@clear-capabilities/agentic-security-scanner 0.159.0 → 0.161.0

package/src/mcp/CLAUDE.md

@@ -13,7 +13,7 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 | `lookup_cve` | ✓ | reads local OSV / KEV / EPSS cache; staleness-tiered |
 | `synthesize_fix` | ✓ | reads last-scan; returns the patch text |
 | `verify_fix` | ✗ | re-scans patched files in memory, runs lint + the project test suite + the fix-honesty gate + PoC re-check; does not touch the target project's own files, but appends a record to `.agentic-security/fix-metrics.jsonl` per attempt |
-| `apply_fix` | ✗ | writes via `posture/fix-history.js` (with backup) |
+| `apply_fix` | ✗ | writes via `posture/fix-history.js` (with backup). With `plan_digest` it applies a MULTI-FILE NixOS option fix (see "Multi-file apply_fix" below): all files or none, one backup per file, one history group |
 | `append_scratchpad` | ✗ | writes under `.agentic-security/agent-scratchpad/<agent>/<session>/` only |
 | `read_scratchpad` | ✓ | paginated read of scratchpad files |
 | `append_agents_memory` | ✗ | appends to `.agentic-security/AGENTS.md` continual-learning file |
@@ -42,6 +42,8 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 | Path-escape refusal | `tools.js::_confine` lexical check before any fs call |
 | Reserved-write paths | `tools.js::RESERVED_WRITE_*` — `.git/`, `.github/`, `.gitlab/`, `.circleci/`, `.buildkite/`, `.agentic-security/`, `node_modules/`, `.terraform/`, `.aws/`, `k8s/`, manifest basenames, `*.tf`, `docker-compose.yml` |
 | HMAC integrity on findings | `posture/integrity.js` — per-install random key at `$XDG_CONFIG_HOME/agentic-security/scan-key`. **Not** hostname-derived. |
+| Multi-file plan binding | `tools.js::_multiFilePlanDigest` / `_applyMultiFilePlan`: `apply_fix` never accepts file content for a multi-file plan; it recomputes the plan from the signed finding + live tree and compares a digest (finding id, stableId, every path, SHA-256 of every pre/post image) with the caller's `plan_digest`. The lifecycle's `preWrite` hook re-checks the digest of the VERIFIED edits and the targets immediately before the first byte is written |
+| Multi-file confinement | `tools.js::_checkMultiFileTargets`: EVERY file of the plan gets clean root-relative form (no absolute, `..`, `.`, backslash, NUL, empty segment), `_confine` (no symlink leaf, no escape), a no-symlinked-parent check (realpath must equal the lexical path), the reserved-write list, existence, no duplicates, at most 8 files. One bad file refuses the whole plan |
 | Patches pass through unredacted | `tools.js` synthesize_fix / apply_fix — premortem-derived. Patches are not findings; redacting them silently corrupts valid fixes. |
 | Secret redaction on findings | `redact.js` — applied to snippet/description/title/vuln/remediation/trace |
 | Audit log | `audit.js` — NDJSON, hash-chained, at `.agentic-security/mcp-audit.log`. Set `$AGENTIC_SECURITY_AUDIT_WEBHOOK=<url>` to also fire-and-forget POST every entry to a remote witness — closes the full-file-rewrite blind spot. Failures land in `mcp-audit.remote-errors.log` and never block a tool call. |
@@ -70,5 +72,34 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 
 `scan_diff`, `verify_fix` and `synthesize_fix` add the import closure of a Haskell or Nix file and the manifests as context
 (`language/context.js` `withLanguageContext`, bounded in files and bytes, read-only) and still report only the files asked
-about. The tool that previews a fix for these files uses the language fixers; `apply_fix` is unchanged (its generic confined-write
-path), and the language-aware apply with backup and `undo` is the CLI's `fix --apply`.
+about. The tool that previews a fix for these files uses the language fixers. A single-file `apply_fix` is unchanged (its generic
+confined-write path); the language-aware apply with backup and `undo` for everything else is the CLI's `fix --apply`.
+
+## Multi-file `apply_fix` (NixOS option fixes, `plan_digest`)
+
+A NixOS option is judged on the effective configuration, so one fix can edit several files (every definition at the winning
+priority). Flow: `synthesize_fix` returns `languageFix.multiFile` (the files), `languageFix.edits` (per file: path + SHA-256 of
+the before and after image, **no content**) and `languageFix.planDigest` after running the verification gates read-only. The
+caller then sends `apply_fix {finding_id, confirm:true, plan_digest}` (optionally `dry_run:true`, `fixMeta.approval` for a
+high-impact change).
+
+Design decision: the caller **cannot supply file content** on this path (`plan_digest` plus `patch` is refused). The server
+re-derives the plan with `planNixFix` over `loadLanguageProject` and refuses unless the digest matches, so "the plan applied is
+exactly the plan previewed" holds by construction, and a changed project file, a changed finding or an altered digest all give
+`stale:true` with no hint of the expected value. Order of checks: `confirm:true` -> last-scan HMAC -> finding exists -> not shadow
+-> digest format -> Nix finding with stableId -> plan exists and has 2+ files -> digest equal -> every file confined and not
+reserved -> high-impact approval (shared `_highImpactApprovalRefusal`, same code as the `patch` branch) -> lifecycle
+(`validateNixFix`, apply): syntax, rescan (original gone, nothing new at medium+), effective-value gate, then `preWrite`, then
+`writeManyWithBackup` (checks every file unchanged since planning and backs every file up before the first write). History is
+one `languageGroupId` group: `undo` / `undoLast` revert all files or none.
+
+Results are non-leaky: absolute paths are scrubbed to `<root>` and passed through `redactString`. A failed write is reported as
+`applied:false` with `rolledBack` and `rollbackIncomplete` (+ `restoreManually` file names) honestly; an incomplete rollback is
+never reported as success.
+
+What this deliberately does NOT do: no caller-supplied multi-file `patch` (would reopen the plan-binding problem), no Haskell
+multi-file plans (the Haskell planner produces none), no `flake.lock` relock plans (`.lock` is on the reserved-write list and
+the relock path is not a finding fix), no fix-attempt-budget enforcement (the language lifecycle records attempts but, as in the
+CLI, does not enforce a cap), and no `fixMeta` honesty gate (that gate judges a caller's residual/verdict claims, which this
+path does not take). The `preWrite` digest re-check is defence in depth over a deterministic planner and has no independent
+test that fails when it is removed (the earlier digest comparison is the pinned control).

package/src/mcp/tools.js

@@ -349,7 +349,7 @@ function _maybeOffload(sessionRoot, toolName, items) {
 //
 // Exported under the `_internals` convention this codebase already uses
 // (see posture/poc-inprocess.js). Not part of the MCP tool surface.
-export const _internals = { _confine, isReservedWrite: _isReservedWritePath };
+export const _internals = { _confine, isReservedWrite: _isReservedWritePath, checkMultiFileTargets: _checkMultiFileTargets, multiFilePlanDigest: _multiFilePlanDigest };
 
 export const scan_diff = {
   name: 'scan_diff',
@@ -603,10 +603,153 @@ export const explain_finding = {
   },
 };
 
+// FR-307/FR-1002/FR-1003: the high-impact-change approval gate (approval evidence, approver identity, separation of duties),
+// shared by the caller-patch branch and the multi-file plan branch so the two cannot drift. Returns a refusal result, or null
+// when the change is not high-impact or is properly approved.
+function _highImpactApprovalRefusal(ctx, materialClassification, fixMeta) {
+  if (!materialClassification.highImpactCategories.length) return null;
+  const cats = materialClassification.highImpactCategories.join(', ');
+  const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
+  const hasApprovalEvidence = !!(approval && typeof approval === 'object' &&
+    typeof approval.approvedBy === 'string' && approval.approvedBy.trim().length > 0 &&
+    typeof approval.reason === 'string' && approval.reason.trim().length > 0);
+  if (!hasApprovalEvidence) {
+    return {
+      _meta: META, applied: false,
+      reason: `high-impact change (${cats}) requires approval evidence — pass fixMeta.approval: {approvedBy, reason} — before it can be applied`,
+      materialClassification,
+    };
+  }
+  const approverRegistry = loadApproverRegistry(ctx.sessionRoot);
+  const requiredRoles = requiredRolesFor(approverRegistry, materialClassification.highImpactCategories);
+  const identityCheck = verifyApprover(approverRegistry, approval.approvedBy, requiredRoles);
+  if (!identityCheck.verified) {
+    return { _meta: META, applied: false, reason: `high-impact change (${cats}) approval rejected: ${identityCheck.reason}`, materialClassification };
+  }
+  // FR-1003: separation-of-duties, same no-op-unless-configured gate as apply-fix-service.js's own copy; see approver-registry.js.
+  const sodCheck = checkSeparationOfDuties(approverRegistry, fixMeta?.author, approval.approvedBy);
+  if (!sodCheck.ok) {
+    return { _meta: META, applied: false, reason: `high-impact change (${cats}) approval rejected: ${sodCheck.reason}`, materialClassification };
+  }
+  return null;
+}
+
+// ─── Multi-file plans (apply_fix with plan_digest) ───────────────────────────
+// A NixOS option fix can edit several files at once (every definition at the winning priority). apply_fix never accepts file
+// contents for this: it RECOMPUTES the plan from the signed finding and the live tree, and writes only if that plan's digest is
+// the one synthesize_fix returned. The digest binds the finding, every file path, the exact pre-image and the exact post-image
+// of each edit, so a changed tree, a changed finding, or an altered digest all refuse. The write itself is the language
+// lifecycle's all-or-nothing writeManyWithBackup (one backup per file, one history group, honest rollback).
+const MULTI_FILE_MAX = 8;
+const _sha256 = (t) => crypto.createHash('sha256').update(String(t), 'utf8').digest('hex');
+function _multiFilePlanDigest(finding, edits) {
+  const canon = edits.map((e) => ({ file: String(e.file), before: _sha256(e.before), after: _sha256(e.after) })).sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : 0));
+  return _sha256(JSON.stringify({ v: 'mf-plan/1', id: finding.id || null, stableId: finding.stableId || null, edits: canon }));
+}
+// Every file of a multi-file plan gets the SAME checks a single-file apply_fix target gets: root-relative lexical form,
+// confinement (no symlink leaf, no symlinked parent, no escape), reserved-write list, and existence. Returns {ok, reason, abs}.
+function _checkMultiFileTargets(sessionRoot, edits) {
+  if (!Array.isArray(edits) || edits.length < 2) return { ok: false, reason: 'a multi-file plan needs at least two edits' };
+  if (edits.length > MULTI_FILE_MAX) return { ok: false, reason: `a multi-file plan may edit at most ${MULTI_FILE_MAX} files` };
+  const rootReal = fs.realpathSync(path.resolve(sessionRoot));
+  const seen = new Set();
+  const abs = {};
+  for (const e of edits) {
+    const rel = e && e.file;
+    if (typeof rel !== 'string' || !rel || rel.includes('\0') || rel.includes('\\') || path.isAbsolute(rel) || rel.split('/').some((seg) => seg === '..' || seg === '.' || seg === '')) {
+      return { ok: false, reason: `path-escape refused: plan file "${path.isAbsolute(String(rel)) ? '(absolute path)' : String(rel).slice(0, 120)}" is not a clean root-relative path` };
+    }
+    if (seen.has(rel)) return { ok: false, reason: `the same file appears twice in the plan: ${rel}` };
+    seen.add(rel);
+    let real;
+    try { real = _confine(sessionRoot, rel, 'plan file'); }
+    catch (err) { return { ok: false, reason: `path-escape refused: ${String(err.message).split(rootReal).join('<root>')}` }; }
+    if (path.relative(rootReal, real).split(path.sep).join('/') !== rel) return { ok: false, reason: `path-escape refused: plan file "${rel}" resolves through a symbolic link` };
+    if (_isReservedWritePath(sessionRoot, real)) return { ok: false, reason: `reserved path refused: ${rel}` };
+    if (!fs.existsSync(real)) return { ok: false, reason: `plan file not found: ${rel}` };
+    abs[rel] = real;
+  }
+  return { ok: true, abs };
+}
+const _scrubRoot = (sessionRoot, text) => {
+  let out = String(text);
+  const roots = new Set([path.resolve(sessionRoot)]);
+  try { roots.add(fs.realpathSync(path.resolve(sessionRoot))); } catch { /* root vanished: the plain path is still scrubbed */ }
+  for (const r of roots) out = out.split(r).join('<root>');
+  return redactString(out);
+};
+const _gateSummary = (g) => (g ? {
+  path: g.path ? g.path.ok : undefined, syntax: g.syntax ? g.syntax.ok : undefined,
+  rescan: g.rescan ? { ok: g.rescan.ok, originalGone: g.rescan.originalGone, newMediumOrHigher: g.rescan.newMediumOrHigher } : undefined,
+  effective: g.effective ? { ok: g.effective.ok, ran: g.effective.ran === true, detail: g.effective.detail } : undefined,
+  compile: g.compile ? { ran: g.compile.ran === true, ok: g.compile.ok } : undefined,
+} : null);
+
+async function _applyMultiFilePlan({ f, planDigest, dryRun, fixMeta, ctx, status }) {
+  const refuse = (reason, extra = {}) => ({ _meta: META, applied: false, multiFile: true, reason, ...extra });
+  if (typeof planDigest !== 'string' || !/^[0-9a-f]{64}$/.test(planDigest)) return refuse('plan_digest must be the 64-character hex digest returned by synthesize_fix');
+  if (!f.stableId) return refuse('finding has no stableId, so a plan cannot be verified against it');
+  const lc = await import('../language/context.js');
+  if (lc.languageOfFinding(f) !== 'nix') return refuse('multi-file plans are produced for NixOS findings only');
+  const nf = await import('../language/nix-fix.js');
+  const proj = lc.loadLanguageProject(ctx.sessionRoot);
+  const files = proj.files;
+  // The plan is derived here, from the signed finding and the live tree. Nothing the caller sends can supply file content.
+  const plan = nf.planNixFix(f, files);
+  if (!plan || plan.ok === false) return refuse(`no applicable plan: ${_scrubRoot(ctx.sessionRoot, (plan && plan.reason) || 'no deterministic fix')}`);
+  if (!Array.isArray(plan.edits) || plan.edits.length < 2) return refuse('this finding has a single-file plan; use apply_fix without plan_digest');
+  if (_multiFilePlanDigest(f, plan.edits) !== planDigest) {
+    return refuse('plan_digest does not match the plan computed now for this finding: the project files or the finding changed since synthesize_fix, or the digest was altered. Run synthesize_fix again and review the new plan.', { stale: true });
+  }
+  const targets = _checkMultiFileTargets(ctx.sessionRoot, plan.edits);
+  if (!targets.ok) return refuse(targets.reason);
+  const classification = classifyFixMaterialRisk(Object.fromEntries(plan.edits.map((e) => [e.file, { before: e.before, after: e.after }])));
+  if (!dryRun) {
+    const approvalRefusal = _highImpactApprovalRefusal(ctx, classification, fixMeta);
+    if (approvalRefusal) return { ...approvalRefusal, multiFile: true };
+  }
+  // The verification gates (syntax, rescan with no new finding, effective value changed as intended) run inside the lifecycle,
+  // and the pre-write hook re-checks the digest of the VERIFIED edits and the targets immediately before the first byte is written.
+  const preWrite = (verifiedPlan) => {
+    const vedits = Array.isArray(verifiedPlan.edits) ? verifiedPlan.edits : [];
+    if (_multiFilePlanDigest(f, vedits) !== planDigest) return { ok: false, detail: 'the verified plan differs from the previewed plan' };
+    const again = _checkMultiFileTargets(ctx.sessionRoot, vedits);
+    return again.ok ? { ok: true } : { ok: false, detail: again.reason };
+  };
+  let res;
+  try { res = await nf.validateNixFix(f, { files, apply: !dryRun, root: ctx.sessionRoot, preWrite }); }
+  catch (e) { return refuse(`plan verification failed: ${_scrubRoot(ctx.sessionRoot, e.message)}`); }
+  const gates = _gateSummary(res.gates);
+  const touched = plan.edits.map((e) => e.file);
+  if (res.status === 'verified' && dryRun) {
+    return { _meta: META, applied: false, dryRun: true, verified: true, multiFile: true, files: touched, planDigest, gates, materialClassification: classification, diff: res.preview };
+  }
+  if (res.status === 'applied') {
+    let acceptance = null;
+    try { acceptance = fixAcceptanceRate(ctx.sessionRoot); } catch { /* best-effort */ }
+    const hist = Array.isArray(res.history) ? res.history : [];
+    const allRecorded = hist.length === touched.length && hist.every(Boolean);
+    return {
+      _meta: META, applied: true, verified: true, multiFile: true, files: touched, planDigest,
+      groupId: res.backup && res.backup.id, historyIds: hist.map((h) => (h ? h.id : null)),
+      ...(allRecorded ? {} : { warning: 'the files were written and backed up, but the fix history could not record every entry; restore with the group backup under .agentic-security/fix-backups' }),
+      gates, integrity: status, acceptance, materialClassification: classification,
+    };
+  }
+  // Blocked or failed: nothing is left changed unless rollbackIncomplete says otherwise.
+  const incomplete = res.rolledBack === false;
+  return {
+    _meta: META, applied: false, multiFile: true, files: touched,
+    reason: _scrubRoot(ctx.sessionRoot, res.reason || `plan not applied (${res.status})`),
+    gates,
+    ...(res.rolledBack !== undefined ? { rolledBack: res.rolledBack === true, rollbackIncomplete: incomplete, ...(incomplete ? { restoreManually: (res.rollbackFailed || []).map(String) } : {}) } : {}),
+  };
+}
+
 // ─── apply_fix ───────────────────────────────────────────────────────────────
 export const apply_fix = {
   name: 'apply_fix',
-  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing. On success, `verified:true` means verification passed but `verifiedFull:true` is the honest signal that every required leg (lint when configured, tests when a runner exists) genuinely ran — a false `verifiedFull` with `verified:true` means the pass is real but degraded (see `verify.degradedLegs`), not a full verification.',
+  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing. On success, `verified:true` means verification passed but `verifiedFull:true` is the honest signal that every required leg (lint when configured, tests when a runner exists) genuinely ran — a false `verifiedFull` with `verified:true` means the pass is real but degraded (see `verify.degradedLegs`), not a full verification. MULTI-FILE NixOS FIX: when synthesize_fix returns `languageFix.planDigest` (an option defined in several files, edited together), pass it back as `plan_digest`. apply_fix then RECOMPUTES the plan itself from the signed finding and the live files, refuses unless its digest matches (so a changed tree, a changed finding or an altered digest all refuse; you never send file content), applies the same confinement, reserved-path, shadow and high-impact-approval checks to EVERY file, runs the verification gates (syntax, rescan with no new finding, the option resolves to the intended value on the patched configuration) before writing, and writes all files or none with one backup per file and one history group that `undo` reverts together. A rollback that could not complete is reported as `rollbackIncomplete` with the files to restore. `plan_digest` cannot be combined with `patch`.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -614,6 +757,7 @@ export const apply_fix = {
       finding_id: { type: 'string', minLength: 1, maxLength: 256 },
       confirm: { type: 'boolean' },
       dry_run: { type: 'boolean' },
+      plan_digest: { type: 'string', minLength: 64, maxLength: 64 },
       patch: {
         type: 'object',
         additionalProperties: { type: 'string', maxLength: 500_000 },
@@ -673,7 +817,7 @@ export const apply_fix = {
     },
     required: ['finding_id', 'confirm'],
   },
-  async handler({ finding_id, confirm, dry_run = false, patch = null, fixMeta = null }, ctx) {
+  async handler({ finding_id, confirm, dry_run = false, patch = null, fixMeta = null, plan_digest = null }, ctx) {
     if (confirm !== true) {
       return { _meta: META, applied: false, reason: 'apply_fix requires confirm: true.' };
     }
@@ -687,6 +831,15 @@ export const apply_fix = {
       return { _meta: META, applied: false, reason: 'shadow findings cannot be auto-applied' };
     }
 
+    // Multi-file plan (a NixOS option defined in several files). The plan is recomputed here and bound by plan_digest; the
+    // caller can never supply file content on this path, and it cannot be combined with `patch`.
+    if (plan_digest !== null && plan_digest !== undefined) {
+      if (patch && typeof patch === 'object' && Object.keys(patch).length) {
+        return { _meta: META, applied: false, reason: 'plan_digest and patch cannot be combined: a multi-file plan is computed by the scanner, not supplied by the caller' };
+      }
+      return _applyMultiFilePlan({ f, planDigest: plan_digest, dryRun: dry_run === true, fixMeta, ctx, status });
+    }
+
     // #3 — verifier-approved patch path. When the caller supplies `patch` (a
     // files map, same shape as verify_fix), apply_fix re-runs the verifier
     // INLINE and writes only if it passes: the original finding's stableId is
@@ -762,39 +915,8 @@ export const apply_fix = {
       if (dry_run) {
         return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, materialClassification };
       }
-      if (materialClassification.highImpactCategories.length) {
-        const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
-        const hasApprovalEvidence = !!(approval && typeof approval === 'object' &&
-          typeof approval.approvedBy === 'string' && approval.approvedBy.trim().length > 0 &&
-          typeof approval.reason === 'string' && approval.reason.trim().length > 0);
-        if (!hasApprovalEvidence) {
-          return {
-            _meta: META, applied: false,
-            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) requires approval evidence — pass fixMeta.approval: {approvedBy, reason} — before it can be applied`,
-            materialClassification,
-          };
-        }
-        const approverRegistry = loadApproverRegistry(ctx.sessionRoot);
-        const requiredRoles = requiredRolesFor(approverRegistry, materialClassification.highImpactCategories);
-        const identityCheck = verifyApprover(approverRegistry, approval.approvedBy, requiredRoles);
-        if (!identityCheck.verified) {
-          return {
-            _meta: META, applied: false,
-            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${identityCheck.reason}`,
-            materialClassification,
-          };
-        }
-        // FR-1003: separation-of-duties, same no-op-unless-configured gate
-        // as apply-fix-service.js's own copy — see approver-registry.js.
-        const sodCheck = checkSeparationOfDuties(approverRegistry, fixMeta?.author, approval.approvedBy);
-        if (!sodCheck.ok) {
-          return {
-            _meta: META, applied: false,
-            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${sodCheck.reason}`,
-            materialClassification,
-          };
-        }
-      }
+      const approvalRefusal = _highImpactApprovalRefusal(ctx, materialClassification, fixMeta);
+      if (approvalRefusal) return approvalRefusal;
       const written = [];
       try {
         for (const [rel, v] of Object.entries(confinedAbs)) {
@@ -1025,7 +1147,7 @@ export const verify_fix = {
 // sequence with the returned blob.
 export const synthesize_fix = {
   name: 'synthesize_fix',
-  description: 'Return the stored fix replacement for a finding (replacement text + remediation + plan if the patch is too large). Read-only; never writes to disk. Use verify_fix → apply_fix to deploy.',
+  description: 'Return the stored fix replacement for a finding (replacement text + remediation + plan if the patch is too large). Read-only; never writes to disk. Use verify_fix → apply_fix to deploy. For a NixOS option defined in several files, `languageFix.multiFile` lists every file, `languageFix.edits` gives each file\'s before/after SHA-256 (no file content) and `languageFix.planDigest` is the value to pass to apply_fix as `plan_digest`; the preview is verified but nothing is written.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -1079,8 +1201,15 @@ export const synthesize_fix = {
             const proj = lc.loadLanguageProject(ctx.sessionRoot);
             const prev = await lc.languageFixPreview(f, proj.files);
             languageFix = { status: prev.status, ok: prev.ok, label: prev.label || null, tier: prev.tier || null, reason: prev.reason || null, diff: prev.diff || null, explanation: prev.explanation || null, consequences: prev.consequences || [] };
-            // apply_fix writes ONE file; a fix that spans several files must go through the CLI lifecycle (atomic, grouped undo).
-            if (prev.ok && prev.edits) languageFix.multiFile = prev.edits.map((e) => e.file);
+            // A fix that spans several files is applied with apply_fix + plan_digest (atomic, one history group); see _applyMultiFilePlan.
+            if (prev.ok && prev.edits) {
+              languageFix.multiFile = prev.edits.map((e) => e.file);
+              // The digest binds finding + every file + exact pre/post image. Pass it to apply_fix as plan_digest; apply_fix
+              // recomputes the plan itself and refuses on any difference. No file content is ever sent back to apply_fix.
+              languageFix.planDigest = _multiFilePlanDigest(f, prev.edits);
+              languageFix.edits = prev.edits.map((e) => ({ file: e.file, beforeSha256: _sha256(e.before), afterSha256: _sha256(e.after) }));
+              languageFix.applyWith = { finding_id: f.id, confirm: true, plan_digest: languageFix.planDigest };
+            }
             else if (prev.ok) autofix = { deterministic: true, ruleId: f.rule || f.family || null, patch: prev.after, file: prev.file, label: prev.label || null, verified: true };
           }
         } catch { /* best-effort: the preview is advisory */ }

package/src/posture/blast-radius.js

@@ -734,8 +734,12 @@ function buildNarrative(finding, signals) {
     ` (controls reducing cost: ${[...signals.controls].join(', ')})` : '';
   const line = finding.line || finding.source?.line || finding.sink?.line || 0;
 
+  // A dependency advisory (Hackage, Nix) carries no `vuln` text, and `vuln` also feeds finding identity, so it is not invented there: the
+  // narrative builds its own label from what the finding does state, and leaves out a location clause it has no location for.
+  const label = finding.vuln || finding.title || advisoryLabel(finding);
+  const where = finding.file ? ` on \`${finding.file}:${line}\`` : '';
   const narrative =
-    `${finding.vuln || finding.title} on \`${finding.file}:${line}\` ` +
+    `${label}${where} ` +
     `could ${dataAtRisk.includes('rce') ? 'lead to' : 'expose'} ${dataPhrase}. ` +
     `Context: ${indProfile.label} / ${jurStr}${controlsStr}. ` +
     `Estimated cost: best ${fmtMoney(total.low)} · likely ${fmtMoney(total.likely)} · worst ${fmtMoney(total.high)}. ` +
@@ -778,6 +782,16 @@ function buildNarrative(finding, signals) {
   };
 }
 
+/** A truthful label for a finding with no `vuln` or `title`: the advisory and package it names, else a plain "Finding". */
+function advisoryLabel(f) {
+  const id = f.osvId || f.advisory || (Array.isArray(f.ids) && f.ids[0]) || null;
+  const pkg = f.name ? `${f.name}${f.version ? ` ${f.version}` : ''}` : null;
+  if (id && pkg) return `Advisory ${id} in ${pkg}`;
+  if (id) return `Advisory ${id}`;
+  if (pkg) return `Vulnerable dependency ${pkg}`;
+  return 'Finding';
+}
+
 function describeDataAtRisk(dataAtRisk, userCount) {
   const n = userCount.toLocaleString();
   if (dataAtRisk.includes('rce'))         return 'full server compromise (remote code execution)';

package/src/posture/remediation-ledger.js

@@ -213,7 +213,11 @@ async function withLock(lockPath, fn) {
             fsp.readFile(lockPath, 'utf8').catch(() => ''),
           ]);
           const pid = parseInt(pidStr.trim(), 10);
-          const pidAlive = Number.isFinite(pid) && isProcessAlive(pid);
+          // A holder creates the file (`wx`) and only then writes its PID, so
+          // an EMPTY file younger than a few seconds is a lock being taken,
+          // not a dead one. Reaping it would hand the lock to two processes.
+          const mid = !pidStr.trim() && Date.now() - st.mtimeMs < 2000;
+          const pidAlive = mid || (Number.isFinite(pid) && isProcessAlive(pid));
           const old = Date.now() - st.mtimeMs > 30000;
           if (!pidAlive || old) {
             try {
@@ -225,6 +229,11 @@ async function withLock(lockPath, fn) {
                 await fsp.unlink(lockPath);
               }
             } catch {}
+            // Bounded: a reap that cannot make progress (unlink refused, the
+            // holder changing under us) must end in the named timeout error,
+            // never spin until an outer watchdog kills the process.
+            if (Date.now() - start > TIMEOUT_MS) throw new Error('remediation-ledger: lock timed out');
+            await new Promise((r) => setTimeout(r, 25));
             continue;
           }
         } catch {}

package/src/sast/pipeline.js

@@ -13,6 +13,44 @@
 const _GH_WORKFLOW_RE = /(?:^|\/)\.github\/workflows\/.*\.ya?ml$/i;
 const _NONPROD_RE = /(?:^|\/)(?:tests?|examples?|fixtures?)\//i;
 
+
+// Matches of the workflow-wide `env:` secret pattern, as { index, end }. See the entry in PIPELINE_PATTERNS.
+// The header is `^env\s*:\s*\n`; its greedy `\s*` ends at the last newline of the whitespace run, and every earlier choice
+// of newline only replays the same lines, so the lazy line loop starts at the line after that newline. Each following line
+// is either the assignment (the tail, tried first, as the lazy loop does) or must itself start with a space or tab.
+const _ENV_HEAD_RE = /^env\s*:\s*/gm;
+const _ENV_TAIL_RE = /[ \t]+[A-Za-z0-9_]+\s*:\s*\$\{\{\s*secrets\.[A-Z0-9_]+\s*\}\}/y;
+export function* scanEnvSecrets(raw, stats) {
+  const head = new RegExp(_ENV_HEAD_RE.source, _ENV_HEAD_RE.flags);
+  const tail = new RegExp(_ENV_TAIL_RE.source, _ENV_TAIL_RE.flags);
+  let pos = 0;
+  while (pos <= raw.length) {
+    head.lastIndex = pos;
+    const h = head.exec(raw);
+    if (!h) return;
+    const afterHead = h.index + h[0].length;
+    const colon = raw.indexOf(':', h.index + 3);
+    const lastNl = raw.lastIndexOf('\n', afterHead - 1);
+    if (lastNl <= colon) { pos = h.index + 1; continue; }   // no newline after the colon: not a header
+    let s = lastNl + 1;
+    let end = -1;
+    for (;;) {
+      tail.lastIndex = s;
+      if (stats) stats.tailAttempts += 1;
+      const t = tail.exec(raw);
+      if (t) { end = s + t[0].length; break; }
+      const c = raw.charCodeAt(s);
+      if (c !== 32 && c !== 9) break;                      // the line loop needs an indented line
+      const nl = raw.indexOf('\n', s);
+      if (nl < 0) break;
+      s = nl + 1;
+    }
+    if (end < 0) { pos = h.index + 1; continue; }
+    yield { index: h.index, end };
+    pos = end > h.index ? end : h.index + 1;
+  }
+}
+
 const PIPELINE_PATTERNS = [
   // ── build hooks common to Haskell (ghcup, Cabal, Stack, Hackage) and Nix pipelines ──
   {
@@ -34,7 +72,12 @@ const PIPELINE_PATTERNS = [
     fix: 'Do not accept a flake\'s own configuration, disable the sandbox, add unauthenticated substituters or evaluate impurely in CI. Put the trust decision in the repository\'s reviewed configuration instead.',
   },
   {
-    re: /^env\s*:\s*\n(?:[ \t]+[^\n]*\n)*?[ \t]+[A-Za-z0-9_]+\s*:\s*\$\{\{\s*secrets\.[A-Z0-9_]+\s*\}\}/gm,
+    // Equivalent to /^env\s*:\s*\n(?:[ \t]+[^\n]*\n)*?[ \t]+[A-Za-z0-9_]+\s*:\s*\$\{\{\s*secrets\.[A-Z0-9_]+\s*\}\}/gm,
+    // which backtracked catastrophically on a comment-blanked workflow (blanking leaves runs of blank lines, and `\s*`, `\n` and
+    // the lazy line loop can all claim them): a real repository's CI directory made a scan run for many minutes. The matcher
+    // below returns the same match starts and ends, in one pass over each `env:` block. Pinned against the original expression
+    // by test/pipeline-env-secret.test.js.
+    scan: scanEnvSecrets,
     vuln: 'Pipeline: secret exposed at workflow-wide environment scope',
     sev: 'medium', cwe: 'CWE-522',
     fix: 'Set secrets such as a Hackage or Cachix token on the single step that needs them (`env:` under that step), not at the top of the workflow where every step and every third-party action can read them.',
@@ -105,9 +148,13 @@ export function scanPipeline(fp, raw) {
       if (p.contextNeg && present) continue; // suppress: required context exists
       if (!p.contextNeg && !present) continue;
     }
-    const re = new RegExp(p.re.source, p.re.flags.includes('g') ? p.re.flags : p.re.flags + 'g');
-    let m;
-    while ((m = re.exec(raw))) {
+    let matches;
+    if (p.scan) matches = p.scan(raw);
+    else {
+      const re = new RegExp(p.re.source, p.re.flags.includes('g') ? p.re.flags : p.re.flags + 'g');
+      matches = (function* () { let mm; while ((mm = re.exec(raw))) yield mm; })();
+    }
+    for (const m of matches) {
       const line = raw.substring(0, m.index).split('\n').length;
       if (p.lineSafeRe && p.lineSafeRe.test((lines[line - 1] || '').trim())) continue;
       const id = `pipeline:${fp}:${line}:${p.vuln.replace(/\s/g, '_').slice(0, 48)}`;