@clear-capabilities/agentic-security-scanner 0.186.2 → 0.188.0

package/src/posture/proof-fabric/generate-haskell.js

@@ -21,9 +21,19 @@
 // or any Hackage package is refused with the package named where it is known. Template Haskell, quasi-quotes, CPP, the foreign
 // function interface and compiler-plugin options are refused too: they run code at load time, before the payload is involved.
 //
-// Classes: command injection (CWE-78) and path traversal by a write (CWE-22). SSRF (CWE-918) is refused for Haskell on purpose: no
-// HTTP client ships with GHC, so a request-making program necessarily imports a package the stdlib-only rule already refuses, and
-// nothing could be proven honestly. Nothing is executed on a refusal.
+// Classes, each with an oracle that sees its effect and nothing else:
+//   command injection (CWE-78)    a nonce-named canary file the injected command alone could create;
+//   path traversal by a WRITE     a file created or changed outside the directory the program writes to (CWE-22);
+//   path traversal by a READ      a per-run secret, planted in a file one directory above the program's base directory, appears in the
+//                                 program's output (stdout, stderr or, for a function, its printed result). A read whose content never
+//                                 reaches the output leaves nothing to see and stays unproven;
+//   argument injection (CWE-88)   the called program is replaced by a harness stand-in that acts on one planted option, but only when that
+//                                 option is its FIRST argument; the canary exists only if attacker data reached the first position of the
+//                                 argument vector. It shows the option position is attacker-controlled, not that the real program has a
+//                                 dangerous option, and the generated reproducer says so in its assumptions.
+// Refused on purpose, with the construct named and the way to supply a hand-written reproducer: SSRF (no HTTP client ships with GHC), SQL
+// (no database binding ships with GHC), deserialization, XSS, code injection, argument injection past the first argument, reads and writes
+// whose base directory the file does not state, and any function the proof cannot fill or call. Nothing is executed on a refusal.
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
@@ -108,20 +118,189 @@ function classify(mod, pkg, boot) {
   return { ok: false, name: mod };
 }
 
+// ---------------------------------------------------------------------------------------------------------------- parameter types
+
+const STRING_TYPES = /^(?:String|Prelude\.String|FilePath|System\.IO\.FilePath|\[Char\])$/;
+const unparen = (t) => { let x = t.trim(); while (x.startsWith('(') && x.endsWith(')') && splitArrows(x.slice(1, -1)).length === 1 && !x.slice(1, -1).includes(',')) x = x.slice(1, -1).trim(); return x; };
+
+/** What the file means by `Text` and `ByteString` (an import of the real module, not a local type of the same name) and its one-line `type` aliases. */
+function typeResolver(info, text) {
+  const textQ = new Set(); const bytesQ = new Set(); let textBare = false; let bytesBare = false;
+  for (const imp of info.imports ?? []) {
+    const isText = /^Data\.Text(?:\.Lazy)?$/.test(imp.module);
+    const isBytes = /^Data\.ByteString(?:\.(?:Char8|Lazy|Lazy\.Char8))?$/.test(imp.module);
+    if (!isText && !isBytes) continue;
+    const bare = !imp.qualified && !imp.hiding && (imp.items == null || imp.items.some((i) => /^(?:Text|ByteString)\b/.test(i)));
+    if (isText) { textQ.add(imp.as ?? imp.module); textBare ||= bare; } else { bytesQ.add(imp.as ?? imp.module); bytesBare ||= bare; }
+  }
+  const localDef = (n) => new RegExp(`^(?:data|newtype)\\s+${n}\\b`, 'm').test(text);
+  if (localDef('Text')) textBare = false;
+  if (localDef('ByteString')) bytesBare = false;
+  const aliases = new Map();
+  for (const m of text.matchAll(/^type\s+([A-Z][\w']*)\s*=\s*([^\n=]+?)\s*(?:--.*)?$/gm)) aliases.set(m[1], m[2]);
+  const resolve = (t, depth = 0) => {
+    const x = unparen(t);
+    if (depth < 4 && aliases.has(x)) return resolve(aliases.get(x), depth + 1);
+    return x;
+  };
+  const stringish = (t) => {
+    const x = resolve(t);
+    if (STRING_TYPES.test(x)) return 'string';
+    const q = /^(?:([A-Z][\w.]*)\.)?(Text|ByteString)$/.exec(x);
+    if (!q) return null;
+    if (q[2] === 'Text') return q[1] ? (textQ.has(q[1]) ? 'overloaded' : null) : (textBare ? 'overloaded' : null);
+    return q[1] ? (bytesQ.has(q[1]) ? 'overloaded' : null) : (bytesBare ? 'overloaded' : null);
+  };
+  /** `{lit}` is the Haskell expression for a value of this type holding `value`, `{needsOverloaded}` whether it relies on OverloadedStrings. */
+  const fill = (t, value) => {
+    const x = resolve(t);
+    const one = stringish(x);
+    if (one) return { expr: value, overloaded: one === 'overloaded' };
+    const list = /^\[\s*(.+?)\s*\]$/.exec(x);
+    if (list) { const e = stringish(list[1]); if (e) return { expr: `[${value}]`, overloaded: e === 'overloaded' }; }
+    const maybe = /^Maybe\s+(.+)$/.exec(x);
+    if (maybe) { const e = stringish(maybe[1]); if (e) return { expr: `(Just ${value})`, overloaded: e === 'overloaded' }; }
+    return null;
+  };
+  /** The result can be shown by `print` and carries the content a read returned (String, Text, ByteString, lists and Maybe of them). */
+  const printable = (t) => {
+    const x = resolve(t);
+    return !!(stringish(x) || (/^\[\s*(.+?)\s*\]$/.exec(x) && stringish(/^\[\s*(.+?)\s*\]$/.exec(x)[1])) || (/^Maybe\s+(.+)$/.exec(x) && stringish(/^Maybe\s+(.+)$/.exec(x)[1])));
+  };
+  return { fill, printable, resolve };
+}
+
+// ---------------------------------------------------------------------------------------------------------------- path traversal: write or read
+
+const READ_SINK = /\b(?:readFile'?|readFileBinary)\b|\b(?:openFile|withFile|openBinaryFile|withBinaryFile)\b[^\n]*\bReadMode\b/;
+const READ_PAYLOAD = '../agentic-proof-secret.txt';
+const READ_SECRET_FILE = 'agentic-proof-secret.txt';
+const READ_ORACLE = { type: 'file_disclosure', params: { secret: 'file' } };
+const WRITE_CONSTRUCTS = 'writeFile, appendFile, copyFile, renameFile, or openFile/withFile in WriteMode/AppendMode';
+const READ_CONSTRUCTS = 'readFile, or openFile/withFile in ReadMode';
+
+/** Which path operation the flagged line is: its own line first, then the lines around it. */
+function pathKind(sinkLine, around, writeRe) {
+  if (writeRe.test(sinkLine)) return 'write';
+  if (READ_SINK.test(sinkLine)) return 'read';
+  if (writeRe.test(around)) return 'write';
+  if (READ_SINK.test(around)) return 'read';
+  return null;
+}
+
+/**
+ * The directories a read is meant to stay under, as far as the source says: a literal that ends in a slash, or sits next to `</>`, or is
+ * bound to a name that says directory. The proof creates them (empty) so that `dir/../secret` resolves; a program whose base is not a
+ * relative literal cannot be modelled and is refused rather than guessed.
+ */
+function readBaseDirs(text) {
+  const found = [];
+  const add = (lit) => {
+    if (!lit || lit.startsWith('/') || lit.includes('..') || lit.includes('\\') || /[{}\s:*?"<>|]/.test(lit)) return;
+    const seg = lit.split('/').filter(Boolean)[0];
+    if (!seg || seg === '.' || ['canary', 'tmp'].includes(seg) || !/^[A-Za-z0-9._-]{1,32}$/.test(seg) || seg.startsWith('__oracle_')) return;
+    if (!found.includes(seg)) found.push(seg);
+  };
+  for (const m of text.matchAll(/"([^"\\\n]+\/)"/g)) add(m[1]);
+  for (const m of text.matchAll(/"([^"\\\n]+)"\s*<\/>/g)) add(m[1]);
+  for (const m of text.matchAll(/<\/>\s*"([^"\\\n]+)"/g)) add(m[1]);
+  for (const m of text.matchAll(/\b[a-z]\w*(?:Dir|Base|Root|Folder|Path|Directory)\w*'?\s*=\s*"([^"\\\n]+)"/gi)) add(m[1]);
+  return found.slice(0, 4);
+}
+
+// ---------------------------------------------------------------------------------------------------------------- argument injection
+
+// Shells and the tools the proof itself runs are never stood in for: an argument to a shell is command injection (CWE-78), and shadowing
+// a toolchain program on PATH would break the proof rather than test the finding.
+const NEVER_STAND_IN = new Set(['sh', 'bash', 'dash', 'zsh', 'csh', 'tcsh', 'ksh', 'fish', 'env', 'ghc', 'runghc', 'ghci', 'cc', 'gcc', 'clang', 'c++', 'g++', 'ld', 'as', 'ar', 'make', 'cabal', 'stack', 'nix', 'sudo', 'su', 'ssh', 'xargs', 'chmod', 'touch', 'node', 'python', 'python3']);
+const PROCESS_CALL = /\b(callProcess|readProcess|readProcessWithExitCode|spawnProcess|rawSystem|proc)\s+(?:\$\s*)?"([^"\\\s]+)"\s*/;
+const STAND_IN = `#!/bin/sh
+# Stand-in for the program the code under test calls. It is planted by the proof runner, never by the target.
+# It acts on exactly one option, and only when that option is its FIRST argument, by creating the file the option names.
+case "$1" in
+  --agentic-proof-write=*) : > "\${1#--agentic-proof-write=}" ;;
+esac
+exit 0
+`;
+// PATH puts the stand-in directory first and keeps the system and toolchain directories after it
+const STAND_IN_PATH = '{{ROOT}}/bin:/opt/ghc/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/homebrew/bin';
+
+/** What stands in first position of the argument vector at the call: a named element, a whole list, a fixed string, or something else. */
+function firstArgument(rest) {
+  if (rest.startsWith('[')) {
+    const inner = rest.slice(1).trimStart();
+    if (inner.startsWith('"')) return { kind: 'literal' };
+    if (inner.startsWith(']')) return { kind: 'empty' };
+    const m = /^([a-z_][\w']*)\s*(?:,|\])/.exec(inner);
+    return m ? { kind: 'element', name: m[1] } : { kind: 'complex' };
+  }
+  if (rest.startsWith('(')) {
+    const m = /^\(\s*([a-z_][\w']*)\s*:/.exec(rest);
+    return m ? { kind: 'element', name: m[1] } : { kind: 'complex' };
+  }
+  const m = /^([a-z_][\w']*)\s*(?:$|\)|"|--)/.exec(rest);
+  return m ? { kind: 'list', name: m[1] } : { kind: 'complex' };
+}
+
+const HINT = 'To prove it anyway, write a reproducer for lang "haskell" (run: ["{{GHC}}", "-ignore-dot-ghci", "-e", "<expression that calls the code>", "<File>.hs"], with an oracle such as command_execution, filesystem_mutation or file_disclosure) and pass it with --reproducer <file>; see the Haskell section of the exploit proof guide. Nothing was executed.';
+
+/** What the flagged line is, in words, for a refusal message. */
+function describeLine(finding, root) {
+  const src = (() => { try { return readInside(root, String(finding.file)); } catch { return null; } })();
+  const line = src ? (src.text.split('\n')[finding.line - 1] ?? '').trim().replace(/\s+/g, ' ').slice(0, 90) : '';
+  return line ? `the flagged line \`${line}\`` : 'the flagged code';
+}
+
+const REFUSALS = {
+  'CWE-89': (what) => `sql-injection: ${what} reaches a database, and GHC ships no database binding, so a program that queries one imports a package outside the proof environment; a program that shells out to the sqlite3 command-line tool depends on a schema, a table and a column count the proof cannot know and a sqlite3 binary this host may not have. A SQL injection is not proven for Haskell.`,
+  'CWE-502': (what) => `deserialization: ${what} decodes data, and nothing observable happens when a decoder reads hostile bytes unless a gadget exists in the program; the decoders in common use (aeson, yaml, cereal) are packages outside GHC's own. A deserialization flaw is not proven for Haskell.`,
+  'CWE-79': (what) => `cross-site scripting: ${what} builds markup, and the effect is in a browser's DOM, which a command-line run cannot observe. XSS is not proven for Haskell.`,
+  'CWE-94': (what) => `code injection: ${what} evaluates code at run time through an interpreter package (hint, plugins) that does not ship with GHC. Code injection is not proven for Haskell.`,
+  'CWE-918': (what) => `ssrf: ${what} makes a request, and no HTTP client ships with GHC, so any program that makes one imports a package outside the proof environment. SSRF is not proven for Haskell.`,
+  'CWE-1427': (what) => `prompt injection: ${what} builds a model prompt, whose effect needs a model endpoint the proof does not have. Not proven for Haskell.`,
+};
+
+/**
+ * The reason a Haskell finding of a class this generator does not cover is refused, naming the construct and the way out.
+ * @param {{finding: object, root: string, cwe: string|null}} o
+ */
+export function haskellRefusal({ finding, root, cwe }) {
+  const what = describeLine(finding, root);
+  const body = REFUSALS[cwe]?.(what) ?? `${cwe ?? 'this class'}: no payload and oracle exist for ${cwe ?? 'it'} in Haskell (${what}). Generated reproducers cover command injection (CWE-78), path traversal by a write or a read (CWE-22) and argument injection into a process call (CWE-88).`;
+  return fail(`${body} ${HINT}`);
+}
+
+// ---------------------------------------------------------------------------------------------------------------- generation
+
 /** @param {{finding: object, root: string, cls: {name: string, payload: string, oracle: object, network?: string, watch?: object, needsHs?: RegExp}, bootModules?: Set<string>}} o */
-export function generateHaskellReproducer({ finding, root, cls, bootModules }) {
+export function generateHaskellReproducer(o) {
+  const r = generateInner(o);
+  if (r.ok || r.reason.includes('Nothing was executed.')) return r;
+  return { ...r, reason: `${r.reason.replace(/\.$/, '')}. ${HINT}` };
+}
+
+function generateInner({ finding, root, cls, bootModules }) {
   const rel = String(finding.file);
-  if (cls.name === 'ssrf') return fail('ssrf: no HTTP client ships with GHC, so any program that makes a request imports a package outside the proof environment; this class is not proven for Haskell');
+  if (cls.name === 'ssrf') return haskellRefusal({ finding, root, cwe: 'CWE-918' });
   const src = readInside(root, rel);
   if (!src) return fail('the flagged file is missing, outside the repository, or too large');
   const hazard = loadTimeHazard(src.text);
   if (hazard) return fail(`the flagged file is refused: ${hazard}`);
+  if (/\{\{[A-Z_]+(?::[a-z0-9_-]{1,32})?\}\}/.test(src.text)) return fail('the flagged file contains text shaped like a proof placeholder ({{NAME}}), which the runner would substitute inside the program');
   const info = parseHaskell(src.text);
   if (!info || info.status !== 'parsed') return fail('the flagged file could not be parsed as Haskell');
   const lines = src.text.split('\n');
   const sinkLine = lines[finding.line - 1] ?? '';
   const around = lines.slice(Math.max(0, finding.line - 3), finding.line + 2).join('\n');
-  if (cls.needsHs && !cls.needsHs.test(sinkLine) && !cls.needsHs.test(around)) return fail(`${cls.name}: the flagged code is not a write, and this class is only proven for write sinks`);
+
+  // the class decides what is planted and what is watched; for a path operation the flagged line decides which of two it is
+  let spec = cls;
+  let kind = cls.name;
+  if (cls.name === 'path-traversal') {
+    const k = pathKind(sinkLine, around, cls.needsHs);
+    if (!k) return fail(`path-traversal: ${describeLine(finding, root)} is not a write (${WRITE_CONSTRUCTS}) or a read (${READ_CONSTRUCTS}); other file operations (removeFile, createDirectory, listDirectory, doesFileExist, and the like) leave nothing the oracle can observe`);
+    if (k === 'read') { kind = 'path-traversal-read'; spec = { name: 'path-traversal-read', payload: READ_PAYLOAD, oracle: READ_ORACLE }; }
+  }
 
   const tools = hostTools();
   const boot = bootModules ?? (tools.ghc ? bootModuleSet(tools.ghc) : null);
@@ -149,6 +328,7 @@ export function generateHaskellReproducer({ finding, root, cls, bootModules }) {
         const dep = parseHaskell(local.text);
         if (!dep || dep.status !== 'parsed') return fail(`the module ${mod} could not be parsed as Haskell`);
         const h = loadTimeHazard(local.text); if (h) return fail(`the module ${mod} is refused: ${h}`);
+        if (/\{\{[A-Z_]+(?::[a-z0-9_-]{1,32})?\}\}/.test(local.text)) return fail(`the module ${mod} contains text shaped like a proof placeholder ({{NAME}})`);
         sources[`${mod.replaceAll('.', '/')}.hs`] = path.relative(rootReal, local.real);
         const r = visit(dep.imports ?? []); if (r) return r;
         continue;
@@ -164,18 +344,35 @@ export function generateHaskellReproducer({ finding, root, cls, bootModules }) {
   sources[entry] = rel;
 
   const assumptions = [];
-  const base = { schema: 'agentic-security/reproducer', version: 1, findingId: String(finding.stableId ?? finding.id ?? 'generated'), lang: 'haskell', oracle: cls.oracle, network: cls.network ?? 'none', ...(cls.watch ? { watch: cls.watch } : {}) };
-  if (cls.watch) assumptions.push('the write target is assumed to be one directory below the working directory (the payload is ../escaped.txt); if the code uses another base, the proof will not confirm it');
-  const ghcRun = (expr) => ['{{GHC}}', '-ignore-dot-ghci', '-e', expr, entry];
+  const base = { schema: 'agentic-security/reproducer', version: 1, findingId: String(finding.stableId ?? finding.id ?? 'generated'), lang: 'haskell', oracle: spec.oracle, network: spec.network ?? 'none', ...(spec.watch ? { watch: spec.watch } : {}) };
+  if (spec.watch) assumptions.push('the write target is assumed to be one directory below the working directory (the payload is ../escaped.txt); if the code uses another base, the proof will not confirm it');
+  const ghcRun = (expr, overloaded = false) => ['{{GHC}}', '-ignore-dot-ghci', ...(overloaded ? ['-e', ':set -XOverloadedStrings'] : []), '-e', expr, entry];
   const literal = (s) => JSON.stringify(s); // payloads are fixed strings with no quote or backslash; this is a plain Haskell string literal
+  const resolver = typeResolver(info, src.text);
+
+  // what the class plants beside the program
+  const extras = { files: {}, build: undefined, env: undefined };
+  if (kind === 'path-traversal-read') {
+    const dirs = readBaseDirs(src.text);
+    if (!dirs.length) return fail(`path-traversal: ${describeLine(finding, root)} reads a path whose base directory is not a relative literal in the file (a path built from getCurrentDirectory, an environment variable, an absolute directory or a configuration value), so the proof cannot plant the file it would escape to`);
+    extras.files = { [READ_SECRET_FILE]: '{{SECRET:file}}', ...Object.fromEntries(dirs.map((d) => [`${d}/.keep`, ''])) };
+    assumptions.push(`the read is assumed to be confined under ${dirs.map((d) => `"${d}"`).join(' or ')}, one directory below the working directory; the proof plants a file one level up (${READ_PAYLOAD}) and sees it only if it reaches the program's output (stdout, stderr or, for a function, its printed result)`);
+  }
 
   // shape 1: a program that reads its payload from the command line
   const hasMain = (info.functions ?? []).some((f) => f.scope === 'top' && f.name === 'main');
   if (/\bgetArgs\b/.test(src.text) && hasMain) {
+    if (kind === 'argument-injection') {
+      const call = argumentCall(lines, finding);
+      if (!call.ok) return call;
+      if (call.first.kind !== 'list' || !new RegExp(`\\b${call.first.name}\\s*<-\\s*getArgs\\b`).test(src.text)) return fail(`argument-injection: the first argument of the call to ${call.exe} is ${describeFirst(call.first)}, and the proof can place the payload only where the whole argument vector comes straight from getArgs (\`args <- getArgs\` then the call with \`args\`)`);
+      Object.assign(extras, standIn(call.exe));
+      assumptions.push(...standInAssumptions(call.exe));
+    }
     assumptions.push('the payload is passed as the first and only command-line argument; a program that expects other arguments will not reach the flagged line');
-    const reproducer = { ...base, sources, run: ghcRun(`:main ${literal(cls.payload)}`) };
+    const reproducer = { ...base, sources, ...(Object.keys(extras.files).length ? { files: extras.files } : {}), ...(extras.build ? { build: extras.build } : {}), ...(extras.env ? { env: extras.env } : {}), run: ghcRun(`:main ${literal(spec.payload)}`) };
     const errs = validateReproducer(reproducer);
-    return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'script', class: cls.name, entry: rel, line: finding.line, assumptions } };
+    return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'script', class: spec.name, entry: rel, line: finding.line, assumptions } };
   }
 
   // shape 2: a top-level function around the flagged line
@@ -195,11 +392,63 @@ export function generateHaskellReproducer({ finding, root, cls, bootModules }) {
   const result = parts[parts.length - 1]; const params = parts.slice(0, -1);
   if (!/^IO\b/.test(result)) return fail(`${fn.name} returns ${result.slice(0, 40)}, not IO, so calling it would not perform the flagged operation`);
   if (!params.length) return fail(`${fn.name} takes no parameters, so the payload has no way in`);
-  const bad2 = params.find((p) => !/^(?:String|FilePath|\[Char\])$/.test(p));
-  if (bad2) return fail(`${fn.name} takes a parameter of type ${bad2.slice(0, 40)}; only String and FilePath can be filled with a payload`);
-  assumptions.push('the payload is passed in every parameter (a String has no request-like stand-in), which is an approximation of how the function is really called');
-  const call = `${fn.name} ${params.map(() => literal(cls.payload)).join(' ')} >>= \\_ -> return ()`;
-  const reproducer = { ...base, sources, run: ghcRun(call) };
+  const resultInner = result.replace(/^IO\s*/, '').trim();
+  if (kind === 'path-traversal-read' && resultInner !== '()' && !resolver.printable(resultInner)) return fail(`${fn.name} returns IO ${resultInner.slice(0, 40)}, whose content the proof cannot print; a read is observed only in the output, so the result must be (), String, Text, ByteString or a list or Maybe of them`);
+
+  let payloadFor = () => spec.payload; // which parameters get the payload (all, unless the class says which)
+  if (kind === 'argument-injection') {
+    const call = argumentCall(lines, finding);
+    if (!call.ok) return call;
+    const headLine = lines[fn.span.startLine - 1] ?? '';
+    const head = new RegExp(`^${fn.name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}((?:\\s+[a-z_][\\w']*)*)\\s*(?:=|\\|)`).exec(headLine);
+    const names = head ? head[1].trim().split(/\s+/).filter(Boolean) : null;
+    if (!names || names.length !== params.length) return fail(`argument-injection: the parameters of ${fn.name} are patterns or the definition is point-free, so the proof cannot tell which parameter reaches the call`);
+    if (call.first.kind !== 'element' && call.first.kind !== 'list') return fail(`argument-injection: the first argument of the call to ${call.exe} is ${describeFirst(call.first)}, and the proof can place the payload only where a plain parameter of ${fn.name} stands first in the argument vector`);
+    const at = names.indexOf(call.first.name);
+    if (at < 0) return fail(`argument-injection: the first argument of the call to ${call.exe} is \`${call.first.name}\`, which is not a parameter of ${fn.name}, so the proof cannot place the payload there`);
+    const shape = resolver.fill(params[at], 'x');
+    if (!shape) return fail(`${fn.name} takes a parameter of type ${params[at].slice(0, 40)}; only String, FilePath, Text, ByteString and lists or Maybe of them can be filled with a payload`);
+    if (call.first.kind === 'list' && !/^\[/.test(shape.expr)) return fail(`argument-injection: ${call.first.name} is passed as the whole argument vector but has type ${params[at].slice(0, 40)}, not a list of strings`);
+    if (call.first.kind === 'element' && /^\[/.test(shape.expr)) return fail(`argument-injection: ${call.first.name} is a list but stands as one element of the argument vector`);
+    payloadFor = (i) => (i === at ? spec.payload : 'benign');
+    Object.assign(extras, standIn(call.exe));
+    assumptions.push(...standInAssumptions(call.exe), `the payload is placed in the parameter \`${call.first.name}\` only; the other parameters get the value "benign"`);
+  } else assumptions.push('the payload is passed in every parameter (a String has no request-like stand-in), which is an approximation of how the function is really called');
+
+  const filled = [];
+  let overloaded = false;
+  for (let i = 0; i < params.length; i++) {
+    const f = resolver.fill(params[i], literal(payloadFor(i)));
+    if (!f) return fail(`${fn.name} takes a parameter of type ${params[i].slice(0, 40)}; only String, FilePath, Text, ByteString and lists or Maybe of them can be filled with a payload`);
+    filled.push(f.expr); overloaded ||= f.overloaded;
+  }
+  if (overloaded) assumptions.push('Text and ByteString arguments are written as string literals under OverloadedStrings, set for the call only, not for the program');
+  const tail = kind === 'path-traversal-read' && resultInner !== '()' ? '>>= print' : '>>= \\_ -> return ()';
+  const call = `${fn.name} ${filled.join(' ')} ${tail}`;
+  const reproducer = { ...base, sources, ...(Object.keys(extras.files).length ? { files: extras.files } : {}), ...(extras.build ? { build: extras.build } : {}), ...(extras.env ? { env: extras.env } : {}), run: ghcRun(call, overloaded) };
   const errs = validateReproducer(reproducer);
-  return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'function', class: cls.name, entry: rel, line: finding.line, function: `${fn.name}(${params.length} String)`, assumptions } };
+  return errs.length ? fail(`the generated reproducer is invalid: ${errs[0]}`) : { ok: true, reproducer, basis: { shape: 'function', class: spec.name, entry: rel, line: finding.line, function: `${fn.name}(${params.length} ${params.every((p) => STRING_TYPES.test(p.trim())) ? 'String' : params.length === 1 ? 'parameter' : 'parameters'})`, assumptions } };
+}
+
+function describeFirst(first) {
+  return { literal: 'a fixed string', empty: 'absent (an empty list)', complex: 'an expression the proof cannot read as a plain parameter', element: 'a parameter', list: 'a list' }[first.kind] ?? 'unreadable';
+}
+
+/** Find the process call at the flagged line and what stands first in its argument vector. */
+function argumentCall(lines, finding) {
+  const window = lines.slice(Math.max(0, finding.line - 1), finding.line + 2).join(' ').replace(/\s+/g, ' ');
+  const m = PROCESS_CALL.exec(window);
+  if (!m) return fail('argument-injection: the flagged line is not a call to callProcess, readProcess, readProcessWithExitCode, spawnProcess, rawSystem or proc with the program named by a string literal, so the proof cannot tell which program receives the arguments');
+  const exe = m[2];
+  if (NEVER_STAND_IN.has(exe) || !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,31}$/.test(exe)) return fail(`argument-injection: the program is \`${exe}\`, which the proof does not stand in for (a shell, an interpreter or a toolchain program; an argument to a shell is command injection, CWE-78)`);
+  const rest = window.slice(m.index + m[0].length).trimStart();
+  const first = firstArgument(rest);
+  if (first.kind === 'literal' || first.kind === 'empty') return fail(`argument-injection: the first argument of the call to ${exe} is ${describeFirst(first)}, and the proof covers only attacker data in the FIRST position, where every conventional option parser reads a leading dash as an option; later positions depend on the program's own grammar (an option such as -f takes the next word as its value)`);
+  return { ok: true, exe, first };
+}
+
+/** The stand-in program, its permission and the PATH that finds it. */
+function standIn(exe) {
+  return { files: { [`bin/${exe}`]: STAND_IN }, build: ['/bin/chmod', '755', `bin/${exe}`], env: { PATH: STAND_IN_PATH } };
 }
+const standInAssumptions = (exe) => [`the program \`${exe}\` is replaced by a harness stand-in that acts on one planted option when it is the FIRST argument; a confirmation shows attacker data reaches the first argument unseparated and unvalidated, not that the real ${exe} has a dangerous option`];

package/src/posture/proof-fabric/generate.js

@@ -17,6 +17,8 @@
 //             loads it and calls it, filling the tainted parameter with the payload. A parameter that is a request-like object
 //             (`req`) gets a stand-in whose `body`/`query`/`params` answer every property with the payload.
 //
+// Haskell additionally proves path-traversal READS (a planted secret appears in the output) and argument injection into the first argument
+// of a process call (a stand-in for the called program); see `generate-haskell.js` for what each shows and does not show.
 // Weakness classes with a payload and an oracle that can SEE the effect: CWE-78 (a canary file created by the injected command),
 // CWE-22 (a write that lands outside the working directory, only for write sinks), CWE-918 (a request reaching the runner's loopback
 // listener). Others (injection into a database, deserialization, memory safety) need an environment or a native harness this does not
@@ -27,13 +29,17 @@ import { builtinModules } from 'node:module';
 import { parse } from '@babel/parser';
 import { validateReproducer } from './reproducer.js';
 import { generatePythonReproducer } from './generate-python.js';
-import { generateHaskellReproducer } from './generate-haskell.js';
+import { generateHaskellReproducer, haskellRefusal } from './generate-haskell.js';
 
 const CLASSES = {
   'CWE-78': { name: 'command-injection', payload: 'x; touch {{CANARY:command}}', oracle: { type: 'command_execution', params: { canary: 'command' } } },
   'CWE-22': { needsPy: /\bopen\s*\([^)]*['"][wax]b?\+?['"]|\.write_(?:text|bytes)\s*\(|\bshutil\.(?:copy|move)/, name: 'path-traversal', payload: '../escaped.txt', oracle: { type: 'filesystem_mutation', params: { canary: 'fs' } }, watch: { fs: 'escaped.txt' }, needsHs: /\b(?:writeFile|appendFile|copyFile|copyFileWithMetadata|renameFile|openBinaryFile)\b|\b(?:openFile|withFile|withBinaryFile)\b[^\n]*\b(?:WriteMode|AppendMode|ReadWriteMode)\b/, needs: /\b(?:writeFile|writeFileSync|appendFile|appendFileSync|createWriteStream)\b/ },
   'CWE-918': { name: 'ssrf', payload: '{{CALLBACK_URL}}', oracle: { type: 'outbound_callback' }, network: 'callback' },
 };
+// classes only the Haskell generator builds (the other languages refuse them): argument injection needs a stand-in for the called program
+const HASKELL_ONLY = {
+  'CWE-88': { name: 'argument-injection', payload: '--agentic-proof-write={{CANARY:arg}}', oracle: { type: 'argument_injection', params: { canary: 'arg' } } },
+};
 const MAX_SOURCE = 256 * 1024;
 const MAX_FILES = 8;
 const EXTS = ['', '.js', '.mjs', '.cjs', '/index.js'];
@@ -135,11 +141,12 @@ clearTimeout(timer);
 
 export function generateReproducer({ finding, root }) {
   const cwe = normCwe(finding?.cwe);
-  const cls = CLASSES[cwe];
-  if (!cls) return fail(`no payload and oracle exist for ${cwe ?? 'this finding'}; supported: ${Object.keys(CLASSES).join(', ')} (others need a database, a deserializer or a native harness)`);
   const rel = String(finding?.file ?? '');
   const isPy = /\.py$/i.test(rel);
   const isHs = /\.hs$/i.test(rel);
+  const cls = CLASSES[cwe] ?? (isHs ? HASKELL_ONLY[cwe] : undefined);
+  if (isHs && !cls && Number.isInteger(finding?.line)) return haskellRefusal({ finding, root, cwe });
+  if (!cls) return fail(`no payload and oracle exist for ${cwe ?? 'this finding'}; supported: ${Object.keys(CLASSES).join(', ')} (others need a database, a deserializer or a native harness)`);
   if (!isPy && !isHs && !/\.(?:js|mjs|cjs)$/i.test(rel)) return fail(`no harness builder for ${path.extname(rel) || 'this file type'}; JavaScript, Python and Haskell only`);
   if (!Number.isInteger(finding?.line)) return fail('the finding has no line number');
   if (isPy) return generatePythonReproducer({ finding, root, cls });

package/src/posture/proof-fabric/oracles.js

@@ -13,6 +13,7 @@
 export const ORACLE_TYPES = Object.freeze([
   'crash_sanitizer', 'command_execution', 'unauthorized_http_access', 'unauthorized_db_read', 'database_mutation',
   'filesystem_mutation', 'outbound_callback', 'authentication_bypass', 'arbitrary_assertion',
+  'file_disclosure', 'argument_injection',
 ]);
 
 const SANITIZER_RE = /(AddressSanitizer|UndefinedBehaviorSanitizer|stack-buffer-overflow|heap-buffer-overflow|SEGV on unknown address|stack smashing detected|buffer overflow detected)/i;
@@ -68,6 +69,26 @@ const IMPL = {
     if (obs.timedOut) return inconclusive('run timed out');
     return out(false, 'protected path unchanged');
   },
+  // A file the runner planted OUTSIDE the directory the program is meant to read from holds a per-run secret. Seeing that secret in the
+  // program's output means attacker data steered a read onto it. The target cannot know the secret in advance, so it can print it
+  // only by reading the file. A read that leaves nothing in stdout/stderr is invisible to this oracle (it stays unproven, not refuted).
+  file_disclosure(obs, p) {
+    const secret = obs.secrets?.[p.secret || 'file'];
+    if (!secret) return inconclusive('disclosure canary was not armed by the runner');
+    if (has(obs, secret)) return out(true, 'content of a planted file outside the permitted directory appeared in the output');
+    if (obs.timedOut) return inconclusive('run timed out');
+    return out(false, 'planted file content not observed');
+  },
+  // A stand-in for the called program (planted by the runner, never the target) acts on exactly one option, given as its FIRST argument,
+  // by creating a nonce-named file. The file exists only if attacker data reached the first argument of the call unseparated and
+  // unvalidated. It shows the option position is attacker-controlled; it does not show the real program has a dangerous option.
+  argument_injection(obs, p) {
+    const c = obs.canaries?.[p.canary || 'arg'];
+    if (!c) return inconclusive('argument canary was not armed by the runner');
+    if (c.exists && !c.existedBefore) return out(true, 'a harness-planted option supplied as attacker data reached the first argument of the called program');
+    if (obs.timedOut) return inconclusive('run timed out before the canary could be judged');
+    return out(false, 'canary file not created');
+  },
   outbound_callback(obs) {
     if (obs.callbackUnavailable) return { fired: false, unsupported: true, reason: 'loopback callback listener is not available on this backend' };
     const hit = (obs.callbacks || []).some((c) => c && c.nonce && c.nonce === obs.nonce);

package/src/posture/stable-id.js

@@ -36,7 +36,8 @@ function basenameLike(file) {
 function pathShape(f) {
   if (!f) return '';
   const segments = [];
-  if (f.source) segments.push(`${f.source.type || ''}@${f.source.label || ''}`);
+  // a parameter source (`kind: 'parameter'`, named by the Haskell evidence chain) is not part of the identity: a finding keeps the id it had before its source was named
+  if (f.source && f.source.kind !== 'parameter') segments.push(`${f.source.type || ''}@${f.source.label || ''}`);
   if (Array.isArray(f.pathSteps)) {
     for (const step of f.pathSteps) {
       segments.push(`${step.type || ''}@${step.label || ''}`);

package/src/report/index.js

@@ -583,6 +583,9 @@ export function normalizeFindings(scan){
       blastRadius: sc.blastRadius || null,
       cvssVector: sc.cvssVector || null,
       functionReachable: sc.functionReachable || null,
+      // Hackage: the reason behind an `unknown` (no module mapping for the package is NOT "unreachable"), the modules that
+      // matched, and the tier. Dropping them left a bare `unknown` that read like a verdict.
+      ...(sc.reachability && typeof sc.reachability === 'object' ? { reachability: sc.reachability, reachabilityTier: sc.reachabilityTier || null } : {}),
       // 0.10.0: CISA KEV — actively abused in the wild
       kev: sc.kev === true,
       kevDateAdded: sc.kevDateAdded || null,

package/src/sast/cloud-iam.js

@@ -363,7 +363,9 @@ export function scanCloudIam(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const out = [];
   const seen = new Set();
-  const isJson = /\.json$/i.test(fp) || raw.trimStart().startsWith('{');
+  // A file is JSON by its extension or because it OPENS like a JSON object: a brace, then a quoted key or a closing brace. A bare leading `{` is not
+  // enough: a Haskell module that starts with a `{-# LANGUAGE ... #-}` pragma (or a `{- ... -}` comment) begins with one too, and its prose was read as policy.
+  const isJson = /\.json$/i.test(fp) || /^\s*\{\s*(?:"|\})/.test(raw.slice(0, 4096));
   const isYaml = /\.(?:yaml|yml)$/i.test(fp);
   const isBicep = /\.bicep$/i.test(fp);
   const isTf = /\.tf$/i.test(fp);