models cover. A limitation, not a condition: most real projects import unmodelled modules.

package/src/language/context.js

@@ -98,6 +98,8 @@ export async function languageFixPreview(finding, files, { apply = false, root =
     status: res.status, applied: res.applied === true, backup: res.backup || null,
     label: plan.label || null, tier: res.tier || plan.tier || null,
     file: plan.file, before: plan.before, after: plan.after,
+    // A fix that spans several files lists every one of them; `file`/`before`/`after` stay the first for single-file callers.
+    edits: Array.isArray(plan.edits) && plan.edits.length > 1 ? plan.edits.map((e) => ({ file: e.file, before: e.before, after: e.after })) : null,
     diff: res.preview || hsDiff(plan.file, plan.before, plan.after),
     gates: res.gates || null, reason: (res.status === 'verified' || res.status === 'applied') ? null : (res.reason || null),
     explanation: plan.explanation || null, consequences: res.consequences || plan.consequences || [],

package/src/language/cvss.js

@@ -0,0 +1,91 @@
+// CVSS v3.x base-score calculator and advisory-severity selection for the Haskell and Nix SCA matchers.
+// Pure: no I/O. Never invents a rating: a vector that cannot be parsed, or a CVSS version this module does not compute
+// (v4 needs lookup tables that are not shipped), yields no score and says why.
+
+const W = {
+  AV: { N: 0.85, A: 0.62, L: 0.55, P: 0.2 },
+  AC: { L: 0.77, H: 0.44 },
+  UI: { N: 0.85, R: 0.62 },
+  CIA: { H: 0.56, L: 0.22, N: 0 },
+};
+const PR = { U: { N: 0.85, L: 0.62, H: 0.27 }, C: { N: 0.85, L: 0.68, H: 0.5 } };
+const REQUIRED = ['AV', 'AC', 'PR', 'UI', 'S', 'C', 'I', 'A'];
+
+// CVSS 3.1 Roundup (spec appendix A, integer arithmetic so float error cannot move a score across a boundary).
+function roundUp31(x) {
+  const i = Math.round(x * 100000);
+  return i % 10000 === 0 ? i / 100000 : (Math.floor(i / 10000) + 1) / 10;
+}
+const roundUp30 = (x) => Math.ceil(x * 10) / 10;
+
+/** @returns {{ok:true, version:string, score:number, vector:string}|{ok:false, reason:string}} */
+export function cvssV3BaseScore(vector) {
+  if (typeof vector !== 'string') return { ok: false, reason: 'the CVSS vector is not a string' };
+  const parts = vector.trim().split('/');
+  const m = /^CVSS:(3\.[01])$/.exec(parts[0] || '');
+  if (!m) return { ok: false, reason: /^CVSS:4/.test(parts[0] || '') ? 'CVSS v4 vectors are not scored by this tool' : 'the vector is not a CVSS v3.0/v3.1 vector' };
+  const version = m[1];
+  const metrics = {};
+  for (const p of parts.slice(1)) {
+    const kv = /^([A-Za-z]+):([A-Za-z])$/.exec(p);
+    if (!kv || kv[1] in metrics) return { ok: false, reason: `malformed or repeated metric "${p}"` };
+    metrics[kv[1]] = kv[2];
+  }
+  for (const k of REQUIRED) if (!(k in metrics)) return { ok: false, reason: `missing base metric ${k}` };
+  if (metrics.S !== 'C' && metrics.S !== 'U') return { ok: false, reason: `invalid scope value "${metrics.S}"` };
+  const changed = metrics.S === 'C';
+  const av = W.AV[metrics.AV], ac = W.AC[metrics.AC], ui = W.UI[metrics.UI];
+  const c = W.CIA[metrics.C], i = W.CIA[metrics.I], a = W.CIA[metrics.A];
+  const pr = PR[metrics.S][metrics.PR];
+  if ([av, ac, ui, c, i, a, pr].some((x) => x === undefined)) return { ok: false, reason: 'an unknown value in a base metric' };
+  const iss = 1 - (1 - c) * (1 - i) * (1 - a);
+  const impact = changed ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
+  const expl = 8.22 * av * ac * pr * ui;
+  const up = version === '3.1' ? roundUp31 : roundUp30;
+  const score = impact <= 0 ? 0 : changed ? up(Math.min(1.08 * (impact + expl), 10)) : up(Math.min(impact + expl, 10));
+  return { ok: true, version, score, vector: vector.trim() };
+}
+
+export function levelFromScore(score) {
+  if (!(score > 0)) return null;
+  return score >= 9 ? 'critical' : score >= 7 ? 'high' : score >= 4 ? 'medium' : 'low';
+}
+
+const NAMED = { critical: 'critical', high: 'high', moderate: 'medium', medium: 'medium', low: 'low' };
+export const normalizeSeverityName = (s) => (typeof s === 'string' ? NAMED[s.trim().toLowerCase()] || null : null);
+
+export const NO_RATING_BASIS = 'the advisory carries no severity rating';
+
+/**
+ * Pick the advisory's own severity from an OSV record: CVSS vectors at record level and on each affected entry, then
+ * database_specific.severity (record, then affected). The highest parseable CVSS score wins; a named severity is used
+ * only when no vector could be scored. Returns {level:null, basis} when nothing usable exists.
+ */
+export function advisorySeverity(rec) {
+  const vectors = [];
+  const named = [];
+  const take = (sevArr, dbs) => {
+    for (const s of Array.isArray(sevArr) ? sevArr : []) if (s && typeof s.score === 'string') vectors.push(s.score);
+    if (dbs && typeof dbs.severity === 'string') named.push(dbs.severity);
+  };
+  if (rec && typeof rec === 'object') {
+    take(rec.severity, rec.database_specific);
+    for (const a of Array.isArray(rec.affected) ? rec.affected : []) if (a && typeof a === 'object') take(a.severity, a.database_specific);
+  }
+  let best = null; const why = [];
+  for (const v of vectors) {
+    const r = cvssV3BaseScore(v);
+    if (r.ok) { if (!best || r.score > best.score) best = r; } else why.push(r.reason);
+  }
+  if (best) {
+    const level = levelFromScore(best.score);
+    if (level) return { level, score: best.score, vector: best.vector, basis: `CVSS v${best.version} base score ${best.score.toFixed(1)} from the advisory` };
+    why.push('the CVSS base score is 0.0 (no impact)');
+  }
+  for (const n of named) {
+    const level = normalizeSeverityName(n);
+    if (level) return { level, score: null, vector: null, basis: `severity "${n}" stated by the advisory (database_specific)` };
+    why.push(`unrecognised severity "${String(n).slice(0, 40)}"`);
+  }
+  return { level: null, score: null, vector: null, basis: why.length ? `${NO_RATING_BASIS} that could be used (${[...new Set(why)].join('; ')})` : NO_RATING_BASIS };
+}

package/src/language/fix-lifecycle.js

@@ -10,8 +10,9 @@
 // Preview never writes. Apply writes a backup first and refuses a file that changed since planning.
 // Undo restores the backup byte for byte.
 
-import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
 import { statePath } from '../posture/state-dir.js';
 import { maybeEncryptForWrite, maybeDecryptForRead } from '../posture/encryption-provider.js';
 import { recordExternalFix, markRevertedByBackup } from '../posture/fix-history.js';
@@ -30,31 +31,102 @@ export function unifiedDiff(file, a, b) {
 }
 const safeRel = (root, rel) => { const p = join(root, rel); if (!p.startsWith(join(root) + '/')) throw new Error(`path escapes the root: ${rel}`); return p; };
 
-export function writeWithBackup(root, rel, before, after) {
+/** Save the pre-image of `rel` (customer source: it follows the encryption policy) and return its backup. Writes nothing to the target. */
+function saveBackup(root, rel, before, after) {
   const target = safeRel(root, rel);
-  const id = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  const id = `${Date.now().toString(36)}-${randomBytes(5).toString('hex')}`;
   const dir = statePath(root, 'fix-backups', id);
   const disk = existsSync(target) ? readFileSync(target, 'utf8') : null;
   if (disk !== before) throw new Error('the file changed on disk since the fix was planned; refusing to overwrite');
-  // The pre-image is customer source: it follows the project's encryption policy for confidential state, and a policy
-  // that REQUIRES encryption with no working provider refuses the fix before anything is written.
+  // A policy that REQUIRES encryption with no working provider refuses the fix before anything is written.
   const enc = maybeEncryptForWrite(root, 'fix-backups', before);
   if (!enc.ok) throw new Error(enc.reason);
   mkdirSync(dir, { recursive: true });
   writeFileSync(join(dir, 'original'), enc.content);
   writeFileSync(join(dir, 'meta.json'), JSON.stringify({ file: rel, appliedAt: new Date().toISOString(), sizeBefore: before.length, sizeAfter: after.length }));
+  return { id, dir, target };
+}
+
+export function writeWithBackup(root, rel, before, after) {
+  const { id, dir, target } = saveBackup(root, rel, before, after);
   writeFileSync(target, after);
   return { id, dir };
 }
 
-export function undoFix(root, backupId) {
-  const _afterUndo = () => { try { markRevertedByBackup(root, backupId); } catch { /* history is best effort */ } };
+/**
+ * Apply several file edits as ONE unit. Nothing is written until every file has been checked (inside the root, unchanged
+ * since planning) and every pre-image is backed up. If a write then fails, every file already written (and the one that
+ * failed, which may be truncated) is put back, and the error says whether that rollback was complete.
+ * @param {string} root
+ * @param {Array<{file:string,before:string,after:string}>} edits
+ * @param {{writeFile?:Function}} [hooks]  test seam for the file writer
+ * @returns {{id:string, dir:string, members:Array<{id:string,dir:string,file:string}>}}
+ */
+export function writeManyWithBackup(root, edits, hooks = {}) {
+  const write = hooks.writeFile || writeFileSync;
+  const seen = new Set();
+  for (const e of edits) { if (seen.has(e.file)) throw new Error(`the same file is edited twice in one fix: ${e.file}`); seen.add(e.file); safeRel(root, e.file); }
+  const members = [];
+  const cleanup = () => { for (const m of members) { try { rmSync(m.dir, { recursive: true, force: true }); } catch { /* best effort */ } } };
+  try { for (const e of edits) { const b = saveBackup(root, e.file, e.before, e.after); members.push({ id: b.id, dir: b.dir, file: e.file, target: b.target, before: e.before, after: e.after }); } }
+  catch (err) { cleanup(); throw new Error(`${err.message} (no file was written)`); }
+  const written = [];
+  for (const m of members) {
+    written.push(m);
+    try { write(m.target, m.after); } catch (err) {
+      const failed = [];
+      for (const w of written.slice().reverse()) { try { write(w.target, w.before); } catch { failed.push(w.file); } }
+      if (!failed.length) cleanup();
+      const e = new Error(failed.length
+        ? `write to ${m.file} failed (${err.message}); ROLLBACK INCOMPLETE, restore these from the backups under .agentic-security/fix-backups: ${failed.join(', ')}`
+        : `write to ${m.file} failed (${err.message}); every file in this fix was restored to its original content`);
+      e.rolledBack = failed.length === 0; e.rollbackFailed = failed; e.failedFile = m.file;
+      throw e;
+    }
+  }
+  const groupId = `g${Date.now().toString(36)}-${randomBytes(5).toString('hex')}`;
+  const dir = statePath(root, 'fix-backups', groupId);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, 'meta.json'), JSON.stringify({ file: members[0].file, group: members.map((m) => ({ id: m.id, file: m.file })), appliedAt: new Date().toISOString() }));
+  return { id: groupId, dir, members: members.map((m) => ({ id: m.id, dir: m.dir, file: m.file })) };
+}
+
+/**
+ * Undo a fix. A multi-file fix is restored as a unit: every pre-image is read and every target resolved before the first
+ * write, and if a restore fails the files already restored are put back to the content they had, so a partial undo is
+ * never left behind.
+ */
+export function undoFix(root, backupId, hooks = {}) {
+  const write = hooks.writeFile || writeFileSync;
   const dir = statePath(root, 'fix-backups', backupId);
   const meta = JSON.parse(readFileSync(join(dir, 'meta.json'), 'utf8'));
-  const target = safeRel(root, meta.file);
-  writeFileSync(target, maybeDecryptForRead(readFileSync(join(dir, 'original'), 'utf8')));
-  _afterUndo();
-  return { ok: true, file: meta.file };
+  if (!Array.isArray(meta.group)) {
+    const target = safeRel(root, meta.file);
+    writeFileSync(target, maybeDecryptForRead(readFileSync(join(dir, 'original'), 'utf8')));
+    try { markRevertedByBackup(root, backupId); } catch { /* history is best effort */ }
+    return { ok: true, file: meta.file, files: [meta.file] };
+  }
+  const items = meta.group.map((m) => {
+    const mdir = statePath(root, 'fix-backups', m.id);
+    const md = JSON.parse(readFileSync(join(mdir, 'meta.json'), 'utf8'));
+    return { file: md.file, target: safeRel(root, md.file), original: maybeDecryptForRead(readFileSync(join(mdir, 'original'), 'utf8')), id: m.id };
+  });
+  const current = items.map((it) => (existsSync(it.target) ? readFileSync(it.target, 'utf8') : null));
+  const touched = [];
+  for (let i = 0; i < items.length; i++) {
+    touched.push(i);
+    try { write(items[i].target, items[i].original); } catch (err) {
+      const failed = [];
+      for (const j of touched.slice().reverse()) { try { if (current[j] !== null) write(items[j].target, current[j]); } catch { failed.push(items[j].file); } }
+      const e = new Error(failed.length
+        ? `undo failed at ${items[i].file} (${err.message}); ROLLBACK INCOMPLETE for: ${failed.join(', ')}`
+        : `undo failed at ${items[i].file} (${err.message}); no file was changed`);
+      e.rolledBack = failed.length === 0; e.rollbackFailed = failed;
+      throw e;
+    }
+  }
+  for (const id of [backupId, ...items.map((it) => it.id)]) { try { markRevertedByBackup(root, id); } catch { /* history is best effort */ } }
+  return { ok: true, file: items[0].file, files: items.map((it) => it.file) };
 }
 
 /**
@@ -75,10 +147,14 @@ export async function runFixLifecycle(o) {
   const { plan, files, finding } = o;
   const gates = {};
   // A patch may only touch a file inside the project: a target that escapes the root is refused before anything else runs.
-  gates.path = { ok: isRootRelativePath(plan.file), detail: plan.file };
-  if (!gates.path.ok) return { status: 'blocked', applied: false, reason: `path-escape: ${String(plan.file).slice(0, 120)} is outside the project root`, plan, gates, label: plan.label };
+  // A plan may carry `edits` (several files, one logical fix); a plan without them is the single edit of `plan.file`.
+  const edits = Array.isArray(plan.edits) && plan.edits.length ? plan.edits : [{ file: plan.file, before: plan.before, after: plan.after }];
+  const escaping = edits.filter((e) => !isRootRelativePath(e.file));
+  gates.path = { ok: escaping.length === 0, detail: edits.map((e) => e.file).join(', ') };
+  if (!gates.path.ok) return { status: 'blocked', applied: false, reason: `path-escape: ${escaping.map((e) => String(e.file).slice(0, 120)).join(', ')} is outside the project root`, plan, gates, label: plan.label };
   gates.syntax = o.syntax(plan);
-  const patched = { ...files, [plan.file]: plan.after };
+  const patched = { ...files };
+  for (const e of edits) patched[e.file] = e.after;
   const blocked = (why) => ({ status: 'blocked', applied: false, reason: why, plan, gates, label: plan.label });
   if (!gates.syntax.ok) return blocked(`syntax: ${gates.syntax.detail}`);
   if (o.behaviorCheck) { gates.behavior = o.behaviorCheck(plan); if (gates.behavior && gates.behavior.ok === false) return blocked(`behavior: ${gates.behavior.detail || 'unrelated behavior change'}`); }
@@ -94,6 +170,12 @@ export async function runFixLifecycle(o) {
   gates.rescan = { ok: gone && added.length === 0, originalGone: gone, newMediumOrHigher: [...new Set(added.map((f) => `${f.cwe || f.vuln}@${f.file}:${f.line}`))] };
   if (!gone) return blocked('the original finding is still reported after the patch');
   if (added.length) return blocked(`the patch introduces ${added.length} new medium-or-higher finding(s)`);
+  // Optional effective-configuration gate: the rescan above only proves a finding stopped being REPORTED, which a patch that
+  // turns the option into a module-system conflict also achieves. The check says whether the option now HAS the intended value.
+  if (o.effectiveCheck) {
+    gates.effective = o.effectiveCheck(plan, patched, files) || { ok: false, detail: 'no effective-configuration result' };
+    if (gates.effective.ok === false) return blocked(`effective: ${gates.effective.detail}`);
+  }
   // Optional controlled-witness gate (X-009): the hook returns judgeFixWitness(before, after). A patch that STILL
   // reproduces the effect is blocked; a witness that could not be judged (unsupported, invalid, unavailable) verifies
   // nothing and, unless `requireWitness` is set, does not block (it is recorded as not-verified).
@@ -106,15 +188,26 @@ export async function runFixLifecycle(o) {
   if (gates.compile.ran && !gates.compile.ok) return blocked(`compile: ${gates.compile.detail}`);
   if (o.requireCompile && !gates.compile.ran) return blocked(`compile verification required but ${gates.compile.detail}`);
   const verified = { syntax: true, rescan: true, compile: gates.compile.ran ? 'passed' : 'not-run', witness: gates.witness ? (gates.witness.verified ? 'passed' : 'not-verified') : 'not-run' };
-  const res = { status: 'verified', applied: false, plan, gates, label: plan.label, verified, preview: unifiedDiff(plan.file, plan.before, plan.after) };
+  const res = { status: 'verified', applied: false, plan, gates, label: plan.label, verified, preview: edits.map((e) => unifiedDiff(e.file, e.before, e.after)).join('\n'), files: edits.map((e) => e.file) };
   if (o.apply) {
     if (!o.root) return blocked('apply requires a root directory');
-    res.backup = writeWithBackup(o.root, plan.file, plan.before, plan.after);
-    res.applied = true; res.status = 'applied';
-    // One ledger: the same fix-history `agentic-security undo` reads, with the tier and the gates that passed.
-    try {
-      res.history = await recordExternalFix({ scanRoot: o.root, file: plan.file, originalContent: plan.before, newContent: plan.after, findingId: finding.id || `${finding.file}:${finding.line}`, ruleId: finding.rule || null, vuln: finding.vuln || null, stableId: finding.stableId || null, fixLabel: plan.label || null, verification: verified, backup: res.backup, findingProvenance: finding.findingProvenance || null });
-    } catch { res.history = null; }
+    const base = { scanRoot: o.root, findingId: finding.id || `${finding.file}:${finding.line}`, ruleId: finding.rule || null, vuln: finding.vuln || null, stableId: finding.stableId || null, fixLabel: plan.label || null, verification: verified, findingProvenance: finding.findingProvenance || null };
+    if (edits.length === 1) {
+      res.backup = writeWithBackup(o.root, plan.file, plan.before, plan.after);
+      res.applied = true; res.status = 'applied';
+      // One ledger: the same fix-history `agentic-security undo` reads, with the tier and the gates that passed.
+      try { res.history = await recordExternalFix({ ...base, file: plan.file, originalContent: plan.before, newContent: plan.after, backup: res.backup }); } catch { res.history = null; }
+    } else {
+      try { res.backup = writeManyWithBackup(o.root, edits, { writeFile: o.writeFile }); } catch (err) {
+        return { ...blocked(`apply failed, nothing was left changed: ${err.message}`), rolledBack: err.rolledBack !== false, rollbackFailed: err.rollbackFailed || [] };
+      }
+      res.applied = true; res.status = 'applied';
+      // One ledger entry per touched file, all carrying the group id so `undo` reverts them together.
+      res.history = [];
+      for (let i = 0; i < edits.length; i++) {
+        try { res.history.push(await recordExternalFix({ ...base, file: edits[i].file, originalContent: edits[i].before, newContent: edits[i].after, backup: res.backup.members[i], languageGroupId: res.backup.id })); } catch { res.history.push(null); }
+      }
+    }
   }
   return res;
 }