@clear-capabilities/agentic-security-scanner 0.195.8 → 0.195.10

package/CHANGELOG.md

@@ -9,6 +9,28 @@
 > make the history less accurate, not more.
 
 
+## 0.195.10 - Haskell remediation measured on real code: a password-hash migration fixer, an HTML-from-text fixer, and the registry's GHC check
+
+Why: the fix preview was run over every labelled real-code true positive of `bench/dag/dev-haskell` (26 sites in gitit, scotty, dhall, hackage-server and IHP; `fix-real.mjs <project> --all`) and 3 of them got a verified patch (one cookie, two wai request bodies). The rest were refusals: five scotty `html $ mconcat ["<h1>", v, "</h1>"]` sites, which the blaze rewrite cannot touch; three scotty `body` reads; two dhall path operations spread over several functions; three generators in files that import no entropy package; an OpenSSL `VerifyNone`; an open redirect; two partial functions; and gitit's `hashPassword salt pass = showDigest $ sha512 $ ...`, refused by the CWE-916 class reason. Two of those classes had a sound rewrite that was never written. After this release 8 of the 26 sites get a verified patch, on the same 47 flagged sites (nothing moved in detection).
+
+- **`hs-password-kdf-migrate` (CWE-916), a MITIGATION that is the migration story the old refusal asked for.** The class reason was right that a swap locks every user out, so the fixer does not swap: a pure one-line `name salt password = ...` of one text type (`String`, `Text` or strict `ByteString`) is kept verbatim as `nameLegacy` for verification only; `name` becomes PBKDF2-HMAC-SHA256 (600000 iterations, 32 bytes, over the same salt and password; a declared default, named in the plan) with a tag in front of the hex so a stored hash says how it was made; `nameNeedsRehash` reads the tag; `nameVerify stored salt password` checks either form; every `stored == name salt password` in the file calls it; an export list gains the helpers. Only in a file that already imports a cryptonite or crypton module (`Crypto.KDF.PBKDF2` is then in a declared package) and `Data.Text` or `Data.ByteString`; refused, naming the decision, when the function takes no salt (a pure function cannot add one), when the types differ, when a name is taken, and when ANOTHER file compares with the function, because that comparison would be left checking the old form against the new one. The rule it relies on is semantic: `haskell-security-rules.js` `legacyVerifierOnly` reports a fast password hash at `info` when every use of its function, in every file, is an operand of an equality and one of those functions also computes a password KDF within one project hop; a function that also stores a hash, or compares beside no KDF, keeps the full finding (pinned both ways, from the IR, never from the name). `defaultRescan` now drops a finding the engine lowered to `info` for a stated reason (`originalSeverity`, or this legacy-verifier evidence) as it drops proven-clean ones; a finding that is `info` in its own right is still counted, so fixing it can still be shown to remove it. The API is cryptonite's from its documentation; the tests type-check the patch against a declared stub of that shape and RUN the patched program under GHC: a legacy hash verifies, a new hash verifies, a wrong password does not, the tag decides re-hashing. gitit's real site stays refused on purpose: it imports the `SHA` package, which has no KDF, and the decision (which library) is the operator's.
+- **`hs-html-escape-text` (CWE-79), a MITIGATION for scotty's `html` of concatenated text.** `html $ mconcat ["<h1>", v, "</h1>"]` becomes `html $ mconcat ["<h1>", agenticEscapeHtml v, "</h1>"]`, and `html (f v)` with no literal in the argument becomes `html (agenticEscapeHtml (f v))`, with the escaper (the five characters that open markup or end a quoted attribute) defined in the file; the rescan recognises it by the entities it spells out (`htmlEscapers`), not by its name, so the finding goes quiet for the right reason and the effective check reads the application count back. Stated limits: HTML text and quoted attribute values only (a value inside a script, a style, a URL or an unquoted attribute is not made safe), markup the value carried is now text. Only with `Web.Scotty` and `Data.Text.Lazy` imported; a nested construction, a renderer in the argument, a literal alone and another framework's sink are refused. The escaper is run under GHC on hostile input in the test. On scotty's own examples this verifies all five labelled XSS sites.
+- **The registry's GHC check.** `bench/language-support/suites.mjs` `probeTools` records the GHC version on PATH and whether it is the recorded toolchain (`docs/language-toolchain.json`, 9.4.8); `promote.mjs` refuses to measure the suites under another GHC (`--allow-ghc-mismatch` records the mismatch in the registry's limits instead); the `auth` compile criterion's failure message says "unavailable compiler" when a module is missing under a mismatched GHC, so the row is recorded as blocked, not as an engine failure; `judgeGhc` is pinned both ways in `test/language/language-package-ci.test.js`. Found while doing it: GHC 9.4.8's package environment file (written by `cabal install --lib`) hides `bytestring`, so under the recorded GHC every stub-compiling remediation test reported its compile gate as not-run or failed; those four files now run their compiles with `GHC_ENVIRONMENT=-` (boot packages only; the auth suite keeps the environment it needs). The remediation suites pass under both GHCs on the maintainer's machine for the first time.
+
+Gates, from the runs recorded for this entry: `test:haskell` 438/438 (two new suites, `haskell-remediation-kdf` and `haskell-remediation-html-text`, both wired into the script and checked for a glued name), `test:nix` 305/305, `test:language` 257/257, `bench:haskell-precision:check` PASS (the labelled real-code rows unchanged), `bench:language-support:check`, mutation and layer-recall unchanged. The registry's capability suites were measured again under GHC 9.4.8 (the holdout result reused, not re-run) so the stored tools record carries the version; every Haskell row stays supported (9 of 9), Nix 8 of 10 with `nix-eval` and `nixos-host` still blocked on a host with no `nix`, and the registry's limits now name the GHC that was present (9.4.8, the recorded toolchain).
+
+## 0.195.9 - Haskell real-code precision, a blind unseen-v6 and the first blind Nix split, the unseen-v5 and Nix development shapes
+
+Four pieces of work, in the order they were done, each measured where it could be measured. Every number below comes from a run recorded in this repository on 2026-11-01.
+
+**Real-code precision (`bench/dag/dev-haskell`, `bench/haskell-precision`).** The 28 flagged false positives of the fresh set and the 5 of the development remainder were read by cause, live, with the current engine. Fourteen were a command-line program reading a FILE NAME from its own standard input (dhall's expression input, summoner's prompts); the trust-boundary module's own header said standard input in a command-line program crosses no boundary, but the code excluded it, so for a path operation it now counts (a command built from standard input, `getLine >>= callCommand`, stays reported, as before). Five were a path parameter handed on whole by a library function (`renderFile path = responseFile .. path`, `store path = readFile (cs path)`): the whole-handoff rule the process wrappers already had (`api-contract`, lowered to information) now covers path operations too, and a parameter spliced under a fixed directory is still a finding. The decision goes against three synthetic development splits, which label `load name = readFile name` vulnerable, and with the real code, where no true positive had that shape; the synthetic numbers that moved are recorded here, not hidden. Three were scotty's own cookie helpers (`setSimpleCookie n v`: a name that is the function's own parameter is decided by the caller), one a hashing tool printing the hash it made (`hashedPassword`: a binding whose name says digest is the stored form). Fresh set: 45 flagged, 17 true positives, 37.8% before; 26 flagged, 17 true positives, 65.4% after; no fresh true positive moved. Development tuning half: 10 flagged, 4 true positives before; 5 flagged, 2 true positives after, because two labelled sites are call-site copies of one fast-hash helper the labeller recorded as "three sites of one weakness", now carried as `alsoAt` on the helper's finding (still reported). The remaining false positives are named in `bench/dag/dev-haskell/README.md`; the sealed set was not run. Baseline re-recorded with `bench:haskell-precision:update`, every changed site checked against its label.
+
+**unseen-v6 (Haskell) and unseen-nix-v1 (Nix), both written blind.** Two separate agent sessions that could not see the repository wrote 78 Haskell forms and 72 NixOS forms from the family names, their CWE meanings and the authoring format, and reported counts only (the unseen-v5 author's per-family library list was a disclosed leak; this time the brief forbade it). The shared builder (`corpora/frozen-split.mjs`) takes an ecosystem, a split's manifest records it, a Nix form's marker is `#@@`, and the detection suite scores a frozen split under its own ecosystem; the two Haskell splits frozen before the field existed reproduce their digests unchanged. Baselines, taken before any engine change motivated by a split: unseen-v6 precision 71.0%, recall 56.4%, F1 62.9% (after the real-code work above, before unseen-v5 was read); unseen-nix-v1 precision 84.6%, recall 61.1%, F1 71.0%, the first Nix generalisation number this project has had.
+
+**unseen-v5 opened (a development set from 2026-11-01), the Nix unseen-v3 development set finished.** Haskell, pinned both ways in `test/haskell/haskell-unseen-v5-shapes.test.js`: a Servant handler pairs the API's reads with its LAST parameters (`orderServer conn ref` was annotated on `conn`); a `Set-Cookie` header handed to `setHeader`; a helper the IR inlined at its call site is reported once, in the helper; mwc-random and splitmix are predictable; a function that makes a key is security-shaped and a `code` is a one-time code where the function talks about a reset; an authentication endpoint is never missing authentication; `X-Session` and similar project header names are credentials; a yes/no answer about a credential, a record logged through a non-credential field and a `lastFour` helper are not a leak, the record logged whole is; fast-logger is a log sink; a URL that starts from a literal naming the host (or a request built over a fixed base by http-conduit's modifiers) is information with the reason `fixed-host-request`; a guard in the helper that holds the sink refutes the flow found from its caller; a blaze helper that escapes its parameter is an escaper for the caller's sink. The detection harness now scores `actionable` findings (not `info`, not proven clean or infeasible), the rule the other benches already used. Nix, pinned in `test/nix/nix-development-shapes.test.js`: `AmbientCapabilities` as one string, `Defaults !authenticate`, a `*File` option handed a `writeText` of a literal, a TLS key path on any enabled service, one script-taint finding per rule, line and origin class. Results: unseen-v5 (development) F1 65.7% to 84.1% (precision 96.7%, recall 74.4%); unseen-v6 (generalisation, aggregate only) F1 62.9% to 72.5% (precision 83.3%, recall 64.1%), so part of it generalised this time; Nix unseen-v3 (development) to 100% on both layers; unseen-nix-v1 (generalisation) 71.0% to 71.0%, none of it generalised. Left in unseen-v5 on purpose or for want of a model: a request count as a SQL LIMIT, a fast hash compared with a stored digest, a delete in a helper behind an `AuthProtect` principal, a Yesod form-field object id, a gzip decompress of a request body, a Snap CSV export, stored XSS through an `IORef`, a `ReqBody` record's host field, and two policy shapes (command-line arguments to SQL, a command-line file's content to a partial pattern), listed in its USE-LOG. **Disclosure:** two frozen-holdout path-traversal sources were printed and read during the precision investigation (both still findings; no rule was changed to them); `scanner/src/language/CLAUDE.md` records it. The support registry was re-measured once on the frozen holdout with GHC 9.4.8 on PATH (the machine's default moved to 9.14.1 and records a false `auth` failure without it): every Haskell and Nix row stays supported at the same holdout numbers; the unseen-v3 development column reads Haskell taint 28 of 30 (the whole-handoff path shape, now information) and Nix 100% on both layers; `nix-eval` and `nixos-host` stay blocked on a host with no `nix`.
+
+**Not done, and why.** Installing `nix` on the maintainer's machine (the two blocked registry rows, and the fetch-hash remediation that needs it) requires an administrator password this session did not have; it is the one item of the plan left for the user. The CWE-916 migration fixer and the registry's own GHC version check were not started: the engine work above took the session. `test:haskell` 426/426, `test:nix` 305/305, `test:language` 257/257 (one pin updated: the fixed-host URL is now information), `test:lineage` 1554/1554, mutation 460/460, layer-recall unchanged. Two `package.json` test scripts were briefly wired with a lost space (two names glued) and ran two files short without failing; found and fixed before this entry, and recorded in memory.
+
 ## 0.195.8 - Haskell: the unseen-v4 shapes are found, a blind unseen-v5 says most of that did not generalise; the NixOS job's status is stated honestly
 
 **Measured, 0.195.7:** commit to published GitHub release 9 min 44 s (`TIMINGS push=6s pr=3s checks=355s merge=4s verify=8s tag=4s release=192s npm=90s total=665s release-clock=208s`); the registry listed the version 4 min 14 s after the publish step. First run under the 10 minute requirement, with about 16 s of margin, on one measurement.

package/dist/{06198b6f3fac9b1cb25f.json → 312ef9976a988b322ade.json}

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.195.8",
+  "version": "0.195.10",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -93,8 +93,8 @@
     "test:lineage": "node --test test/lineage/analysis-completion.test.js test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js test/lineage/runtime-assurance.test.js test/lineage/runtime-edge-states.test.js test/lineage/runtime-explorer-view.test.js test/cli/runtime-explorer-cli.test.js test/cli/runtime-identity-cli.test.js test/cli/runtime-twin-cli.test.js test/lineage/cut-planner.test.js test/lineage/scc.test.js test/lineage/scc-solver.test.js test/graph/graph-views.test.js test/lineage/dag07-completion.test.js test/lineage/owned-build.test.js test/dataflow/boundary-propagation.test.js test/lineage/boundary-contract.test.js test/lineage/correlation-v2.test.js test/lineage/path-control-evidence.test.js test/lineage/smt-z3-backend.test.js test/cli/dag-commands.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
     "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
-    "test:haskell": "node --test test/haskell/haskell-reachability.test.js test/haskell/haskell-unseen-v4-shapes.test.js test/haskell/haskell-alias-taint.test.js test/haskell/haskell-weak-hash-names.test.js test/haskell/haskell-models-extended.test.js test/haskell/haskell-rules-extended.test.js test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-remediation-0190.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-sca-severity.test.js test/haskell/haskell-web-guards.test.js test/haskell/haskell-advisory-feed.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js test/haskell/haskell-boundaries.test.js test/haskell/haskell-live-feed-scan.test.js test/haskell/haskell-supply-bounds.test.js test/haskell/haskell-ir-scaling.test.js test/haskell/haskell-boundary-propagation.test.js test/haskell/haskell-generalization.test.js test/haskell/haskell-trust-boundary.test.js test/haskell/haskell-comment-invariance.test.js test/haskell/haskell-remediation-classes.test.js test/haskell/haskell-trust-boundary-frameworks.test.js test/haskell/haskell-generic-detectors.test.js",
-    "test:nix": "node --test test/nix/nix-option-types.test.js test/nix/nixos-hardening-daemon.test.js test/nix/nixos-hardening-extended.test.js test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-sca-severity.test.js test/nix/nix-haskell-closure-names.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js test/nix/nix-fix-multifile.test.js test/nix/nixos-evaluator-forms.test.js test/nix/nix-advisory-feed.test.js test/nix/nix-fix-prewrite.test.js test/nix/nix-boundary-scope.test.js",
+    "test:haskell": "node --test test/haskell/haskell-reachability.test.js test/haskell/haskell-real-code-shapes.test.js test/haskell/haskell-unseen-v5-shapes.test.js test/haskell/haskell-unseen-v4-shapes.test.js test/haskell/haskell-alias-taint.test.js test/haskell/haskell-weak-hash-names.test.js test/haskell/haskell-models-extended.test.js test/haskell/haskell-rules-extended.test.js test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-remediation-0190.test.js test/haskell/haskell-remediation-kdf.test.js test/haskell/haskell-remediation-html-text.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-sca-severity.test.js test/haskell/haskell-web-guards.test.js test/haskell/haskell-advisory-feed.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js test/haskell/haskell-boundaries.test.js test/haskell/haskell-live-feed-scan.test.js test/haskell/haskell-supply-bounds.test.js test/haskell/haskell-ir-scaling.test.js test/haskell/haskell-boundary-propagation.test.js test/haskell/haskell-generalization.test.js test/haskell/haskell-trust-boundary.test.js test/haskell/haskell-comment-invariance.test.js test/haskell/haskell-remediation-classes.test.js test/haskell/haskell-trust-boundary-frameworks.test.js test/haskell/haskell-generic-detectors.test.js",
+    "test:nix": "node --test test/nix/nix-option-types.test.js test/nix/nix-development-shapes.test.js test/nix/nixos-hardening-daemon.test.js test/nix/nixos-hardening-extended.test.js test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-sca-severity.test.js test/nix/nix-haskell-closure-names.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js test/nix/nix-fix-multifile.test.js test/nix/nixos-evaluator-forms.test.js test/nix/nix-advisory-feed.test.js test/nix/nix-fix-prewrite.test.js test/nix/nix-boundary-scope.test.js",
     "test:language": "node --test test/bench-haskell-precision.test.js test/bench-independent-haskell-panel.test.js test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/frozen-splits.test.js test/language/language-gap-fixes.test.js test/language/language-gap-fixes-2.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-parity-haskell.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js test/language/language-trust-boundary.test.js",
     "test:language-stress": "node --test --test-concurrency=1 test/language/language-stress-offline.test.js",
     "test:language-tools": "node --test test/haskell/haskell-web-auth.test.js test/haskell/haskell-support-gate.test.js",