@clear-capabilities/agentic-security-scanner 0.186.2 → 0.188.0

package/src/language/haskell-trust.js

@@ -0,0 +1,268 @@
+// Trust-boundary adjudication of Haskell taint findings.
+//
+// A taint finding says "data from a SOURCE reaches a SINK". Whether that is a vulnerability depends on whether the party that controls the
+// source is a different party from the one the program runs for. This module reads the origins the taint engine recorded for each finding
+// (`sourceRoots`, or the evidence chain) and decides, from code facts only, which side of that line they sit on:
+//
+//   attacker-reachable    a request, a socket, a header, a cookie, a remote response: the peer is not the operator
+//   operator-controlled   command-line arguments and environment variables (the person who starts the process chooses them), and, in a
+//                         command-line program, standard input and the files it is pointed at: no boundary is crossed. The finding
+//                         is lowered to `info`, never dropped
+//   api-contract          the value is a parameter of an exported function that nothing in the analysed code calls, and the function
+//                         hands it WHOLE (or as the root it appends fixed text to) to a path or command operation: a thin wrapper.
+//                         The caller chose what to read or run, and the wrapper has no fixed part to escape from. Lowered to `info`
+//   entry-parameter       a parameter of such a function used inside a larger value the function builds: its own construction, kept
+//   data-input            standard input or a file's content in a service or a library: data the program processes, kept
+//   unattributed          the engine recorded no origin: kept
+//
+// A command-line program is one reached only from `main`s whose reachable modules import no server framework or socket library
+// (`entryRole` in haskell-ir.js). The role is a fact about the call graph, not about a name or a path.
+//
+// Nothing here reads a comment, a name or a path: the inputs are the recorded origins, the lowered expression at the sink and the
+// parameter annotations the IR derived from the signature.
+
+import { findSites, identNames } from './haskell-guards.js';
+
+export const TRUST_VERDICTS = Object.freeze(['attacker-reachable', 'operator-controlled', 'api-contract', 'entry-parameter', 'data-input', 'unattributed']);
+
+const OPERATOR = new Set(['cli', 'env']);
+const EXTERNAL = new Set(['http-body', 'url-param', 'path-param', 'header', 'cookie', 'network']);
+const DATA = new Set(['stdin', 'file-read']);
+const WEAK_PARAM_LABEL = /\(caller-controlled\)$/;
+const WRAPPER_FAMILIES = new Set(['CWE-78', 'CWE-88']);
+const CONVERSIONS = /(?:^|\.)(?:pack|unpack|fromString|toString|show|encodeUtf8|decodeUtf8|toStrict|fromStrict|toText|unpackFS|fromText)$/;
+const PATH_JOIN = /(?:^|\.)(?:<\/>|combine|joinPath|<\.>)$/;
+// list plumbing that only lays the parameters out as text (`unwords args`, `concatMap (' ':) args`): no fixed words are added
+const LIST_LAYOUT = /(?:^|\.)(?:unwords|unlines|intercalate|concatMap|concat|map|fmap)$/;
+const SPEC_CTORS = new Set(['System.Process.shell', 'System.Process.proc', 'System.Process.Typed.shell', 'System.Process.Typed.proc']);
+const hasAlnum = (v) => /[A-Za-z0-9]/.test(String(v));
+
+function rootsOf(f) {
+  // A hop through a function's return that names no origin behind it (`interproc`, `param`) is not an origin.
+  if (Array.isArray(f.sourceRoots) && f.sourceRoots.length) return f.sourceRoots.filter((r) => r && r.provenance !== 'interproc' && r.provenance !== 'param').map((r) => ({ label: r.label, provenance: r.provenance || null, ...(r.file ? { file: r.file } : {}), ...(Number.isInteger(r.line) ? { line: r.line } : {}) }));
+  const out = [];
+  for (const c of f.chain || []) {
+    if (!c || !c.label || c.kind === 'sink') continue;
+    if (c.provenance === 'interproc' || c.provenance === 'param') continue;
+    out.push({ label: c.label, provenance: c.provenance || null });
+  }
+  if (!out.length && f.source && f.source.label && !/^(?:interproc-return:|parameter )/.test(f.source.label)) out.push({ label: f.source.label, provenance: f.sourceProvenance || null });
+  return out;
+}
+
+const classOf = (r) => {
+  if (r.provenance && OPERATOR.has(r.provenance)) return 'operator';
+  if (r.provenance && EXTERNAL.has(r.provenance)) return 'external';
+  if (r.provenance && DATA.has(r.provenance)) return 'data';
+  if (WEAK_PARAM_LABEL.test(String(r.label || ''))) return 'weak-param';
+  return 'other';
+};
+
+// The expression a sink was handed, with the conversions that only change its type (`unpack`, `fromString`, `show`) peeled off.
+function peel(e, depth = 0) {
+  while (e && e.kind === 'call' && depth++ < 8 && typeof e.callee === 'string' && CONVERSIONS.test(e.callee) && (e.args || []).length === 1) e = e.args[0];
+  return e;
+}
+
+// Flatten a concatenation / path join into its operands, left to right.
+function operandsOf(e, out = [], depth = 0, resolve = null) {
+  e = peel(e);
+  if (!e || depth > 12) { out.push(e); return out; }
+  if (resolve && e.kind === 'ident') { const r = resolve(e); if (r && r !== e) return operandsOf(r, out, depth + 1, resolve); }
+  if (e.kind === 'binary' && e.hs && e.hs.concat) { operandsOf(e.left, out, depth + 1, resolve); operandsOf(e.right, out, depth + 1, resolve); return out; }
+  if (e.kind === 'binary' && (e.op === '</>' || e.op === '<>' || e.op === '++')) { operandsOf(e.left, out, depth + 1, resolve); operandsOf(e.right, out, depth + 1, resolve); return out; }
+  if (e.kind === 'call' && typeof e.callee === 'string' && PATH_JOIN.test(e.callee) && (e.args || []).length === 2) { operandsOf(e.args[0], out, depth + 1, resolve); operandsOf(e.args[1], out, depth + 1, resolve); return out; }
+  out.push(e);
+  return out;
+}
+
+/**
+ * Is the sink argument a value the function merely passes on? True when every non-literal operand is one of `params` (or list plumbing over
+ * them) and either (a) nothing in the value is fixed text that names something (only separators), or (b) for a path, the parameter is the
+ * LEFTMOST operand, so it chooses the whole location and the fixed tail is only a file name inside it.
+ */
+export function isPassThrough(arg, params, family, resolve = null) {
+  const ops = operandsOf(arg, [], 0, resolve);
+  if (!ops.length || ops.some((o) => !o)) return false;
+  const dyn = ops.filter((o) => o.kind !== 'literal');
+  if (!dyn.length) return false;
+  // a dynamic operand is acceptable when it is made only of parameters and separators (a list laid out as text, a member of a parameter)
+  const ok = (o, depth = 0) => {
+    if (!o || depth > 10) return false;
+    if (o.kind === 'literal') return !hasAlnum(o.value);
+    if (o.kind === 'ident') return params.has(o.name);
+    if (o.kind === 'member') return ok(o.object, depth + 1);
+    if (o.kind === 'array') return o.elements.length > 0 && o.elements.every((x) => ok(x, depth + 1));
+    if (o.kind === 'call' && typeof o.callee === 'string' && LIST_LAYOUT.test(o.callee)) return (o.args || []).length > 0 && o.args.every((x) => ok(x, depth + 1));
+    return false;
+  };
+  if (!dyn.every((o) => ok(o))) return false;
+  const namedLiteral = ops.some((o) => o.kind === 'literal' && hasAlnum(o.value));
+  if (!namedLiteral) return true;
+  return family === 'path' && ops[0].kind === 'ident' && params.has(ops[0].name);
+}
+
+function weakParamsOf(fn) {
+  const out = new Set();
+  for (const a of fn.paramAnnotations || []) if (a && a.decorator === 'hs:caller-controlled' && a.name) out.add(a.name);
+  return out;
+}
+
+// A local name bound exactly once (`let cmd = exe <> " " <> args`) stands for its definition when the sink argument is judged.
+function localResolver(fn) {
+  const defs = new Map();
+  for (const n of Object.values(fn.cfg.nodes)) if (n.kind === 'assign' && typeof n.target === 'string' && n.source) defs.set(n.target, [...(defs.get(n.target) || []), n.source]);
+  const params = new Set(Array.isArray(fn.params) ? fn.params : []);
+  return (e) => (e && e.kind === 'ident' && !params.has(e.name) && defs.has(e.name) && defs.get(e.name).length === 1 ? defs.get(e.name)[0] : e);
+}
+
+const fnByQid = (perFile, qid) => {
+  if (!qid) return null;
+  const file = String(qid).split('::')[0];
+  const ir = perFile && perFile[file];
+  return ir ? ir.functions.find((x) => x.qid === qid) || null : null;
+};
+
+// The role the IR gave the function the finding was found in: `cli` (reached only from mains that import no server framework), `service`, or
+// `library` (no main reaches it, or the walk could not).
+function roleOf(f, perFile) {
+  const fn = fnByQid(perFile, f._funcQid);
+  return (fn && fn.hs && fn.hs.entryRole) || 'library';
+}
+
+// The function that holds the sink call, and the sink's argument expressions there. A finding found while analysing a CALLER (its `_funcQid`) is
+// located at the callee's line; the sink function is the one in the finding's file that has the call at that line.
+function locateSink(perFile, f) {
+  const ir = perFile && perFile[f.file];
+  if (!ir || !f.callee) return null;
+  const direct = fnByQid(perFile, f._funcQid);
+  const candidates = direct && direct.file === f.file ? [direct, ...ir.functions.filter((x) => x !== direct)] : ir.functions;
+  for (const fn of candidates) {
+    const sites = findSites(fn, f.callee, f.line);
+    if (sites.length) return { fn, sites };
+  }
+  return null;
+}
+
+/**
+ * Is this finding a thin wrapper's pass-through? `weakParams` are the caller-controlled parameters of the function the engine analysed. When the
+ * sink sits in a callee, the callee must itself hand its own parameter on whole, and every call of it from the analysed function must pass
+ * values built only from that function's caller-controlled parameters (one hop; a longer chain is not judged).
+ */
+function passThroughVerdict(perFile, f) {
+  if (!WRAPPER_FAMILIES.has(f.cwe)) return null;
+  const family = f.cwe === 'CWE-22' ? 'path' : 'cmd';
+  const sink = locateSink(perFile, f);
+  if (!sink) return null;
+  const argIdx = Number.isInteger(f.argIndex) ? f.argIndex : 0;
+  let args = sink.sites.map((s) => (s.call.args || [])[argIdx]).filter(Boolean);
+  // A process is started from a SPEC value (`createProcess ((shell cmd) { cwd = d })`): what decides the verdict is what the spec constructor
+  // was handed, so the constructor's own arguments are judged instead of the record update around it.
+  const specArgs = [];
+  const findSpecs = (e, d = 0) => {
+    if (!e || typeof e !== 'object' || d > 20) return;
+    if (e.kind === 'call' && typeof e.callee === 'string' && SPEC_CTORS.has(e.callee)) { for (const a of (e.args || []).slice(0, 2)) if (a) specArgs.push(a); return; }
+    for (const k of ['left', 'right', 'object', 'value']) if (e[k] && typeof e[k] === 'object') findSpecs(e[k], d + 1);
+    for (const k of ['args', 'elements', 'branches']) if (Array.isArray(e[k])) e[k].forEach((x) => findSpecs(x, d + 1));
+    if (Array.isArray(e.props)) for (const p of e.props) findSpecs(p && p.value, d + 1);
+  };
+  for (const a of args) findSpecs(a);
+  if (specArgs.length) args = specArgs;
+  if (!args.length) return null;
+  const analysed = fnByQid(perFile, f._funcQid);
+  if (!analysed) return null;
+  if (sink.fn.qid === analysed.qid) {
+    const weak = weakParamsOf(analysed);
+    if (!weak.size) return null;
+    const own = new Set(Array.isArray(analysed.params) ? analysed.params : []);
+    const res = localResolver(analysed);
+    return args.every((a) => isPassThrough(a, own, family, res)) && args.some((a) => { const seen = new Set(); const walkIds = (e, d = 0) => { if (!e || d > 12) return; if (e.kind === 'ident') seen.add(e.name); for (const k of ['left', 'right', 'object', 'value']) if (e[k] && typeof e[k] === 'object') walkIds(e[k], d + 1); for (const k of ['args', 'elements']) if (Array.isArray(e[k])) e[k].forEach((x) => walkIds(x, d + 1)); }; let x = a; for (let i = 0; i < 4; i++) { const r = res(x); if (r === x) break; x = r; } walkIds(x); return [...seen].some((n) => weak.has(n)); }) ? 'direct' : null;
+  }
+  // the sink is in a callee
+  const own = new Set(Array.isArray(sink.fn.params) ? sink.fn.params : []);
+  const ownVars = [...new Set(args.flatMap((a) => [...identNames(a)]))];
+  if (!own.size || !ownVars.length || !ownVars.every((v) => own.has(v)) || !args.every((a) => isPassThrough(a, own, family))) return null;
+  const weak = weakParamsOf(analysed);
+  if (!weak.size) return null;
+  const calls = findCallsTo(analysed, sink.fn);
+  if (!calls.length) return null;
+  const used = new Set(ownVars);
+  for (const call of calls) {
+    for (let i = 0; i < (call.args || []).length; i++) {
+      const p = sink.fn.params[i];
+      if (!p || !used.has(p)) continue;
+      const a = call.args[i];
+      if (!a) return null;
+      if (a.kind === 'literal') continue;
+      if (!isPassThrough(a, weak, family)) return null;
+    }
+  }
+  return 'chain';
+}
+
+function findCallsTo(fn, target) {
+  const out = [];
+  const visit = (e, d) => {
+    if (!e || typeof e !== 'object' || d > 50) return;
+    if (e.kind === 'call' && e.callee === target.name) out.push(e);
+    for (const k of ['left', 'right', 'object', 'value', 'callee']) if (e[k] && typeof e[k] === 'object') visit(e[k], d + 1);
+    for (const k of ['args', 'elements', 'branches', 'parts']) if (Array.isArray(e[k])) for (const x of e[k]) visit(x, d + 1);
+    if (Array.isArray(e.props)) for (const p of e.props) visit(p && p.value, d + 1);
+  };
+  for (const n of Object.values(fn.cfg.nodes)) {
+    if (n.kind === 'call' && n.callee === target.name) out.push({ kind: 'call', callee: n.callee, args: n.args || [] });
+    for (const k of ['source', 'value', 'cond']) if (n[k]) visit(n[k], 0);
+    if (Array.isArray(n.args)) for (const a of n.args) visit(a, 0);
+  }
+  return out;
+}
+
+/**
+ * Stamps `trustBoundary` on every Haskell IR-TAINT finding and lowers to `info` the verdicts that name no boundary crossed
+ * (`operator-controlled`, `api-contract`). Mutates the findings; returns counts.
+ */
+export function applyTrustBoundary(findings, perFile) {
+  const stats = { attackerReachable: 0, operatorControlled: 0, apiContract: 0, entryParameter: 0, dataInput: 0, unattributed: 0 };
+  for (const f of findings || []) {
+    if (!f || f.parser !== 'IR-TAINT' || !/\.(?:l?hs|hsc)$/i.test(String(f.file || ''))) continue;
+    const roots = rootsOf(f);
+    const classes = new Set(roots.map(classOf));
+    const role = roleOf(f, perFile);
+    let verdict;
+    let reason;
+    let inferred = false;
+    if (classes.has('external')) { verdict = 'attacker-reachable'; reason = 'a request, socket, header, cookie or remote response supplies the value'; }
+    else if (roots.length && [...classes].every((c) => c === 'operator')) {
+      verdict = 'operator-controlled';
+      reason = 'only command-line arguments or environment variables supply the value; whoever starts the program chooses them, so no trust boundary is crossed';
+    } else if (roots.length && role === 'cli' && roots.every((r) => r.provenance === 'file-read' || OPERATOR.has(r.provenance))) {
+      verdict = 'operator-controlled';
+      reason = 'the function belongs to a command-line program (reached from a main that imports no server framework) and the value comes from files the person running it pointed the program at, or from its arguments and environment; standard input is not covered by this rule';
+    } else if (classes.has('data')) { verdict = 'data-input'; reason = 'standard input or file content supplies the value'; }
+    else if (classes.has('weak-param')) {
+      verdict = 'entry-parameter';
+      reason = 'a parameter of an exported function that nothing in the analysed code calls';
+      const pt = passThroughVerdict(perFile, f);
+      if (pt) { verdict = 'api-contract'; reason = 'the function hands its parameter on whole (or as the root of a fixed tail) to a path or command operation: a thin wrapper, whose caller chose what to read or run'; }
+    } else if (!roots.length && role === 'cli') {
+      // No origin was recorded. Every external origin the model knows (a request, a socket, a remote response) is recorded when it is read, so
+      // an empty record in a command-line program means the value came from the operator's side: its arguments, environment, files or
+      // configuration reached the sink through a path the engine could not attribute. Stated as an inference on the finding.
+      verdict = 'operator-controlled';
+      reason = 'no origin was recorded for the tainted value and the function belongs to a command-line program; no request, socket or remote-response read feeds it (inferred, not proven)';
+      inferred = true;
+    } else { verdict = 'unattributed'; reason = roots.length ? 'the recorded origins are not classified' : 'the engine recorded no origin for the value'; }
+
+    f.trustBoundary = { verdict, reason, role, ...(inferred ? { inferred: true } : {}), roots: roots.slice(0, 5) };
+    const key = verdict.replace(/-(\w)/g, (_, c) => c.toUpperCase());
+    stats[key] = (stats[key] || 0) + 1;
+    if ((verdict === 'operator-controlled' || verdict === 'api-contract') && !f._trustLowered) {
+      f._trustLowered = true;
+      f.originalSeverity = f.originalSeverity || f.severity;
+      f.severity = 'info';
+      f.controls = [...(f.controls || []), { kind: verdict === 'operator-controlled' ? 'operator-controlled-input' : 'api-contract-wrapper', evidenceKind: 'source' }];
+      f.guardNote = { kind: verdict, reason };
+    }
+  }
+  return stats;
+}

package/src/language/haskell-web.js

@@ -19,6 +19,7 @@
 //     is recorded as `unknown` coverage, never as protected and never omitted.
 
 import { buildHaskellIR, lowerHandlerExpr, resolveName } from './haskell-ir.js';
+import { codeOfLine } from './haskell-comments.js';
 import { qualifyAmbiguous, HS_WEB_FRAMEWORKS, HS_WEB_MODEL_VERSION, modelStatus } from './haskell-models.js';
 
 export const HS_WEB_RULES_VERSION = 'haskell-web-rules/1';
@@ -267,6 +268,7 @@ function kidsIr(e) {
   for (const k of ['left', 'right', 'object', 'value']) if (e[k] && typeof e[k] === 'object') out.push(e[k]);
   for (const k of ['args', 'elements', 'branches', 'parts']) if (Array.isArray(e[k])) out.push(...e[k]);
   if (Array.isArray(e.props)) for (const p of e.props) if (p && p.value) out.push(p.value);
+  if (e.hs && e.hs.inner && typeof e.hs.inner === 'object') out.push(e.hs.inner);   // `oid :: Int`: a number to the taint engine, still the id it names here
   return out;
 }
 function* walkIr(e, depth = 0) { if (!e || typeof e !== 'object' || depth > 80) return; yield e; for (const c of kidsIr(e)) yield* walkIr(c, depth + 1); }
@@ -295,6 +297,8 @@ function handlerFacts(ctx, fn, opts = {}) {
     if (n.kind === 'if' && n.cond) conds.push(n.cond);
     for (const root of exprsOfNode(n)) for (const e of walkIr(root)) {
       if (e.kind === 'call' && typeof e.callee === 'string') ordered.push({ call: e, line: e.line || n.line, node: n });
+      // `when (owner /= principal) notFound`, `unless (owner == principal) (permissionDenied ..)`: the condition is the first argument of the call
+      if (e.kind === 'call' && /(?:^|\.)(?:when|unless)$/.test(e.callee || '') && e.args && e.args[0]) conds.push(e.args[0]);
       if (e.kind === 'union' && e.hs && e.hs.branchConds) for (const bc of e.hs.branchConds) conds.push(bc.cond);
     }
   }
@@ -349,6 +353,9 @@ function handlerFacts(ctx, fn, opts = {}) {
     const hard = allCalls.findIndex((r) => r !== rd.call && isRejection(r) && !SCOTTY_STATUS.test(r.callee) && stopsHandler(r, allCalls));
     if (hard >= 0) { inlineIdx = hard; inlineKind = rd.kind; inlineLine = allCalls[hard].line; inlineCallee = rd.callee; inlineRejectCallee = allCalls[hard].callee; break; }
   }
+  // A credential read and a rejection that ends the handler exist, but the rejection is not before the first sensitive operation BY LINE (a `case`
+  // lists the success branch first and the rejecting branch last). Their order is then a question about control flow, answered from the syntax tree.
+  const inlineCandidate = reads.length > 0 && allCalls.some((r) => isRejection(r) && stopsHandler(r, allCalls));
   const principals = new Set();
   for (const a of assigns) if (a.source.kind === 'call' && isGuardCall(a.source)) principals.add(a.target);
   // ids read from the request
@@ -360,7 +367,7 @@ function handlerFacts(ctx, fn, opts = {}) {
       if (nm && /id$/i.test(nm)) idVars.add(a.target);
     }
   }
-  return { ordered, guardIdx, inlineIdx, inlineKind, inlineLine, inlineCallee, inlineRejectCallee, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
+  return { ordered, guardIdx, inlineIdx, inlineCandidate, inlineKind, inlineLine, inlineCallee, inlineRejectCallee, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
 }
 
 function hasOwnership(ctx, facts) {
@@ -368,7 +375,7 @@ function hasOwnership(ctx, facts) {
   const mentionsPrincipal = (e) => { for (const n of identsIr(e)) if (principals.has(n)) return true; return false; };
   // 1. a comparison involving the principal
   for (const c of facts.conds) for (const x of walkIr(c)) {
-    if (x.kind === 'binary' && ['==', '===', '!='].includes(x.op) && (mentionsPrincipal(x.left) || mentionsPrincipal(x.right))) return { kind: 'principal-comparison' };
+    if (x.kind === 'binary' && ['==', '===', '!=', '/='].includes(x.op) && (mentionsPrincipal(x.left) || mentionsPrincipal(x.right))) return { kind: 'principal-comparison' };
     if (x.kind === 'call' && /(?:^|\.)(?:elem|notElem)$/.test(x.callee || '') && (x.args || []).some(mentionsPrincipal)) return { kind: 'principal-membership' };
   }
   for (const o of facts.ordered) {
@@ -396,7 +403,7 @@ function hasOwnership(ctx, facts) {
 //     source, a sensitive call the walk did not find) makes the order UNKNOWN, and unknown is reported as late, never as authenticated.
 // Leaf expressions are classified by lowering them alone and reusing the classifiers above (credentialReadsOf, isRejection, stopsHandler,
 // isSensitiveCall), so this adds ordering and no second definition of what a credential, a rejection or a sensitive call is.
-const HARD_REJECT_HEAD = /^(?:throwError|permissionDenied|notAuthenticated)$/;
+const HARD_REJECT_HEAD = /^(?:throwError|permissionDenied|notAuthenticated|raiseStatus)$/;
 const SOFT_REJECT_HEAD = /^(?:respond|return|pure)$/;
 
 function rhsBranches(rhs) {
@@ -425,7 +432,7 @@ function inlineOrder(ctx, fn, facts, opts) {
   const mentions = (e, names) => { for (const x of walkAst(e)) if (x.t === 'var' && !x.qual && names.has(x.name)) return x.name; return null; };
   const classify = (e) => {
     if (memo.has(e)) return memo.get(e);
-    let out = { reads: false, rej: false, sensN: 0 };
+    let out = { reads: false, rej: false, sensN: 0, stat: false, halt: false };
     try {
       const f2 = lowerHandlerExpr(ctx.project, src.mod, e, `order${seq++}`, Number.isFinite(e.line) ? e.line : 1);
       const calls = [...callsOf(f2), ...nullaryRejectionsOf(f2)].filter((c) => typeof c.callee === 'string');
@@ -434,6 +441,10 @@ function inlineOrder(ctx, fn, facts, opts) {
         reads: credentialReadsOf(f2).size > 0 || Object.values(f2.cfg.nodes).some((n) => exprsOfNode(n).some((r) => [...walkIr(r)].some((x) => x.kind === 'ident' && typeof x.name === 'string' && !!credentialKind({ callee: x.name, args: [] })))),
         rej: calls.some((c) => isRejection(c) && !SCOTTY_STATUS.test(c.callee) && stopsHandler(c, calls)),
         sensN: callsOf(f2).filter((c) => typeof c.callee === 'string' && isSensitiveCall(ctx, c)).length,
+        // Scotty: `status 40x` only sets the code; a halting call (`finish`, `raise`, `redirect`) ends the handler. Both are tracked so the PAIR counts
+        // as a rejection wherever the two sit in sequence (`status status401 >> finish`), in either order of statements within one branch.
+        stat: calls.some((c) => SCOTTY_STATUS.test(c.callee) && isRejection(c)),
+        halt: haltLinesOf(f2).length > 0,
       };
     } catch { T.failed = true; }
     // A lambda inside the expression is lifted out by the lowering, so the calls in its body are not among the expression's own: classify
@@ -441,7 +452,7 @@ function inlineOrder(ctx, fn, facts, opts) {
     memo.set(e, out);
     for (const x of walkAst(e)) {
       const bodies = x.t === 'lam' ? [x.body] : x.t === 'lamcase' ? (x.alts || []).flatMap((a) => rhsBranches(a.rhs).map((b) => b.body)) : [];
-      for (const b of bodies) { const sub = classify(b); out = { reads: out.reads || sub.reads, rej: out.rej || sub.rej, sensN: out.sensN + sub.sensN }; }
+      for (const b of bodies) { const sub = classify(b); out = { reads: out.reads || sub.reads, rej: out.rej || sub.rej, sensN: out.sensN + sub.sensN, stat: out.stat || sub.stat, halt: out.halt || sub.halt }; }
     }
     T.astSens += out.sensN;
     memo.set(e, out);
@@ -459,6 +470,9 @@ function inlineOrder(ctx, fn, facts, opts) {
     for (let i = 0; i < n; i++) acc.sens.push({ guarded: s.guarded, readMay: s.readMay });
     const sp = spine(e);
     const hn = sp && sp.head ? sp.head.name : null;
+    if (c.stat) s = { ...s, statusRej: true };
+    // a Scotty halting call after a rejecting status on this path, once a credential has been read
+    if (c.halt && n === 0 && s.statusRej && s.read) { acc.guards++; return { st: s, term: true }; }
     if (c.rej && n === 0 && hn && (HARD_REJECT_HEAD.test(hn) || (tail && SOFT_REJECT_HEAD.test(hn))) && s.read) { acc.guards++; return { st: s, term: true }; }
     if (c.rej && n > 0) T.unordered = true;
     return { st: s, term: false };
@@ -586,6 +600,9 @@ function analyzeRoute(ctx, route, handlerFn, opts) {
     const ord = R.framework === 'scotty' ? { verdict: 'before' } : inlineOrder(ctx, handlerFn, facts, opts);
     if (ord.verdict === 'before') R.auth = { status: 'authenticated', kind: facts.inlineKind, evidence: [{ kind: 'inline-guard', callee: facts.inlineCallee, line: facts.inlineLine }] };
     else R.auth = { status: 'late', kind: null, evidence: [{ kind: 'late-guard', callee: facts.inlineRejectCallee || facts.inlineCallee, line: facts.inlineLine, order: ord.verdict, reason: ord.reason }] };
+  } else if (facts.inlineCandidate && inlineOrder(ctx, handlerFn, facts, opts).verdict === 'before') {
+    // by line the rejection looked late or absent; the handler's structure proves every sensitive operation sits on the non-rejecting side of it
+    R.auth = { status: 'authenticated', kind: facts.inlineKind || 'token', evidence: [{ kind: 'inline-guard', callee: 'structure', line: R.line }] };
   } else R.auth = { status: 'none', kind: null, evidence: [] };
   // role
   const roleCall = facts.ordered.find((o) => ROLE_CALL.test(o.call.callee || ''));
@@ -765,7 +782,10 @@ function servantHandlers(ctx, mod, apiName) {
     const flat = [];
     const go = (e) => { e = unparen(e); if (e && e.t === 'op' && e.op === ':<|>') { go(e.l); go(e.r); } else flat.push(e); };
     if (body) go(body);
-    if (flat.length > 0) return { fnName: fun.name, handlers: flat, fun };
+    // `server _account rowId = do ...`: a single endpoint written as a function, whose parameters ARE the endpoint's auth, capture and query values
+    const clause = fun.clauses[0];
+    const params = flat.length === 1 && clause && (clause.pats || []).length ? clause.pats.map((x) => (x && x.t === 'pvar' ? x.name : null)) : null;
+    if (flat.length > 0) return { fnName: fun.name, handlers: flat, fun, params };
   }
   return null;
 }
@@ -874,7 +894,7 @@ export function analyzeHaskellWeb(files, opts = {}) {
     list.forEach((e, i) => {
       const hAst = h && h.handlers.length === list.length ? h.handlers[i] : null;
       if (h && h.handlers.length !== list.length) ctx.gaps.push({ kind: 'servant-handler-arity', detail: `${apiName} has ${list.length} endpoints but ${h.fnName} lists ${h.handlers.length} handlers; handlers are not paired`, file: mod.file, line: e.line });
-      add({ framework: 'servant', method: e.method, path: e.path, file: mod.file, line: e.line, mod, handlerAst: hAst, servant: e, owner: apiName, whereDecls: h && h.fun && h.fun.clauses[0] && h.fun.clauses[0].rhs.where });
+      add({ framework: 'servant', method: e.method, path: e.path, file: mod.file, line: e.line, mod, handlerAst: hAst, handlerParams: h && h.handlers.length === list.length ? h.params : null, servant: e, owner: apiName, whereDecls: h && h.fun && h.fun.clauses[0] && h.fun.clauses[0].rhs.where });
     });
   }
 
@@ -890,6 +910,23 @@ export function analyzeHaskellWeb(files, opts = {}) {
     }
   }
 
+  // Yesod handlers named by the framework's convention (`getInvoiceR`, `postPurgeR`, `handleHomeR`) whose route table is not in an analysed
+  // file (it usually lives in `config/routes`, read by a Template Haskell splice): the name and the `Handler` result type identify the entry point.
+  // A handler a route table already names is not added twice.
+  if (fw.has('yesod')) {
+    const named = new Set(pending.filter((p) => p.framework === 'yesod').map((p) => p.handlerName));
+    for (const mod of ctx.modules) {
+      if (!mod.imports.some((i) => /^Yesod(?:\.|$)/.test(i.module))) continue;
+      for (const fun of mod.groups.funs) {
+        const m = /^(get|post|put|delete|patch|options|head|handle)([A-Z][A-Za-z0-9_']*R)$/.exec(fun.name);
+        const sig = mod.sigs.get(fun.name);
+        if (!m || named.has(fun.name) || !sig || !/\bHandler(?:For|T)?\b/.test(sig.text)) continue;
+        const method = m[1] === 'handle' ? 'ANY' : m[1].toUpperCase();
+        add({ framework: 'yesod', method, path: `/${m[2].replace(/R$/, '').replace(/([a-z0-9])([A-Z])/g, '$1-$2').toLowerCase()}`, file: mod.file, line: fun.line, mod, handlerName: fun.name, resource: m[2], owner: m[2], conventional: true });
+      }
+    }
+  }
+
   // ── resolve handlers and analyse ─────────────────────────────────────────
   for (const p of pending) {
     const R = newRoute({ framework: p.framework, method: p.method, path: p.path, file: p.file, line: p.line, owner: p.owner });
@@ -919,7 +956,7 @@ export function analyzeHaskellWeb(files, opts = {}) {
           else if (q) handlerName = q.name;
         }
       } else {
-        try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, p.handlerAst, `${p.framework}-${p.line}`, p.line); ctx.handlerAst.set(handlerFn, { mod: p.mod, rhss: [{ guards: null, body: p.handlerAst, where: [] }] }); handlerName = '<inline>'; } catch { handlerFn = null; }
+        try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, p.handlerAst, `${p.framework}-${p.line}`, p.line); ctx.handlerAst.set(handlerFn, { mod: p.mod, rhss: [{ guards: null, body: p.handlerAst, where: [] }] }); handlerName = '<inline>'; if (p.handlerParams) paramNames = p.handlerParams; } catch { handlerFn = null; }
       }
     }
     R.handler = handlerFn ? { kind: handlerName === '<inline>' ? 'inline' : 'named', name: handlerName } : { kind: 'unknown', name: handlerName };
@@ -1019,7 +1056,7 @@ function emitFindings(ctx, result, yesodAuthz) {
     const vs = result.versionStatus[R.framework];
     const untested = vs && vs.status !== 'tested';
     if (untested) extra = { ...extra, confidence: (extra.confidence ?? 0.75) * 0.8, uncertainty: [...(extra.uncertainty || []), { kind: 'untested-model', detail: `${vs.package} ${vs.version || '(version unknown)'} is not in the tested set (${vs.tested.join(', ')}); the route model is applied best-effort` }] };
-    const snip = (text.split('\n')[line - 1] || '').trim().slice(0, 240);
+    const snip = codeOfLine(text.split('\n')[line - 1] || '').slice(0, 240);
     out.push({
       id: `hs-web:${rule}:${R.file}:${line}:${R.method}:${R.path}`, severity: extra.severity || r.severity, file: R.file, line, vuln: r.vuln, cwe: r.cwe,
       description: `${r.vuln}: ${R.method} ${R.path} (${R.framework})${extra.detail ? ` - ${extra.detail}` : ''}`,

package/src/language/support-registry.js

@@ -221,7 +221,8 @@ export function evaluateSupport(language, input) {
     const strict = r.evidence.metric === 'sast-holdout' || r.evidence.metric === 'taint-holdout' ? (detection.layers || {})[key] && (detection.layers[key].strict || null) : null;
     r.evidence = withInterval({ ...r.evidence, ...(strict && Number.isFinite(strict.precision) ? { strictPrecision: strict.precision } : {}) });
   }
-  // Generalisation: the SAME layers measured on shapes absent from train, validation and holdout. It never changes a row's status (the
+  // Generalisation: the SAME layers measured on shapes absent from train, validation and holdout. When that split has become a DEVELOPMENT set (its
+  // failures were read and the engine was changed for them) the result is a regression number and is labelled so (`role`). It never changes a row's status (the
   // PRD's gates are defined on the frozen holdout); it is stated beside it, with the shortfalls named, so "supported" is not read as more.
   const un = input.unseen && input.unseen.ecosystems && input.unseen.ecosystems[language] && input.unseen.ecosystems[language].detection;
   out.generalizationGaps = [];
@@ -234,7 +235,7 @@ export function evaluateSupport(language, input) {
     if (!(u.precision >= TARGETS.precision)) shortfalls.push(`precision ${pct(u.precision)} < ${pct(TARGETS.precision)}`);
     if (!(u.recall >= TARGETS.recall)) shortfalls.push(`recall ${pct(u.recall)} < ${pct(TARGETS.recall)}`);
     if (!(u.f1 >= TARGETS.f1)) shortfalls.push(`F1 ${pct(u.f1)} < ${pct(TARGETS.f1)}`);
-    r.generalization = { status: shortfalls.length ? 'below-target' : 'meets-targets', shortfalls, cases: u.cases, tp: u.tp, fp: u.fp, fn: u.fn, tn: u.tn, precision: u.precision, recall: u.recall, f1: u.f1, strictPrecision: u.strict && u.strict.precision, ci: { precision: ciShapes(u.tp, u.tp + u.fp), recall: ciShapes(u.tp, u.tp + u.fn), level: 0.95, method: `Clopper-Pearson over shapes (${SHAPE_CLUSTER} near-identical cases per shape)` } };
+    r.generalization = { status: shortfalls.length ? 'below-target' : 'meets-targets', role: (input.unseen && input.unseen.splitRole) || 'generalisation', shortfalls, cases: u.cases, tp: u.tp, fp: u.fp, fn: u.fn, tn: u.tn, precision: u.precision, recall: u.recall, f1: u.f1, strictPrecision: u.strict && u.strict.precision, ci: { precision: ciShapes(u.tp, u.tp + u.fp), recall: ciShapes(u.tp, u.tp + u.fn), level: 0.95, method: `Clopper-Pearson over shapes (${SHAPE_CLUSTER} near-identical cases per shape)` } };
     if (shortfalls.length) out.generalizationGaps.push(`${r.capability}: ${shortfalls.join(', ')}`);
   }
   // a capability whose tool is absent is blocked, not passed and not skipped

package/src/mcp/tools.js

@@ -475,6 +475,22 @@ export const scan_diff = {
   },
 };
 
+// The ordered source-to-sink steps of a finding: its `trace` when the detector wrote one, else the `chain` the IR taint
+// engine records (file, line, label, kind, provenance). Null when the finding carries neither.
+function _flowSteps(f) {
+  if (Array.isArray(f.trace) && f.trace.length) return f.trace;
+  if (f.trace && !Array.isArray(f.trace)) return f.trace;
+  if (Array.isArray(f.chain) && f.chain.length) {
+    return f.chain.map((s) => ({ file: s.file ?? null, line: s.line ?? null, label: s.label ?? null, kind: s.kind || (s.provenance ? 'source' : 'step'), provenance: s.provenance ?? null }));
+  }
+  return null;
+}
+// Labels of the structured source, sink and rule, for matching only.
+function _flowEnds(f) {
+  const lab = (x) => (x && typeof x === 'object' ? [x.label, x.family, x.kind].filter((v) => typeof v === 'string').join(' ') : '');
+  return [lab(f.source), lab(f.sink), typeof f.rule === 'string' ? f.rule : ''].join(' ');
+}
+
 // ─── query_taint ─────────────────────────────────────────────────────────────
 export const query_taint = {
   name: 'query_taint',
@@ -505,13 +521,16 @@ export const query_taint = {
     // dilutes its reasoning; the agent receives a bounded slice plus the
     // cursor to fetch the rest if it wants.
     const all = (scan.findings || []).filter(f => {
-      const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(f.trace || '')].join(' ').toLowerCase();
+      // The structured flow counts too: an IR taint finding (Haskell included) records its path as `source`, `sink`, `rule`
+      // and `chain`, and carries no free-text description or `trace`, so matching only the text fields would answer
+      // "no path" for a path the scan did find.
+      const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(_flowSteps(f) || ''), _flowEnds(f)].join(' ').toLowerCase();
       return hay.includes(srcL) && hay.includes(sinkL);
     });
     const page = all.slice(off, off + lim).map(f => redactFinding({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, description: f.description,
-      trace: f.trace || null,
+      trace: _flowSteps(f),
     }));
     return {
       _meta: META,
@@ -551,7 +570,7 @@ export const explain_finding = {
       title: f.title || f.vuln, cwe: f.cwe,
       description: f.description, remediation: f.remediation,
       snippet: f.snippet || null,
-      trace: f.trace || null,
+      trace: _flowSteps(f),
     });
     // Harness-anatomy #1: explain_finding's trace is the most-likely-large
     // field on a single finding. Offload when it crosses the threshold so
@@ -1211,6 +1230,9 @@ export const synthesize_fix = {
               languageFix.applyWith = { finding_id: f.id, confirm: true, plan_digest: languageFix.planDigest };
             }
             else if (prev.ok) autofix = { deterministic: true, ruleId: f.rule || f.family || null, patch: prev.after, file: prev.file, label: prev.label || null, verified: true };
+          } else if (lc.isLanguageDependencyFinding(f)) {
+            // Named, not silent: a Hackage or flake dependency is fixed by raising a constraint, which has its own tool.
+            languageFix = { status: 'use-sca-upgrade', ok: false, label: null, tier: null, reason: 'this is a dependency finding: use synthesize_sca_upgrade for the constraint edit (apply_sca_upgrade writes it)', diff: null, explanation: null, consequences: [] };
           }
         } catch { /* best-effort: the preview is advisory */ }
       }
@@ -1625,6 +1647,22 @@ export const query_cache_telemetry = {
   },
 };
 
+async function _languageUpgrade(lc, f, ctx, apply) {
+  const proj = lc.loadLanguageProject(ctx.sessionRoot);
+  return lc.languageUpgradePreview(f, { ...proj.files, ...proj.manifests }, { apply, root: ctx.sessionRoot });
+}
+// The result shape both SCA upgrade tools return for a Hackage or flake dependency. `verified` is never true: the edit
+// changes a declared constraint or a ref, not the resolved version.
+function _languageUpgradeResult(f, r) {
+  return {
+    ok: true, mode: r.ok ? 'source-edit' : 'blocked', ecosystem: f.ecosystem, package: f.package || null,
+    currentVersion: f.version || null, targetVersion: null, command: null,
+    reason: r.ok ? null : (r.reason || 'no upgrade could be planned'),
+    languageUpgrade: { status: r.status || null, tier: r.tier || null, label: r.label || null, file: r.file || null, diff: r.diff || null, explanation: r.explanation || null, consequences: r.consequences || [], backup: r.backup ? r.backup.id || null : null },
+    verified: false,
+  };
+}
+
 // ─── synthesize_sca_upgrade ───────────────────────────────────────────────
 // Phase 3 / Item 5 of the SCA improvement plan. Read-only counterpart to
 // apply_sca_upgrade — produces a structured upgrade plan via the
@@ -1653,6 +1691,10 @@ export const synthesize_sca_upgrade = {
     if (f.type !== 'vulnerable_dep') {
       return { _meta: META, ok: false, reason: 'finding is not an SCA vulnerable_dep — use synthesize_fix for SAST findings' };
     }
+    // Hackage constraints and flake inputs are source edits the language planner owns; without this the generic planner
+    // answers "no automated upgrade" for a dependency the CLI can fix. Read-only: nothing is written or run.
+    const lc = await import('../language/context.js');
+    if (lc.isLanguageDependencyFinding(f)) return { _meta: META, ..._languageUpgradeResult(f, await _languageUpgrade(lc, f, ctx, false)) };
     const { planScaUpgrade } = await _getScaUpgrade();
     const plan = await planScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f });
     return { _meta: META, ...plan };
@@ -1693,6 +1735,15 @@ export const apply_sca_upgrade = {
     if (f.type !== 'vulnerable_dep') {
       return { _meta: META, applied: false, reason: 'finding is not an SCA vulnerable_dep — use apply_fix for SAST findings' };
     }
+    const lc = await import('../language/context.js');
+    if (lc.isLanguageDependencyFinding(f)) {
+      // Plan first, confine the one file it names, then write it with a backup and a history entry (`undo` reverts it).
+      const plan = await _languageUpgrade(lc, f, ctx, false);
+      if (!plan.ok) return { _meta: META, applied: false, ..._languageUpgradeResult(f, plan) };
+      try { _confine(ctx.sessionRoot, plan.file, 'upgrade.file'); } catch (e) { return { _meta: META, applied: false, reason: String((e && e.message) || e) }; }
+      const done = await _languageUpgrade(lc, f, ctx, true);
+      return { _meta: META, applied: done.applied === true, ..._languageUpgradeResult(f, done), testsRun: false, testsNote: 'a constraint edit is not re-resolved or re-tested by this tool; resolve (for example `cabal build --dry-run`), rescan and run the project tests before relying on it' };
+    }
     const { applyScaUpgrade } = await _getScaUpgrade();
     const result = await applyScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f, runTests: run_tests });
     return { _meta: META, ...result };

package/src/posture/attack-taxonomy.js

@@ -167,6 +167,16 @@ const FAMILY_ALIAS = {
   'license':                 'license-graph',
   'cloud-iam-overpermissive': 'iam-overpermissive',
   'http-no-tls':             'crypto-tls-version',
+  // Haskell producers (language/haskell-*.js) name the same defects more finely; each maps to the canonical family of
+  // the same kind of defect, and a family with no canonical counterpart stays unmapped and is listed as such.
+  'missing-authentication':  'auth-missing',
+  'weak-randomness':         'crypto-weak-rng',
+  'weak-hash':               'crypto-weak-hash',
+  'password-hashing':        'crypto-kdf-weak',
+  'tls-validation':          'crypto-tls-no-verify',
+  'hardcoded-credentials':   'hardcoded-secret',
+  'broken-object-authorization': 'idor',
+  'broken-function-authorization': 'authz',
 };
 
 function _canonical(family) {

package/src/posture/entrypoint-inventory.js

@@ -140,9 +140,13 @@ export function buildEntrypointInventory(fileContents, opts = {}) {
       const line = Number.isInteger(route.line) ? route.line : 0;
       const method = typeof route.method === 'string' ? route.method : 'GET';
       const path = typeof route.path === 'string' ? route.path : '';
-      const isWebhook = /webhook/i.test(path) || /webhook/i.test(String(route.handler || ''));
+      // A handler is a name for most frameworks and an object ({kind, name}) for Haskell routes; String() of the object
+      // is "[object Object]". An inline handler has no name of its own, so the route stands in for it.
+      const h = route.handler;
+      const handlerName = typeof h === 'string' ? h : (h && typeof h === 'object' && typeof h.name === 'string' && h.name && !/^<.*>$/.test(h.name) ? h.name : '');
+      const isWebhook = /webhook/i.test(path) || /webhook/i.test(handlerName);
       const type = isWebhook ? 'webhook' : 'http';
-      const name = _clip(route.handler || `${method} ${path}`.trim() || type);
+      const name = _clip(handlerName || `${method} ${path}`.trim() || type);
 
       // Trust: an authenticated route (hasAuth) or a nearby auth token wins.
       let trust = route.hasAuth === true ? 'authenticated' : 'unauthenticated';