@clear-capabilities/agentic-security-scanner 0.172.1 → 0.173.0

package/dist/4491.index.js

@@ -0,0 +1,133 @@
+export const id = 4491;
+export const ids = [4491];
+export const modules = {
+
+/***/ 54491:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   extractVulnFunctionsViaLLM: () => (/* binding */ extractVulnFunctionsViaLLM)
+/* harmony export */ });
+/* unused harmony export isLlmScaEnabled */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
+/* harmony import */ var _egress_policy_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(15369);
+// LLM-assisted vulnerable function extraction for SCA findings.
+//
+// For CVEs without OSV ecosystem_specific data or GHSA fix commits,
+// uses an LLM to extract vulnerable function names from the CVE description.
+//
+// Gated behind AGENTIC_SECURITY_LLM_SCA=1 (opt-in).
+// Uses the same LLM endpoint config as the SAST validator.
+
+
+
+
+
+
+const CACHE_DIR = process.env.XDG_CONFIG_HOME
+  ? node_path__WEBPACK_IMPORTED_MODULE_2__.join(process.env.XDG_CONFIG_HOME, 'agentic-security', 'llm-sca-cache')
+  : node_path__WEBPACK_IMPORTED_MODULE_2__.join(process.env.HOME || '/tmp', '.config', 'agentic-security', 'llm-sca-cache');
+
+function _cacheKey(osvId) {
+  return node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(`sca-fn:${osvId}`).digest('hex').slice(0, 16);
+}
+
+function _readCache(osvId) {
+  try {
+    const fp = node_path__WEBPACK_IMPORTED_MODULE_2__.join(CACHE_DIR, _cacheKey(osvId) + '.json');
+    return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_1__.readFileSync(fp, 'utf8'));
+  } catch { return null; }
+}
+
+function _writeCache(osvId, data) {
+  try {
+    node_fs__WEBPACK_IMPORTED_MODULE_1__.mkdirSync(CACHE_DIR, { recursive: true });
+    node_fs__WEBPACK_IMPORTED_MODULE_1__.writeFileSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(CACHE_DIR, _cacheKey(osvId) + '.json'), JSON.stringify(data));
+  } catch { /* cache write failure is non-fatal */ }
+}
+
+function isLlmScaEnabled() {
+  return process.env.AGENTIC_SECURITY_LLM_SCA === '1';
+}
+
+function _endpointConfig() {
+  const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
+  const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY;
+  const model = process.env.AGENTIC_SECURITY_LLM_MODEL || 'unknown';
+  return endpoint ? { endpoint, apiKey, model } : null;
+}
+
+async function _askLlm(prompt, config) {
+  const headers = { 'Content-Type': 'application/json' };
+  if (config.apiKey) headers['Authorization'] = `Bearer ${config.apiKey}`;
+  const resp = await fetch(config.endpoint, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify({ prompt, model: config.model }),
+    signal: AbortSignal.timeout(15000),
+  });
+  if (!resp.ok) return null;
+  const text = await resp.text();
+  const jsonMatch = text.match(/\{[^{}]*"functions"\s*:\s*\[[^\]]*\][^{}]*\}/);
+  if (!jsonMatch) return null;
+  try { return JSON.parse(jsonMatch[0]); } catch { return null; }
+}
+
+async function extractVulnFunctionsViaLLM(supplyChain, opts = {}) {
+  if (!isLlmScaEnabled()) return [];
+  const config = _endpointConfig();
+  if (!config) return [];
+  // FR-601: one decision for the whole batch (same endpoint for every CVE in
+  // this run) — evaluated before any of the per-candidate prompts below are
+  // built.
+  const egressDecision = (0,_egress_policy_js__WEBPACK_IMPORTED_MODULE_3__/* .evaluateEgress */ .nn)({ scanRoot: opts.scanRoot, purpose: 'sca-llm-function-extract', endpoint: config.endpoint });
+  if (!egressDecision.allowed) return [];
+
+  const enriched = [];
+  const candidates = (supplyChain || []).filter(sc =>
+    sc.type === 'vulnerable_dep' &&
+    (!sc.osvVulnFunctions || !sc.osvVulnFunctions.length) &&
+    sc.noKnownCallSite &&
+    sc.description
+  );
+
+  const BATCH_LIMIT = 20;
+  for (const sc of candidates.slice(0, BATCH_LIMIT)) {
+    const cached = _readCache(sc.osvId);
+    if (cached) {
+      if (cached.functions && cached.functions.length) {
+        sc.osvVulnFunctions = cached.functions;
+        sc._llmFunctionExtracted = true;
+        enriched.push(sc);
+      }
+      continue;
+    }
+
+    const prompt = `Given security advisory ${sc.osvId || ''} (${sc.cveAliases?.[0] || ''}) affecting npm package "${sc.name}" version ${sc.version}:\n\nDescription: ${sc.description.slice(0, 500)}\n\nWhat specific exported function(s) in this package are vulnerable? Return ONLY a JSON object: { "functions": ["functionName1", "functionName2"] }\n\nIf you cannot determine the specific functions, return: { "functions": [] }`;
+
+    try {
+      const result = await _askLlm(prompt, config);
+      if (result && Array.isArray(result.functions)) {
+        const fns = result.functions.filter(f => typeof f === 'string' && f.length > 0 && f.length < 100);
+        _writeCache(sc.osvId, { functions: fns, model: config.model, extractedAt: new Date().toISOString() });
+        if (fns.length) {
+          sc.osvVulnFunctions = fns;
+          sc._llmFunctionExtracted = true;
+          enriched.push(sc);
+        }
+      } else {
+        _writeCache(sc.osvId, { functions: [], model: config.model, extractedAt: new Date().toISOString() });
+      }
+    } catch {
+      // LLM call failure — skip, don't cache (may be transient)
+    }
+  }
+  return enriched;
+}
+
+
+/***/ })
+
+};

package/dist/4538.index.js

@@ -0,0 +1,185 @@
+export const id = 4538;
+export const ids = [4538];
+export const modules = {
+
+/***/ 74538:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   proposeGovernanceEdit: () => (/* binding */ proposeGovernanceEdit)
+/* harmony export */ });
+/* harmony import */ var _recipient_registry_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(16288);
+// governance-edit.js — M5 deliverable #5 (PRD line 1324's 5-part write
+// contract: preview, validation, backup/version guard, confirmation,
+// audit event). A CLI-only workflow for proposing a validated,
+// reviewable edit to recipient-profiles.json — the one governance
+// config file this codebase already has real, tested per-entry
+// validation for (isValidRecipientConfigEntry, recipient-registry.js).
+//
+// Deliberately narrower than the PRD's own richer "interactive review/
+// approve UI" vision — the HTTP-server-side interactive write surface
+// (new routes, CSRF protection, a write-authorization mechanism beyond
+// the existing read-only session token) is real, separately-scoped
+// future work, not attempted here. See this sub-project's own scoping
+// doc for the full reasoning: no PRD acceptance criterion gates this
+// deliverable at all, and every M4/M5 deliverable this session has
+// shipped has been CLI-first with zero UI/HTTP-write work.
+//
+// This module is pure — no file I/O, no fs access. The CLI layer
+// (bin/agentic-security.js's cmdGovernancePropose) owns reading the
+// current file, writing the backup, writing the new content, and
+// calling auditCall.
+
+
+
+// Validates the top-level `{recipients: {...}}` container shape — used
+// for BOTH the current on-disk config and the --patch file. A patch is
+// user input the command's whole job is to validate, so it gets no
+// tolerant degradation (fixes I2/I3: previously a patch missing
+// `recipients` entirely, or with `recipients` as an array, degraded
+// silently to an empty no-op write). The CURRENT config gets the same
+// check for a different reason: if its top-level shape is unrecognized
+// (e.g. a typo'd `Recipients` key), the tool must refuse rather than
+// silently treating "no recognizable data" as "start from empty" and
+// overwriting whatever WAS there (this was B1's second live repro —
+// the whole file being replaced under a misspelled key).
+function _validateContainerShape(recipients, label) {
+  if (recipients === undefined) {
+    return [{ key: '(top-level)', message: `${label} is missing a "recipients" object` }];
+  }
+  if (recipients === null || typeof recipients !== 'object' || Array.isArray(recipients)) {
+    return [{ key: '(top-level)', message: `${label}'s "recipients" must be a plain object, not ${Array.isArray(recipients) ? 'an array' : recipients === null ? 'null' : typeof recipients}` }];
+  }
+  const errors = [];
+  for (const key of Object.keys(recipients)) {
+    if (key.length === 0) errors.push({ key, message: `${label} contains an empty-string recipient key, which is never valid` });
+    if (key === '__proto__') errors.push({ key, message: `${label} contains a "__proto__" recipient key, which is never valid` });
+  }
+  return errors;
+}
+
+function _validateEntries(patchRecipients) {
+  const errors = [];
+  for (const [key, entry] of Object.entries(patchRecipients)) {
+    if (entry === null) continue; // explicit deletion marker, not a config entry
+    if (!(0,_recipient_registry_js__WEBPACK_IMPORTED_MODULE_0__/* .isValidRecipientConfigEntry */ .cw)(entry)) {
+      errors.push({ key, message: `recipient "${key}" is not a valid recipient-profile-shaped config entry` });
+    }
+  }
+  return errors;
+}
+
+// RFC-7396-style merge patch at the recipient-key level: a non-null
+// patch value REPLACES that key's entire entry; a null value DELETES
+// it; a key the patch never mentions is left untouched. This is the
+// fix for a real data-loss bug (found by this task's own review,
+// live-reproduced): the prior design treated `patch.recipients` as
+// the ENTIRE new recipients object, so omitting a key silently
+// deleted it — a reasonable operator adding one vendor had no reason
+// to expect every other vendor's compliance facts to vanish.
+function _mergeRecipients(currentRecipients, patchRecipients) {
+  const merged = { ...currentRecipients };
+  for (const [key, value] of Object.entries(patchRecipients)) {
+    if (value === null) delete merged[key];
+    else merged[key] = value;
+  }
+  return merged;
+}
+
+// Canonical (key-order-independent) JSON serialization for change
+// detection — mirrors ids.js's own _canon precedent. A hand-authored
+// patch file has no reason to preserve the stored config's own key
+// order, so a raw JSON.stringify comparison would spuriously flag a
+// semantically-unchanged recipient as "changed" (found by the task
+// review, reproduced live). Arrays keep their own order (order is
+// semantically meaningful there — e.g. subprocessorChain); only OBJECT
+// key order is normalized.
+function _canonicalize(value) {
+  if (Array.isArray(value)) return value.map(_canonicalize);
+  if (value && typeof value === 'object') {
+    const sorted = {};
+    for (const key of Object.keys(value).sort()) sorted[key] = _canonicalize(value[key]);
+    return sorted;
+  }
+  return value;
+}
+
+function _diffRecipients(currentRecipients, patchRecipients) {
+  const added = [];
+  const removed = [];
+  const changed = [];
+  const currentKeys = new Set(Object.keys(currentRecipients));
+  for (const [key, value] of Object.entries(patchRecipients)) {
+    if (value === null) {
+      if (currentKeys.has(key)) removed.push(key);
+      // deleting a key that never existed is a no-op, not reported
+      continue;
+    }
+    if (!currentKeys.has(key)) { added.push(key); continue; }
+    if (JSON.stringify(_canonicalize(currentRecipients[key])) !== JSON.stringify(_canonicalize(value))) {
+      changed.push({ key, before: currentRecipients[key], after: value });
+    }
+  }
+  added.sort();
+  removed.sort();
+  changed.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+  return { added, removed, changed };
+}
+
+/**
+ * Propose a patch to a recipient-profiles.json-shaped config. Pure,
+ * never throws, never touches the filesystem. `currentConfig`/`patch`
+ * are both expected to be `{recipients: {...}}`-shaped — a malformed
+ * top-level shape on EITHER side (missing `recipients`, `recipients`
+ * not a plain object, or an empty-string/`__proto__` recipient key) is
+ * a validation failure (`valid: false`, `merged: null`), never a
+ * silent empty-object fallback. The stored config gets this treatment
+ * so an unrecognized shape (e.g. a typo'd top-level key) refuses to
+ * write rather than being silently treated as "nothing here yet" and
+ * overwritten; the patch gets it because it is user input the command's
+ * whole job is to validate.
+ *
+ * `patch.recipients` is an RFC-7396-style JSON MERGE PATCH against
+ * `currentConfig.recipients`, keyed at the recipient level — never a
+ * full replacement of the whole object: a key present with a non-null
+ * value REPLACES that key's entire entry (never deep-merged within
+ * itself); a key present with value `null` DELETES it (the only way to
+ * remove a recipient); a key the patch never mentions is left
+ * untouched in the merged result. Every OTHER top-level key on the
+ * current config (e.g. `$schema`, `version`) is preserved verbatim into
+ * `merged` — only `recipients` itself is merged.
+ *
+ * Returns `{valid, errors, diff, merged}` — `diff`/`merged` are always
+ * computed when both container shapes are valid, even when `valid` is
+ * false due to a per-entry error, so an operator can see what they
+ * attempted before fixing a validation error. `merged` is `null` only
+ * when there is no safe merge base to compute (a container-shape
+ * failure on either side). `merged`, when non-null, is the full
+ * config-shaped result the caller should write — never the raw patch.
+ */
+function proposeGovernanceEdit(currentConfig, patch) {
+  const currentContainerErrors = _validateContainerShape(currentConfig?.recipients, 'the current config file');
+  const patchContainerErrors = _validateContainerShape(patch?.recipients, 'the --patch file');
+  if (currentContainerErrors.length || patchContainerErrors.length) {
+    return {
+      valid: false,
+      errors: [...currentContainerErrors, ...patchContainerErrors],
+      diff: { added: [], removed: [], changed: [] },
+      merged: null,
+    };
+  }
+  const currentRecipients = currentConfig.recipients;
+  const patchRecipients = patch.recipients;
+  const entryErrors = _validateEntries(patchRecipients);
+  const diff = _diffRecipients(currentRecipients, patchRecipients);
+  const mergedRecipients = _mergeRecipients(currentRecipients, patchRecipients);
+  // Preserve every OTHER top-level key from the current config verbatim
+  // (e.g. $schema, version) — only `recipients` itself is merged.
+  const merged = { ...(currentConfig && typeof currentConfig === 'object' ? currentConfig : {}), recipients: mergedRecipients };
+  return { valid: entryErrors.length === 0, errors: entryErrors, diff, merged };
+}
+
+
+/***/ })
+
+};

package/dist/4684.index.js

@@ -0,0 +1,319 @@
+export const id = 4684;
+export const ids = [4684];
+export const modules = {
+
+/***/ 34684:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  analyzeLanguageFindings: () => (/* binding */ analyzeLanguageFindings),
+  analyzeLanguageSupplyChain: () => (/* binding */ analyzeLanguageSupplyChain)
+});
+
+// UNUSED EXPORTS: nixosEntries
+
+// EXTERNAL MODULE: ./src/language/resolved-pass.js + 4 modules
+var resolved_pass = __webpack_require__(30208);
+// EXTERNAL MODULE: ./src/language/nix-build-trust.js
+var nix_build_trust = __webpack_require__(13787);
+// EXTERNAL MODULE: ./src/language/discovery.js
+var discovery = __webpack_require__(41928);
+// EXTERNAL MODULE: ./src/language/haskell-supply.js
+var haskell_supply = __webpack_require__(67052);
+// EXTERNAL MODULE: ./src/language/nix-script-taint.js
+var nix_script_taint = __webpack_require__(89928);
+// EXTERNAL MODULE: ./src/language/nix-secrets.js
+var nix_secrets = __webpack_require__(2245);
+// EXTERNAL MODULE: ./src/language/nix-parser.js
+var nix_parser = __webpack_require__(81985);
+// EXTERNAL MODULE: ./src/language/secrets.js
+var secrets = __webpack_require__(67855);
+// EXTERNAL MODULE: ./src/language/haskell-manifests.js
+var haskell_manifests = __webpack_require__(60377);
+;// CONCATENATED MODULE: ./src/language/nix-agents.js
+// Nix-launched agent and MCP service configuration (X-003).
+//
+// What this reads is DECLARATION: a systemd service or container whose command line starts an MCP server or
+// an agent CLI, with the filesystem roots, flags, bind address, user and environment the configuration gives
+// it. Every finding here is configuration evidence of a CAPABILITY, never proof that an agent exercised it
+// (`declaredCapability: true`, `exercised: 'not-established'`). Bridges to the application that reads the
+// configuration (an environment variable the Nix service sets and the Haskell program reads) carry explicit
+// provenance on both sides, and only become `executable-linked` when the service launches an executable the
+// project's own manifest builds; a matching variable name alone is a `candidate`.
+//
+// Static only: nothing is evaluated or launched.
+
+
+
+
+
+const NIX_AGENTS_VERSION = 'nix-agents/1';
+const PH = '';
+
+const MCP_RE = /(?:@modelcontextprotocol\/|\bmcp[-_]server|\bserver[-_]mcp|\bmcp[-_]proxy|fastmcp|\buvx\s+mcp|\bnpx\b[^\n]*\bmcp\b|\s--mcp\b)/i;
+const SHELL_MCP_RE = /(?:mcp[-_]server[-_](?:shell|commands|exec)|server-shell|shell-server|mcp-shell|mcp[-_]commands)/i;
+const AGENT_RE = /(?:^|[/\s])(?:claude|aider|goose|codex|gemini|gemini-cli|opencode|crush|openhands|open-interpreter|interpreter|autogpt|cline)(?:\s|$|--)/i;
+const AUTO_APPROVE_RE = /(?:--dangerously-skip-permissions|--dangerously-bypass[\w-]*|--yolo\b|--auto-?approve\b|--approval-mode[= ]yolo|--no-confirm\b|--yes-always\b|--permission-mode[= ]bypass\w*|-y\s+--(?:auto|run))/i;
+const BIND_ALL_RE = /(?:--(?:host|listen|address|bind)[= ]\s*(?:0\.0\.0\.0|::|\[::\]|\*)|-H\s+0\.0\.0\.0|\b(?:HOST|LISTEN_ADDR|BIND(?:_ADDRESS)?)=0\.0\.0\.0)/i;
+const BROAD_ROOTS = [[/(?:^|\s)\/(?:\s|$)/, '/', 'high'], [/(?:^|\s)\/(?:etc|root|nix|boot|proc|sys|usr)(?:\/\S*)?(?:\s|$)/, '/etc, /root, /nix or another system tree', 'high'], [/(?:^|\s)(?:\/home|\/var|\/mnt|\/srv\/?)(?:\s|$)/, '/home, /var or /mnt', 'medium'], [/(?:^|\s)(?:~\/?|\$HOME\/?|%h\/?)(?:\s|$)/, 'the user home directory', 'medium']];
+
+const segName = (s) => (s && s.kind === 'static' ? s.name : null);
+const unparen = (n) => { let x = n; while (x && x.type === 'paren') x = x.expr; return x; };
+
+/** A string's text with every interpolation replaced by a placeholder (never evaluated). */
+function textOf(n) {
+  n = unparen(n);
+  if (!n) return null;
+  if (n.type === 'string') return n.parts.map((p) => (p.kind === 'text' ? p.value : PH)).join('');
+  if (n.type === 'list') return n.items.map((i) => textOf(i)).filter((x) => x !== null).join(' ');
+  if (n.type === 'path') return n.literal || null;
+  if (n.type === 'binop' && n.op === '+') { const a = textOf(n.left); const b = textOf(n.right); return a !== null && b !== null ? a + b : null; }
+  return null;
+}
+
+function collectServices(files) {
+  const services = new Map();
+  const get = (file, name, kind, line) => { const k = `${kind}:${name}`; if (!services.has(k)) services.set(k, { file, name, kind, line, commands: [], env: {}, user: null, dynamicUser: null, openFirewall: null, extra: {} }); return services.get(k); };
+  for (const [file, text] of Object.entries(files)) {
+    const parse = (0,nix_parser/* parseNix */.Z$)(text, { file });
+    if (!parse.ast) continue;
+    const stack = [{ n: parse.ast, path: [] }];
+    while (stack.length) {
+      const { n, path } = stack.pop();
+      if (!n || typeof n !== 'object') continue;
+      if (n.type === 'attrset') {
+        for (const b of n.bindings || []) {
+          if (b.kind !== 'attr' || !b.value) continue;
+          const key = (b.path || []).map(segName);
+          if (key.some((x) => x === null)) { stack.push({ n: b.value, path: [...path, ...key.filter(Boolean)] }); continue; }
+          const full = [...path, ...key];
+          const line = b.span ? b.span.startLine : null;
+          let m = /^systemd\.(?:user\.)?services\.([^.]+)\.(.+)$/.exec(full.join('.'));
+          let kind = 'systemd';
+          const oci = /^virtualisation\.oci-containers\.containers\.([^.]+)\.(.+)$/.exec(full.join('.'));
+          if (oci) { m = oci; kind = 'oci'; }
+          if (m) {
+            const svc = get(file, m[1], kind, line); const rest = m[2];
+            const v = unparen(b.value); const t = textOf(v);
+            if (kind === 'systemd') {
+              if ((/^(?:script|preStart|postStart)$/.test(rest) || /^serviceConfig\.ExecStart(?:Pre)?$/.test(rest)) && t !== null) svc.commands.push({ text: t, line, file, option: rest });
+              if (rest === 'serviceConfig.User' && t !== null) svc.user = { value: t, line };
+              if (rest === 'serviceConfig.DynamicUser' && v && v.type === 'ident') svc.dynamicUser = { value: v.name === 'true', line };
+              const env = /^environment\.(.+)$/.exec(rest);
+              if (env && t !== null) svc.env[env[1]] = { text: t, line, file };
+              if (rest === 'environment' && v && v.type === 'attrset') for (const eb of v.bindings) { if (eb.kind !== 'attr') continue; const ek = (eb.path || []).map(segName).filter(Boolean).join('.'); const et = textOf(eb.value); if (et !== null) svc.env[ek] = { text: et, line: eb.span ? eb.span.startLine : line, file }; }
+            } else {
+              if (/^(?:cmd|entrypoint)$/.test(rest) && t !== null) svc.commands.push({ text: t, line, file, option: rest });
+              if (rest === 'image' && t !== null) svc.extra.image = t;
+              if (rest === 'user' && t !== null) svc.user = { value: t, line };
+              if (rest === 'ports' && t !== null) svc.extra.ports = t;
+              if (rest === 'volumes' && t !== null) svc.extra.volumes = t;
+              const env = /^environment\.(.+)$/.exec(rest);
+              if (env && t !== null) svc.env[env[1]] = { text: t, line, file };
+            }
+          }
+          stack.push({ n: b.value, path: full });
+        }
+      }
+      for (const k of Object.keys(n)) { if (k === 'span') continue; const c = n[k]; if (c && typeof c === 'object' && !(n.type === 'attrset' && k === 'bindings')) { if (Array.isArray(c)) for (const x of c) stack.push({ n: x, path }); else stack.push({ n: c, path }); } }
+    }
+  }
+  return [...services.values()];
+}
+
+const finding = (rule, svc, cmd, o) => ({
+  id: `${rule}:${svc.file}:${o.line || svc.line}`, file: svc.file, line: o.line || svc.line, parser: 'NIX-AGENT', family: 'agent-config', rule,
+  severity: o.severity, cwe: o.cwe, vuln: o.vuln, owaspLlm: 'LLM06',
+  description: `${o.desc} This is configuration evidence of a declared capability; nothing shows an agent has exercised it.`,
+  remediation: o.fix, language: 'nix', capability: 'iac', analysisKind: 'configuration', evidenceKind: 'config', scope: 'system', confidence: o.confidence ?? 0.7,
+  declaredCapability: true, exercised: 'not-established', service: { name: svc.name, kind: svc.kind }, subject: `${svc.kind}:${svc.name}`,
+  attrPath: `${svc.kind === 'oci' ? 'virtualisation.oci-containers.containers' : 'systemd.services'}.${svc.name}`,
+  chain: [{ file: svc.file, line: o.line || svc.line, label: o.label || o.vuln, kind: 'config' }],
+});
+
+/**
+ * @param {Record<string,string>} files  Nix sources (and, for bridges, Haskell sources and .cabal manifests)
+ */
+function analyzeNixAgents(files) {
+  const nix = Object.fromEntries(Object.entries(files).filter(([p, t]) => /\.nix$/i.test(p) && typeof t === 'string'));
+  const findings = []; const agents = []; const bridges = [];
+  const services = collectServices(nix);
+  for (const svc of services) {
+    const all = svc.commands.map((c) => c.text).join('\n');
+    const isMcp = MCP_RE.test(all) || MCP_RE.test(svc.name) || (svc.extra.image && MCP_RE.test(svc.extra.image));
+    const isAgent = AGENT_RE.test(all);
+    if (!isMcp && !isAgent) continue;
+    const cmd = svc.commands.find((c) => MCP_RE.test(c.text) || AGENT_RE.test(c.text)) || svc.commands[0] || { text: '', line: svc.line };
+    const entry = { name: svc.name, kind: isMcp ? 'mcp-server' : 'agent', launcher: svc.kind, file: svc.file, line: cmd.line || svc.line, user: svc.user ? svc.user.value : null, dynamicUser: svc.dynamicUser ? svc.dynamicUser.value : null, env: Object.keys(svc.env), declaredCapability: true, exercised: 'not-established' };
+    agents.push(entry);
+    const text = ` ${all.replace(new RegExp(PH, 'g'), ' ')} `;
+    if (SHELL_MCP_RE.test(all)) findings.push(finding('nix-mcp-shell-server', svc, cmd, { severity: 'high', cwe: 'CWE-250', vuln: 'An MCP server that executes shell commands is launched as a service', desc: `${svc.name} starts an MCP server whose purpose is to run commands.`, fix: 'Do not expose a general shell to a model. Offer narrow tools, or run it in a sandbox with no network and a read-only root.', line: cmd.line }));
+    if (isMcp) for (const [re, what, sev] of BROAD_ROOTS) if (re.test(text)) { findings.push(finding('nix-mcp-broad-filesystem', svc, cmd, { severity: sev, cwe: 'CWE-732', vuln: 'An MCP/agent service is given a broad filesystem root', desc: `${svc.name} is started with ${what} as a root the server may read or write.`, fix: 'Point the server at the one project directory it needs, and add systemd ReadWritePaths/ProtectSystem so the unit cannot reach more.', line: cmd.line })); break; }
+    if (AUTO_APPROVE_RE.test(text)) findings.push(finding('nix-agent-auto-approve', svc, cmd, { severity: 'high', cwe: 'CWE-862', vuln: 'An agent is launched with permission prompts disabled', desc: `${svc.name} starts an agent with an auto-approve / skip-permissions flag, so tool use needs no confirmation.`, fix: 'Remove the flag, or run the agent in an isolated unit with a minimal allow-list.', line: cmd.line }));
+    const bindAll = BIND_ALL_RE.test(text) || Object.values(svc.env).some((e) => BIND_ALL_RE.test(` ${e.text} `) || /^0\.0\.0\.0$/.test(String(e.text).trim()) && false);
+    const envBind = Object.entries(svc.env).find(([k, e]) => /^(?:HOST|LISTEN_ADDR|BIND|BIND_ADDRESS|MCP_HOST)$/i.test(k) && String(e.text).trim() === '0.0.0.0');
+    if (bindAll || envBind) findings.push(finding('nix-agent-network-exposed', svc, cmd, { severity: 'medium', cwe: 'CWE-668', vuln: 'An agent/MCP service listens on every interface', desc: `${svc.name} binds 0.0.0.0, so anything that can reach the host can reach the tool surface.`, fix: 'Bind 127.0.0.1 (or a unix socket) and put authentication in front of anything that must be remote.', line: envBind ? envBind[1].line : cmd.line }));
+    const root = svc.kind === 'systemd' && (!svc.user || svc.user.value === 'root') && !(svc.dynamicUser && svc.dynamicUser.value);
+    if (root) findings.push(finding('nix-agent-runs-as-root', svc, cmd, { severity: 'medium', cwe: 'CWE-250', vuln: 'An agent/MCP service runs as root', desc: `${svc.name} has no User or DynamicUser, so systemd runs it as root.`, fix: 'Set serviceConfig.DynamicUser = true (or a dedicated User) and grant only the paths it needs.', line: svc.line }));
+    entry.environment = Object.entries(svc.env).map(([k, e]) => ({ name: k, line: e.line, valueRecorded: false }));
+  }
+  // bridges: a Nix service environment variable and the Haskell program that reads it
+  const hsFiles = Object.entries(files).filter(([p, t]) => /\.l?hs$/i.test(p) && typeof t === 'string');
+  const manifests = Object.entries(files).filter(([p, t]) => /\.cabal$/i.test(p) && typeof t === 'string').map(([path, text]) => ({ path, text }));
+  const executables = new Set();
+  if (manifests.length) { try { for (const pkg of (0,haskell_manifests/* analyzeHaskellManifests */.JS)(manifests).packages) for (const c of pkg.components || []) if (c.kind === 'executable') executables.add(c.name); } catch { /* no manifest evidence */ } }
+  const reads = [];
+  for (const [file, text] of hsFiles) {
+    const toks = (0,secrets/* tokenizeHaskell */.cH)(text);
+    for (let i = 0; i < toks.length; i++) {
+      const t = toks[i];
+      if (t.k !== 'i' || !/^(?:getEnv|lookupEnv)$/.test(t.v.replace(/^.*\./, ''))) continue;
+      let j = i + 1; while (toks[j] && toks[j].k === 'x' && toks[j].v === '(') j++;
+      if (toks[j] && toks[j].k === 's') { let line = 1; for (let q = 0; q < t.start; q++) if (text.charCodeAt(q) === 10) line++; reads.push({ file, line, variable: toks[j].v }); }
+    }
+  }
+  for (const svc of services) {
+    const exec = svc.commands.map((c) => c.text).join(' ');
+    const launched = [...executables].filter((e) => new RegExp(`(?:^|[/\\s])${e.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\s|$)`).test(exec.replace(new RegExp(PH, 'g'), ' ')));
+    for (const [variable, e] of Object.entries(svc.env)) {
+      for (const r of reads.filter((x) => x.variable === variable)) {
+        bridges.push({ kind: 'env-read', variable, status: launched.length ? 'executable-linked' : 'candidate', executable: launched[0] || null,
+          nix: { service: svc.name, file: e.file, line: e.line, role: 'declares-environment' }, haskell: { file: r.file, line: r.line, role: 'reads-environment' },
+          provenance: { nix: 'systemd service environment (configuration)', haskell: 'getEnv/lookupEnv literal (source)', link: launched.length ? `the service launches ${launched[0]}, an executable built by the project's cabal file` : 'only the variable name matches: no evidence this service runs that program' },
+          flow: 'a runtime configuration bridge, not a data-flow proof' });
+      }
+    }
+  }
+  return { version: NIX_AGENTS_VERSION, findings, agents, bridges };
+}
+
+// EXTERNAL MODULE: ./src/language/nixos-hardening.js
+var nixos_hardening = __webpack_require__(188);
+;// CONCATENATED MODULE: ./src/language/engine-pass.js
+// Language supply-chain pass for the scan engine. Nix fetch/build/cache trust findings are
+// supply-chain entries, so they join the ordinary `supplyChain` bucket (and from there SCA
+// policy, scan health and every report) instead of a side channel. Static only: nothing here
+// evaluates Nix, fetches a URL or runs a builder.
+
+
+
+
+
+
+
+
+
+
+const isNixSource = (p) => /\.nix$/i.test(p);
+const isFlakeLock = (p) => /(^|\/)flake\.lock$/i.test(p);
+
+/**
+ * @param {Record<string,string>} files rel path -> content (sources and manifests as the engine read them)
+ * @returns {{supplyChain: object[], gaps: object[], analyzed: number}}
+ */
+const NIXOS_OPTION = /(?:^|[\s;{])(?:services|networking|security|systemd|users|environment|programs|boot|virtualisation|nix)\.[A-Za-z_]|(?:^|[\s;{])(?:services|networking|security|systemd|users|environment|programs|boot|virtualisation)\s*=\s*\{/m;
+
+/** NixOS entry points of a Nix file set: every configuration.nix, else every module nothing imports (capped). */
+function nixosEntries(nix, { max = 15 } = {}) {
+  const conf = Object.keys(nix).filter((p) => /(?:^|\/)configuration\.nix$/i.test(p)).sort().slice(0, 5);
+  const imported = new Set();
+  try { const { graph } = (0,discovery/* buildImportGraph */.oK)(nix); for (const deps of graph.values()) for (const d of deps) imported.add(d); } catch { /* no import graph */ }
+  const standalone = Object.keys(nix).filter((p) => !conf.includes(p) && !imported.has(p) && !/(?:^|\/)flake\.nix$/i.test(p) && NIXOS_OPTION.test(nix[p])).sort().slice(0, max);
+  return [...conf, ...standalone];
+}
+
+function _baseSupplyChain(files = {}, opts = {}) {
+  const nix = {};
+  for (const [p, text] of Object.entries(files)) {
+    if (typeof text !== 'string') continue;
+    if (!(isNixSource(p) || isFlakeLock(p))) continue;
+    if ((0,discovery/* isLanguageExcludedPath */.EG)(p)) continue;
+    nix[p] = text;
+  }
+  // Haskell: Hackage advisories and source/name policy (manifests, a freeze or a plan, and the .hs imports).
+  const hs = (0,haskell_supply/* analyzeHaskellSupply */.i1)(files, { root: opts.scanRoot || null, resolved: opts.resolved || null });
+  const sources = Object.keys(nix).filter(isNixSource);
+  if (!sources.length) {
+    if (!hs.components.length) return { supplyChain: [], gaps: [], analyzed: 0 };
+    return { supplyChain: hs.supplyChain, gaps: hs.gaps, analyzed: hs.components.length, haskell: hs };
+  }
+  // The effective configuration is decided from an ENTRY: configuration.nix when there is one, otherwise each NixOS module that
+  // nothing imports (a flake's host file under any name). With no entry at all only the file-local rules run.
+  const entries = nixosEntries(nix);
+  const reports = entries.length ? entries.map((entry) => (0,nix_build_trust/* analyzeNixBuildTrust */.OQ)({ files: nix, entry })) : [(0,nix_build_trust/* analyzeNixBuildTrust */.OQ)({ files: nix })];
+  const seenIds = new Set(); const merged = []; const gaps = [];
+  for (const r of reports) {
+    for (const f of r.findings) { const k = f.id || `${f.rule}|${f.file}|${f.line}`; if (!seenIds.has(k)) { seenIds.add(k); merged.push(f); } }
+    for (const g of r.gaps) gaps.push(g);
+  }
+  return { supplyChain: [...hs.supplyChain, ...merged], gaps: [...hs.gaps, ...gaps], analyzed: sources.length + hs.components.length, haskell: hs };
+}
+
+/**
+ * Findings (not supply-chain entries) from Nix: embedded-shell taint (NIX-003). Returns the findings plus the
+ * coverage gaps (unsupported shells, scripts built by expressions) so scan health can report them.
+ */
+function analyzeLanguageFindings(files = {}) {
+  const nix = {};
+  for (const [p, text] of Object.entries(files)) {
+    if (typeof text !== 'string' || !isNixSource(p) || (0,discovery/* isLanguageExcludedPath */.EG)(p)) continue;
+    nix[p] = text;
+  }
+  if (!Object.keys(nix).length) return { findings: [], gaps: [], analyzed: 0 };
+  const r = (0,nix_script_taint/* analyzeNixScripts */.S3)({ files: nix });
+  // secret placement sees referenced data files (sopsFile / agenix file) as well as the Nix sources
+  const sec = (0,nix_secrets/* analyzeNixSecrets */.D0)({ files: { ...files, ...nix } });
+  let agents = { findings: [] };
+  try { agents = analyzeNixAgents(files); } catch { /* agent/MCP rules are best effort */ }
+  // NIX-004: effective-configuration hardening, judged per NixOS entry point (configuration.nix). A finding with no
+  // option source (a catalog default decided it) is anchored to the entry file at line 1 and says so, so it can be
+  // reported, attributed and suppressed instead of being lineless. The files that decided the value travel with it.
+  const hardening = [];
+  const effective = [];
+  // Entry points: every configuration.nix, plus NixOS modules NOTHING imports (a standalone module, a flake's host file under any
+  // name): its options are the only place their values are decided, and a file name is not what makes a configuration real.
+  const confEntries = Object.keys(nix).filter((p) => /(?:^|\/)configuration\.nix$/i.test(p)).sort().slice(0, 5);
+  const entryList = nixosEntries(nix);
+  for (const entry of entryList) {
+    try {
+      const h = (0,nixos_hardening/* analyzeNixosHardening */.QC)({ entry, files: nix });
+      effective.push({ entry, completeness: h.reconciliation && h.reconciliation.completeness, unresolved: (h.reconciliation && h.reconciliation.unanalyzed) || [], truncated: [], target: h.target });
+      for (const f of h.findings) {
+        const ctl = [...new Set((f.evidence || []).flatMap((e) => (e.sources || []).map((x) => x.file)).filter(Boolean))];
+        const anchored = Number.isInteger(f.line) && f.file;
+        hardening.push({ ...f, file: anchored ? f.file : entry, line: anchored ? f.line : 1, locationKind: anchored ? 'option-source' : 'target-level', controlFiles: ctl, entry, entryKind: confEntries.includes(entry) ? 'configuration' : 'standalone-module', optionEvidence: f.evidence, option: f.evidence && f.evidence[0] ? f.evidence[0].option : null });
+      }
+    } catch (e) { r.gaps.push({ kind: 'hardening-failed', file: entry, reason: String((e && e.message) || e) }); }
+  }
+  // Two different rules of one family can land on the same line (a one-line configuration, or several defaults that
+  // anchor at the entry). The engine's per-(file, line, family) de-duplication must not merge them into one finding, so
+  // each carries a site key built from what makes it a different finding. The key also feeds the stable id.
+  const keyed = (list, parts) => list.map((f) => (f && f.siteKey ? f : { ...f, siteKey: parts(f).filter((x) => x !== null && x !== undefined && x !== '').join('|') }));
+  const out = [
+    ...keyed(r.findings, (f) => [f.rule, f.attrPath, f.sink && f.sink.command, f.generatedLocation && `${f.generatedLocation.line}:${f.generatedLocation.startColumn}`]),
+    ...keyed(sec.findings, (f) => [f.rule, f.source && f.source.detail, f.destination && f.destination.label]),
+    ...agents.findings,
+    ...keyed(hardening, (f) => [f.rule, f.subject]),
+  ];
+  return { findings: out, gaps: [...r.gaps, ...sec.gaps], analyzed: r.analyzed, effectiveConfigs: effective };
+}
+
+/**
+ * The language supply chain: declared and resolved Hackage dependencies, Nix inputs and build trust, and (when the project exported
+ * one) the Nix closure matched against an advisory snapshot. The resolved data comes from EXPLICIT export files only.
+ */
+function analyzeLanguageSupplyChain(files = {}, opts = {}) {
+  let resolved = null; let closure = null;
+  try { resolved = (0,resolved_pass.resolvedHackageComponents)(files); } catch { resolved = null; }
+  try { closure = (0,resolved_pass.analyzeNixClosure)(files, { scanRoot: opts.scanRoot || null }); } catch (e) { closure = { findings: [], gaps: [{ kind: 'closure-analysis-failed', detail: String((e && e.message) || e).slice(0, 160) }], statuses: [], sources: [], status: 'failed' }; }
+  const base = _baseSupplyChain(files, { ...opts, resolved });
+  if (!closure) return resolved && resolved.summary ? { ...base, resolved: resolved.summary } : base;
+  return { ...base, supplyChain: [...base.supplyChain, ...closure.findings], gaps: [...(base.gaps || []), ...closure.gaps], analyzed: (base.analyzed || 0) + closure.statuses.length, resolved: resolved && resolved.summary, nixClosure: closure };
+}
+
+
+/***/ })
+
+};