@clear-capabilities/agentic-security-scanner 0.160.0 → 0.162.0

package/src/language/haskell-web.js

@@ -90,6 +90,7 @@ class Ctx {
     this.fnByQid = new Map();
     for (const f of Object.values(this.ir.perFile)) for (const fn of f.functions) this.fnByQid.set(fn.qid, fn);
     this.guardMemo = new Map();
+    this.handlerAst = new Map();   // handler IR fn -> { mod, rhss } for handlers lowered from an expression (named top-level ones are found by name)
     this.gaps = [];
     this.limits = [];
   }
@@ -271,6 +272,17 @@ function kidsIr(e) {
 function* walkIr(e, depth = 0) { if (!e || typeof e !== 'object' || depth > 80) return; yield e; for (const c of kidsIr(e)) yield* walkIr(c, depth + 1); }
 const identsIr = (e) => { const out = new Set(); for (const x of walkIr(e)) { if (x.kind === 'ident' && x.name) out.add(x.name); if (x.kind === 'member' && x.object) { for (const y of walkIr(x.object)) if (y.kind === 'ident') out.add(y.name); } } return out; };
 
+function isSensitiveCall(ctx, c) {
+  if (SENSITIVE_PREFIX.some((p) => c.callee.startsWith(p))) return true;
+  const bare = c.callee.split('.').pop();
+  if (PERSIST_FNS.has(bare) && !/^(?:Prelude|Data|Web)\./.test(c.callee)) return true;
+  if (c.hs && c.hs.status === 'resolved' && c.hs.target) {
+    const sub = ctx.fnByQid.get(c.hs.target);
+    if (sub && callsOf(sub).some((x) => SENSITIVE_PREFIX.some((p) => (x.callee || '').startsWith(p)))) return true;
+  }
+  return false;
+}
+
 // ── handler summary ─────────────────────────────────────────────────────────
 // Ordered call list (program order) + principal / id / ownership facts for one handler function IR.
 function handlerFacts(ctx, fn, opts = {}) {
@@ -294,16 +306,7 @@ function handlerFacts(ctx, fn, opts = {}) {
     if (c.hs && c.hs.status === 'resolved' && c.hs.target) return guardSummary(ctx, ctx.fnByQid.get(c.hs.target)).auth;
     return false;
   };
-  const isSensitive = (c) => {
-    if (SENSITIVE_PREFIX.some((p) => c.callee.startsWith(p))) return true;
-    const bare = c.callee.split('.').pop();
-    if (PERSIST_FNS.has(bare) && !/^(?:Prelude|Data|Web)\./.test(c.callee)) return true;
-    if (c.hs && c.hs.status === 'resolved' && c.hs.target) {
-      const sub = ctx.fnByQid.get(c.hs.target);
-      if (sub && callsOf(sub).some((x) => SENSITIVE_PREFIX.some((p) => (x.callee || '').startsWith(p)))) return true;
-    }
-    return false;
-  };
+  const isSensitive = (c) => isSensitiveCall(ctx, c);
   const guardIdx = ordered.findIndex((o) => isGuardCall(o.call));
   const sensIdx = ordered.findIndex((o) => isSensitive(o.call));
   // An INLINE guard: the handler itself reads a credential and, before any sensitive operation, rejects. Scotty's `status` only sets the
@@ -327,7 +330,7 @@ function handlerFacts(ctx, fn, opts = {}) {
     if (first !== null) reads.push({ line: first, kind: cp.kind, callee: `param:${cp.name}`, call: null });
   }
   reads.sort((x, y) => x.line - y.line);
-  let inlineIdx = -1, inlineKind = null, inlineLine = null, inlineCallee = null;
+  let inlineIdx = -1, inlineKind = null, inlineLine = null, inlineCallee = null, inlineRejectCallee = null;
   for (let i = 0; i < reads.length && inlineIdx < 0; i++) {
     const rd = reads[i];
     if (!(rd.line <= sensLine)) break;
@@ -337,14 +340,14 @@ function handlerFacts(ctx, fn, opts = {}) {
       const r = allCalls[j];
       if (r === rd.call || r.line < rd.line || !isRejection(r) || !stopsHandler(r, allCalls)) continue;
       if (SCOTTY_STATUS.test(r.callee) && !haltsAfter(rd.line)) continue;   // an identifier carries its enclosing node's line, so position is judged from the credential read
-      inlineIdx = j; inlineKind = rd.kind; inlineLine = r.line; inlineCallee = rd.callee; break;
+      inlineIdx = j; inlineKind = rd.kind; inlineLine = r.line; inlineCallee = rd.callee; inlineRejectCallee = r.callee; break;
     }
     if (inlineIdx >= 0) break;
     // (b) a rejection that ends the handler by itself (WAI response handed back, throwError, permissionDenied, raiseStatus). A call in tail position
     // (the last statement, a case alternative) reports the enclosing line, not its own, so its line cannot be ordered against the sensitive
     // operation; the ordering that CAN be trusted is the credential read against the first sensitive operation, tested above.
     const hard = allCalls.findIndex((r) => r !== rd.call && isRejection(r) && !SCOTTY_STATUS.test(r.callee) && stopsHandler(r, allCalls));
-    if (hard >= 0) { inlineIdx = hard; inlineKind = rd.kind; inlineLine = allCalls[hard].line; inlineCallee = rd.callee; break; }
+    if (hard >= 0) { inlineIdx = hard; inlineKind = rd.kind; inlineLine = allCalls[hard].line; inlineCallee = rd.callee; inlineRejectCallee = allCalls[hard].callee; break; }
   }
   const principals = new Set();
   for (const a of assigns) if (a.source.kind === 'call' && isGuardCall(a.source)) principals.add(a.target);
@@ -357,7 +360,7 @@ function handlerFacts(ctx, fn, opts = {}) {
       if (nm && /id$/i.test(nm)) idVars.add(a.target);
     }
   }
-  return { ordered, guardIdx, inlineIdx, inlineKind, inlineLine, inlineCallee, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
+  return { ordered, guardIdx, inlineIdx, inlineKind, inlineLine, inlineCallee, inlineRejectCallee, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
 }
 
 function hasOwnership(ctx, facts) {
@@ -378,6 +381,181 @@ function hasOwnership(ctx, facts) {
   return null;
 }
 
+// ── structural order of an inline guard (WAI, Servant, Yesod) ──────────────────
+// For these frameworks the IR reports a call in tail position (the last statement, a case alternative) at the ENCLOSING line, so a line
+// number cannot say whether the rejection runs before the first sensitive operation. The handler's own syntax tree can: this walks it in
+// evaluation order (statements of a do block in sequence, a scrutinee or condition before its branches, `when`/`unless`/`if`/`case` as forks)
+// and proves, per sensitive operation, whether a rejection that follows a credential read has already been passed on every path to it.
+//
+//   * A branch is REJECTING when every path through it ends in a rejection reached after a credential read. The sibling branches of a rejecting
+//     branch, and everything after the conditional, are GUARDED. This is a statement about control flow only: it does not judge that the
+//     condition really examines the credential (the same laxity the line-based check had).
+//   * `throwError`, `permissionDenied` and `notAuthenticated` stop the handler wherever they appear. A WAI `respond`/`return` of a 401 stops it only in
+//     TAIL position (the value the handler hands back); a mid-block `respond` is followed by the next statement, so it is not a rejection.
+//   * Anything not understood (a rejection mixed with a sensitive operation inside one opaque expression, a body that is not available as
+//     source, a sensitive call the walk did not find) makes the order UNKNOWN, and unknown is reported as late, never as authenticated.
+// Leaf expressions are classified by lowering them alone and reusing the classifiers above (credentialReadsOf, isRejection, stopsHandler,
+// isSensitiveCall), so this adds ordering and no second definition of what a credential, a rejection or a sensitive call is.
+const HARD_REJECT_HEAD = /^(?:throwError|permissionDenied|notAuthenticated)$/;
+const SOFT_REJECT_HEAD = /^(?:respond|return|pure)$/;
+
+function rhsBranches(rhs) {
+  if (!rhs) return [];
+  if (Array.isArray(rhs.guards) && rhs.guards.length) return rhs.guards.map((g) => ({ quals: g.quals || [], body: g.body }));
+  return [{ quals: [], body: rhs.body }];
+}
+
+function handlerSource(ctx, fn) {
+  const reg = ctx.handlerAst.get(fn);
+  if (reg) return reg;
+  const mod = ctx.modOf(fn.file);
+  const fun = mod && mod.groups.funs.find((f) => `${mod.name}.${f.name}` === fn.name);
+  return fun ? { mod, rhss: fun.clauses.map((c) => c.rhs) } : null;
+}
+
+function inlineOrder(ctx, fn, facts, opts) {
+  const src = handlerSource(ctx, fn);
+  if (!src) return { verdict: 'unknown', reason: 'the handler body is not available as source structure' };
+  const credNames = new Set((opts.credentialParams || []).map((c) => c.name));
+  const irSens = callsOf(fn).filter((c) => typeof c.callee === 'string' && isSensitiveCall(ctx, c)).length;
+  const T = { astSens: 0, failed: false, unordered: false };
+  const memo = new Map();
+  const localSens = new Map();    // a name bound by let/where to an expression that performs a sensitive operation -> how many
+  let seq = 0;
+  const mentions = (e, names) => { for (const x of walkAst(e)) if (x.t === 'var' && !x.qual && names.has(x.name)) return x.name; return null; };
+  const classify = (e) => {
+    if (memo.has(e)) return memo.get(e);
+    let out = { reads: false, rej: false, sensN: 0 };
+    try {
+      const f2 = lowerHandlerExpr(ctx.project, src.mod, e, `order${seq++}`, Number.isFinite(e.line) ? e.line : 1);
+      const calls = [...callsOf(f2), ...nullaryRejectionsOf(f2)].filter((c) => typeof c.callee === 'string');
+      out = {
+        // an argument-less credential read (`maybeAuthId`, `lookupBearerAuth`) is an identifier, not a call, when it is lowered on its own
+        reads: credentialReadsOf(f2).size > 0 || Object.values(f2.cfg.nodes).some((n) => exprsOfNode(n).some((r) => [...walkIr(r)].some((x) => x.kind === 'ident' && typeof x.name === 'string' && !!credentialKind({ callee: x.name, args: [] })))),
+        rej: calls.some((c) => isRejection(c) && !SCOTTY_STATUS.test(c.callee) && stopsHandler(c, calls)),
+        sensN: callsOf(f2).filter((c) => typeof c.callee === 'string' && isSensitiveCall(ctx, c)).length,
+      };
+    } catch { T.failed = true; }
+    // A lambda inside the expression is lifted out by the lowering, so the calls in its body are not among the expression's own: classify
+    // each lambda body on its own and fold it in (over-counting is the safe direction here).
+    memo.set(e, out);
+    for (const x of walkAst(e)) {
+      const bodies = x.t === 'lam' ? [x.body] : x.t === 'lamcase' ? (x.alts || []).flatMap((a) => rhsBranches(a.rhs).map((b) => b.body)) : [];
+      for (const b of bodies) { const sub = classify(b); out = { reads: out.reads || sub.reads, rej: out.rej || sub.rej, sensN: out.sensN + sub.sensN }; }
+    }
+    T.astSens += out.sensN;
+    memo.set(e, out);
+    return out;
+  };
+  const newAcc = () => ({ sens: [], guards: 0 });
+  const localMentions = (e) => { const out = []; for (const x of walkAst(e)) if (x.t === 'var' && !x.qual && localSens.has(x.name)) out.push(x.name); return out; };
+
+  const atom = (e, st, tail, acc) => {
+    const c = classify(e);
+    let s = st;
+    if (c.reads || (credNames.size && mentions(e, credNames))) s = { ...s, read: true, readMay: true };
+    let n = c.sensN;
+    for (const nm of localMentions(e)) n += localSens.get(nm);
+    for (let i = 0; i < n; i++) acc.sens.push({ guarded: s.guarded, readMay: s.readMay });
+    const sp = spine(e);
+    const hn = sp && sp.head ? sp.head.name : null;
+    if (c.rej && n === 0 && hn && (HARD_REJECT_HEAD.test(hn) || (tail && SOFT_REJECT_HEAD.test(hn))) && s.read) { acc.guards++; return { st: s, term: true }; }
+    if (c.rej && n > 0) T.unordered = true;
+    return { st: s, term: false };
+  };
+  // Run alternative branches. A branch that always rejects (after a read) guards its siblings and everything after the fork.
+  const fork = (st, kids, acc) => {
+    const rejecting = kids.map((k) => k(st, newAcc()).term);
+    const base = rejecting.some(Boolean) ? { ...st, guarded: true } : st;
+    const outs = kids.map((k, i) => k(rejecting[i] ? st : base, acc));
+    const live = outs.filter((o) => !o.term);
+    if (!live.length) return { st, term: true };
+    return { st: { read: live.every((o) => o.st.read), readMay: st.readMay || live.some((o) => o.st.readMay), guarded: live.every((o) => o.st.guarded) }, term: false };
+  };
+  const letDecls = (decls, st) => {
+    let s = st;
+    for (const d of decls || []) {
+      const rhs = d && d.t === 'clause' ? d.clause && d.clause.rhs : d && d.t === 'patbind' ? d.rhs : null;
+      if (!rhs) continue;
+      for (const b of rhsBranches(rhs)) {
+        const c = classify(b.body);
+        if (c.reads || (credNames.size && mentions(b.body, credNames))) s = { ...s, read: true, readMay: true };
+        if (c.sensN && d.t === 'clause' && d.name) localSens.set(d.name, (localSens.get(d.name) || 0) + c.sensN);
+      }
+    }
+    return s;
+  };
+  const walkBranch = (b, st, tail, acc) => {
+    let s = st;
+    for (const q of b.quals || []) {
+      if (q.t === 'qlet') { s = letDecls(q.decls, s); continue; }
+      const r = walk(q.e, s, false, acc);
+      if (r.term) return r;
+      s = r.st;
+    }
+    return walk(b.body, s, tail, acc);
+  };
+  const altKids = (alts, tail) => (alts || []).flatMap((alt) => rhsBranches(alt.rhs).map((b) => (s, a) => walkBranch(b, s, tail, a)));
+  const walkStmts = (stmts, st, tail, acc) => {
+    let s = st;
+    for (let i = 0; i < stmts.length; i++) {
+      const stmt = stmts[i];
+      const t = tail && i === stmts.length - 1;
+      let r;
+      if (stmt.t === 'sexpr') r = walk(stmt.e, s, t, acc);
+      else if (stmt.t === 'sbind') r = walk(stmt.e, s, false, acc);
+      else if (stmt.t === 'slet') r = { st: letDecls(stmt.decls, s), term: false };
+      else { T.unordered = true; r = { st: s, term: false }; }
+      if (r.term) return r;
+      s = r.st;
+    }
+    return { st: s, term: false };
+  };
+  const walk = (e0, st, tail, acc) => {
+    const e = unparen(e0);
+    if (!e) return { st, term: false };
+    switch (e.t) {
+      case 'do': return walkStmts(e.stmts || [], st, tail, acc);
+      case 'case': { const r = walk(e.scrut, st, false, acc); return r.term ? r : fork(r.st, altKids(e.alts, tail), acc); }
+      case 'lamcase': return fork(st, altKids(e.alts, tail), acc);
+      case 'if': { const r = walk(e.c, st, false, acc); return r.term ? r : fork(r.st, [(s, a) => walk(e.a, s, tail, a), (s, a) => walk(e.b, s, tail, a)], acc); }
+      case 'multiif': return fork(st, (e.guards || []).map((g) => (s, a) => walkBranch({ quals: g.quals || [], body: g.body }, s, tail, a)), acc);
+      case 'lam': return walk(e.body, st, tail, acc);
+      case 'let': return walk(e.body, letDecls(e.decls, st), tail, acc);
+      default: break;
+    }
+    if (e.t === 'app' || (e.t === 'op' && e.op === '$')) {
+      const sp = spine(e);
+      if (sp && sp.head && /^(?:when|unless)$/.test(sp.head.name) && sp.args.length >= 2) {
+        const r = walk(sp.args[0], st, false, acc);
+        return r.term ? r : fork(r.st, [(s, a) => walk(sp.args[1], s, false, a), (s) => ({ st: s, term: false })], acc);
+      }
+    }
+    if (e.t === 'op' && (e.op === '>>' || e.op === '*>' || e.op === '>>=')) {
+      const l = walk(e.l, st, false, acc);
+      return l.term ? l : walk(e.r, l.st, tail, acc);
+    }
+    if (e.t === 'op' && e.op === '=<<') {
+      const r = walk(e.r, st, false, acc);
+      return r.term ? r : walk(e.l, r.st, tail, acc);
+    }
+    return atom(e, st, tail, acc);
+  };
+
+  const acc = newAcc();
+  let s0 = { read: false, readMay: false, guarded: false };
+  for (const rhs of src.rhss) s0 = letDecls(rhs.where || [], s0);
+  fork(s0, src.rhss.flatMap(rhsBranches).map((b) => (s, a) => walkBranch(b, s, true, a)), acc);
+  if (T.failed) return { verdict: 'unknown', reason: 'part of the handler could not be analysed' };
+  if (T.unordered) return { verdict: 'unknown', reason: 'a rejection and a sensitive operation sit in one expression whose order is not modelled' };
+  if (T.astSens < irSens) return { verdict: 'unknown', reason: 'a sensitive operation was not found in the handler source structure' };
+  if (acc.sens.length === 0 && irSens === 0) return { verdict: 'before', reason: 'no sensitive operation to order' };
+  const unguarded = acc.sens.filter((x) => !x.guarded);
+  if (!unguarded.length && acc.guards > 0) return { verdict: 'before' };
+  if (unguarded.length && unguarded.every((x) => x.readMay)) return { verdict: 'after', reason: 'a sensitive operation runs after the credential read and before any rejection' };
+  return { verdict: 'unknown', reason: 'the order of the rejection and the sensitive operations could not be established' };
+}
+
 // ── route record ─────────────────────────────────────────────────────────────
 function newRoute(r) { return { auth: { status: 'unknown', kind: null, evidence: [] }, role: { status: 'none', evidence: [] }, params: [], uploads: false, limits: [], ...r }; }
 
@@ -403,7 +581,11 @@ function analyzeRoute(ctx, route, handlerFn, opts) {
       (sub.kinds || []).forEach((k) => R.credentialKinds.add(k));
     }
   } else if (facts.inlineIdx >= 0) {
-    R.auth = { status: 'authenticated', kind: facts.inlineKind, evidence: [{ kind: 'inline-guard', callee: facts.inlineCallee, line: facts.inlineLine }] };
+    // Scotty reports its halting points reliably. For WAI, Servant and Yesod the candidate (a credential read and a rejection that ends the
+    // handler) is only credited once the STRUCTURE of the handler proves the rejection precedes every sensitive operation.
+    const ord = R.framework === 'scotty' ? { verdict: 'before' } : inlineOrder(ctx, handlerFn, facts, opts);
+    if (ord.verdict === 'before') R.auth = { status: 'authenticated', kind: facts.inlineKind, evidence: [{ kind: 'inline-guard', callee: facts.inlineCallee, line: facts.inlineLine }] };
+    else R.auth = { status: 'late', kind: null, evidence: [{ kind: 'late-guard', callee: facts.inlineRejectCallee || facts.inlineCallee, line: facts.inlineLine, order: ord.verdict, reason: ord.reason }] };
   } else R.auth = { status: 'none', kind: null, evidence: [] };
   // role
   const roleCall = facts.ordered.find((o) => ROLE_CALL.test(o.call.callee || ''));
@@ -730,14 +912,14 @@ export function analyzeHaskellWeb(files, opts = {}) {
         // a handler bound in the enclosing `where` (Servant servers usually are)
         const local = (p.whereDecls || []).find((d) => d.name === head.name && !head.qual);
         if (local && local.clause && local.clause.rhs && local.clause.rhs.body && !(local.clause.rhs.guards && local.clause.rhs.guards.length)) {
-          try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, local.clause.rhs.body, `${p.framework}-${head.name}`, local.line || p.line); handlerName = head.name; paramNames = paramsOf(local.clause); } catch { handlerFn = null; }
+          try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, local.clause.rhs.body, `${p.framework}-${head.name}`, local.line || p.line); ctx.handlerAst.set(handlerFn, { mod: p.mod, rhss: [local.clause.rhs] }); handlerName = head.name; paramNames = paramsOf(local.clause); } catch { handlerFn = null; }
         } else {
           const q = ctx.qualify(p.mod, head);
           if (q && q.qid) { handlerFn = ctx.fnFor(q); handlerName = q.name; const f = topFun(p.mod, head.name); if (f && f.clauses[0]) paramNames = paramsOf(f.clauses[0]); }
           else if (q) handlerName = q.name;
         }
       } else {
-        try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, p.handlerAst, `${p.framework}-${p.line}`, p.line); handlerName = '<inline>'; } catch { handlerFn = null; }
+        try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, p.handlerAst, `${p.framework}-${p.line}`, p.line); ctx.handlerAst.set(handlerFn, { mod: p.mod, rhss: [{ guards: null, body: p.handlerAst, where: [] }] }); handlerName = '<inline>'; } catch { handlerFn = null; }
       }
     }
     R.handler = handlerFn ? { kind: handlerName === '<inline>' ? 'inline' : 'named', name: handlerName } : { kind: 'unknown', name: handlerName };
@@ -851,7 +1033,7 @@ function emitFindings(ctx, result, yesodAuthz) {
     if (!R.handler || R.handler.kind === 'unknown') continue;
     const writes = WRITE_METHODS.has(R.method) || R.method === 'ANY';
     const privileged = ADMIN_PATH.test(R.path) || /admin/i.test(R.handler.name || '');
-    if (R.auth.status === 'late') emit('hs-route-late-auth', R, { detail: `guard ${R.auth.evidence[0].callee} runs after the first sensitive operation`, evidence: R.auth.evidence });
+    if (R.auth.status === 'late') emit('hs-route-late-auth', R, { detail: R.auth.evidence[0].order === 'unknown' ? `the rejection ${R.auth.evidence[0].callee} cannot be shown to run before the first sensitive operation (${R.auth.evidence[0].reason})` : `guard ${R.auth.evidence[0].callee} runs after the first sensitive operation`, evidence: R.auth.evidence });
     else if (R.auth.status === 'none' && (writes || privileged) && R.sensitive !== false) {
       if (!(R.framework === 'yesod' && R.yesodExplicitPublic && !writes)) emit('hs-route-missing-auth', R, { severity: writes ? 'high' : 'medium', detail: R.method === 'ANY' ? 'any method' : 'state-changing method' });
     }

package/src/language/nix-fix.js

@@ -340,7 +340,7 @@ function makeEffectiveCheck(entry) {
 export async function validateNixFix(finding, o) {
   const plan = planNixFix(finding, o.files, o);
   if (!plan.ok) return { status: plan.status || 'unsupported', applied: false, tier: plan.tier, reason: plan.reason, proposal: plan.proposal || null, ...plan };
-  const res = await runFixLifecycle({ plan, files: o.files, finding, matchKey, rescan: o.rescan || rescanNix, syntax: syntaxGate, behaviorCheck: o.behaviorCheck, effectiveCheck: makeEffectiveCheck(entryOf(o.files, o)), writeFile: o.writeFile, witness: o.witness, requireWitness: o.requireWitness, apply: o.apply, root: o.root });
+  const res = await runFixLifecycle({ plan, files: o.files, finding, matchKey, rescan: o.rescan || rescanNix, syntax: syntaxGate, behaviorCheck: o.behaviorCheck, effectiveCheck: makeEffectiveCheck(entryOf(o.files, o)), writeFile: o.writeFile, preWrite: o.preWrite, witness: o.witness, requireWitness: o.requireWitness, apply: o.apply, root: o.root });
   return { ...res, consequences: plan.consequences || [], tier: res.status === 'blocked' ? TIERS.blocked : plan.tier, explanation: plan.explanation };
 }
 

package/src/language/resolved-pass.js

@@ -69,13 +69,16 @@ export function resolvedHackageComponents(files) {
   const SCOPE = { runtime: 'required', test: 'optional', benchmark: 'optional', setup: 'optional', 'build-tool': 'optional' };
   const direct = new Set((g.declared || []).map((d) => d.name));
   const components = [];
+  // Boot libraries are not dependencies to match, but the plan states the exact version the compiler provides: the compiler-advisory
+  // grouping decides a boot-library advisory from it (and from the compiler-id) instead of from a declared range.
+  const bootLibraries = (g.units || []).filter((u) => u.origin === 'compiler' && u.name && u.version).map((u) => ({ name: u.name, version: u.version, versionSource: { file: r.file, line: null } }));
   for (const u of g.units) {
     if (u.origin === 'local' || u.origin === 'compiler' || !u.name || !u.version) continue;   // the project itself and boot libraries are not dependencies to match
     const scopes = Array.isArray(u.scopes) && u.scopes.length ? u.scopes : ['runtime'];
     const scope = scopes.includes('runtime') ? 'runtime' : scopes[0];
     components.push({ ecosystem: 'hackage', name: u.name, version: u.version, declaredRange: null, resolution: 'plan', scope, engineScope: SCOPE[scope] || 'required', target: null, componentKind: u.componentKind || null, manifest: r.file, line: null, ghcComponent: false, direct: direct.has(u.name), unitId: u.id, origin: u.origin, versionSource: { file: r.file, line: null } });
   }
-  return { components, gaps, summary };
+  return { components, bootLibraries, compiler: g.compiler || null, gaps, summary };
 }
 
 // ── Nix closure ──────────────────────────────────────────────────────────────────

package/src/language/witness.js

@@ -92,7 +92,7 @@ export function runNixScriptWitness(w, { timeoutMs = DEFAULT_TIMEOUT_MS, force }
     // 1. a witness that does not parse proves nothing in either direction
     const syn = runConfined([shellBin, '-n', 'witness.sh'], { root, timeoutMs, force });
     if (syn.status === 'disabled' || syn.status === 'error') return { ...base, backend: syn.backend, status: 'invalid', reason: `the sandbox could not run the syntax check (${syn.backend}): ${String(syn.stderr || '').trim() || 'no detail'}` };
-    if (syn.timedOut) return { ...base, backend: syn.backend, status: 'invalid', reason: 'the syntax check exceeded its time budget' };
+    if (syn.timedOut) return { ...base, backend: syn.backend, status: 'invalid', reason: 'the syntax check exceeded its time budget', timedOut: true };
     if (syn.exitCode !== 0) return { ...base, backend: syn.backend, status: 'invalid', reason: `syntax error in the generated witness: ${String(syn.stderr || '').trim().split('\n')[0] || 'shell rejected it'}` };
     // 2. the real run
     const r = runConfined([shellBin, 'witness.sh'], { root, timeoutMs, force });

package/src/mcp/CLAUDE.md

@@ -12,8 +12,8 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 | `find_rule_module` | ✓ | reads `scanner/src/{sast,posture}/` to answer "which file detects CWE-X / family Y" |
 | `lookup_cve` | ✓ | reads local OSV / KEV / EPSS cache; staleness-tiered |
 | `synthesize_fix` | ✓ | reads last-scan; returns the patch text |
-| `verify_fix` | ✗ | re-scans patched files in memory, runs lint + the project test suite + the fix-honesty gate + PoC re-check; does not touch the target project's own files, but appends a record to `.agentic-security/fix-metrics.jsonl` per attempt |
-| `apply_fix` | ✗ | writes via `posture/fix-history.js` (with backup) |
+| `verify_fix` | ✗ | re-scans patched files in memory, runs lint + the project test suite + the fix-honesty gate + PoC re-check; does not touch the target project's own files, but appends a record to `.agentic-security/fix-metrics.jsonl` per attempt. Also returns `verificationRecord`, the shared version-1 verification record (X-201; additive, `apply_fix` returns it too): a static re-scan alone is `not-run`, never confirmed |
+| `apply_fix` | ✗ | writes via `posture/fix-history.js` (with backup). With `plan_digest` it applies a MULTI-FILE NixOS option fix (see "Multi-file apply_fix" below): all files or none, one backup per file, one history group |
 | `append_scratchpad` | ✗ | writes under `.agentic-security/agent-scratchpad/<agent>/<session>/` only |
 | `read_scratchpad` | ✓ | paginated read of scratchpad files |
 | `append_agents_memory` | ✗ | appends to `.agentic-security/AGENTS.md` continual-learning file |
@@ -42,6 +42,8 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 | Path-escape refusal | `tools.js::_confine` lexical check before any fs call |
 | Reserved-write paths | `tools.js::RESERVED_WRITE_*` — `.git/`, `.github/`, `.gitlab/`, `.circleci/`, `.buildkite/`, `.agentic-security/`, `node_modules/`, `.terraform/`, `.aws/`, `k8s/`, manifest basenames, `*.tf`, `docker-compose.yml` |
 | HMAC integrity on findings | `posture/integrity.js` — per-install random key at `$XDG_CONFIG_HOME/agentic-security/scan-key`. **Not** hostname-derived. |
+| Multi-file plan binding | `tools.js::_multiFilePlanDigest` / `_applyMultiFilePlan`: `apply_fix` never accepts file content for a multi-file plan; it recomputes the plan from the signed finding + live tree and compares a digest (finding id, stableId, every path, SHA-256 of every pre/post image) with the caller's `plan_digest`. The lifecycle's `preWrite` hook re-checks the digest of the VERIFIED edits and the targets immediately before the first byte is written |
+| Multi-file confinement | `tools.js::_checkMultiFileTargets`: EVERY file of the plan gets clean root-relative form (no absolute, `..`, `.`, backslash, NUL, empty segment), `_confine` (no symlink leaf, no escape), a no-symlinked-parent check (realpath must equal the lexical path), the reserved-write list, existence, no duplicates, at most 8 files. One bad file refuses the whole plan |
 | Patches pass through unredacted | `tools.js` synthesize_fix / apply_fix — premortem-derived. Patches are not findings; redacting them silently corrupts valid fixes. |
 | Secret redaction on findings | `redact.js` — applied to snippet/description/title/vuln/remediation/trace |
 | Audit log | `audit.js` — NDJSON, hash-chained, at `.agentic-security/mcp-audit.log`. Set `$AGENTIC_SECURITY_AUDIT_WEBHOOK=<url>` to also fire-and-forget POST every entry to a remote witness — closes the full-file-rewrite blind spot. Failures land in `mcp-audit.remote-errors.log` and never block a tool call. |
@@ -70,5 +72,42 @@ MCP server. JSON-RPC 2.0 over NDJSON on stdin/stdout. Bin entry `../../bin/agent
 
 `scan_diff`, `verify_fix` and `synthesize_fix` add the import closure of a Haskell or Nix file and the manifests as context
 (`language/context.js` `withLanguageContext`, bounded in files and bytes, read-only) and still report only the files asked
-about. The tool that previews a fix for these files uses the language fixers; `apply_fix` is unchanged (its generic confined-write
-path), and the language-aware apply with backup and `undo` is the CLI's `fix --apply`.
+about. The tool that previews a fix for these files uses the language fixers. A single-file `apply_fix` is unchanged (its generic
+confined-write path); the language-aware apply with backup and `undo` for everything else is the CLI's `fix --apply`.
+
+## Multi-file `apply_fix` (NixOS option fixes, `plan_digest`)
+
+A NixOS option is judged on the effective configuration, so one fix can edit several files (every definition at the winning
+priority). Flow: `synthesize_fix` returns `languageFix.multiFile` (the files), `languageFix.edits` (per file: path + SHA-256 of
+the before and after image, **no content**) and `languageFix.planDigest` after running the verification gates read-only. The
+caller then sends `apply_fix {finding_id, confirm:true, plan_digest}` (optionally `dry_run:true`, `fixMeta.approval` for a
+high-impact change).
+
+Design decision: the caller **cannot supply file content** on this path (`plan_digest` plus `patch` is refused). The server
+re-derives the plan with `planNixFix` over `loadLanguageProject` and refuses unless the digest matches, so "the plan applied is
+exactly the plan previewed" holds by construction, and a changed project file, a changed finding or an altered digest all give
+`stale:true` with no hint of the expected value. Order of checks: `confirm:true` -> last-scan HMAC -> finding exists -> not shadow
+-> digest format -> Nix finding with stableId -> plan exists and has 2+ files -> digest equal -> every file confined and not
+reserved -> high-impact approval (shared `_highImpactApprovalRefusal`, same code as the `patch` branch) -> lifecycle
+(`validateNixFix`, apply): syntax, rescan (original gone, nothing new at medium+), effective-value gate, then `preWrite`, then
+`writeManyWithBackup` (checks every file unchanged since planning and backs every file up before the first write). History is
+one `languageGroupId` group: `undo` / `undoLast` revert all files or none.
+
+Results are non-leaky: absolute paths are scrubbed to `<root>` and passed through `redactString`. A failed write is reported as
+`applied:false` with `rolledBack` and `rollbackIncomplete` (+ `restoreManually` file names) honestly; an incomplete rollback is
+never reported as success.
+
+What this deliberately does NOT do: no caller-supplied multi-file `patch` (would reopen the plan-binding problem), no Haskell
+multi-file plans (the Haskell planner produces none), no `flake.lock` relock plans (`.lock` is on the reserved-write list and
+the relock path is not a finding fix), no fix-attempt-budget enforcement (the language lifecycle records attempts but, as in the
+CLI, does not enforce a cap), and no `fixMeta` honesty gate (that gate judges a caller's residual/verdict claims, which this
+path does not take). The `preWrite` digest re-check is defence in depth over a deterministic planner and has no independent
+test that fails when it is removed (the earlier digest comparison is the pinned control).
+
+## Verification view (X-206)
+
+`explain_finding` (when the finding in `last-scan.json` carries a `verificationRecord`), `verify_fix` and `apply_fix` add
+`verificationView`, the shared projection from `posture/verification/projection.js`, beside the existing `verificationRecord`.
+It is the same object the JSON report, the text reports and the autopilot response carry for the same finding. Additive: a finding
+without a record returns exactly what it did. The key is `verificationView`, not `verification` (that name belongs to the
+producer/verifier separation record). See `docs/guides/verification-schema-migration.md`.