@avi770/testteam 2.0.0 → 3.2.0

package/dist/agents/112-taint-tracker.js

@@ -0,0 +1,1273 @@
+/**
+ * Cross-File Taint Tracker — bounded 1-hop interprocedural taint analysis.
+ *
+ * The single-file security scanners (#107 open-redirect, #108 SQLi,
+ * #109 path-traversal, #110 mass-assignment, #111 dynamic-eval) only fire
+ * when an attacker-controlled value and a dangerous sink appear in the SAME
+ * expression. Real code launders request data through helper functions, so
+ * the source and the sink live in different places:
+ *
+ *     // routes/user.ts
+ *     app.get('/u', (req, res) => res.json(runQuery(req.query.id)));   // source
+ *     // db/helpers.ts
+ *     export function runQuery(id) {                                   // tainted param
+ *       return db.$queryRawUnsafe(`SELECT * FROM u WHERE id = ${id}`); // sink
+ *     }
+ *
+ * Neither line alone trips a line-level scanner. This agent connects them:
+ *
+ *   1. Find "sink-wrapper" functions: a standalone function (declaration or
+ *      `const fn = (…) =>`) whose body reaches a dangerous sink
+ *      (sql / eval / command / fs-path / redirect) using one of its own
+ *      parameters. The tainted parameter slot is recorded.
+ *   2. Find call sites of those wrappers anywhere in the codebase whose
+ *      argument in the dangerous slot is request-tainted — `req`/`request`/
+ *      `.body`/`.query`/`.params`, either directly or via a local variable
+ *      assigned from such.
+ *   3. Emit a flow: source(call site) → wrapper(param) → sink.
+ *
+ * Bounded to ONE hop (source → wrapper → sink) to stay linear and
+ * low-false-positive: a finding requires BOTH a confirmed sink-wrapper AND a
+ * confirmed taint source reaching its dangerous slot. Cross-file flows (call
+ * site and sink in different files) are the headline; same-file 1-hop flows
+ * the line scanners miss are also reported.
+ *
+ * Known limitations (kept deliberately, to bound false positives): only
+ * standalone functions and `const fn = …` arrows are treated as wrappers
+ * (class/object methods are not), and taint is followed a single hop.
+ *
+ * Findings:
+ *   - 112-taint-flow   high   code-bug-security
+ *   - 112-clean / 112-summary  info
+ *
+ * Persists `evidence/taint-analysis.json`. Read-only, parallel-safe, static.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', '.run', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+/**
+ * Request-input taint markers — kept in sync with the line-level scanners.
+ * `req`/`request` + the `.body`/`.query`/`.params` accessors also cover Koa
+ * (`ctx.request.body`, `ctx.params`) and Hapi (`request.payload`).
+ *
+ * The `(?!\s*\()` after the accessors disambiguates a request PROPERTY ACCESS
+ * (`req.query.id`, `ctx.params`, `request.body`) from a same-named METHOD CALL —
+ * notably TypeORM / query-builder `queryRunner.query(sql)` / `conn.params(...)`,
+ * which would otherwise false-positive as request input. (No real request accessor
+ * is invoked as `.query(`/`.params(`/`.body(`, so excluding the call form is loss-free.)
+ * This is the prerequisite for safely recognising NestJS class-method sink-wrappers,
+ * which were reverted earlier precisely because of this collision.
+ *
+ * NB: bare `args`/`payload` (GraphQL resolver args / queue payloads) false-
+ * positive on their pervasive non-request use (`execFile(cmd, args)`), so they
+ * aren't here. GraphQL resolver args are handled separately via
+ * `extractResolvers` (below), which gates `args` as a taint source on a
+ * distinctive 3/4-arg resolver signature `(parent, args, context|info, …)`.
+ * Queue `payload` remains a deferred gap (no equally distinctive shape).
+ */
+export const REQUEST_RE = /\b(?:req|request)\b|\.(?:body|query|params)\b(?!\s*\(|\s*\?\.\s*\()/;
+// ─────────────────────────────────────────────────────────────────────────
+// Generic source helpers
+// ─────────────────────────────────────────────────────────────────────────
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    return content.slice(start, end).trim().slice(0, 160);
+}
+function skipWs(content, i) {
+    while (i < content.length && /\s/.test(content[i]))
+        i++;
+    return i;
+}
+/** String-aware balanced-delimiter reader. Returns the slice including delimiters. */
+export function readBalanced(content, openIdx, open, close) {
+    if (content[openIdx] !== open)
+        return null;
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    for (let i = openIdx; i < content.length; i++) {
+        const ch = content[i];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (inString) {
+            if (ch === '\\')
+                escape = true;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            continue;
+        }
+        if (ch === open)
+            depth++;
+        else if (ch === close) {
+            depth--;
+            if (depth === 0)
+                return { text: content.slice(openIdx, i + 1), end: i };
+        }
+    }
+    return null;
+}
+/**
+ * Read an arrow-expression body (no braces) up to a top-level `;` or newline.
+ * With `stopAtComma`, also stop at a top-level `,` — needed for a concise arrow
+ * inside an argument list (`f(x => expr, other)`), whose body ends at the comma
+ * separating it from the next argument.
+ */
+function readExprBody(content, start, stopAtComma = false) {
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    for (let i = start; i < content.length; i++) {
+        const ch = content[i];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (inString) {
+            if (ch === '\\')
+                escape = true;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{')
+            depth++;
+        else if (ch === ')' || ch === ']' || ch === '}') {
+            if (depth === 0)
+                return content.slice(start, i);
+            depth--;
+        }
+        else if (depth === 0 && (ch === ';' || ch === '\n' || (stopAtComma && ch === ','))) {
+            return content.slice(start, i);
+        }
+    }
+    return content.slice(start);
+}
+/** Split a parenthesised argument list (incl. the outer parens) into top-level pieces. */
+export function splitArgs(parenText) {
+    const inner = parenText.slice(1, -1);
+    if (inner.trim() === '')
+        return [];
+    const parts = [];
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    let cur = '';
+    for (let i = 0; i < inner.length; i++) {
+        const ch = inner[i];
+        if (escape) {
+            cur += ch;
+            escape = false;
+            continue;
+        }
+        if (inString) {
+            cur += ch;
+            if (ch === '\\')
+                escape = true;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            cur += ch;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{') {
+            depth++;
+            cur += ch;
+        }
+        else if (ch === ')' || ch === ']' || ch === '}') {
+            depth--;
+            cur += ch;
+        }
+        else if (ch === ',' && depth === 0) {
+            parts.push(cur.trim());
+            cur = '';
+        }
+        else {
+            cur += ch;
+        }
+    }
+    parts.push(cur.trim());
+    return parts;
+}
+/** Reduce a single parameter token to the identifier(s) it binds. */
+function paramIdentifiers(token) {
+    let t = token.trim();
+    if (t.startsWith('...'))
+        t = t.slice(3).trim();
+    // strip a default value: `x = 1` → `x`
+    const eq = topLevelEquals(t);
+    if (eq !== -1)
+        t = t.slice(0, eq).trim();
+    if (t.startsWith('{') || t.startsWith('[')) {
+        const open = t[0];
+        const close = open === '{' ? '}' : ']';
+        // Take only the destructuring pattern, dropping any trailing `: Type` annotation.
+        const pat = readBalanced(t, 0, open, close);
+        return destructuredBindings(pat ? pat.text : t, open);
+    }
+    // strip a type annotation: `x: Foo` → `x`
+    const colon = t.indexOf(':');
+    if (colon !== -1)
+        t = t.slice(0, colon).trim();
+    // strip an optional marker: `q?` → `q` (e.g. NestJS `@Query('q') q?: string`)
+    if (t.endsWith('?'))
+        t = t.slice(0, -1).trim();
+    return t ? [t] : [];
+}
+/**
+ * Identifiers actually *bound* (introduced into scope) by a destructuring pattern.
+ * For object patterns, a `key:` to the left of a colon is a property name, not a
+ * binding — only the right-hand side is bound (`{ a: b }` binds `b`, not `a`;
+ * shorthand `{ a }` binds `a`). Array patterns bind every identifier. This keeps
+ * a renamed property key (`{ input: cmd }` → `cmd`, never `input`) from being
+ * mistaken for an in-scope taint name (adversarial-review FP-2).
+ */
+export function destructuredBindings(pattern, kind) {
+    if (kind === '[') {
+        return [...new Set(pattern.match(/[A-Za-z_$][\w$]*/g) ?? [])];
+    }
+    const ids = [];
+    const re = /([A-Za-z_$][\w$]*)\s*(:)?/g;
+    let m;
+    while ((m = re.exec(pattern)) !== null) {
+        if (m[2] === ':')
+            continue; // property key (rename target) — not a binding
+        ids.push(m[1]);
+    }
+    return [...new Set(ids)];
+}
+/** Index of the first `=` that is an assignment (not `=>`, `==`, `<=`, `>=`, `!=`). */
+function topLevelEquals(t) {
+    for (let i = 0; i < t.length; i++) {
+        if (t[i] !== '=')
+            continue;
+        if (t[i + 1] === '=' || t[i + 1] === '>')
+            continue;
+        if (t[i - 1] === '=' || t[i - 1] === '!' || t[i - 1] === '<' || t[i - 1] === '>')
+            continue;
+        return i;
+    }
+    return -1;
+}
+/** Locate a function body after its parameter list, tolerating a return-type annotation. */
+function findBody(content, afterParenIdx) {
+    let i = skipWs(content, afterParenIdx);
+    if (content[i] === ':') {
+        i++;
+        let d = 0;
+        while (i < content.length) {
+            const c = content[i];
+            if (c === '<' || c === '(' || c === '[')
+                d++;
+            else if (c === '>' || c === ')' || c === ']')
+                d--;
+            else if (d === 0) {
+                if (c === '{')
+                    break;
+                if (c === '=' && content[i + 1] === '>')
+                    break;
+            }
+            i++;
+        }
+    }
+    if (content[i] === '{') {
+        const body = readBalanced(content, i, '{', '}');
+        return body ? { text: body.text, openIdx: i } : null;
+    }
+    if (content[i] === '=' && content[i + 1] === '>') {
+        const j = skipWs(content, i + 2);
+        if (content[j] === '{') {
+            const body = readBalanced(content, j, '{', '}');
+            return body ? { text: body.text, openIdx: j } : null;
+        }
+        return { text: readExprBody(content, j), openIdx: j };
+    }
+    return null;
+}
+function paramSlotsOf(parenText) {
+    return splitArgs(parenText).map(paramIdentifiers);
+}
+export function extractFunctions(content) {
+    const fns = [];
+    // function NAME(params) [: T] { ... }
+    const fnDecl = /(?:\bexport\s+)?(?:\bdefault\s+)?(?:\basync\s+)?\bfunction\s*\*?\s*([A-Za-z_$][\w$]*)\s*\(/g;
+    let m;
+    while ((m = fnDecl.exec(content)) !== null) {
+        const parenIdx = m.index + m[0].length - 1;
+        const params = readBalanced(content, parenIdx, '(', ')');
+        if (!params)
+            continue;
+        const body = findBody(content, params.end + 1);
+        if (!body)
+            continue;
+        fns.push({
+            name: m[1],
+            paramSlots: paramSlotsOf(params.text),
+            bodyText: body.text,
+            bodyOpenIdx: body.openIdx,
+            declLine: lineOf(content, m.index),
+        });
+    }
+    // const NAME = (params) => ... | = async (params) => ... | = function (params) { ... }
+    const arrowParen = /(?:\bexport\s+)?\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?(?:function\s*\*?\s*)?\(/g;
+    while ((m = arrowParen.exec(content)) !== null) {
+        const parenIdx = m.index + m[0].length - 1;
+        const params = readBalanced(content, parenIdx, '(', ')');
+        if (!params)
+            continue;
+        const body = findBody(content, params.end + 1);
+        if (!body)
+            continue;
+        fns.push({
+            name: m[1],
+            paramSlots: paramSlotsOf(params.text),
+            bodyText: body.text,
+            bodyOpenIdx: body.openIdx,
+            declLine: lineOf(content, m.index),
+        });
+    }
+    // const NAME = (async) IDENT => ...   (single param, no parens)
+    const arrowSingle = /(?:\bexport\s+)?\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?([A-Za-z_$][\w$]*)\s*=>/g;
+    while ((m = arrowSingle.exec(content)) !== null) {
+        const arrowIdx = content.indexOf('=>', m.index + m[0].length - 2);
+        if (arrowIdx === -1)
+            continue;
+        const j = skipWs(content, arrowIdx + 2);
+        let bodyText;
+        let bodyOpenIdx;
+        if (content[j] === '{') {
+            const body = readBalanced(content, j, '{', '}');
+            if (!body)
+                continue;
+            bodyText = body.text;
+            bodyOpenIdx = j;
+        }
+        else {
+            bodyText = readExprBody(content, j);
+            bodyOpenIdx = j;
+        }
+        fns.push({
+            name: m[1],
+            paramSlots: [[m[2]]],
+            bodyText,
+            bodyOpenIdx,
+            declLine: lineOf(content, m.index),
+        });
+    }
+    // NB: class/object methods are NOT treated as STANDALONE wrappers here — on
+    // query-builder/ORM code (TypeORM's `QueryRunner.query()`) the `.query`/`.params`
+    // accessors collide with method names. NestJS class-method flows are handled
+    // separately and conservatively by `extractClasses` + the NestJS pass in
+    // `analyzeTaint`, which only matches same-class `this.method()` call sites (a bare
+    // `.find(`/`.map(` member call can never collide with an Array.prototype method).
+    return fns;
+}
+// ─────────────────────────────────────────────────────────────────────────
+// NestJS class extraction (controllers / providers)
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * NestJS request-binding param decorators (names only). A param decorated with one
+ * of these carries client-controlled input, so its bound identifier is a taint
+ * source — the class-method analogue of GraphQL's resolver `args`. Distinctive
+ * (low false-positive, like the resolver signature gate); a bare param named
+ * `body`/`query`/`payload` is NOT a source without the decorator.
+ *
+ * `@MessageBody`/`@Payload` extend this to NestJS microservice + queue handlers
+ * (`@MessagePattern`/`@EventPattern`/`@Process`), where the deserialised message/job
+ * payload crosses a trust boundary just like an HTTP `@Body`. A BARE queue
+ * `payload`/`job.data` (plain BullMQ `new Worker(name, job => …)`, no decorator) is
+ * deliberately NOT a source — no distinctive non-decorator shape to gate on without
+ * false-positiving on pervasive non-queue `payload` use (tracked in CLEANUP_PHASE.md).
+ */
+const NEST_SOURCE_NAMES = new Set([
+    'Body', 'Query', 'Param', 'Headers', 'Req', 'Request', 'Ip', 'Session',
+    'RawBody', 'UploadedFile', 'UploadedFiles', 'HostParam', 'Cookies', 'MessageBody',
+    'Payload',
+]);
+/** TS parameter-property modifiers stripped before reading the bound identifier. */
+const PARAM_MODIFIERS = new Set(['public', 'private', 'protected', 'readonly']);
+/** Method names that are really keywords/control-flow, never method definitions. */
+const NON_METHOD_NAMES = new Set([
+    'if', 'for', 'while', 'switch', 'catch', 'return', 'await', 'typeof', 'function',
+    'new', 'do', 'else', 'yield', 'void', 'delete', 'in', 'of', 'instanceof', 'class',
+    'super', 'constructor',
+]);
+/**
+ * Strip leading decorators from a parameter token; report whether any is a source
+ * decorator. Decorator arguments are read paren-BALANCED, so a decorator with a
+ * call/object argument — `@Body(new ValidationPipe())`, `@Param('id', ParseIntPipe)` —
+ * is fully consumed rather than truncated at the first inner `)` (critic FN-3).
+ */
+function parseDecoratedParam(token) {
+    let t = token.trim();
+    let isSource = false;
+    for (;;) {
+        if (t[0] !== '@')
+            break;
+        const nameMatch = t.slice(1).match(/^[A-Za-z_$][\w$]*/);
+        if (!nameMatch)
+            break;
+        if (NEST_SOURCE_NAMES.has(nameMatch[0]))
+            isSource = true;
+        let rest = t.slice(1 + nameMatch[0].length).replace(/^\s+/, '');
+        if (rest[0] === '(') {
+            const bal = readBalanced(rest, 0, '(', ')');
+            if (!bal)
+                break; // malformed — stop consuming
+            rest = rest.slice(bal.end + 1).replace(/^\s+/, '');
+        }
+        t = rest;
+    }
+    // Strip TS parameter-property modifiers (`readonly`/`private`/… — valid only on
+    // constructor params, defensive here) so the bound identifier is read cleanly (FN-1).
+    let prev;
+    do {
+        prev = t;
+        const w = t.match(/^([A-Za-z_$][\w$]*)\s+/);
+        if (w && PARAM_MODIFIERS.has(w[1]))
+            t = t.slice(w[0].length);
+    } while (t !== prev);
+    return { ids: paramIdentifiers(t), isSource };
+}
+/** Parse a (decorated) parameter list into per-slot bindings + decorator-sourced ids. */
+function parseDecoratedParams(parenText) {
+    const slots = [];
+    const sourceIds = [];
+    for (const tok of splitArgs(parenText)) {
+        const { ids, isSource } = parseDecoratedParam(tok);
+        slots.push(ids);
+        if (isSource)
+            sourceIds.push(...ids);
+    }
+    return { slots, sourceIds };
+}
+/** Extract the method definitions from a class body (text incl. outer braces). */
+function extractClassMethods(classBodyText, classBodyAbsIdx) {
+    const methods = [];
+    const re = /([A-Za-z_$][\w$]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(classBodyText)) !== null) {
+        const name = m[1];
+        if (NON_METHOD_NAMES.has(name))
+            continue;
+        // The char before the name (skipping whitespace) must not be `.`/`?` — that
+        // would be a `this.foo(` / `a?.foo(` CALL, not a method definition.
+        let p = m.index - 1;
+        while (p >= 0 && /\s/.test(classBodyText[p]))
+            p--;
+        if (p >= 0 && (classBodyText[p] === '.' || classBodyText[p] === '?'))
+            continue;
+        const parenIdx = m.index + m[0].length - 1;
+        const params = readBalanced(classBodyText, parenIdx, '(', ')');
+        if (!params)
+            continue;
+        const body = findBody(classBodyText, params.end + 1);
+        if (!body || body.text[0] !== '{')
+            continue; // a real method has a brace body
+        const { slots, sourceIds } = parseDecoratedParams(params.text);
+        methods.push({
+            name,
+            paramSlots: slots,
+            sourceParamIds: sourceIds,
+            bodyText: body.text,
+            bodyAbsIdx: classBodyAbsIdx + body.openIdx,
+            bodyStart: classBodyAbsIdx + body.openIdx,
+            bodyEnd: classBodyAbsIdx + body.openIdx + body.text.length,
+        });
+        re.lastIndex = body.openIdx + body.text.length; // skip the body; don't re-scan its calls
+    }
+    return methods;
+}
+/**
+ * Extract class declarations and their methods. Used by the NestJS pass to find
+ * class-method sink-wrappers and decorator-bound request sources. Standalone
+ * functions remain the job of `extractFunctions`.
+ */
+export function extractClasses(content) {
+    const classes = [];
+    const re = /\bclass\s+([A-Za-z_$][\w$]*)/g;
+    let m;
+    while ((m = re.exec(content)) !== null) {
+        // Walk to the class body `{`, skipping any `extends X<…>` / `implements Y, Z`.
+        let depth = 0;
+        let openIdx = -1;
+        for (let i = m.index + m[0].length; i < content.length; i++) {
+            const c = content[i];
+            if (c === '<' || c === '(' || c === '[')
+                depth++;
+            else if (c === '>' || c === ')' || c === ']')
+                depth--;
+            else if (depth === 0 && c === '{') {
+                openIdx = i;
+                break;
+            }
+            else if (depth === 0 && c === ';')
+                break;
+        }
+        if (openIdx === -1)
+            continue;
+        const body = readBalanced(content, openIdx, '{', '}');
+        if (!body)
+            continue;
+        classes.push({
+            name: m[1],
+            methods: extractClassMethods(body.text, openIdx),
+            bodyStart: openIdx,
+            bodyEnd: openIdx + body.text.length,
+        });
+        re.lastIndex = openIdx + body.text.length; // don't descend into nested classes twice
+    }
+    return classes;
+}
+// ─────────────────────────────────────────────────────────────────────────
+// GraphQL resolver detection
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Recognise the canonical GraphQL resolver signature so the resolver's `args`
+ * parameter can be treated as a taint source. Bare `args` was rejected as a
+ * global taint marker — it false-positives on `execFile(cmd, args)`; requiring
+ * a distinctive resolver shape removes that whole class of FP.
+ *
+ * Apollo / Yoga / graphql-tools resolvers take `(parent, args, context, info)`.
+ * The discriminators kept here are the *names of the later params*:
+ *   - 4-arg shape with `context`/`ctx` at slot 2 or `info` at slot 3; or
+ *   - 3-arg shape with `context`/`ctx`/`info` at slot 2.
+ * A bare 2-arg function with `args` (the original FP shape) is NOT recognised.
+ * NestJS `@Resolver()` class methods are not recognised here (class-method
+ * extraction is a separate, deferred gap).
+ */
+const CONTEXT_PARAM_NAMES = new Set(['context', 'ctx', '_context', '_ctx']);
+const INFO_PARAM_NAMES = new Set(['info', '_info']);
+export function isResolverSignature(fn) {
+    const slots = fn.paramSlots;
+    if (slots.length !== 3 && slots.length !== 4)
+        return false;
+    const slotHas = (idx, names) => !!slots[idx] && slots[idx].some((n) => names.has(n));
+    if (slots.length === 4)
+        return slotHas(2, CONTEXT_PARAM_NAMES) || slotHas(3, INFO_PARAM_NAMES);
+    return slotHas(2, CONTEXT_PARAM_NAMES) || slotHas(2, INFO_PARAM_NAMES);
+}
+/**
+ * Pick up object-literal member functions for resolver detection. `extractFunctions`
+ * deliberately skips these (object/class methods as sink *wrappers* regressed FPs
+ * on ORM query-builders — see the note in that function). Resolvers gate on a
+ * strict signature, so broader extraction here is safe: the canonical Apollo
+ * shape is `{ Query: { user: async (parent, args, context, info) => … } }` /
+ * `{ user(parent, args, context, info) { … } }`, which would never be reached
+ * by the standalone-function extractor.
+ *
+ * Patterns picked up:
+ *   - `KEY: async? (params) [: T] => body`    (arrow-valued property)
+ *   - `async? KEY(params) [: T] { body }`     (method shorthand)
+ */
+function extractObjectMemberFns(content) {
+    const fns = [];
+    const skipTypeAnnotationTo = (i, terminators) => {
+        if (content[i] !== ':')
+            return i;
+        let d = 0;
+        i++;
+        while (i < content.length) {
+            const c = content[i];
+            if (c === '<' || c === '(' || c === '[')
+                d++;
+            else if (c === '>' || c === ')' || c === ']')
+                d--;
+            else if (d === 0) {
+                if (c === '=' && content[i + 1] === '>')
+                    return i;
+                if (terminators.has(c))
+                    return i;
+            }
+            i++;
+        }
+        return i;
+    };
+    // `KEY : ASYNC? ( PARAMS ) [: T] => BODY`
+    const arrowRe = /[\s,{(]([A-Za-z_$][\w$]*)\s*:\s*(?:async\s+)?\(/g;
+    let m;
+    const ARROW_TERMINATORS = new Set([',', ';', '}', '\n']);
+    while ((m = arrowRe.exec(content)) !== null) {
+        const parenIdx = m.index + m[0].length - 1;
+        const params = readBalanced(content, parenIdx, '(', ')');
+        if (!params)
+            continue;
+        let i = skipWs(content, params.end + 1);
+        i = skipTypeAnnotationTo(i, ARROW_TERMINATORS);
+        if (content[i] !== '=' || content[i + 1] !== '>')
+            continue;
+        const bodyStart = skipWs(content, i + 2);
+        let bodyText;
+        let bodyOpenIdx;
+        if (content[bodyStart] === '{') {
+            const b = readBalanced(content, bodyStart, '{', '}');
+            if (!b)
+                continue;
+            bodyText = b.text;
+            bodyOpenIdx = bodyStart;
+        }
+        else {
+            bodyText = readExprBody(content, bodyStart);
+            bodyOpenIdx = bodyStart;
+        }
+        fns.push({
+            name: m[1],
+            paramSlots: paramSlotsOf(params.text),
+            bodyText,
+            bodyOpenIdx,
+            declLine: lineOf(content, m.index),
+        });
+    }
+    // `ASYNC? KEY ( PARAMS ) [: T] { BODY }` — object method shorthand
+    const methodRe = /[,{]\s*(?:async\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+    const METHOD_TERMINATORS = new Set([',', ';', '}', '\n']);
+    while ((m = methodRe.exec(content)) !== null) {
+        const parenIdx = m.index + m[0].length - 1;
+        const params = readBalanced(content, parenIdx, '(', ')');
+        if (!params)
+            continue;
+        let i = skipWs(content, params.end + 1);
+        i = skipTypeAnnotationTo(i, METHOD_TERMINATORS);
+        if (content[i] !== '{')
+            continue;
+        const body = readBalanced(content, i, '{', '}');
+        if (!body)
+            continue;
+        fns.push({
+            name: m[1],
+            paramSlots: paramSlotsOf(params.text),
+            bodyText: body.text,
+            bodyOpenIdx: i,
+            declLine: lineOf(content, m.index),
+        });
+    }
+    return fns;
+}
+export function extractResolvers(content) {
+    const out = [];
+    const all = [...extractFunctions(content), ...extractObjectMemberFns(content)];
+    for (const fn of all) {
+        if (!isResolverSignature(fn))
+            continue;
+        const argsNames = fn.paramSlots[1] ?? [];
+        if (argsNames.length === 0)
+            continue;
+        out.push({
+            fn,
+            bodyStart: fn.bodyOpenIdx,
+            bodyEnd: fn.bodyOpenIdx + fn.bodyText.length,
+            taintedNames: argsNames,
+        });
+    }
+    return out;
+}
+/**
+ * Inline arrow-callback scopes within `content` — `(p) => …` / `p => …` forms that
+ * `extractFunctions` does NOT pick up (it only finds declarations and assigned
+ * arrows, not anonymous callbacks like `items.map(args => …)`). Each entry gives
+ * the callback's bound parameter identifiers and its body offset range, so a call
+ * site inside the callback can be tested for parameter shadowing.
+ */
+function inlineArrowScopes(content) {
+    const out = [];
+    let i = content.indexOf('=>');
+    while (i !== -1) {
+        // Walk back over whitespace to the end of the parameter list.
+        let j = i - 1;
+        while (j >= 0 && /\s/.test(content[j]))
+            j--;
+        let paramText = null;
+        if (content[j] === ')') {
+            // Scan back to the matching '(' (content is masked, so parens in strings are gone).
+            let depth = 0;
+            let k = j;
+            for (; k >= 0; k--) {
+                if (content[k] === ')')
+                    depth++;
+                else if (content[k] === '(') {
+                    depth--;
+                    if (depth === 0)
+                        break;
+                }
+            }
+            if (k >= 0)
+                paramText = content.slice(k, j + 1);
+        }
+        else if (j >= 0 && /[A-Za-z_$]/.test(content[j])) {
+            // Single bare identifier param: `x =>`.
+            let k = j;
+            while (k >= 0 && /[\w$]/.test(content[k]))
+                k--;
+            paramText = `(${content.slice(k + 1, j + 1)})`;
+        }
+        if (paramText !== null) {
+            const b = skipWs(content, i + 2);
+            let end;
+            if (content[b] === '{') {
+                const blk = readBalanced(content, b, '{', '}');
+                end = blk ? b + blk.text.length : b;
+            }
+            else {
+                // Concise body inside an arg list ends at the comma before the next arg.
+                end = b + readExprBody(content, b, true).length;
+            }
+            out.push({ paramSlots: paramSlotsOf(paramText), start: b, end });
+        }
+        i = content.indexOf('=>', i + 2);
+    }
+    return out;
+}
+/**
+ * The subset of a resolver's `taintedNames` that is NOT shadowed at `callOffset`
+ * by a parameter binding inside the resolver body. A nested
+ * `function f(args) {…}`, an assigned arrow `const g = (args) => …`, OR an inline
+ * callback `items.map(args => …)` all rebind `args`, so a sink call inside them
+ * uses the inner param — not the resolver's client input — and crediting resolver
+ * taint there is a false positive (adversarial-review FP-1 + Codex inline-callback
+ * follow-up). `callOffset` is an absolute offset into the same (masked) content
+ * `extractResolvers` was given.
+ */
+/**
+ * The subset of `names` NOT shadowed by a nested fn/arrow scope enclosing `callOffset`.
+ * `bodyText` is the enclosing scope's (masked) source and `base` its absolute offset.
+ * Shared by the resolver and NestJS passes so both ignore a request-source name that a
+ * nested callback parameter rebinds — e.g. `items.map(body => this.run(body.id))`, where
+ * the inner `body` is the callback's local, not the request body.
+ */
+export function unshadowedAt(bodyText, base, names, callOffset) {
+    if (names.length === 0)
+        return names;
+    // Shadow scopes: nested declared/assigned fns AND inline arrow callbacks.
+    const scopes = [];
+    for (const nf of extractFunctions(bodyText)) {
+        scopes.push({ start: base + nf.bodyOpenIdx, end: base + nf.bodyOpenIdx + nf.bodyText.length, paramSlots: nf.paramSlots });
+    }
+    for (const ar of inlineArrowScopes(bodyText)) {
+        scopes.push({ start: base + ar.start, end: base + ar.end, paramSlots: ar.paramSlots });
+    }
+    if (scopes.length === 0)
+        return names;
+    return names.filter((name) => {
+        for (const s of scopes) {
+            if (callOffset >= s.start && callOffset < s.end && s.paramSlots.some((slot) => slot.includes(name))) {
+                return false; // the call site is inside a scope that rebinds `name`
+            }
+        }
+        return true;
+    });
+}
+export function unshadowedResolverTaint(resolver, callOffset) {
+    return unshadowedAt(resolver.fn.bodyText, resolver.bodyStart, resolver.taintedNames, callOffset);
+}
+/**
+ * Sink call signatures. Each must end with `(` so the argument list can be
+ * read. `.exec(`/`.query(` member forms are intentionally NOT matched as
+ * commands (they collide with `RegExp.exec` etc.); bare `exec`/`spawn`
+ * (child_process via destructuring) are.
+ */
+export const SINK_SPECS = [
+    { kind: 'eval', re: /(?<![.\w])eval\s*\(/g },
+    { kind: 'eval', re: /\bnew\s+Function\s*\(/g },
+    { kind: 'sql', re: /\$(?:queryRawUnsafe|executeRawUnsafe)\s*\(/g },
+    { kind: 'sql', re: /\.(?:query|execute|raw)\s*\(/g },
+    { kind: 'command', re: /(?<![.\w])exec(?:Sync|File)?\s*\(/g },
+    { kind: 'command', re: /(?<![.\w])spawn(?:Sync)?\s*\(/g },
+    {
+        kind: 'fs-path',
+        re: /\bfs(?:\.promises)?\s*\.\s*(?:readFile|readFileSync|writeFile|writeFileSync|appendFile|appendFileSync|createReadStream|createWriteStream|unlink|unlinkSync|readdir|readdirSync|open|openSync|rm|rmSync)\s*\(/g,
+    },
+    { kind: 'fs-path', re: /\.(?:sendFile|download)\s*\(/g },
+    { kind: 'redirect', re: /\.redirect\s*\(/g },
+    // SSRF: a request-tainted URL into an outbound HTTP client. Specific call
+    // shapes only (not a bare `.get(`) so it fires on real network sinks.
+    { kind: 'ssrf', re: /(?<![.\w])fetch\s*\(/g },
+    { kind: 'ssrf', re: /\baxios\s*(?:\.\s*(?:get|post|put|patch|delete|head|request))?\s*\(/g },
+    { kind: 'ssrf', re: /\b(?:https?)\s*\.\s*(?:request|get)\s*\(/g },
+    { kind: 'ssrf', re: /(?<![.\w])got\s*(?:\.\s*(?:get|post|put|patch|delete|head|stream))?\s*\(/g },
+];
+/** True if `ident` appears as a standalone (non-member) identifier in `text`. */
+export function identAppears(text, ident) {
+    const re = new RegExp(`(?<![.\\w])${ident.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w])`);
+    return re.test(text);
+}
+const URL_BASE_ACCESSOR = /^(?:url|origin|href|host|hostname|protocol|port)$/;
+/**
+ * For redirect sinks: a request param used only as a URL base — `new URL(path,
+ * req.url)` / `req.origin` — isn't the redirect target (the literal path is).
+ * Returns true when every appearance of `ident` is such a base accessor, so it
+ * shouldn't be treated as a tainted redirect target. A bare use or a user-input
+ * accessor (`.query`/`.nextUrl`/…) returns false → still flagged.
+ */
+export function appearsOnlyAsUrlBase(text, ident) {
+    const re = new RegExp(`(?<![.\\w])${ident.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b\\s*(?:\\.\\s*([A-Za-z_$][\\w$]*))?`, 'g');
+    let m;
+    let appeared = false;
+    while ((m = re.exec(text)) !== null) {
+        appeared = true;
+        if (!m[1] || !URL_BASE_ACCESSOR.test(m[1]))
+            return false;
+    }
+    return appeared;
+}
+/** Find every (parameter-slot → sink) pair inside one function body. */
+export function sinksUsingParams(fn, fileContent) {
+    const out = [];
+    const body = fn.bodyText;
+    const seen = new Set();
+    for (const spec of SINK_SPECS) {
+        const re = new RegExp(spec.re.source, 'g');
+        let m;
+        while ((m = re.exec(body)) !== null) {
+            const parenInBody = m.index + m[0].length - 1;
+            const args = readBalanced(body, parenInBody, '(', ')');
+            if (!args)
+                continue;
+            // For SQL sinks only the first argument (the query string) is injectable.
+            // A tainted value sitting in the bound-params slot — `conn.execute(sql, [id])`,
+            // `$queryRawUnsafe(sql, id)` — is parameterized and safe, so don't scan it.
+            // maskNonCode keeps `${…}` interpolation, so a real `\`...${id}\`` / `"..."+id`
+            // query still shows the ident in arg[0].
+            let searchText = args.text;
+            if (spec.kind === 'sql') {
+                const arg0 = (splitArgs(args.text)[0] ?? '').trim();
+                // Raw SQL takes a query string as arg[0]. An object-literal first arg means
+                // a structured `.execute({...})` — an HTTP/queue/postback adapter, not SQL.
+                if (arg0.startsWith('{'))
+                    continue;
+                searchText = arg0;
+            }
+            for (let slot = 0; slot < fn.paramSlots.length; slot++) {
+                for (const ident of fn.paramSlots[slot]) {
+                    if (!ident)
+                        continue;
+                    if (identAppears(searchText, ident)) {
+                        // A request param used only as a URL base in a redirect (e.g.
+                        // `new URL("/login", req.url)`) is not the redirect target.
+                        if (spec.kind === 'redirect' && appearsOnlyAsUrlBase(searchText, ident))
+                            continue;
+                        const key = `${slot}:${spec.kind}`;
+                        if (seen.has(key))
+                            continue;
+                        seen.add(key);
+                        const sinkOffset = fn.bodyOpenIdx + m.index;
+                        const sinkLine = lineOf(fileContent, sinkOffset);
+                        out.push({ slot, paramName: ident, kind: spec.kind, sinkLine, sinkOffset });
+                    }
+                }
+            }
+        }
+    }
+    return out;
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Taint at call sites
+// ─────────────────────────────────────────────────────────────────────────
+/** Collect local variables assigned directly from request input within a file. */
+export function taintedLocals(content) {
+    const vars = new Set();
+    const decl = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*|\{[^}]*\}|\[[^\]]*\])\s*=\s*([^;\n]+)/g;
+    let m;
+    while ((m = decl.exec(content)) !== null) {
+        if (!REQUEST_RE.test(m[2]))
+            continue;
+        const target = m[1].trim();
+        if (target.startsWith('{') || target.startsWith('[')) {
+            for (const id of target.match(/[A-Za-z_$][\w$]*/g) ?? [])
+                vars.add(id);
+        }
+        else {
+            vars.add(target);
+        }
+    }
+    return vars;
+}
+export function isTainted(argText, locals) {
+    if (REQUEST_RE.test(argText))
+        return true;
+    for (const v of locals) {
+        if (identAppears(argText, v))
+            return true;
+    }
+    return false;
+}
+/**
+ * Run the full analysis over an in-memory set of source files.
+ * Pure and deterministic — the agent is a thin wrapper around this.
+ */
+export function analyzeTaint(files) {
+    // Pass 1 — discover sink wrappers across all files.
+    const wrappers = [];
+    const byName = new Map();
+    for (const file of files) {
+        const masked = maskNonCode(file.content);
+        for (const fn of extractFunctions(masked)) {
+            if (fn.paramSlots.length === 0)
+                continue;
+            for (const hit of sinksUsingParams(fn, masked)) {
+                const w = {
+                    fnName: fn.name,
+                    file: file.path,
+                    declLine: fn.declLine,
+                    paramName: hit.paramName,
+                    paramSlot: hit.slot,
+                    sinkKind: hit.kind,
+                    sinkLine: hit.sinkLine,
+                };
+                wrappers.push(w);
+                const list = byName.get(fn.name) ?? [];
+                list.push(w);
+                byName.set(fn.name, list);
+            }
+        }
+    }
+    // Pass 1.5 — GraphQL resolvers whose `args` reaches a sink directly. The
+    // resolver itself is the wrapper, but its caller is the GraphQL framework
+    // (not visible in code), so we'd never find a tainted call site in pass 2.
+    // Emit the flow here instead. Only the args slot (positionally 2nd = idx 1)
+    // counts as a request source.
+    const flows = [];
+    const seen = new Set();
+    for (const file of files) {
+        const masked = maskNonCode(file.content);
+        for (const r of extractResolvers(masked)) {
+            for (const hit of sinksUsingParams(r.fn, masked)) {
+                if (hit.slot !== 1)
+                    continue;
+                const key = `${file.path}:${hit.sinkLine}:${r.fn.name}:${hit.slot}:${hit.kind}:resolver`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                flows.push({
+                    callFile: file.path,
+                    callLine: hit.sinkLine,
+                    wrapperFn: r.fn.name,
+                    paramSlot: hit.slot,
+                    sinkFile: file.path,
+                    sinkKind: hit.kind,
+                    crossFile: false,
+                    snippet: snippetOf(file.content, hit.sinkOffset),
+                    resolverDirect: true,
+                });
+            }
+        }
+    }
+    // Pass 2 — find tainted call sites of those wrappers.
+    for (const file of files) {
+        const masked = maskNonCode(file.content);
+        const locals = taintedLocals(masked);
+        // Inside a resolver body, the resolver's args-slot identifiers are also
+        // taint sources. Scoping to the body offset range avoids tainting random
+        // `args` locals elsewhere in the file (the original FP shape).
+        const resolvers = extractResolvers(masked);
+        for (const [name, defs] of byName) {
+            const callRe = new RegExp(`(?<![.\\w])${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*\\(`, 'g');
+            let m;
+            while ((m = callRe.exec(masked)) !== null) {
+                // Skip the wrapper's own declaration site.
+                const before = masked.slice(Math.max(0, m.index - 12), m.index);
+                if (/\bfunction\s+$/.test(before))
+                    continue;
+                const parenIdx = m.index + m[0].length - 1;
+                const args = readBalanced(masked, parenIdx, '(', ')');
+                if (!args)
+                    continue;
+                const argList = splitArgs(args.text);
+                let resolverTaint = [];
+                for (const r of resolvers) {
+                    if (m.index >= r.bodyStart && m.index < r.bodyEnd) {
+                        resolverTaint = unshadowedResolverTaint(r, m.index);
+                        break;
+                    }
+                }
+                for (const def of defs) {
+                    const slotArg = argList[def.paramSlot];
+                    if (slotArg === undefined)
+                        continue;
+                    const tainted = isTainted(slotArg, locals)
+                        || (resolverTaint.length > 0 && resolverTaint.some((n) => identAppears(slotArg, n)));
+                    if (!tainted)
+                        continue;
+                    const callLine = lineOf(file.content, m.index);
+                    const key = `${file.path}:${callLine}:${name}:${def.paramSlot}:${def.sinkKind}`;
+                    if (seen.has(key))
+                        continue;
+                    seen.add(key);
+                    flows.push({
+                        callFile: file.path,
+                        callLine,
+                        wrapperFn: name,
+                        paramSlot: def.paramSlot,
+                        sinkFile: def.file,
+                        sinkKind: def.sinkKind,
+                        crossFile: file.path !== def.file,
+                        snippet: snippetOf(file.content, m.index),
+                    });
+                }
+            }
+        }
+    }
+    // Pass 3 — NestJS: class-method sink-wrappers reached via SAME-CLASS `this.method()`,
+    // plus request params decorated with @Body/@Query/@Param/… as taint sources.
+    // Deliberately isolated from passes 1-2: class methods are never standalone
+    // wrappers (that collided with ORM `.query()` and was reverted), and call sites are
+    // gated to `this.method(...)` within the same class — a bare `.find(`/`.map(` member
+    // call can never match, so Array.prototype methods don't false-positive.
+    for (const file of files) {
+        const masked = maskNonCode(file.content);
+        const locals = taintedLocals(masked);
+        for (const cls of extractClasses(masked)) {
+            // Same-class sink-wrappers (a method whose param reaches a sink), keyed by name.
+            const classWrappers = new Map();
+            for (const method of cls.methods) {
+                const fnDef = {
+                    name: method.name, paramSlots: method.paramSlots,
+                    bodyText: method.bodyText, bodyOpenIdx: method.bodyAbsIdx,
+                    declLine: lineOf(masked, method.bodyAbsIdx),
+                };
+                const hits = sinksUsingParams(fnDef, masked);
+                if (hits.length > 0)
+                    classWrappers.set(method.name, hits.map((h) => ({ slot: h.slot, kind: h.kind })));
+            }
+            for (const method of cls.methods) {
+                const sources = method.sourceParamIds;
+                // NestJS flows REQUIRE a decorated request param (@Body/@Query/@Param/…) on
+                // this method — the distinctive, low-false-positive signal (the class-method
+                // analogue of the resolver-signature gate). A plain utility method that merely
+                // uses request-ish NAMES internally — e.g. an HTTP client's
+                // `concurrent(requests)` calling `this.request(req.url, req.body, …)` where
+                // `req` is an outbound config, not inbound input — is correctly excluded.
+                // (Trade-off: Express-in-a-class `handle(req, res)` without decorators is a
+                // conservative MISS rather than an FP; NestJS, the target, always decorates.)
+                if (sources.length === 0)
+                    continue;
+                const fnDef = {
+                    name: method.name, paramSlots: method.paramSlots,
+                    bodyText: method.bodyText, bodyOpenIdx: method.bodyAbsIdx,
+                    declLine: lineOf(masked, method.bodyAbsIdx),
+                };
+                // (a) Direct: a decorated request param reaches a sink in this method's own body.
+                for (const hit of sinksUsingParams(fnDef, masked)) {
+                    if (!sources.includes(hit.paramName))
+                        continue;
+                    // A decorated source rebound by a nested callback at the sink is not the request value.
+                    if (unshadowedAt(method.bodyText, method.bodyAbsIdx, [hit.paramName], hit.sinkOffset).length === 0)
+                        continue;
+                    const callLine = lineOf(file.content, hit.sinkOffset);
+                    const key = `${file.path}:${callLine}:${method.name}:${hit.slot}:${hit.kind}:nest-direct`;
+                    if (seen.has(key))
+                        continue;
+                    seen.add(key);
+                    flows.push({
+                        callFile: file.path, callLine, wrapperFn: method.name, paramSlot: hit.slot,
+                        sinkFile: file.path, sinkKind: hit.kind, crossFile: false,
+                        snippet: snippetOf(file.content, hit.sinkOffset),
+                    });
+                }
+                // (b) Laundered: `this.wrapper(tainted)` where wrapper is a same-class sink-wrapper.
+                const callRe = /this\s*\.\s*([A-Za-z_$][\w$]*)\s*\(/g;
+                let cm;
+                while ((cm = callRe.exec(method.bodyText)) !== null) {
+                    const targets = classWrappers.get(cm[1]);
+                    if (!targets)
+                        continue;
+                    const parenIdx = cm.index + cm[0].length - 1;
+                    const args = readBalanced(method.bodyText, parenIdx, '(', ')');
+                    if (!args)
+                        continue;
+                    const argList = splitArgs(args.text);
+                    const callAbs = method.bodyAbsIdx + cm.index;
+                    // Drop decorated sources that a nested callback enclosing THIS call rebinds
+                    // (e.g. `items.map(body => this.run(body.id))` — the inner `body` is local,
+                    // not the request body), mirroring the resolver path's shadow handling.
+                    const liveSources = unshadowedAt(method.bodyText, method.bodyAbsIdx, sources, callAbs);
+                    for (const t of targets) {
+                        const arg = argList[t.slot];
+                        if (arg === undefined)
+                            continue;
+                        const tainted = isTainted(arg, locals) || liveSources.some((s) => identAppears(arg, s));
+                        if (!tainted)
+                            continue;
+                        const callLine = lineOf(file.content, callAbs);
+                        const key = `${file.path}:${callLine}:${cm[1]}:${t.slot}:${t.kind}:nest`;
+                        if (seen.has(key))
+                            continue;
+                        seen.add(key);
+                        flows.push({
+                            callFile: file.path, callLine, wrapperFn: cm[1], paramSlot: t.slot,
+                            sinkFile: file.path, sinkKind: t.kind, crossFile: false,
+                            snippet: snippetOf(file.content, callAbs),
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return { wrappers, flows };
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Agent
+// ─────────────────────────────────────────────────────────────────────────
+const SINK_LABEL = {
+    sql: 'a raw-SQL',
+    eval: 'a dynamic-code-execution',
+    command: 'a shell-command',
+    'fs-path': 'a filesystem-path',
+    redirect: 'an HTTP-redirect',
+    ssrf: 'an outbound-HTTP (SSRF)',
+};
+export class CrossFileTaintTrackerAgent extends BaseAgent {
+    agentId = 112;
+    agentName = 'Cross-File Taint Tracker';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const filePaths = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    filePaths.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                filePaths.add(f);
+        }
+        const files = [];
+        for (const abs of filePaths) {
+            if (isTestPath(abs, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(abs, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            files.push({ path: relativise(abs, projectRoot), content });
+        }
+        const { wrappers, flows } = analyzeTaint(files);
+        this.persistAudit(projectRoot, files.length, wrappers.length, flows);
+        if (flows.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'taint-tracker',
+                description: `Scanned ${files.length} non-test file(s), ${wrappers.length} sink-wrapper(s) — no request input reaches a dangerous sink through a helper.`,
+            });
+            return findings;
+        }
+        for (const flow of flows.slice(0, 100)) {
+            const description = flow.resolverDirect
+                ? `GraphQL resolver \`${flow.wrapperFn}\` at ${flow.callFile}:${flow.callLine} reaches ${SINK_LABEL[flow.sinkKind]} sink with its \`args\` directly. The GraphQL framework supplies \`args\` from the client query — validate or parameterise it before the sink. \`${flow.snippet}\``
+                : (() => {
+                    const where = flow.crossFile
+                        ? `${flow.callFile}:${flow.callLine} passes request data to ${flow.wrapperFn}() (defined in ${flow.sinkFile})`
+                        : `${flow.callFile}:${flow.callLine} passes request data to ${flow.wrapperFn}() in the same file`;
+                    return `${flow.crossFile ? 'Cross-file' : 'Same-file'} taint flow into ${SINK_LABEL[flow.sinkKind]} sink: ${where}, whose parameter #${flow.paramSlot} reaches the sink unsanitised. Validate or parameterise the input at the boundary before it reaches ${flow.wrapperFn}(). \`${flow.snippet}\``;
+                })();
+            const idSuffix = flow.resolverDirect ? '-resolver' : '';
+            findings.push({
+                id: `${this.agentId}-taint-flow-${flow.callFile.replace(/[^\w]/g, '_')}-${flow.callLine}-${flow.wrapperFn}${idSuffix}`,
+                type: 'code-bug-security',
+                severity: 'high',
+                agentId: this.agentId,
+                module: 'taint-tracker',
+                description,
+                file: flow.callFile,
+                line: flow.callLine,
+            });
+        }
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'taint-tracker',
+            description: `Taint analysis: ${flows.length} flow(s) (${flows.filter(f => f.crossFile).length} cross-file) through ${wrappers.length} sink-wrapper(s) across ${files.length} file(s).`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, filesScanned, wrappers, flows) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            wrappers,
+            flows,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'taint-analysis.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/taint-analysis.json',
+                description: `Taint analysis: ${flows.length} flow(s) through ${wrappers} sink-wrapper(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=112-taint-tracker.js.map