@clear-capabilities/agentic-security-scanner 0.158.0 → 0.160.0

package/CHANGELOG.md

@@ -9,6 +9,45 @@
 > make the history less accurate, not more.
 
 
+## 0.160.0 - a faster, sturdier release path: a parallel hosted gate, a one-command release orchestrator, and fixes for the failing workflow runs
+
+**Measured baseline, before this release** (from the real runs of 0.157.x to 0.159.0): the hosted release workflow took about 25 minutes, of which 25.1 were one sequential gate step (`npm test` 14.9 min, then roughly 10 minutes of benchmarks one after another; publishing itself took seconds); PR CI took about 13.5 minutes (57 once, when a job hung); npm showed the new version 5 to 6 minutes after the workflow finished (55 minutes once); a local release gate took about 35 minutes. This release is the first to carry the changes below, so the numbers for it are in the release notes of the next one, measured, not predicted.
+
+- **The hosted gate runs in parallel.** The release workflow's single gate job is now seven legs (four test shards, two benchmark groups, and everything else), and `publish` depends on all of them. Only `publish` holds the OIDC token. Every check that ran before still runs, with caching off: the benchmark groups and the `rest` group are defined in one place and `rest` is the complement of the named groups, so a new check can only land in a group that runs, never be dropped; a test proves the groups plus `rest` exactly partition the planned checks and that every test file runs in exactly one shard. A partial run says so and can never print the full-pass line. The design target is a gate of roughly 10 to 12 minutes instead of 25; whether it gets there on hosted runners is not yet measured.
+- **`scripts/ship.mjs` (also `npm run ship`)** takes a branch from push to npm in one command: pull request, blocking checks, merge, release gate, tag, hosted workflow, npm check, each step starting the moment the previous one is ready. It re-runs a CI job that has hung far past any healthy run or that failed in setup (a real gate failure is never re-run, even when fail-fast cancelled its sibling legs), and when the merge commit's tree is byte-identical to the verified PR head it releases the PR head, which skips the second CI wait and the second full verification. It never bypasses a gate. `--resume` continues an interrupted run without repeating a phase.
+- **The local gate catches a stale bundle.** `bundle-integrity` only compares the bundle to its own sidecar, so editing `src/` after the last build passed the local gate and failed hosted CI (0.159.0, PR #66). A new `bundle-matches-source` check rebuilds and diffs exactly as CI does, restoring `dist/` if it differs.
+- **The failing workflow runs are fixed.** The Scanner F1 benchmark had failed on every run because its job ran the full suite without relaxing the runner's user-namespace restriction (seven sandbox tests failed); it now has the step `ci.yml`'s test job has, and a test checks that every workflow job that runs the full suite does. The PNG export tests killed headless Chrome at 20 seconds, which a large render on a loaded runner can exceed; Chrome renders now get 120 seconds.
+- **Not verified here:** the parallel gate has not yet run as real CI jobs, and `ship.mjs` has not yet driven a real release (its logic is covered by tests against a scripted git and gh).
+
+## 0.159.0 - Haskell and Nix/NixOS: advisory severity, safer auth guards, CPP and Template Haskell, a wider Nix evaluator, multi-file fixes, a live nixpkgs feed, and the first real-project measurement
+
+This release was built by seven parallel workstreams and integrated afterwards; each was tested in both directions with fresh fixtures and deliberate-breakage checks. The measurement below found real defects, and fixing them is most of what changed under it.
+
+**Found by measuring the live Hackage feed on real projects (`bench/live-feed/`, results in `RESULTS.md`).** 56 real projects (Hackage tarballs and tagged application releases, some with a freeze file, a stack lock or a generated cabal plan) against the real OSV service: 3,717 package lookups, 0 uncovered and 0 failed record fetches; lookup step median 0.6 s; a second run inside the TTL made 0 requests; with `--no-network` or `AGENTIC_SECURITY_OFFLINE=1` it made 0 requests and reported `partial` on all 56. A sample of 34 matched rows was adjudicated against the real advisories: 26 of 26 affected or possibly-affected claims were judged correct (95% interval 0.868 to 1.0). **Those labels are the harness model's, not a human's**, the projects were chosen by availability not at random, and the live service's failure paths (a failed record, pagination, rate limiting) were not exercised by real traffic. The run exposed seven defects, all fixed with tests that fail without the fix:
+- **Offline mode still sent registry requests.** `--no-network` and `AGENTIC_SECURITY_OFFLINE=1` still queried the npm, PyPI, crates.io and Maven registries for package metadata (7,576 requests over 16 of 56 projects). This was not Haskell-specific. It no longer touches the network for it.
+- `build-depends: aeson` with no bound means any version, but was reported `unknown` (159 of 684 rows in the first pass); it now matches as a declared unbounded range.
+- A freeze file written for one builder was applied to the whole repository, and a project's own package (aeson's test suite depending on aeson) was counted as a dependency of itself; an unbounded use in one component ignored the bounds set elsewhere in the same manifest.
+- The `hackage-live` scan-health entry was hard-coded to "not selected", and `matchStatus`/`matchReason`/`declaredRange` were dropped from the scan result, so `possibly-affected` read like `affected`.
+Not fixed, and listed in `RESULTS.md`: distinct declared ranges are collapsed by name and scope; `cabal.project` `constraints:` and `allow-newer` are not applied; compiler-provided `ghc-component` rows are 313 of 479 affected rows; and deep scans of three large projects (pandoc, cabal-install) did not finish within ten minutes.
+
+**Haskell**
+- **The advisory's own severity.** Findings use the CVSS v3.x base score from the record (a new calculator, `cvss.js`), else a named `database_specific.severity`, else `medium` with the basis stated. Version 4 vectors and malformed ones keep `medium` and say why. The Nix matcher uses it for affected packages only; a fixed or backport-verified one is never raised.
+- **A named guard must stop the handler.** A Scotty `status status401` only sets the code, so a shared `requireAuth` that never calls `finish`/`raise` no longer counts as a guard. Previously only the newer inline check had that requirement.
+- **Inline guards for WAI, Servant and Yesod** (credential read, then a rejection that ends the handler). **Disclosed limit:** for those three the IR reports a tail call at the enclosing line, so order is judged on the credential read against the first sensitive operation, not on the rejection. A handler that reads the credential, writes, and only then rejects is credited. This is pinned in a test and described in the guide; Scotty does not have this limit.
+- **CPP and Template Haskell.** A conditional the file, a project-stated compiler pin or the cabal bounds can decide keeps only the live branch (same-length blanking, so locations stay exact); an undecidable one keeps both. A declaration-level splice from a known generator (lens, aeson, safecopy, persistent, acid-state) with only name quotes, literals and documented settings is an analysed-with-a-stated-assumption boundary instead of an opaque one; `runIO`, `embedFile`, user splices and variable arguments stay opaque. Inert quasi-quotes (`[r|...|]`, and `[i|...|]`/`[here|...|]` with no interpolation marker) read as strings. Everything unsafe or undecidable behaves exactly as before.
+
+**Nix and NixOS**
+- **A wider option evaluator** (`nixos-eval-forms.js`): `let`, `with`, `if`, lambdas, `++`, `//`, integer operators, string interpolation of known parts and a closed allow-list of `lib` functions. Anything unknown makes the whole value unknown. Measured on every non-flake `.nix` file under the examples, test fixtures and test corpora (each as its own entry): 711 options moved from unknown to known, none moved the other way and no known value changed. That corpus is synthetic, so the figure shows the evaluator widening, not accuracy on real configurations.
+- **Multi-file fixes verified on the effective configuration.** A fix edits every contributing definition of an option, applies all files atomically with backups (a failed write rolls the others back), records one history entry per file, and undoes the group as a unit. A winner outside the project root, or not a single literal, is refused with an override suggestion that is never applied. A definition overridden by something stronger is refused at planning. This changes one behaviour: choosing a shadowed definition used to be caught by the rescan, and is now refused earlier with the winner named.
+- **An opt-in live nixpkgs feed** (`AGENTIC_SECURITY_NIX_ADVISORIES_LIVE=1`) from the NVD CVE API 2.0, keyed by the CPE a package declares; same contract as the Hackage feed (off by default, offline wins, a pinned snapshot is never refreshed over, operator-only snapshot, per-identity coverage so an unread identity is unknown and never clean, bounded and validated wire data). NVD allows 5 requests per 30 seconds without a key, so requests are spaced 6.5 s (0.7 s with `AGENTIC_SECURITY_NVD_API_KEY`) and capped per scan. It does not cover identities without a CPE, products with more than 6,000 CVEs, or OS and hardware conditions, and has been exercised only against a fake feed plus a few polite live requests. A new operator-only `AGENTIC_SECURITY_NIX_META` supplies the package metadata that carries those identities.
+
+**Process**
+- **A per-check cache in the pre-push gate**, keyed on a content digest of every file the check can read, its script, the bundle, the Node version and the environment, signed with the per-install key; a failing result is never cached, `--no-cache` and CI always run everything, and a hit is printed. It saves time across commits only for four cheap benches, so the full pass is not much shorter. The change was tested with injected checks and on the real cheap benches, not through a full pass; the release gate for this version was run with `--no-cache`.
+- **CI hang protection:** timeouts on every job and network step, bounded retries for downloads (the Neovim step once hung 55 minutes).
+- **The emulated aarch64 NixOS check** now has bounded waits, more vCPUs and memory, a timeout scale and one visible automatic retry that keeps the first failure's log. **This is not verified here (Nix is not installed) and is not claimed fixed;** see CLAUDE.md for how to measure it in CI.
+
+This entry makes no claim about precision for the fixes above (the unseen set they came from is consumed, so a new number needs a fresh one) and none about how many requirements are verified.
+
 ## 0.158.0 - live Hackage advisories (opt in), and the detection gaps the second unseen set found
 
 Two things, both in the Haskell and Nix/NixOS work.

package/dist/1919.index.js

@@ -292,11 +292,14 @@ async function codeActionsFor(params) {
     let prev;
     try { prev = await (0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.languageFixPreview)(f, files); } catch (e) { prev = { ok: false, reason: String((e && e.message) || e) }; }
     if (prev && prev.ok && prev.file) {
-      const target = pathToUri(node_path__WEBPACK_IMPORTED_MODULE_3__.join(_rootDir, prev.file));
+      // A fix that spans several files (the winning definitions of one option) is ONE workspace edit over all of them: offering
+      // only the first file would leave the configuration in a state the verification never saw.
+      const changes = {};
+      for (const e of (prev.edits || [{ file: prev.file, before: prev.before, after: prev.after }])) changes[pathToUri(node_path__WEBPACK_IMPORTED_MODULE_3__.join(_rootDir, e.file))] = [(0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.minimalEdit)(e.before, e.after)];
       actions.push({
         title: `Fix${prev.label ? ` (${prev.label})` : ''}: ${f.vuln || f.rule || 'finding'}`,
         kind: 'quickfix', diagnostics: [d], isPreferred: false,
-        edit: { changes: { [target]: [(0,_language_context_js__WEBPACK_IMPORTED_MODULE_1__.minimalEdit)(prev.before, prev.after)] } },
+        edit: { changes },
         data: { stableId: f.stableId || null, verified: { syntax: true, rescan: true } },
       });
     } else {

package/dist/2862.index.js

@@ -15,8 +15,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 // EXTERNAL MODULE: ./src/language/contracts.js
 var contracts = __webpack_require__(43790);
-// EXTERNAL MODULE: ./src/language/haskell-parser.js
-var haskell_parser = __webpack_require__(41745);
+// EXTERNAL MODULE: ./src/language/haskell-parser.js + 1 modules
+var haskell_parser = __webpack_require__(99864);
 // EXTERNAL MODULE: ./src/language/haskell-grammar.js
 var haskell_grammar = __webpack_require__(50029);
 ;// CONCATENATED MODULE: ./src/language/haskell-adapter.js
@@ -35,7 +35,8 @@ const HASKELL_PARSE_PRODUCER = 'language:haskell-parse';
 
 // Boundaries whose content the parser could not see. cpp and ffi are disclosed on
 // the parse result but do not make the file unresolved: both CPP branches are
-// parsed and a foreign declaration's own Haskell signature is.
+// parsed and a foreign declaration's own Haskell signature is. `th-safe-splice` and `quasiquote-inert` are matched by a
+// closed, sound pattern (haskell-boundaries.js) and stay disclosed as assumptions; every other TH/quasi-quote boundary is opaque.
 const OPAQUE_BOUNDARIES = new Set(['th-splice', 'th-quote', 'th-name-quote', 'th-top-level-splice', 'quasiquote', 'hsc', 'generated']);
 
 function ensureHaskellParseProducer() {
@@ -46,7 +47,7 @@ function ensureHaskellParseProducer() {
 }
 
 /**
- * @param {{grammarSource?:Function, budgets?:object, mode?:string, onParse?:(file:string, parse:object)=>void}} [opts]
+ * @param {{grammarSource?:Function, budgets?:object, mode?:string, cpp?:object, onParse?:(file:string, parse:object)=>void}} [opts]
  */
 function createHaskellAdapter(opts = {}) {
   ensureHaskellParseProducer();
@@ -55,7 +56,7 @@ function createHaskellAdapter(opts = {}) {
     language: 'haskell',
     hasGrammar: () => (0,haskell_grammar/* loadHaskellGrammar */.UP)({ grammarSource: opts.grammarSource }).available,
     analyze(file, content) {
-      const parse = (0,haskell_parser/* parseHaskell */.cX)(content, { file, grammarSource: opts.grammarSource, budgets: opts.budgets, mode: opts.mode });
+      const parse = (0,haskell_parser/* parseHaskell */.cX)(content, { file, grammarSource: opts.grammarSource, budgets: opts.budgets, mode: opts.mode, cpp: opts.cpp });
       if (typeof opts.onParse === 'function') opts.onParse(file, parse);
       if (parse.status === 'budget_exceeded' && parse.budget && parse.budget.name === 'deadlineMs') {
         throw Object.assign(new Error(`Haskell parser deadline exceeded for ${file}`), { code: 'LANG_TIMEOUT' });
@@ -72,6 +73,8 @@ function createHaskellAdapter(opts = {}) {
   };
 }
 
+// EXTERNAL MODULE: ./src/language/haskell-cpp.js
+var haskell_cpp = __webpack_require__(92777);
 // EXTERNAL MODULE: ./src/language/nix-ir.js
 var nix_ir = __webpack_require__(67772);
 // EXTERNAL MODULE: ./src/language/nix-grammar.js
@@ -150,6 +153,7 @@ var haskell_models = __webpack_require__(54084);
 
 
 
+
 const ASSURANCE_VERSION = 'language-assurance/1';
 
 const REQUIRED_CAPABILITIES = Object.freeze({
@@ -198,14 +202,21 @@ async function assessLanguageAssurance(input = {}) {
   // 1. parse adapters over every language source
   // Boundaries that do not make a file unresolved but that a reader must be told about: CPP (every branch was parsed, the
   // chosen one is not known) and FFI (the foreign code is not analysed).
+  const DISCLOSED_KINDS = new Set(['cpp', 'ffi', 'th-safe-splice', 'quasiquote-inert']);
   const disclosed = new Map();   // boundary kind -> {count, files:Set}
   const projectModules = new Set(); const importedModules = new Map();   // module -> files
   const onParse = (file, parse) => {
     if (parse && parse.module && parse.module.name) projectModules.add(parse.module.name);
     for (const i of (parse && parse.imports) || []) if (i && i.module) { const e = importedModules.get(i.module) || new Set(); e.add(file); importedModules.set(i.module, e); }
-    for (const b of (parse && parse.boundaries) || []) if (b.kind === 'cpp' || b.kind === 'ffi') { const e = disclosed.get(b.kind) || { count: 0, files: new Set() }; e.count += b.count || 1; e.files.add(file); disclosed.set(b.kind, e); }
+    for (const b of (parse && parse.boundaries) || []) {
+      if (!DISCLOSED_KINDS.has(b.kind)) continue;
+      const e = disclosed.get(b.kind) || { count: 0, files: new Set(), decided: 0, undecided: 0, assumptions: new Set() };
+      e.count += b.count || 1; e.files.add(file);
+      if (b.kind === 'cpp') { e.decided += b.decided || 0; e.undecided += b.undecided || 0; for (const a of b.assumptions || []) e.assumptions.add(a); }
+      disclosed.set(b.kind, e);
+    }
   };
-  const adapters = input.adapters || [createHaskellAdapter({ onParse }), createNixAdapter()];
+  const adapters = input.adapters || [createHaskellAdapter({ onParse, cpp: (0,haskell_cpp/* deriveCppContext */.uP)(files) }), createNixAdapter()];
   const run = await (0,contracts/* runLanguageAnalysis */.i5)({ files, adapters, timeoutMs: input.timeoutMs || 0 });
   const reconcile = (0,contracts/* reconcileLanguageLedger */.SA)(run.ledger, files);
   const base = (0,contracts/* languageHealth */.bX)({ ledger: run.ledger, outcomes: run.outcomes });
@@ -224,8 +235,17 @@ async function assessLanguageAssurance(input = {}) {
     for (const o of opaque) { const k = String(o.detail).replace(/^opaque-boundary:\s*/, ''); kinds[k] = (kinds[k] || 0) + 1; }
     for (const [k, n] of Object.entries(kinds).sort()) limitations.push({ kind: 'opaque-boundary', boundary: k, count: n, note: 'a documented limit of static analysis: this code is not analysed, and is not reported clean' });
   }
-  const DISCLOSED_NOTE = { cpp: 'preprocessor conditionals: every branch was parsed, but which branch is compiled is not known', ffi: 'foreign declarations: the foreign code is not analysed and its effects are not modelled' };
-  for (const [k, e] of [...disclosed.entries()].sort()) limitations.push({ kind: 'opaque-boundary', boundary: k, count: e.count, files: [...e.files].sort().slice(0, 20), note: `a documented limit of static analysis (${DISCLOSED_NOTE[k]})` });
+  const DISCLOSED_NOTE = {
+    cpp: 'preprocessor conditionals: a conditional the file or the project decides keeps only its live branch, every other one keeps all of its branches, and which branch is compiled is then not known',
+    ffi: 'foreign declarations: the foreign code is not analysed and its effects are not modelled',
+    'th-safe-splice': 'declaration-level Template Haskell splices of a known generator applied to names and literals only: assumed to be the upstream generator, nothing is run and the generated declarations are not modelled',
+    'quasiquote-inert': 'quasi-quotes of a known raw-string or non-interpolating quoter: read as a string literal on the assumption that the quoter is the upstream one',
+  };
+  for (const [k, e] of [...disclosed.entries()].sort()) {
+    const extra = k === 'cpp' ? { decidedConditionals: e.decided, undecidedConditionals: e.undecided, ...(e.assumptions.size ? { assumptions: [...e.assumptions].sort() } : {}) } : {};
+    const assumed = k === 'cpp' && e.assumptions.size ? `; some conditionals were decided on a stated project assumption (${[...e.assumptions].sort().join(', ')}), so a branch dead under it was not analysed` : '';
+    limitations.push({ kind: 'opaque-boundary', boundary: k, count: e.count, files: [...e.files].sort().slice(0, 20), ...extra, note: `a documented limit of static analysis (${DISCLOSED_NOTE[k]}${assumed})` });
+  }
   // Imported modules this scan has no model for: their functions are ordinary, opaque calls (never a source, sink or
   // sanitizer), so a taint flow through them is widened and disclosed on the finding. Listed so a reader knows how much of the
   // import surface the models cover. A limitation, not a condition: most real projects import unmodelled modules.

package/dist/3531.index.js

@@ -14,7 +14,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   purlFromGitHost: () => (/* binding */ purlFromGitHost),
 /* harmony export */   purlFromUpstreamUrl: () => (/* binding */ purlFromUpstreamUrl)
 /* harmony export */ });
-/* harmony import */ var _haskell_supply_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(43436);
+/* harmony import */ var _haskell_supply_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(86349);
 /* harmony import */ var _haskell_sca_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2437);
 /* harmony import */ var _haskell_resolved_graph_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(86359);
 /* harmony import */ var _nix_inventory_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(81303);

package/dist/4171.index.js

@@ -14,14 +14,14 @@ __webpack_require__.d(__webpack_exports__, {
 
 // UNUSED EXPORTS: nixosEntries
 
-// EXTERNAL MODULE: ./src/language/resolved-pass.js + 3 modules
-var resolved_pass = __webpack_require__(38551);
+// EXTERNAL MODULE: ./src/language/resolved-pass.js + 4 modules
+var resolved_pass = __webpack_require__(37033);
 // EXTERNAL MODULE: ./src/language/nix-build-trust.js
 var nix_build_trust = __webpack_require__(36668);
 // EXTERNAL MODULE: ./src/language/discovery.js
 var discovery = __webpack_require__(30951);
-// EXTERNAL MODULE: ./src/language/haskell-supply.js + 1 modules
-var haskell_supply = __webpack_require__(43436);
+// EXTERNAL MODULE: ./src/language/haskell-supply.js
+var haskell_supply = __webpack_require__(86349);
 // EXTERNAL MODULE: ./src/language/nix-script-taint.js
 var nix_script_taint = __webpack_require__(11793);
 // EXTERNAL MODULE: ./src/language/nix-secrets.js