@clear-capabilities/agentic-security-scanner 0.185.0 → 0.186.2

package/dist/{5817.index.js → 1602.index.js}

@@ -1,8 +1,8 @@
-export const id = 5817;
-export const ids = [5817,2199];
+export const id = 1602;
+export const ids = [1602,2199];
 export const modules = {
 
-/***/ 95817:
+/***/ 31602:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 // ESM COMPAT FLAG
@@ -35,6 +35,348 @@ var proof_fabric_reproducer = __webpack_require__(37055);
 var external_node_module_ = __webpack_require__(98995);
 // EXTERNAL MODULE: ./node_modules/@babel/parser/lib/index.js
 var lib = __webpack_require__(46411);
+// EXTERNAL MODULE: external "node:child_process"
+var external_node_child_process_ = __webpack_require__(31421);
+;// CONCATENATED MODULE: ./src/posture/proof-fabric/generate-python.js
+// Reproducer generation for Python (PRD 1), the second language of `generate.js`. Same contract: a DETERMINISTIC proposal built
+// from the flagged file alone, then run through the ordinary runner, oracle, 3-of-3 repetition and independent replay. A generated
+// reproducer is a proposal that execution either confirms or does not.
+//
+// Python is parsed by Python itself (`python3 -I -c`, the standard `ast` module, source on stdin, JSON on stdout) with a timeout, so
+// the shape rules follow the real grammar. Two shapes, as in JavaScript:
+//   script    the file reads `sys.argv[1]`: it is run with the payload as its argument (whether the flagged line is reached is then
+//             decided by execution, not assumed);
+//   function  a module-level `def` around the flagged line: a generated harness imports the file (never as `__main__`, so its main
+//             guard does not run) and calls the function with the payload in every parameter.
+// Only the standard library and sibling `.py` files in the flagged file's directory can be satisfied; any other import is refused,
+// with the package named. Anything outside returns `{ ok: false }` with the reason, and nothing is executed.
+
+
+
+
+
+const MAX_SOURCE = 256 * 1024;
+const MAX_FILES = 8;
+const fail = (reason, extra = {}) => ({ ok: false, reason, ...extra });
+
+const ANALYZER = `
+import ast, json, sys
+src = sys.stdin.read()
+try:
+    tree = ast.parse(src)
+except SyntaxError as e:
+    print(json.dumps({"error": "syntax"})); sys.exit(0)
+line = int(sys.argv[1])
+imports = []
+for n in ast.walk(tree):
+    if isinstance(n, ast.Import):
+        for a in n.names: imports.append({"module": a.name, "level": 0})
+    elif isinstance(n, ast.ImportFrom):
+        imports.append({"module": n.module or "", "level": n.level or 0, "names": [a.name for a in n.names]})
+fns = []
+for n in ast.walk(tree):
+    if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef)) and n.lineno <= line <= (n.end_lineno or n.lineno):
+        args = [a.arg for a in n.args.posonlyargs + n.args.args + n.args.kwonlyargs]
+        fns.append({"name": n.name, "start": n.lineno, "end": n.end_lineno, "args": args, "async": isinstance(n, ast.AsyncFunctionDef), "decorated": bool(n.decorator_list), "toplevel": n in tree.body, "defaults": len(n.args.defaults)})
+fns.sort(key=lambda f: f["end"] - f["start"])
+main_guard = any(isinstance(n, ast.If) and "__name__" in ast.dump(n.test) for n in tree.body)
+print(json.dumps({"imports": imports, "functions": fns, "mainGuard": main_guard, "stdlib": sorted(sys.stdlib_module_names) if hasattr(sys, "stdlib_module_names") else None}))
+`;
+
+function analyze(text, line) {
+  const r = (0,external_node_child_process_.spawnSync)('python3', ['-I', '-c', ANALYZER, String(line)], { input: text, encoding: 'utf8', timeout: 10_000, maxBuffer: 4 * 1024 * 1024 });
+  if (r.error || r.status !== 0) return null;
+  try { return JSON.parse(r.stdout); } catch { return null; }
+}
+
+function readInside(root, rel) {
+  let real; try { real = external_node_fs_.realpathSync(external_node_path_.resolve(root, rel)); } catch { return null; }
+  const base = external_node_fs_.realpathSync(root);
+  if (!(real === base || real.startsWith(base + external_node_path_.sep))) return null;
+  const st = external_node_fs_.statSync(real);
+  return st.isFile() && st.size <= MAX_SOURCE ? { real, text: external_node_fs_.readFileSync(real, 'utf8') } : null;
+}
+
+const HARNESS = (entry, name, args) => `# Generated by the proof fabric from the finding's own evidence. It imports the flagged module (never as __main__) and calls the function.
+import importlib.util, sys, asyncio, inspect
+payload = sys.argv[1] if len(sys.argv) > 1 else ""
+spec = importlib.util.spec_from_file_location("target", ${JSON.stringify(entry)})
+mod = importlib.util.module_from_spec(spec)
+sys.modules["target"] = mod
+spec.loader.exec_module(mod)
+fn = getattr(mod, ${JSON.stringify(name)}, None)
+if not callable(fn):
+    print("the function is not defined at module level", file=sys.stderr); sys.exit(3)
+try:
+    res = fn(${args.join(', ')})
+    if inspect.isawaitable(res): asyncio.run(asyncio.wait_for(res, 5))
+except Exception as e:
+    print("target raised:", str(e)[:200], file=sys.stderr)
+`;
+
+/** @param {{finding: object, root: string, cls: {name: string, payload: string, oracle: object, network?: string, watch?: object, needsPy?: RegExp}}} o */
+function generatePythonReproducer({ finding, root, cls }) {
+  const rel = String(finding.file);
+  const src = readInside(root, rel);
+  if (!src) return fail('the flagged file is missing, outside the repository, or too large');
+  const info = analyze(src.text, finding.line);
+  if (!info || info.error) return fail('the flagged file could not be parsed by Python (is python3 installed and is the file valid Python 3?)');
+  const lines = src.text.split('\n');
+  const sinkLine = lines[finding.line - 1] ?? '';
+  const around = lines.slice(Math.max(0, finding.line - 3), finding.line + 2).join('\n');
+  if (cls.needsPy && !cls.needsPy.test(sinkLine) && !cls.needsPy.test(around)) return fail(`${cls.name}: the flagged code is not a write, and this class is only proven for write sinks`);
+
+  const stdlib = new Set(info.stdlib ?? []);
+  if (!info.stdlib) return fail('this Python is too old to list its standard library (3.10 or newer is needed), so imports cannot be classified');
+  const dir = external_node_path_.dirname(src.real); const rootReal = external_node_fs_.realpathSync(root);
+  const sources = {}; const external = [];
+  for (const imp of info.imports) {
+    const top = imp.module.split('.')[0];
+    if (imp.level === 0 && stdlib.has(top)) continue;
+    const sibling = imp.level <= 1 ? external_node_path_.join(dir, `${top || (imp.names?.[0] ?? '')}.py`) : null;
+    if (sibling && external_node_fs_.existsSync(sibling)) {
+      const dep = readInside(root, external_node_path_.relative(rootReal, external_node_fs_.realpathSync(sibling)));
+      if (!dep) return fail(`"${top}" is too large or outside the repository`);
+      const destRel = external_node_path_.relative(dir, dep.real);
+      if (!sources[destRel]) { if (Object.keys(sources).length >= MAX_FILES) return fail(`the file pulls in more than ${MAX_FILES} repository files`); sources[destRel] = external_node_path_.relative(rootReal, dep.real); }
+      continue;
+    }
+    external.push(top || '.'.repeat(imp.level));
+  }
+  if (external.length) return fail(`the flagged code needs ${[...new Set(external)].slice(0, 4).join(', ')}, which is not available in the proof environment; only the standard library and sibling files in the same directory can be satisfied`);
+
+  const entry = 'target.py';
+  sources[entry] = rel;
+  const assumptions = [];
+  const base = { schema: 'agentic-security/reproducer', version: 1, findingId: String(finding.stableId ?? finding.id ?? 'generated'), lang: 'python', oracle: cls.oracle, network: cls.network ?? 'none', ...(cls.watch ? { watch: cls.watch } : {}) };
+  if (cls.watch) assumptions.push('the write target is assumed to be one directory below the working directory (the payload is ../escaped.txt); if the code uses another base, the proof will not confirm it');
+
+  if (/sys\.argv\s*\[\s*1\s*\]/.test(src.text)) {
+    const reproducer = { ...base, sources, run: ['{{PYTHON}}', entry, cls.payload] };
+    const errs = (0,proof_fabric_reproducer/* validateReproducer */.mC)(reproducer);
+    return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'script', class: cls.name, entry: rel, line: finding.line, assumptions } };
+  }
+  const fn = info.functions.find((f) => f.toplevel);
+  if (!fn) return fail('the flagged line is not inside a module-level function, and the file does not read sys.argv[1]');
+  if (fn.decorated) return fail(`${fn.name} is decorated (a web framework route, a cache, a wrapper): calling it directly would not match how it is reached, and the framework is not available`);
+  if (!fn.args.length) return fail('the function around the flagged line takes no parameters, so the payload has no way in');
+  if (fn.async) assumptions.push('the function is a coroutine; the harness awaits it for at most 5 seconds');
+  assumptions.push('the payload is passed in every parameter (a Python parameter has no request-like stand-in), which is an approximation of how the function is really called');
+  const harness = HARNESS(entry, fn.name, fn.args.map(() => 'payload'));
+  const reproducer = { ...base, sources, files: { 'harness.py': harness }, run: ['{{PYTHON}}', 'harness.py', cls.payload] };
+  const errs = (0,proof_fabric_reproducer/* validateReproducer */.mC)(reproducer);
+  return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'function', class: cls.name, entry: rel, line: finding.line, function: `${fn.name}(${fn.args.join(', ')})`, assumptions } };
+}
+
+// EXTERNAL MODULE: ./src/language/haskell-parser.js + 1 modules
+var haskell_parser = __webpack_require__(99864);
+;// CONCATENATED MODULE: ./src/posture/proof-fabric/generate-haskell.js
+// Reproducer generation for Haskell (PRD 1), the third language of `generate.js`. Same contract as JavaScript and Python: a
+// DETERMINISTIC proposal built from the flagged file alone, then run through the ordinary runner, oracle, 3-of-3 repetition and
+// independent replay. A generated reproducer is a proposal that execution either confirms or does not.
+//
+// The program is run by GHC's interpreter (`ghc -e`), not compiled. Why: it needs no C compiler and no linker (so no dependence on
+// the platform's developer tools), it leaves no object files or binaries to account for, it starts in about half a second where a
+// compile-then-run takes a second or more, and there is one process tree to confine instead of a build stage followed by a run
+// stage. Interpreted bytecode calls the same installed libraries a compiled program would, so a shell string reaches the same
+// `System.Process` either way. The tradeoff is stated, not hidden: a program whose behaviour depends on compiled code (FFI, an
+// optimisation-sensitive race) is refused, and `-O` is never in play. A hand-written reproducer may still use `build`/`run` with
+// `{{GHC}}` to compile; both paths run under the same sandbox, timeout and output cap.
+//
+// Two shapes, as in the other languages:
+//   script    the file reads `getArgs`: it is run as `:main "<payload>"`, so the payload arrives as the first argument;
+//   function  a top-level function around the flagged line that has a type signature of `String`/`FilePath` parameters and an `IO`
+//             result: `ghc -e 'fn "<payload>" ...'` loads the module with every top-level name in scope (the module need not export
+//             it) and calls it with the payload in every parameter.
+//
+// Only what the proof environment can load is accepted: the file's imports must be modules of the packages that ship with GHC (the
+// global package database, read from the installed GHC) or other `.hs` files in the repository. A web framework, a database binding
+// or any Hackage package is refused with the package named where it is known. Template Haskell, quasi-quotes, CPP, the foreign
+// function interface and compiler-plugin options are refused too: they run code at load time, before the payload is involved.
+//
+// Classes: command injection (CWE-78) and path traversal by a write (CWE-22). SSRF (CWE-918) is refused for Haskell on purpose: no
+// HTTP client ships with GHC, so a request-making program necessarily imports a package the stdlib-only rule already refuses, and
+// nothing could be proven honestly. Nothing is executed on a refusal.
+
+
+
+
+
+
+
+const generate_haskell_MAX_SOURCE = 256 * 1024;
+const generate_haskell_MAX_FILES = 8;
+const generate_haskell_fail = (reason, extra = {}) => ({ ok: false, reason, ...extra });
+
+// Well-known packages that are NOT part of a GHC install, by module prefix, so a refusal can name the package to install.
+const THIRD_PARTY = [
+  ['Web.Scotty', 'scotty'], ['Network.Wai', 'wai'], ['Network.HTTP.Types', 'http-types'], ['Network.HTTP.Client', 'http-client'],
+  ['Network.HTTP.Simple', 'http-conduit'], ['Network.HTTP.Conduit', 'http-conduit'], ['Network.Wreq', 'wreq'], ['Network.Socket', 'network'],
+  ['Servant', 'servant'], ['Yesod', 'yesod'], ['Snap', 'snap'], ['Happstack', 'happstack-server'], ['Data.Aeson', 'aeson'],
+  ['Database.SQLite.Simple', 'sqlite-simple'], ['Database.PostgreSQL.Simple', 'postgresql-simple'], ['Database.Persist', 'persistent'],
+  ['Database.MySQL', 'mysql-simple'], ['System.Random', 'random'], ['Data.Vector', 'vector'], ['Data.Hashable', 'hashable'],
+  ['Data.HashMap', 'unordered-containers'], ['Control.Lens', 'lens'], ['Test.', 'a test framework'], ['Turtle', 'turtle'],
+  ['Shelly', 'shelly'], ['System.Process.Typed', 'typed-process'], ['Conduit', 'conduit'], ['Control.Monad.Logger', 'monad-logger'],
+  ['Options.Applicative', 'optparse-applicative'], ['Data.Text.Lazy.Builder', null],
+];
+
+const libCache = new Map();
+/** The modules the installed GHC exposes from its global package database (what a program can import with no extra packages). */
+function bootModuleSet(ghc) {
+  if (libCache.has(ghc)) return libCache.get(ghc);
+  let set = null;
+  try {
+    const r = (0,external_node_child_process_.spawnSync)(ghc, ['--print-libdir'], { encoding: 'utf8', timeout: 10_000 });
+    const dir = r.status === 0 ? external_node_path_.join(r.stdout.trim(), 'package.conf.d') : null;
+    if (dir && external_node_fs_.existsSync(dir)) {
+      set = new Set();
+      for (const f of external_node_fs_.readdirSync(dir)) {
+        if (!f.endsWith('.conf')) continue;
+        const text = external_node_fs_.readFileSync(external_node_path_.join(dir, f), 'utf8');
+        if (/^exposed:\s*False/m.test(text)) continue;
+        const m = /^exposed-modules:\s*\n?([\s\S]*?)(?=^\S)/m.exec(text);
+        if (!m) continue;
+        for (const tok of m[1].split(/[\s,]+/)) if (/^[A-Z][\w']*(?:\.[A-Z][\w']*)*$/.test(tok)) set.add(tok);
+      }
+      if (!set.has('Prelude')) set = null; // a database that does not even list Prelude was not read correctly
+    }
+  } catch { set = null; }
+  libCache.set(ghc, set);
+  return set;
+}
+
+function generate_haskell_readInside(root, rel) {
+  let real; try { real = external_node_fs_.realpathSync(external_node_path_.resolve(root, rel)); } catch { return null; }
+  const base = external_node_fs_.realpathSync(root);
+  if (!(real === base || real.startsWith(base + external_node_path_.sep))) return null;
+  const st = external_node_fs_.statSync(real);
+  return st.isFile() && st.size <= generate_haskell_MAX_SOURCE ? { real, text: external_node_fs_.readFileSync(real, 'utf8') } : null;
+}
+
+/** Split a type on its top-level arrows (arrows inside parentheses or brackets belong to a function-typed argument). */
+function splitArrows(type) {
+  const parts = []; let depth = 0; let cur = '';
+  for (let i = 0; i < type.length; i++) {
+    const c = type[i];
+    if ('([{'.includes(c)) depth++; else if (')]}'.includes(c)) depth--;
+    if (depth === 0 && c === '-' && type[i + 1] === '>') { parts.push(cur.trim()); cur = ''; i++; continue; }
+    cur += c;
+  }
+  parts.push(cur.trim());
+  return parts;
+}
+
+// Compile-time code execution and options that change what runs before the payload is involved.
+function loadTimeHazard(text) {
+  if (/\{-#\s*LANGUAGE[^#]*\b(?:TemplateHaskell|TemplateHaskellQuotes|QuasiQuotes|CPP|ForeignFunctionInterface|CApiFFI)\b/i.test(text)) return 'it enables Template Haskell, quasi-quotes, CPP or the foreign function interface, which run or require code at load time';
+  if (/\{-#\s*OPTIONS(?:_GHC)?\b[^#]*(?:-fplugin|-pgm|-opt[a-zA-Z]|-F\b|-cpp|-fobject-code)/i.test(text)) return 'its OPTIONS_GHC pragma names a plugin, a preprocessor or an external program';
+  if (/^\s*foreign\s+(?:import|export)\b/m.test(text)) return 'it uses the foreign function interface';
+  return null;
+}
+
+function classify(mod, pkg, boot) {
+  if (pkg) return { ok: false, name: String(pkg).replace(/^"|"$/g, '') };
+  if (boot.has(mod)) return { ok: true };
+  for (const [prefix, name] of THIRD_PARTY) if (mod === prefix || mod.startsWith(prefix.endsWith('.') ? prefix : `${prefix}.`)) return { ok: false, name: name ?? mod };
+  return { ok: false, name: mod };
+}
+
+/** @param {{finding: object, root: string, cls: {name: string, payload: string, oracle: object, network?: string, watch?: object, needsHs?: RegExp}, bootModules?: Set<string>}} o */
+function generateHaskellReproducer({ finding, root, cls, bootModules }) {
+  const rel = String(finding.file);
+  if (cls.name === 'ssrf') return generate_haskell_fail('ssrf: no HTTP client ships with GHC, so any program that makes a request imports a package outside the proof environment; this class is not proven for Haskell');
+  const src = generate_haskell_readInside(root, rel);
+  if (!src) return generate_haskell_fail('the flagged file is missing, outside the repository, or too large');
+  const hazard = loadTimeHazard(src.text);
+  if (hazard) return generate_haskell_fail(`the flagged file is refused: ${hazard}`);
+  const info = (0,haskell_parser/* parseHaskell */.cX)(src.text);
+  if (!info || info.status !== 'parsed') return generate_haskell_fail('the flagged file could not be parsed as Haskell');
+  const lines = src.text.split('\n');
+  const sinkLine = lines[finding.line - 1] ?? '';
+  const around = lines.slice(Math.max(0, finding.line - 3), finding.line + 2).join('\n');
+  if (cls.needsHs && !cls.needsHs.test(sinkLine) && !cls.needsHs.test(around)) return generate_haskell_fail(`${cls.name}: the flagged code is not a write, and this class is only proven for write sinks`);
+
+  const tools = (0,runner/* hostTools */.qV)();
+  const boot = bootModules ?? (tools.ghc ? bootModuleSet(tools.ghc) : null);
+  if (!boot) return generate_haskell_fail('no working GHC was found to list the modules the proof environment can import (install ghc, or run `agentic-security proof doctor`)');
+
+  // the entry module is placed at its module path so that other modules can import it; Main goes to Main.hs
+  const modName = info.module?.name ?? 'Main';
+  const entry = `${modName.replaceAll('.', '/')}.hs`;
+  const rootReal = external_node_fs_.realpathSync(root);
+  const entryDir = external_node_path_.dirname(src.real);
+  const modRel = modName.replaceAll('.', external_node_path_.sep);
+  const srcRoot = src.real.endsWith(`${modRel}.hs`) ? src.real.slice(0, src.real.length - modRel.length - 3) : `${entryDir}${external_node_path_.sep}`;
+  const searchRoots = [...new Set([srcRoot.replace(/[\\/]$/, ''), ...['src', 'app', 'lib', ''].map((d) => external_node_path_.join(rootReal, d))])];
+  const sources = {}; const external = []; const seen = new Set([modName]);
+  let count = 0;
+  const visit = (imports) => {
+    for (const imp of imports) {
+      const mod = imp.module;
+      if (seen.has(mod)) continue;
+      seen.add(mod);
+      let local = null;
+      for (const base of searchRoots) { const cand = external_node_path_.join(base, `${mod.replaceAll('.', '/')}.hs`); const r = generate_haskell_readInside(root, external_node_path_.relative(rootReal, cand)); if (r) { local = r; break; } }
+      if (local && !imp.package) {
+        if (++count > generate_haskell_MAX_FILES) return generate_haskell_fail(`the file pulls in more than ${generate_haskell_MAX_FILES} repository modules`);
+        const dep = (0,haskell_parser/* parseHaskell */.cX)(local.text);
+        if (!dep || dep.status !== 'parsed') return generate_haskell_fail(`the module ${mod} could not be parsed as Haskell`);
+        const h = loadTimeHazard(local.text); if (h) return generate_haskell_fail(`the module ${mod} is refused: ${h}`);
+        sources[`${mod.replaceAll('.', '/')}.hs`] = external_node_path_.relative(rootReal, local.real);
+        const r = visit(dep.imports ?? []); if (r) return r;
+        continue;
+      }
+      const c = classify(mod, imp.package, boot);
+      if (!c.ok) external.push(c.name);
+    }
+    return null;
+  };
+  const bad = visit(info.imports ?? []);
+  if (bad) return bad;
+  if (external.length) return generate_haskell_fail(`the flagged code needs ${[...new Set(external)].slice(0, 4).join(', ')}, which is not available in the proof environment; only the packages that ship with GHC and files in the repository can be loaded`, { missing: [...new Set(external)] });
+  sources[entry] = rel;
+
+  const assumptions = [];
+  const base = { schema: 'agentic-security/reproducer', version: 1, findingId: String(finding.stableId ?? finding.id ?? 'generated'), lang: 'haskell', oracle: cls.oracle, network: cls.network ?? 'none', ...(cls.watch ? { watch: cls.watch } : {}) };
+  if (cls.watch) assumptions.push('the write target is assumed to be one directory below the working directory (the payload is ../escaped.txt); if the code uses another base, the proof will not confirm it');
+  const ghcRun = (expr) => ['{{GHC}}', '-ignore-dot-ghci', '-e', expr, entry];
+  const literal = (s) => JSON.stringify(s); // payloads are fixed strings with no quote or backslash; this is a plain Haskell string literal
+
+  // shape 1: a program that reads its payload from the command line
+  const hasMain = (info.functions ?? []).some((f) => f.scope === 'top' && f.name === 'main');
+  if (/\bgetArgs\b/.test(src.text) && hasMain) {
+    assumptions.push('the payload is passed as the first and only command-line argument; a program that expects other arguments will not reach the flagged line');
+    const reproducer = { ...base, sources, run: ghcRun(`:main ${literal(cls.payload)}`) };
+    const errs = (0,proof_fabric_reproducer/* validateReproducer */.mC)(reproducer);
+    return errs.length ? generate_haskell_fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'script', class: cls.name, entry: rel, line: finding.line, assumptions } };
+  }
+
+  // shape 2: a top-level function around the flagged line
+  const fn = (info.functions ?? []).filter((f) => f.scope === 'top' && f.name !== 'main' && /^[a-z_][\w']*$/.test(f.name)).find((f) => {
+    const end = Math.max(f.span.endLine, ...(f.clauses ?? []).map((c) => c.span?.endLine ?? 0));
+    return f.span.startLine <= finding.line && end >= finding.line;
+  });
+  if (!fn) return generate_haskell_fail('the flagged line is not inside a top-level function, and the file does not read getArgs in a main');
+  const sig = (info.signatures ?? []).find((s) => s.scope === 'top' && s.names.includes(fn.name));
+  if (!sig) return generate_haskell_fail(`${fn.name} has no type signature, so the proof cannot tell what to pass it`);
+  const sigText = lines.slice(sig.span.startLine - 1, sig.span.endLine).join(' ');
+  const m = new RegExp(`${fn.name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}[^:]*::\\s*([\\s\\S]*)$`).exec(sigText);
+  if (!m) return generate_haskell_fail(`the type signature of ${fn.name} could not be read`);
+  const type = m[1].replace(/--.*$/, '').trim();
+  if (type.includes('=>') || /\bforall\b/.test(type)) return generate_haskell_fail(`${fn.name} is polymorphic or constrained (${type.slice(0, 60)}), so the proof cannot choose its arguments`);
+  const parts = splitArrows(type);
+  const result = parts[parts.length - 1]; const params = parts.slice(0, -1);
+  if (!/^IO\b/.test(result)) return generate_haskell_fail(`${fn.name} returns ${result.slice(0, 40)}, not IO, so calling it would not perform the flagged operation`);
+  if (!params.length) return generate_haskell_fail(`${fn.name} takes no parameters, so the payload has no way in`);
+  const bad2 = params.find((p) => !/^(?:String|FilePath|\[Char\])$/.test(p));
+  if (bad2) return generate_haskell_fail(`${fn.name} takes a parameter of type ${bad2.slice(0, 40)}; only String and FilePath can be filled with a payload`);
+  assumptions.push('the payload is passed in every parameter (a String has no request-like stand-in), which is an approximation of how the function is really called');
+  const call = `${fn.name} ${params.map(() => literal(cls.payload)).join(' ')} >>= \\_ -> return ()`;
+  const reproducer = { ...base, sources, run: ghcRun(call) };
+  const errs = (0,proof_fabric_reproducer/* validateReproducer */.mC)(reproducer);
+  return errs.length ? generate_haskell_fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'function', class: cls.name, entry: rel, line: finding.line, function: `${fn.name}(${params.length} String)`, assumptions } };
+}
+
 ;// CONCATENATED MODULE: ./src/posture/proof-fabric/generate.js
 // Reproducer generation from a finding's own evidence (PRD 1: `triage exploit --prove` with no hand-written reproducer).
 //
@@ -44,7 +386,7 @@ var lib = __webpack_require__(46411);
 // independent replay as any other. A generated reproducer is not a verdict; it is a proposal that is either confirmed by execution
 // or not.
 //
-// What this is not: a general exploit generator. It handles JavaScript only, and only code the proof environment can actually load:
+// What this is not: a general exploit generator. It handles JavaScript (here), Python (`generate-python.js`) and Haskell (`generate-haskell.js`), and only code the proof environment can actually load:
 // the file's imports must be Node built-ins or relative files inside the repository (a package from node_modules is not there in
 // the sandbox, so a handler that needs `express` is refused, with the package named). Anything outside that returns `{ ok: false }`
 // with the reason, and nothing is executed.
@@ -65,18 +407,20 @@ var lib = __webpack_require__(46411);
 
 
 
+
+
 const CLASSES = {
   'CWE-78': { name: 'command-injection', payload: 'x; touch {{CANARY:command}}', oracle: { type: 'command_execution', params: { canary: 'command' } } },
-  'CWE-22': { name: 'path-traversal', payload: '../escaped.txt', oracle: { type: 'filesystem_mutation', params: { canary: 'fs' } }, watch: { fs: 'escaped.txt' }, needs: /\b(?:writeFile|writeFileSync|appendFile|appendFileSync|createWriteStream)\b/ },
+  'CWE-22': { needsPy: /\bopen\s*\([^)]*['"][wax]b?\+?['"]|\.write_(?:text|bytes)\s*\(|\bshutil\.(?:copy|move)/, name: 'path-traversal', payload: '../escaped.txt', oracle: { type: 'filesystem_mutation', params: { canary: 'fs' } }, watch: { fs: 'escaped.txt' }, needsHs: /\b(?:writeFile|appendFile|copyFile|copyFileWithMetadata|renameFile|openBinaryFile)\b|\b(?:openFile|withFile|withBinaryFile)\b[^\n]*\b(?:WriteMode|AppendMode|ReadWriteMode)\b/, needs: /\b(?:writeFile|writeFileSync|appendFile|appendFileSync|createWriteStream)\b/ },
   'CWE-918': { name: 'ssrf', payload: '{{CALLBACK_URL}}', oracle: { type: 'outbound_callback' }, network: 'callback' },
 };
-const MAX_SOURCE = 256 * 1024;
-const MAX_FILES = 8;
+const generate_MAX_SOURCE = 256 * 1024;
+const generate_MAX_FILES = 8;
 const EXTS = ['', '.js', '.mjs', '.cjs', '/index.js'];
 const BUILTINS = new Set(external_node_module_.builtinModules.flatMap((m) => [m, `node:${m}`]));
 const MODULE_SYNTAX = /^\s*(?:import\s[^('"]|import\s*['"{*]|export\s)/m;
 
-const fail = (reason, extra = {}) => ({ ok: false, reason, ...extra });
+const generate_fail = (reason, extra = {}) => ({ ok: false, reason, ...extra });
 const normCwe = (c) => { const m = /(\d{1,5})/.exec(String(c ?? '')); return m ? `CWE-${Number(m[1])}` : null; };
 
 function inside(root, rel) {
@@ -91,7 +435,7 @@ function readSource(root, rel) {
   const real = inside(root, rel);
   if (!real) return null;
   const st = external_node_fs_.statSync(real);
-  if (!st.isFile() || st.size > MAX_SOURCE) return null;
+  if (!st.isFile() || st.size > generate_MAX_SOURCE) return null;
   return { real, text: external_node_fs_.readFileSync(real, 'utf8') };
 }
 
@@ -164,24 +508,29 @@ const P = new Proxy({}, { get: (_t, k) => (k === Symbol.toPrimitive ? () => payl
 const res = new Proxy(function () {}, { get: () => res, apply: () => res });
 const fn = ${pick};
 if (typeof fn !== 'function') { console.error('the exported value is not a function'); process.exit(3); }
-try { await Promise.race([Promise.resolve(fn(${args.join(', ')})), new Promise((r) => setTimeout(r, 5000))]); } catch (e) { console.error('target threw:', String(e && e.message).slice(0, 200)); }
+let timer; try { await Promise.race([Promise.resolve(fn(${args.join(', ')})), new Promise((r) => { timer = setTimeout(r, 5000); })]); } catch (e) { console.error('target threw:', String(e && e.message).slice(0, 200)); }
+clearTimeout(timer);
 `;
 }
 
 function generateReproducer({ finding, root }) {
   const cwe = normCwe(finding?.cwe);
   const cls = CLASSES[cwe];
-  if (!cls) return fail(`no payload and oracle exist for ${cwe ?? 'this finding'}; supported: ${Object.keys(CLASSES).join(', ')} (others need a database, a deserializer or a native harness)`);
+  if (!cls) return generate_fail(`no payload and oracle exist for ${cwe ?? 'this finding'}; supported: ${Object.keys(CLASSES).join(', ')} (others need a database, a deserializer or a native harness)`);
   const rel = String(finding?.file ?? '');
-  if (!/\.(?:js|mjs|cjs)$/i.test(rel)) return fail(`no harness builder for ${external_node_path_.extname(rel) || 'this file type'}; JavaScript only`);
-  if (!Number.isInteger(finding?.line)) return fail('the finding has no line number');
+  const isPy = /\.py$/i.test(rel);
+  const isHs = /\.hs$/i.test(rel);
+  if (!isPy && !isHs && !/\.(?:js|mjs|cjs)$/i.test(rel)) return generate_fail(`no harness builder for ${external_node_path_.extname(rel) || 'this file type'}; JavaScript, Python and Haskell only`);
+  if (!Number.isInteger(finding?.line)) return generate_fail('the finding has no line number');
+  if (isPy) return generatePythonReproducer({ finding, root, cls });
+  if (isHs) return generateHaskellReproducer({ finding, root, cls });
   const src = readSource(root, rel);
-  if (!src) return fail('the flagged file is missing, outside the repository, or too large');
+  if (!src) return generate_fail('the flagged file is missing, outside the repository, or too large');
   const ast = parseSource(src.text);
-  if (!ast) return fail('the flagged file could not be parsed');
+  if (!ast) return generate_fail('the flagged file could not be parsed');
   const lines = src.text.split('\n');
   const sinkLine = lines[finding.line - 1] ?? '';
-  if (cls.needs && !cls.needs.test(sinkLine) && !cls.needs.test(lines.slice(Math.max(0, finding.line - 3), finding.line + 2).join('\n'))) return fail(`${cls.name}: the flagged code is not a write, and the oracle can only observe a write (a read leaves no trace unless the program prints it)`);
+  if (cls.needs && !cls.needs.test(sinkLine) && !cls.needs.test(lines.slice(Math.max(0, finding.line - 3), finding.line + 2).join('\n'))) return generate_fail(`${cls.name}: the flagged code is not a write, and the oracle can only observe a write (a read leaves no trace unless the program prints it)`);
 
   // dependencies the sandbox can satisfy
   const sources = {}; const external = [];
@@ -193,23 +542,23 @@ function generateReproducer({ finding, root }) {
       if (!spec.startsWith('.')) { external.push(spec); continue; }
       let found = null;
       for (const e of EXTS) { const cand = inside(root, external_node_path_.relative(rootReal, external_node_path_.resolve(external_node_path_.dirname(realFile), spec + e))); if (cand && external_node_fs_.statSync(cand).isFile()) { found = cand; break; } }
-      if (!found) return fail(`the relative import "${spec}" was not found inside the repository`);
+      if (!found) return generate_fail(`the relative import "${spec}" was not found inside the repository`);
       const destRel = external_node_path_.relative(entryDir, found);
-      if (destRel.startsWith('..')) return fail(`"${spec}" lives outside the flagged file's directory, which a proof workspace cannot mirror`);
+      if (destRel.startsWith('..')) return generate_fail(`"${spec}" lives outside the flagged file's directory, which a proof workspace cannot mirror`);
       if (sources[destRel] || found === src.real) continue;
-      if (Object.keys(sources).length >= MAX_FILES) return fail(`the file pulls in more than ${MAX_FILES} repository files`);
+      if (Object.keys(sources).length >= generate_MAX_FILES) return generate_fail(`the file pulls in more than ${generate_MAX_FILES} repository files`);
       const dep = readSource(root, external_node_path_.relative(rootReal, found));
-      if (!dep) return fail(`"${spec}" is too large or unreadable`);
+      if (!dep) return generate_fail(`"${spec}" is too large or unreadable`);
       sources[destRel] = external_node_path_.relative(rootReal, found);
       const depAst = parseSource(dep.text);
-      if (!depAst) return fail(`"${spec}" could not be parsed`);
+      if (!depAst) return generate_fail(`"${spec}" could not be parsed`);
       const r = collect(found, depAst, count + 1); if (r) return r;
     }
     return null;
   };
   const bad = collect(src.real, ast, 0);
   if (bad) return bad;
-  if (external.length) return fail(`the flagged code needs ${[...new Set(external)].slice(0, 4).join(', ')}, which is not installed in the proof environment; only Node built-ins and repository files can be loaded`, { missing: [...new Set(external)] });
+  if (external.length) return generate_fail(`the flagged code needs ${[...new Set(external)].slice(0, 4).join(', ')}, which is not installed in the proof environment; only Node built-ins and repository files can be loaded`, { missing: [...new Set(external)] });
 
   const esm = MODULE_SYNTAX.test(src.text) || external_node_path_.extname(rel).toLowerCase() === '.mjs';
   const entry = `target${esm ? '.mjs' : '.cjs'}`;
@@ -222,29 +571,29 @@ function generateReproducer({ finding, root }) {
   if (/process\.argv\s*\[\s*2\s*\]|process\.argv\.slice\(\s*2\s*\)/.test(src.text) && !/\bmodule\.exports\b|^\s*export\s/m.test(src.text)) {
     const reproducer = { ...base, sources, run: ['{{NODE}}', entry, cls.payload] };
     const errs = (0,proof_fabric_reproducer/* validateReproducer */.mC)(reproducer);
-    return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'script', class: cls.name, entry: rel, line: finding.line, assumptions } };
+    return errs.length ? generate_fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'script', class: cls.name, entry: rel, line: finding.line, assumptions } };
   }
 
   // shape 2: an exported function around the flagged line
   const candidates = functionsAround(ast, finding.line);
-  if (!candidates.length) return fail('the flagged line is not inside a function, and the file does not read its payload from process.argv[2]');
+  if (!candidates.length) return generate_fail('the flagged line is not inside a function, and the file does not read its payload from process.argv[2]');
   let around = null; let exp = null;
   for (const c of candidates) { const e = exportName(ast, c); if (e) { around = c; exp = e; break; } }
-  if (!around) return fail('the function around the flagged line is not exported, so nothing outside the file can call it');
+  if (!around) return generate_fail('the function around the flagged line is not exported, so nothing outside the file can call it');
   const names = paramNames(around.node);
-  if (!names.length) return fail('the function around the flagged line takes no parameters, so the payload has no way in');
+  if (!names.length) return generate_fail('the function around the flagged line takes no parameters, so the payload has no way in');
   const window = lines.slice(Math.max(0, around.node.loc.start.line - 1), Math.min(lines.length, finding.line + 1)).join('\n');
   const requestLike = names.findIndex((n) => n && /^(?:req|request)$/.test(n) && new RegExp(`\\b${n}\\.(?:body|query|params)\\b`).test(sinkLine));
   const direct = requestLike >= 0 ? -1 : names.findIndex((n) => n && new RegExp(`\\b${n}\\b`).test(sinkLine));
   const fallback = direct < 0 && requestLike < 0 ? names.findIndex((n) => n && new RegExp(`\\b${n}\\b`).test(window)) : -1;
   const idx = requestLike >= 0 ? requestLike : direct >= 0 ? direct : fallback;
-  if (idx < 0) return fail('none of the function\'s parameters appears in the flagged code, so there is no tainted parameter to fill');
+  if (idx < 0) return generate_fail('none of the function\'s parameters appears in the flagged code, so there is no tainted parameter to fill');
   if (fallback >= 0) assumptions.push(`the tainted parameter "${names[idx]}" was chosen because it appears in the function body near the flagged line, not on the line itself`);
   const args = names.map((_, i) => (i !== idx ? (/^(?:res|response)$/.test(names[i] ?? '') ? 'res' : 'undefined') : requestLike >= 0 ? '{ body: P, query: P, params: P, headers: P, cookies: P }' : 'payload'));
   const files = { 'harness.mjs': harness({ esm, entry, exp, args }) };
   const reproducer = { ...base, sources, files, run: ['{{NODE}}', 'harness.mjs', cls.payload] };
   const errs = (0,proof_fabric_reproducer/* validateReproducer */.mC)(reproducer);
-  return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'function', class: cls.name, entry: rel, line: finding.line, function: names.length ? `${exp.kind === 'named' ? exp.name : exp.kind}(${names.join(', ')})` : exp.kind, taintedParameter: names[idx], requestLike: requestLike >= 0, assumptions } };
+  return errs.length ? generate_fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'function', class: cls.name, entry: rel, line: finding.line, function: names.length ? `${exp.kind === 'named' ? exp.name : exp.kind}(${names.join(', ')})` : exp.kind, taintedParameter: names[idx], requestLike: requestLike >= 0, assumptions } };
 }
 
 ;// CONCATENATED MODULE: ./src/posture/proof-fabric/cli.js
@@ -382,7 +731,7 @@ async function cmdProof(args, root) {
 function doctor(args) {
   const tools = (0,runner/* hostTools */.qV)();
   const rows = proof_fabric_reproducer/* LANGUAGES */.Yj.map((l) => ({ lang: l, ...(0,runner/* languageSupport */.ql)(l, tools) }));
-  const envs = ['javascript', 'python'].map((l) => ({ lang: l, ...(0,runner/* selectEnvironment */.aP)({ lang: l }) }));
+  const envs = ['javascript', 'python', 'haskell'].map((l) => ({ lang: l, ...(0,runner/* selectEnvironment */.aP)({ lang: l }) }));
   if (args.flags.json) { console.log(JSON.stringify({ tools, languages: rows, environments: envs }, null, 2)); return 0; }
   console.log('Proof fabric doctor');
   for (const r of rows) console.log(`  ${r.lang.padEnd(11)} ${r.supported ? 'supported' : `unsupported (${r.reason})`}`);

package/dist/2584.index.js

@@ -1430,7 +1430,7 @@ async function diagnosticsOf(scan) {
   try { wanted = JSON.parse(process.env.AGENTIC_SECURITY_DIAG_FILES || '[]'); } catch { wanted = []; }
   if (wanted.length) {
     try {
-      const irMod = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 28149));
+      const irMod = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 98297));
       irMod._resetIrParseFailures();
       const ir = await irMod.buildProjectIRAsync(Object.fromEntries(wanted.filter((f) => scan.fc && typeof scan.fc[f] === 'string').map((f) => [f, scan.fc[f]])));
       for (const f of wanted) {

package/dist/4171.index.js

@@ -22,8 +22,8 @@ var nix_build_trust = __webpack_require__(36668);
 var discovery = __webpack_require__(30951);
 // EXTERNAL MODULE: ./src/language/haskell-supply.js
 var haskell_supply = __webpack_require__(86349);
-// EXTERNAL MODULE: ./src/language/nix-script-taint.js
-var nix_script_taint = __webpack_require__(11793);
+// EXTERNAL MODULE: ./src/language/nix-script-taint.js + 1 modules
+var nix_script_taint = __webpack_require__(98078);
 // EXTERNAL MODULE: ./src/language/nix-secrets.js
 var nix_secrets = __webpack_require__(69466);
 // EXTERNAL MODULE: ./src/language/nix-parser.js