@clear-capabilities/agentic-security-scanner 0.186.2 → 0.187.0

package/CHANGELOG.md

@@ -9,6 +9,17 @@
 > make the history less accurate, not more.
 
 
+## 0.187.0 - Haskell parity work: wider exploit proof, broader SAST and taint, new unseen measurement sets
+
+- **Haskell SAST and taint, generalised beyond the shapes they were written against.** New sources and sinks (Scotty, Yesod, WAI, Servant, Req, conduit, http-client), guards recognised by what they do rather than by name (host allow-lists, hand-written HTML escapers, `sh -c` scripts), SSRF reported at the send instead of the parse, and Haskell-scoped engine fixes for branches handed to combinators, `words`, `>>=` and common lowering forms. On unseen-v3, now a development set, SAST and taint reach 100%; that is a regression result, not a generalisation claim.
+- **Honest unseen measurement.** A new set, unseen-v4 (78 forms, 13 families, measured once before this release's engine work), gives SAST recall 45.8% to 54.2% and taint precision 73.3% to 84.6%; taint recall is unchanged at 73.3%. Several families remain at 0 to 33% recall.
+- **Real-code precision did not move.** On four pinned real Haskell projects (`bench/dag/independent-haskell/`, one LLM labeler, 60 of the flagged sites), default-scan precision is 2.3% (95% interval 0.4% to 12.1%), against 2.0% before. The new engine flags additional sites that are unlabeled and are not counted.
+- **Alias fix.** A point-free alias of a library function (`tidy = takeFileName`, `run = callCommand`) was treated as an unresolved call, so a sanitizer alias left a flow unsanitized and a sink alias went undetected. Aliases of library functions are now expanded; a local binding with the same name disables the expansion.
+- **Exploit proof.** Widened Haskell reproducer coverage and oracles.
+- **Gates.** 56 Haskell mutation cases and 8 synthetic corpus entries (verdict-flip 460 of 460, corpus 228 of 228); layer-recall maps `.hs` and `.lhs`, taint attribution 126 to 134.
+- **Parity outside the engine.** Haskell on the MCP `query_taint`, context, compliance mapping, capability decisions, attack taxonomy, entrypoint inventory and reports, with `docs/language-parity-haskell.md` listing what remains open.
+- **Not done.** The container proof path is untested, `prove_finding` and `prove_fix` have no `.hs` harness builder, and `haskell-web-auth` route fixtures need a host with scotty, wai, servant and yesod to compile.
+
 ## 0.186.2 - Haskell exploit proof, a default-scan drift gate, and the measurements behind earlier claims
 
 - **Haskell in the exploit proof fabric (GA capability, new language).** `proof doctor` now lists `haskell` and `proof generate` builds reproducers for Haskell findings. Reproducers run in GHC's interpreter (`ghc -e`), so there is no build step. Command injection and path-traversal writes are proven; server-side request forgery is refused because no HTTP client ships with GHC; SQL, argument injection and deserialization are refused by name. Only `base` and the packages that ship with GHC are allowed (read from the installed GHC); a handler that needs a web framework is refused with the package named. Template Haskell, quasi-quotes, CPP, the foreign function interface and plugin options are refused as load-time code execution. 45 of 45 fixture reproductions across 15 classes, 0 false confirmations. Limits: exercised under local confinement on macOS with GHC 9.14.1 only; the container image is wired but was not run against a real engine, and Linux was not exercised.

package/dist/1602.index.js

@@ -194,9 +194,19 @@ var haskell_parser = __webpack_require__(99864);
 // or any Hackage package is refused with the package named where it is known. Template Haskell, quasi-quotes, CPP, the foreign
 // function interface and compiler-plugin options are refused too: they run code at load time, before the payload is involved.
 //
-// Classes: command injection (CWE-78) and path traversal by a write (CWE-22). SSRF (CWE-918) is refused for Haskell on purpose: no
-// HTTP client ships with GHC, so a request-making program necessarily imports a package the stdlib-only rule already refuses, and
-// nothing could be proven honestly. Nothing is executed on a refusal.
+// Classes, each with an oracle that sees its effect and nothing else:
+//   command injection (CWE-78)    a nonce-named canary file the injected command alone could create;
+//   path traversal by a WRITE     a file created or changed outside the directory the program writes to (CWE-22);
+//   path traversal by a READ      a per-run secret, planted in a file one directory above the program's base directory, appears in the
+//                                 program's output (stdout, stderr or, for a function, its printed result). A read whose content never
+//                                 reaches the output leaves nothing to see and stays unproven;
+//   argument injection (CWE-88)   the called program is replaced by a harness stand-in that acts on one planted option, but only when that
+//                                 option is its FIRST argument; the canary exists only if attacker data reached the first position of the
+//                                 argument vector. It shows the option position is attacker-controlled, not that the real program has a
+//                                 dangerous option, and the generated reproducer says so in its assumptions.
+// Refused on purpose, with the construct named and the way to supply a hand-written reproducer: SSRF (no HTTP client ships with GHC), SQL
+// (no database binding ships with GHC), deserialization, XSS, code injection, argument injection past the first argument, reads and writes
+// whose base directory the file does not state, and any function the proof cannot fill or call. Nothing is executed on a refusal.
 
 
 
@@ -281,20 +291,189 @@ function classify(mod, pkg, boot) {
   return { ok: false, name: mod };
 }
 
+// ---------------------------------------------------------------------------------------------------------------- parameter types
+
+const STRING_TYPES = /^(?:String|Prelude\.String|FilePath|System\.IO\.FilePath|\[Char\])$/;
+const unparen = (t) => { let x = t.trim(); while (x.startsWith('(') && x.endsWith(')') && splitArrows(x.slice(1, -1)).length === 1 && !x.slice(1, -1).includes(',')) x = x.slice(1, -1).trim(); return x; };
+
+/** What the file means by `Text` and `ByteString` (an import of the real module, not a local type of the same name) and its one-line `type` aliases. */
+function typeResolver(info, text) {
+  const textQ = new Set(); const bytesQ = new Set(); let textBare = false; let bytesBare = false;
+  for (const imp of info.imports ?? []) {
+    const isText = /^Data\.Text(?:\.Lazy)?$/.test(imp.module);
+    const isBytes = /^Data\.ByteString(?:\.(?:Char8|Lazy|Lazy\.Char8))?$/.test(imp.module);
+    if (!isText && !isBytes) continue;
+    const bare = !imp.qualified && !imp.hiding && (imp.items == null || imp.items.some((i) => /^(?:Text|ByteString)\b/.test(i)));
+    if (isText) { textQ.add(imp.as ?? imp.module); textBare ||= bare; } else { bytesQ.add(imp.as ?? imp.module); bytesBare ||= bare; }
+  }
+  const localDef = (n) => new RegExp(`^(?:data|newtype)\\s+${n}\\b`, 'm').test(text);
+  if (localDef('Text')) textBare = false;
+  if (localDef('ByteString')) bytesBare = false;
+  const aliases = new Map();
+  for (const m of text.matchAll(/^type\s+([A-Z][\w']*)\s*=\s*([^\n=]+?)\s*(?:--.*)?$/gm)) aliases.set(m[1], m[2]);
+  const resolve = (t, depth = 0) => {
+    const x = unparen(t);
+    if (depth < 4 && aliases.has(x)) return resolve(aliases.get(x), depth + 1);
+    return x;
+  };
+  const stringish = (t) => {
+    const x = resolve(t);
+    if (STRING_TYPES.test(x)) return 'string';
+    const q = /^(?:([A-Z][\w.]*)\.)?(Text|ByteString)$/.exec(x);
+    if (!q) return null;
+    if (q[2] === 'Text') return q[1] ? (textQ.has(q[1]) ? 'overloaded' : null) : (textBare ? 'overloaded' : null);
+    return q[1] ? (bytesQ.has(q[1]) ? 'overloaded' : null) : (bytesBare ? 'overloaded' : null);
+  };
+  /** `{lit}` is the Haskell expression for a value of this type holding `value`, `{needsOverloaded}` whether it relies on OverloadedStrings. */
+  const fill = (t, value) => {
+    const x = resolve(t);
+    const one = stringish(x);
+    if (one) return { expr: value, overloaded: one === 'overloaded' };
+    const list = /^\[\s*(.+?)\s*\]$/.exec(x);
+    if (list) { const e = stringish(list[1]); if (e) return { expr: `[${value}]`, overloaded: e === 'overloaded' }; }
+    const maybe = /^Maybe\s+(.+)$/.exec(x);
+    if (maybe) { const e = stringish(maybe[1]); if (e) return { expr: `(Just ${value})`, overloaded: e === 'overloaded' }; }
+    return null;
+  };
+  /** The result can be shown by `print` and carries the content a read returned (String, Text, ByteString, lists and Maybe of them). */
+  const printable = (t) => {
+    const x = resolve(t);
+    return !!(stringish(x) || (/^\[\s*(.+?)\s*\]$/.exec(x) && stringish(/^\[\s*(.+?)\s*\]$/.exec(x)[1])) || (/^Maybe\s+(.+)$/.exec(x) && stringish(/^Maybe\s+(.+)$/.exec(x)[1])));
+  };
+  return { fill, printable, resolve };
+}
+
+// ---------------------------------------------------------------------------------------------------------------- path traversal: write or read
+
+const READ_SINK = /\b(?:readFile'?|readFileBinary)\b|\b(?:openFile|withFile|openBinaryFile|withBinaryFile)\b[^\n]*\bReadMode\b/;
+const READ_PAYLOAD = '../agentic-proof-secret.txt';
+const READ_SECRET_FILE = 'agentic-proof-secret.txt';
+const READ_ORACLE = { type: 'file_disclosure', params: { secret: 'file' } };
+const WRITE_CONSTRUCTS = 'writeFile, appendFile, copyFile, renameFile, or openFile/withFile in WriteMode/AppendMode';
+const READ_CONSTRUCTS = 'readFile, or openFile/withFile in ReadMode';
+
+/** Which path operation the flagged line is: its own line first, then the lines around it. */
+function pathKind(sinkLine, around, writeRe) {
+  if (writeRe.test(sinkLine)) return 'write';
+  if (READ_SINK.test(sinkLine)) return 'read';
+  if (writeRe.test(around)) return 'write';
+  if (READ_SINK.test(around)) return 'read';
+  return null;
+}
+
+/**
+ * The directories a read is meant to stay under, as far as the source says: a literal that ends in a slash, or sits next to `</>`, or is
+ * bound to a name that says directory. The proof creates them (empty) so that `dir/../secret` resolves; a program whose base is not a
+ * relative literal cannot be modelled and is refused rather than guessed.
+ */
+function readBaseDirs(text) {
+  const found = [];
+  const add = (lit) => {
+    if (!lit || lit.startsWith('/') || lit.includes('..') || lit.includes('\\') || /[{}\s:*?"<>|]/.test(lit)) return;
+    const seg = lit.split('/').filter(Boolean)[0];
+    if (!seg || seg === '.' || ['canary', 'tmp'].includes(seg) || !/^[A-Za-z0-9._-]{1,32}$/.test(seg) || seg.startsWith('__oracle_')) return;
+    if (!found.includes(seg)) found.push(seg);
+  };
+  for (const m of text.matchAll(/"([^"\\\n]+\/)"/g)) add(m[1]);
+  for (const m of text.matchAll(/"([^"\\\n]+)"\s*<\/>/g)) add(m[1]);
+  for (const m of text.matchAll(/<\/>\s*"([^"\\\n]+)"/g)) add(m[1]);
+  for (const m of text.matchAll(/\b[a-z]\w*(?:Dir|Base|Root|Folder|Path|Directory)\w*'?\s*=\s*"([^"\\\n]+)"/gi)) add(m[1]);
+  return found.slice(0, 4);
+}
+
+// ---------------------------------------------------------------------------------------------------------------- argument injection
+
+// Shells and the tools the proof itself runs are never stood in for: an argument to a shell is command injection (CWE-78), and shadowing
+// a toolchain program on PATH would break the proof rather than test the finding.
+const NEVER_STAND_IN = new Set(['sh', 'bash', 'dash', 'zsh', 'csh', 'tcsh', 'ksh', 'fish', 'env', 'ghc', 'runghc', 'ghci', 'cc', 'gcc', 'clang', 'c++', 'g++', 'ld', 'as', 'ar', 'make', 'cabal', 'stack', 'nix', 'sudo', 'su', 'ssh', 'xargs', 'chmod', 'touch', 'node', 'python', 'python3']);
+const PROCESS_CALL = /\b(callProcess|readProcess|readProcessWithExitCode|spawnProcess|rawSystem|proc)\s+(?:\$\s*)?"([^"\\\s]+)"\s*/;
+const STAND_IN = `#!/bin/sh
+# Stand-in for the program the code under test calls. It is planted by the proof runner, never by the target.
+# It acts on exactly one option, and only when that option is its FIRST argument, by creating the file the option names.
+case "$1" in
+  --agentic-proof-write=*) : > "\${1#--agentic-proof-write=}" ;;
+esac
+exit 0
+`;
+// PATH puts the stand-in directory first and keeps the system and toolchain directories after it
+const STAND_IN_PATH = '{{ROOT}}/bin:/opt/ghc/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/homebrew/bin';
+
+/** What stands in first position of the argument vector at the call: a named element, a whole list, a fixed string, or something else. */
+function firstArgument(rest) {
+  if (rest.startsWith('[')) {
+    const inner = rest.slice(1).trimStart();
+    if (inner.startsWith('"')) return { kind: 'literal' };
+    if (inner.startsWith(']')) return { kind: 'empty' };
+    const m = /^([a-z_][\w']*)\s*(?:,|\])/.exec(inner);
+    return m ? { kind: 'element', name: m[1] } : { kind: 'complex' };
+  }
+  if (rest.startsWith('(')) {
+    const m = /^\(\s*([a-z_][\w']*)\s*:/.exec(rest);
+    return m ? { kind: 'element', name: m[1] } : { kind: 'complex' };
+  }
+  const m = /^([a-z_][\w']*)\s*(?:$|\)|"|--)/.exec(rest);
+  return m ? { kind: 'list', name: m[1] } : { kind: 'complex' };
+}
+
+const HINT = 'To prove it anyway, write a reproducer for lang "haskell" (run: ["{{GHC}}", "-ignore-dot-ghci", "-e", "<expression that calls the code>", "<File>.hs"], with an oracle such as command_execution, filesystem_mutation or file_disclosure) and pass it with --reproducer <file>; see the Haskell section of the exploit proof guide. Nothing was executed.';
+
+/** What the flagged line is, in words, for a refusal message. */
+function describeLine(finding, root) {
+  const src = (() => { try { return generate_haskell_readInside(root, String(finding.file)); } catch { return null; } })();
+  const line = src ? (src.text.split('\n')[finding.line - 1] ?? '').trim().replace(/\s+/g, ' ').slice(0, 90) : '';
+  return line ? `the flagged line \`${line}\`` : 'the flagged code';
+}
+
+const REFUSALS = {
+  'CWE-89': (what) => `sql-injection: ${what} reaches a database, and GHC ships no database binding, so a program that queries one imports a package outside the proof environment; a program that shells out to the sqlite3 command-line tool depends on a schema, a table and a column count the proof cannot know and a sqlite3 binary this host may not have. A SQL injection is not proven for Haskell.`,
+  'CWE-502': (what) => `deserialization: ${what} decodes data, and nothing observable happens when a decoder reads hostile bytes unless a gadget exists in the program; the decoders in common use (aeson, yaml, cereal) are packages outside GHC's own. A deserialization flaw is not proven for Haskell.`,
+  'CWE-79': (what) => `cross-site scripting: ${what} builds markup, and the effect is in a browser's DOM, which a command-line run cannot observe. XSS is not proven for Haskell.`,
+  'CWE-94': (what) => `code injection: ${what} evaluates code at run time through an interpreter package (hint, plugins) that does not ship with GHC. Code injection is not proven for Haskell.`,
+  'CWE-918': (what) => `ssrf: ${what} makes a request, and no HTTP client ships with GHC, so any program that makes one imports a package outside the proof environment. SSRF is not proven for Haskell.`,
+  'CWE-1427': (what) => `prompt injection: ${what} builds a model prompt, whose effect needs a model endpoint the proof does not have. Not proven for Haskell.`,
+};
+
+/**
+ * The reason a Haskell finding of a class this generator does not cover is refused, naming the construct and the way out.
+ * @param {{finding: object, root: string, cwe: string|null}} o
+ */
+function haskellRefusal({ finding, root, cwe }) {
+  const what = describeLine(finding, root);
+  const body = REFUSALS[cwe]?.(what) ?? `${cwe ?? 'this class'}: no payload and oracle exist for ${cwe ?? 'it'} in Haskell (${what}). Generated reproducers cover command injection (CWE-78), path traversal by a write or a read (CWE-22) and argument injection into a process call (CWE-88).`;
+  return generate_haskell_fail(`${body} ${HINT}`);
+}
+
+// ---------------------------------------------------------------------------------------------------------------- generation
+
 /** @param {{finding: object, root: string, cls: {name: string, payload: string, oracle: object, network?: string, watch?: object, needsHs?: RegExp}, bootModules?: Set<string>}} o */
-function generateHaskellReproducer({ finding, root, cls, bootModules }) {
+function generateHaskellReproducer(o) {
+  const r = generateInner(o);
+  if (r.ok || r.reason.includes('Nothing was executed.')) return r;
+  return { ...r, reason: `${r.reason.replace(/\.$/, '')}. ${HINT}` };
+}
+
+function generateInner({ finding, root, cls, bootModules }) {
   const rel = String(finding.file);
-  if (cls.name === 'ssrf') return generate_haskell_fail('ssrf: no HTTP client ships with GHC, so any program that makes a request imports a package outside the proof environment; this class is not proven for Haskell');
+  if (cls.name === 'ssrf') return haskellRefusal({ finding, root, cwe: 'CWE-918' });
   const src = generate_haskell_readInside(root, rel);
   if (!src) return generate_haskell_fail('the flagged file is missing, outside the repository, or too large');
   const hazard = loadTimeHazard(src.text);
   if (hazard) return generate_haskell_fail(`the flagged file is refused: ${hazard}`);
+  if (/\{\{[A-Z_]+(?::[a-z0-9_-]{1,32})?\}\}/.test(src.text)) return generate_haskell_fail('the flagged file contains text shaped like a proof placeholder ({{NAME}}), which the runner would substitute inside the program');
   const info = (0,haskell_parser/* parseHaskell */.cX)(src.text);
   if (!info || info.status !== 'parsed') return generate_haskell_fail('the flagged file could not be parsed as Haskell');
   const lines = src.text.split('\n');
   const sinkLine = lines[finding.line - 1] ?? '';
   const around = lines.slice(Math.max(0, finding.line - 3), finding.line + 2).join('\n');
-  if (cls.needsHs && !cls.needsHs.test(sinkLine) && !cls.needsHs.test(around)) return generate_haskell_fail(`${cls.name}: the flagged code is not a write, and this class is only proven for write sinks`);
+
+  // the class decides what is planted and what is watched; for a path operation the flagged line decides which of two it is
+  let spec = cls;
+  let kind = cls.name;
+  if (cls.name === 'path-traversal') {
+    const k = pathKind(sinkLine, around, cls.needsHs);
+    if (!k) return generate_haskell_fail(`path-traversal: ${describeLine(finding, root)} is not a write (${WRITE_CONSTRUCTS}) or a read (${READ_CONSTRUCTS}); other file operations (removeFile, createDirectory, listDirectory, doesFileExist, and the like) leave nothing the oracle can observe`);
+    if (k === 'read') { kind = 'path-traversal-read'; spec = { name: 'path-traversal-read', payload: READ_PAYLOAD, oracle: READ_ORACLE }; }
+  }
 
   const tools = (0,runner/* hostTools */.qV)();
   const boot = bootModules ?? (tools.ghc ? bootModuleSet(tools.ghc) : null);
@@ -322,6 +501,7 @@ function generateHaskellReproducer({ finding, root, cls, bootModules }) {
         const dep = (0,haskell_parser/* parseHaskell */.cX)(local.text);
         if (!dep || dep.status !== 'parsed') return generate_haskell_fail(`the module ${mod} could not be parsed as Haskell`);
         const h = loadTimeHazard(local.text); if (h) return generate_haskell_fail(`the module ${mod} is refused: ${h}`);
+        if (/\{\{[A-Z_]+(?::[a-z0-9_-]{1,32})?\}\}/.test(local.text)) return generate_haskell_fail(`the module ${mod} contains text shaped like a proof placeholder ({{NAME}})`);
         sources[`${mod.replaceAll('.', '/')}.hs`] = external_node_path_.relative(rootReal, local.real);
         const r = visit(dep.imports ?? []); if (r) return r;
         continue;
@@ -337,18 +517,35 @@ function generateHaskellReproducer({ finding, root, cls, bootModules }) {
   sources[entry] = rel;
 
   const assumptions = [];
-  const base = { schema: 'agentic-security/reproducer', version: 1, findingId: String(finding.stableId ?? finding.id ?? 'generated'), lang: 'haskell', oracle: cls.oracle, network: cls.network ?? 'none', ...(cls.watch ? { watch: cls.watch } : {}) };
-  if (cls.watch) assumptions.push('the write target is assumed to be one directory below the working directory (the payload is ../escaped.txt); if the code uses another base, the proof will not confirm it');
-  const ghcRun = (expr) => ['{{GHC}}', '-ignore-dot-ghci', '-e', expr, entry];
+  const base = { schema: 'agentic-security/reproducer', version: 1, findingId: String(finding.stableId ?? finding.id ?? 'generated'), lang: 'haskell', oracle: spec.oracle, network: spec.network ?? 'none', ...(spec.watch ? { watch: spec.watch } : {}) };
+  if (spec.watch) assumptions.push('the write target is assumed to be one directory below the working directory (the payload is ../escaped.txt); if the code uses another base, the proof will not confirm it');
+  const ghcRun = (expr, overloaded = false) => ['{{GHC}}', '-ignore-dot-ghci', ...(overloaded ? ['-e', ':set -XOverloadedStrings'] : []), '-e', expr, entry];
   const literal = (s) => JSON.stringify(s); // payloads are fixed strings with no quote or backslash; this is a plain Haskell string literal
+  const resolver = typeResolver(info, src.text);
+
+  // what the class plants beside the program
+  const extras = { files: {}, build: undefined, env: undefined };
+  if (kind === 'path-traversal-read') {
+    const dirs = readBaseDirs(src.text);
+    if (!dirs.length) return generate_haskell_fail(`path-traversal: ${describeLine(finding, root)} reads a path whose base directory is not a relative literal in the file (a path built from getCurrentDirectory, an environment variable, an absolute directory or a configuration value), so the proof cannot plant the file it would escape to`);
+    extras.files = { [READ_SECRET_FILE]: '{{SECRET:file}}', ...Object.fromEntries(dirs.map((d) => [`${d}/.keep`, ''])) };
+    assumptions.push(`the read is assumed to be confined under ${dirs.map((d) => `"${d}"`).join(' or ')}, one directory below the working directory; the proof plants a file one level up (${READ_PAYLOAD}) and sees it only if it reaches the program's output (stdout, stderr or, for a function, its printed result)`);
+  }
 
   // shape 1: a program that reads its payload from the command line
   const hasMain = (info.functions ?? []).some((f) => f.scope === 'top' && f.name === 'main');
   if (/\bgetArgs\b/.test(src.text) && hasMain) {
+    if (kind === 'argument-injection') {
+      const call = argumentCall(lines, finding);
+      if (!call.ok) return call;
+      if (call.first.kind !== 'list' || !new RegExp(`\\b${call.first.name}\\s*<-\\s*getArgs\\b`).test(src.text)) return generate_haskell_fail(`argument-injection: the first argument of the call to ${call.exe} is ${describeFirst(call.first)}, and the proof can place the payload only where the whole argument vector comes straight from getArgs (\`args <- getArgs\` then the call with \`args\`)`);
+      Object.assign(extras, standIn(call.exe));
+      assumptions.push(...standInAssumptions(call.exe));
+    }
     assumptions.push('the payload is passed as the first and only command-line argument; a program that expects other arguments will not reach the flagged line');
-    const reproducer = { ...base, sources, run: ghcRun(`:main ${literal(cls.payload)}`) };
+    const reproducer = { ...base, sources, ...(Object.keys(extras.files).length ? { files: extras.files } : {}), ...(extras.build ? { build: extras.build } : {}), ...(extras.env ? { env: extras.env } : {}), run: ghcRun(`:main ${literal(spec.payload)}`) };
     const errs = (0,proof_fabric_reproducer/* validateReproducer */.mC)(reproducer);
-    return errs.length ? generate_haskell_fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'script', class: cls.name, entry: rel, line: finding.line, assumptions } };
+    return errs.length ? generate_haskell_fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'script', class: spec.name, entry: rel, line: finding.line, assumptions } };
   }
 
   // shape 2: a top-level function around the flagged line
@@ -368,14 +565,66 @@ function generateHaskellReproducer({ finding, root, cls, bootModules }) {
   const result = parts[parts.length - 1]; const params = parts.slice(0, -1);
   if (!/^IO\b/.test(result)) return generate_haskell_fail(`${fn.name} returns ${result.slice(0, 40)}, not IO, so calling it would not perform the flagged operation`);
   if (!params.length) return generate_haskell_fail(`${fn.name} takes no parameters, so the payload has no way in`);
-  const bad2 = params.find((p) => !/^(?:String|FilePath|\[Char\])$/.test(p));
-  if (bad2) return generate_haskell_fail(`${fn.name} takes a parameter of type ${bad2.slice(0, 40)}; only String and FilePath can be filled with a payload`);
-  assumptions.push('the payload is passed in every parameter (a String has no request-like stand-in), which is an approximation of how the function is really called');
-  const call = `${fn.name} ${params.map(() => literal(cls.payload)).join(' ')} >>= \\_ -> return ()`;
-  const reproducer = { ...base, sources, run: ghcRun(call) };
+  const resultInner = result.replace(/^IO\s*/, '').trim();
+  if (kind === 'path-traversal-read' && resultInner !== '()' && !resolver.printable(resultInner)) return generate_haskell_fail(`${fn.name} returns IO ${resultInner.slice(0, 40)}, whose content the proof cannot print; a read is observed only in the output, so the result must be (), String, Text, ByteString or a list or Maybe of them`);
+
+  let payloadFor = () => spec.payload; // which parameters get the payload (all, unless the class says which)
+  if (kind === 'argument-injection') {
+    const call = argumentCall(lines, finding);
+    if (!call.ok) return call;
+    const headLine = lines[fn.span.startLine - 1] ?? '';
+    const head = new RegExp(`^${fn.name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}((?:\\s+[a-z_][\\w']*)*)\\s*(?:=|\\|)`).exec(headLine);
+    const names = head ? head[1].trim().split(/\s+/).filter(Boolean) : null;
+    if (!names || names.length !== params.length) return generate_haskell_fail(`argument-injection: the parameters of ${fn.name} are patterns or the definition is point-free, so the proof cannot tell which parameter reaches the call`);
+    if (call.first.kind !== 'element' && call.first.kind !== 'list') return generate_haskell_fail(`argument-injection: the first argument of the call to ${call.exe} is ${describeFirst(call.first)}, and the proof can place the payload only where a plain parameter of ${fn.name} stands first in the argument vector`);
+    const at = names.indexOf(call.first.name);
+    if (at < 0) return generate_haskell_fail(`argument-injection: the first argument of the call to ${call.exe} is \`${call.first.name}\`, which is not a parameter of ${fn.name}, so the proof cannot place the payload there`);
+    const shape = resolver.fill(params[at], 'x');
+    if (!shape) return generate_haskell_fail(`${fn.name} takes a parameter of type ${params[at].slice(0, 40)}; only String, FilePath, Text, ByteString and lists or Maybe of them can be filled with a payload`);
+    if (call.first.kind === 'list' && !/^\[/.test(shape.expr)) return generate_haskell_fail(`argument-injection: ${call.first.name} is passed as the whole argument vector but has type ${params[at].slice(0, 40)}, not a list of strings`);
+    if (call.first.kind === 'element' && /^\[/.test(shape.expr)) return generate_haskell_fail(`argument-injection: ${call.first.name} is a list but stands as one element of the argument vector`);
+    payloadFor = (i) => (i === at ? spec.payload : 'benign');
+    Object.assign(extras, standIn(call.exe));
+    assumptions.push(...standInAssumptions(call.exe), `the payload is placed in the parameter \`${call.first.name}\` only; the other parameters get the value "benign"`);
+  } else assumptions.push('the payload is passed in every parameter (a String has no request-like stand-in), which is an approximation of how the function is really called');
+
+  const filled = [];
+  let overloaded = false;
+  for (let i = 0; i < params.length; i++) {
+    const f = resolver.fill(params[i], literal(payloadFor(i)));
+    if (!f) return generate_haskell_fail(`${fn.name} takes a parameter of type ${params[i].slice(0, 40)}; only String, FilePath, Text, ByteString and lists or Maybe of them can be filled with a payload`);
+    filled.push(f.expr); overloaded ||= f.overloaded;
+  }
+  if (overloaded) assumptions.push('Text and ByteString arguments are written as string literals under OverloadedStrings, set for the call only, not for the program');
+  const tail = kind === 'path-traversal-read' && resultInner !== '()' ? '>>= print' : '>>= \\_ -> return ()';
+  const call = `${fn.name} ${filled.join(' ')} ${tail}`;
+  const reproducer = { ...base, sources, ...(Object.keys(extras.files).length ? { files: extras.files } : {}), ...(extras.build ? { build: extras.build } : {}), ...(extras.env ? { env: extras.env } : {}), run: ghcRun(call, overloaded) };
   const errs = (0,proof_fabric_reproducer/* validateReproducer */.mC)(reproducer);
-  return errs.length ? generate_haskell_fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'function', class: cls.name, entry: rel, line: finding.line, function: `${fn.name}(${params.length} String)`, assumptions } };
+  return errs.length ? generate_haskell_fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'function', class: spec.name, entry: rel, line: finding.line, function: `${fn.name}(${params.length} ${params.every((p) => STRING_TYPES.test(p.trim())) ? 'String' : params.length === 1 ? 'parameter' : 'parameters'})`, assumptions } };
+}
+
+function describeFirst(first) {
+  return { literal: 'a fixed string', empty: 'absent (an empty list)', complex: 'an expression the proof cannot read as a plain parameter', element: 'a parameter', list: 'a list' }[first.kind] ?? 'unreadable';
+}
+
+/** Find the process call at the flagged line and what stands first in its argument vector. */
+function argumentCall(lines, finding) {
+  const window = lines.slice(Math.max(0, finding.line - 1), finding.line + 2).join(' ').replace(/\s+/g, ' ');
+  const m = PROCESS_CALL.exec(window);
+  if (!m) return generate_haskell_fail('argument-injection: the flagged line is not a call to callProcess, readProcess, readProcessWithExitCode, spawnProcess, rawSystem or proc with the program named by a string literal, so the proof cannot tell which program receives the arguments');
+  const exe = m[2];
+  if (NEVER_STAND_IN.has(exe) || !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,31}$/.test(exe)) return generate_haskell_fail(`argument-injection: the program is \`${exe}\`, which the proof does not stand in for (a shell, an interpreter or a toolchain program; an argument to a shell is command injection, CWE-78)`);
+  const rest = window.slice(m.index + m[0].length).trimStart();
+  const first = firstArgument(rest);
+  if (first.kind === 'literal' || first.kind === 'empty') return generate_haskell_fail(`argument-injection: the first argument of the call to ${exe} is ${describeFirst(first)}, and the proof covers only attacker data in the FIRST position, where every conventional option parser reads a leading dash as an option; later positions depend on the program's own grammar (an option such as -f takes the next word as its value)`);
+  return { ok: true, exe, first };
+}
+
+/** The stand-in program, its permission and the PATH that finds it. */
+function standIn(exe) {
+  return { files: { [`bin/${exe}`]: STAND_IN }, build: ['/bin/chmod', '755', `bin/${exe}`], env: { PATH: STAND_IN_PATH } };
 }
+const standInAssumptions = (exe) => [`the program \`${exe}\` is replaced by a harness stand-in that acts on one planted option when it is the FIRST argument; a confirmation shows attacker data reaches the first argument unseparated and unvalidated, not that the real ${exe} has a dangerous option`];
 
 ;// CONCATENATED MODULE: ./src/posture/proof-fabric/generate.js
 // Reproducer generation from a finding's own evidence (PRD 1: `triage exploit --prove` with no hand-written reproducer).
@@ -397,6 +646,8 @@ function generateHaskellReproducer({ finding, root, cls, bootModules }) {
 //             loads it and calls it, filling the tainted parameter with the payload. A parameter that is a request-like object
 //             (`req`) gets a stand-in whose `body`/`query`/`params` answer every property with the payload.
 //
+// Haskell additionally proves path-traversal READS (a planted secret appears in the output) and argument injection into the first argument
+// of a process call (a stand-in for the called program); see `generate-haskell.js` for what each shows and does not show.
 // Weakness classes with a payload and an oracle that can SEE the effect: CWE-78 (a canary file created by the injected command),
 // CWE-22 (a write that lands outside the working directory, only for write sinks), CWE-918 (a request reaching the runner's loopback
 // listener). Others (injection into a database, deserialization, memory safety) need an environment or a native harness this does not
@@ -414,6 +665,10 @@ const CLASSES = {
   'CWE-22': { needsPy: /\bopen\s*\([^)]*['"][wax]b?\+?['"]|\.write_(?:text|bytes)\s*\(|\bshutil\.(?:copy|move)/, name: 'path-traversal', payload: '../escaped.txt', oracle: { type: 'filesystem_mutation', params: { canary: 'fs' } }, watch: { fs: 'escaped.txt' }, needsHs: /\b(?:writeFile|appendFile|copyFile|copyFileWithMetadata|renameFile|openBinaryFile)\b|\b(?:openFile|withFile|withBinaryFile)\b[^\n]*\b(?:WriteMode|AppendMode|ReadWriteMode)\b/, needs: /\b(?:writeFile|writeFileSync|appendFile|appendFileSync|createWriteStream)\b/ },
   'CWE-918': { name: 'ssrf', payload: '{{CALLBACK_URL}}', oracle: { type: 'outbound_callback' }, network: 'callback' },
 };
+// classes only the Haskell generator builds (the other languages refuse them): argument injection needs a stand-in for the called program
+const HASKELL_ONLY = {
+  'CWE-88': { name: 'argument-injection', payload: '--agentic-proof-write={{CANARY:arg}}', oracle: { type: 'argument_injection', params: { canary: 'arg' } } },
+};
 const generate_MAX_SOURCE = 256 * 1024;
 const generate_MAX_FILES = 8;
 const EXTS = ['', '.js', '.mjs', '.cjs', '/index.js'];
@@ -515,11 +770,12 @@ clearTimeout(timer);
 
 function generateReproducer({ finding, root }) {
   const cwe = normCwe(finding?.cwe);
-  const cls = CLASSES[cwe];
-  if (!cls) return generate_fail(`no payload and oracle exist for ${cwe ?? 'this finding'}; supported: ${Object.keys(CLASSES).join(', ')} (others need a database, a deserializer or a native harness)`);
   const rel = String(finding?.file ?? '');
   const isPy = /\.py$/i.test(rel);
   const isHs = /\.hs$/i.test(rel);
+  const cls = CLASSES[cwe] ?? (isHs ? HASKELL_ONLY[cwe] : undefined);
+  if (isHs && !cls && Number.isInteger(finding?.line)) return haskellRefusal({ finding, root, cwe });
+  if (!cls) return generate_fail(`no payload and oracle exist for ${cwe ?? 'this finding'}; supported: ${Object.keys(CLASSES).join(', ')} (others need a database, a deserializer or a native harness)`);
   if (!isPy && !isHs && !/\.(?:js|mjs|cjs)$/i.test(rel)) return generate_fail(`no harness builder for ${external_node_path_.extname(rel) || 'this file type'}; JavaScript, Python and Haskell only`);
   if (!Number.isInteger(finding?.line)) return generate_fail('the finding has no line number');
   if (isPy) return generatePythonReproducer({ finding, root, cls });

package/dist/9560.index.js

@@ -721,8 +721,14 @@ const INTERPRETER_NAMES = new Set([
   'time', 'timeout', 'sudo', 'doas', 'su', 'ssh', 'osascript', 'launchctl', 'script', 'expect', 'tclsh', 'wish',
   'awk', 'gawk', 'mawk', 'nawk', 'java', 'jshell', 'deno', 'bun', 'nodejs', 'swift', 'make', 'gmake',
   'npm', 'npx', 'yarn', 'pnpm', 'pip', 'pip3', 'pipx', 'gem', 'bundle', 'cargo', 'go', 'gradle', 'mvn', 'watch',
+  // Haskell and Nix toolchains run code supplied by the project: GHC and cabal execute Template Haskell splices and a
+  // custom Setup.hs at build time, runghc/ghci interpret a source file, and the Nix evaluators run the expressions they
+  // are given (builders run the derivation's build script).
+  'ghc', 'ghci', 'runghc', 'runhaskell', 'cabal', 'stack',
+  'nix', 'nix-build', 'nix-shell', 'nix-instantiate', 'nix-env', 'nix-store',
 ]);
-const INTERPRETER_FAMILY = /^(?:python|pypy|ruby|perl|php|lua|luajit|node|tclsh)[0-9.]*$/;
+// Versioned toolchain binaries (`ghc-9.14.1`, `runghc-9.14.1`, `cabal-3.14`) are the same executables under another name.
+const INTERPRETER_FAMILY = /^(?:python|pypy|ruby|perl|php|lua|luajit|node|tclsh)[0-9.]*$|^(?:ghc|ghci|runghc|runhaskell|cabal|stack)-[0-9][0-9.]*$/;
 
 /**
  * What kind of executable this is. `interpreter` is true for a known shell or
@@ -3578,6 +3584,22 @@ const scan_diff = {
   },
 };
 
+// The ordered source-to-sink steps of a finding: its `trace` when the detector wrote one, else the `chain` the IR taint
+// engine records (file, line, label, kind, provenance). Null when the finding carries neither.
+function _flowSteps(f) {
+  if (Array.isArray(f.trace) && f.trace.length) return f.trace;
+  if (f.trace && !Array.isArray(f.trace)) return f.trace;
+  if (Array.isArray(f.chain) && f.chain.length) {
+    return f.chain.map((s) => ({ file: s.file ?? null, line: s.line ?? null, label: s.label ?? null, kind: s.kind || (s.provenance ? 'source' : 'step'), provenance: s.provenance ?? null }));
+  }
+  return null;
+}
+// Labels of the structured source, sink and rule, for matching only.
+function _flowEnds(f) {
+  const lab = (x) => (x && typeof x === 'object' ? [x.label, x.family, x.kind].filter((v) => typeof v === 'string').join(' ') : '');
+  return [lab(f.source), lab(f.sink), typeof f.rule === 'string' ? f.rule : ''].join(' ');
+}
+
 // ─── query_taint ─────────────────────────────────────────────────────────────
 const query_taint = {
   name: 'query_taint',
@@ -3608,13 +3630,16 @@ const query_taint = {
     // dilutes its reasoning; the agent receives a bounded slice plus the
     // cursor to fetch the rest if it wants.
     const all = (scan.findings || []).filter(f => {
-      const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(f.trace || '')].join(' ').toLowerCase();
+      // The structured flow counts too: an IR taint finding (Haskell included) records its path as `source`, `sink`, `rule`
+      // and `chain`, and carries no free-text description or `trace`, so matching only the text fields would answer
+      // "no path" for a path the scan did find.
+      const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(_flowSteps(f) || ''), _flowEnds(f)].join(' ').toLowerCase();
       return hay.includes(srcL) && hay.includes(sinkL);
     });
     const page = all.slice(off, off + lim).map(f => (0,_redact_js__WEBPACK_IMPORTED_MODULE_21__/* .redactFinding */ .lE)({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, description: f.description,
-      trace: f.trace || null,
+      trace: _flowSteps(f),
     }));
     return {
       _meta: META,
@@ -3654,7 +3679,7 @@ const explain_finding = {
       title: f.title || f.vuln, cwe: f.cwe,
       description: f.description, remediation: f.remediation,
       snippet: f.snippet || null,
-      trace: f.trace || null,
+      trace: _flowSteps(f),
     });
     // Harness-anatomy #1: explain_finding's trace is the most-likely-large
     // field on a single finding. Offload when it crosses the threshold so
@@ -4314,6 +4339,9 @@ const synthesize_fix = {
               languageFix.applyWith = { finding_id: f.id, confirm: true, plan_digest: languageFix.planDigest };
             }
             else if (prev.ok) autofix = { deterministic: true, ruleId: f.rule || f.family || null, patch: prev.after, file: prev.file, label: prev.label || null, verified: true };
+          } else if (lc.isLanguageDependencyFinding(f)) {
+            // Named, not silent: a Hackage or flake dependency is fixed by raising a constraint, which has its own tool.
+            languageFix = { status: 'use-sca-upgrade', ok: false, label: null, tier: null, reason: 'this is a dependency finding: use synthesize_sca_upgrade for the constraint edit (apply_sca_upgrade writes it)', diff: null, explanation: null, consequences: [] };
           }
         } catch { /* best-effort: the preview is advisory */ }
       }
@@ -4728,6 +4756,22 @@ const query_cache_telemetry = {
   },
 };
 
+async function _languageUpgrade(lc, f, ctx, apply) {
+  const proj = lc.loadLanguageProject(ctx.sessionRoot);
+  return lc.languageUpgradePreview(f, { ...proj.files, ...proj.manifests }, { apply, root: ctx.sessionRoot });
+}
+// The result shape both SCA upgrade tools return for a Hackage or flake dependency. `verified` is never true: the edit
+// changes a declared constraint or a ref, not the resolved version.
+function _languageUpgradeResult(f, r) {
+  return {
+    ok: true, mode: r.ok ? 'source-edit' : 'blocked', ecosystem: f.ecosystem, package: f.package || null,
+    currentVersion: f.version || null, targetVersion: null, command: null,
+    reason: r.ok ? null : (r.reason || 'no upgrade could be planned'),
+    languageUpgrade: { status: r.status || null, tier: r.tier || null, label: r.label || null, file: r.file || null, diff: r.diff || null, explanation: r.explanation || null, consequences: r.consequences || [], backup: r.backup ? r.backup.id || null : null },
+    verified: false,
+  };
+}
+
 // ─── synthesize_sca_upgrade ───────────────────────────────────────────────
 // Phase 3 / Item 5 of the SCA improvement plan. Read-only counterpart to
 // apply_sca_upgrade — produces a structured upgrade plan via the
@@ -4756,6 +4800,10 @@ const synthesize_sca_upgrade = {
     if (f.type !== 'vulnerable_dep') {
       return { _meta: META, ok: false, reason: 'finding is not an SCA vulnerable_dep — use synthesize_fix for SAST findings' };
     }
+    // Hackage constraints and flake inputs are source edits the language planner owns; without this the generic planner
+    // answers "no automated upgrade" for a dependency the CLI can fix. Read-only: nothing is written or run.
+    const lc = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 52603));
+    if (lc.isLanguageDependencyFinding(f)) return { _meta: META, ..._languageUpgradeResult(f, await _languageUpgrade(lc, f, ctx, false)) };
     const { planScaUpgrade } = await _getScaUpgrade();
     const plan = await planScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f });
     return { _meta: META, ...plan };
@@ -4796,6 +4844,15 @@ const apply_sca_upgrade = {
     if (f.type !== 'vulnerable_dep') {
       return { _meta: META, applied: false, reason: 'finding is not an SCA vulnerable_dep — use apply_fix for SAST findings' };
     }
+    const lc = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 52603));
+    if (lc.isLanguageDependencyFinding(f)) {
+      // Plan first, confine the one file it names, then write it with a backup and a history entry (`undo` reverts it).
+      const plan = await _languageUpgrade(lc, f, ctx, false);
+      if (!plan.ok) return { _meta: META, applied: false, ..._languageUpgradeResult(f, plan) };
+      try { _confine(ctx.sessionRoot, plan.file, 'upgrade.file'); } catch (e) { return { _meta: META, applied: false, reason: String((e && e.message) || e) }; }
+      const done = await _languageUpgrade(lc, f, ctx, true);
+      return { _meta: META, applied: done.applied === true, ..._languageUpgradeResult(f, done), testsRun: false, testsNote: 'a constraint edit is not re-resolved or re-tested by this tool; resolve (for example `cabal build --dry-run`), rescan and run the project tests before relying on it' };
+    }
     const { applyScaUpgrade } = await _getScaUpgrade();
     const result = await applyScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f, runTests: run_tests });
     return { _meta: META, ...result };