@clear-capabilities/agentic-security-scanner 0.157.2 → 0.159.0

package/src/language/nix-fix.js

@@ -24,7 +24,8 @@ import { analyzeNixScripts } from './nix-script-taint.js';
 import { analyzeNixSecrets } from './nix-secrets.js';
 import { analyzeNixBuildTrust } from './nix-build-trust.js';
 import { analyzeNixosHardening } from './nixos-hardening.js';
-import { runFixLifecycle, unifiedDiff, writeWithBackup, undoFix } from './fix-lifecycle.js';
+import { runFixLifecycle, unifiedDiff, writeWithBackup, undoFix, isRootRelativePath } from './fix-lifecycle.js';
+import { resolveNixosConfig } from './nixos-module-resolver.js';
 import { parseFlakeLock } from './nix-inventory.js';
 
 export const NIX_FIX_VERSION = 'nix-fix/1';
@@ -55,30 +56,137 @@ const MANUAL = {
 };
 const HASH_MANUAL = new Set(['nix-fetch-missing-hash', 'nix-fetch-fake-hash', 'nix-fetch-floating-rev']);
 
-function planOptionFix(finding, files, fx, source) {
-  // `optionEvidence` is the option-level evidence a scan carries; `evidence` is that same array on a finding that comes
-  // straight from the hardening analysis (the scan's own `evidence` field is the list of detectors that agreed).
-  const evList = Array.isArray(finding.optionEvidence) ? finding.optionEvidence : (Array.isArray(finding.evidence) ? finding.evidence.filter((e) => e && typeof e === 'object') : []);
-  const evidence = evList[0] || null;
-  const option = (evidence && evidence.option) || finding.subject;
-  const winner = evidence && (evidence.sources || []).find((s) => s.role === 'winner');
-  const file = source ? source.file : (winner ? winner.file : finding.file);
-  const line = source ? source.line : (winner ? winner.line : finding.line);
-  const text = files[file];
-  if (typeof text !== 'string') return { ok: false, status: 'blocked', tier: TIERS.blocked, reason: `the defining file ${file} is not in the supplied tree` };
+// The option each hardening rule judges. Used to pick the right evidence record when a finding carries several.
+const OPTION_OF = {
+  'ssh-root-login': 'services.openssh.settings.PermitRootLogin',
+  'ssh-password-auth': 'services.openssh.settings.PasswordAuthentication',
+  'ssh-empty-passwords': 'services.openssh.settings.PermitEmptyPasswords',
+  'firewall-disabled': 'networking.firewall.enable',
+  'nix-require-sigs-disabled': 'nix.settings.require-sigs',
+  'nix-sandbox-disabled': 'nix.settings.sandbox',
+  'nix-accept-flake-config': 'nix.settings.accept-flake-config',
+};
+// The literal each rule treats as the weakness: the one a conditional branch must hold to be edited.
+const BAD_OF = { 'ssh-root-login': '"yes"', 'ssh-password-auth': 'true', 'ssh-empty-passwords': 'true', 'firewall-disabled': 'false', 'nix-require-sigs-disabled': 'false', 'nix-sandbox-disabled': 'false', 'nix-accept-flake-config': 'true' };
+const literalValue = (to) => (to.startsWith('"') ? to.slice(1, -1) : to === 'true');
+
+/** The module a human should put an override line in: the entry configuration. */
+const entryOf = (files, opts) => (opts && opts.entry) || (files['configuration.nix'] !== undefined ? 'configuration.nix' : null);
+
+/**
+ * The override line to ADD to the entry module when no definition can be edited. A plain assignment conflicts with an
+ * equal-priority definition, so the wrapper is chosen from the strongest competing priority: nothing when every
+ * definition is weaker than plain, mkForce when plain is the strongest, mkOverride just below anything stronger.
+ */
+function overrideSuggestion(option, fx, sources, files, opts) {
+  const prios = sources.map((s) => s.priority).filter((n) => Number.isFinite(n));
+  const strongest = prios.length ? Math.min(...prios) : 100;
+  const base = { file: entryOf(files, opts), option, automatic: false };
+  if (strongest > 100) return { ...base, line: `${option} = ${fx.to};`, priority: 100, note: 'every existing definition is weaker than a plain assignment, so no override wrapper is needed.' };
+  if (strongest > 50) return { ...base, line: `${option} = lib.mkForce ${fx.to};`, priority: 50, note: 'a plain assignment would conflict with the existing definition at the same priority, so mkForce is required. `lib` must be among the module arguments.' };
+  if (strongest > 1) return { ...base, line: `${option} = lib.mkOverride ${strongest - 1} ${fx.to};`, priority: strongest - 1, note: `an existing definition already uses priority ${strongest}, so the override must be stronger than it. \`lib\` must be among the module arguments.` };
+  return { ...base, line: null, priority: null, note: 'an existing definition uses the strongest possible priority; nothing can override it from another module.' };
+}
+
+const refuse = (status, reason, extra = {}) => ({ ok: false, status, tier: status === 'blocked' ? TIERS.blocked : TIERS.guidance, reason, ...extra });
+
+/**
+ * Edit the single literal that defines `option` at `file`:`line` in `text`. When several bindings share the line (the branches
+ * of one `if`), the one holding the weak literal `bad` is preferred. `skip` reports a definition that already holds the safe value.
+ */
+function literalEdit(file, text, line, option, fx, bad) {
   const parse = parseNix(text, { file });
-  if (!parse.ast) return { ok: false, status: 'blocked', tier: TIERS.blocked, reason: `${file} does not parse` };
+  if (!parse.ast) return { ok: false, reason: `${file} does not parse` };
   const ir = buildNixIR(parse, { file, source: text });
-  const cands = ir.bindings.filter((b) => b.pathText === option && b.valueSpan);
-  const hit = cands.find((b) => b.span && Math.abs(b.span.startLine - line) <= 0) || cands.find((b) => b.span && b.span.startLine <= line && b.span.endLine >= line) || (cands.length === 1 ? cands[0] : null);
-  if (!hit) return { ok: false, status: 'manual', tier: TIERS.guidance, reason: `no literal definition of ${option} was found at ${file}:${line}: it may be set by a function, an import or an attribute-set merge`, proposal: { option, set: fx.to } };
+  const re = fx.kind === 'bool' ? /\b(?:true|false)\b/g : /"(?:[^"\\]|\\.)*"/g;
+  const cands = ir.bindings.filter((b) => b.pathText === option && b.valueSpan && b.span);
+  const onLine = cands.filter((b) => b.span.startLine === line);
+  const within = cands.filter((b) => b.span.startLine <= line && b.span.endLine >= line);
+  const pool = onLine.length ? onLine : (within.length ? within : (cands.length === 1 ? cands : []));
+  const litOf = (b) => { const t = text.slice(b.valueSpan.startOffset, b.valueSpan.endOffset).match(re) || []; return t.length === 1 ? t[0] : null; };
+  const hit = (bad && pool.find((b) => litOf(b) === bad)) || pool.find((b) => litOf(b) !== null && litOf(b) !== fx.to) || pool[0] || null;
+  if (!hit) return { ok: false, reason: `no literal definition of ${option} was found at ${file}:${line}: it may be set by a function, an import or an attribute-set merge` };
   const vs = hit.valueSpan;
   const current = text.slice(vs.startOffset, vs.endOffset);
-  const re = fx.kind === 'bool' ? /\b(?:true|false)\b/g : /"(?:[^"\\]|\\.)*"/g;
   const lits = current.match(re) || [];
-  if (lits.length !== 1) return { ok: false, status: 'manual', tier: TIERS.guidance, reason: `the definition of ${option} is not a single literal (${current.slice(0, 60)}): the edit would have to choose a branch`, proposal: { option, set: fx.to } };
+  if (lits.length !== 1) return { ok: false, reason: `the definition of ${option} at ${file}:${hit.span.startLine} is not a single literal (${current.trim().slice(0, 60)}): the edit would have to choose a branch` };
+  if (lits[0] === fx.to) return { ok: true, skip: true, line: hit.span.startLine };
   const next = current.replace(re, fx.to);
-  return { ok: true, file, before: text, after: splice(text, vs.startOffset, vs.endOffset, next), ruleId: `nix-set-${option}`, label: 'FULL', explanation: `${option} = ${current.trim()} -> ${next.trim()} at ${file}:${hit.span.startLine}, the definition that wins by priority.`, consequences: fx.consequences, tier: TIERS.edit, behavior: { kind: 'option', option, from: current.trim(), to: next.trim() } };
+  return { ok: true, after: splice(text, vs.startOffset, vs.endOffset, next), from: current.trim(), to: next.trim(), line: hit.span.startLine, literal: lits[0] };
+}
+
+function planOptionFix(finding, files, fx, source, opts = {}) {
+  // `optionEvidence` is the option-level evidence a scan carries; `evidence` is that same array on a finding that comes
+  // straight from the hardening analysis (the scan's own `evidence` field is the list of detectors that agreed).
+  const evList = Array.isArray(finding.optionEvidence) ? finding.optionEvidence : (Array.isArray(finding.evidence) ? finding.evidence.filter((e) => e && typeof e === 'object') : []);
+  const evidence = evList.find((e) => e && e.option === OPTION_OF[finding.rule]) || evList[0] || null;
+  const option = (evidence && evidence.option) || finding.subject;
+  const sources = (evidence && Array.isArray(evidence.sources)) ? evidence.sources : [];
+  const bad = BAD_OF[finding.rule] || null;
+  const proposal = (extra = {}) => ({ option, set: fx.to, ...extra });
+
+  // Findings that carry no per-definition evidence keep the single-file behaviour: edit the reported line.
+  if (!sources.length) {
+    const file = source ? source.file : finding.file;
+    const line = source ? source.line : finding.line;
+    if (typeof files[file] !== 'string') return refuse('blocked', `the defining file ${file} is not in the supplied tree`);
+    const r = literalEdit(file, files[file], line, option, fx, bad);
+    if (!r.ok) return refuse(/does not parse/.test(r.reason) ? 'blocked' : 'manual', r.reason, { proposal: proposal() });
+    if (r.skip) return refuse('manual', `the definition of ${option} at ${file}:${r.line} already holds ${fx.to}`, { proposal: proposal() });
+    return optionPlanResult(option, fx, [{ file, before: files[file], after: r.after, from: r.from, to: r.to, line: r.line }], [], bad);
+  }
+
+  // Everything that contributes to the effective value: the definitions that win, and those that apply only under a
+  // condition. Definitions another one overrides do not contribute and are left alone.
+  const live = sources.filter((s) => s.role === 'winner' || s.role === 'conditional');
+  const shadowed = sources.filter((s) => s.role === 'shadowed');
+  const override = () => overrideSuggestion(option, fx, sources, files, opts);
+  if (!live.length) return refuse('manual', `no contributing definition of ${option} could be identified`, { proposal: proposal({ override: override() }) });
+
+  // The caller chose a definition that another one overrides: changing it cannot change the effective value.
+  if (source) {
+    const chosen = sources.find((s) => s.file === source.file && s.line === source.line);
+    if (chosen && chosen.role === 'shadowed') {
+      const by = live.map((w) => `${w.file}:${w.line} (${w.priorityLabel || w.priority})`).join(', ');
+      return refuse('blocked', `${source.file}:${source.line} is overridden by ${by}: editing it would leave the effective value of ${option} unchanged`, { proposal: proposal({ editInstead: live.map((w) => ({ file: w.file, line: w.line })), override: override() }) });
+    }
+  }
+
+  // Every contributing definition must be editable: inside the project, present, a single literal. Several definitions at the
+  // winning priority agree today and the module system rejects a mix, so they are all changed or none is. A conditional
+  // branch is edited only where it holds the weak literal; the verification then proves every branch is safe.
+  const working = { ...files };
+  const edits = [];
+  for (const w of live) {
+    if (!isRootRelativePath(w.file)) return refuse('manual', `the winning definition of ${option} is in ${w.file}, outside the project root, so it is not edited`, { proposal: proposal({ outsideRoot: w.file, override: override() }) });
+    if (typeof working[w.file] !== 'string') return refuse('manual', `the winning definition of ${option} is in ${w.file}, which is not in the supplied tree`, { proposal: proposal({ override: override() }) });
+    const r = literalEdit(w.file, working[w.file], w.line, option, fx, bad);
+    if (!r.ok) return refuse(/does not parse/.test(r.reason) ? 'blocked' : 'manual', r.reason, { proposal: proposal({ override: override() }) });
+    if (r.skip || (w.role === 'conditional' && bad && r.literal !== bad)) continue;
+    const prior = edits.find((e) => e.file === w.file);
+    if (prior) prior.after = r.after; else edits.push({ file: w.file, before: working[w.file], after: r.after, from: r.from, to: r.to, line: r.line });
+    working[w.file] = r.after;
+  }
+  if (!edits.length) return refuse('manual', `no contributing definition of ${option} holds the weak value, so there is nothing to edit`, { proposal: proposal({ override: override() }) });
+  return optionPlanResult(option, fx, edits, shadowed, bad);
+}
+
+function optionPlanResult(option, fx, edits, shadowed, bad = null) {
+  const first = edits[0];
+  const where = edits.map((e) => `${e.file}:${e.line}`).join(', ');
+  const multi = edits.length > 1;
+  const notes = [...fx.consequences];
+  if (shadowed.length) notes.push(`Weaker definitions of ${option} remain at ${shadowed.map((s) => `${s.file}:${s.line}`).join(', ')}; they are overridden and unchanged.`);
+  if (multi) notes.push(`${edits.length} files are edited together (${edits.map((e) => e.file).join(', ')}) because each holds a definition at the winning priority; undo restores all of them.`);
+  return {
+    ok: true, file: first.file, before: first.before, after: first.after,
+    edits: edits.map((e) => ({ file: e.file, before: e.before, after: e.after })),
+    ruleId: `nix-set-${option}`, label: 'FULL',
+    explanation: `${option} = ${first.from} -> ${first.to} at ${where}, the definition${multi ? 's' : ''} that win${multi ? '' : 's'} by priority.`,
+    consequences: notes, tier: TIERS.edit,
+    behavior: { kind: 'option', option, from: first.from, to: first.to, files: edits.map((e) => e.file) },
+    expectEffective: { option, value: literalValue(fx.to), ...(bad ? { bad: literalValue(bad) } : {}) },
+  };
 }
 
 function planTransportFix(finding, files) {
@@ -170,7 +278,7 @@ export function planNixFix(finding, files, opts = {}) {
   const r = finding.rule;
   if (r === 'nix-shell-injection' || r === 'nix-escape-wrong-context') return planShellFix(finding, files);
   if (r === 'nix-service-env-shell') return planEnvQuoteFix(finding, files);
-  if (OPTION_FIXES[r]) return planOptionFix(finding, files, OPTION_FIXES[r], opts.source || null);
+  if (OPTION_FIXES[r]) return planOptionFix(finding, files, OPTION_FIXES[r], opts.source || null, opts);
   if (TRANSPORT_RULES.has(r)) return planTransportFix(finding, files);
   if (MANUAL[r]) return { ok: false, status: 'manual', tier: TIERS.guidance, reason: 'moving a secret out of the store changes where the credential lives and who can read it: it needs a human migration, never an automatic rewrite', proposal: { steps: MANUAL[r], rotate: r !== 'nix-secret-log', manager: 'sops-nix or agenix' } };
   if (HASH_MANUAL.has(r)) return { ok: false, status: 'manual', tier: TIERS.blocked, reason: 'the correct hash or revision can only be obtained by fetching the source, which a scan never does; a placeholder hash would be a fabricated value', proposal: { steps: ['Run `nix-prefetch-url` / `nix store prefetch-file` (or build once with lib.fakeHash and read the reported hash) from a trusted machine.', 'Pin a full revision, not a branch.', 'Paste the real hash.'], neverDo: 'insert a made-up or all-zero hash' } };
@@ -193,16 +301,46 @@ export async function rescanNix(files) {
 }
 const matchKey = (f) => `${f.rule || f.cwe}|${f.subject || f.attrPath || ''}|${f.file}`;
 const syntaxGate = (plan) => {
-  const a = parseNix(plan.before, { file: plan.file }); const b = parseNix(plan.after, { file: plan.file });
-  const na = (a.errors || []).length, nb = (b.errors || []).length;
-  return { ok: !!b.ast && nb <= na, errorsBefore: na, errorsAfter: nb, detail: nb <= na ? 'no new syntax errors' : `${nb - na} new syntax error(s)` };
+  const edits = Array.isArray(plan.edits) && plan.edits.length ? plan.edits : [{ file: plan.file, before: plan.before, after: plan.after }];
+  let na = 0; let nb = 0; let ok = true;
+  for (const e of edits) {
+    const a = parseNix(e.before, { file: e.file }); const b = parseNix(e.after, { file: e.file });
+    na += (a.errors || []).length; nb += (b.errors || []).length;
+    if (!b.ast || (b.errors || []).length > (a.errors || []).length) ok = false;
+  }
+  return { ok, errorsBefore: na, errorsAfter: nb, detail: ok ? 'no new syntax errors' : `${nb - na} new syntax error(s)` };
 };
 
+/**
+ * The effective-configuration gate of an option fix. The rescan only proves a finding stopped being REPORTED, and an edit that
+ * leaves two equal-priority definitions disagreeing does that too (the module system then rejects the configuration). So the
+ * option is resolved again over the patched tree and must be a decided `set` value equal to the intended one.
+ */
+function makeEffectiveCheck(entry) {
+  return (plan, patched) => {
+    const want = plan.expectEffective;
+    if (!want) return { ok: true, ran: false, detail: 'not an option fix' };
+    const multi = Array.isArray(plan.edits) && plan.edits.length > 1;
+    if (!entry) return multi ? { ok: false, ran: false, detail: `no entry configuration was found to resolve ${want.option} over the patched tree, and ${plan.edits.length} files were edited` } : { ok: true, ran: false, detail: 'no entry configuration to resolve; the single definition was edited in place' };
+    const nixOnly = Object.fromEntries(Object.entries(patched).filter(([p, t]) => /\.nix$/.test(p) && typeof t === 'string'));
+    let res;
+    try { res = resolveNixosConfig({ entry, files: nixOnly }).lookup(want.option); } catch (e) { return { ok: false, ran: true, detail: `the patched configuration could not be resolved (${e.message})` }; }
+    // A value that depends on a condition has no single answer; the fix holds when NO branch can still produce the weak value.
+    if (res && res.status === 'conditional' && Array.isArray(res.possibleValues) && res.possibleValues.length && want.bad !== undefined) {
+      if (res.possibleValues.includes(want.bad)) return { ok: false, ran: true, option: want.option, detail: `${want.option} can still be ${JSON.stringify(want.bad)} under some condition after the patch` };
+      return { ok: true, ran: true, option: want.option, possibleValues: res.possibleValues, detail: `${want.option} is conditional and no branch can produce ${JSON.stringify(want.bad)} (possible: ${res.possibleValues.map((v) => JSON.stringify(v)).join(', ')})` };
+    }
+    if (!res || res.status !== 'set') return { ok: false, ran: true, option: want.option, status: res && res.status, detail: `${want.option} is "${res && res.status}" after the patch${res && res.reason ? ` (${res.reason})` : ''}, not a decided value` };
+    if (res.value !== want.value) return { ok: false, ran: true, option: want.option, detail: `${want.option} is ${JSON.stringify(res.value)} after the patch, not ${JSON.stringify(want.value)}` };
+    return { ok: true, ran: true, option: want.option, value: res.value, detail: `${want.option} resolves to ${JSON.stringify(res.value)} over the patched tree` };
+  };
+}
+
 /** Validate (and optionally apply) a fix through the shared lifecycle. */
 export async function validateNixFix(finding, o) {
   const plan = planNixFix(finding, o.files, o);
   if (!plan.ok) return { status: plan.status || 'unsupported', applied: false, tier: plan.tier, reason: plan.reason, proposal: plan.proposal || null, ...plan };
-  const res = await runFixLifecycle({ plan, files: o.files, finding, matchKey, rescan: o.rescan || rescanNix, syntax: syntaxGate, behaviorCheck: o.behaviorCheck, witness: o.witness, requireWitness: o.requireWitness, apply: o.apply, root: o.root });
+  const res = await runFixLifecycle({ plan, files: o.files, finding, matchKey, rescan: o.rescan || rescanNix, syntax: syntaxGate, behaviorCheck: o.behaviorCheck, effectiveCheck: makeEffectiveCheck(entryOf(o.files, o)), writeFile: o.writeFile, witness: o.witness, requireWitness: o.requireWitness, apply: o.apply, root: o.root });
   return { ...res, consequences: plan.consequences || [], tier: res.status === 'blocked' ? TIERS.blocked : plan.tier, explanation: plan.explanation };
 }
 

package/src/language/nix-ir.js

@@ -165,21 +165,23 @@ class IrBuilder {
     if (depth > this.b.maxIrDepth) { this.budget('maxIrDepth'); return []; }
     switch (n.type) {
       case 'attrset': return this.flattenAttrs(n, ctx, depth);
+      // `evalWrap` remembers the OUTERMOST let/with that wraps a leaf value (through nothing but let, with, assert and parentheses), so
+      // the module resolver can evaluate the whole wrapper with correct scoping instead of the bare body. Any other combinator clears it.
       case 'let': {
         const out = this.recordScoped(n, 'let', ctx);
-        return out.concat(this.flatten(n.body, ctx, depth + 1));
+        return out.concat(this.flatten(n.body, { ...ctx, evalWrap: ctx.evalWrap || { span: n.span, withs: ctx.withs } }, depth + 1));
       }
-      case 'with': return this.flatten(n.body, { ...ctx, withs: [...ctx.withs, this.snippet(n.env)] }, depth + 1);
-      case 'assert': return this.flatten(n.body, ctx, depth + 1);
+      case 'with': return this.flatten(n.body, { ...ctx, withs: [...ctx.withs, this.snippet(n.env)], evalWrap: ctx.evalWrap || { span: n.span, withs: ctx.withs } }, depth + 1);
+      case 'assert': return this.flatten(n.body, { ...ctx, evalWrap: ctx.evalWrap || { span: n.span, withs: ctx.withs } }, depth + 1);
       case 'if': {
         const c = { kind: 'if', span: n.cond.span, text: this.snippet(n.cond) };
-        return this.flatten(n.then, { ...ctx, conditions: [...ctx.conditions, { ...c, branch: 'then' }] }, depth + 1)
-          .concat(this.flatten(n.else, { ...ctx, conditions: [...ctx.conditions, { ...c, branch: 'else' }] }, depth + 1));
+        return this.flatten(n.then, { ...ctx, evalWrap: null, conditions: [...ctx.conditions, { ...c, branch: 'then' }] }, depth + 1)
+          .concat(this.flatten(n.else, { ...ctx, evalWrap: null, conditions: [...ctx.conditions, { ...c, branch: 'else' }] }, depth + 1));
       }
       case 'binop':
         if (n.op === '//') {
-          const left = this.flatten(n.left, ctx, depth + 1);
-          const right = this.flatten(n.right, ctx, depth + 1);
+          const left = this.flatten(n.left, { ...ctx, evalWrap: null }, depth + 1);
+          const right = this.flatten(n.right, { ...ctx, evalWrap: null }, depth + 1);
           const over = new Set();
           for (const r of right) if (r.path.length > ctx.prefix.length && r.path[ctx.prefix.length] !== null) over.add(r.path[ctx.prefix.length]);
           const kept = [];
@@ -196,17 +198,17 @@ class IrBuilder {
         const name = calleeName(fn);
         if (name === 'mkMerge' && args.length === 1 && unparen(args[0]).type === 'list') {
           let out = [];
-          for (const it of unparen(args[0]).items) out = out.concat(this.flatten(it, { ...ctx, merge: 'mkMerge' }, depth + 1));
+          for (const it of unparen(args[0]).items) out = out.concat(this.flatten(it, { ...ctx, evalWrap: null, merge: 'mkMerge' }, depth + 1));
           return out;
         }
         if (COND_WRAPPERS.has(name) && args.length === 2) {
           const cond = { kind: name, span: args[0].span, text: this.snippet(args[0]), branch: 'then' };
-          return this.flatten(args[1], { ...ctx, conditions: [...ctx.conditions, cond] }, depth + 1);
+          return this.flatten(args[1], { ...ctx, evalWrap: null, conditions: [...ctx.conditions, cond] }, depth + 1);
         }
         if (PRIORITY_WRAPPERS.has(name) && args.length >= 1) {
           // mkOverride carries its numeric priority as the first argument; keep it so the module resolver can rank it
           const priorityArg = name === 'mkOverride' && args.length >= 2 ? this.summarize(args[0]) : null;
-          return this.flatten(args[args.length - 1], { ...ctx, priority: name, priorityArg }, depth + 1);
+          return this.flatten(args[args.length - 1], { ...ctx, evalWrap: null, priority: name, priorityArg }, depth + 1);
         }
         // a file that is just `mkDerivation { ... }` / `callPackage ./x.nix { ... }`: the last attrset argument is the configuration
         if (!ctx.prefix.length && args.length) {
@@ -229,6 +231,8 @@ class IrBuilder {
       withs: ctx.withs, overridden: false, update: false, callee: ctx.callee || null,
     });
     if (rec && ctx.priorityArg) rec.priorityArg = ctx.priorityArg;
+    if (rec && ctx.evalWrap) { rec.evalSpan = ctx.evalWrap.span; rec.evalWiths = ctx.evalWrap.withs; }
+    if (rec && ctx.inRec) rec.inRec = true;
     if (rec && n.type === 'lambda') this.noteBoundaryLambda(n, ctx);
     return rec ? [rec] : [];
   }
@@ -262,7 +266,7 @@ class IrBuilder {
       if (dynamic) {
         for (const s of b.path) if (s.kind !== 'static') this.gap('dynamic-attribute', `attribute name computed at evaluation time (${this.snippet({ start: s.span.startOffset, end: s.span.endOffset }) || 'interpolated'})`, s.span);
       }
-      const sub = { ...ctx, prefix: [...ctx.prefix, ...segs], span: b.span, origin: 'attr' };
+      const sub = { ...ctx, prefix: [...ctx.prefix, ...segs], span: b.span, origin: 'attr', evalWrap: null, inRec: ctx.inRec || !!n.rec };
       out = out.concat(this.flatten(b.value, sub, depth + 1));
     }
     return out;
@@ -280,7 +284,7 @@ class IrBuilder {
         continue;
       }
       const { path: segs, dynamic } = staticPath(b.path);
-      const r = this.addBinding({ path: segs, pathText: segs.map((p) => (p === null ? '${...}' : p)).join('.'), value: this.summarize(b.value), span: b.span, valueSpan: b.value.span, origin: 'let', scope, dynamic, conditions: ctx.conditions, priority: null, merge: null, withs: ctx.withs, overridden: false, update: false });
+      const r = this.addBinding({ letSpan: n.span, path: segs, pathText: segs.map((p) => (p === null ? '${...}' : p)).join('.'), value: this.summarize(b.value), span: b.span, valueSpan: b.value.span, origin: 'let', scope, dynamic, conditions: ctx.conditions, priority: null, merge: null, withs: ctx.withs, overridden: false, update: false });
       if (r) out.push(r);
       if (dynamic) this.gap('dynamic-attribute', 'dynamic attribute name in let binding', b.span);
     }

package/src/language/nix-sca.js

@@ -20,7 +20,9 @@
 
 import { AdvisoryDb, matchComponent as matchHackage, reachability as hackageReachability, licensePolicy, hackagePurl, normalizeAdvisory } from './haskell-sca.js';
 import { parseVersion as parsePvp } from './haskell-manifests.js';
+import { advisorySeverity, NO_RATING_BASIS } from './cvss.js';
 import { parseNix } from './nix-parser.js';
+import { cpeKey } from './nix-advisory-feed.js';
 
 export const NIX_SCA_VERSION = 'nix-sca/1';
 const HEX40 = /^[0-9a-f]{40}$/i;
@@ -59,16 +61,18 @@ export function compareUpstream(a, b) {
 // ── advisories ───────────────────────────────────────────────────────────────
 const sha = (s) => String(s || '').toLowerCase().replace(/^sha256[-:]/, '');
 function eventsToRanges(events) {
-  const out = []; let lo = null;
+  // `introduced_excluding` is not an OSV event: it carries an exclusive start bound (the NVD live feed has them), so 8.0 is not in "after 8.0".
+  const out = []; let lo = null; let loExc = false;
   for (const e of events || []) {
-    if ('introduced' in e) lo = e.introduced === '0' ? null : e.introduced;
-    else if ('fixed' in e) { out.push({ lo, hi: e.fixed, hiInc: false }); lo = null; }
-    else if ('last_affected' in e) { out.push({ lo, hi: e.last_affected, hiInc: true }); lo = null; }
+    if ('introduced' in e) { lo = e.introduced === '0' ? null : e.introduced; loExc = false; }
+    else if ('introduced_excluding' in e) { lo = e.introduced_excluding; loExc = true; }
+    else if ('fixed' in e) { out.push({ lo, loExc, hi: e.fixed, hiInc: false }); lo = null; loExc = false; }
+    else if ('last_affected' in e) { out.push({ lo, loExc, hi: e.last_affected, hiInc: true }); lo = null; loExc = false; }
   }
-  if (events && events.some((e) => 'introduced' in e) && (lo !== null || !out.length || !events.some((e) => 'fixed' in e || 'last_affected' in e))) out.push({ lo, hi: null, hiInc: false });
+  if (events && events.some((e) => 'introduced' in e || 'introduced_excluding' in e) && (lo !== null || !out.length || !events.some((e) => 'fixed' in e || 'last_affected' in e))) out.push({ lo, loExc, hi: null, hiInc: false });
   return out;
 }
-const inRange = (v, r) => (r.lo === null || compareUpstream(v, r.lo) >= 0) && (r.hi === null || (r.hiInc ? compareUpstream(v, r.hi) <= 0 : compareUpstream(v, r.hi) < 0));
+const inRange = (v, r) => (r.lo === null || (r.loExc ? compareUpstream(v, r.lo) > 0 : compareUpstream(v, r.lo) >= 0)) && (r.hi === null || (r.hiInc ? compareUpstream(v, r.hi) <= 0 : compareUpstream(v, r.hi) < 0));
 
 /** Normalize a non-Hackage OSV-style record into what Nix matching needs. */
 export function normalizeGenericAdvisory(rec) {
@@ -86,12 +90,15 @@ export function normalizeGenericAdvisory(rec) {
       fixPatches: ((a.database_specific && a.database_specific.fix_patches) || (rec.database_specific && rec.database_specific.fix_patches) || []).map((p) => ({ name: p.name || null, sha256: p.sha256 ? sha(p.sha256) : null })),
     });
   }
-  return { id: rec.id, ids: [rec.id, ...aliases], cves: [rec.id, ...aliases].filter((x) => /^CVE-/.test(x)), summary: rec.summary || '', withdrawn: rec.withdrawn || null, published: rec.published || null, modified: rec.modified || null, references: (rec.references || []).map((r) => r.url).filter(Boolean), affected };
+  return { id: rec.id, severityInfo: advisorySeverity(rec), ids: [rec.id, ...aliases], cves: [rec.id, ...aliases].filter((x) => /^CVE-/.test(x)), summary: rec.summary || '', withdrawn: rec.withdrawn || null, published: rec.published || null, modified: rec.modified || null, references: (rec.references || []).map((r) => r.url).filter(Boolean), affected };
 }
 
 export class NixAdvisoryData {
-  constructor({ records = [], hackage = null, source = 'records', generatedAt = null, now = Date.now(), maxAgeDays = 30 } = {}) {
-    this.source = source; this.generatedAt = generatedAt; this.maxAgeDays = maxAgeDays;
+  constructor({ records = [], hackage = null, source = 'records', generatedAt = null, now = Date.now(), maxAgeDays = 30, covered = null } = {}) {
+    this.source = source; this.generatedAt = generatedAt; this.maxAgeDays = maxAgeDays; this.now = now;
+    // `covered` is {'vendor:product': ISO time that CPE identity was last fully read from the live feed}. null means the snapshot makes no
+    // per-identity claim (a hand-built or operator-pinned snapshot) and is matched exactly as it always was.
+    this.covered = covered && typeof covered === 'object' ? covered : null;
     this.records = records.map(normalizeGenericAdvisory).filter(Boolean);
     this.hackage = hackage;                      // an AdvisoryDb (HS-009) for wrapped Haskell packages
     const gen = generatedAt ? Date.parse(generatedAt) : NaN;
@@ -99,10 +106,17 @@ export class NixAdvisoryData {
     this.stale = this.ageDays === null ? true : this.ageDays > maxAgeDays;
     this.feed = { source, generatedAt, status: this.stale ? 'stale-cache' : 'current', records: this.records.length };
   }
+  /** 'covered' | 'uncovered' | 'stale' for a CPE identity ('vendor:product'); always 'covered' when the snapshot makes no per-identity claim. */
+  cpeCoverage(key) {
+    if (!this.covered) return 'covered';
+    const t = Date.parse(this.covered[key]);
+    if (!Number.isFinite(t)) return 'uncovered';
+    return (this.now - t) / 86400000 > this.maxAgeDays ? 'stale' : 'covered';
+  }
 }
 
 // ── upstream identity ────────────────────────────────────────────────────────
-const HASKELL_ENV_HINTS = ['libraryHaskellDepends', 'setupHaskellDepends', 'executableHaskellDepends', 'isLibrary', 'isExecutable', 'enableSeparateDataOutput', 'compilerName', 'enableLibraryProfiling'];
+export const HASKELL_ENV_HINTS = ['libraryHaskellDepends', 'setupHaskellDepends', 'executableHaskellDepends', 'isLibrary', 'isExecutable', 'enableSeparateDataOutput', 'compilerName', 'enableLibraryProfiling'];
 function purlFromUrl(u) {
   const m = /^https?:\/\/(?:www\.)?github\.com\/([^/]+)\/([^/#?]+?)(?:\.git)?(?:\/|$)/.exec(u || '');
   if (m) return { purl: `pkg:github/${m[1].toLowerCase()}/${m[2].toLowerCase()}`, host: 'github' };
@@ -125,7 +139,7 @@ export function upstreamIdentity(node, drvEnv, meta, overlay) {
   const ids = meta && meta.identifiers ? meta.identifiers : null;
   if (ids && typeof ids.purl === 'string') cands.push({ purl: ids.purl, authority: 'explicit', basis: 'meta.identifiers.purl' });
   const cpes = ids ? [].concat(ids.cpe || [], ids.possibleCPEs || [], ids.v1 && ids.v1.cpeParts ? [ids.v1.cpeParts] : []).filter(Boolean) : [];
-  const cpeStrings = cpes.map((c) => (typeof c === 'string' ? c : (c.vendor && c.product ? `${c.vendor}:${c.product}` : null))).filter(Boolean);
+  const cpeStrings = cpes.map(cpeKey).filter(Boolean);   // 'vendor:product' from a full CPE string or a {vendor, product} part; malformed values are dropped
   const uniqueCpe = [...new Set(cpeStrings)];
   if (uniqueCpe.length === 1 && ids && ids.cpe && !ids.possibleCPEs) cands.push({ cpe: uniqueCpe[0], authority: 'explicit', basis: 'meta.identifiers.cpe' });
   else for (const c of uniqueCpe) cands.push({ cpe: c, authority: 'candidate', basis: uniqueCpe.length > 1 ? 'one of several possible CPEs' : 'possible CPE' });
@@ -139,6 +153,32 @@ export function upstreamIdentity(node, drvEnv, meta, overlay) {
   return { ...base, candidates: uniq, ambiguous: distinctTargets.size > 1 || (strong.length === 0 && uniq.length > 1) || uniq.some((c) => c.authority === 'candidate'), authority: strong.length && distinctTargets.size === 1 && !uniq.some((c) => c.authority === 'candidate') ? strong[0].authority : (uniq[0] ? 'name-only' : 'none'), haskell: !!isHs };
 }
 
+/**
+ * The upstream identities of every dependency in a closure, in the form the matcher will use, so a pre-scan step can ask a live feed
+ * about exactly what the matcher will look up. `cpes` holds 'vendor:product' keys (explicit and candidate); a component with none is
+ * listed in `withoutCpe` so the caller can say what a CPE-keyed feed cannot cover.
+ */
+export function closureIdentities({ closure, drvEnv = {}, meta = {}, overlays = {} } = {}) {
+  const nodes = (closure && closure.nodes) || [];
+  const roots = new Set((closure && closure.roots) || []);
+  const subjects = new Map();
+  for (const n of nodes) {
+    if (n.kind !== 'output' || roots.has(n.id)) continue;
+    const key = n.deriver || n.id;
+    if (!subjects.has(key)) subjects.set(key, { drv: n.deriver || null, node: n });
+    const s = subjects.get(key);
+    if (n.outputName === 'out' || (s.node.outputName !== 'out' && n.scopes.includes('runtime'))) s.node = n;
+  }
+  const cpes = new Set(); const withoutCpe = [];
+  for (const s of subjects.values()) {
+    const node = s.node;
+    const ident = upstreamIdentity(node, (s.drv && drvEnv[s.drv]) || null, meta[node.pname] || meta[node.storeName] || null, overlays[node.pname] || null);
+    const mine = ident.candidates.filter((c) => c.cpe).map((c) => c.cpe);
+    if (mine.length) mine.forEach((k) => cpes.add(k)); else if (node.pname) withoutCpe.push(node.pname);
+  }
+  return { cpes: [...cpes].sort(), withoutCpe: [...new Set(withoutCpe)].sort() };
+}
+
 // ── overlays and patches ─────────────────────────────────────────────────────
 const segName = (s) => (s && s.kind === 'static' ? s.name : null);
 const unparen = (n) => { let x = n; while (x && x.type === 'paren') x = x.expr; return x; };
@@ -280,9 +320,14 @@ export function matchNixVulnerabilities(opts = {}) {
     if (!data) { push({ status: 'unknown', reason: 'no advisory feed was supplied: absence of a match is not a clean result' }); summary.unmapped++; continue; }
     if (ident.versionRejected && !ident.haskell && !(node.upstream && node.upstream.rev)) { push({ status: 'unknown', reason: `the version cannot be queried: ${ident.versionRejected}` }); summary.unmapped++; continue; }
 
-    let matched = false; let mapped = false;
+    let matched = false; let mapped = false; let hackageGap = null;
     // Hackage (wrapped Haskell packages): reuse the PVP matcher
-    if (ident.haskell && data.hackage && ident.version && parsePvp(ident.version)) {
+    if (ident.haskell && data.hackage && ident.version && parsePvp(ident.version) && data.hackage.coverage(node.pname) !== 'covered') {
+      // A feed that never looked up this package (or looked too long ago) says nothing about it: that is unknown, not "no advisory matches".
+      hackageGap = data.hackage.coverage(node.pname) === 'stale'
+        ? 'the Hackage advisory feed last covered this package longer ago than its age limit: the absence of a match is not a clean result'
+        : 'the Hackage advisory feed never covered this package: the absence of a match is not a clean result';
+    } else if (ident.haskell && data.hackage && ident.version && parsePvp(ident.version)) {
       mapped = true;
       for (const { adv, aff } of data.hackage.forPackage(node.pname)) {
         if (adv.withdrawn) continue;
@@ -292,11 +337,12 @@ export function matchNixVulnerabilities(opts = {}) {
         const st = decide(r, pe, ident);
         matched = true;
         if (haskellUsage) { const rr = hackageReachability(node.pname, haskellUsage.imports, haskellUsage.callees, symbols[adv.id] || null); tiers.reachability = { import: rr.import, function: rr.function, basis: rr.reason }; }
-        findings.push(finding({ ...base, tiers: { ...tiers } }, { id: adv.canonicalId, ids: adv.ids, summary: adv.summary, cves: adv.cveAliases }, st.status, st.reason, { source: data.hackage.source, ecosystem: 'Hackage', fixedIn: aff.fixedIn, patchEvidence: pe }, { kev, epss }));
+        findings.push(finding({ ...base, tiers: { ...tiers } }, { id: adv.canonicalId, ids: adv.ids, summary: adv.summary, cves: adv.cveAliases, severityInfo: adv.severityInfo }, st.status, st.reason, { source: data.hackage.source, ecosystem: 'Hackage', fixedIn: aff.fixedIn, patchEvidence: pe }, { kev, epss }));
       }
     }
     // generic records by PURL / CPE; only authoritative identities are matched, candidates are leads
     for (const adv of data.records) {
+      if (adv.withdrawn) continue;
       for (const aff of adv.affected) {
         const target = ident.candidates.find((c) => (c.purl && aff.purl && c.purl === aff.purl) || (c.cpe && aff.cpe && c.cpe === aff.cpe) || (c.name && aff.name && !aff.purl && !aff.cpe && c.name === aff.name && c.authority === 'name-only') || (c.ecosystem === 'Hackage' && aff.ecosystem === 'Hackage' && c.name === aff.name));
         if (!target) continue;
@@ -315,7 +361,22 @@ export function matchNixVulnerabilities(opts = {}) {
         findings.push(finding({ ...base, tiers: { ...tiers } }, adv, st.status, st.reason, { source: data.source, ecosystem: aff.ecosystem, fixedIn: aff.fixedIn, patchEvidence: pe, identityBasis: target.basis, identityAuthority: target.authority }, { kev, epss }));
       }
     }
+    // A feed that records coverage per CPE identity can only vouch for the identities it actually read. Without a covered, explicit,
+    // unambiguous CPE identity, "no match" says nothing, so it is unknown (never not-affected).
+    let covGap = null;
+    if (!hackageGap && data.covered) {
+      const cpeCands = ident.candidates.filter((c) => c.cpe);
+      const firm = !ident.ambiguous ? cpeCands.find((c) => c.authority === 'explicit') : null;
+      if (firm) {
+        const cv = data.cpeCoverage(firm.cpe);
+        if (cv === 'covered') mapped = true;
+        else covGap = cv === 'stale' ? `the live advisory feed last read ${firm.cpe} longer ago than its age limit: the absence of a match is not a clean result` : `the live advisory feed never read ${firm.cpe} (it was not queried or the query did not complete): the absence of a match is not a clean result`;
+      } else if (!matched && !cpeCands.length) covGap = 'the live advisory feed is keyed by CPE and this component declares no CPE identity (a source URL or purl alone is not something it can look up): the absence of a match is not a clean result';
+    }
     if (matched) summary.matched++;
+    if (covGap) { if (!matched) summary.unmapped++; push({ status: 'unknown', reason: covGap }, { identityMapped: false, feedCoverage: 'incomplete' }); }
+    else if (matched) { /* findings above are the result */ }
+    else if (hackageGap) { summary.unmapped++; push({ status: 'unknown', reason: hackageGap }, { identityMapped: false, feedCoverage: 'incomplete' }); }
     else if (mapped) { summary.mappedNoMatch++; push({ status: 'not-affected', reason: 'mapped to an upstream identity and no advisory in the supplied feed matches this version' }, { identityMapped: true }); }
     else { summary.unmapped++; push({ status: 'unknown', reason: ident.ambiguous ? 'the upstream identity is ambiguous: no verdict' : 'the upstream identity could not be mapped to anything an advisory is keyed by' }, { identityMapped: false }); }
   }
@@ -334,10 +395,14 @@ function finding(base, adv, status, reason, extra, { kev, epss }) {
   const kevHit = cves.length ? (kev ? cves.some((c) => kev.has(c)) : 'unknown') : 'not-applicable';
   const ep = cves.map((c) => epss && epss[c]).filter((x) => typeof x === 'number');
   const level = { affected: 'high', 'possibly-affected': 'medium', candidate: 'low', 'backported-verified': 'info', fixed: 'info', unknown: 'low', 'not-affected': 'info' }[status] || 'low';
+  // The advisory's own rating applies only where the package is judged vulnerable; the other statuses keep their fixed,
+  // lower levels (a verified backport must never be raised by the upstream score).
+  const sev = adv.severityInfo || { level: null, score: null, basis: NO_RATING_BASIS };
+  const rated = !!sev.level && (status === 'affected' || status === 'possibly-affected');
   return {
     type: 'vulnerable_dep', ecosystem: 'nix', language: 'nix', capability: 'sca', analysisKind: 'application', evidenceKind: 'closure',
     name: base.name, version: base.version, osvId: adv.id, ids: adv.ids || [adv.id], cveAliases: cves, summary: adv.summary || '',
-    status, matchStatus: status, matchReason: reason, severity: level, severityBasis: 'the advisory carries no severity rating',
+    status, matchStatus: status, matchReason: reason, severity: rated ? sev.level : level, severityBasis: rated ? sev.basis : sev.level ? `the match status "${status}" fixes this level; the advisory rating (${sev.basis}) is not applied` : sev.basis, ...(rated ? { severityScore: sev.score } : {}),
     nixBuild: base.nixBuild, identity: base.identity, tiers: base.tiers, feed: base.feed,
     kev: kevHit, epss: ep.length ? Math.max(...ep) : 'unknown',
     fixedIn: extra.fixedIn || [], patchEvidence: extra.patchEvidence || { verified: null, claims: [] }, dataSource: { feed: extra.source || base.feed.source, ecosystem: extra.ecosystem || null, identityBasis: extra.identityBasis || null, identityAuthority: extra.identityAuthority || null, feedStatus: base.feed.status },