@clear-capabilities/agentic-security-scanner 0.157.2 → 0.159.0

package/src/language/haskell-parser.js

@@ -25,6 +25,8 @@
 // named and no partial analysis, and never throws into the caller.
 
 import { loadHaskellGrammar } from './haskell-grammar.js';
+import { evaluateCppLines } from './haskell-cpp.js';
+import { classifySafeSplice, classifyInertQuasiQuote } from './haskell-boundaries.js';
 
 export const DEFAULT_PARSE_BUDGETS = Object.freeze({
   maxBytes: 4 * 1024 * 1024,
@@ -36,6 +38,10 @@ export const DEFAULT_PARSE_BUDGETS = Object.freeze({
   maxErrors: 200,
 });
 
+// Boundaries that are disclosed but do not make a file incomplete: the content was either parsed (cpp, ffi) or matched
+// by a closed, sound pattern and stated as an assumption (see haskell-boundaries.js).
+export const NON_OPAQUE_BOUNDARIES = new Set(['cpp', 'ffi', 'th-safe-splice', 'quasiquote-inert']);
+
 class BudgetError extends Error {
   constructor(budget, limit) {
     super(`parser budget "${budget}" exceeded (limit ${limit})`);
@@ -157,48 +163,55 @@ function unwrapLiterate(source) {
   return { code: out, style: latex ? 'latex' : 'bird' };
 }
 
-function stripDirectives(code, dialect, grammar, loc) {
+function stripDirectives(code, dialect, grammar, loc, cppCtx) {
   const cppNames = new Set(grammar.cppDirectives);
   const lines = code.split('\n');
   const directives = [];
-  const depthAtLine = new Int32Array(lines.length + 2);
-  let depth = 0;
-  let off = 0;
+  // Physical line offsets into the ORIGINAL text, so directive spans stay exact.
+  const starts = new Array(lines.length);
+  { let o = 0; for (let i = 0; i < lines.length; i++) { starts[i] = o; o += lines[i].length + 1; } }
+  // Group directive lines (a trailing backslash continues the directive onto the next physical line).
+  const groups = new Map();
   for (let i = 0; i < lines.length; i++) {
-    let line = lines[i];
+    const line = lines[i];
     const m = /^#\s*([A-Za-z]+)/.exec(line);
     const shebang = i === 0 && line.startsWith('#!');
     const hscLine = dialect === 'hsc' && /^#/.test(line);
-    if (shebang || hscLine || (m && cppNames.has(m[1]))) {
-      const name = shebang ? 'shebang' : (m ? m[1] : 'hsc');
-      directives.push({ name, line: i + 1, span: loc.span(off, off + line.length) });
-      if (name === 'if' || name === 'ifdef' || name === 'ifndef') depth++;
-      else if (name === 'endif' && depth > 0) depth--;
-      depthAtLine[i + 1] = depth;
-      let cur = blank(line);
-      // A directive continued with a trailing backslash swallows the next line too.
-      let k = i;
-      while (/\\\r?$/.test(lines[k]) && k + 1 < lines.length) {
-        k++;
-        cur += '\n' + blank(lines[k]);
-        depthAtLine[k + 1] = depth;
-      }
-      if (k > i) {
-        off += lines[i].length + 1;
-        for (let q = i + 1; q <= k; q++) off += lines[q].length + 1;
-        lines.splice(i, k - i + 1, ...cur.split('\n'));
-        i = k;
-        continue;
+    if (!(shebang || hscLine || (m && cppNames.has(m[1])))) continue;
+    const name = shebang ? 'shebang' : (m ? m[1] : 'hsc');
+    let k = i;
+    let text = line;
+    while (/\\\r?$/.test(lines[k]) && k + 1 < lines.length) { k++; text += ' ' + lines[k].replace(/\r$/, ''); }
+    groups.set(i, { name, text: text.replace(/\\\r?(?= )/g, ' '), last: k });
+    directives.push({ name, line: i + 1, span: loc.span(starts[i], starts[i] + line.length) });
+    i = k;
+  }
+  let evalOut = null;
+  let depthAtLine = new Int32Array(lines.length + 2);
+  let outLines = lines;
+  if (dialect !== 'hsc' && groups.size) {
+    evalOut = evaluateCppLines(lines, (i) => { const g = groups.get(i); return g && g.name !== 'shebang' ? g : null; }, cppCtx || {});
+    outLines = evalOut.lines.slice();
+    depthAtLine = evalOut.maybeDepth;
+  } else {
+    outLines = lines.slice();
+    let depth = 0;
+    for (let i = 0; i < lines.length; i++) {
+      const g = groups.get(i);
+      if (g) {
+        if (g.name === 'if' || g.name === 'ifdef' || g.name === 'ifndef') depth++;
+        else if (g.name === 'endif' && depth > 0) depth--;
+        for (let q = i; q <= g.last; q++) depthAtLine[q + 1] = depth;
+        i = g.last;
+      } else {
+        depthAtLine[i + 1] = depth;
+        if (dialect === 'hsc') outLines[i] = lines[i].replace(/#\{[^}\n]*\}/g, (x) => ' '.repeat(x.length));
       }
-      lines[i] = cur;
-      line = cur;
-    } else {
-      depthAtLine[i + 1] = depth;
-      if (dialect === 'hsc') lines[i] = line.replace(/#\{[^}\n]*\}/g, (s) => ' '.repeat(s.length));
     }
-    off += line.length + 1;
   }
-  return { code: lines.join('\n'), directives, depthAtLine };
+  for (const [i, g] of groups) for (let q = i; q <= g.last; q++) outLines[q] = blank(lines[q]);
+  const cpp = evalOut ? { decided: evalOut.decided, undecided: evalOut.undecided, deadLines: evalOut.deadLines } : { decided: [], undecided: [], deadLines: 0 };
+  return { code: outLines.join('\n'), directives, depthAtLine, cpp };
 }
 
 // ── lexer ──────────────────────────────────────────────────────────────────
@@ -436,7 +449,7 @@ function emptyResult(file, dialect) {
   return {
     language: 'haskell', file, dialect, ok: false, status: 'failed', complete: false,
     module: null, imports: [], functions: [], signatures: [], declarations: [], calls: [], expressions: [],
-    records: [], doBlocks: [], comments: [], pragmas: [], errors: [], boundaries: [], uncertainty: [], gaps: [],
+    records: [], doBlocks: [], comments: [], pragmas: [], errors: [], boundaries: [], blankRanges: [], uncertainty: [], gaps: [],
     stats: { bytes: 0, tokens: 0, steps: 0 },
   };
 }
@@ -462,7 +475,7 @@ export function parseHaskell(source, opts = {}) {
   }
   const started = Date.now();
   const ctx = {
-    grammar: g.grammar, budgets, steps: 0,
+    grammar: g.grammar, budgets, steps: 0, cpp: opts.cpp || null,
     tick() {
       this.steps++;
       if (this.steps > budgets.maxSteps) throw new BudgetError('maxSteps', budgets.maxSteps);
@@ -475,7 +488,7 @@ export function parseHaskell(source, opts = {}) {
     res.stats.steps = ctx.steps;
     res.status = res.errors.length ? 'parsed_with_errors' : 'parsed';
     res.ok = true;
-    res.complete = res.errors.length === 0 && !res.boundaries.some((b) => b.kind !== 'cpp' && b.kind !== 'ffi');
+    res.complete = res.errors.length === 0 && !res.boundaries.some((b) => !NON_OPAQUE_BOUNDARIES.has(b.kind));
   } catch (e) {
     const fresh = emptyResult(file, dialect);
     fresh.stats = { ...res.stats, steps: ctx.steps };
@@ -503,11 +516,18 @@ function analyze(source, file, dialect, ctx, res) {
     code = lit.code;
     res.dialect = lit.style === 'latex' ? 'literate-latex' : 'literate-bird';
   }
-  const pre = stripDirectives(code, dialect, g, loc);
+  const pre = stripDirectives(code, dialect, g, loc, ctx.cpp);
   code = pre.code;
   const cppLines = pre.directives.filter((d) => d.name !== 'shebang');
+  // The preprocessed text (directives and dead branches overwritten in place) for the semantic IR; not serialised with the result.
+  Object.defineProperty(res, '_preprocessed', { value: code, enumerable: false, configurable: true });
   if (cppLines.length && dialect !== 'hsc') {
-    res.boundaries.push({ kind: 'cpp', span: cppLines[0].span, detail: `${cppLines.length} preprocessor line(s) removed in place; every conditional branch was parsed`, count: cppLines.length });
+    const cd = pre.cpp;
+    const parts = [`${cppLines.length} preprocessor line(s) removed in place`];
+    if (cd.decided.length) parts.push(`${cd.decided.length} conditional(s) decided (${cd.deadLines} dead line(s) overwritten with spaces)`);
+    parts.push(cd.undecided.length ? `${cd.undecided.length} conditional(s) could not be decided, so every possible branch was parsed` : 'no conditional was left undecided');
+    const assumptions = [...new Set(cd.decided.flatMap((d) => (d.basis || []).filter((b) => b !== 'file')))].sort();
+    res.boundaries.push({ kind: 'cpp', span: cppLines[0].span, detail: parts.join('; '), count: cppLines.length, decided: cd.decided.length, undecided: cd.undecided.length, deadLines: cd.deadLines, assumptions, decisions: cd.decided, undecidedAt: cd.undecided.map((u) => u.line) });
   }
   if (dialect === 'hsc') {
     res.boundaries.push({ kind: 'hsc', span: loc.span(0, Math.min(source.length, 1)), detail: 'hsc2hs source: # directives and #{...} blanked in place, never run through hsc2hs' });
@@ -652,6 +672,7 @@ function analyze(source, file, dialect, ctx, res) {
   const spanOf = (a, b) => loc.span(T[a].s, T[Math.max(a, b - 1)].e);
   const condAt = (t) => pre.depthAtLine[t.line] > 0;
   const topRanges = [];
+  const spliceItems = [];
 
   const registerFunction = (key, rec) => {
     let f = fnIndex.get(key);
@@ -865,7 +886,9 @@ function analyze(source, file, dialect, ctx, res) {
     }
     if (mark < 0) {
       if (c.scope === 'top' && ctx.th) {
-        res.boundaries.push({ kind: 'th-top-level-splice', span: spanOf(a, b), detail: 'top-level Template Haskell splice; declarations it generates are not visible' });
+        const bnd = { kind: 'th-top-level-splice', span: spanOf(a, b), detail: 'top-level Template Haskell splice; declarations it generates are not visible' };
+        res.boundaries.push(bnd);
+        spliceItems.push({ a, b, bnd });
         return;
       }
       errors.push({ kind: 'expected-declaration', offset: T[a].s, endOffset: T[b - 1].e, detail: 'item is neither a binding nor a signature' });
@@ -1022,6 +1045,41 @@ function analyze(source, file, dialect, ctx, res) {
     else scanItem(w.role, w.a, w.b, w);
   }
 
+  function absorbSafeBoundaries() {
+    if (!spliceItems.length && !res.boundaries.some((x) => x.kind === 'quasiquote')) return;
+    const defined = new Set();
+    for (const f of res.functions) if (f.name) defined.add(f.name);
+    for (const d of res.declarations) if (d.name) defined.add(d.name);
+    for (const sg of res.signatures) for (const n of sg.names) defined.add(n);
+    const absorbed = [];
+    for (const it of spliceItems) {
+      const r = classifySafeSplice(T, it.a, it.b, match, res.imports, defined);
+      if (!r) continue;
+      const from = T[it.a].s; const to = T[it.b - 1].e;
+      absorbed.push({ from, to });
+      Object.assign(it.bnd, {
+        kind: 'th-safe-splice',
+        detail: `declaration-level splice of ${[...new Set(r.generators)].join(', ')}: names and literals only, no project-controlled string reaches it; ASSUMED to be the upstream generator from ${r.modules.join(' / ')}, and the declarations it generates are not modelled`,
+        generators: [...new Set(r.generators)], assumption: 'upstream-generator',
+      });
+      res.blankRanges.push({ kind: 'th-safe-splice', startOffset: from, endOffset: to });
+    }
+    const inside = (b) => absorbed.some((x) => b.span.startOffset >= x.from && b.span.endOffset <= x.to);
+    res.boundaries = res.boundaries.filter((b) => !((b.kind === 'th-name-quote' || b.kind === 'th-splice' || b.kind === 'quasiquote') && inside(b)));
+    for (const b of res.boundaries) {
+      if (b.kind !== 'quasiquote') continue;
+      const body = source.slice(b.span.startOffset, b.span.endOffset);
+      const bar = body.indexOf('|');
+      const inner = bar < 0 ? '' : body.slice(bar + 1, body.endsWith('|]') ? -2 : undefined);
+      const r = classifyInertQuasiQuote(b.quoter, inner, res.imports, defined);
+      if (!r) continue;
+      b.kind = 'quasiquote-inert';
+      b.detail = `quasi-quote [${r.quoter}|...|] is a string literal (no interpolation); ASSUMED to be the upstream quoter from ${r.modules.join(' / ')}`;
+      b.assumption = 'upstream-quoter';
+      res.blankRanges.push({ kind: 'quasiquote-inert', startOffset: b.span.startOffset, endOffset: b.span.endOffset });
+    }
+  }
+
   // ── errors → withheld calls ──
   const bad = [];
   for (const e of errors) {
@@ -1063,6 +1121,9 @@ function analyze(source, file, dialect, ctx, res) {
   }
   if (total > outErrors.length) res.errors.push({ kind: 'errors-truncated', detail: `${total - outErrors.length} further syntax error(s) not listed` });
 
+  // ── safe generative splices and inert quasi-quotes (disclosed assumptions, not opaque boundaries) ──
+  absorbSafeBoundaries();
+
   // ── uncertainty ──
   if (res.boundaries.some((x) => x.kind === 'cpp' || x.kind === 'hsc')) res.uncertainty.push({ kind: 'preprocessed' });
   if (res.boundaries.some((x) => x.kind === 'generated' || x.kind.startsWith('th-') || x.kind === 'quasiquote')) res.uncertainty.push({ kind: 'generated-source' });
@@ -1071,3 +1132,26 @@ function analyze(source, file, dialect, ctx, res) {
   res.calls.sort((x, y) => x.span.startOffset - y.span.startOffset);
   void cut;
 }
+
+const IR_PREPROCESS_GUARD = /^[ \t]*#\s*(?:if|ifdef|ifndef|elif|else|endif|define|undef)\b|\bTemplateHaskell\b|\bQuasiQuotes\b/m;
+
+/**
+ * Source for the semantic IR's own parser, which knows neither CPP nor Template Haskell. Length-preserving: CPP directives and
+ * dead branches become spaces; a safe declaration splice becomes spaces; an inert quasi-quote becomes a string literal of the
+ * same length. Anything else (an undecided conditional's branches, an opaque splice or quasi-quote) is left exactly as written.
+ * Returns the input unchanged when it has nothing to preprocess or cannot be parsed.
+ */
+export function preprocessForSyntax(source, opts = {}) {
+  if (typeof source !== 'string' || !IR_PREPROCESS_GUARD.test(source)) return source;
+  let r;
+  try { r = parseHaskell(source, { file: opts.file, cpp: opts.cpp }); } catch { return source; }
+  if (!r || !r.ok || typeof r._preprocessed !== 'string' || r._preprocessed.length !== source.length) return source;
+  let out = r._preprocessed;
+  for (const b of r.blankRanges || []) {
+    const seg = out.slice(b.startOffset, b.endOffset);
+    let repl = blank(seg);
+    if (b.kind === 'quasiquote-inert' && repl.length >= 2) repl = `"${repl.slice(1, -1)}"`;
+    out = out.slice(0, b.startOffset) + repl + out.slice(b.endOffset);
+  }
+  return out;
+}

package/src/language/haskell-sca.js

@@ -19,6 +19,7 @@
 // response). The wire query is built here so its exact shape is testable.
 
 import { createHash, createVerify } from 'node:crypto';
+import { advisorySeverity, NO_RATING_BASIS } from './cvss.js';
 import { parseVersion, compareVersions, parseVersionRange, caretUpperBound } from './haskell-manifests.js';
 
 export const HS_SCA_VERSION = 'haskell-sca/1';
@@ -140,15 +141,19 @@ export function normalizeAdvisory(rec) {
     id: rec.id, canonicalId, ids, cveAliases: ids.filter((x) => /^CVE-/.test(x)), ghsaAliases: ids.filter((x) => /^GHSA-/.test(x)),
     summary: rec.summary || '', details: rec.details || '', published: rec.published || null, modified: rec.modified || null,
     withdrawn: rec.withdrawn || null, references: (rec.references || []).map((r) => r.url).filter(Boolean),
-    severity: rec.severity || [], affected, problems,
+    severity: rec.severity || [], severityInfo: advisorySeverity(rec), affected, problems,
   };
 }
 const fixedVersions = (ranges) => [...new Set((ranges || []).flatMap((r) => (r.events || []).filter((e) => 'fixed' in e).map((e) => e.fixed)))];
 
 // ── advisory database (pinned snapshot / records) ────────────────────────────
 export class AdvisoryDb {
-  constructor({ records = [], source = 'records', generatedAt = null, now = Date.now(), maxAgeDays = 30, integrity = null } = {}) {
+  constructor({ records = [], source = 'records', generatedAt = null, now = Date.now(), maxAgeDays = 30, integrity = null, covered = null } = {}) {
     this.source = source;
+    // `covered` is {package: ISO time it was last queried}. null means the snapshot makes no per-package claim (a hand-built or
+    // operator-pinned snapshot): every package is then treated as covered, as it always was.
+    this.covered = covered && typeof covered === 'object' ? covered : null;
+    this.now = now;
     this.generatedAt = generatedAt;
     this.integrity = integrity;
     this.problems = [];
@@ -167,6 +172,13 @@ export class AdvisoryDb {
     this.maxAgeDays = maxAgeDays;
   }
   forPackage(name) { return this.byPackage.get(name) || []; }
+  /** 'covered' | 'uncovered' | 'stale' for a package; always 'covered' when the snapshot makes no per-package claim. */
+  coverage(name) {
+    if (!this.covered) return 'covered';
+    const t = Date.parse(this.covered[name]);
+    if (!Number.isFinite(t)) return 'uncovered';
+    return (this.now - t) / 86400000 > this.maxAgeDays ? 'stale' : 'covered';
+  }
 }
 
 const sha256 = (b) => createHash('sha256').update(b).digest('hex');
@@ -185,7 +197,7 @@ export function loadAdvisorySnapshot(snapshot, { pinnedSha256 = null, signature
     if (!want) return refuse(`record ${rec.id} has no recorded hash`);
     if (sha256(JSON.stringify(rec)) !== want) return refuse(`record ${rec.id} does not match its recorded hash`);
   }
-  const body = JSON.stringify({ schema: snapshot.schema, generatedAt: snapshot.generatedAt, records: snapshot.records, recordHashes: snapshot.recordHashes });
+  const body = snapshotBody(snapshot);
   const digest = sha256(body);
   if (pinnedSha256 && digest !== pinnedSha256) return refuse('snapshot hash does not match the pinned value');
   let signed = false;
@@ -197,7 +209,7 @@ export function loadAdvisorySnapshot(snapshot, { pinnedSha256 = null, signature
       signed = true;
     } catch (e) { return refuse(`signature check failed: ${e.message}`); }
   }
-  const db = new AdvisoryDb({ records: snapshot.records, source: 'snapshot', generatedAt: snapshot.generatedAt, now, maxAgeDays, integrity: { sha256: digest, hashPinned: !!pinnedSha256, signed } });
+  const db = new AdvisoryDb({ records: snapshot.records, source: 'snapshot', generatedAt: snapshot.generatedAt, now, maxAgeDays, integrity: { sha256: digest, hashPinned: !!pinnedSha256, signed }, covered: snapshot.covered || null });
   return { ok: true, db, digest };
 }
 
@@ -205,7 +217,8 @@ export function buildSnapshot(records, generatedAt) {
   const recordHashes = Object.fromEntries(records.map((r) => [r.id, sha256(JSON.stringify(r))]));
   return { schema: 1, generatedAt, records, recordHashes };
 }
-export const snapshotBody = (s) => JSON.stringify({ schema: s.schema, generatedAt: s.generatedAt, records: s.records, recordHashes: s.recordHashes });
+// `covered` joins the hashed body only when present, so a snapshot without it keeps the digest it always had.
+export const snapshotBody = (s) => JSON.stringify({ schema: s.schema, generatedAt: s.generatedAt, records: s.records, recordHashes: s.recordHashes, ...(s.covered ? { covered: s.covered } : {}) });
 
 // ── matching ─────────────────────────────────────────────────────────────────
 /**
@@ -219,14 +232,16 @@ export function matchComponent(aff, comp) {
     if (inside === null) return { status: 'unknown', reason: `"${comp.version}" is not a Cabal version` };
     return inside ? { status: 'affected', reason: 'the resolved version is inside an affected range' } : { status: 'not-affected', reason: 'the resolved version is outside every affected range' };
   }
-  if (comp.declaredRange) {
-    const declared = rangeToIntervals(comp.declaredRange);
+  // `unbounded` = the manifest declared the dependency with NO version bound (`build-depends: aeson`), which in Cabal means "any version".
+  // That is a declared range like any other (it overlaps an advisory, so possibly-affected), not an absent one.
+  if (comp.declaredRange || comp.unbounded) {
+    const declared = comp.declaredRange ? rangeToIntervals(comp.declaredRange) : [iv(null, false, null, false)];
     if (declared === null) return { status: 'unknown', reason: 'the declared range could not be parsed' };
     if (!declared.length) return { status: 'unknown', reason: 'the declared range admits no version' };
     const overlap = intervalsOverlap(declared, aff.intervals);
     if (!overlap) return { status: 'not-affected', reason: 'no version allowed by the declared range is affected' };
     const subset = declared.every((d) => aff.intervals.some((a) => !isEmpty(intersectIntervals(d, a)) && containsInterval(a, d)));
-    return subset ? { status: 'affected', reason: 'every version allowed by the declared range is affected' } : { status: 'possibly-affected', reason: 'the declared range allows both affected and unaffected versions; no resolved version is known' };
+    return subset ? { status: 'affected', reason: 'every version allowed by the declared range is affected' } : { status: 'possibly-affected', reason: comp.declaredRange ? 'the declared range allows both affected and unaffected versions; no resolved version is known' : 'the dependency is declared with no version bound, so any version may be selected; no resolved version is known' };
   }
   return { status: 'unknown', reason: 'neither a resolved version nor a declared range is known' };
 }
@@ -251,6 +266,8 @@ export function evaluateComponents(components, db, opts = {}) {
   for (const comp of components) {
     const base = { name: comp.name, version: comp.version || null, declaredRange: comp.declaredRange || null, scope: comp.scope || null, target: comp.target || null, purl: hackagePurl(comp.name, comp.version || null) };
     if (!db) { statuses.push({ ...base, status: 'feed-unavailable' }); continue; }
+    const cov = db.coverage(comp.name);
+    if (cov !== 'covered') { statuses.push({ ...base, status: cov === 'stale' ? 'feed-stale' : 'feed-incomplete', reason: cov === 'stale' ? 'this package was last looked up longer ago than the feed age limit; the absence of advisories is not evidence' : 'the advisory feed never covered this package; the absence of advisories is not evidence' }); continue; }
     const hits = db.forPackage(comp.name);
     if (!hits.length) { statuses.push({ ...base, status: 'no-advisories', feed: feed.status }); continue; }
     let any = false;
@@ -261,14 +278,15 @@ export function evaluateComponents(components, db, opts = {}) {
       statuses.push({ ...base, status: ghc && m.status !== 'not-affected' ? `ghc-component:${m.status}` : m.status, advisory: adv.canonicalId, reason: m.reason, ghcComponent: ghc });
       if (m.status === 'not-affected') continue;
       any = true;
+      const sev = adv.severityInfo || { level: null, score: null, basis: NO_RATING_BASIS };
       const kevHit = adv.cveAliases.length ? (opts.kev ? adv.cveAliases.some((c) => opts.kev.has(c)) : 'unknown') : 'not-applicable';
       const epssVals = adv.cveAliases.map((c) => opts.epss && opts.epss[c]).filter((x) => typeof x === 'number');
       findings.push({
         type: 'vulnerable_dep', ecosystem: 'hackage', name: comp.name, version: comp.version || null, declaredRange: comp.declaredRange || null,
         osvId: adv.canonicalId, ids: adv.ids, cveAliases: adv.cveAliases, ghsaAliases: adv.ghsaAliases,
         summary: adv.summary, fixedIn: aff.fixedIn, unfixed: aff.unfixed, references: adv.references.slice(0, 5),
-        severity: 'medium', severityBasis: 'the advisory carries no severity rating',
-        matchStatus: m.status, matchReason: m.reason, resolution: comp.version ? 'resolved' : (comp.declaredRange ? 'declared-range' : 'none'),
+        severity: sev.level || 'medium', severityBasis: sev.basis, severityScore: sev.score ?? null,
+        matchStatus: m.status, matchReason: m.reason, resolution: comp.version ? 'resolved' : (comp.declaredRange ? 'declared-range' : (comp.unbounded ? 'declared-unbounded' : 'none')),
         scope: comp.scope || null, target: comp.target || null, purl: base.purl, ghcComponent: ghc,
         ...(ghc ? { remediation: `${comp.name} is provided by the compiler: upgrade GHC (the fix is in ${comp.name} ${aff.fixedIn.join(', ') || '(no fixed version published)'}), not a Cabal dependency bound.` } : { remediation: aff.fixedIn.length ? `Upgrade ${comp.name} to ${aff.fixedIn.join(' or ')}.` : `No fixed version of ${comp.name} is published; remove or replace the dependency.` }),
         kev: kevHit, epss: epssVals.length ? Math.max(...epssVals) : 'unknown',

package/src/language/haskell-security-rules.js

@@ -26,7 +26,7 @@ export const RULES = Object.freeze({
   'hs-ecb-mode': { cwe: 'CWE-327', severity: 'high', family: 'weak-crypto', vuln: 'ECB block cipher mode', remediation: 'ECB leaks plaintext structure. Use an AEAD mode (AES-GCM) with a fresh nonce.' },
   'hs-static-iv': { cwe: 'CWE-329', severity: 'high', family: 'weak-crypto', vuln: 'Static IV or nonce', remediation: 'Generate a fresh random IV/nonce per message with `getRandomBytes`; never reuse one with the same key.' },
   'hs-predictable-random': { cwe: 'CWE-338', severity: 'high', family: 'weak-randomness', vuln: 'Predictable random number generator used for a security value', remediation: 'Use `Crypto.Random.getRandomBytes` or `System.Entropy.getEntropy` (OS CSPRNG). `System.Random` is a deterministic PRNG.' },
-  'hs-unbounded-request-body': { cwe: 'CWE-400', severity: 'medium', family: 'resource-exhaustion', vuln: 'Request body read without a size limit', remediation: 'Apply `requestSizeLimitMiddleware` (wai-extra) or read a bounded number of chunks with `getRequestBodyChunk`.' },
+  'hs-unbounded-request-body': { cwe: 'CWE-770', severity: 'medium', family: 'resource-exhaustion', vuln: 'Request body read without a size limit', remediation: 'Apply `requestSizeLimitMiddleware` (wai-extra) or read a bounded number of chunks with `getRequestBodyChunk`.' },
   'hs-xml-entity-substitution': { cwe: 'CWE-611', severity: 'medium', family: 'xxe', vuln: 'XML parser configured to substitute DTD entities', remediation: 'Disable DTD entity substitution (`withSubstDTDEntities no`) for untrusted XML.' },
   'hs-sensitive-logging': { cwe: 'CWE-532', severity: 'high', family: 'sensitive-logging', vuln: 'Sensitive value written to a log or trace', remediation: 'Do not log credentials or secrets. Log an identifier, or redact the value before it reaches the logger.' },
   'hs-insecure-cookie': { cwe: 'CWE-1004', severity: 'medium', family: 'cookie-attributes', vuln: 'Session cookie without HttpOnly or Secure', remediation: 'Set `setCookieHttpOnly = True`, `setCookieSecure = True` and `setCookieSameSite = Just sameSiteStrict` (or Lax) on a session or token cookie.' },

package/src/language/haskell-supply.js

@@ -6,6 +6,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { analyzeHaskellManifests } from './haskell-manifests.js';
 import { buildHaskellIR } from './haskell-ir.js';
+import { getLastRefresh, refreshHackageAdvisories, liveFeedEnabled, FEED_ENV } from './haskell-advisory-feed.js';
 import { AdvisoryDb, loadAdvisorySnapshot, evaluateComponents, reachability, nearNameCandidates, sourceIntegrity, lifecycle, licensePolicy, hackagePurl, GHC_BOOT_PACKAGES } from './haskell-sca.js';
 
 const MANIFEST = /(?:^|\/)(?:[^/]+\.cabal|cabal\.project(?:\.[a-z]+)?|package\.yaml|stack\.yaml|stack\.yaml\.lock)$/;
@@ -20,22 +21,56 @@ export function hackageComponents(files) {
   const mf = manifestFiles(files);
   if (!mf.length) return { components: [], manifests: null };
   const manifests = analyzeHaskellManifests(mf);
-  const locked = new Map();
-  const lockedAt = new Map();
-  for (const l of manifests.lockedPackages || []) { locked.set(l.name, l.version); if (l.version && l.file) lockedAt.set(l.name, { file: l.file, line: l.line || null }); }
+  // A freeze or lock file resolves the manifests at or below its own directory (that is what a Cabal project or Stack project root means), and the
+  // nearest enclosing one wins. Applying one repository-wide made a release builder's freeze (builders/linux.armv6hf/) the "resolved" version of
+  // the root package: found by the live Hackage feed bench.
+  const dirOf = (p) => (typeof p === 'string' && p.includes('/') ? p.slice(0, p.lastIndexOf('/')) : '');
+  const covers = (lockFile, manifest) => { const base = dirOf(lockFile); const m = dirOf(manifest); return base === '' || m === base || m.startsWith(`${base}/`); };
+  const lockedFor = (name, manifest) => {
+    let best = null;
+    for (const l of manifests.lockedPackages || []) {
+      if (l.name !== name || !l.version || !l.file || !covers(l.file, manifest)) continue;
+      if (!best || dirOf(l.file).length >= dirOf(best.file).length) best = l;
+    }
+    return best;
+  };
+  // Packages this project DEFINES (a .cabal file or an hpack package.yaml in the scanned tree). A `build-depends` on one of them resolves to the
+  // workspace package, not to Hackage; reporting it would raise advisories about the project's own (usually fixed) version as if it were a
+  // dependency. Found by the live Hackage feed bench (aeson's own test suite depends on aeson).
+  const defined = new Set([...(manifests.packages || []), ...(manifests.hpack || [])].map((p) => p.name).filter(Boolean));
   const seen = new Map();
   for (const d of manifests.dependencies || []) {
-    const resolved = locked.get(d.name) || d.exactPin || null;
-    const key = `${d.name}@${d.scope || 'runtime'}`;
+    if (defined.has(d.name)) continue;
+    const lock = lockedFor(d.name, d.manifest);
+    const resolved = (lock && lock.version) || d.exactPin || null;
+    const key = `${d.name}@${d.scope || 'runtime'}@${resolved || ''}`;   // a covered (resolved) use is not merged into an uncovered one
     if (seen.has(key)) continue;
     seen.set(key, {
-      ecosystem: 'hackage', name: d.name, version: resolved, declaredRange: d.declaredRange || null,
-      resolution: locked.has(d.name) ? 'freeze' : (d.exactPin ? 'exact-pin' : 'unresolved'),
+      ecosystem: 'hackage', name: d.name, version: resolved, declaredRange: d.declaredRange || null, unbounded: !resolved && !d.declaredRange && d.rangeKind === 'unbounded',
+      resolution: lock ? 'freeze' : (d.exactPin ? 'exact-pin' : 'unresolved'),
       scope: d.scope || 'runtime', engineScope: SCOPE[d.scope] || 'required', target: d.component || null, componentKind: d.componentKind || null,
       manifest: d.manifest, line: d.line, ghcComponent: GHC_BOOT_PACKAGES.has(d.name),
-      versionSource: locked.has(d.name) && lockedAt.has(d.name) ? lockedAt.get(d.name) : null,
+      versionSource: lock ? { file: lock.file, line: lock.line || null } : null,
     });
   }
+  // Cabal chooses ONE version of a package for every component of a .cabal file, so a use with no bound inherits the unconditional bounds the
+  // same manifest declares for that package elsewhere (a library that pins `aeson >=2.2.5.1` next to a test suite that just says `aeson`).
+  // Conditional bounds (flags, os, compiler) are not in force everywhere and are not inherited; neither is a bound from another manifest.
+  const boundsIn = new Map();
+  for (const d of manifests.dependencies || []) {
+    if (!d.declaredRange || (d.conditions && d.conditions.length) || defined.has(d.name)) continue;
+    const k = `${d.manifest}\u0000${d.name}`;
+    if (!boundsIn.has(k)) boundsIn.set(k, []);
+    if (!boundsIn.get(k).includes(d.declaredRange)) boundsIn.get(k).push(d.declaredRange);
+  }
+  for (const c of seen.values()) {
+    if (!c.unbounded) continue;
+    const rs = boundsIn.get(`${c.manifest}\u0000${c.name}`);
+    if (!rs) continue;
+    c.declaredRange = rs.length === 1 ? rs[0] : rs.map((r) => `(${r})`).join(' && ');
+    c.unbounded = false;
+    c.rangeInheritedFromSibling = true;
+  }
   return { components: [...seen.values()], manifests };
 }
 
@@ -61,7 +96,18 @@ function mergeResolved(declared, resolved) {
 }
 
 /** Advisory data configured for this scan: a hash-pinned snapshot from the environment or the project's state dir. */
+/** The live-feed sentence appended to a "no advisory data" reason: what the refresh did, or how to turn it on. */
+function liveFeedNote(env) {
+  const r = getLastRefresh();
+  if (r && r.status !== 'disabled') return ` Live feed: ${r.status}, ${r.detail}.`;
+  return env[FEED_ENV] === '1' ? '' : ` To fetch advisories from the OSV Hackage feed instead, set ${FEED_ENV}=1 (network, opt-in).`;
+}
+
 export function configuredAdvisoryDb(root, env = process.env) {
+  const c = _configuredAdvisoryDb(root, env);
+  return c.db ? c : { ...c, reason: `${c.reason}${liveFeedNote(env)}` };
+}
+function _configuredAdvisoryDb(root, env = process.env) {
   const sel = resolveOperatorSnapshot({ envVar: 'AGENTIC_SECURITY_HACKAGE_ADVISORIES', fileName: 'hackage-advisories.json', root, env });
   if (!sel.path) return { db: null, reason: `no advisory snapshot configured (set AGENTIC_SECURITY_HACKAGE_ADVISORIES, or place hackage-advisories.json in the operator configuration directory, agentic-security under XDG_CONFIG_HOME)${sel.projectLocalIgnored ? IGNORED_NOTE('hackage-advisories.json') : ''}`, projectLocalIgnored: !!sel.projectLocalIgnored };
   let snap;
@@ -70,6 +116,20 @@ export function configuredAdvisoryDb(root, env = process.env) {
   return r.ok ? { db: r.db, reason: null, source: sel.source } : { db: null, reason: `advisory snapshot refused: ${r.reason}` };
 }
 
+/**
+ * The async step before a scan's synchronous passes: when the live feed is enabled, make sure the operator snapshot covers every
+ * Hackage package this scan will evaluate (declared, frozen, transitive when a plan is present, and Haskell packages inside an imported Nix closure). Does nothing, and costs nothing
+ * (no manifest parsing), unless the feed is enabled. Never throws.
+ */
+export async function prefetchHackageFeed(files, { env = process.env, resolvedComponents = [], extraNames = [], ...opts } = {}) {
+  if (!liveFeedEnabled(env)) return null;
+  try {
+    const names = [...hackageComponents(files).components, ...resolvedComponents].map((c) => c.name).concat(extraNames);
+    if (!names.length) return null;
+    return await refreshHackageAdvisories(names, { env, ...opts });
+  } catch (e) { return { status: 'failed', detail: `the feed step failed: ${String((e && e.message) || e).slice(0, 120)}` }; }
+}
+
 /** Imports and import-qualified callees across the project's Haskell sources. */
 export function collectUsage(files) {
   const hs = {};
@@ -101,6 +161,8 @@ export function analyzeHaskellSupply(files, { db = undefined, root = null, env =
   out.feed = ev.feed;
   if (!db) out.gaps.push({ kind: 'advisory-feed-unavailable', detail: `${feedReason || ev.feed.detail}. ${components.length} Hackage dependencies were NOT checked against any advisory: the absence of findings is not a clean result.` });
   else if (ev.feed.status === 'stale-cache') out.gaps.push({ kind: 'advisory-feed-stale', detail: ev.feed.detail });
+  const notCovered = ev.statuses.filter((x) => x.status === 'feed-incomplete' || x.status === 'feed-stale');
+  if (db && notCovered.length) out.gaps.push({ kind: 'advisory-feed-incomplete', detail: `${notCovered.length} Hackage package(s) were not covered by the advisory feed (${[...new Set(notCovered.map((x) => x.name))].slice(0, 5).join(', ')}${notCovered.length > 5 ? ', ...' : ''}): their status is unknown, and the absence of findings for them is not a clean result.` });
   const unresolved = components.filter((c) => !c.version);
   if (unresolved.length) out.gaps.push({ kind: 'unresolved-dependency-versions', detail: `${unresolved.length} dependency version(s) are only declared ranges (${unresolved.slice(0, 5).map((c) => c.name).join(', ')}${unresolved.length > 5 ? ', ...' : ''}); generate a Cabal plan or a Stack export to resolve them` });