@clear-capabilities/agentic-security-scanner 0.195.27 → 0.195.28

package/src/language/haskell-budget-state.js

@@ -0,0 +1,85 @@
+// Haskell parse budgets and the record of work left when one is hit (PRD FR 02 "budget behavior and proof of completion").
+//
+// The parser stops a file at a named bound (bytes, tokens, nesting, steps, wall clock) and reports `budget_exceeded`; the file is
+// not analysed and the capability stays incomplete. This module does three things around that:
+//
+//   1. Operator budgets. AGENTIC_SECURITY_HASKELL_PARSE_BUDGETS raises (or lowers) named bounds: `deadlineMs=20000,maxTokens=800000`.
+//      Only the parser's own budget names are accepted, as positive integers; anything else is rejected and reported, never guessed.
+//   2. A persisted record. Each scan writes `.agentic-security/haskell-budget.json`: the effective budgets, the count of completed
+//      files, and every remaining file with the reason and a digest of its content.
+//   3. A comparison. The next scan reads that record and states, for each previously remaining file, whether it is now complete,
+//      still remaining on the same inputs and budgets (a deterministic bound will be hit again: raise it), still remaining after
+//      a change, or gone.
+//
+// What it does not do: resume. The Haskell pass parses every eligible file on every scan, so nothing is reused from a previous
+// run, and nothing is skipped because it was analysed before. The record proves what was and was not finished; it does not
+// shortcut the work. `deadlineMs` is wall-clock time, so a file can complete on one machine and exceed it on another.
+
+import * as fs from 'node:fs';
+import * as crypto from 'node:crypto';
+import { statePath, safeWriteState } from '../posture/state-dir.js';
+import { DEFAULT_PARSE_BUDGETS } from './haskell-parser.js';
+
+export const BUDGET_STATE_SCHEMA = 'haskell-budget-state/1';
+export const HASKELL_PARSE_BUDGET_ENV = 'AGENTIC_SECURITY_HASKELL_PARSE_BUDGETS';
+const STATE_FILE = 'haskell-budget.json';
+const MAX_RECORDED = 5000;
+
+/** Parse `name=value,...` into parser budget overrides. Returns { budgets, rejected }. */
+export function parseBudgetOverrides(raw) {
+  const budgets = {};
+  const rejected = [];
+  for (const part of String(raw || '').split(',').map((s) => s.trim()).filter(Boolean)) {
+    const m = /^([A-Za-z]+)\s*=\s*(\d+)$/.exec(part);
+    if (!m) { rejected.push({ entry: part, reason: 'expected name=positive-integer' }); continue; }
+    if (!Object.prototype.hasOwnProperty.call(DEFAULT_PARSE_BUDGETS, m[1])) { rejected.push({ entry: part, reason: `unknown budget "${m[1]}"` }); continue; }
+    const v = Number(m[2]);
+    if (!Number.isSafeInteger(v) || v <= 0) { rejected.push({ entry: part, reason: 'value must be a positive integer' }); continue; }
+    budgets[m[1]] = v;
+  }
+  return { budgets, rejected };
+}
+
+export const contentDigest = (text) => crypto.createHash('sha256').update(String(text ?? '')).digest('hex');
+
+export function loadBudgetState(scanRoot) {
+  if (!scanRoot) return null;
+  try {
+    const doc = JSON.parse(fs.readFileSync(statePath(scanRoot, STATE_FILE), 'utf8'));
+    if (!doc || doc.schema !== BUDGET_STATE_SCHEMA || !Array.isArray(doc.remaining)) return null;
+    return doc;
+  } catch { return null; }
+}
+
+const sameBudgets = (a, b) => JSON.stringify(Object.entries(a || {}).sort()) === JSON.stringify(Object.entries(b || {}).sort());
+
+/**
+ * Build this scan's record and compare it with the previous one.
+ * @param {{remaining:{file:string,parse:string,flowAnalysis:string,budgetName?:string}[], completedFiles:number,
+ *          budgets:object, files:Record<string,string>, previous:object|null}} i
+ */
+export function budgetRecord({ remaining, completedFiles, budgets, files, previous }) {
+  const rows = remaining.slice(0, MAX_RECORDED).map((r) => ({ ...r, digest: contentDigest(files[r.file]) }));
+  const record = { schema: BUDGET_STATE_SCHEMA, budgets, completedFiles, remainingFiles: remaining.length, remaining: rows, truncated: remaining.length > rows.length };
+  if (!previous) return { record, sinceLast: null };
+  const now = new Map(rows.map((r) => [r.file, r]));
+  const budgetsChanged = !sameBudgets(previous.budgets, budgets);
+  const sinceLast = { budgetsChanged, completed: [], stillRemainingSameInputs: [], stillRemainingChanged: [], gone: [], newlyRemaining: [] };
+  for (const p of previous.remaining) {
+    if (!(p.file in files)) { sinceLast.gone.push(p.file); continue; }
+    const cur = now.get(p.file);
+    if (!cur) { sinceLast.completed.push(p.file); continue; }
+    // Both digests are hashes of source files the scan already read, not secrets: comparison time reveals nothing.
+    if (cur.digest === p.digest && !budgetsChanged) sinceLast.stillRemainingSameInputs.push(p.file); // agentic-security-ignore: CWE-208
+    else sinceLast.stillRemainingChanged.push(p.file);
+  }
+  const before = new Set(previous.remaining.map((p) => p.file));
+  for (const r of rows) if (!before.has(r.file)) sinceLast.newlyRemaining.push(r.file);
+  for (const k of Object.keys(sinceLast)) if (Array.isArray(sinceLast[k])) sinceLast[k].sort();
+  return { record, sinceLast };
+}
+
+export function saveBudgetState(scanRoot, record) {
+  if (!scanRoot) return false;
+  return safeWriteState(statePath(scanRoot, STATE_FILE), JSON.stringify(record, null, 1) + '\n');
+}

package/src/language/haskell-coverage.js

@@ -0,0 +1,230 @@
+// Haskell coverage accounting (PRD FR 02).
+//
+// Answers "what actually ran" for Haskell, counted in separate stages so a
+// recognised extension, a successful parse and a completed data-flow analysis
+// are never conflated:
+//
+//   read -> parse -> ruleEvaluation -> graphInclusion -> flowAnalysis
+//
+// Every eligible file is in the denominator whether it parsed or not. A file
+// excluded by policy, a size cap or an excluded directory is listed with its
+// reason and is not eligible. Nothing here reads a file, runs a tool or
+// executes project code: it summarises results the engine already produced.
+//
+// Pure: inputs in, one record out.
+
+import * as path from 'node:path';
+import { parseCabalFile, parseHpackFile } from './haskell-manifests.js';
+
+export const COVERAGE_SCHEMA = 'haskell-coverage/1';
+export const DEFAULT_THRESHOLDS = Object.freeze({ parseRate: 0.95, semanticRate: 0.90 });
+
+const HS_FORM = /\.(lhs-boot|hs-boot|lhs|hs|hsig|hsc)$/i;
+const norm = (p) => String(p || '').replace(/\\/g, '/');
+export const formOf = (f) => { const m = HS_FORM.exec(norm(f)); return m ? m[1].toLowerCase() : null; };
+const isPlainHs = (f) => formOf(f) === 'hs';
+
+/** Rule families the Haskell pipeline can run. `needsDeep` ones only run under the IR layer. */
+export const RULE_FAMILIES = Object.freeze([
+  { id: 'hs-security-rules', label: 'crypto, randomness, resource, XML and sensitive-logging rules', needsDeep: false },
+  { id: 'hs-web', label: 'web routes and authorization', needsDeep: false },
+  { id: 'hs-llm', label: 'LLM usage rules', needsDeep: false },
+  { id: 'ir-taint', label: 'interprocedural taint (SQL, command, path, SSRF, ...)', needsDeep: true },
+  { id: 'hs-sca', label: 'dependency manifests and advisories', needsDeep: false },
+]);
+
+function packageIndex(files) {
+  const roots = [];
+  for (const [p, text] of Object.entries(files)) {
+    const np = norm(p);
+    const base = np.split('/').pop();
+    let r = null;
+    try {
+      if (/\.cabal$/i.test(base)) r = parseCabalFile(text, { file: np });
+      else if (base === 'package.yaml') r = parseHpackFile(text, { file: np });
+    } catch { r = null; }
+    if (r) roots.push({ dir: path.posix.dirname(np) === '.' ? '' : path.posix.dirname(np), name: (r.package && r.package.name) || path.posix.basename(path.posix.dirname(np)) || '(root)', manifest: np });
+  }
+  return roots.sort((a, b) => b.dir.length - a.dir.length);
+}
+
+function packageOf(file, index, sourceMap) {
+  const f = norm(file);
+  if (sourceMap && sourceMap.packages) {
+    let best = null;
+    for (const [name, prefixes] of Object.entries(sourceMap.packages)) {
+      for (const pre of [].concat(prefixes)) {
+        const p = norm(pre).replace(/\/+$/, '');
+        if ((f === p || f.startsWith(p + '/')) && (!best || p.length > best.len)) best = { name, len: p.length };
+      }
+    }
+    if (best) return { name: best.name, source: 'source-map' };
+  }
+  for (const r of index) if (r.dir === '' || f.startsWith(r.dir + '/')) return { name: r.name, source: 'manifest' };
+  return { name: '(unassigned)', source: 'none' };
+}
+
+const rate = (n, d) => (d > 0 ? n / d : null);
+
+/**
+ * @param {object} i
+ * @param {Record<string,string>} i.files       sources and manifests the scan read
+ * @param {Map<string,object>|Record<string,object>} [i.parses]  file -> parseHaskell result
+ * @param {object|null} [i.ir]                  buildHaskellIR result, or null when no graph was built
+ * @param {boolean} i.deepEnabled
+ * @param {Record<string,{ran:boolean, failed?:string, findings?:number}>} [i.ruleRuns]
+ * @param {{file:string,bytes:number,cap:number}[]} [i.sizeSkipped]
+ * @param {string[]} [i.policyExcluded]
+ * @param {string[]} [i.excludedPaths]          language-excluded build-output paths seen
+ * @param {{packages:Record<string,string|string[]>}|null} [i.sourceMap]
+ * @param {{parseRate:number, semanticRate:number}} [i.thresholds]
+ */
+export function buildHaskellCoverage(i) {
+  const files = i.files || {};
+  const th = { ...DEFAULT_THRESHOLDS, ...(i.thresholds || {}) };
+  const parses = i.parses instanceof Map ? i.parses : new Map(Object.entries(i.parses || {}));
+  const ir = i.ir || null;
+  const index = packageIndex(files);
+  const byFile = {};
+  const skipped = [];
+
+  const sizeSkipped = new Map((i.sizeSkipped || []).filter((x) => formOf(x.file)).map((x) => [norm(x.file), x]));
+  const policy = new Set((i.policyExcluded || []).map(norm).filter((f) => formOf(f)));
+  const excl = new Set((i.excludedPaths || []).map(norm).filter((f) => formOf(f)));
+  const present = Object.keys(files).map(norm).filter((f) => formOf(f));
+
+  const add = (file, status) => { byFile[file] = { form: formOf(file), package: packageOf(file, index, i.sourceMap).name, ...status }; };
+
+  for (const f of [...sizeSkipped.keys()]) {
+    const s = sizeSkipped.get(f);
+    add(f, { eligible: true, read: 'oversize', parse: 'not-attempted', ruleEvaluation: 'not-run', graphInclusion: 'not-in-graph', flowAnalysis: 'not-run', reason: `over the read cap (${s.bytes} > ${s.cap} bytes)` });
+  }
+  for (const f of policy) if (!byFile[f]) { add(f, { eligible: false, read: 'not-read', reason: 'default-ignored directory' }); skipped.push({ file: f, reason: 'default-ignored directory' }); }
+  for (const f of excl) if (!byFile[f]) { add(f, { eligible: false, read: 'not-read', reason: 'build-output directory' }); skipped.push({ file: f, reason: 'build-output directory' }); }
+
+  const familyRan = (id) => !!(i.ruleRuns && i.ruleRuns[id] && i.ruleRuns[id].ran);
+  const staticRulesRan = familyRan('hs-security-rules') && familyRan('hs-web');
+
+  for (const f of present.sort()) {
+    if (byFile[f]) continue;
+    const form = formOf(f);
+    const p = parses.get(f);
+    const parse = !p ? 'not-attempted' : p.status; // parsed | parsed_with_errors | failed | budget_exceeded | missing_grammar
+    const parsedOk = parse === 'parsed' || parse === 'parsed_with_errors';
+    // The rule modules and the IR read `.hs` only; every other form is parse-only and is said to be.
+    const plain = form === 'hs';
+    const ruleEvaluation = !plain ? 'unsupported-form' : !parsedOk ? 'not-run' : (staticRulesRan ? 'evaluated' : 'not-run');
+    const irFile = ir && ir.perFile && ir.perFile[f];
+    const graphInclusion = !plain ? 'parse-only' : (irFile ? 'included' : 'not-in-graph');
+    let flowAnalysis;
+    let fnDiscovered = p && Array.isArray(p.functions) ? p.functions.length : 0;
+    let fnLowered = 0; let fnIncomplete = 0;
+    if (irFile) {
+      const fns = irFile.functions.filter((x) => !(x.hs && x.hs.kind === 'module-init'));
+      fnLowered = fns.length; fnIncomplete = fns.filter((x) => x.hs && x.hs.incomplete).length;
+      fnDiscovered = Math.max(fnDiscovered, fnLowered);
+    }
+    const capped = ir && (ir.diagnostics || []).some((d) => d.file === f && (d.kind === 'function-cap' || d.kind === 'ir-lowering-failure' || d.kind === 'ir-parse-failure'));
+    if (!plain) flowAnalysis = 'unsupported-form';
+    else if (!i.deepEnabled) flowAnalysis = 'not-run:deep-analysis-disabled';
+    else if (graphInclusion !== 'included') flowAnalysis = 'not-run:not-in-graph';
+    else if (capped || fnIncomplete > 0 || parse === 'parsed_with_errors') flowAnalysis = 'partial';
+    else flowAnalysis = 'completed';
+    const boundaries = p && Array.isArray(p.boundaries) ? [...new Set(p.boundaries.map((b) => b.kind))].sort() : [];
+    add(f, {
+      eligible: true, read: 'read', parse, ruleEvaluation, graphInclusion, flowAnalysis,
+      functions: { discovered: fnDiscovered, lowered: fnLowered, incomplete: fnIncomplete },
+      ...(boundaries.length ? { boundaries } : {}),
+      ...(p && p.errors && p.errors.length ? { parseErrors: p.errors.length } : {}),
+    });
+  }
+
+  const rows = Object.entries(byFile);
+  const eligible = rows.filter(([, r]) => r.eligible);
+  const eligibleHs = eligible.filter(([f]) => isPlainHs(f));
+
+  const byForm = {};
+  for (const [f, r] of rows) { const k = r.form; (byForm[k] = byForm[k] || { discovered: 0, eligible: 0, parsed: 0, parsedWithErrors: 0, failed: 0 }); byForm[k].discovered++; if (r.eligible) byForm[k].eligible++; if (r.parse === 'parsed') byForm[k].parsed++; else if (r.parse === 'parsed_with_errors') byForm[k].parsedWithErrors++; else if (r.eligible) byForm[k].failed++; }
+
+  const byPackage = {};
+  for (const [, r] of rows) {
+    const e = (byPackage[r.package] = byPackage[r.package] || { discovered: 0, eligible: 0, parsed: 0, semanticComplete: 0 });
+    e.discovered++; if (r.eligible) e.eligible++; if (r.parse === 'parsed') e.parsed++; if (r.flowAnalysis === 'completed') e.semanticComplete++;
+  }
+
+  const parsedHs = eligibleHs.filter(([, r]) => r.parse === 'parsed').length;
+  const semanticHs = eligibleHs.filter(([, r]) => r.flowAnalysis === 'completed').length;
+  const fn = { discovered: 0, lowered: 0, incomplete: 0 };
+  for (const [, r] of eligible) if (r.functions) { fn.discovered += r.functions.discovered; fn.lowered += r.functions.lowered; fn.incomplete += r.functions.incomplete; }
+  const unresolvedCalls = ir && ir.callGraph && Array.isArray(ir.callGraph.unresolved) ? ir.callGraph.unresolved.length : (ir ? 0 : null);
+
+  const families = RULE_FAMILIES.map((fam) => {
+    const run = (i.ruleRuns && i.ruleRuns[fam.id]) || null;
+    const ranDeep = fam.needsDeep ? (i.deepEnabled && !!ir) : true;
+    const ran = !!(run && run.ran) && ranDeep;
+    // A caller that did not report rule runs (a direct assurance call, not an engine scan) gets 'not-reported': unknown, not a failure.
+    if (!i.ruleRuns) return { id: fam.id, label: fam.label, ran: null, status: 'not-reported', findings: null };
+    return { id: fam.id, label: fam.label, ran, status: ran ? 'executed' : (fam.needsDeep && !i.deepEnabled ? 'not-run:deep-analysis-disabled' : (run && run.failed ? `failed:${run.failed}` : 'not-run')), findings: run && Number.isInteger(run.findings) ? run.findings : null };
+  });
+
+  const reasons = [];
+  const limitations = [];
+  if (present.length + sizeSkipped.size > 0) {
+    if (!i.deepEnabled) reasons.push('deep analysis is disabled: no Haskell data-flow analysis ran');
+    for (const f of families) if (f.ran === false && !(f.id === 'ir-taint' && !i.deepEnabled) && f.id !== 'hs-sca') reasons.push(`rule family ${f.id} did not run (${f.status})`);
+    const pr = rate(parsedHs, eligibleHs.length);
+    const sr = rate(semanticHs, eligibleHs.length);
+    if (pr !== null && pr < th.parseRate) reasons.push(`parse success ${(pr * 100).toFixed(1)}% is below ${(th.parseRate * 100)}% of eligible .hs files`);
+    if (sr !== null && sr < th.semanticRate) reasons.push(`semantic analysis completed for ${(sr * 100).toFixed(1)}% of eligible .hs files, below ${(th.semanticRate * 100)}%`);
+    const nonHs = eligible.filter(([f]) => !isPlainHs(f)).length;
+    if (nonHs) limitations.push(`${nonHs} eligible file(s) in a non-.hs form (.lhs, .hs-boot, .hsig, .hsc) are parse-only: no rules or data-flow analysis`);
+  }
+
+  const incompleteEntries = eligibleHs.filter(([, r]) => r.parse !== 'parsed' || r.flowAnalysis !== 'completed')
+    .map(([file, r]) => ({ file, parse: r.parse, flowAnalysis: r.flowAnalysis })).slice(0, 500);
+  const mains = [];
+  if (ir && ir.callGraph && ir.callGraph.functions) {
+    for (const f of ir.callGraph.functions.values()) if (/\.main$/.test(f.name || '') && byFile[f.file] && byFile[f.file].flowAnalysis !== 'completed') mains.push({ name: f.name, file: f.file, flowAnalysis: byFile[f.file].flowAnalysis });
+  }
+
+  // Work completed and work remaining when a limit stopped the analysis (PRD FR 02). A file is remaining when its parse hit a
+  // budget or its flow analysis did not complete. Nothing is sampled: the lists are exhaustive up to the cap, in path order, so a
+  // rerun over the same inputs names the same files. `resume` says only what the scanner can do today (assurance.js adds the
+  // effective budgets and the comparison with the previous scan's record, language/haskell-budget-state.js).
+  const remaining = eligibleHs.filter(([, r]) => r.parse === 'budget_exceeded' || (r.parse === 'parsed' && r.flowAnalysis !== 'completed' && r.flowAnalysis !== 'not-applicable'))
+    .map(([file, r]) => ({ file, parse: r.parse, flowAnalysis: r.flowAnalysis })).sort((a, b) => (a.file < b.file ? -1 : 1));
+  const budget = {
+    exhausted: eligibleHs.some(([, r]) => r.parse === 'budget_exceeded'),
+    completedFiles: eligibleHs.length - remaining.length,
+    remainingFiles: remaining.length,
+    remaining: remaining.slice(0, 500),
+    remainingTruncated: remaining.length > 500,
+    // The Haskell pass parses every eligible file on every scan: nothing is reused from a previous run, so there is no resume.
+    resume: { supported: false, toFinish: 'raise the named parse budget with AGENTIC_SECURITY_HASKELL_PARSE_BUDGETS (name=value,...) and rescan; a file whose flow analysis did not run needs deep analysis on. The remaining files are never skipped silently, and the capability stays incomplete until they are analysed' },
+  };
+  // The full list (not capped) for the persisted record in haskell-budget-state.js; non-enumerable so the report shape is unchanged.
+  Object.defineProperty(budget, 'remainingAll', { value: remaining, enumerable: false });
+  const hasHaskell = present.length + sizeSkipped.size + policy.size + excl.size > 0;
+  return {
+    schema: COVERAGE_SCHEMA,
+    present: hasHaskell,
+    // `complete` only when every stage that was required ran to completion; never inferred from a zero-finding scan.
+    capability: { status: !hasHaskell ? 'not-applicable' : (reasons.length || sizeSkipped.size) ? 'incomplete' : 'complete', reasons, limitations },
+    totals: { discovered: rows.length, eligible: eligible.length, eligibleHs: eligibleHs.length, skipped: skipped.length },
+    byForm, byPackage,
+    stages: {
+      parse: { success: parsedHs, partial: eligibleHs.filter(([, r]) => r.parse === 'parsed_with_errors').length, failed: eligibleHs.filter(([, r]) => !['parsed', 'parsed_with_errors'].includes(r.parse)).length, rate: rate(parsedHs, eligibleHs.length) },
+      semantic: { completed: semanticHs, rate: rate(semanticHs, eligibleHs.length) },
+    },
+    functions: fn,
+    unresolvedCalls,
+    ruleFamilies: families,
+    thresholds: th,
+    meetsThresholds: hasHaskell ? ((rate(parsedHs, eligibleHs.length) ?? 1) >= th.parseRate && (rate(semanticHs, eligibleHs.length) ?? 1) >= th.semanticRate) : null,
+    incompleteEntries,
+    incompleteMains: mains,
+    budget,
+    skipped: skipped.slice(0, 500),
+    byFile,
+  };
+}

package/src/language/haskell-project-models.js

@@ -0,0 +1,107 @@
+// Declarative project models for Haskell wrappers (PRD FR 03).
+//
+// A wrapper the shipped registry does not know (a project's own `runQuery`, a vendored HTTP helper) can be declared in
+// `.agentic-security/haskell-models.json`. A suggestive function name is never enough: every model must carry provenance (who
+// reviewed it and why), the argument position it concerns, and a paired positive and negative test that exist in the scanned
+// source. A model that lacks any of these is rejected, with the reason, and has no effect on the scan.
+//
+// File shape:
+//   { "schema": "haskell-project-models/1",
+//     "models": [ { "id": "app-runquery", "role": "sink", "module": "App.Db", "name": "runQuery",
+//                   "family": "sql", "cwe": "CWE-89", "argIndex": 0,
+//                   "provenance": { "reviewer": "…", "reviewedAt": "2026-11-01", "reason": "…" },
+//                   "tests": { "positive": "test/RunQueryVuln.hs", "negative": "test/RunQuerySafe.hs" } } ] }
+//
+// Roles: `source` (its result is untrusted input), `sink` (argument `argIndex` is dangerous for `family`), `sanitizer`
+// (its result is safe for the families in `appliesTo`, and only those; `*` is not accepted).
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { statePath } from '../posture/state-dir.js';
+
+export const PROJECT_MODEL_SCHEMA = 'haskell-project-models/1';
+
+const FAMILIES = Object.freeze({
+  sql: 'CWE-89', cmd: 'CWE-78', path: 'CWE-22', ssrf: 'CWE-918', xss: 'CWE-79', log: 'CWE-532', code: 'CWE-94', redirect: 'CWE-601',
+});
+const SEVERITY = { sql: 'high', cmd: 'high', path: 'high', ssrf: 'high', xss: 'high', log: 'medium', code: 'critical', redirect: 'medium' };
+const MODULE_RE = /^[A-Z][A-Za-z0-9_']*(?:\.[A-Z][A-Za-z0-9_']*)*$/;
+const NAME_RE = /^[a-z_][A-Za-z0-9_']*$/;
+
+function check(m, exists) {
+  if (!m || typeof m !== 'object') return 'not an object';
+  if (!m.id || typeof m.id !== 'string') return 'missing id';
+  if (!['source', 'sink', 'sanitizer'].includes(m.role)) return `role must be source, sink or sanitizer, got ${JSON.stringify(m.role)}`;
+  if (!MODULE_RE.test(String(m.module || ''))) return 'module must be a qualified module name such as App.Db';
+  if (!NAME_RE.test(String(m.name || ''))) return 'name must be a function name';
+  const pv = m.provenance;
+  if (!pv || !pv.reviewer || !pv.reviewedAt || !pv.reason) return 'provenance needs reviewer, reviewedAt and reason: a function name alone is not a model';
+  const t = m.tests;
+  if (!t || !t.positive || !t.negative) return 'a paired positive and negative test is required';
+  if (t.positive === t.negative) return 'the positive and negative tests must be different files';
+  for (const k of ['positive', 'negative']) {
+    if (!exists(String(t[k]))) return `${k} test "${t[k]}" does not exist inside the project`;
+  }
+  if (m.role === 'sink') {
+    if (!FAMILIES[m.family]) return `family must be one of ${Object.keys(FAMILIES).join(', ')}`;
+    if (!(Number.isInteger(m.argIndex) && m.argIndex >= 0) && m.argIndex !== 'all') return 'a sink needs argIndex (a non-negative integer or "all")';
+  }
+  if (m.role === 'sanitizer') {
+    if (!Array.isArray(m.appliesTo) || !m.appliesTo.length) return 'a sanitizer needs appliesTo, the families it neutralises';
+    if (m.appliesTo.includes('*')) return 'a project sanitizer may not claim every family';
+    const bad = m.appliesTo.find((f) => !FAMILIES[f]);
+    if (bad) return `unknown family in appliesTo: ${bad}`;
+  }
+  if (m.role === 'source' && !m.label) return 'a source needs a label saying what it returns';
+  return null;
+}
+
+/** A predicate for 'this relative path is a regular file inside the project root'. */
+export function projectFileExists(scanRoot) {
+  const root = path.resolve(scanRoot);
+  return (rel) => {
+    try {
+      if (path.isAbsolute(rel)) return false;
+      const abs = path.resolve(root, rel);
+      if (abs !== root && !abs.startsWith(root + path.sep)) return false;
+      return fs.lstatSync(abs).isFile();
+    } catch { return false; }
+  };
+}
+
+/** Read the model file from the scan root (an exact path, never a traversal). Returns the parsed document or null. */
+export function readProjectModelFile(scanRoot) {
+  try {
+    const fp = statePath(scanRoot, 'haskell-models.json');
+    return JSON.parse(fs.readFileSync(fp, 'utf8'));
+  } catch { return null; }
+}
+
+/**
+ * @returns {{present: boolean, accepted: object[], rejected: {id: string, reason: string}[], catalog: object[]}}
+ */
+export function loadProjectModels(doc, exists = () => false) {
+  if (!doc) return { present: false, accepted: [], rejected: [], catalog: [] };
+  if (doc.schema !== PROJECT_MODEL_SCHEMA || !Array.isArray(doc.models)) {
+    return { present: true, accepted: [], rejected: [{ id: '(file)', reason: `expected schema ${PROJECT_MODEL_SCHEMA} with a models array` }], catalog: [] };
+  }
+  const accepted = []; const rejected = []; const seen = new Set();
+  for (const m of doc.models) {
+    const id = String(m && m.id || '(no id)');
+    const why = seen.has(id) ? 'duplicate id' : check(m, exists);
+    seen.add(id);
+    if (why) rejected.push({ id, reason: why }); else accepted.push(m);
+  }
+  const catalog = accepted.map((m) => {
+    const callee = `${m.module}.${m.name}`;
+    const base = { id: `hs-project-${m.id}`.toLowerCase(), language: 'hs', framework: 'haskell', match: { type: 'call', callee }, projectModel: m.id };
+    if (m.role === 'source') return { ...base, kind: 'source', label: m.label, provenance: 'project-model' };
+    if (m.role === 'sink') return {
+      ...base, kind: 'sink', argIndex: m.argIndex,
+      vuln: { name: m.vuln || `${m.family} sink (project model ${m.id})`, severity: SEVERITY[m.family], cwe: m.cwe || FAMILIES[m.family], remediation: m.remediation || 'See the project model that declares this wrapper.' },
+      hs: { family: m.family, shell: m.shell === true, argv: false, package: 'project', htmlSkeleton: false },
+    };
+    return { ...base, kind: 'sanitizer', effect: 'strip', appliesTo: m.appliesTo, note: `project model ${m.id}` };
+  });
+  return { present: true, accepted, rejected, catalog };
+}

package/src/language/nix-eval-isolation.js

@@ -69,7 +69,7 @@ const real = (p) => { try { return realpathSync(p); } catch { return resolve(p);
  * The sandboxed command for a backend. Reads are an ALLOWLIST (the listed roots, system library paths and the
  * evaluator); writes are an allowlist of one scratch directory; network and process creation are denied.
  * @param {{backend:string, path?:string}} sb
- * @param {{execFile:string, args:string[], readOnly:string[], readFiles?:string[], writable:string[], cwd:string}} spec
+ * @param {{execFile:string, args:string[], readOnly:string[], readFiles?:string[], writable:string[], cwd:string, env?:Record<string,string>}} spec
  */
 export function sandboxCommand(sb, spec) {
   const ro = [...new Set(spec.readOnly.map(real))];
@@ -92,34 +92,94 @@ export function sandboxCommand(sb, spec) {
     for (const p of ro) a.push('--ro-bind', p, p);
     for (const p of files) a.push('--ro-bind', p, p);
     for (const p of rw) a.push('--bind', p, p);
+    // --clearenv empties the environment bwrap itself was given, so the clean one is set explicitly inside.
+    for (const [k, v] of Object.entries(spec.env || {})) a.push('--setenv', k, String(v));
+    // Namespaces do not stop process creation; the seccomp filter does. Before it, a sandboxed process could spawn anything the
+    // read-only binds expose (found the first time a CI runner had bwrap installed). On an architecture with no filter there is
+    // none, and the probe then reports the spawn and refuses to evaluate.
+    const seccomp = seccompNoProcesses(sb.arch || process.arch);
+    if (seccomp) a.push('--seccomp', '3');
     a.push('--chdir', spec.cwd, exec, ...spec.args);
-    return { file: sb.path, args: a, profile: null };
+    return { file: sb.path, args: a, profile: null, fd3: seccomp };
   }
   return null;
 }
 
+// ── seccomp: threads yes, processes no ──────────────────────────────────────
+// A classic-BPF seccomp program, as `bwrap --seccomp FD` reads it (struct sock_filter, native little-endian). It denies fork and vfork,
+// denies clone unless CLONE_THREAD is set (so pthread_create works and posix_spawn, fork and vfork through clone do not), answers clone3
+// with ENOSYS (its flags are behind a pointer a filter cannot read; glibc then falls back to clone), denies x32 syscalls, and kills a
+// process that switches to another syscall ABI.
+const SECCOMP_ARCH = {
+  x64: { audit: 0xc000003e, clone: 56, clone3: 435, deny: [57, 58], x32: true },
+  arm64: { audit: 0xc00000b7, clone: 220, clone3: 435, deny: [], x32: false },
+};
+const CLONE_THREAD = 0x10000;
+export function seccompNoProcesses(arch) {
+  const A = SECCOMP_ARCH[arch];
+  if (!A) return null;
+  const LD = 0x20, JEQ = 0x15, JGE = 0x35, JSET = 0x45, RET = 0x06;
+  const ALLOW = 0x7fff0000, EPERM = 0x00050000 | 1, ENOSYS = 0x00050000 | 38, KILL = 0x80000000;
+  // Instructions with symbolic jump targets, resolved to relative offsets below.
+  const prog = [
+    [LD, 0, 0, 4],                                         // arch
+    [JEQ, null, 'kill', A.audit],
+    [LD, 0, 0, 0],                                         // syscall number
+    ...(A.x32 ? [[JGE, 'eperm', null, 0x40000000]] : []),
+    [JEQ, 'enosys', null, A.clone3],
+    ...A.deny.map((nr) => [JEQ, 'eperm', null, nr]),
+    [JEQ, null, 'allow', A.clone],
+    [LD, 0, 0, 16],                                        // clone flags, args[0] low word
+    [JSET, 'allow', 'eperm', CLONE_THREAD],
+    ['allow', RET, ALLOW], ['eperm', RET, EPERM], ['enosys', RET, ENOSYS], ['kill', RET, KILL],
+  ];
+  const at = {};
+  prog.forEach((ins, i) => { if (typeof ins[0] === 'string') at[ins[0]] = i; });
+  const buf = Buffer.alloc(prog.length * 8);
+  prog.forEach((ins, i) => {
+    const [code, jt, jf, k] = typeof ins[0] === 'string' ? [ins[1], 0, 0, ins[2]] : ins;
+    const rel = (t) => (t === null || t === 0 ? 0 : at[t] - i - 1);
+    buf.writeUInt16LE(code, i * 8); buf.writeUInt8(rel(jt), i * 8 + 2); buf.writeUInt8(rel(jf), i * 8 + 3); buf.writeUInt32LE(k >>> 0, i * 8 + 4);
+  });
+  return buf;
+}
+
 // ── process supervisor ───────────────────────────────────────────────────────
-function rssOfGroup(pgid) {
-  const r = spawnSync('/bin/ps', ['-o', 'rss=', '-g', String(pgid)], { encoding: 'utf8', timeout: 2000 });
+// The memory of the whole process tree under `root`, in MB. Not the process group: bwrap's --new-session puts the sandboxed process in
+// a session and group of its own, so a group sum never saw the evaluator on Linux.
+function rssOfTree(root) {
+  const r = spawnSync('/bin/ps', ['-A', '-o', 'pid=,ppid=,rss='], { encoding: 'utf8', timeout: 2000 });
   if (r.status !== 0) return 0;
-  return r.stdout.split('\n').map((x) => parseInt(x, 10)).filter(Number.isFinite).reduce((a, b) => a + b, 0) / 1024;
+  const kids = new Map(); const rss = new Map();
+  for (const line of r.stdout.split('\n')) {
+    const [pid, ppid, kb] = line.trim().split(/\s+/).map((x) => parseInt(x, 10));
+    if (!Number.isFinite(pid) || !Number.isFinite(ppid)) continue;
+    rss.set(pid, Number.isFinite(kb) ? kb : 0);
+    if (!kids.has(ppid)) kids.set(ppid, []);
+    kids.get(ppid).push(pid);
+  }
+  let total = 0; const seen = new Set(); const stack = [root];
+  while (stack.length) { const p = stack.pop(); if (seen.has(p)) continue; seen.add(p); total += rss.get(p) || 0; stack.push(...(kids.get(p) || [])); }
+  return total / 1024;
 }
 function killGroup(pid, sig) { try { process.kill(-pid, sig); } catch { try { process.kill(pid, sig); } catch { /* gone */ } } }
 
 /** Run a command to completion under a deadline, an output cap and a memory ceiling. Never throws. */
-export function supervise(file, args, { env, cwd, deadlineMs, maxOutputBytes, maxRssMb, killGraceMs = 1500 }) {
+export function supervise(file, args, { env, cwd, deadlineMs, maxOutputBytes, maxRssMb, killGraceMs = 1500, fd3 = null }) {
   return new Promise((resolveP) => {
     const t0 = Date.now();
     let child;
-    try { child = spawn(file, args, { env, cwd, detached: true, stdio: ['ignore', 'pipe', 'pipe'] }); }
+    try { child = spawn(file, args, { env, cwd, detached: true, stdio: ['ignore', 'pipe', 'pipe', ...(fd3 ? ['pipe'] : [])] }); }
     catch (e) { return resolveP({ status: 'failed', reason: `could not start: ${e.message}`, stdout: '', stderr: '', exitCode: null, signal: null, ms: 0 }); }
+    // fd 3 carries the seccomp program to bwrap; a child that exits before reading it closes the pipe, which is not an error here.
+    if (fd3) { child.stdio[3].on('error', () => {}); child.stdio[3].end(fd3); }
     let out = ''; let err = ''; let bytes = 0; let state = null; let done = false;
     const finish = (extra = {}) => { if (done) return; done = true; clearInterval(poll); clearTimeout(dl); resolveP({ stdout: out, stderr: err.slice(0, 4000), ms: Date.now() - t0, ...extra }); };
     const stop = (why) => { if (state) return; state = why; killGroup(child.pid, 'SIGTERM'); setTimeout(() => killGroup(child.pid, 'SIGKILL'), killGraceMs).unref(); };
     child.stdout.on('data', (d) => { bytes += d.length; if (bytes > maxOutputBytes) { stop('output-limit'); return; } out += d.toString('utf8'); });
     child.stderr.on('data', (d) => { if (err.length < 8000) err += d.toString('utf8'); });
     const dl = setTimeout(() => stop('timed-out'), deadlineMs);
-    const poll = setInterval(() => { if (!state && maxRssMb && rssOfGroup(child.pid) > maxRssMb) stop('resource-limit'); }, 250);
+    const poll = setInterval(() => { if (!state && maxRssMb && rssOfTree(child.pid) > maxRssMb) stop('resource-limit'); }, 250);
     child.on('error', (e) => finish({ status: 'failed', reason: e.message, exitCode: null, signal: null }));
     child.on('close', (code, signal) => {
       killGroup(child.pid, 'SIGKILL');                                          // reap any descendants
@@ -197,8 +257,8 @@ export async function probeSandbox(sb, opts = {}) {
   const port = tcp.address().port;
   try {
     const exe = opts.nodePath || process.execPath;
-    const cmd = sandboxCommand(sb, { execFile: exe, args: [script, join(allowed, 'a.txt'), join(outside, 'secret.txt'), join(outside, 'w.txt'), join(scratch, 'w.txt'), String(port), sockPath], readOnly: [allowed, dirname(dirname(real(exe)))], readFiles: [script], writable: [scratch], cwd: scratch });
-    const r = await supervise(cmd.file, cmd.args, { env: cleanEnv(scratch), cwd: scratch, deadlineMs: limits.probeDeadlineMs, maxOutputBytes: 64 * 1024, maxRssMb: limits.maxRssMb, killGraceMs: limits.killGraceMs });
+    const cmd = sandboxCommand(sb, { env: cleanEnv(scratch), execFile: exe, args: [script, join(allowed, 'a.txt'), join(outside, 'secret.txt'), join(outside, 'w.txt'), join(scratch, 'w.txt'), String(port), sockPath], readOnly: [allowed, dirname(dirname(real(exe)))], readFiles: [script], writable: [scratch], cwd: scratch });
+    const r = await supervise(cmd.file, cmd.args, { fd3: cmd.fd3, env: cleanEnv(scratch), cwd: scratch, deadlineMs: limits.probeDeadlineMs, maxOutputBytes: 64 * 1024, maxRssMb: limits.maxRssMb, killGraceMs: limits.killGraceMs });
     let attempts = null;
     try { attempts = JSON.parse(r.stdout.trim()); } catch { /* unparseable: not verified */ }
     if (!attempts) return { verified: false, backend: sb.backend, reason: `the probe did not complete inside the sandbox (${r.reason || r.stderr.slice(0, 120) || 'no output'})`, attempts: {} };
@@ -221,8 +281,8 @@ export async function probeSandbox(sb, opts = {}) {
 /** @param {{file:string, prefixArgs?:string[]}} nix  the evaluator command (a stand-in in tests) */
 export async function detectEvaluator(nix, sb, ctx) {
   const run = async (args) => {
-    const cmd = sandboxCommand(sb, { execFile: nix.file, args: [...(nix.prefixArgs || []), ...args], readOnly: ctx.readOnly, readFiles: [...(ctx.readFiles || []), ...(nix.prefixArgs || []).filter((a) => !a.startsWith('-'))], writable: [ctx.work], cwd: ctx.work });
-    return supervise(cmd.file, cmd.args, { env: cleanEnv(ctx.work), cwd: ctx.work, deadlineMs: 10_000, maxOutputBytes: 64 * 1024, maxRssMb: ctx.limits.maxRssMb, killGraceMs: ctx.limits.killGraceMs });
+    const cmd = sandboxCommand(sb, { env: cleanEnv(ctx.work), execFile: nix.file, args: [...(nix.prefixArgs || []), ...args], readOnly: ctx.readOnly, readFiles: [...(ctx.readFiles || []), ...(nix.prefixArgs || []).filter((a) => !a.startsWith('-'))], writable: [ctx.work], cwd: ctx.work });
+    return supervise(cmd.file, cmd.args, { fd3: cmd.fd3, env: cleanEnv(ctx.work), cwd: ctx.work, deadlineMs: 10_000, maxOutputBytes: 64 * 1024, maxRssMb: ctx.limits.maxRssMb, killGraceMs: ctx.limits.killGraceMs });
   };
   const v = await run(['--version']);
   const ver = (/(\d+\.\d+(?:\.\d+)?)/.exec(v.stdout) || [])[1] || null;
@@ -276,8 +336,8 @@ export async function runIsolatedEval(o) {
     const feat = await detectEvaluator(o.nix, sb, ctx);
     if (!feat.ok) return stopBefore('unsupported', `${feat.reason}; the project's Nix code was NOT evaluated`, { sandbox: sb, probe: { verified: true }, evaluator: feat });
     const args = [...(o.nix.prefixArgs || []), ...buildEvalArgs(target)];
-    const cmd = sandboxCommand(sb, { execFile: o.nix.file, args, readOnly: ctx.readOnly, readFiles: nixFiles, writable: [ctx.work], cwd: ctx.work });
-    const r = await supervise(cmd.file, cmd.args, { env: cleanEnv(ctx.work, o.env || {}), cwd: ctx.work, deadlineMs: limits.deadlineMs, maxOutputBytes: limits.maxOutputBytes, maxRssMb: limits.maxRssMb, killGraceMs: limits.killGraceMs });
+    const cmd = sandboxCommand(sb, { env: cleanEnv(ctx.work, o.env || {}), execFile: o.nix.file, args, readOnly: ctx.readOnly, readFiles: nixFiles, writable: [ctx.work], cwd: ctx.work });
+    const r = await supervise(cmd.file, cmd.args, { fd3: cmd.fd3, env: cleanEnv(ctx.work, o.env || {}), cwd: ctx.work, deadlineMs: limits.deadlineMs, maxOutputBytes: limits.maxOutputBytes, maxRssMb: limits.maxRssMb, killGraceMs: limits.killGraceMs });
     const base = { ...keep, projectCodeEvaluated: true, sandbox: { backend: sb.backend }, evaluator: { version: feat.version }, ms: r.ms, target: { attribute: target.attribute, system: target.system, installable: target.installable } };
     if (r.status !== 'ok') return { ...base, status: r.status === 'failed' ? 'failed' : r.status, reason: r.reason || r.stderr.slice(0, 200) };
     let data;