@clear-capabilities/agentic-security-scanner 0.158.0 → 0.160.0

package/src/language/haskell-parser.js

@@ -25,6 +25,8 @@
 // named and no partial analysis, and never throws into the caller.
 
 import { loadHaskellGrammar } from './haskell-grammar.js';
+import { evaluateCppLines } from './haskell-cpp.js';
+import { classifySafeSplice, classifyInertQuasiQuote } from './haskell-boundaries.js';
 
 export const DEFAULT_PARSE_BUDGETS = Object.freeze({
   maxBytes: 4 * 1024 * 1024,
@@ -36,6 +38,10 @@ export const DEFAULT_PARSE_BUDGETS = Object.freeze({
   maxErrors: 200,
 });
 
+// Boundaries that are disclosed but do not make a file incomplete: the content was either parsed (cpp, ffi) or matched
+// by a closed, sound pattern and stated as an assumption (see haskell-boundaries.js).
+export const NON_OPAQUE_BOUNDARIES = new Set(['cpp', 'ffi', 'th-safe-splice', 'quasiquote-inert']);
+
 class BudgetError extends Error {
   constructor(budget, limit) {
     super(`parser budget "${budget}" exceeded (limit ${limit})`);
@@ -157,48 +163,55 @@ function unwrapLiterate(source) {
   return { code: out, style: latex ? 'latex' : 'bird' };
 }
 
-function stripDirectives(code, dialect, grammar, loc) {
+function stripDirectives(code, dialect, grammar, loc, cppCtx) {
   const cppNames = new Set(grammar.cppDirectives);
   const lines = code.split('\n');
   const directives = [];
-  const depthAtLine = new Int32Array(lines.length + 2);
-  let depth = 0;
-  let off = 0;
+  // Physical line offsets into the ORIGINAL text, so directive spans stay exact.
+  const starts = new Array(lines.length);
+  { let o = 0; for (let i = 0; i < lines.length; i++) { starts[i] = o; o += lines[i].length + 1; } }
+  // Group directive lines (a trailing backslash continues the directive onto the next physical line).
+  const groups = new Map();
   for (let i = 0; i < lines.length; i++) {
-    let line = lines[i];
+    const line = lines[i];
     const m = /^#\s*([A-Za-z]+)/.exec(line);
     const shebang = i === 0 && line.startsWith('#!');
     const hscLine = dialect === 'hsc' && /^#/.test(line);
-    if (shebang || hscLine || (m && cppNames.has(m[1]))) {
-      const name = shebang ? 'shebang' : (m ? m[1] : 'hsc');
-      directives.push({ name, line: i + 1, span: loc.span(off, off + line.length) });
-      if (name === 'if' || name === 'ifdef' || name === 'ifndef') depth++;
-      else if (name === 'endif' && depth > 0) depth--;
-      depthAtLine[i + 1] = depth;
-      let cur = blank(line);
-      // A directive continued with a trailing backslash swallows the next line too.
-      let k = i;
-      while (/\\\r?$/.test(lines[k]) && k + 1 < lines.length) {
-        k++;
-        cur += '\n' + blank(lines[k]);
-        depthAtLine[k + 1] = depth;
-      }
-      if (k > i) {
-        off += lines[i].length + 1;
-        for (let q = i + 1; q <= k; q++) off += lines[q].length + 1;
-        lines.splice(i, k - i + 1, ...cur.split('\n'));
-        i = k;
-        continue;
+    if (!(shebang || hscLine || (m && cppNames.has(m[1])))) continue;
+    const name = shebang ? 'shebang' : (m ? m[1] : 'hsc');
+    let k = i;
+    let text = line;
+    while (/\\\r?$/.test(lines[k]) && k + 1 < lines.length) { k++; text += ' ' + lines[k].replace(/\r$/, ''); }
+    groups.set(i, { name, text: text.replace(/\\\r?(?= )/g, ' '), last: k });
+    directives.push({ name, line: i + 1, span: loc.span(starts[i], starts[i] + line.length) });
+    i = k;
+  }
+  let evalOut = null;
+  let depthAtLine = new Int32Array(lines.length + 2);
+  let outLines = lines;
+  if (dialect !== 'hsc' && groups.size) {
+    evalOut = evaluateCppLines(lines, (i) => { const g = groups.get(i); return g && g.name !== 'shebang' ? g : null; }, cppCtx || {});
+    outLines = evalOut.lines.slice();
+    depthAtLine = evalOut.maybeDepth;
+  } else {
+    outLines = lines.slice();
+    let depth = 0;
+    for (let i = 0; i < lines.length; i++) {
+      const g = groups.get(i);
+      if (g) {
+        if (g.name === 'if' || g.name === 'ifdef' || g.name === 'ifndef') depth++;
+        else if (g.name === 'endif' && depth > 0) depth--;
+        for (let q = i; q <= g.last; q++) depthAtLine[q + 1] = depth;
+        i = g.last;
+      } else {
+        depthAtLine[i + 1] = depth;
+        if (dialect === 'hsc') outLines[i] = lines[i].replace(/#\{[^}\n]*\}/g, (x) => ' '.repeat(x.length));
       }
-      lines[i] = cur;
-      line = cur;
-    } else {
-      depthAtLine[i + 1] = depth;
-      if (dialect === 'hsc') lines[i] = line.replace(/#\{[^}\n]*\}/g, (s) => ' '.repeat(s.length));
     }
-    off += line.length + 1;
   }
-  return { code: lines.join('\n'), directives, depthAtLine };
+  for (const [i, g] of groups) for (let q = i; q <= g.last; q++) outLines[q] = blank(lines[q]);
+  const cpp = evalOut ? { decided: evalOut.decided, undecided: evalOut.undecided, deadLines: evalOut.deadLines } : { decided: [], undecided: [], deadLines: 0 };
+  return { code: outLines.join('\n'), directives, depthAtLine, cpp };
 }
 
 // ── lexer ──────────────────────────────────────────────────────────────────
@@ -436,7 +449,7 @@ function emptyResult(file, dialect) {
   return {
     language: 'haskell', file, dialect, ok: false, status: 'failed', complete: false,
     module: null, imports: [], functions: [], signatures: [], declarations: [], calls: [], expressions: [],
-    records: [], doBlocks: [], comments: [], pragmas: [], errors: [], boundaries: [], uncertainty: [], gaps: [],
+    records: [], doBlocks: [], comments: [], pragmas: [], errors: [], boundaries: [], blankRanges: [], uncertainty: [], gaps: [],
     stats: { bytes: 0, tokens: 0, steps: 0 },
   };
 }
@@ -462,7 +475,7 @@ export function parseHaskell(source, opts = {}) {
   }
   const started = Date.now();
   const ctx = {
-    grammar: g.grammar, budgets, steps: 0,
+    grammar: g.grammar, budgets, steps: 0, cpp: opts.cpp || null,
     tick() {
       this.steps++;
       if (this.steps > budgets.maxSteps) throw new BudgetError('maxSteps', budgets.maxSteps);
@@ -475,7 +488,7 @@ export function parseHaskell(source, opts = {}) {
     res.stats.steps = ctx.steps;
     res.status = res.errors.length ? 'parsed_with_errors' : 'parsed';
     res.ok = true;
-    res.complete = res.errors.length === 0 && !res.boundaries.some((b) => b.kind !== 'cpp' && b.kind !== 'ffi');
+    res.complete = res.errors.length === 0 && !res.boundaries.some((b) => !NON_OPAQUE_BOUNDARIES.has(b.kind));
   } catch (e) {
     const fresh = emptyResult(file, dialect);
     fresh.stats = { ...res.stats, steps: ctx.steps };
@@ -503,11 +516,18 @@ function analyze(source, file, dialect, ctx, res) {
     code = lit.code;
     res.dialect = lit.style === 'latex' ? 'literate-latex' : 'literate-bird';
   }
-  const pre = stripDirectives(code, dialect, g, loc);
+  const pre = stripDirectives(code, dialect, g, loc, ctx.cpp);
   code = pre.code;
   const cppLines = pre.directives.filter((d) => d.name !== 'shebang');
+  // The preprocessed text (directives and dead branches overwritten in place) for the semantic IR; not serialised with the result.
+  Object.defineProperty(res, '_preprocessed', { value: code, enumerable: false, configurable: true });
   if (cppLines.length && dialect !== 'hsc') {
-    res.boundaries.push({ kind: 'cpp', span: cppLines[0].span, detail: `${cppLines.length} preprocessor line(s) removed in place; every conditional branch was parsed`, count: cppLines.length });
+    const cd = pre.cpp;
+    const parts = [`${cppLines.length} preprocessor line(s) removed in place`];
+    if (cd.decided.length) parts.push(`${cd.decided.length} conditional(s) decided (${cd.deadLines} dead line(s) overwritten with spaces)`);
+    parts.push(cd.undecided.length ? `${cd.undecided.length} conditional(s) could not be decided, so every possible branch was parsed` : 'no conditional was left undecided');
+    const assumptions = [...new Set(cd.decided.flatMap((d) => (d.basis || []).filter((b) => b !== 'file')))].sort();
+    res.boundaries.push({ kind: 'cpp', span: cppLines[0].span, detail: parts.join('; '), count: cppLines.length, decided: cd.decided.length, undecided: cd.undecided.length, deadLines: cd.deadLines, assumptions, decisions: cd.decided, undecidedAt: cd.undecided.map((u) => u.line) });
   }
   if (dialect === 'hsc') {
     res.boundaries.push({ kind: 'hsc', span: loc.span(0, Math.min(source.length, 1)), detail: 'hsc2hs source: # directives and #{...} blanked in place, never run through hsc2hs' });
@@ -652,6 +672,7 @@ function analyze(source, file, dialect, ctx, res) {
   const spanOf = (a, b) => loc.span(T[a].s, T[Math.max(a, b - 1)].e);
   const condAt = (t) => pre.depthAtLine[t.line] > 0;
   const topRanges = [];
+  const spliceItems = [];
 
   const registerFunction = (key, rec) => {
     let f = fnIndex.get(key);
@@ -865,7 +886,9 @@ function analyze(source, file, dialect, ctx, res) {
     }
     if (mark < 0) {
       if (c.scope === 'top' && ctx.th) {
-        res.boundaries.push({ kind: 'th-top-level-splice', span: spanOf(a, b), detail: 'top-level Template Haskell splice; declarations it generates are not visible' });
+        const bnd = { kind: 'th-top-level-splice', span: spanOf(a, b), detail: 'top-level Template Haskell splice; declarations it generates are not visible' };
+        res.boundaries.push(bnd);
+        spliceItems.push({ a, b, bnd });
         return;
       }
       errors.push({ kind: 'expected-declaration', offset: T[a].s, endOffset: T[b - 1].e, detail: 'item is neither a binding nor a signature' });
@@ -1022,6 +1045,41 @@ function analyze(source, file, dialect, ctx, res) {
     else scanItem(w.role, w.a, w.b, w);
   }
 
+  function absorbSafeBoundaries() {
+    if (!spliceItems.length && !res.boundaries.some((x) => x.kind === 'quasiquote')) return;
+    const defined = new Set();
+    for (const f of res.functions) if (f.name) defined.add(f.name);
+    for (const d of res.declarations) if (d.name) defined.add(d.name);
+    for (const sg of res.signatures) for (const n of sg.names) defined.add(n);
+    const absorbed = [];
+    for (const it of spliceItems) {
+      const r = classifySafeSplice(T, it.a, it.b, match, res.imports, defined);
+      if (!r) continue;
+      const from = T[it.a].s; const to = T[it.b - 1].e;
+      absorbed.push({ from, to });
+      Object.assign(it.bnd, {
+        kind: 'th-safe-splice',
+        detail: `declaration-level splice of ${[...new Set(r.generators)].join(', ')}: names and literals only, no project-controlled string reaches it; ASSUMED to be the upstream generator from ${r.modules.join(' / ')}, and the declarations it generates are not modelled`,
+        generators: [...new Set(r.generators)], assumption: 'upstream-generator',
+      });
+      res.blankRanges.push({ kind: 'th-safe-splice', startOffset: from, endOffset: to });
+    }
+    const inside = (b) => absorbed.some((x) => b.span.startOffset >= x.from && b.span.endOffset <= x.to);
+    res.boundaries = res.boundaries.filter((b) => !((b.kind === 'th-name-quote' || b.kind === 'th-splice' || b.kind === 'quasiquote') && inside(b)));
+    for (const b of res.boundaries) {
+      if (b.kind !== 'quasiquote') continue;
+      const body = source.slice(b.span.startOffset, b.span.endOffset);
+      const bar = body.indexOf('|');
+      const inner = bar < 0 ? '' : body.slice(bar + 1, body.endsWith('|]') ? -2 : undefined);
+      const r = classifyInertQuasiQuote(b.quoter, inner, res.imports, defined);
+      if (!r) continue;
+      b.kind = 'quasiquote-inert';
+      b.detail = `quasi-quote [${r.quoter}|...|] is a string literal (no interpolation); ASSUMED to be the upstream quoter from ${r.modules.join(' / ')}`;
+      b.assumption = 'upstream-quoter';
+      res.blankRanges.push({ kind: 'quasiquote-inert', startOffset: b.span.startOffset, endOffset: b.span.endOffset });
+    }
+  }
+
   // ── errors → withheld calls ──
   const bad = [];
   for (const e of errors) {
@@ -1063,6 +1121,9 @@ function analyze(source, file, dialect, ctx, res) {
   }
   if (total > outErrors.length) res.errors.push({ kind: 'errors-truncated', detail: `${total - outErrors.length} further syntax error(s) not listed` });
 
+  // ── safe generative splices and inert quasi-quotes (disclosed assumptions, not opaque boundaries) ──
+  absorbSafeBoundaries();
+
   // ── uncertainty ──
   if (res.boundaries.some((x) => x.kind === 'cpp' || x.kind === 'hsc')) res.uncertainty.push({ kind: 'preprocessed' });
   if (res.boundaries.some((x) => x.kind === 'generated' || x.kind.startsWith('th-') || x.kind === 'quasiquote')) res.uncertainty.push({ kind: 'generated-source' });
@@ -1071,3 +1132,26 @@ function analyze(source, file, dialect, ctx, res) {
   res.calls.sort((x, y) => x.span.startOffset - y.span.startOffset);
   void cut;
 }
+
+const IR_PREPROCESS_GUARD = /^[ \t]*#\s*(?:if|ifdef|ifndef|elif|else|endif|define|undef)\b|\bTemplateHaskell\b|\bQuasiQuotes\b/m;
+
+/**
+ * Source for the semantic IR's own parser, which knows neither CPP nor Template Haskell. Length-preserving: CPP directives and
+ * dead branches become spaces; a safe declaration splice becomes spaces; an inert quasi-quote becomes a string literal of the
+ * same length. Anything else (an undecided conditional's branches, an opaque splice or quasi-quote) is left exactly as written.
+ * Returns the input unchanged when it has nothing to preprocess or cannot be parsed.
+ */
+export function preprocessForSyntax(source, opts = {}) {
+  if (typeof source !== 'string' || !IR_PREPROCESS_GUARD.test(source)) return source;
+  let r;
+  try { r = parseHaskell(source, { file: opts.file, cpp: opts.cpp }); } catch { return source; }
+  if (!r || !r.ok || typeof r._preprocessed !== 'string' || r._preprocessed.length !== source.length) return source;
+  let out = r._preprocessed;
+  for (const b of r.blankRanges || []) {
+    const seg = out.slice(b.startOffset, b.endOffset);
+    let repl = blank(seg);
+    if (b.kind === 'quasiquote-inert' && repl.length >= 2) repl = `"${repl.slice(1, -1)}"`;
+    out = out.slice(0, b.startOffset) + repl + out.slice(b.endOffset);
+  }
+  return out;
+}

package/src/language/haskell-sca.js

@@ -19,6 +19,7 @@
 // response). The wire query is built here so its exact shape is testable.
 
 import { createHash, createVerify } from 'node:crypto';
+import { advisorySeverity, NO_RATING_BASIS } from './cvss.js';
 import { parseVersion, compareVersions, parseVersionRange, caretUpperBound } from './haskell-manifests.js';
 
 export const HS_SCA_VERSION = 'haskell-sca/1';
@@ -140,7 +141,7 @@ export function normalizeAdvisory(rec) {
     id: rec.id, canonicalId, ids, cveAliases: ids.filter((x) => /^CVE-/.test(x)), ghsaAliases: ids.filter((x) => /^GHSA-/.test(x)),
     summary: rec.summary || '', details: rec.details || '', published: rec.published || null, modified: rec.modified || null,
     withdrawn: rec.withdrawn || null, references: (rec.references || []).map((r) => r.url).filter(Boolean),
-    severity: rec.severity || [], affected, problems,
+    severity: rec.severity || [], severityInfo: advisorySeverity(rec), affected, problems,
   };
 }
 const fixedVersions = (ranges) => [...new Set((ranges || []).flatMap((r) => (r.events || []).filter((e) => 'fixed' in e).map((e) => e.fixed)))];
@@ -231,14 +232,16 @@ export function matchComponent(aff, comp) {
     if (inside === null) return { status: 'unknown', reason: `"${comp.version}" is not a Cabal version` };
     return inside ? { status: 'affected', reason: 'the resolved version is inside an affected range' } : { status: 'not-affected', reason: 'the resolved version is outside every affected range' };
   }
-  if (comp.declaredRange) {
-    const declared = rangeToIntervals(comp.declaredRange);
+  // `unbounded` = the manifest declared the dependency with NO version bound (`build-depends: aeson`), which in Cabal means "any version".
+  // That is a declared range like any other (it overlaps an advisory, so possibly-affected), not an absent one.
+  if (comp.declaredRange || comp.unbounded) {
+    const declared = comp.declaredRange ? rangeToIntervals(comp.declaredRange) : [iv(null, false, null, false)];
     if (declared === null) return { status: 'unknown', reason: 'the declared range could not be parsed' };
     if (!declared.length) return { status: 'unknown', reason: 'the declared range admits no version' };
     const overlap = intervalsOverlap(declared, aff.intervals);
     if (!overlap) return { status: 'not-affected', reason: 'no version allowed by the declared range is affected' };
     const subset = declared.every((d) => aff.intervals.some((a) => !isEmpty(intersectIntervals(d, a)) && containsInterval(a, d)));
-    return subset ? { status: 'affected', reason: 'every version allowed by the declared range is affected' } : { status: 'possibly-affected', reason: 'the declared range allows both affected and unaffected versions; no resolved version is known' };
+    return subset ? { status: 'affected', reason: 'every version allowed by the declared range is affected' } : { status: 'possibly-affected', reason: comp.declaredRange ? 'the declared range allows both affected and unaffected versions; no resolved version is known' : 'the dependency is declared with no version bound, so any version may be selected; no resolved version is known' };
   }
   return { status: 'unknown', reason: 'neither a resolved version nor a declared range is known' };
 }
@@ -275,14 +278,15 @@ export function evaluateComponents(components, db, opts = {}) {
       statuses.push({ ...base, status: ghc && m.status !== 'not-affected' ? `ghc-component:${m.status}` : m.status, advisory: adv.canonicalId, reason: m.reason, ghcComponent: ghc });
       if (m.status === 'not-affected') continue;
       any = true;
+      const sev = adv.severityInfo || { level: null, score: null, basis: NO_RATING_BASIS };
       const kevHit = adv.cveAliases.length ? (opts.kev ? adv.cveAliases.some((c) => opts.kev.has(c)) : 'unknown') : 'not-applicable';
       const epssVals = adv.cveAliases.map((c) => opts.epss && opts.epss[c]).filter((x) => typeof x === 'number');
       findings.push({
         type: 'vulnerable_dep', ecosystem: 'hackage', name: comp.name, version: comp.version || null, declaredRange: comp.declaredRange || null,
         osvId: adv.canonicalId, ids: adv.ids, cveAliases: adv.cveAliases, ghsaAliases: adv.ghsaAliases,
         summary: adv.summary, fixedIn: aff.fixedIn, unfixed: aff.unfixed, references: adv.references.slice(0, 5),
-        severity: 'medium', severityBasis: 'the advisory carries no severity rating',
-        matchStatus: m.status, matchReason: m.reason, resolution: comp.version ? 'resolved' : (comp.declaredRange ? 'declared-range' : 'none'),
+        severity: sev.level || 'medium', severityBasis: sev.basis, severityScore: sev.score ?? null,
+        matchStatus: m.status, matchReason: m.reason, resolution: comp.version ? 'resolved' : (comp.declaredRange ? 'declared-range' : (comp.unbounded ? 'declared-unbounded' : 'none')),
         scope: comp.scope || null, target: comp.target || null, purl: base.purl, ghcComponent: ghc,
         ...(ghc ? { remediation: `${comp.name} is provided by the compiler: upgrade GHC (the fix is in ${comp.name} ${aff.fixedIn.join(', ') || '(no fixed version published)'}), not a Cabal dependency bound.` } : { remediation: aff.fixedIn.length ? `Upgrade ${comp.name} to ${aff.fixedIn.join(' or ')}.` : `No fixed version of ${comp.name} is published; remove or replace the dependency.` }),
         kev: kevHit, epss: epssVals.length ? Math.max(...epssVals) : 'unknown',

package/src/language/haskell-supply.js

@@ -21,22 +21,56 @@ export function hackageComponents(files) {
   const mf = manifestFiles(files);
   if (!mf.length) return { components: [], manifests: null };
   const manifests = analyzeHaskellManifests(mf);
-  const locked = new Map();
-  const lockedAt = new Map();
-  for (const l of manifests.lockedPackages || []) { locked.set(l.name, l.version); if (l.version && l.file) lockedAt.set(l.name, { file: l.file, line: l.line || null }); }
+  // A freeze or lock file resolves the manifests at or below its own directory (that is what a Cabal project or Stack project root means), and the
+  // nearest enclosing one wins. Applying one repository-wide made a release builder's freeze (builders/linux.armv6hf/) the "resolved" version of
+  // the root package: found by the live Hackage feed bench.
+  const dirOf = (p) => (typeof p === 'string' && p.includes('/') ? p.slice(0, p.lastIndexOf('/')) : '');
+  const covers = (lockFile, manifest) => { const base = dirOf(lockFile); const m = dirOf(manifest); return base === '' || m === base || m.startsWith(`${base}/`); };
+  const lockedFor = (name, manifest) => {
+    let best = null;
+    for (const l of manifests.lockedPackages || []) {
+      if (l.name !== name || !l.version || !l.file || !covers(l.file, manifest)) continue;
+      if (!best || dirOf(l.file).length >= dirOf(best.file).length) best = l;
+    }
+    return best;
+  };
+  // Packages this project DEFINES (a .cabal file or an hpack package.yaml in the scanned tree). A `build-depends` on one of them resolves to the
+  // workspace package, not to Hackage; reporting it would raise advisories about the project's own (usually fixed) version as if it were a
+  // dependency. Found by the live Hackage feed bench (aeson's own test suite depends on aeson).
+  const defined = new Set([...(manifests.packages || []), ...(manifests.hpack || [])].map((p) => p.name).filter(Boolean));
   const seen = new Map();
   for (const d of manifests.dependencies || []) {
-    const resolved = locked.get(d.name) || d.exactPin || null;
-    const key = `${d.name}@${d.scope || 'runtime'}`;
+    if (defined.has(d.name)) continue;
+    const lock = lockedFor(d.name, d.manifest);
+    const resolved = (lock && lock.version) || d.exactPin || null;
+    const key = `${d.name}@${d.scope || 'runtime'}@${resolved || ''}`;   // a covered (resolved) use is not merged into an uncovered one
     if (seen.has(key)) continue;
     seen.set(key, {
-      ecosystem: 'hackage', name: d.name, version: resolved, declaredRange: d.declaredRange || null,
-      resolution: locked.has(d.name) ? 'freeze' : (d.exactPin ? 'exact-pin' : 'unresolved'),
+      ecosystem: 'hackage', name: d.name, version: resolved, declaredRange: d.declaredRange || null, unbounded: !resolved && !d.declaredRange && d.rangeKind === 'unbounded',
+      resolution: lock ? 'freeze' : (d.exactPin ? 'exact-pin' : 'unresolved'),
       scope: d.scope || 'runtime', engineScope: SCOPE[d.scope] || 'required', target: d.component || null, componentKind: d.componentKind || null,
       manifest: d.manifest, line: d.line, ghcComponent: GHC_BOOT_PACKAGES.has(d.name),
-      versionSource: locked.has(d.name) && lockedAt.has(d.name) ? lockedAt.get(d.name) : null,
+      versionSource: lock ? { file: lock.file, line: lock.line || null } : null,
     });
   }
+  // Cabal chooses ONE version of a package for every component of a .cabal file, so a use with no bound inherits the unconditional bounds the
+  // same manifest declares for that package elsewhere (a library that pins `aeson >=2.2.5.1` next to a test suite that just says `aeson`).
+  // Conditional bounds (flags, os, compiler) are not in force everywhere and are not inherited; neither is a bound from another manifest.
+  const boundsIn = new Map();
+  for (const d of manifests.dependencies || []) {
+    if (!d.declaredRange || (d.conditions && d.conditions.length) || defined.has(d.name)) continue;
+    const k = `${d.manifest}\u0000${d.name}`;
+    if (!boundsIn.has(k)) boundsIn.set(k, []);
+    if (!boundsIn.get(k).includes(d.declaredRange)) boundsIn.get(k).push(d.declaredRange);
+  }
+  for (const c of seen.values()) {
+    if (!c.unbounded) continue;
+    const rs = boundsIn.get(`${c.manifest}\u0000${c.name}`);
+    if (!rs) continue;
+    c.declaredRange = rs.length === 1 ? rs[0] : rs.map((r) => `(${r})`).join(' && ');
+    c.unbounded = false;
+    c.rangeInheritedFromSibling = true;
+  }
   return { components: [...seen.values()], manifests };
 }
 

package/src/language/haskell-web.js

@@ -36,7 +36,7 @@ const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 const SCOTTY_METHODS = { get: 'GET', post: 'POST', put: 'PUT', delete: 'DELETE', patch: 'PATCH', options: 'OPTIONS', matchAny: 'ANY', addroute: 'ANY' };
 const SENSITIVE_PREFIX = ['Database.', 'System.Process.', 'System.Directory.', 'Prelude.readFile', 'Prelude.writeFile', 'Prelude.appendFile', 'System.IO.', 'Network.HTTP.Simple.', 'Network.HTTP.Client.'];
 const PERSIST_FNS = new Set(['get', 'getBy', 'selectFirst', 'selectList', 'insert', 'insert_', 'update', 'updateWhere', 'delete', 'deleteWhere', 'replace', 'runDB', 'getJust', 'upsert']);
-const GUARD_PRIMITIVES = new Set(['Yesod.Core.requireAuthId', 'Yesod.Core.requireAuth', 'Yesod.Auth.requireAuthId', 'Yesod.Auth.requireAuth', 'Network.Wai.Middleware.HttpAuth.basicAuth']);
+const GUARD_PRIMITIVES = new Set(['Yesod.Core.requireAuthId', 'Yesod.Core.requireAuth', 'Yesod.Auth.requireAuthId', 'Yesod.Auth.requireAuth', 'Yesod.requireAuthId', 'Yesod.requireAuth', 'Network.Wai.Middleware.HttpAuth.basicAuth']);
 const CREDENTIAL_HEADER = /^(?:authorization|cookie|x-api-key|x-auth-token|x-access-token)$/i;
 const ADMIN_PATH = /(?:^|\/)(?:admin|internal|manage|superuser)(?:\/|$|:)/i;
 const ROLE_CALL = /(?:^|\.)(?:isAdmin|hasRole|requireAdmin|checkRole|hasPermission|requireRole|requirePermission|isSuperuser)$/i;
@@ -128,31 +128,111 @@ function credentialKind(c) {
   if (c.callee === 'Web.Cookie.parseCookies') return 'cookie';
   if (c.callee === 'Network.Wai.requestHeaders') return 'token';
   if (c.callee.startsWith('Web.JWT.')) return 'token';
+  // Yesod: the session principal, or a credential header, read by the handler itself (the caller still has to reject on it)
+  if (/^Yesod(?:\.Core|\.Auth)?\.(?:maybeAuthId|maybeAuth)$/.test(c.callee)) return 'session';
+  if (/^Yesod(?:\.Core)?\.lookupHeader$/.test(c.callee)) { const h = headerArg(c); if (h && CREDENTIAL_HEADER.test(h)) return /cookie/i.test(h) ? 'cookie' : 'token'; }
+  if (/^Yesod(?:\.Core)?\.lookupBearerAuth$/.test(c.callee)) return 'token';
+  if (/^Yesod(?:\.Core)?\.lookupBasicAuth$/.test(c.callee)) return 'basic';
   if (GUARD_PRIMITIVES.has(c.callee)) return c.callee.includes('HttpAuth') ? 'basic' : 'session';
   return null;
 }
 
+/**
+ * Credential reads of one function, by call. A WAI `requestHeaders` read is classified by the key it is looked up with: a lookup of a
+ * header that is not a credential (`lookup "X-Request-Id" (requestHeaders req)`) is not a credential read. An unrecognised use of
+ * `requestHeaders` keeps its old meaning (a token read), so only the provable non-credential lookup is excluded.
+ * The IR lowers `lookup k t` to a call on `t` with the key kept as `hs.selector`.
+ */
+function credentialReadsOf(fn) {
+  const nodes = Object.values(fn.cfg.nodes);
+  const hdrTargets = new Map();   // temp name -> line of the node that read requestHeaders
+  for (const n of nodes) if (n.kind === 'assign' && n.source && n.source.kind === 'call' && n.source.callee === 'Network.Wai.requestHeaders') hdrTargets.set(n.target, n.line);
+  const lineKind = new Map();     // line of a requestHeaders read -> 'token' | 'cookie' | null (a header that is not a credential)
+  for (const n of nodes) for (const root of exprsOfNode(n)) for (const e of walkIr(root)) {
+    if (e.kind !== 'call' || !/(?:^|\.)lookup$/.test(e.callee || '') || !e.hs || !e.hs.selector) continue;
+    const sel = e.hs.selector;
+    let name = null;
+    if (sel.kind === 'literal' && typeof sel.value === 'string') name = sel.value;
+    else if (sel.kind === 'ident' && /(?:^|\.)hAuthorization$/.test(sel.name || '')) name = 'Authorization';
+    else if (sel.kind === 'ident' && /(?:^|\.)hCookie$/.test(sel.name || '')) name = 'Cookie';
+    if (name === null) continue;
+    const a0 = (e.args || [])[0];
+    const line = a0 && a0.kind === 'ident' && hdrTargets.has(a0.name) ? hdrTargets.get(a0.name) : (a0 && a0.kind === 'call' && a0.callee === 'Network.Wai.requestHeaders' ? n.line : null);
+    if (line === null) continue;
+    lineKind.set(line, CREDENTIAL_HEADER.test(name) ? (/cookie/i.test(name) ? 'cookie' : 'token') : null);
+  }
+  const out = new Map();
+  for (const c of callsOf(fn)) {
+    let k;
+    if (c.callee === 'Network.Wai.requestHeaders' && lineKind.has(c.line)) k = lineKind.get(c.line);
+    else k = credentialKind(c);
+    if (k) out.set(c, k);
+  }
+  return out;
+}
+
+/**
+ * `notAuthenticated` takes no argument, so it is an identifier in the IR, not a call (like Scotty's `finish`). It ends the handler by itself,
+ * so each occurrence is a rejection, reported as a pseudo-call at its enclosing node's line.
+ */
+function nullaryRejectionsOf(fn) {
+  const out = [];
+  for (const n of Object.values(fn.cfg.nodes)) for (const root of exprsOfNode(n)) for (const e of walkIr(root)) {
+    if (e.kind === 'ident' && /^Yesod(?:\.Core)?\.notAuthenticated$/.test(e.name || '')) out.push({ kind: 'call', callee: e.name, args: [], line: Number.isFinite(e.line) ? e.line : n.line, hs: { nullary: true } });
+  }
+  return out;
+}
+
+// A WAI rejection is a response VALUE: it ends the handler only when it is handed back (`respond (responseLBS 401 ..)`, `return (..)`).
+// Built and dropped, it rejects nothing. Servant's throwError, Yesod's permissionDenied/notAuthenticated and Scotty's raiseStatus end the
+// handler by themselves.
+function stopsHandler(c, allCalls) {
+  if (c.callee !== 'Network.Wai.responseLBS') return true;
+  return allCalls.some((p) => p !== c && (p.callee === 'return' || p.callee === 'pure' || (p.hs && p.hs.status === 'param') || p.callee === 'respond')
+    && (p.args || []).some((a) => [...walkIr(a)].some((x) => x.kind === 'call' && x.args === c.args)));
+}
+
 function isRejection(c) {
   const name = c.callee;
   const argNames = (c.args || []).flatMap((a) => (a && a.kind === 'ident' ? [a.name] : []));
   if ((name === 'Web.Scotty.status' || name === 'Web.Scotty.Trans.status') && argNames.some((n) => /(?:status40[13]|unauthorized401|forbidden403)$/.test(n))) return true;
+  if (/^Web\.Scotty(?:\.Trans)?\.raiseStatus$/.test(name) && argNames.some((n) => /(?:status40[13]|unauthorized401|forbidden403)$/.test(n))) return true;   // halts by itself
   if (name === 'Network.Wai.responseLBS' && argNames.some((n) => /(?:status40[13]|unauthorized401|forbidden403)$/.test(n))) return true;
-  if (/^(?:Servant|Servant\.Server|Control\.Monad\.Except)\.throwError$/.test(name) && (c.args || []).some((a) => a && ((a.kind === 'ident' && /err40[13]$/.test(a.name)) || (a.kind === 'call' && /err40[13]$/.test(a.callee))))) return true;
-  if (/^Yesod\.Core\.(?:permissionDenied|notAuthenticated)$/.test(name)) return true;
+  // `throwError err401 { errBody = .. }` is a record update: the status constructor is inside it
+  if (/^(?:Servant|Servant\.Server|Control\.Monad\.Except)\.throwError$/.test(name) && (c.args || []).some((a) => a && [...walkIr(a)].some((x) => (x.kind === 'ident' && /err40[13]$/.test(x.name || '')) || (x.kind === 'call' && /err40[13]$/.test(x.callee || ''))))) return true;
+  if (/^Yesod(?:\.Core)?\.(?:permissionDenied|notAuthenticated)$/.test(name)) return true;
   return false;
 }
 
+// Scotty's `status` only sets the response code: the handler keeps running unless something halts it.
+const SCOTTY_STATUS = /^Web\.Scotty(?:\.Trans)?\.status$/;
+const SCOTTY_HALT = /^Web\.Scotty(?:\.Trans)?\.(?:finish|raise|raiseStatus|redirect)$/;
+/**
+ * Source lines of every Scotty halting point in one function IR. `finish` is usually a bare operand (`status status401 >> finish`,
+ * `when bad finish`), which the IR records as an identifier rather than a call, and an identifier has no line of its own: it inherits the
+ * enclosing node's line. So both calls and identifiers are collected, by line.
+ */
+function haltLinesOf(fn) {
+  const lines = [];
+  for (const n of Object.values(fn.cfg.nodes)) for (const root of exprsOfNode(n)) for (const e of walkIr(root)) {
+    const nm = e.kind === 'call' ? e.callee : e.kind === 'ident' ? e.name : null;
+    if (nm && SCOTTY_HALT.test(nm)) lines.push(Number.isFinite(e.line) ? e.line : n.line);
+  }
+  return lines;
+}
+
 function guardSummary(ctx, fn, depth = 0, seen = new Set()) {
   if (!fn) return { auth: false, kinds: [], role: false, owner: false, csrf: false };
   if (ctx.guardMemo.has(fn.qid)) return ctx.guardMemo.get(fn.qid);
   if (seen.has(fn.qid) || depth > 3) return { auth: false, kinds: [], role: false, owner: false, csrf: false };
   seen.add(fn.qid);
   const kinds = new Set();
-  let reads = false, rejects = false, role = false, owner = false, csrf = false, primitive = false;
+  let reads = false, rejects = false, statusRejects = [], role = false, owner = false, csrf = false, primitive = false;
+  const credReads = credentialReadsOf(fn);
   for (const c of callsOf(fn)) {
-    const k = credentialKind(c);
+    const k = credReads.get(c) || null;
     if (k) { kinds.add(k); reads = true; if (GUARD_PRIMITIVES.has(c.callee)) primitive = true; }
-    if (isRejection(c)) rejects = true;
+    if (isRejection(c)) { if (SCOTTY_STATUS.test(c.callee)) statusRejects.push(c.line); else rejects = true; }
     if (ROLE_CALL.test(c.callee || '')) role = true;
     if (OWNER_CALL.test(c.callee || '')) owner = true;
     if (CSRF_CALL.test(c.callee || '')) csrf = true;
@@ -162,6 +242,11 @@ function guardSummary(ctx, fn, depth = 0, seen = new Set()) {
       if (sub.role) role = true; if (sub.owner) owner = true; if (sub.csrf) csrf = true;
     }
   }
+  if (!rejects && nullaryRejectionsOf(fn).length) rejects = true;
+  // A Scotty `status 40x` is a rejection only if the function also halts the handler (finish, raise, raiseStatus, redirect). Position is not
+  // judged here: a bare `finish` operand carries its enclosing node's line (often the function head), so a line comparison would reject
+  // the ordinary `Nothing -> status status401 >> finish`. The inline-guard path, which can order against the first sensitive call, does.
+  if (!rejects && statusRejects.length && haltLinesOf(fn).length) rejects = true;
   // literal comparisons against an admin role count as a role check
   for (const n of Object.values(fn.cfg.nodes)) for (const e of exprsOfNode(n)) for (const x of walkIr(e)) {
     if (x.kind === 'binary' && (x.op === '==' || x.op === '===' || x.op === '!=')) {
@@ -188,7 +273,7 @@ const identsIr = (e) => { const out = new Set(); for (const x of walkIr(e)) { if
 
 // ── handler summary ─────────────────────────────────────────────────────────
 // Ordered call list (program order) + principal / id / ownership facts for one handler function IR.
-function handlerFacts(ctx, fn) {
+function handlerFacts(ctx, fn, opts = {}) {
   const ordered = [];
   const nodes = Object.entries(fn.cfg.nodes).map(([id, n]) => ({ id, ...n })).sort((a, b) => Number(a.id.slice(1)) - Number(b.id.slice(1)));
   const assigns = [];
@@ -226,26 +311,40 @@ function handlerFacts(ctx, fn) {
   // a WAI response, a Servant throwError or a Yesod permissionDenied ends the handler by itself.
   // `finish` is usually a bare operand (`status status401 >> finish`, `when bad finish`), which the IR records as an identifier
   // rather than a call, so halting points are collected from both, by source line.
-  const HALT = /^Web\.Scotty(?:\.Trans)?\.(?:finish|raise|raiseStatus|redirect)$/;
-  const haltLines = [];
-  for (const n of nodes) for (const root of exprsOfNode(n)) for (const e of walkIr(root)) {
-    if ((e.kind === 'call' ? e.callee : e.kind === 'ident' ? e.name : null) && HALT.test(e.kind === 'call' ? e.callee : e.name)) haltLines.push(Number.isFinite(e.line) ? e.line : n.line);
-  }
+  const haltLines = haltLinesOf(fn);
   const sensLine = sensIdx >= 0 ? ordered[sensIdx].line : Infinity;
   const haltsAfter = (line) => haltLines.some((h) => Number.isFinite(h) && h >= line && h < sensLine);
   // The complete call list (not the node walk, which does not descend into case alternatives), ordered by source line.
-  const allCalls = callsOf(fn).filter((c) => typeof c.callee === 'string' && Number.isFinite(c.line)).sort((x, y) => x.line - y.line);
+  const allCalls = [...callsOf(fn), ...nullaryRejectionsOf(fn)].filter((c) => typeof c.callee === 'string' && Number.isFinite(c.line)).sort((x, y) => x.line - y.line);
+  const credReads = credentialReadsOf(fn);
+  // Credential reads in source order: calls that read one, and handler parameters bound to a credential header (Servant `Header "Authorization"`),
+  // whose "read" is their first use in the body.
+  const reads = [];
+  for (const c of allCalls) if (credReads.has(c)) reads.push({ line: c.line, kind: credReads.get(c), callee: c.callee, call: c });
+  for (const cp of opts.credentialParams || []) {
+    let first = null;
+    for (const n of nodes) for (const root of exprsOfNode(n)) for (const e of walkIr(root)) if (e.kind === 'ident' && e.name === cp.name && Number.isFinite(n.line) && (first === null || n.line < first)) first = n.line;
+    if (first !== null) reads.push({ line: first, kind: cp.kind, callee: `param:${cp.name}`, call: null });
+  }
+  reads.sort((x, y) => x.line - y.line);
   let inlineIdx = -1, inlineKind = null, inlineLine = null, inlineCallee = null;
-  for (let i = 0; i < allCalls.length && inlineIdx < 0; i++) {
-    const k = credentialKind(allCalls[i]);
-    if (!k) continue;
-    for (let j = i + 1; j < allCalls.length && allCalls[j].line < sensLine; j++) {
+  for (let i = 0; i < reads.length && inlineIdx < 0; i++) {
+    const rd = reads[i];
+    if (!(rd.line <= sensLine)) break;
+    // (a) a rejection at or after the read and before the first sensitive operation, by line. Scotty's `status` only sets the code, so there a
+    // halting call must follow too.
+    for (let j = 0; j < allCalls.length && allCalls[j].line < sensLine; j++) {
       const r = allCalls[j];
-      if (!isRejection(r)) continue;
-      const setsStatusOnly = /^Web\.Scotty(?:\.Trans)?\.status$/.test(r.callee);
-      if (setsStatusOnly && !haltsAfter(allCalls[i].line)) continue;   // an identifier carries its enclosing node's line, so position is judged from the credential read
-      inlineIdx = j; inlineKind = k; inlineLine = r.line; inlineCallee = allCalls[i].callee; break;
+      if (r === rd.call || r.line < rd.line || !isRejection(r) || !stopsHandler(r, allCalls)) continue;
+      if (SCOTTY_STATUS.test(r.callee) && !haltsAfter(rd.line)) continue;   // an identifier carries its enclosing node's line, so position is judged from the credential read
+      inlineIdx = j; inlineKind = rd.kind; inlineLine = r.line; inlineCallee = rd.callee; break;
     }
+    if (inlineIdx >= 0) break;
+    // (b) a rejection that ends the handler by itself (WAI response handed back, throwError, permissionDenied, raiseStatus). A call in tail position
+    // (the last statement, a case alternative) reports the enclosing line, not its own, so its line cannot be ordered against the sensitive
+    // operation; the ordering that CAN be trusted is the credential read against the first sensitive operation, tested above.
+    const hard = allCalls.findIndex((r) => r !== rd.call && isRejection(r) && !SCOTTY_STATUS.test(r.callee) && stopsHandler(r, allCalls));
+    if (hard >= 0) { inlineIdx = hard; inlineKind = rd.kind; inlineLine = allCalls[hard].line; inlineCallee = rd.callee; break; }
   }
   const principals = new Set();
   for (const a of assigns) if (a.source.kind === 'call' && isGuardCall(a.source)) principals.add(a.target);
@@ -285,7 +384,7 @@ function newRoute(r) { return { auth: { status: 'unknown', kind: null, evidence:
 function analyzeRoute(ctx, route, handlerFn, opts) {
   const R = route;
   if (!handlerFn) { R.handler = R.handler || { kind: 'unknown' }; R.auth = { status: 'unknown', kind: null, evidence: [], reason: 'handler not resolved' }; return; }
-  const facts = handlerFacts(ctx, handlerFn);
+  const facts = handlerFacts(ctx, handlerFn, opts);
   for (const v of opts.principalVars || []) facts.principals.add(v);
   for (const v of opts.idVars || []) facts.idVars.add(v);
   const gs = guardSummary(ctx, handlerFn);
@@ -460,6 +559,7 @@ function expandChain(chain, acc) {
   const name = first.t === 'con' ? first.v : null;
   if (name === 'Capture' || name === 'Capture\'') { const nm = head.find((t) => t.t === 'str'); a.path.push(`:${nm ? nm.v : 'param'}`); a.captures.push(nm ? nm.v : 'param'); a.order.push(`capture:${nm ? nm.v : 'param'}`); }
   else if (name === 'QueryParam' || name === 'QueryParam\'' || name === 'QueryParams') { const nm = head.find((t) => t.t === 'str'); a.params.push(nm ? nm.v : '?'); a.order.push(`query:${nm ? nm.v : '?'}`); }
+  else if (name === 'Header' || name === 'Header\'') { const nm = head.find((t) => t.t === 'str'); a.order.push(`header:${nm ? nm.v : '?'}`); }
   else if (name === 'ReqBody') a.order.push('body');
   else if (name === 'BasicAuth') { a.auth = { kind: 'basic', tag: 'BasicAuth' }; a.order.push('auth'); }
   else if (name === 'AuthProtect') { const nm = head.find((t) => t.t === 'str'); a.auth = { kind: 'token', tag: nm ? nm.v : 'AuthProtect' }; a.order.push('auth'); if (nm && /admin|role|perm/i.test(nm.v)) a.role = true; }
@@ -654,11 +754,16 @@ export function analyzeHaskellWeb(files, opts = {}) {
       (p.servant.order || []).forEach((kind, i) => {
         const nm = paramNames[i]; if (!nm) return;
         if (kind === 'auth') o.principalVars.push(nm);
+        else if (/^header:/.test(kind) && CREDENTIAL_HEADER.test(kind.slice(7))) (o.credentialParams ||= []).push({ name: nm, kind: /cookie/i.test(kind) ? 'cookie' : 'token' });
         else if (/^(?:capture|query):.*id$/i.test(kind)) o.idVars.push(nm);
       });
     } else if (p.framework === 'servant') {
       o.idVars = [];
-      (p.servant.order || []).forEach((kind, i) => { const nm = paramNames[i]; if (nm && /^(?:capture|query):.*id$/i.test(kind)) o.idVars.push(nm); });
+      (p.servant.order || []).forEach((kind, i) => {
+        const nm = paramNames[i]; if (!nm) return;
+        if (/^(?:capture|query):.*id$/i.test(kind)) o.idVars.push(nm);
+        else if (/^header:/.test(kind) && CREDENTIAL_HEADER.test(kind.slice(7))) (o.credentialParams ||= []).push({ name: nm, kind: /cookie/i.test(kind) ? 'cookie' : 'token' });
+      });
     }
     if (p.framework === 'yesod') {
       o.idVars = paramNames.filter(Boolean);