@clear-capabilities/agentic-security-scanner 0.186.2 → 0.188.0

package/src/engine.js

@@ -320,6 +320,7 @@ import { annotateHaskellFindings } from './language/haskell-findings.js';
 import { annotateHaskellLlm, analyzeHaskellLlmRules } from './language/haskell-llm.js';
 import { languagePragmaOnLine as _languagePragmaOnLine, languagePragmaSuppresses as _languagePragmaSuppresses } from './language/pragma.js';
 import { applyHaskellGuards, consolidateFlowSinks } from './language/haskell-guards.js';
+import { applyTrustBoundary } from './language/haskell-trust.js';
 import { annotateUnresolvedTargets, attachEvidenceChains } from './language/haskell-disclosure.js';
 import { analyzeHaskellRules } from './language/haskell-security-rules.js';
 import { scanLanguageSecretConcat, scanDependencyUrlCredentials, providerInfo as _secretProvider } from './language/secrets.js';
@@ -2556,6 +2557,10 @@ function scanStructuralVulns(fp, raw, _suppOut) {
   for (const pat of STRUCTURAL_VULN_PATTERNS) {
     if (!_ruleAppliesIn(pat, ctx)) { _supp.push({vuln:pat.vuln,file:fp,line:0,snippet:'',reason:'context-mismatch:'+ctx.kind}); continue; }
     if (pat.langScope && !pat.langScope.test(fp)) { continue; }
+    // These patterns are written in the syntax of JavaScript, Python, Java and C-family code (`parseString(`, `$(document)`, `exec(`). Haskell and
+    // Nix have their own analyzers; a pattern with no language scope has no meaning there, and one that fires (a record pattern named `String`
+    // read as an XML parser call, a script inside an HTML quasi-quote) is an artefact of the text.
+    if (!pat.langScope && isLanguageSource(fp)) continue;
     const re = new RegExp(pat.regex.source, pat.regex.flags);
     // Default: match against the string-stripped view so rule-library shapes
     // ('exec(' inside a fix-message) don't self-detect. Patterns that need to
@@ -9615,7 +9620,7 @@ function _deterministicFileTimings(timings) {
         f.unvalidated = true;
         f.validator_verdict = 'unvalidated';
       }
-      try { applyHaskellGuards(irFindings, perFile); consolidateFlowSinks(irFindings, perFile); annotateUnresolvedTargets(irFindings, perFile); attachEvidenceChains(irFindings, perFile); annotateHaskellFindings(irFindings, fc); annotateHaskellLlm(irFindings, fc); } catch (_) { /* metadata only; the finding stands without it */ }
+      try { applyHaskellGuards(irFindings, perFile); applyTrustBoundary(irFindings, perFile); consolidateFlowSinks(irFindings, perFile); annotateUnresolvedTargets(irFindings, perFile); attachEvidenceChains(irFindings, perFile); annotateHaskellFindings(irFindings, fc); annotateHaskellLlm(irFindings, fc); } catch (_) { /* metadata only; the finding stands without it */ }
       aF.push(...irFindings);
     } catch (e) {
       // Deep mode is best-effort. A parser blowup in one file shouldn't kill
@@ -9823,7 +9828,10 @@ function _deterministicFileTimings(timings) {
     } catch { /* Java SCA enrichment is best-effort */ }
   }
   // Haskell crypto / randomness / resource / XML / sensitive-logging rules (project-level: imports resolve across modules).
-  try{aF.push(...analyzeHaskellRules(fc).findings);}catch(_){}
+  // An `unsafePerformIO` / `unsafeCoerce` / `unsafeInterleaveIO` boundary note says (in its own text) that it claims no vulnerability class: it marks where the
+  // type system is stepped around. In a scan it is information, not a finding that gates a release; the rules module keeps emitting it at `low` (its contract),
+  // and the severity is lowered here with the original kept.
+  try{aF.push(...analyzeHaskellRules(fc).findings.map((f)=>f&&f.rule==='hs-unsafe-io-boundary'?{...f,originalSeverity:f.severity,severity:'info'}:f));}catch(_){}
   try{aF.push(...analyzeHaskellLlmRules(fc));}catch(_){}
   try{const{analyzeLanguageFindings}=await import('./language/engine-pass.js');aF.push(...analyzeLanguageFindings(allFileContents).findings);}catch(_){}
   let _languageBridges=null;try{if(Object.keys(allFileContents).some(f=>/\.(?:l?hs|nix)$/i.test(f))){const{analyzePolyglotBridges}=await import('./language/bridges.js');_languageBridges=analyzePolyglotBridges(allFileContents);}}catch(_){}
@@ -10727,7 +10735,7 @@ function _deterministicFileTimings(timings) {
   // classes from one source" finding, not a duplicate of any single
   // existing finding) still gets its own standalone finding, tagged with
   // the honest generic CWE-20/'multi-sink-taint-chain' label.
-  try{const srcGroups=new Map();for(const f of finalFindings){const src=f.chain?.[0]?.label;if(!src)continue;if(!srcGroups.has(src))srcGroups.set(src,[]);srcGroups.get(src).push(f);}for(const[src,group]of srcGroups){if(group.length<2)continue;const groupId=`multi-sink:${src}:${group.length}`;for(const f of group)f._multiSinkGroupId=groupId;const sharedFamily=group.every(f=>f.family&&f.family===group[0].family)?group[0].family:null;const sharedCwe=group.every(f=>f.cwe&&f.cwe===group[0].cwe)?group[0].cwe:null;const sinks=group.map(f=>({file:f.file,line:f.line,vuln:f.vuln}));if(sharedFamily&&sharedCwe){for(const f of group)f.multiSinkChain={source:src,sinkCount:group.length,sinks};continue;}finalFindings.push({id:groupId,file:group[0].file,line:group[0].line,vuln:`Multi-Sink Taint Chain — ${src} reaches ${group.length} sinks`,severity:group.some(f=>f.severity==='critical')?'critical':'high',cwe:'CWE-20',family:'multi-sink-taint-chain',parser:'MULTI-SINK',confidence:0.85,sinks,_aggregated:true});}}catch(_){}
+  try{const srcGroups=new Map();for(const f of finalFindings){const src=f.chain?.[0]?.label;if(!src)continue;if(f.severity==='info')continue;if(!srcGroups.has(src))srcGroups.set(src,[]);srcGroups.get(src).push(f);}for(const[src,group]of srcGroups){if(group.length<2)continue;const groupId=`multi-sink:${src}:${group.length}`;for(const f of group)f._multiSinkGroupId=groupId;const sharedFamily=group.every(f=>f.family&&f.family===group[0].family)?group[0].family:null;const sharedCwe=group.every(f=>f.cwe&&f.cwe===group[0].cwe)?group[0].cwe:null;const sinks=group.map(f=>({file:f.file,line:f.line,vuln:f.vuln}));if(sharedFamily&&sharedCwe){for(const f of group)f.multiSinkChain={source:src,sinkCount:group.length,sinks};continue;}finalFindings.push({id:groupId,file:group[0].file,line:group[0].line,vuln:`Multi-Sink Taint Chain — ${src} reaches ${group.length} sinks`,severity:group.some(f=>f.severity==='critical')?'critical':'high',cwe:'CWE-20',family:'multi-sink-taint-chain',parser:'MULTI-SINK',confidence:0.85,sinks,_aggregated:true});}}catch(_){}
   // SCA transitive dedup: collapse duplicate CVEs across dep chains
   try{const osvGroups=new Map();for(const sc of supplyChain){if(sc.type!=='vulnerable_dep'||!sc.osvId)continue;if(!osvGroups.has(sc.osvId))osvGroups.set(sc.osvId,[]);osvGroups.get(sc.osvId).push(sc);}for(const[osvId,group]of osvGroups){if(group.length<=1)continue;const primary=group.find(s=>s.isDirect)||group[0];primary.dependents=group.filter(s=>s!==primary).map(s=>({name:s.name,version:s.version,depChain:s.depChain,isDirect:s.isDirect}));primary._transitiveDeduped=group.length-1;for(const dup of group){if(dup!==primary)dup._deduplicatedInto=primary.osvId;}supplyChain.splice(0,supplyChain.length,...supplyChain.filter(s=>!s._deduplicatedInto));}}catch(_){}
   // ── World-class post-scan artifact emitters ──────────────────────────

package/src/language/CLAUDE.md

@@ -60,6 +60,18 @@ or a capability.** Product-facing guides: `docs/guides/haskell.md`, `docs/guides
   before. The prefetch (`prefetchNixAdvisoryFeed`, `resolved-pass.js`) asks only for identities `closureIdentities` says the matcher
   will use; metadata comes only from the operator (`AGENTIC_SECURITY_NIX_META`). NVD is rate limited (5/30 s keyless): never raise
   the request caps or lower the spacing in `nix-advisory-feed.js` without re-reading the NVD limits.
+- **The SEND is the SSRF sink, not the parse.** `parseRequest`/`parseUrlThrow`/`requestFromURI` only build a value, and the host check a defence needs (`host req \`elem\` allowed`) can only follow the parse, so a sink on the parse sits before every such guard and reports every guarded flow. The sinks are the senders (`httpLbs`, `httpNoBody`, `withResponse`, `httpLBS`, `simpleHttp`, wreq, and Req's `useURI`, where a parsed URI chooses the host; `req` itself is not a sink because `https "host" /: segment` keeps a tainted path segment on a fixed host).
+- **A parameter source says what it is.** `haskell-ir.js` annotates a text parameter of an exported function with `hs:caller-controlled` (the weak label) or, when the module imports Scotty/Yesod/Servant/WAI and the declared RESULT type is that framework's handler type (`HS_HANDLER_PARAM_SOURCES`, `handlerFrameworkOf`), `hs:handler-param:<framework>` (request input, provenance `url-param`). A single-endpoint Servant function (`server a rowId = ...` for one `type API`) takes its parameters from the API type in order (`servantEndpointParams`: Capture/QueryParam/Header/ReqBody that are text; never the `AuthProtect` principal). A project record parameter is NOT a taint source (the lineage view reads it as a customer record): seeding its text fields was tried, and it put a new finding on a documented example (a customer email sent to a CRM read as a prompt), so it was removed. `haskell-disclosure.js` `buildChain` starts the evidence chain at the function head with that label when no read call exists.
+- **A numeric annotation is a clean constant to the taint engine and still an expression to the rules.** `read s :: Int` and `readMaybe s :: Maybe Int` parse to a `typed` node (`NUMERIC_TYPE` in `haskell-syntax.js`, nothing else is kept) which lowers to a literal whose `hs.inner` carries the lowered expression; `haskell-security-rules.js` and `haskell-web.js` walk `hs.inner` (as they walk `hs.selector`), so an unsafe coercion in it and the request id it names stay visible. It is deliberately NOT a call of a sanitizer: the engine's sanitizer label is per expression, so a number in `"kill " ++ show n ++ name` would mark the tainted `name` sanitized.
+- **Guards are recognised by what they do.** `haskell-guards.js`: a project function is an HTML escaper when it (or its local helpers) spells out the entities for `<`, `>` and `&` (`htmlEscapers`; never by name), and it neutralises a CWE-79 flow only when EVERY use of the value in the sink argument is under such a call (`allUsesEscaped`); a host allow-list may be a named constant and may sit in an `&&`; `sh -c SCRIPT arg0 arg1` is shell injection only when the SCRIPT is built from the value, and tainted positional parameters are data when the constant script expands them only inside double quotes after `--` (`quotedPositionals`, which decodes the Haskell string escapes the IR keeps raw).
+- **Handlers named by the framework's convention are routes.** `haskell-web.js` adds `getFooR`/`postFooR`/`handleFooR` functions whose signature mentions `Handler` in a module importing Yesod when no route table in an analysed file names them (the table usually lives in `config/routes`). Scotty's rejection order is judged by `inlineOrder` as well as by line: a `case` lists the success branch first, so `status 40x >> finish` in the LAST alternative guards it (a bare `status` with no halting call does not).
+- **IR idioms that must keep the action.** `m >>= \_ -> k` and `f <$> m` RUN `m` even when the lambda ignores its result (`betaReduce`, `via`); `maybe d f m` / `either f g e` are a two-way branch on the scrutinee (so the scrutinee is still examined); `\case` applied by `>>=` is a case run in place; `foldM`, `zipWithM_`, `uncurry`, `fst`/`snd`/`const` of a written-out tuple, `filter isAlphaNum`, and a let-bound lambda (`let go = \x -> ..`, treated as `go x = ..`) are lowered so their sinks are reached. The taint engine (`dataflow/engine.js`) is Haskell-scoped for three of these: a `union` handed to a combinator or bound as a statement is a sink site in each branch (`_nestedSinkFindings`, the `assign` case), and a `member` whose object is a call (the elements of `words s`) carries its object's taint.
+- **A Haskell taint finding says who controls its input.** `haskell-trust.js` `applyTrustBoundary` (run in `engine.js` right after `applyHaskellGuards`) reads the origins the engine recorded (`sourceRoots`, or the evidence chain) and stamps `trustBoundary {verdict, reason, role, roots}`. Verdicts: `attacker-reachable` (request, socket, header, cookie, remote response; never lowered), `operator-controlled` (cli/env roots, and file-read roots in a command-line program; also an EMPTY origin in a command-line program, marked `inferred: true`), `api-contract` (a bare/whole-handoff parameter of an uncalled exported function reaching a process, CWE-78/88 only), `entry-parameter`, `data-input`, `unattributed`. `operator-controlled` and `api-contract` are lowered to `info` (never dropped; `originalSeverity`, `controls`, `guardNote` kept), the same convention `haskell-guards.js` uses. **Standard input is deliberately NOT covered by the command-line rule** (`getLine >>= callCommand` in `main` stays reported; `test/haskell/haskell-generalization.test.js` pins it), and **path wrappers are deliberately not `api-contract`** (`withFile name WriteMode` on a caller-named file is the vulnerable shape of three development splits). The role is `fn.hs.entryRole` from `assignEntryRoles` in `haskell-ir.js`: `cli` (reached only from `main`s whose reachable modules import no server framework or socket library), `service`, or `library` (no `main` reaches it; an incomplete call graph therefore yields `library`, never `cli`). Pinned both ways in `test/haskell/haskell-trust-boundary.test.js`.
+- **Origins are recorded, not guessed** (`dataflow/engine.js`). The engine records a source only against the variable a source call was assigned to; three additions make an evidence chain begin at the real origin: a value derived from a source inherits its records (`_inheritSources`), a callee analysed under an entry-taint state names its tainted parameters with placeholder records (`_paramPlaceholders`) that `_mergeSummaryFindings` resolves to the sources of the arguments at the merging call site (`_resolveParams`), and a function return keeps the sources behind it (`returnSources`, followed through `from` into `sourceRoots`). A parameter annotated as a source (`hs:caller-controlled`, `hs:handler-param:*`) is recorded too (`matchAnnotationParamSources`, `source.kind: 'parameter'` so stable ids do not change). This is language-neutral (`test/dataflow-source-attribution.test.js` pins it on JavaScript). `System.IO.hGetContents`/`hGetLine`/`hGetChar` (and the Text/ByteString forms) are modelled as `file-read`, not `stdin`: they read whatever handle they are given.
+- **Reachability must survive platform variants.** An import two modules both satisfy (the Posix and Windows variants behind an undecided CPP conditional) resolves to `unknown: ambiguous-import` with its `candidates`; `haskell-ir.js` records each candidate as a reference of the caller, so neither is an "uncalled entry point" whose parameters are caller-controlled. Without it every function of the platform module that was not chosen was reported.
+- **Comments never change a verdict, an id or a cluster.** `haskell-comments.js` finds Haskell comments lexically; a finding's `snippet` is `codeOfLine(line)` (code only), because the snippet feeds the stable id and the clone-shape hash, and both changed when someone edited a trailing comment. `test/haskell/haskell-comment-invariance.test.js` scans the examples and corpus-shaped cases as written, with every comment blanked, and with every comment (and a trailing comment on every line) replaced by text that lies in each direction; `bench/dag/dev-haskell/comment-invariance.mjs` does the same to a real project. An engine that varies is wrong.
+- **Rules that read the function around a call** (`haskell-security-rules.js`): `hs-weak-hash` is a vulnerability only where `weakDigestUse` finds a use that depends on the digest's strength (compared, hashed secret, credential-shaped binding or function, handed to a signing/verifying call); otherwise it is emitted at `info`. `hs-unbounded-input-read` needs a socket handle, or standard input in a function nothing calls (`readsOutsideInput`). Partial-function and allocation rules use a parameter as caller-supplied only for a framework-handler parameter or an uncalled function (`fn.hs.reached`). A salt is not an unpredictability-sensitive value. A cookie whose whole value is constant is not a credential. Own-property lookups only (`Object.hasOwn`): `constructor` and `toString` are legal Haskell names and were reported as "Unsafe boundary: function Object() { [native code] }".
+- **Fixes name the library the file uses.** `sqlDriverOf` picks `Database.PostgreSQL.Simple` or `Database.SQLite.Simple` from the file's own imports and refuses anything else; `hs-html-escape` needs blaze-html or a re-exporter; `hs-hash-sha256` refuses when the algorithm is named on another line (a type); `hs-path-takefilename` rewrites only a String/FilePath parameter spliced under a fixed directory in a FILE operation. Classes with no safe rewrite refuse with a class-level reason (`CLASS_REASONS`), `proposal: 'model-assisted'`.
 - **Pragma** (`pragma.js`): comment-aware, line-scoped, exact rule-id match, logged. A line-less finding cannot be suppressed.
 - **Scale: no per-use scan of the project.** Pandoc and cabal-install (hundreds to thousands of modules) did not finish a scan because of four superlinear costs, now fixed; do not reintroduce the shapes. (1) `haskell-ir.js`: anything a lowering step needs "from every module" (a constructor by name, the record types, a definition by qid, a name's resolution) is an index on `Project` / a per-module memo (`findCon`, `recordTypes`, `defByQid`, `RESOLVE_MEMO`), built once, never a loop over `proj.modules` per use. Only a top-level resolution (depth 0) is memoised: a resolution inside a re-export chain depends on the path taken. (2) `aibom.js` looks a file's imports up in a map, not `Object.values(perFile).find`. (3) `sast/pipeline.js`: the workflow-wide `env:` secret rule is a one-pass matcher (`scanEnvSecrets`), because the single regular expression it replaced backtracked catastrophically on a comment-blanked workflow (blanking leaves runs of blank lines). A detector expression that runs on comment-blanked text must not let `\s*`, `\n` and a lazy line loop claim the same blank lines. (4) `dataflow/engine.js` `exprTaint`: a call's argument taint is computed once per visit (`_argTaint`); computing it twice re-walked the subtree and cost 2^N for N nested calls. Guards: `test/pipeline-env-secret.test.js`, `test/dataflow-expr-taint-scaling.test.js`, `test/haskell/haskell-ir-scaling.test.js`, `test/mark-used-vuln-functions.test.js` compare work counters between two sizes, never a clock.
 
@@ -75,6 +87,7 @@ or a capability.** Product-facing guides: `docs/guides/haskell.md`, `docs/guides
 | Nix | `nix-parser.js`, `nix-grammar.js`, `nix-ir.js`, `nix-adapter.js`, `nixos-module-resolver.js`, `nixos-eval-forms.js`, `nixos-option-catalog.js`, `nixos-hardening.js`, `nix-build-trust.js`, `nix-secrets.js`, `nix-script-taint.js`, `nix-privacy.js`, `nix-agents.js`, `nix-inventory.js`, `nix-closure.js`, `nix-sca.js`, `nix-eval-isolation.js`, `nix-fix.js` |
 | Haskell | `haskell-parser.js`, `haskell-grammar.js`, `haskell-adapter.js`, `haskell-ir.js`, `haskell-models.js` (the single registry of sources, sinks, sanitizers; `dataflow/catalog-haskell.js` is generated from it), `haskell-guards.js`, `haskell-security-rules.js`, `haskell-web.js`, `haskell-findings.js`, `haskell-syntax.js`, `haskell-sweep.js`, `haskell-disclosure.js`, `haskell-llm.js`, `haskell-manifests.js`, `haskell-resolved-graph.js`, `haskell-sca.js`, `haskell-advisory-feed.js` (the opt-in live Hackage feed: OSV fetch, per-package coverage, operator-only snapshot), `haskell-supply.js`, `haskell-fix.js` |
 | Nix | `nix-parser.js`, `nix-grammar.js`, `nix-ir.js`, `nix-adapter.js`, `nixos-module-resolver.js`, `nixos-option-catalog.js`, `nixos-hardening.js`, `nix-build-trust.js`, `nix-secrets.js`, `nix-script-taint.js`, `nix-privacy.js`, `nix-agents.js`, `nix-inventory.js`, `nix-closure.js`, `nix-sca.js`, `nix-advisory-feed.js`, `nix-eval-isolation.js`, `nix-fix.js` |
+| Haskell trust | `haskell-trust.js` (trust-boundary verdicts and the lowering of operator-controlled and pass-through findings), `haskell-comments.js` (lexical Haskell comments; the code-only snippet) |
 | Measurement | `accuracy.js` (family-scoped scoring, per-layer), `support-registry.js` (status rules, promotion refusals, frozen-hash demotion) |
 
 Related, outside this directory: `dataflow/catalog-haskell.js`, `lineage/haskell-view.js`, `lineage/nix-view.js`,
@@ -121,6 +134,8 @@ Pinned both ways in `test/nix/nix-option-types.test.js`.
 | Support registry | `npm run bench:language-support:check` | recomputes the registry from the STORED measurement; fails on any difference |
 | Live feed | `npm run bench:live-feed -- <fetch\|plan\|scan\|merge\|sample\|report>` | `bench/live-feed/`: the opt-in Hackage feed against real projects and real OSV. Needs the network and is NOT in `npm test` or any gate. `RESULTS.md` is a dated measurement; labels in it are model-assessed |
 
+The `unseen` split (unseen-v3) is a **DEVELOPMENT set since 2026-10-26**: its failures were read and the engine was changed for their causes (provenance.json, `unseen-v3-development`; manifest `role: development`). `measure.mjs` records `splitRole` with every result, the registry labels the column "DEVELOPMENT set", and a generalisation claim needs a new unseen set (unseen-v4).
+
 The support registry is measured **once per promotion** on a frozen holdout (`bench/language-support/promote.mjs`); never tune
 against the holdout, and any further holdout run counts as repeated use. A change to the engine, the corpus or a label changes the
 frozen hashes and demotes rows until a deliberate re-measure. `docs/language-support.*` are generated; do not edit by hand.
@@ -142,3 +157,14 @@ the capture reads `dist/`.
    record the revision in `provenance.json`. Do not hand-edit labels.
 4. Run `test:haskell` / `test:nix` / `test:language`, `bench:mutation:check`, `bench:layer-recall:check` and
    `bench:language-support:check`; re-promote deliberately if a measured number legitimately changes.
+
+## Point-free aliases (`haskell-ir.js` `aliasBodyOf` / `applyAlias`)
+
+`tidy = takeFileName` and `run = callCommand` (and `.` compositions of such names) are the functions they name, so applying one
+lowers to the application of those functions, for a top-level, `let` and `where` binding alike. Found by `bench/mutation`
+(`hs-san-path-where-helper`): without it a sanitizer or sink reached through the alias was an unresolved call and lost its identity.
+Rules: only an alias of LIBRARY functions is expanded (a project function keeps its own summary and call-graph node); a local binding
+at the use site that shares one of the names disables the expansion (it stays the unresolved call, which fails toward unsanitized);
+the alias's call-graph edge is kept via `inlinedCalls`; arguments are lowered in the CALLER's module. Pinned both ways in
+`test/haskell/haskell-alias-taint.test.js`. Haskell verdict-flip cases live in `bench/mutation/cases-haskell.mjs`; the 8
+`bench/cve-replay/deep/hs-*-shape` entries are synthetic (self-authored, not from advisories).

package/src/language/compliance-map.js

@@ -18,6 +18,12 @@ export const LANGUAGE_FAMILY_ALIASES = Object.freeze({
   // credential handling: a secret that lands in the Nix store, a derivation or a log is exposed sensitive data
   'data-exposure': ['secret-in-store', 'secret-in-build', 'secret-in-log', 'sensitive-logging', 'dependency-url-credential'],
   'key-hygiene': ['secret-in-store', 'secret-in-build'],
+  // credentials written in source and certificate validation switched off (Haskell names them more specifically)
+  'hardcoded-secret': ['hardcoded-credentials'],
+  'crypto-tls-no-verify': ['tls-validation'],
+  // a session cookie built without HttpOnly or Secure is evidence for both cookie controls
+  'session-cookie-missing-secure-flag': ['cookie-attributes'],
+  'session-cookie-without-httponly-flag': ['cookie-attributes'],
   // cryptography
   'crypto-weak-hash': ['weak-hash'],
   'crypto-kdf-weak': ['password-hashing'],

package/src/language/context.js

@@ -82,6 +82,19 @@ export function languageOfFinding(f) {
   return null;
 }
 
+const _importedModules = (text) => new Set([...String(text || '').matchAll(/^import\s+(?:safe\s+)?(?:qualified\s+)?([A-Z][\w.']*)/gm)].map((m) => m[1]));
+/** Database-library modules a Haskell fix plan imports that the file did not import before the edit (sorted, deduplicated). */
+export function addedDatabaseImports(plan) {
+  const edits = Array.isArray(plan && plan.edits) && plan.edits.length ? plan.edits : [plan];
+  const out = new Set();
+  for (const e of edits) {
+    if (!e || typeof e.before !== 'string' || typeof e.after !== 'string') continue;
+    const had = _importedModules(e.before);
+    for (const m of _importedModules(e.after)) if (!had.has(m) && /^Database\./.test(m)) out.add(m);
+  }
+  return [...out].sort();
+}
+
 /**
  * A READ-ONLY fix preview for a Haskell/Nix finding: the planned patch, its tier, and what the verification gates say.
  * Never writes. `files` is the project's language sources (see loadLanguageProject).
@@ -91,6 +104,13 @@ export async function languageFixPreview(finding, files, { apply = false, root =
   if (!lang) return { ok: false, status: 'unsupported', reason: 'not a Haskell or Nix finding' };
   const plan = lang === 'haskell' ? planHaskellFix(finding, files) : planNixFix(finding, files);
   if (!plan || plan.ok === false) return { ok: false, status: (plan && plan.status) || 'unsupported', tier: (plan && plan.tier) || null, reason: (plan && plan.reason) || 'no deterministic fix', proposal: (plan && plan.proposal) || null };
+  if (lang === 'haskell') {
+    // A static rescan cannot see a wrong library, so this is decided here, before any gate can call the patch verified.
+    const added = addedDatabaseImports(plan);
+    if (added.length) {
+      return { ok: false, status: 'blocked', tier: null, label: plan.label || null, reason: `the patch adds an import of a database library the file did not use (${added.join(', ')}); which driver the project uses is not provable from this file, so the edit is refused rather than guessed. Apply the parameterised query by hand with the project's own driver`, proposal: null };
+    }
+  }
   let res;
   try { res = lang === 'haskell' ? await validateHaskellFix(finding, { files, apply, root }) : await validateNixFix(finding, { files, apply, root }); } catch (e) { res = { status: 'blocked', reason: `verification failed: ${String((e && e.message) || e)}` }; }
   return {

package/src/language/haskell-comments.js

@@ -0,0 +1,65 @@
+// Haskell comments, found lexically. Used so that text a finding carries from the source (its snippet, and through it the identity and the
+// clone-shape of the finding) is the CODE of the line and never a comment on it: a verdict, an id and a cluster must not change because someone
+// edited, or lied in, a comment. Strings, character literals and pragmas are not comments; a run of dashes inside an operator (`-->`, `|--`) is
+// not a comment; block comments nest.
+
+const SYMBOL = new Set([...'!#$%&*+./<=>?@\\^|~:-']);
+const IDENT = /[A-Za-z0-9_']/;
+
+/** The comments of a Haskell source: [{start, end, kind}] with `end` exclusive. */
+export function findComments(src) {
+  const out = [];
+  const n = src.length;
+  let i = 0;
+  while (i < n) {
+    const c = src[i];
+    if (c === '"') {   // string literal
+      i++;
+      while (i < n && src[i] !== '"') { if (src[i] === '\\') i++; i++; }
+      i++;
+      continue;
+    }
+    if (c === "'" && !(i > 0 && IDENT.test(src[i - 1]))) {   // character literal (a prime after an identifier character is part of the name)
+      const m = /^'(?:\\(?:[^']|x[0-9A-Fa-f]+|[0-9]+|[A-Z]+)|[^'\\])'/.exec(src.slice(i, i + 12));
+      if (m) { i += m[0].length; continue; }
+    }
+    if (c === '{' && src[i + 1] === '-' && src[i + 2] !== '#') {
+      let depth = 1; const start = i; i += 2;
+      while (i < n && depth > 0) {
+        if (src[i] === '{' && src[i + 1] === '-') { depth++; i += 2; } else if (src[i] === '-' && src[i + 1] === '}') { depth--; i += 2; } else i++;
+      }
+      out.push({ start, end: i, kind: 'block' });
+      continue;
+    }
+    if (c === '-' && src[i + 1] === '-') {
+      let j = i; while (j < n && src[j] === '-') j++;
+      const prevSym = i > 0 && SYMBOL.has(src[i - 1]) && src[i - 1] !== '-';
+      const nextSym = j < n && SYMBOL.has(src[j]);
+      if (!prevSym && !nextSym) {
+        let e = j; while (e < n && src[e] !== '\n') e++;
+        out.push({ start: i, end: e, kind: 'line' });
+        i = e;
+        continue;
+      }
+      i = j;
+      continue;
+    }
+    i++;
+  }
+  return out;
+}
+
+const blank = (text) => text.replace(/[^\n]/g, ' ');
+
+/** The source with every comment overwritten by spaces: same length, same line breaks, so locations do not move. */
+export function stripComments(src) {
+  let out = ''; let at = 0;
+  for (const c of findComments(src)) { out += src.slice(at, c.start) + blank(src.slice(c.start, c.end)); at = c.end; }
+  return out + src.slice(at);
+}
+
+/** One source line without its comments, trimmed. A block comment that opened on an earlier line is not known here; a line that is only a comment becomes ''. */
+export function codeOfLine(line) {
+  if (typeof line !== 'string') return '';
+  return stripComments(line).trim();
+}

package/src/language/haskell-disclosure.js

@@ -8,7 +8,7 @@
 // with the reason, and marks the finding's resolution as partial. It adds evidence; it never removes a
 // finding or changes its severity.
 
-import { sourceInfo } from './haskell-models.js';
+import { sourceInfo, paramSourceInfo } from './haskell-models.js';
 
 const OPAQUE = {
   unknown: (c) => ({ kind: 'unresolved-target', detail: `${c.callee}: ${(c.hs && c.hs.reason) || 'unresolved'}` }),
@@ -111,6 +111,10 @@ export function buildChain(fn, finding) {
   const steps = [];
   const seen = new Set();
   let source = null;
+  // A parameter the IR annotated as a source (a request value handed to a framework handler, or caller-supplied text of an exported function) has no
+  // read call to point at: the flow starts at the function head, and the label says which kind of source it is.
+  const annotated = new Map((fn.paramAnnotations || []).map((a) => [a.name, a.decorator]));
+  let paramSource = null;
   const queue = [{ expr: arg, before: sinkNodeIdx }];
   let guard = 0;
   while (queue.length && !source && guard++ < 300) {
@@ -121,6 +125,10 @@ export function buildChain(fn, finding) {
     if (source) break;
     for (const name of identsOf(expr)) {
       const root = name.replace(/\.[^.]*$/, '');
+      if (!paramSource && (annotated.has(name) || annotated.has(root))) {
+        const info = paramSourceInfo(annotated.get(name) || annotated.get(root));
+        if (info) paramSource = { line: fn.line, label: info.label, provenance: info.provenance || undefined, viaParameter: true };
+      }
       for (let i = Math.min(before, nodes.length) - 1; i >= 0; i--) {
         const n = nodes[i];
         if (n.kind !== 'assign' || typeof n.target !== 'string' || !n.source) continue;
@@ -133,9 +141,10 @@ export function buildChain(fn, finding) {
       }
     }
   }
+  if (!source && paramSource) source = paramSource;
   if (!source) return null;
   const ordered = steps.filter((s) => s.line !== source.line || s.label).sort((a, b) => a.line - b.line);
-  return [{ line: source.line, label: source.label, provenance: source.provenance }, ...ordered.filter((s) => s.line > source.line)];
+  return [{ line: source.line, label: source.label, provenance: source.provenance, ...(source.viaParameter ? { viaParameter: true } : {}) }, ...ordered.filter((s) => s.line > source.line)];
 }
 
 /** A callee as text. A Haskell finding carries a string; an IR finding carries `{kind:'ident', name}` or `{kind:'member', object, prop}`. */
@@ -157,7 +166,8 @@ function appendSinkStep(f) {
   const sinkLine = (f.sink && f.sink.line) || f.line;
   const last = f.chain[f.chain.length - 1];
   if (!Number.isInteger(sinkLine) || (last && last.kind === 'sink')) return;
-  if (last && last.line === sinkLine && (last.file || f.file) === sinkFile && !/^source|standard input|stdin|argument|environment/i.test(String(last.label || ''))) { last.kind = 'sink'; return; }
+  // the first element of a chain is always the source: when the source and the sink share a line it stays the source and the sink is added after it
+  if (f.chain.length > 1 && last && last.line === sinkLine && (last.file || f.file) === sinkFile && !/^source|standard input|stdin|argument|environment/i.test(String(last.label || ''))) { last.kind = 'sink'; return; }
   f.chain.push({ file: sinkFile, line: sinkLine, label: `sink: ${calleeText(f.callee).replace(/^.*\./, '') || 'call'}`, kind: 'sink' });
 }
 
@@ -174,7 +184,9 @@ export function attachEvidenceChains(findings, perFile) {
     if (!chain || !chain.length) continue;
     f.chain = chain.map((c) => ({ file: f.file, line: c.line, label: c.label, ...(c.provenance ? { provenance: c.provenance } : {}) }));
     appendSinkStep(f);
-    f.source = { file: f.file, line: chain[0].line, label: chain[0].label };
+    // a parameter source is marked `kind: 'parameter'`: it is not part of the finding's stable identity (`posture/stable-id.js`), so findings that
+    // already existed keep their ids when the source is first named
+    f.source = { file: f.file, line: chain[0].line, label: chain[0].label, ...(chain[0].viaParameter ? { kind: 'parameter' } : {}) };
     if (chain[0].provenance) f.sourceProvenance = chain[0].provenance;
     n++;
   }

package/src/language/haskell-findings.js

@@ -4,6 +4,7 @@
 // finding is distinguishable, filterable and compliance-mappable without a second finding schema.
 
 import { HS_MODEL_VERSION } from './haskell-models.js';
+import { codeOfLine } from './haskell-comments.js';
 
 const HS_FILE = /\.(?:hs|lhs|hsc)$/i;
 
@@ -32,7 +33,7 @@ export function annotateHaskellFindings(findings, fileContents = null) {
     if (!f || !isHaskellFile(f.file)) continue;
     if (!f.snippet && fileContents && typeof fileContents[f.file] === 'string' && Number.isInteger(f.line) && f.line >= 1) {
       const text = fileContents[f.file].split('\n')[f.line - 1];
-      if (typeof text === 'string') f.snippet = text.trim().slice(0, 240);
+      if (typeof text === 'string') f.snippet = codeOfLine(text).slice(0, 240);
     }
     f.language = 'haskell';
     f.capability = f.capability || 'taint';

package/src/language/haskell-fix.js

@@ -124,7 +124,19 @@ function findCall(lineText, names) {
   return m ? { prefix: m[1], name: m[2], index: m.index, after: m.index + m[0].length } : null;
 }
 
+// The database driver whose `execute`/`query`/`Only` the rewrite uses is the one the FILE already imports: a hard-coded driver would add an
+// import of a library the project may not depend on, and a patch that compiles against nothing is not a fix. Only the two drivers whose
+// `execute_`/`query_`/`execute`/`query`/`Only` API is identical are rewritten; any other (mysql-simple, HDBC, persistent) or two at once is refused.
+const SQL_DRIVERS = Object.freeze(['Database.PostgreSQL.Simple', 'Database.SQLite.Simple']);
+const OTHER_SQL = /^import\s+(?:qualified\s+)?Database\.(?:MySQL|HDBC|Persist|Beam|Opaleye|Selda|Esqueleto|SQLite3|PostgreSQL\.LibPQ)/m;
+export function sqlDriverOf(text) {
+  const used = SQL_DRIVERS.filter((m) => importInfo(text, m));
+  return used.length === 1 && !OTHER_SQL.test(text) ? used[0] : null;
+}
+
 function fixSql(text, f) {
+  const driver = sqlDriverOf(text);
+  if (!driver) return null;
   const lb = lineBounds(text, f.line);
   const call = findCall(lb.text, ['execute_', 'query_']);
   if (!call) return null;
@@ -144,7 +156,7 @@ function fixSql(text, f) {
     if (q) { sql = sql.slice(0, -1); parts[i + 1] = { lit: after.lit.slice(1) }; }
     sql += '?'; params.push(p.var);
   }
-  const imp = ensureImport(text, 'Database.PostgreSQL.Simple', ['execute', 'query', 'Only']);
+  const imp = ensureImport(text, driver, ['execute', 'query', 'Only']);
   if (!imp) return null;
   const only = `${call.prefix || imp.prefix}Only`;
   const tuple = params.length === 1 ? `(${only} ${params[0]})` : `(${params.join(', ')})`;
@@ -214,6 +226,9 @@ function fixProcess(text, f) {
 }
 
 function fixHtml(text, f) {
+  // `preEscapedToHtml` and `toHtml` are blaze-html's pair (Yesod and the shakespeare packages re-export them); another library's raw-markup call has a
+  // different name and a different escaping function, so a file that does not import blaze or one of its re-exporters is not rewritten.
+  if (!/^import\s+(?:qualified\s+)?(?:Text\.Blaze|Yesod|Text\.Hamlet)/m.test(text)) return null;
   const lb = lineBounds(text, f.line);
   const m = /(?<![\w'.])((?:[A-Z][\w']*\.)?)preEscapedToHtml(?![\w'])/.exec(lb.text);
   if (!m) return null;
@@ -227,12 +242,98 @@ function fixWeakHash(text, f) {
   const lb = lineBounds(text, f.line);
   const re = /(?<![\w'.])(MD5|SHA1)(?![\w'.])/g;
   if (!re.test(lb.text)) return null;
+  // The algorithm is often a TYPE as well (`Digest MD5` in a signature, an annotation on another line): replacing it on one line only leaves a
+  // type error behind. Any other mention outside the import list means the rewrite is not provably the same program, so it is not made.
+  const elsewhere = text.split('\n').some((l, i) => i !== f.line - 1 && !/^import\s/.test(l) && /(?<![\w'.])(MD5|SHA1)(?![\w'.])/.test(l));
+  if (elsewhere) return null;
   const imp = ensureImport(text, 'Crypto.Hash', ['SHA256(..)']); if (!imp) return null;
   const repl = lb.text.replace(/(?<![\w'.])(MD5|SHA1)(?![\w'.])/g, 'SHA256');
   const next = applyImportDelta(text, imp.text, splice(text, lb.start, lb.end, repl));
   return { ruleId: 'hs-hash-sha256', label: 'FULL', text: next, explanation: 'MD5/SHA-1 replaced by SHA-256. Digests change: anything that stored or compares old digests must be migrated.', behavior: { kind: 'hash', from: ['MD5', 'SHA1'], to: 'SHA256' } };
 }
 
+
+// ── path traversal ───────────────────────────────────────────────────────────
+// `readFile ("/srv/data/" ++ name)` -> `readFile ("/srv/data/" ++ takeFileName name)` when `name` is a String/FilePath PARAMETER of the enclosing function.
+// The rewrite is a mitigation, not an equivalence: a name that carried directories now keeps only its last segment, and `.` / `..` survive
+// `takeFileName`, which is why directory operations are not rewritten (only operations on a file). Every other shape is a proposal.
+const PATH_FILE_OPS = ['readFile', 'writeFile', 'appendFile', 'removeFile', 'doesFileExist', 'openFile', 'withFile', 'openBinaryFile', 'withBinaryFile', 'getFileSize', 'getModificationTime'];
+
+/** Splits `a ++ b </> c` at its top-level `++` / `<>` / `</>` operators, keeping the operator text: [part, op, part, ...] or null. */
+function splitOperators(expr) {
+  const out = []; let depth = 0; let start = 0;
+  for (let i = 0; i < expr.length; i++) {
+    const c = expr[i];
+    if (c === '"') { const e = atomEnd(expr, i); if (e < 0) return null; i = e - 1; continue; }
+    if (c === '(' || c === '[') depth++;
+    else if (c === ')' || c === ']') depth--;
+    else if (depth === 0) {
+      const m = /^\s*(\+\+|<>|<\/>)\s*/.exec(expr.slice(i));
+      if (m && (i === start || /\s/.test(expr[i]) || true)) { out.push(expr.slice(start, i), m[0]); i += m[0].length - 1; start = i + 1; }
+    }
+  }
+  out.push(expr.slice(start));
+  return out;
+}
+
+/** The declared types of the parameters of the top-level function containing `line`: { name -> type text }, from its signature and first clause. */
+function paramTypesAt(text, line) {
+  const lines = text.split('\n');
+  let clause = -1;
+  for (let i = Math.min(line - 1, lines.length - 1); i >= 0; i--) if (/^[a-z_][\w']*\b[^:\n]*=/.test(lines[i]) && !/^[a-z_][\w']*\s*::/.test(lines[i])) { clause = i; break; }
+  if (clause < 0) return null;
+  const m = /^([a-z_][\w']*)([^=]*)=/.exec(lines[clause]);
+  if (!m) return null;
+  const name = m[1]; const params = m[2].trim() ? m[2].trim().split(/\s+/) : [];
+  if (params.some((p) => !/^[a-z_][\w']*$/.test(p))) return null;      // a pattern, not a plain name: not judged
+  const sigLine = lines.findIndex((l) => new RegExp(`^${name}\\s*::`).test(l));
+  if (sigLine < 0) return null;
+  let sig = lines[sigLine].replace(/^[^:]*::/, '');
+  for (let j = sigLine + 1; j < lines.length && /^\s+\S/.test(lines[j]) && !/^[a-z_][\w']*\s*(::|=)/.test(lines[j]); j++) sig += ` ${lines[j].trim()}`;
+  sig = sig.replace(/^.*=>/, '');
+  const types = []; let depth = 0; let cur = '';
+  for (let i = 0; i < sig.length; i++) {
+    const c = sig[i];
+    if (c === '(' || c === '[') depth++; else if (c === ')' || c === ']') depth--;
+    if (depth === 0 && sig.startsWith('->', i)) { types.push(cur.trim()); cur = ''; i++; continue; }
+    cur += c;
+  }
+  types.push(cur.trim());
+  const out = {};
+  params.forEach((p, i) => { if (types[i] !== undefined) out[p] = types[i]; });
+  return out;
+}
+
+function fixPath(text, f) {
+  const lb = lineBounds(text, f.line);
+  const call = findCall(lb.text, PATH_FILE_OPS);
+  if (!call) return null;
+  let aStart = call.after; while (lb.text[aStart] === ' ') aStart++;
+  let aEnd;
+  if (lb.text[aStart] === '$') { aStart++; while (lb.text[aStart] === ' ') aStart++; aEnd = lb.text.length; }
+  else aEnd = atomEnd(lb.text, aStart);
+  if (aEnd < 0) return null;
+  const arg = lb.text.slice(aStart, aEnd);
+  const inner = trimParens(arg);
+  const parts = splitOperators(inner);
+  if (!parts || parts.length < 3) return null;
+  const operands = parts.filter((_, i) => i % 2 === 0).map((x) => trimParens(x));
+  if (!operands.some((o) => STRING.test(o))) return null;                       // no fixed part: a pass-through, not a construction
+  const vars = operands.filter((o) => !STRING.test(o));
+  if (!vars.length || vars.some((v) => !IDENT.test(v))) return null;
+  const types = paramTypesAt(text, f.line);
+  if (!types || vars.some((v) => !/^(?:String|FilePath)$/.test(types[v] || ''))) return null;   // takeFileName takes a String: any other type would not compile
+  if (new RegExp(`(?<![\\w'.])takeFileName\\s+(?:${vars.join('|')})(?![\\w'])`).test(lb.text)) return null;
+  const imp = ensureImport(text, 'System.FilePath', ['takeFileName']); if (!imp) return null;
+  const fn = `${imp.prefix}takeFileName`;
+  let rebuilt = '';
+  parts.forEach((part, i) => { rebuilt += i % 2 === 1 ? part : (vars.includes(trimParens(part)) ? part.replace(trimParens(part), `${fn} ${trimParens(part)}`) : part); });
+  const wrapped = arg.startsWith('(') && atomEnd(arg, 0) === arg.length ? `(${rebuilt})` : rebuilt;
+  const replaced = lb.text.slice(0, aStart) + wrapped + lb.text.slice(aEnd);
+  const next = applyImportDelta(text, imp.text, splice(text, lb.start, lb.end, replaced));
+  return { ruleId: 'hs-path-takefilename', label: 'MITIGATION', text: next, explanation: `Applied takeFileName to ${vars.join(', ')} so only its last path segment is used under the fixed directory. A value that carried subdirectories now names a file directly inside it; "." and ".." survive takeFileName, so this is not applied to directory operations.`, behavior: { kind: 'path', sanitizer: 'takeFileName', vars } };
+}
+
 const LOG_CALLS = ['putStrLn', 'putStr', 'hPutStrLn', 'hPutStr', 'print', 'trace', 'traceShow', 'traceShowId', 'logInfoN', 'logDebugN', 'logWarnN', 'logErrorN', 'logInfo', 'logDebug', 'logWarn', 'logError'];
 function fixLogging(text, f) {
   const lb = lineBounds(text, f.line);
@@ -256,6 +357,7 @@ const FIXERS = [
   { id: 'hs-html-escape', applies: (f) => f.cwe === 'CWE-79', run: fixHtml },
   { id: 'hs-hash-sha256', applies: (f) => f.cwe === 'CWE-328' || f.rule === 'hs-weak-hash', run: fixWeakHash },
   { id: 'hs-log-redact', applies: (f) => f.cwe === 'CWE-532' || f.rule === 'hs-sensitive-logging', run: fixLogging },
+  { id: 'hs-path-takefilename', applies: (f) => f.cwe === 'CWE-22', run: fixPath },
 ];
 export const SUPPORTED_FIX_IDS = Object.freeze(FIXERS.map((x) => x.id));
 
@@ -300,9 +402,23 @@ export function planHaskellFix(finding, files) {
       if (r && r.text && r.text !== before) return { ok: true, ruleId: r.ruleId, label: r.label, file: finding.file, before, after: r.text, explanation: r.explanation, behavior: r.behavior, ...(line !== finding.line ? { fixedAtLine: line } : {}) };
     }
   }
-  return { ok: false, reason: 'no deterministic fix is supported for this exact shape', proposal: 'model-assisted' };
+  return { ok: false, reason: CLASS_REASONS[finding.cwe] || 'no deterministic fix is supported for this exact shape', proposal: 'model-assisted' };
 }
 
+// Classes whose repair needs a choice the code does not contain (a policy, a library, a limit). The scanner reports them; it does not guess.
+const CLASS_REASONS = Object.freeze({
+  'CWE-918': 'server-side request forgery is fixed by an allow-list of hosts or a resolved-address policy, which is a decision about this service, not a rewrite of this line',
+  'CWE-88': 'argument injection is fixed by validating the value against what the program accepts; inserting "--" only helps programs that honour it, so no patch is made',
+  'CWE-916': 'password hashing needs a memory-hard or iterated KDF (Argon2id, scrypt, bcrypt, PBKDF2) from a library the project may not depend on, and existing stored hashes must be migrated',
+  'CWE-338': 'a predictable generator is replaced by the operating system CSPRNG (Crypto.Random), whose result type differs from System.Random: the surrounding code must change with it',
+  'CWE-1004': 'cookie attributes live in different places for each framework (a record field, a header string, a helper); the rewrite is not provably the same program',
+  'CWE-306': 'a missing authentication check needs a policy (which credential, which rejection); the scanner reports the handler and does not invent the guard',
+  'CWE-770': 'a resource limit is a number only the operator can choose (how many bytes, how many requests)',
+  'CWE-295': 'enabling certificate validation can break connections the project depends on; the trust store to use is a deployment decision',
+  'CWE-798': 'a hard-coded secret must be rotated and moved to a secret store; rewriting the line would leave the leaked value valid',
+  'CWE-611': 'XML entity handling depends on the parser configuration in use',
+});
+
 // ── gates ────────────────────────────────────────────────────────────────────
 const key = (f) => `${f.file}|${f.cwe || ""}`;