@clear-capabilities/agentic-security-scanner 0.159.0 → 0.161.0

package/src/language/haskell-supply.js

@@ -7,7 +7,8 @@ import { join } from 'node:path';
 import { analyzeHaskellManifests } from './haskell-manifests.js';
 import { buildHaskellIR } from './haskell-ir.js';
 import { getLastRefresh, refreshHackageAdvisories, liveFeedEnabled, FEED_ENV } from './haskell-advisory-feed.js';
-import { AdvisoryDb, loadAdvisorySnapshot, evaluateComponents, reachability, nearNameCandidates, sourceIntegrity, lifecycle, licensePolicy, hackagePurl, GHC_BOOT_PACKAGES } from './haskell-sca.js';
+import { AdvisoryDb, loadAdvisorySnapshot, evaluateComponents, reachability, nearNameCandidates, sourceIntegrity, lifecycle, licensePolicy, hackagePurl, GHC_BOOT_PACKAGES, rangeToIntervals, intervalsContain, baseRangeForGhc } from './haskell-sca.js';
+import { deriveCppContext } from './haskell-cpp.js';
 
 const MANIFEST = /(?:^|\/)(?:[^/]+\.cabal|cabal\.project(?:\.[a-z]+)?|package\.yaml|stack\.yaml|stack\.yaml\.lock)$/;
 const SCOPE = { runtime: 'required', test: 'optional', benchmark: 'optional', setup: 'optional', 'build-tool': 'optional' };
@@ -38,12 +39,16 @@ export function hackageComponents(files) {
   // workspace package, not to Hackage; reporting it would raise advisories about the project's own (usually fixed) version as if it were a
   // dependency. Found by the live Hackage feed bench (aeson's own test suite depends on aeson).
   const defined = new Set([...(manifests.packages || []), ...(manifests.hpack || [])].map((p) => p.name).filter(Boolean));
+  // Every distinct DECLARED USE is kept (not just the first per package and scope): a second manifest or component with a different range was
+  // never evaluated, so a worse status could hide behind a milder kept one. The evaluator reports the worst per package, scope and advisory
+  // and lists the components that carry it; `components` below keeps the old one-per-package-and-scope shape for inventories.
   const seen = new Map();
   for (const d of manifests.dependencies || []) {
     if (defined.has(d.name)) continue;
     const lock = lockedFor(d.name, d.manifest);
     const resolved = (lock && lock.version) || d.exactPin || null;
-    const key = `${d.name}@${d.scope || 'runtime'}@${resolved || ''}`;   // a covered (resolved) use is not merged into an uncovered one
+    // a covered (resolved) use is not merged into an uncovered one; an uncovered use is distinguished by where and how it is declared
+    const key = `${d.name}@${d.scope || 'runtime'}@${resolved || ''}@${resolved ? '' : `${d.manifest}|${d.component || ''}|${d.declaredRange || ''}|${d.rangeKind || ''}`}`;
     if (seen.has(key)) continue;
     seen.set(key, {
       ecosystem: 'hackage', name: d.name, version: resolved, declaredRange: d.declaredRange || null, unbounded: !resolved && !d.declaredRange && d.rangeKind === 'unbounded',
@@ -71,7 +76,96 @@ export function hackageComponents(files) {
     c.unbounded = false;
     c.rangeInheritedFromSibling = true;
   }
-  return { components: [...seen.values()], manifests };
+  // Project-level bounds from cabal.project: `constraints:` narrow a declared range (the solver must satisfy both) and `allow-newer` /
+  // `allow-older` widen it. Both apply only to a use with no resolved version, from a project file that actually governs the manifest.
+  const bounds = projectBounds(manifests);
+  for (const c of seen.values()) {
+    if (c.version) continue;
+    const gov = bounds.governing(c.manifest);
+    if (!gov.length) continue;
+    const cons = bounds.constraintsFor(c.name, gov);
+    const relax = bounds.relaxationsFor(c.name, gov);
+    if (relax.length) c.relaxation = relax;
+    if (!cons.length) continue;
+    // an exact pin inside the declared range IS the resolved version; anything else is an interval to intersect
+    const pins = cons.filter((x) => x.pin);
+    const distinctPins = [...new Set(pins.map((x) => x.pin))];
+    const declaredIv = c.declaredRange ? rangeToIntervals(c.declaredRange) : [{ lo: null, loInc: false, hi: null, hiInc: false }];
+    if (distinctPins.length === 1 && declaredIv && (!c.declaredRange || intervalsContain(declaredIv, distinctPins[0])) && cons.every((x) => x.pin || (rangeToIntervals(x.text) && intervalsContain(rangeToIntervals(x.text), distinctPins[0])))) {
+      const p = pins[0];
+      c.version = distinctPins[0]; c.resolution = 'constraint-pin'; c.versionSource = { file: p.file, line: p.line || null }; c.unbounded = false;
+      c.projectConstraints = cons.map(({ text, file, line }) => ({ text, file, line }));
+    } else {
+      c.projectConstraints = cons.map(({ text, file, line }) => ({ text, file, line }));
+    }
+  }
+  // Collapse uses that ended up identical (same package, scope, version, bounds): one entry, every declaring component kept in `carriers`.
+  const merged = new Map();
+  for (const c of seen.values()) {
+    const key = `${c.name}@${c.scope}@${c.version || ''}@${c.version ? '' : `${c.declaredRange || ''}|${c.unbounded}|${(c.projectConstraints || []).map((x) => x.text).join(',')}|${(c.relaxation || []).map((x) => x.direction).join(',')}`}`;
+    const carrier = { file: c.manifest, line: c.line, target: c.target, componentKind: c.componentKind, declaredRange: c.declaredRange };
+    if (merged.has(key)) { merged.get(key).carriers.push(carrier); continue; }
+    merged.set(key, { ...c, carriers: [carrier] });
+  }
+  const uses = [...merged.values()];
+  const first = new Map();
+  for (const c of uses) { const k = `${c.name}@${c.scope}@${c.version || ''}`; if (!first.has(k)) first.set(k, c); }
+  return { components: [...first.values()], uses, manifests, bounds: { conditionalConstraintsSkipped: bounds.conditionalSkipped } };
+}
+
+const isRemotePattern = (p) => /^[a-z][a-z0-9+.-]*:\/\//i.test(p);
+/** Does a cabal.project `packages:` pattern name this manifest (a .cabal, or a package.yaml whose cabal file is generated beside it)? */
+function patternNames(pattern, relManifest) {
+  let pat = String(pattern).trim().replace(/^\.\//, '');
+  if (pat === '' || pat === '.') pat = '*.cabal';
+  else if (pat.endsWith('/')) pat = `${pat}*.cabal`;
+  else if (!pat.endsWith('.cabal')) pat = `${pat}/*.cabal`;
+  const rel = /(?:^|\/)package\.yaml$/.test(relManifest) ? relManifest.replace(/package\.yaml$/, 'package.cabal') : relManifest;
+  const re = new RegExp(`^${pat.split('**').map((seg) => seg.split('*').map((x) => x.replace(/[.+?^${}()|[\]\\]/g, '\\$&')).join('[^/]*')).join('.*')}$`);
+  return re.test(rel);
+}
+
+/**
+ * cabal.project constraints and relaxations, scoped to the manifests a project file governs. A project governs a manifest only when the
+ * manifest sits at or below the project's directory AND matches one of its `packages:` patterns (a project with no `packages:` governs
+ * the .cabal file in its own directory, which is cabal's default). A constraint under an `if` is not in force everywhere and is not applied
+ * (counted in `conditionalSkipped` and disclosed). A freeze file is handled as a resolution, not here.
+ */
+function projectBounds(manifests) {
+  const dirOf = (p) => (typeof p === 'string' && p.includes('/') ? p.slice(0, p.lastIndexOf('/')) : '');
+  const isFreeze = (f) => /\.freeze$|(?:^|\/)cabal\.config$/.test(f || '');
+  const projects = (manifests.projects || []).filter((p) => p.kind === 'cabal-project' && !isFreeze(p.file));
+  const constraints = [];
+  let conditionalSkipped = 0;
+  for (const c of manifests.constraints || []) {
+    if (c.kind !== 'range' || !c.range || isFreeze(c.manifest)) continue;
+    if (c.qualifier && c.qualifier !== 'any') continue;
+    if (c.conditions && c.conditions.length) { conditionalSkipped += 1; continue; }
+    constraints.push({ name: c.name, text: c.rangeText, file: c.file, line: c.line, project: c.manifest, pin: c.range.t === 'cmp' && c.range.op === '==' && !c.range.wildcard ? c.range.text : null });
+  }
+  const governs = (project, manifest) => {
+    const base = dirOf(project.file);
+    let rel;
+    if (base === '') rel = manifest;
+    else if (manifest.startsWith(`${base}/`)) rel = manifest.slice(base.length + 1);
+    else return false;
+    const pats = (project.packages || []).map((x) => x.pattern).filter((x) => typeof x === 'string' && !isRemotePattern(x));
+    return (pats.length ? pats : ['.']).some((pat) => patternNames(pat, rel));
+  };
+  const relaxMatches = (target, dep) => {
+    const t = String(target || '').trim().replace(/^\^/, '');
+    if (t === '' || t === 'all' || t === '*' || t === '*:*') return true;
+    const parts = t.split(':');
+    const last = parts[parts.length - 1];
+    return last === dep || last === '*';
+  };
+  return {
+    conditionalSkipped,
+    governing: (manifest) => projects.filter((p) => typeof manifest === 'string' && governs(p, manifest)),
+    constraintsFor: (name, gov) => constraints.filter((c) => c.name === name && gov.some((p) => p.file === c.project)),
+    // A relaxation naming package `a:dep` is applied to `dep` wherever it is used: widening more than the cabal semantics is the safe direction.
+    relaxationsFor: (name, gov) => gov.flatMap((p) => (p.allowRelaxations || []).filter((r) => relaxMatches(r.target, name)).map((r) => ({ direction: r.direction, target: r.target, file: r.file, line: r.line }))),
+  };
 }
 
 /**
@@ -130,6 +224,70 @@ export async function prefetchHackageFeed(files, { env = process.env, resolvedCo
   } catch (e) { return { status: 'failed', detail: `the feed step failed: ${String((e && e.message) || e).slice(0, 120)}` }; }
 }
 
+/**
+ * The compiler this project is built with, only when it is stated: `with-compiler`, a Stack `compiler:`, a plan's compiler-id, or a
+ * `tested-with` whose every item is the same exact version (a claim by the project, weaker than a pin). Sources that disagree, or a
+ * `tested-with` listing several versions, leave it UNKNOWN, never a guess.
+ * @returns {{version: string|null, label: string, basis: string|null, reason: string|null}}
+ */
+export function projectCompiler(files, manifests, resolved) {
+  const pins = [];
+  const take = (v, basis) => { if (typeof v === 'string') { const m = /(?:^|[\\/])ghc-(\d+(?:\.\d+)+)$/.exec(v.trim()); if (m) pins.push({ version: m[1], basis }); } };
+  for (const p of (manifests && manifests.projects) || []) take(p.withCompiler, 'with-compiler');
+  for (const s of (manifests && manifests.stack) || []) take(s.compiler, 'stack compiler');
+  const pc = resolved && resolved.compiler;
+  if (pc && /^ghc$/i.test(pc.name || 'ghc') && pc.version) pins.push({ version: pc.version, basis: 'plan compiler-id' });
+  const distinct = [...new Set(pins.map((p) => p.version))];
+  if (distinct.length > 1) return { version: null, label: 'unknown compiler', basis: null, reason: `the project states conflicting compilers: ${pins.map((p) => `${p.basis} ${p.version}`).join(', ')}` };
+  if (distinct.length === 1) return { version: distinct[0], label: `GHC ${distinct[0]}`, basis: [...new Set(pins.map((p) => p.basis))].join(' + '), reason: null };
+  let tested = null;
+  try { tested = deriveCppContext(files).ghc; } catch { /* unreadable manifests state nothing */ }
+  if (tested && tested.basis === 'tested-with') {
+    const vs = [...new Set(tested.versions.map((v) => v.join('.')))];
+    if (vs.length === 1) return { version: vs[0], label: `GHC ${vs[0]}`, basis: 'tested-with (the project\'s own claim, not a pin)', reason: null };
+    return { version: null, label: 'unknown compiler', basis: null, reason: `tested-with lists several GHC versions: ${vs.join(', ')}; none is pinned` };
+  }
+  return { version: null, label: 'unknown compiler', basis: null, reason: 'no compiler is pinned by with-compiler, a Stack compiler or a plan, and no tested-with names exactly one version' };
+}
+
+/** A compiler-provided package takes its version from the plan's boot unit, else (for base) the compiler's base series; otherwise it stays as declared. */
+function resolveBootComponent(c, compiler, resolved) {
+  if (!c.ghcComponent || c.version) return c;
+  const boot = resolved && resolved.bootLibraries && resolved.bootLibraries.find((b) => b.name === c.name && b.version);
+  if (boot) return { ...c, version: boot.version, resolution: 'plan-compiler', versionSource: boot.versionSource || null, compilerDerived: { compiler: compiler.label, basis: 'plan boot library' } };
+  if (compiler.version && c.name === 'base') {
+    const range = baseRangeForGhc(compiler.version);
+    if (range) return { ...c, declaredRange: range, unbounded: false, declaredRangeAsWritten: c.declaredRange || null, compilerDerived: { compiler: compiler.label, basis: compiler.basis, rule: `base ${range} is the base series of ${compiler.label}` } };
+  }
+  return c;
+}
+
+const GHC_RANK = { affected: 3, 'possibly-affected': 2, unknown: 1 };
+/** One finding per advisory for the project's compiler: members, the worst status, and a remediation that names the compiler. */
+function groupCompilerFindings(findings, compiler) {
+  const byAdvisory = new Map();
+  for (const f of findings) { const k = `${f.osvId}\u0000${(f.ids && f.ids[0]) || ''}`; if (!byAdvisory.has(k)) byAdvisory.set(k, []); byAdvisory.get(k).push(f); }
+  const out = [];
+  for (const members of byAdvisory.values()) {
+    const rank = (f) => GHC_RANK[f.matchStatus] || 0;
+    const lead = members.slice().sort((a, b) => rank(b) - rank(a))[0];
+    const packages = [...new Set(members.map((m) => m.name))].sort();
+    const fixed = [...new Set(members.flatMap((m) => m.fixedIn || []))];
+    const list = packages.join(', ');
+    const fixText = fixed.length ? `a release that ships ${list} ${fixed.join(' or ')} or later` : `a release with a fixed ${list} (none is published yet)`;
+    const remediation = compiler.version
+      ? `${list} ${packages.length > 1 ? 'are' : 'is'} provided by the compiler, and this project builds with ${compiler.label} (${compiler.basis}). Upgrade GHC to ${fixText}; a Cabal bound does not change the compiler's own library.`
+      : `${list} ${packages.length > 1 ? 'are' : 'is'} provided by the compiler, and this project's compiler is unknown (${compiler.reason}), so which ${list} version applies cannot be decided. Pin one with with-compiler in cabal.project, or supply a Cabal plan, to decide it. The fix is a compiler upgrade: upgrade GHC to ${fixText}.`;
+    out.push({
+      ...lead, name: list, packages, grouped: 'compiler', ghcComponent: true, compiler: { version: compiler.version, label: compiler.label, basis: compiler.basis, reason: compiler.reason },
+      matchStatus: lead.matchStatus, remediation,
+      members: members.map((m) => ({ name: m.name, scope: m.scope, version: m.version, declaredRange: m.declaredRange, matchStatus: m.matchStatus, matchReason: m.matchReason, resolution: m.resolution, carriedBy: m.carriedBy, ...(m.compilerDerived ? { compilerDerived: m.compilerDerived } : {}) })),
+      memberCount: members.length,
+    });
+  }
+  return out;
+}
+
 /** Imports and import-qualified callees across the project's Haskell sources. */
 export function collectUsage(files) {
   const hs = {};
@@ -156,9 +314,15 @@ export function analyzeHaskellSupply(files, { db = undefined, root = null, env =
   if (!components.length) return out;
   let feedReason = null;
   if (db === undefined) { const c = configuredAdvisoryDb(root, env); db = c.db; feedReason = c.reason; }
-  const ev = evaluateComponents(components, db, { kev, epss });
-  out.statuses = ev.statuses;
+  const compiler = projectCompiler(files, manifests, resolved);
+  out.compiler = compiler;
+  // Evaluate every distinct declared use (the evaluator reports the worst per package, scope and advisory), with compiler-provided packages
+  // resolved against the project's compiler where that can be decided.
+  const evalComponents = mergeResolved(hc.uses, resolved).map((c) => resolveBootComponent(c, compiler, resolved));
+  const ev = evaluateComponents(evalComponents, db, { kev, epss });
+  out.statuses = ev.statuses.map((s) => (s.ghcComponent ? { ...s, compiler: compiler.label } : s));
   out.feed = ev.feed;
+  if (hc.bounds && hc.bounds.conditionalConstraintsSkipped) out.gaps.push({ kind: 'conditional-constraints-not-applied', detail: `${hc.bounds.conditionalConstraintsSkipped} cabal.project constraint(s) sit under a condition (if os(...), flag, compiler) and were NOT applied to declared ranges; they are not in force everywhere, so a declared range they would narrow is judged as written` });
   if (!db) out.gaps.push({ kind: 'advisory-feed-unavailable', detail: `${feedReason || ev.feed.detail}. ${components.length} Hackage dependencies were NOT checked against any advisory: the absence of findings is not a clean result.` });
   else if (ev.feed.status === 'stale-cache') out.gaps.push({ kind: 'advisory-feed-stale', detail: ev.feed.detail });
   const notCovered = ev.statuses.filter((x) => x.status === 'feed-incomplete' || x.status === 'feed-stale');
@@ -173,8 +337,13 @@ export function analyzeHaskellSupply(files, { db = undefined, root = null, env =
     f.reachability = r;
     f.functionReachable = r.function === 'reachable' ? 'reachable' : (r.function === 'not-imported' ? 'unreachable' : 'unknown');
     f.reachabilityTier = r.import === 'imported' ? (r.function === 'reachable' ? 'function-reachable' : 'import-reachable') : (r.import === 'not-imported' ? 'not-imported' : 'unknown');
-    out.supplyChain.push({ ...f, file: f.file, line: f.line });
   }
+  // Compiler-provided packages (GHC boot libraries) are one finding per advisory for the project's compiler, not one per package and scope:
+  // the fix is a compiler upgrade whatever the Cabal bounds say. Every member stays listed in the group and every use keeps its status row.
+  const ordinary = ev.findings.filter((f) => !f.ghcComponent);
+  const groups = groupCompilerFindings(ev.findings.filter((f) => f.ghcComponent), compiler);
+  for (const f of [...ordinary, ...groups]) out.supplyChain.push({ ...f, file: f.file, line: f.line });
+  out.counts = { dependencyFindings: ordinary.length, compilerAdvisories: groups.length, compilerMemberRows: groups.reduce((n, g) => n + g.memberCount, 0), statusRows: out.statuses.length };
   // policy
   const si = sourceIntegrity(manifests || {});
   for (const s of si.filter((x) => x.finding)) {

package/src/language/haskell-web.js

@@ -90,6 +90,7 @@ class Ctx {
     this.fnByQid = new Map();
     for (const f of Object.values(this.ir.perFile)) for (const fn of f.functions) this.fnByQid.set(fn.qid, fn);
     this.guardMemo = new Map();
+    this.handlerAst = new Map();   // handler IR fn -> { mod, rhss } for handlers lowered from an expression (named top-level ones are found by name)
     this.gaps = [];
     this.limits = [];
   }
@@ -271,6 +272,17 @@ function kidsIr(e) {
 function* walkIr(e, depth = 0) { if (!e || typeof e !== 'object' || depth > 80) return; yield e; for (const c of kidsIr(e)) yield* walkIr(c, depth + 1); }
 const identsIr = (e) => { const out = new Set(); for (const x of walkIr(e)) { if (x.kind === 'ident' && x.name) out.add(x.name); if (x.kind === 'member' && x.object) { for (const y of walkIr(x.object)) if (y.kind === 'ident') out.add(y.name); } } return out; };
 
+function isSensitiveCall(ctx, c) {
+  if (SENSITIVE_PREFIX.some((p) => c.callee.startsWith(p))) return true;
+  const bare = c.callee.split('.').pop();
+  if (PERSIST_FNS.has(bare) && !/^(?:Prelude|Data|Web)\./.test(c.callee)) return true;
+  if (c.hs && c.hs.status === 'resolved' && c.hs.target) {
+    const sub = ctx.fnByQid.get(c.hs.target);
+    if (sub && callsOf(sub).some((x) => SENSITIVE_PREFIX.some((p) => (x.callee || '').startsWith(p)))) return true;
+  }
+  return false;
+}
+
 // ── handler summary ─────────────────────────────────────────────────────────
 // Ordered call list (program order) + principal / id / ownership facts for one handler function IR.
 function handlerFacts(ctx, fn, opts = {}) {
@@ -294,16 +306,7 @@ function handlerFacts(ctx, fn, opts = {}) {
     if (c.hs && c.hs.status === 'resolved' && c.hs.target) return guardSummary(ctx, ctx.fnByQid.get(c.hs.target)).auth;
     return false;
   };
-  const isSensitive = (c) => {
-    if (SENSITIVE_PREFIX.some((p) => c.callee.startsWith(p))) return true;
-    const bare = c.callee.split('.').pop();
-    if (PERSIST_FNS.has(bare) && !/^(?:Prelude|Data|Web)\./.test(c.callee)) return true;
-    if (c.hs && c.hs.status === 'resolved' && c.hs.target) {
-      const sub = ctx.fnByQid.get(c.hs.target);
-      if (sub && callsOf(sub).some((x) => SENSITIVE_PREFIX.some((p) => (x.callee || '').startsWith(p)))) return true;
-    }
-    return false;
-  };
+  const isSensitive = (c) => isSensitiveCall(ctx, c);
   const guardIdx = ordered.findIndex((o) => isGuardCall(o.call));
   const sensIdx = ordered.findIndex((o) => isSensitive(o.call));
   // An INLINE guard: the handler itself reads a credential and, before any sensitive operation, rejects. Scotty's `status` only sets the
@@ -327,7 +330,7 @@ function handlerFacts(ctx, fn, opts = {}) {
     if (first !== null) reads.push({ line: first, kind: cp.kind, callee: `param:${cp.name}`, call: null });
   }
   reads.sort((x, y) => x.line - y.line);
-  let inlineIdx = -1, inlineKind = null, inlineLine = null, inlineCallee = null;
+  let inlineIdx = -1, inlineKind = null, inlineLine = null, inlineCallee = null, inlineRejectCallee = null;
   for (let i = 0; i < reads.length && inlineIdx < 0; i++) {
     const rd = reads[i];
     if (!(rd.line <= sensLine)) break;
@@ -337,14 +340,14 @@ function handlerFacts(ctx, fn, opts = {}) {
       const r = allCalls[j];
       if (r === rd.call || r.line < rd.line || !isRejection(r) || !stopsHandler(r, allCalls)) continue;
       if (SCOTTY_STATUS.test(r.callee) && !haltsAfter(rd.line)) continue;   // an identifier carries its enclosing node's line, so position is judged from the credential read
-      inlineIdx = j; inlineKind = rd.kind; inlineLine = r.line; inlineCallee = rd.callee; break;
+      inlineIdx = j; inlineKind = rd.kind; inlineLine = r.line; inlineCallee = rd.callee; inlineRejectCallee = r.callee; break;
     }
     if (inlineIdx >= 0) break;
     // (b) a rejection that ends the handler by itself (WAI response handed back, throwError, permissionDenied, raiseStatus). A call in tail position
     // (the last statement, a case alternative) reports the enclosing line, not its own, so its line cannot be ordered against the sensitive
     // operation; the ordering that CAN be trusted is the credential read against the first sensitive operation, tested above.
     const hard = allCalls.findIndex((r) => r !== rd.call && isRejection(r) && !SCOTTY_STATUS.test(r.callee) && stopsHandler(r, allCalls));
-    if (hard >= 0) { inlineIdx = hard; inlineKind = rd.kind; inlineLine = allCalls[hard].line; inlineCallee = rd.callee; break; }
+    if (hard >= 0) { inlineIdx = hard; inlineKind = rd.kind; inlineLine = allCalls[hard].line; inlineCallee = rd.callee; inlineRejectCallee = allCalls[hard].callee; break; }
   }
   const principals = new Set();
   for (const a of assigns) if (a.source.kind === 'call' && isGuardCall(a.source)) principals.add(a.target);
@@ -357,7 +360,7 @@ function handlerFacts(ctx, fn, opts = {}) {
       if (nm && /id$/i.test(nm)) idVars.add(a.target);
     }
   }
-  return { ordered, guardIdx, inlineIdx, inlineKind, inlineLine, inlineCallee, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
+  return { ordered, guardIdx, inlineIdx, inlineKind, inlineLine, inlineCallee, inlineRejectCallee, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
 }
 
 function hasOwnership(ctx, facts) {
@@ -378,6 +381,181 @@ function hasOwnership(ctx, facts) {
   return null;
 }
 
+// ── structural order of an inline guard (WAI, Servant, Yesod) ──────────────────
+// For these frameworks the IR reports a call in tail position (the last statement, a case alternative) at the ENCLOSING line, so a line
+// number cannot say whether the rejection runs before the first sensitive operation. The handler's own syntax tree can: this walks it in
+// evaluation order (statements of a do block in sequence, a scrutinee or condition before its branches, `when`/`unless`/`if`/`case` as forks)
+// and proves, per sensitive operation, whether a rejection that follows a credential read has already been passed on every path to it.
+//
+//   * A branch is REJECTING when every path through it ends in a rejection reached after a credential read. The sibling branches of a rejecting
+//     branch, and everything after the conditional, are GUARDED. This is a statement about control flow only: it does not judge that the
+//     condition really examines the credential (the same laxity the line-based check had).
+//   * `throwError`, `permissionDenied` and `notAuthenticated` stop the handler wherever they appear. A WAI `respond`/`return` of a 401 stops it only in
+//     TAIL position (the value the handler hands back); a mid-block `respond` is followed by the next statement, so it is not a rejection.
+//   * Anything not understood (a rejection mixed with a sensitive operation inside one opaque expression, a body that is not available as
+//     source, a sensitive call the walk did not find) makes the order UNKNOWN, and unknown is reported as late, never as authenticated.
+// Leaf expressions are classified by lowering them alone and reusing the classifiers above (credentialReadsOf, isRejection, stopsHandler,
+// isSensitiveCall), so this adds ordering and no second definition of what a credential, a rejection or a sensitive call is.
+const HARD_REJECT_HEAD = /^(?:throwError|permissionDenied|notAuthenticated)$/;
+const SOFT_REJECT_HEAD = /^(?:respond|return|pure)$/;
+
+function rhsBranches(rhs) {
+  if (!rhs) return [];
+  if (Array.isArray(rhs.guards) && rhs.guards.length) return rhs.guards.map((g) => ({ quals: g.quals || [], body: g.body }));
+  return [{ quals: [], body: rhs.body }];
+}
+
+function handlerSource(ctx, fn) {
+  const reg = ctx.handlerAst.get(fn);
+  if (reg) return reg;
+  const mod = ctx.modOf(fn.file);
+  const fun = mod && mod.groups.funs.find((f) => `${mod.name}.${f.name}` === fn.name);
+  return fun ? { mod, rhss: fun.clauses.map((c) => c.rhs) } : null;
+}
+
+function inlineOrder(ctx, fn, facts, opts) {
+  const src = handlerSource(ctx, fn);
+  if (!src) return { verdict: 'unknown', reason: 'the handler body is not available as source structure' };
+  const credNames = new Set((opts.credentialParams || []).map((c) => c.name));
+  const irSens = callsOf(fn).filter((c) => typeof c.callee === 'string' && isSensitiveCall(ctx, c)).length;
+  const T = { astSens: 0, failed: false, unordered: false };
+  const memo = new Map();
+  const localSens = new Map();    // a name bound by let/where to an expression that performs a sensitive operation -> how many
+  let seq = 0;
+  const mentions = (e, names) => { for (const x of walkAst(e)) if (x.t === 'var' && !x.qual && names.has(x.name)) return x.name; return null; };
+  const classify = (e) => {
+    if (memo.has(e)) return memo.get(e);
+    let out = { reads: false, rej: false, sensN: 0 };
+    try {
+      const f2 = lowerHandlerExpr(ctx.project, src.mod, e, `order${seq++}`, Number.isFinite(e.line) ? e.line : 1);
+      const calls = [...callsOf(f2), ...nullaryRejectionsOf(f2)].filter((c) => typeof c.callee === 'string');
+      out = {
+        // an argument-less credential read (`maybeAuthId`, `lookupBearerAuth`) is an identifier, not a call, when it is lowered on its own
+        reads: credentialReadsOf(f2).size > 0 || Object.values(f2.cfg.nodes).some((n) => exprsOfNode(n).some((r) => [...walkIr(r)].some((x) => x.kind === 'ident' && typeof x.name === 'string' && !!credentialKind({ callee: x.name, args: [] })))),
+        rej: calls.some((c) => isRejection(c) && !SCOTTY_STATUS.test(c.callee) && stopsHandler(c, calls)),
+        sensN: callsOf(f2).filter((c) => typeof c.callee === 'string' && isSensitiveCall(ctx, c)).length,
+      };
+    } catch { T.failed = true; }
+    // A lambda inside the expression is lifted out by the lowering, so the calls in its body are not among the expression's own: classify
+    // each lambda body on its own and fold it in (over-counting is the safe direction here).
+    memo.set(e, out);
+    for (const x of walkAst(e)) {
+      const bodies = x.t === 'lam' ? [x.body] : x.t === 'lamcase' ? (x.alts || []).flatMap((a) => rhsBranches(a.rhs).map((b) => b.body)) : [];
+      for (const b of bodies) { const sub = classify(b); out = { reads: out.reads || sub.reads, rej: out.rej || sub.rej, sensN: out.sensN + sub.sensN }; }
+    }
+    T.astSens += out.sensN;
+    memo.set(e, out);
+    return out;
+  };
+  const newAcc = () => ({ sens: [], guards: 0 });
+  const localMentions = (e) => { const out = []; for (const x of walkAst(e)) if (x.t === 'var' && !x.qual && localSens.has(x.name)) out.push(x.name); return out; };
+
+  const atom = (e, st, tail, acc) => {
+    const c = classify(e);
+    let s = st;
+    if (c.reads || (credNames.size && mentions(e, credNames))) s = { ...s, read: true, readMay: true };
+    let n = c.sensN;
+    for (const nm of localMentions(e)) n += localSens.get(nm);
+    for (let i = 0; i < n; i++) acc.sens.push({ guarded: s.guarded, readMay: s.readMay });
+    const sp = spine(e);
+    const hn = sp && sp.head ? sp.head.name : null;
+    if (c.rej && n === 0 && hn && (HARD_REJECT_HEAD.test(hn) || (tail && SOFT_REJECT_HEAD.test(hn))) && s.read) { acc.guards++; return { st: s, term: true }; }
+    if (c.rej && n > 0) T.unordered = true;
+    return { st: s, term: false };
+  };
+  // Run alternative branches. A branch that always rejects (after a read) guards its siblings and everything after the fork.
+  const fork = (st, kids, acc) => {
+    const rejecting = kids.map((k) => k(st, newAcc()).term);
+    const base = rejecting.some(Boolean) ? { ...st, guarded: true } : st;
+    const outs = kids.map((k, i) => k(rejecting[i] ? st : base, acc));
+    const live = outs.filter((o) => !o.term);
+    if (!live.length) return { st, term: true };
+    return { st: { read: live.every((o) => o.st.read), readMay: st.readMay || live.some((o) => o.st.readMay), guarded: live.every((o) => o.st.guarded) }, term: false };
+  };
+  const letDecls = (decls, st) => {
+    let s = st;
+    for (const d of decls || []) {
+      const rhs = d && d.t === 'clause' ? d.clause && d.clause.rhs : d && d.t === 'patbind' ? d.rhs : null;
+      if (!rhs) continue;
+      for (const b of rhsBranches(rhs)) {
+        const c = classify(b.body);
+        if (c.reads || (credNames.size && mentions(b.body, credNames))) s = { ...s, read: true, readMay: true };
+        if (c.sensN && d.t === 'clause' && d.name) localSens.set(d.name, (localSens.get(d.name) || 0) + c.sensN);
+      }
+    }
+    return s;
+  };
+  const walkBranch = (b, st, tail, acc) => {
+    let s = st;
+    for (const q of b.quals || []) {
+      if (q.t === 'qlet') { s = letDecls(q.decls, s); continue; }
+      const r = walk(q.e, s, false, acc);
+      if (r.term) return r;
+      s = r.st;
+    }
+    return walk(b.body, s, tail, acc);
+  };
+  const altKids = (alts, tail) => (alts || []).flatMap((alt) => rhsBranches(alt.rhs).map((b) => (s, a) => walkBranch(b, s, tail, a)));
+  const walkStmts = (stmts, st, tail, acc) => {
+    let s = st;
+    for (let i = 0; i < stmts.length; i++) {
+      const stmt = stmts[i];
+      const t = tail && i === stmts.length - 1;
+      let r;
+      if (stmt.t === 'sexpr') r = walk(stmt.e, s, t, acc);
+      else if (stmt.t === 'sbind') r = walk(stmt.e, s, false, acc);
+      else if (stmt.t === 'slet') r = { st: letDecls(stmt.decls, s), term: false };
+      else { T.unordered = true; r = { st: s, term: false }; }
+      if (r.term) return r;
+      s = r.st;
+    }
+    return { st: s, term: false };
+  };
+  const walk = (e0, st, tail, acc) => {
+    const e = unparen(e0);
+    if (!e) return { st, term: false };
+    switch (e.t) {
+      case 'do': return walkStmts(e.stmts || [], st, tail, acc);
+      case 'case': { const r = walk(e.scrut, st, false, acc); return r.term ? r : fork(r.st, altKids(e.alts, tail), acc); }
+      case 'lamcase': return fork(st, altKids(e.alts, tail), acc);
+      case 'if': { const r = walk(e.c, st, false, acc); return r.term ? r : fork(r.st, [(s, a) => walk(e.a, s, tail, a), (s, a) => walk(e.b, s, tail, a)], acc); }
+      case 'multiif': return fork(st, (e.guards || []).map((g) => (s, a) => walkBranch({ quals: g.quals || [], body: g.body }, s, tail, a)), acc);
+      case 'lam': return walk(e.body, st, tail, acc);
+      case 'let': return walk(e.body, letDecls(e.decls, st), tail, acc);
+      default: break;
+    }
+    if (e.t === 'app' || (e.t === 'op' && e.op === '$')) {
+      const sp = spine(e);
+      if (sp && sp.head && /^(?:when|unless)$/.test(sp.head.name) && sp.args.length >= 2) {
+        const r = walk(sp.args[0], st, false, acc);
+        return r.term ? r : fork(r.st, [(s, a) => walk(sp.args[1], s, false, a), (s) => ({ st: s, term: false })], acc);
+      }
+    }
+    if (e.t === 'op' && (e.op === '>>' || e.op === '*>' || e.op === '>>=')) {
+      const l = walk(e.l, st, false, acc);
+      return l.term ? l : walk(e.r, l.st, tail, acc);
+    }
+    if (e.t === 'op' && e.op === '=<<') {
+      const r = walk(e.r, st, false, acc);
+      return r.term ? r : walk(e.l, r.st, tail, acc);
+    }
+    return atom(e, st, tail, acc);
+  };
+
+  const acc = newAcc();
+  let s0 = { read: false, readMay: false, guarded: false };
+  for (const rhs of src.rhss) s0 = letDecls(rhs.where || [], s0);
+  fork(s0, src.rhss.flatMap(rhsBranches).map((b) => (s, a) => walkBranch(b, s, true, a)), acc);
+  if (T.failed) return { verdict: 'unknown', reason: 'part of the handler could not be analysed' };
+  if (T.unordered) return { verdict: 'unknown', reason: 'a rejection and a sensitive operation sit in one expression whose order is not modelled' };
+  if (T.astSens < irSens) return { verdict: 'unknown', reason: 'a sensitive operation was not found in the handler source structure' };
+  if (acc.sens.length === 0 && irSens === 0) return { verdict: 'before', reason: 'no sensitive operation to order' };
+  const unguarded = acc.sens.filter((x) => !x.guarded);
+  if (!unguarded.length && acc.guards > 0) return { verdict: 'before' };
+  if (unguarded.length && unguarded.every((x) => x.readMay)) return { verdict: 'after', reason: 'a sensitive operation runs after the credential read and before any rejection' };
+  return { verdict: 'unknown', reason: 'the order of the rejection and the sensitive operations could not be established' };
+}
+
 // ── route record ─────────────────────────────────────────────────────────────
 function newRoute(r) { return { auth: { status: 'unknown', kind: null, evidence: [] }, role: { status: 'none', evidence: [] }, params: [], uploads: false, limits: [], ...r }; }
 
@@ -403,7 +581,11 @@ function analyzeRoute(ctx, route, handlerFn, opts) {
       (sub.kinds || []).forEach((k) => R.credentialKinds.add(k));
     }
   } else if (facts.inlineIdx >= 0) {
-    R.auth = { status: 'authenticated', kind: facts.inlineKind, evidence: [{ kind: 'inline-guard', callee: facts.inlineCallee, line: facts.inlineLine }] };
+    // Scotty reports its halting points reliably. For WAI, Servant and Yesod the candidate (a credential read and a rejection that ends the
+    // handler) is only credited once the STRUCTURE of the handler proves the rejection precedes every sensitive operation.
+    const ord = R.framework === 'scotty' ? { verdict: 'before' } : inlineOrder(ctx, handlerFn, facts, opts);
+    if (ord.verdict === 'before') R.auth = { status: 'authenticated', kind: facts.inlineKind, evidence: [{ kind: 'inline-guard', callee: facts.inlineCallee, line: facts.inlineLine }] };
+    else R.auth = { status: 'late', kind: null, evidence: [{ kind: 'late-guard', callee: facts.inlineRejectCallee || facts.inlineCallee, line: facts.inlineLine, order: ord.verdict, reason: ord.reason }] };
   } else R.auth = { status: 'none', kind: null, evidence: [] };
   // role
   const roleCall = facts.ordered.find((o) => ROLE_CALL.test(o.call.callee || ''));
@@ -730,14 +912,14 @@ export function analyzeHaskellWeb(files, opts = {}) {
         // a handler bound in the enclosing `where` (Servant servers usually are)
         const local = (p.whereDecls || []).find((d) => d.name === head.name && !head.qual);
         if (local && local.clause && local.clause.rhs && local.clause.rhs.body && !(local.clause.rhs.guards && local.clause.rhs.guards.length)) {
-          try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, local.clause.rhs.body, `${p.framework}-${head.name}`, local.line || p.line); handlerName = head.name; paramNames = paramsOf(local.clause); } catch { handlerFn = null; }
+          try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, local.clause.rhs.body, `${p.framework}-${head.name}`, local.line || p.line); ctx.handlerAst.set(handlerFn, { mod: p.mod, rhss: [local.clause.rhs] }); handlerName = head.name; paramNames = paramsOf(local.clause); } catch { handlerFn = null; }
         } else {
           const q = ctx.qualify(p.mod, head);
           if (q && q.qid) { handlerFn = ctx.fnFor(q); handlerName = q.name; const f = topFun(p.mod, head.name); if (f && f.clauses[0]) paramNames = paramsOf(f.clauses[0]); }
           else if (q) handlerName = q.name;
         }
       } else {
-        try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, p.handlerAst, `${p.framework}-${p.line}`, p.line); handlerName = '<inline>'; } catch { handlerFn = null; }
+        try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, p.handlerAst, `${p.framework}-${p.line}`, p.line); ctx.handlerAst.set(handlerFn, { mod: p.mod, rhss: [{ guards: null, body: p.handlerAst, where: [] }] }); handlerName = '<inline>'; } catch { handlerFn = null; }
       }
     }
     R.handler = handlerFn ? { kind: handlerName === '<inline>' ? 'inline' : 'named', name: handlerName } : { kind: 'unknown', name: handlerName };
@@ -851,7 +1033,7 @@ function emitFindings(ctx, result, yesodAuthz) {
     if (!R.handler || R.handler.kind === 'unknown') continue;
     const writes = WRITE_METHODS.has(R.method) || R.method === 'ANY';
     const privileged = ADMIN_PATH.test(R.path) || /admin/i.test(R.handler.name || '');
-    if (R.auth.status === 'late') emit('hs-route-late-auth', R, { detail: `guard ${R.auth.evidence[0].callee} runs after the first sensitive operation`, evidence: R.auth.evidence });
+    if (R.auth.status === 'late') emit('hs-route-late-auth', R, { detail: R.auth.evidence[0].order === 'unknown' ? `the rejection ${R.auth.evidence[0].callee} cannot be shown to run before the first sensitive operation (${R.auth.evidence[0].reason})` : `guard ${R.auth.evidence[0].callee} runs after the first sensitive operation`, evidence: R.auth.evidence });
     else if (R.auth.status === 'none' && (writes || privileged) && R.sensitive !== false) {
       if (!(R.framework === 'yesod' && R.yesodExplicitPublic && !writes)) emit('hs-route-missing-auth', R, { severity: writes ? 'high' : 'medium', detail: R.method === 'ANY' ? 'any method' : 'state-changing method' });
     }

package/src/language/nix-fix.js

@@ -340,7 +340,7 @@ function makeEffectiveCheck(entry) {
 export async function validateNixFix(finding, o) {
   const plan = planNixFix(finding, o.files, o);
   if (!plan.ok) return { status: plan.status || 'unsupported', applied: false, tier: plan.tier, reason: plan.reason, proposal: plan.proposal || null, ...plan };
-  const res = await runFixLifecycle({ plan, files: o.files, finding, matchKey, rescan: o.rescan || rescanNix, syntax: syntaxGate, behaviorCheck: o.behaviorCheck, effectiveCheck: makeEffectiveCheck(entryOf(o.files, o)), writeFile: o.writeFile, witness: o.witness, requireWitness: o.requireWitness, apply: o.apply, root: o.root });
+  const res = await runFixLifecycle({ plan, files: o.files, finding, matchKey, rescan: o.rescan || rescanNix, syntax: syntaxGate, behaviorCheck: o.behaviorCheck, effectiveCheck: makeEffectiveCheck(entryOf(o.files, o)), writeFile: o.writeFile, preWrite: o.preWrite, witness: o.witness, requireWitness: o.requireWitness, apply: o.apply, root: o.root });
   return { ...res, consequences: plan.consequences || [], tier: res.status === 'blocked' ? TIERS.blocked : plan.tier, explanation: plan.explanation };
 }
 

package/src/language/resolved-pass.js

@@ -69,13 +69,16 @@ export function resolvedHackageComponents(files) {
   const SCOPE = { runtime: 'required', test: 'optional', benchmark: 'optional', setup: 'optional', 'build-tool': 'optional' };
   const direct = new Set((g.declared || []).map((d) => d.name));
   const components = [];
+  // Boot libraries are not dependencies to match, but the plan states the exact version the compiler provides: the compiler-advisory
+  // grouping decides a boot-library advisory from it (and from the compiler-id) instead of from a declared range.
+  const bootLibraries = (g.units || []).filter((u) => u.origin === 'compiler' && u.name && u.version).map((u) => ({ name: u.name, version: u.version, versionSource: { file: r.file, line: null } }));
   for (const u of g.units) {
     if (u.origin === 'local' || u.origin === 'compiler' || !u.name || !u.version) continue;   // the project itself and boot libraries are not dependencies to match
     const scopes = Array.isArray(u.scopes) && u.scopes.length ? u.scopes : ['runtime'];
     const scope = scopes.includes('runtime') ? 'runtime' : scopes[0];
     components.push({ ecosystem: 'hackage', name: u.name, version: u.version, declaredRange: null, resolution: 'plan', scope, engineScope: SCOPE[scope] || 'required', target: null, componentKind: u.componentKind || null, manifest: r.file, line: null, ghcComponent: false, direct: direct.has(u.name), unitId: u.id, origin: u.origin, versionSource: { file: r.file, line: null } });
   }
-  return { components, gaps, summary };
+  return { components, bootLibraries, compiler: g.compiler || null, gaps, summary };
 }
 
 // ── Nix closure ──────────────────────────────────────────────────────────────────

package/src/language/witness.js

@@ -92,7 +92,7 @@ export function runNixScriptWitness(w, { timeoutMs = DEFAULT_TIMEOUT_MS, force }
     // 1. a witness that does not parse proves nothing in either direction
     const syn = runConfined([shellBin, '-n', 'witness.sh'], { root, timeoutMs, force });
     if (syn.status === 'disabled' || syn.status === 'error') return { ...base, backend: syn.backend, status: 'invalid', reason: `the sandbox could not run the syntax check (${syn.backend}): ${String(syn.stderr || '').trim() || 'no detail'}` };
-    if (syn.timedOut) return { ...base, backend: syn.backend, status: 'invalid', reason: 'the syntax check exceeded its time budget' };
+    if (syn.timedOut) return { ...base, backend: syn.backend, status: 'invalid', reason: 'the syntax check exceeded its time budget', timedOut: true };
     if (syn.exitCode !== 0) return { ...base, backend: syn.backend, status: 'invalid', reason: `syntax error in the generated witness: ${String(syn.stderr || '').trim().split('\n')[0] || 'shell rejected it'}` };
     // 2. the real run
     const r = runConfined([shellBin, 'witness.sh'], { root, timeoutMs, force });