@clear-capabilities/agentic-security-scanner 0.155.0 → 0.156.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-5b1c3482deb6bf15eb606402755278ad1e04a5b2e8b12c5b5246c5dcd4028b50  agentic-security.mjs
+71a2f80d8b60918125a14973bffd460f469848dc1b0aac126272864b539b61ce  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.155.0",
+  "version": "0.156.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -81,7 +81,7 @@
     "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
     "test:haskell": "node --test test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js",
     "test:nix": "node --test test/nix/nix-build-trust.test.js test/nix/nix-eval-isolation.test.js test/nix/nix-input-inventory.test.js test/nix/nix-parser-ir.test.js test/nix/nix-remediation.test.js test/nix/nix-resolved-closure.test.js test/nix/nix-sca-patches.test.js test/nix/nix-script-taint.test.js test/nix/nix-secrets-store.test.js test/nix/nixos-hardening.test.js test/nix/nixos-module-resolution.test.js",
-    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js test/language/language-trust-boundary.test.js",
+    "test:language": "node --test test/language/capability-ledger.test.js test/language/language-accuracy-regression.test.js test/language/language-aibom.test.js test/language/language-assurance.test.js test/language/language-bom.test.js test/language/language-compliance.test.js test/language/language-contracts.test.js test/language/language-corpora-integrity.test.js test/language/language-discovery.test.js test/language/language-doc-coverage.test.js test/language/language-evidence-posture.test.js test/language/language-explorer.test.js test/language/language-gap-fixes.test.js test/language/language-governance.test.js test/language/language-integrations.test.js test/language/language-llm-agent.test.js test/language/language-local-ai.test.js test/language/language-polyglot-bridges.test.js test/language/language-privacy-lineage.test.js test/language/language-proof-remediation.test.js test/language/language-report-formats.test.js test/language/language-secrets.test.js test/language/language-trust-boundary.test.js",
     "test:language-stress": "node --test --test-concurrency=1 test/language/language-stress-offline.test.js",
     "test:language-tools": "node --test test/haskell/haskell-web-auth.test.js test/haskell/haskell-support-gate.test.js",
     "bench:language-support:check": "node ../bench/language-support/check.mjs",

package/src/language/haskell-guards.js

@@ -42,11 +42,11 @@ function identNames(e, out = new Set(), depth = 0) {
 const mentions = (e, vars) => { for (const n of identNames(e)) if (vars.has(n)) return true; return false; };
 
 /** Classify a condition over the value `vars`. -> {safeWhen, kind, families, needsCanon?, subject} | null */
-export function classifyCondition(c, vars) {
+export function classifyCondition(c, vars, derived = new Set()) {
   if (!c || typeof c !== 'object') return null;
   if (c.kind === 'binary') {
-    if (c.op === '&&') { const a = classifyCondition(c.left, vars); const b = classifyCondition(c.right, vars); return [a, b].find((x) => x && x.safeWhen === true) || null; }
-    if (c.op === '||') { const a = classifyCondition(c.left, vars); const b = classifyCondition(c.right, vars); return [a, b].find((x) => x && x.safeWhen === false) || null; }
+    if (c.op === '&&') { const a = classifyCondition(c.left, vars, derived); const b = classifyCondition(c.right, vars, derived); return [a, b].find((x) => x && x.safeWhen === true) || null; }
+    if (c.op === '||') { const a = classifyCondition(c.left, vars, derived); const b = classifyCondition(c.right, vars, derived); return [a, b].find((x) => x && x.safeWhen === false) || null; }
     if (c.op === '==' || c.op === '===') {
       const pair = (l, r) => l && l.kind === 'call' && /(?:^|\.)takeFileName$/.test(l.callee || '') && l.args && l.args[0] && r && r.kind === 'ident' && l.args[0].kind === 'ident' && l.args[0].name === r.name && vars.has(r.name);
       if (pair(c.left, c.right) || pair(c.right, c.left)) return { safeWhen: true, kind: 'bare-filename', families: ['path'], subject: (c.left.kind === 'ident' ? c.left : c.right).name };
@@ -56,7 +56,7 @@ export function classifyCondition(c, vars) {
   if (c.kind !== 'call') return null;
   const name = c.callee || '';
   const a = c.args || [];
-  if (name === 'not' || name === 'Prelude.not') { const inner = classifyCondition(a[0], vars); return inner ? { ...inner, safeWhen: !inner.safeWhen } : null; }
+  if (name === 'not' || name === 'Prelude.not') { const inner = classifyCondition(a[0], vars, derived); return inner ? { ...inner, safeWhen: !inner.safeWhen } : null; }
   if (name === 'Data.List.isInfixOf' && isStr(a[0]) && a[0].value.includes('..') && a[1] && a[1].kind === 'ident' && vars.has(a[1].name)) {
     return { safeWhen: false, kind: 'traversal-check', families: ['path'], subject: a[1].name };
   }
@@ -70,6 +70,12 @@ export function classifyCondition(c, vars) {
   if ((IS_ELEM.has(name) || NOT_ELEM.has(name)) && isStr(a[0]) && a[0].value === '..' && a[1] && a[1].kind === 'call' && /(?:^|\.)(?:splitDirectories|splitPath)$/.test(a[1].callee || '') && a[1].args && a[1].args[0] && a[1].args[0].kind === 'ident' && vars.has(a[1].args[0].name)) {
     return { safeWhen: NOT_ELEM.has(name), kind: 'traversal-check', families: ['path'], subject: a[1].args[0].name };
   }
+  // `uriRegName a `elem` ["api.example.com"]` where `a` was parsed from the checked URL: the host is on an allow-list, which is the
+  // URL family's control. Only a HOST accessor over a value derived from the checked one counts (a path or query allow-list does not).
+  if ((IS_ELEM.has(name) || NOT_ELEM.has(name)) && a[0] && a[0].kind === 'call' && /(?:^|\.)(?:uriRegName|uriAuthority|getHost)$/.test(a[0].callee || '') && a[0].args && a[0].args[0] && a[0].args[0].kind === 'ident'
+      && (vars.has(a[0].args[0].name) || derived.has(a[0].args[0].name)) && a[1] && a[1].kind === 'array' && a[1].elements.length && a[1].elements.every(isStr)) {
+    return { safeWhen: IS_ELEM.has(name), kind: 'host-allow-list', families: ['url'], subject: a[0].args[0].name };
+  }
   if ((IS_ELEM.has(name) || NOT_ELEM.has(name)) && a[0] && a[0].kind === 'ident' && vars.has(a[0].name) && !mentions(a[1], vars)) {
     return { safeWhen: IS_ELEM.has(name), kind: 'allow-list', families: ['*'], subject: a[0].name };
   }
@@ -280,10 +286,11 @@ export function judgeFinding(f, perFile) {
     // The sink argument may be a value BUILT from the checked one (`req <- parseUrlThrow target; httpLbs req m`): the
     // guard names the original, so the origins of the argument count as its subject too.
     for (const v of originsOf(fn, vars)) vars.add(v);
+    const derived = derivedFrom(fn, vars);   // values built FROM the checked one (`a` in `Just a <- parseURI url`)
     const facts = [...site.facts, ...cfgBranchFacts(fn, site.nodeId), ...exitGuardFacts(fn, site.nodeId)];
     let refuted = null;
     for (const fact of facts) {
-      const cls = classifyCondition(fact.cond, vars);
+      const cls = classifyCondition(fact.cond, vars, derived);
       if (!cls || cls.safeWhen !== fact.when) continue;
       if (!(cls.families.includes('*') || cls.families.includes(fam))) continue;          // wrong-context control
       if (cls.needsCanon && !isCanonical(fn, cls.subject)) { weak = { kind: cls.kind, line: fact.line || fn.line, reason: 'containment check on a path that was not canonicalised' }; continue; }

package/src/language/haskell-ir.js

@@ -545,8 +545,15 @@ class FnLowerer {
       const mem = { kind: 'member', object: obj, prop: r.name };
       return argAsts.length === 1 ? mem : { kind: 'call', callee: '<indirect>', args: [mem, ...argAsts.slice(1).map((a) => this.lowerExpr(a, ln))], hs: { status: 'unknown', reason: 'field-applied' } };
     }
-    const args = argAsts.map((a) => this.lowerExpr(a, ln));
+    let args = argAsts.map((a) => this.lowerExpr(a, ln));
+    // `lookup key table` returns an element OF the table: the key chooses which, it is not where the value comes from. Only the table
+    // flows to the result, so a constant table gives a constant result however tainted the key is.
+    let selector = null;
+    if (f.name === 'lookup' && args.length === 2 && (r.kind === 'builtin' || r.kind === 'external')) { selector = args[0]; args = [args[1]]; }
     const hs = { via };
+    // The key stays on the call as `hs.selector`: taint ignores it (it only chooses), but a rule asking "does caller text decide whether
+    // this fails" (fromJust (lookup key t)) still sees it.
+    if (selector) hs.selector = selector;
     let callee = f.qual ? `${f.qual}.${f.name}` : f.name;
     const arity = (r.kind === 'def' && r.def.kind === 'fun') ? r.def.arity : (r.kind === 'localfn' ? r.arity : -1);
     if ((r.kind === 'def' && r.def.kind === 'fun') || r.kind === 'localfn') {

package/src/language/haskell-models.js

@@ -163,6 +163,14 @@ san('Text.Blaze', ['toMarkup', 'toValue', 'text', 'string', 'lazyText'], ['xss']
 san('Lucid', ['toHtml', 'toHtmlRaw_'], ['xss'], 'Lucid.toHtml escapes');
 san('System.FilePath', ['takeFileName', 'takeBaseName'], ['path'], 'drops every directory component');
 san('System.FilePath.Posix', ['takeFileName', 'takeBaseName'], ['path'], 'drops every directory component');
+// A function whose result is a number or a boolean cannot carry caller text: nothing of the argument survives (`show (length x)`).
+const ALL_FAMILIES = ['*'];
+san('Prelude', ['length', 'null', 'fromEnum'], ALL_FAMILIES, 'returns a number or boolean: no caller text survives');
+san('Data.List', ['length', 'genericLength'], ALL_FAMILIES, 'returns a number: no caller text survives');
+san('Data.Foldable', ['length', 'null'], ALL_FAMILIES, 'returns a number or boolean: no caller text survives');
+san('Data.Text', ['length'], ALL_FAMILIES, 'returns a number: no caller text survives');
+san('Data.ByteString', ['length'], ALL_FAMILIES, 'returns a number: no caller text survives');
+san('Data.Char', ['ord'], ALL_FAMILIES, 'returns a number: no caller text survives');
 san('Database.PostgreSQL.Simple', ['Only'], [], 'binds a parameter; it is a safe argument position, not a query-text sanitizer');
 
 export const HS_SOURCES = Object.freeze(SRC);

package/src/language/haskell-security-rules.js

@@ -57,10 +57,14 @@ const STRONG_KDF = /^(?:Crypto\.KDF\.BCrypt\.|Crypto\.Argon2\.|Crypto\.Scrypt\.|
 const UNSAFE_CALLS = { 'System.IO.Unsafe.unsafePerformIO': 'unsafePerformIO', 'System.IO.Unsafe.unsafeInterleaveIO': 'unsafeInterleaveIO', 'System.IO.Unsafe.unsafeDupablePerformIO': 'unsafeDupablePerformIO', 'Unsafe.Coerce.unsafeCoerce': 'unsafeCoerce' };
 
 const TIME_SOURCES = new Set(['Data.Time.Clock.POSIX.getPOSIXTime', 'Data.Time.Clock.getCurrentTime', 'System.CPUTime.getCPUTime']);
-const SECURITY_FN = /(?:token|nonce|secret|otp|csrf|session|salt|apikey|resetcode|passcode|verification)/i;
+const SECURITY_FN_SUBSTR = /(?:token|nonce|secret|otp|csrf|session|salt|apikey|resetcode|passcode|verification)/i;
+// Short credential words that would over-match as substrings (`spin`, `mapping`, `keyboard`): matched as whole camelCase / snake_case words.
+const SECURITY_WORDS = new Set(['pin', 'password', 'passwd', 'credential', 'credentials']);
+const SECURITY_FN = { test: (name) => SECURITY_FN_SUBSTR.test(name) || String(name).replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase().split(/[^a-z0-9]+/).some((w) => SECURITY_WORDS.has(w)) };
 const INPUT_READS = new Set(['Prelude.getContents', 'System.IO.getContents', 'System.IO.hGetContents', 'Data.ByteString.getContents', 'Data.ByteString.hGetContents', 'Data.ByteString.Char8.getContents', 'Data.ByteString.Char8.hGetContents', 'Data.ByteString.Lazy.getContents', 'Data.ByteString.Lazy.hGetContents', 'Data.ByteString.Lazy.Char8.getContents', 'Data.ByteString.Lazy.Char8.hGetContents', 'Data.Text.IO.getContents', 'Data.Text.IO.hGetContents', 'Data.Text.Lazy.IO.getContents', 'Data.Text.Lazy.IO.hGetContents']);
 const BOUNDING = /(?:^|\.)(?:take|hGetSome|hGet|splitAt|limit|limitedRead)$/;
-const ALLOCATORS = new Set(['replicate', 'Prelude.replicate', 'Data.List.replicate', 'Data.ByteString.replicate', 'Data.ByteString.Char8.replicate', 'Data.ByteString.Lazy.replicate', 'Data.Text.replicate', 'Data.Vector.replicate']);
+// `replicateM n getLine` reads n lines: the count is an allocation (and an input loop) sized by whoever supplied n.
+const ALLOCATORS = new Set(['replicate', 'Prelude.replicate', 'Data.List.replicate', 'Data.ByteString.replicate', 'Data.ByteString.Char8.replicate', 'Data.ByteString.Lazy.replicate', 'Data.Text.replicate', 'Data.Vector.replicate', 'Control.Monad.replicateM', 'Control.Monad.replicateM_', 'Data.Vector.replicateM', 'Data.List.genericReplicate']);
 const CLAMPS = /^(?:(?:Prelude|Data\.Ord)\.)?(?:min|clamp)$/;
 const PARTIALS = new Set(['read', 'Prelude.read', 'head', 'Prelude.head', 'Data.List.head', 'tail', 'Prelude.tail', 'Data.List.tail', 'last', 'Prelude.last', 'Data.List.last', 'init', 'Prelude.init', 'Data.List.init', 'Data.Maybe.fromJust', 'fromJust']);
 const SESSION_COOKIE = /(?:sess|sid|token|tok|auth|jwt|csrf|login|remember|secret)/i;
@@ -77,6 +81,7 @@ const kids = (e) => {
   for (const k of ['left', 'right', 'object', 'value', 'callee']) if (e[k] && typeof e[k] === 'object') out.push(e[k]);
   for (const k of ['args', 'elements', 'branches', 'parts']) if (Array.isArray(e[k])) out.push(...e[k]);
   if (Array.isArray(e.props)) for (const p of e.props) if (p && p.value) out.push(p.value);
+  if (e.hs && e.hs.selector && typeof e.hs.selector === 'object') out.push(e.hs.selector);   // `lookup key t`: the key decides the outcome
   return out;
 };
 
@@ -210,6 +215,11 @@ export function analyzeHaskellRules(files, opts = {}) {
               }
               continue;
             }
+            // `xs !! n` raises on a short list: a partial function, written as an operator, applied to caller-supplied text
+            if (e.kind === 'binary' && e.op === '!!' && e.left && mentionsText(e.left)) {
+              emit('hs-partial-function-on-input', file, e.line || node.line, { detail: '!! on a caller-supplied list', evidence: { partial: '!!' } });
+              continue;
+            }
             if (e.kind !== 'call' || typeof e.callee !== 'string') continue;
             const c = e.callee;
             const line = e.line || node.line;
@@ -301,7 +311,18 @@ export function analyzeHaskellRules(files, opts = {}) {
             // a file append is a log only when its path says so (a log, audit or trace file)
             if (sink.channel === 'file') { const p = (e.args || [])[0]; if (!(p && p.kind === 'literal' && /(?:log|audit|trace|journal)/i.test(String(p.value)))) continue; }
             let hit = null;
+            // a labelled value: a literal that names a credential ("token=", "password: ") followed by a non-literal operand
+            if (!hit) {
+              for (const x of walk(arg)) {
+                if (x.kind === 'binary' && x.hs && x.hs.concat && x.left && x.left.kind === 'literal' && typeof x.left.value === 'string' && /^\s*[\w .-]*(?:pass(?:word|wd|phrase)?|pwd|secret|token|api_?key|authorization|bearer|private_?key|session_?id)[\w .-]*\s*[=:]\s*$/i.test(x.left.value) && x.right && x.right.kind !== 'literal') {
+                  const lab = x.left.value.replace(/[=:\s]+$/, '').trim();
+                  hit = { name: lab, low: LOW_ENTROPY.test(lab), hashed: false, var: lab };
+                  break;
+                }
+              }
+            }
             for (const n of names(arg)) {
+              if (hit) break;
               const bare = n.replace(/^\./, '');
               if (sensitive.has(n)) hit = { ...sensitive.get(n), var: n };
               else if (SENSITIVE.test(bare) && !/^[A-Z][A-Za-z0-9_.]*\./.test(n)) hit = { name: bare, low: LOW_ENTROPY.test(bare), hashed: false, var: n };

package/src/language/haskell-web.js

@@ -201,6 +201,9 @@ function handlerFacts(ctx, fn) {
       if (e.kind === 'union' && e.hs && e.hs.branchConds) for (const bc of e.hs.branchConds) conds.push(bc.cond);
     }
   }
+  // Program order is SOURCE order. A wrapper guard (`guarded $ do ...`) encloses the statements it protects, but the lowering emits
+  // those statements as earlier control-flow nodes than the call that contains them, so node order would make the guard look late.
+  ordered.sort((a, b) => (Number.isFinite(a.line) && Number.isFinite(b.line) ? a.line - b.line : 0));
   const isGuardCall = (c) => {
     if (GUARD_PRIMITIVES.has(c.callee)) return true;
     if (c.hs && c.hs.status === 'resolved' && c.hs.target) return guardSummary(ctx, ctx.fnByQid.get(c.hs.target)).auth;

package/src/language/nix-secrets.js

@@ -67,6 +67,8 @@ export function plausibleSecret(v) {
   if (/^\/(?:run|var|etc|nix|home|usr|opt|tmp)\//.test(t) || /^\.{0,2}\//.test(t)) return false;
   if (/^(?:https?|file|unix):\/\/[^:@\s]*$/.test(t)) return false;
   if (/^\$\{|^\$[A-Za-z_]/.test(t)) return false;
+  // wpa_supplicant's `ext:NAME` is a REFERENCE to a variable supplied at runtime (networking.wireless.environmentFile), not a value
+  if (/^ext:[A-Za-z0-9_.-]+$/.test(t)) return false;
   return true;
 }
 

package/src/language/nixos-hardening.js

@@ -140,6 +140,31 @@ const hasPathNode = (n, depth = 0) => {
   for (const k of Object.keys(n)) { const v = n[k]; if (Array.isArray(v)) { if (v.some((x) => hasPathNode(x, depth + 1))) return true; } else if (v && typeof v === 'object' && hasPathNode(v, depth + 1)) return true; }
   return false;
 };
+// An expression that CREATES a store file from its arguments (`pkgs.writeText "k" "…"`): used as a key/cert option it puts the secret in the store
+// exactly as a path literal does.
+const STORE_WRITERS = new Set(['writeText', 'writeTextFile', 'writeTextDir', 'writeScript', 'writeScriptBin', 'toFile', 'copyPathToStore', 'runCommand', 'runCommandLocal']);
+const isStoreCopy = (n, depth = 0) => {
+  if (!n || typeof n !== 'object' || depth > 12) return false;
+  if (n.type === 'app') { let h = n; while (h && h.type === 'app') h = h.fn; return !!h && ((h.type === 'select' && h.attrpath && h.attrpath.length && STORE_WRITERS.has(h.attrpath[h.attrpath.length - 1].name)) || (h.type === 'ident' && STORE_WRITERS.has(h.name))); }
+  return false;
+};
+const strOf = (n) => (n && n.type === 'string' && typeof n.literal === 'string' ? n.literal : null);
+// sudo `extraRules`: a rule is NOPASSWD for ALL when one of its `commands` is ALL (or a {command = "ALL"; options = [ "NOPASSWD" ]}) with the NOPASSWD tag.
+const sudoRulesNopasswdAll = (node) => {
+  if (!node || node.type !== 'list') return false;
+  for (const rule of node.items || []) {
+    const cmds = attrOf(rule, 'commands');
+    if (!cmds || !cmds.value || cmds.value.type !== 'list') continue;
+    for (const c of cmds.value.items || []) {
+      if (c.type !== 'attrset') continue;
+      const command = attrOf(c, 'command'); const options = attrOf(c, 'options');
+      const all = command && strOf(command.value) === 'ALL';
+      const nopass = options && options.value && options.value.type === 'list' && (options.value.items || []).some((x) => strOf(x) === 'NOPASSWD');
+      if (all && nopass) return true;
+    }
+  }
+  return false;
+};
 const attrOf = (set, name) => (set && set.type === 'attrset' ? (set.bindings || []).find((b) => b.kind === 'attr' && b.path && b.path.length === 1 && b.path[0].name === name) : null);
 const isTrueNode = (n) => !!n && n.type === 'ident' && n.name === 'true';
 
@@ -291,6 +316,12 @@ export function analyzeNixosHardening(opts, extra = {}) {
       }
     }
 
+    const sudoRules = nixos('security.sudo.extraRules');
+    if (sudoRules && sudoState !== 'inactive' && sudoState !== 'unknown' && sudoRulesNopasswdAll(rhsNodeOf(sudoRules, opts.files))) {
+      addFinding('sudo-nopasswd-all', { anchor: anchorOf(sudoRules), scope: 'security.sudo.extraRules', state: sudoState === 'conditional' ? 'conditional' : 'active', uncertain: false, evidence: [evidenceOf(sudoRules)] });
+      entryPoints.push({ id: 'sudo-nopasswd-all', kind: 'sudo-nopasswd', state: sudoState === 'conditional' ? 'conditional' : 'active', privilege: 'root', evidence: [evidenceOf(sudoRules)] });
+    }
+
     const doasEnable = nixos('security.doas.enable');
     const doasState = stateOf(doasEnable);
     const doasCfg = note(nixos('security.doas.extraConfig'), 'doas');
@@ -356,7 +387,7 @@ export function analyzeNixosHardening(opts, extra = {}) {
       const st = nginxState === 'conditional' ? 'conditional' : 'active';
       for (const o of cfg.options.filter((x) => x.namespace === 'nixos' && /^services\.nginx\.virtualHosts\..+\.(?:sslCertificateKey|sslTrustedCertificate)$/.test(x.path))) {
         const node = rhsNodeOf(o, opts.files);
-        if (node && hasPathNode(node)) addFinding('tls-key-in-store', { anchor: anchorOf(o), scope: o.path, state: st, uncertain: false, evidence: [evidenceOf(o)] });
+        if (node && (hasPathNode(node) || isStoreCopy(node))) addFinding('tls-key-in-store', { anchor: anchorOf(o), scope: o.path, state: st, uncertain: false, evidence: [evidenceOf(o)] });
         else if (view(o).state === 'known' && typeof view(o).value === 'string') controls.push({ control: 'tls-key-runtime-path', option: o.path, applies: true });
       }
       for (const o of cfg.options.filter((x) => x.namespace === 'nixos' && /^services\.nginx\.virtualHosts\..+\.forceSSL$/.test(x.path))) {

package/src/language/support-registry.js

@@ -72,6 +72,10 @@ export function clopperPearson(k, n, alpha = 0.05) {
   const upper = k === n ? 1 : bisect((p) => binomTail(p, k + 1) >= 1 - alpha / 2, 0, 1);
   return [lower, upper];
 }
+// Every unseen shape is instantiated with TWO near-identical nouns, so those two cases are one observation, not two. The interval over
+// cases would be too narrow; this one is over shapes (counts halved, rounded), and is labelled so.
+const SHAPE_CLUSTER = 2;
+const ciShapes = (k, n) => { const r = clopperPearson(Math.round(k / SHAPE_CLUSTER), Math.max(1, Math.round(n / SHAPE_CLUSTER))); return r ? [Number(r[0].toFixed(4)), Number(r[1].toFixed(4))] : null; };
 const ci = (k, n) => { const r = clopperPearson(k, n); return r ? [Number(r[0].toFixed(4)), Number(r[1].toFixed(4))] : null; };
 const withInterval = (e) => (e && Number.isFinite(e.tp) ? { ...e, ci: { precision: ci(e.tp, e.tp + (e.fp || 0)), recall: ci(e.tp, e.tp + (e.fn || 0)), level: 0.95, method: 'Clopper-Pearson' } } : e);
 const pct = (x) => (x == null ? 'not measured' : `${(x * 100).toFixed(1)}%`);
@@ -230,7 +234,7 @@ export function evaluateSupport(language, input) {
     if (!(u.precision >= TARGETS.precision)) shortfalls.push(`precision ${pct(u.precision)} < ${pct(TARGETS.precision)}`);
     if (!(u.recall >= TARGETS.recall)) shortfalls.push(`recall ${pct(u.recall)} < ${pct(TARGETS.recall)}`);
     if (!(u.f1 >= TARGETS.f1)) shortfalls.push(`F1 ${pct(u.f1)} < ${pct(TARGETS.f1)}`);
-    r.generalization = { status: shortfalls.length ? 'below-target' : 'meets-targets', shortfalls, cases: u.cases, tp: u.tp, fp: u.fp, fn: u.fn, tn: u.tn, precision: u.precision, recall: u.recall, f1: u.f1, strictPrecision: u.strict && u.strict.precision, ci: { precision: ci(u.tp, u.tp + u.fp), recall: ci(u.tp, u.tp + u.fn), level: 0.95, method: 'Clopper-Pearson' } };
+    r.generalization = { status: shortfalls.length ? 'below-target' : 'meets-targets', shortfalls, cases: u.cases, tp: u.tp, fp: u.fp, fn: u.fn, tn: u.tn, precision: u.precision, recall: u.recall, f1: u.f1, strictPrecision: u.strict && u.strict.precision, ci: { precision: ciShapes(u.tp, u.tp + u.fp), recall: ciShapes(u.tp, u.tp + u.fn), level: 0.95, method: `Clopper-Pearson over shapes (${SHAPE_CLUSTER} near-identical cases per shape)` } };
     if (shortfalls.length) out.generalizationGaps.push(`${r.capability}: ${shortfalls.join(', ')}`);
   }
   // a capability whose tool is absent is blocked, not passed and not skipped

package/src/language/witness.js

@@ -146,8 +146,10 @@ export function judgeFixWitness(before, after) {
 export function haskellRunner() {
   const p = which('runghc') || which('runhaskell');
   if (!p) return { available: false, reason: 'no Haskell toolchain (runghc) on PATH; witnesses for Haskell findings are unavailable here' };
-  const v = spawnSync(p, ['--version'], { encoding: 'utf8', timeout: 10_000 });
-  return v.status === 0 ? { available: true, path: p, version: String(v.stdout || v.stderr).trim() } : { available: false, reason: 'the Haskell runner did not start' };
+  // GHC's first start on a cold, loaded machine (a CI runner) has taken more than 10 s; a probe that gives up there reports a toolchain
+  // that is installed as absent, and the answer then differs between two calls in one run.
+  const v = spawnSync(p, ['--version'], { encoding: 'utf8', timeout: 60_000 });
+  return v.status === 0 ? { available: true, path: p, version: String(v.stdout || v.stderr).trim() } : { available: false, reason: v.error && v.error.code === 'ETIMEDOUT' ? 'the Haskell runner did not start within 60 s' : 'the Haskell runner did not start' };
 }
 
 /**