@clear-capabilities/agentic-security-scanner 0.127.0 → 0.130.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-424585bd11f792465c48ad4fcf7bcb61be3b3351b80f3fdb500eb7f89cb6755c  agentic-security.mjs
+dd72d7c2dcc4df5e96f24285cf531a6476881867a330000427a6a8edaf71b06e  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.127.0",
+  "version": "0.130.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -35,21 +35,21 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@babel/core": "^7.29.7",
-    "@babel/preset-react": "^7.29.7",
-    "@babel/preset-typescript": "^7.29.7",
+    "@babel/core": "^8.0.1",
+    "@babel/preset-react": "^8.0.1",
+    "@babel/preset-typescript": "^8.0.1",
     "fast-glob": "^3.3.3",
     "java-parser": "^3.0.1",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^5.2.2",
     "safe-regex": "^2.1.1"
   },
   "optionalDependencies": {
-    "web-tree-sitter": "0.20.8",
-    "tree-sitter-wasms": "0.1.13"
+    "tree-sitter-wasms": "0.1.13",
+    "web-tree-sitter": "0.20.8"
   },
   "devDependencies": {
-    "@types/node": "^24.0.0",
-    "@vercel/ncc": "^0.38.3"
+    "@types/node": "^26.1.1",
+    "@vercel/ncc": "^0.44.1"
   },
   "overrides": {
     "lodash": "^4.18.1",
@@ -61,13 +61,13 @@
     "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
     "test:smoke": "node --test test/smoke.test.js",
     "test:sast": "node --test test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
-    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js",
-    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js",
+    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/attestation.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/scan-checkpoint.test.js test/llm-redact.test.js",
+    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js",
     "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js",
-    "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js",
-    "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js && node ../scripts/lint-command-descriptions.mjs",
-    "test:eval": "node --test test/independent-eval.test.js",
+    "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
+    "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js && node ../scripts/lint-command-descriptions.mjs",
+    "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
     "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",
     "smoke": "node bin/agentic-security.js scan test/fixtures/vulnerable-js",
@@ -87,7 +87,15 @@
     "bench:bigquery:smoke": "node ../bench/bigquery-github/bin/run-cycle.mjs --smoke",
     "bench:bigquery": "node ../bench/bigquery-github/bin/run-cycle.mjs",
     "bench:agent-tasks": "node ../bench/agent-tasks/security-fixer/runner.mjs",
-    "bench:polyglot": "node ../bench/polyglot/runner.mjs"
+    "bench:polyglot": "node ../bench/polyglot/runner.mjs",
+    "bench:proof-corpus": "node ../bench/proof-corpus/runner.mjs",
+    "bench:proof-corpus:pins": "node ../bench/proof-corpus/runner.mjs --refresh-pins",
+    "bench:engine-reconnect": "node ../bench/engine-reconnect/measure.mjs",
+    "bench:self-scan": "node ../bench/self-scan/measure.mjs",
+    "bench:self-scan:check": "node ../bench/self-scan/check.mjs",
+    "bench:self-scan:update-baseline": "node ../bench/self-scan/check.mjs --update-baseline",
+    "bench:engine-recall": "node ../bench/engine-recall/measure.mjs",
+    "scorecard": "node ../scripts/scorecard.mjs"
   },
   "author": "Ross Young <ross@clearcapabilities.com>",
   "license": "PolyForm-Internal-Use-1.0.0"

package/src/dataflow/CLAUDE.md

@@ -6,7 +6,10 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
 
 - **Intra-procedural field-sensitive taint** with access-path lattice (`access-paths.js`). `user.email` is distinguishable from `user.password`.
 - **Value-context-sensitive interprocedural taint (FR-SEM-2).** `SummaryCache` (`summaries.js`) holds a distinct summary per distinct entry-taint-state. A pre-pass computes the empty-entry base for every function; call sites then lazily compute the summary under their actual tainted-arg context (at both assign-from-call and plain-call sites) so a helper that is clean with clean args but tainted with user input is detected per call site. Bounded by a per-function context cap (`AGENTIC_SECURITY_KCFA_MAX_CONTEXTS`, default 16; 0 = monovariant). Over the cap → reuse the empty-entry summary.
-- **Catalog-driven source/sink/sanitizer matching.** Add entries in `catalog.js`. Each entry: `kind` ∈ {source, sink, sanitizer}, plus language + framework + match shape. 200+ entries spanning Express/Flask/FastAPI/Django/Rails/PHP/Go-net-http/Gin/Echo.
+- **Catalog-driven source/sink matching.** Add entries in `catalog.js`. Each entry: `kind` ∈ {source, sink, sanitizer}, plus language + framework + match shape. 200+ entries spanning Express/Flask/FastAPI/Django/Rails/PHP/Go-net-http/Gin/Echo.
+  - **Sanitizer entries are NOT consulted by this engine.** `matchSinkOrSanitizer()` returns hits of both kinds, but every consumer in `dataflow/*.js` keeps only `e.kind === 'sink'` — there is no `'sanitizer'` branch anywhere in this directory. Taint dies here only on clean re-assignment of a variable (`removePathAndDescendants`), independent of whether the RHS is a catalog sanitizer. Consequence: `engine.js`'s `applySanitizerGate` call is **inert** (`sanitizersOnPath` is always `{}`) because there is nothing to populate it from. Making it live needs (1) a `kind === 'sanitizer'` branch at the call site in `engine.js`, and (2) the sanitizer callee threaded onto the finding.
+  - **`match.receiver`** (optional, regex source string) constrains a call to call sites whose receiver chain has a matching segment. Callee matching is by *bare name*, so `callee: 'write'` otherwise matches `process.stdout.write` and `fh.write` as readily as `document.write`. Works for both sinks (via `matchSinkOrSanitizer`) and sources (via `matchSource`'s CALL-source path). `match.receiverBase` is an optional, independent second pattern (both `_receiverAllowed` checks must pass) — use it when `receiver` alone would still match an unrelated same-named local, e.g. `py-flask-args-get` requires *both* a property segment (`args`/`form`/`headers`/…) *and* a `request`/`req` segment, so `args = parse(); args.get(x)` doesn't fire just because some catalog entry happens to be named `get`.
+  - **`language`** is enforced by `_languageAllowed` (Phase 2) via a table (`_LANG_EXT` in `catalog.js`) covering all nine catalog languages — `js`, `py`, `cs`, `kt`, `go`, `php`, `rb`, `java` by literal regex kept byte-identical to `ir/index.js`'s own dispatch regexes (pinned by `test/phase2-scoping.test.js`, which compares `.source` directly, not just "does this regex literal appear somewhere in the file"), and `cpp` by delegating to `ir/parser-cpp.js`'s `cppExtRe()` so it can't drift from the parser. A language with no table entry stays permissive (matches any file) — additive by design, so it can't regress a language before its entry exists.
 - **Path feasibility.** Constant-folds `if` conditions to prune unreachable branches.
 - **Per-flow source attribution.** Sources reported on a finding are the ones actually reaching the sink argument (via free-var matching in the sink expression), NOT the first source the worklist happened to see. Premortem-derived.
 

package/src/dataflow/async-sequencing.js

@@ -71,7 +71,7 @@ export function describeChain(callExpr, opts = {}) {
   let isPromise = isPromiseRoot(cur);
   if (!isPromise && opts.summaryCache && opts.callGraph && cur && cur.kind === 'call') {
     const name = typeof cur.callee === 'string' ? cur.callee : (cur.callee?.name || null);
-    if (name) isPromise = isAsyncSourceFromSummary(name, opts.summaryCache, opts.callGraph);
+    if (name) isPromise = isAsyncSourceFromSummary(name, opts.summaryCache, opts.callGraph, opts.callerFile || null);
   }
   return { ops, rootCallee: cur, isPromise };
 }
@@ -91,9 +91,14 @@ function isPromiseRoot(expr) {
   return false;
 }
 
-export function isAsyncSourceFromSummary(calleeName, summaryCache, callGraph) {
+// `callerFile` is the file the call site lives in. Passing it enables the
+// call graph's same-file preference — without it a bare name (`handler`)
+// binds to whichever file's Map iterates first.
+export function isAsyncSourceFromSummary(calleeName, summaryCache, callGraph, callerFile = null) {
   if (!calleeName || !summaryCache || !callGraph) return false;
-  const resolved = callGraph.resolve ? callGraph.resolve(calleeName) : null;
+  // resolveKnownCallee, never the permissive resolve(): a guessed bare-tail
+  // edge fabricates a dataflow path that does not exist.
+  const resolved = callGraph.resolveKnownCallee ? callGraph.resolveKnownCallee(calleeName, callerFile) : null;
   const qid = resolved && (resolved.qid || resolved);
   if (typeof qid !== 'string') return false;
   const sum = summaryCache.get(qid, new Set());

package/src/dataflow/catalog.js

@@ -1,5 +1,21 @@
 // Sources / sinks / sanitizers catalog.
 //
+// Premortem (post-C/C++ taint catalog review): CALLEE_INDEX is keyed by
+// callee name ALONE, with no language filter at match time. That's fine for
+// most of the catalog because cross-language name collisions are rare and
+// even beneficial (a Python entry matching a Go call of the same name still
+// carries a real vuln). It is NOT fine for the C/C++ entries below, whose
+// names are generic libc calls (`read`, `memcpy`, `sprintf`, `fopen`, `gets`,
+// `scanf`) that also appear as ordinary, unrelated method/function names in
+// JS/Python/PHP/Java source (`stream.read()`, a user-defined `memcpy()`
+// polyfill, PHP's own `sprintf`/`fopen`). Matching those unconditionally
+// turned every `.read()` in a JS file into a recognized C source and every
+// PHP `sprintf`/`fopen` call into a C buffer-overflow/path-traversal sink.
+// `matchSource`/`matchSinkOrSanitizer` therefore accept an optional `file`
+// argument; when present, any candidate entry whose `language === 'cpp'` is
+// dropped unless `file` has a C/C++ extension. Every other entry (all other
+// languages, or a `cpp` entry when no file is supplied) is completely
+// unaffected — this is intentionally NOT general language filtering.
 // Each entry describes a callable or member-access pattern. The taint engine
 // consults this catalog when it sees a call site or a property read.
 //
@@ -70,7 +86,11 @@ export const CATALOG = [
   // XSS / DOM sinks (assignment-form, not match).
   // innerHTML and outerHTML are handled in the engine via assignment LHS matching.
   // DOM sinks.
-  { kind: 'sink', id: 'js-document-write', language: 'js', framework: 'dom', match: { type: 'call', callee: 'write' }, argIndex: 0,
+  // `receiver` is required here: a bare `write` callee is overwhelmingly
+  // `process.stdout.write` / `stream.write` / `fh.write`, not a DOM write.
+  // Only a document-ish or window-ish receiver chain qualifies.
+  { kind: 'sink', id: 'js-document-write', language: 'js', framework: 'dom',
+    match: { type: 'call', callee: 'write', receiver: '^(?:[A-Za-z_$][\\w$]*[Dd]ocument|document|doc|window|win|top|parent|self|frames|iframe|frame)$' }, argIndex: 0,
     vuln: { name: 'XSS (document.write)', severity: 'high', cwe: 'CWE-79',
             remediation: 'document.write is universally unsafe — use textContent or a typed templating engine.' } },
   // SSRF / HTTP-client sinks: matched by callee; rich-CWE classification in engine.
@@ -117,6 +137,23 @@ export const CATALOG = [
   { kind: 'source', id: 'py-flask-request-cookies',language: 'py', framework: 'flask',   match: { type: 'member', object: 'request', prop: 'cookies' }, label: 'request.cookies' },
   { kind: 'source', id: 'py-flask-request-headers',language: 'py', framework: 'flask',   match: { type: 'member', object: 'request', prop: 'headers' }, label: 'request.headers' },
   { kind: 'source', id: 'py-flask-request-data',   language: 'py', framework: 'flask',   match: { type: 'member', object: 'request', prop: 'data'    }, label: 'request.data' },
+  // Call-shaped variant of the member sources above — `request.args.get(...)`
+  // (and Flask's `.form`/`.values`/`.headers`/`.cookies`/`.json`/`.data`,
+  // Django's `.GET`/`.POST`/`.FILES`/`.META`) is at least as common in real
+  // Flask/Django code as the bare-member form, but matchSource only
+  // recognized the member itself. The alternation covers every request
+  // property this catalog already trusts as a member source
+  // (py-flask-request-args/form/json/values/cookies/headers/data above) so
+  // the `.get()` chain restores the same recall the member form has, rather
+  // than a subset of it — a first cut here covered only args/form/values and
+  // silently left request.headers.get()/cookies.get()/json.get() undetected
+  // (measured 4→0 against the pre-scoping cross-language leak, vs. 4→2 for
+  // args/form/values; see phase2-scoping.test.js's shape-by-shape A/B test).
+  // Gated by `match.receiver` (checked by matchSource via _receiverAllowed,
+  // same mechanism matchSinkOrSanitizer already uses for sinks) so a plain
+  // `dict.get(...)`/`config.get(...)` elsewhere in the file does not also
+  // fire.
+  { kind: 'source', id: 'py-flask-args-get',       language: 'py', framework: 'flask',   match: { type: 'call', callee: 'get', receiver: '^(?:args|form|values|headers|cookies|json|data|GET|POST|FILES|META)$', receiverBase: '^(?:request|req)$' }, label: 'request.args/form/values/headers/cookies/json/data.get() (Flask/Django)', provenance: 'url-param' },
   { kind: 'source', id: 'py-fastapi-request-query',language: 'py', framework: 'fastapi', match: { type: 'call',   callee: 'Query'                  }, label: 'fastapi.Query()' },
   { kind: 'source', id: 'py-fastapi-request-body', language: 'py', framework: 'fastapi', match: { type: 'call',   callee: 'Body'                   }, label: 'fastapi.Body()' },
   { kind: 'source', id: 'py-fastapi-form',         language: 'py', framework: 'fastapi', match: { type: 'call',   callee: 'Form'                   }, label: 'fastapi.Form()' },
@@ -348,10 +385,19 @@ export const CATALOG = [
             remediation: 'When the first arg is "/bin/sh" or "bash" with a -c string built from user input, the shell parses it. Pass argv array values directly to exec.Command.' } },
 
   // ─── SINKS (deserialization) ──────────────────────────────────────────────
-  { kind: 'sink', id: 'py-pickle-loads',  language: 'py', framework: 'pickle', match: { type: 'call', callee: 'loads' },     argIndex: 0,
+  // `load`/`loads` are among the most overloaded names in Python: `json.load`,
+  // `json.loads`, `tomllib.load` and `configparser`-style readers all share
+  // them and none of them are deserialization sinks. Bare-name matching made
+  // every one of those fire once sinks began matching in assignment position
+  // (`rules = json.load(fh)`), so the pyyaml/pickle entries are pinned to
+  // their own receiver — the same `match.receiver` mechanism `py-flask-args-get`
+  // already uses. Cost: a `from yaml import load; load(x)` import-style call no
+  // longer matches (no receiver segment); that is the accepted trade, and the
+  // dotted form is by far the dominant shape in real code.
+  { kind: 'sink', id: 'py-pickle-loads',  language: 'py', framework: 'pickle', match: { type: 'call', callee: 'loads', receiver: '^(?:pickle|cPickle|_pickle|dill|jsonpickle)$' },     argIndex: 0,
     vuln: { name: 'Insecure Deserialization (pickle.loads)', severity: 'critical', cwe: 'CWE-502',
             remediation: 'Never pickle-load attacker-controlled data. Use JSON / msgpack with an explicit schema.' } },
-  { kind: 'sink', id: 'py-yaml-load',     language: 'py', framework: 'pyyaml', match: { type: 'call', callee: 'load' },      argIndex: 0,
+  { kind: 'sink', id: 'py-yaml-load',     language: 'py', framework: 'pyyaml', match: { type: 'call', callee: 'load', receiver: '^(?:yaml|ruamel)$' },      argIndex: 0,
     vuln: { name: 'Insecure Deserialization (yaml.load)', severity: 'critical', cwe: 'CWE-502',
             remediation: 'Use yaml.safe_load.' } },
   { kind: 'sink', id: 'java-ois-readObject', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'readObject' }, argIndex: 'all',
@@ -547,13 +593,15 @@ export const CATALOG = [
     vuln: { name: 'Code Injection (compile)', severity: 'high', cwe: 'CWE-95',
             remediation: 'compile() followed by exec is equivalent to eval. Avoid on untrusted input.' } },
   // Deserialization.
-  { kind: 'sink', id: 'py-pickle-loads-v2', language: 'py', framework: 'std', match: { type: 'call', callee: 'loads' }, argIndex: 0,
+  // Receiver-pinned for the same reason as the base-catalog pyyaml/pickle
+  // entries above — see the comment there.
+  { kind: 'sink', id: 'py-pickle-loads-v2', language: 'py', framework: 'std', match: { type: 'call', callee: 'loads', receiver: '^(?:pickle|cPickle|_pickle|dill|jsonpickle)$' }, argIndex: 0,
     vuln: { name: 'Unsafe Deserialization (pickle.loads)', severity: 'critical', cwe: 'CWE-502',
             remediation: 'pickle.loads on untrusted data is RCE. Use JSON / msgpack with explicit schema.' } },
-  { kind: 'sink', id: 'py-pickle-load', language: 'py', framework: 'std', match: { type: 'call', callee: 'load' }, argIndex: 0,
+  { kind: 'sink', id: 'py-pickle-load', language: 'py', framework: 'std', match: { type: 'call', callee: 'load', receiver: '^(?:pickle|cPickle|_pickle|dill|jsonpickle)$' }, argIndex: 0,
     vuln: { name: 'Unsafe Deserialization (pickle.load)', severity: 'critical', cwe: 'CWE-502',
             remediation: 'pickle.load on untrusted streams is RCE.' } },
-  { kind: 'sink', id: 'py-yaml-load-v2', language: 'py', framework: 'yaml', match: { type: 'call', callee: 'load' }, argIndex: 0,
+  { kind: 'sink', id: 'py-yaml-load-v2', language: 'py', framework: 'yaml', match: { type: 'call', callee: 'load', receiver: '^(?:yaml|ruamel)$' }, argIndex: 0,
     vuln: { name: 'Unsafe Deserialization (yaml.load)', severity: 'high', cwe: 'CWE-502',
             remediation: 'Use yaml.safe_load instead of yaml.load on untrusted YAML.' } },
   // SSRF / HTTP-out.
@@ -681,6 +729,47 @@ export const CATALOG = [
   { kind: 'sanitizer', id: 'kt-int-toIntOrNull',language: 'kt', match: { type: 'call', callee: 'toIntOrNull' }, effect: 'strip', appliesTo: ['*'] },
   { kind: 'sanitizer', id: 'kt-path-canonical',language: 'kt', match: { type: 'call', callee: 'canonicalFile' },effect: 'taintIf-not-pinned', appliesTo: ['path'] },
   { kind: 'sanitizer', id: 'kt-jdbc-setstring',language: 'kt', match: { type: 'call', callee: 'setString' },    effect: 'strip', appliesTo: ['sql'] },
+
+  // ─── SOURCES (C / C++) ─────────────────────────────────────────────────────
+  { kind: 'source', id: 'cpp-getenv',  language: 'cpp', framework: null, match: { type: 'call', callee: 'getenv'  }, label: 'getenv()',  provenance: 'env' },
+  { kind: 'source', id: 'cpp-recv',    language: 'cpp', framework: null, match: { type: 'call', callee: 'recv'    }, label: 'recv()',    provenance: 'network' },
+  { kind: 'source', id: 'cpp-recvfrom',language: 'cpp', framework: null, match: { type: 'call', callee: 'recvfrom'}, label: 'recvfrom()',provenance: 'network' },
+  { kind: 'source', id: 'cpp-read',    language: 'cpp', framework: null, match: { type: 'call', callee: 'read'    }, label: 'read()',    provenance: 'file-read' },
+  { kind: 'source', id: 'cpp-fread',   language: 'cpp', framework: null, match: { type: 'call', callee: 'fread'   }, label: 'fread()',   provenance: 'file-read' },
+  { kind: 'source', id: 'cpp-fgets',   language: 'cpp', framework: null, match: { type: 'call', callee: 'fgets'   }, label: 'fgets()',   provenance: 'file-read' },
+  { kind: 'source', id: 'cpp-gets',    language: 'cpp', framework: null, match: { type: 'call', callee: 'gets'    }, label: 'gets()',    provenance: 'stdin' },
+  { kind: 'source', id: 'cpp-scanf',   language: 'cpp', framework: null, match: { type: 'call', callee: 'scanf'   }, label: 'scanf()',   provenance: 'stdin' },
+
+  // ─── SINKS (C / C++) ───────────────────────────────────────────────────────
+  { kind: 'sink', id: 'cpp-system', language: 'cpp', framework: null, match: { type: 'call', callee: 'system' }, argIndex: 0,
+    vuln: { name: 'Command injection via system()', severity: 'critical', cwe: 'CWE-78', remediation: 'Use execve() with an argument vector instead of passing a shell string; never interpolate untrusted input into a command.' } },
+  { kind: 'sink', id: 'cpp-popen', language: 'cpp', framework: null, match: { type: 'call', callee: 'popen' }, argIndex: 0,
+    vuln: { name: 'Command injection via popen()', severity: 'critical', cwe: 'CWE-78', remediation: 'Use a pipe with execve() and an argument vector rather than a shell command string.' } },
+  { kind: 'sink', id: 'cpp-execl', language: 'cpp', framework: null, match: { type: 'call', callee: 'execl' }, argIndex: 0,
+    vuln: { name: 'Command injection via execl()', severity: 'critical', cwe: 'CWE-78', remediation: 'Validate the executable path against an allow-list; never build it from untrusted input.' } },
+  { kind: 'sink', id: 'cpp-strcpy', language: 'cpp', framework: null, match: { type: 'call', callee: 'strcpy' }, argIndex: 1,
+    vuln: { name: 'Buffer overflow via strcpy()', severity: 'high', cwe: 'CWE-120', remediation: 'Use strncpy() or snprintf() with an explicit destination size.' } },
+  { kind: 'sink', id: 'cpp-strcat', language: 'cpp', framework: null, match: { type: 'call', callee: 'strcat' }, argIndex: 1,
+    vuln: { name: 'Buffer overflow via strcat()', severity: 'high', cwe: 'CWE-120', remediation: 'Use strncat() or snprintf() with an explicit destination size.' } },
+  { kind: 'sink', id: 'cpp-sprintf', language: 'cpp', framework: null, match: { type: 'call', callee: 'sprintf' }, argIndex: 'all',
+    vuln: { name: 'Buffer overflow via sprintf()', severity: 'high', cwe: 'CWE-120', remediation: 'Use snprintf() with an explicit destination size.' } },
+  { kind: 'sink', id: 'cpp-memcpy', language: 'cpp', framework: null, match: { type: 'call', callee: 'memcpy' }, argIndex: 2,
+    vuln: { name: 'Buffer overflow via unchecked memcpy() length', severity: 'high', cwe: 'CWE-787', remediation: 'Bound the copy length by the destination size before copying.' } },
+  { kind: 'sink', id: 'cpp-fopen', language: 'cpp', framework: null, match: { type: 'call', callee: 'fopen' }, argIndex: 0,
+    vuln: { name: 'Path traversal via fopen()', severity: 'high', cwe: 'CWE-22', remediation: 'Canonicalise with realpath() and confirm the result stays within an allowed base directory.' } },
+  { kind: 'sink', id: 'cpp-dlopen', language: 'cpp', framework: null, match: { type: 'call', callee: 'dlopen' }, argIndex: 0,
+    vuln: { name: 'Untrusted library load via dlopen()', severity: 'critical', cwe: 'CWE-114', remediation: 'Load only from a fixed, trusted path; never build the library path from untrusted input.' } },
+
+  // ─── SANITIZERS (C / C++) ──────────────────────────────────────────────────
+  { kind: 'sanitizer', id: 'cpp-realpath', language: 'cpp', framework: null, match: { type: 'call', callee: 'realpath' }, effect: 'strip' },
+  // Deliberately NOT listed as sanitizers: snprintf() and strncpy() bound the
+  // COPY LENGTH, they do not touch the CONTENT. `snprintf(buf, n, "ls %s",
+  // user); system(buf);` is still command injection — truncating the string
+  // doesn't remove shell metacharacters. Nothing in the engine consumes
+  // `effect` for a non-'sql' appliesTo today, so marking them 'strip' was
+  // inert, but a future sanitizer consumer would silently turn this into a
+  // false negative. realpath() stays: it genuinely canonicalises a path,
+  // which is the property CWE-22 sinks care about.
 ];
 
 // ─── Expanded sanitizer catalog (v0.65.0) ────────────────────────────────
@@ -688,6 +777,132 @@ export const CATALOG = [
 // Lives in catalog-expanded.js to keep the diff reviewable. Merged into
 // the main CATALOG below so the indexer treats them identically.
 import { EXPANDED_SANITIZERS } from './catalog-expanded.js';
+import { cppExtRe } from '../ir/parser-cpp.js';
+
+// Language-scope guard. `file` is optional — when absent, behavior is
+// unchanged from before this guard existed (every entry is allowed).
+//
+// Table-driven across all nine catalog languages (Phase 2). Extension sets
+// MUST equal the ones ir/index.js uses to dispatch each parser. Narrower
+// silently drops true positives; wider re-opens the cross-language leak that
+// put a js DOM rule on Python files in Phase 1 (the `js-document-write` sink
+// fired on `sys.stderr.write(...)` / `fh.write(...)` because callee matching
+// is by bare name). phase2-scoping.test.js pins both directions against the
+// real dispatch source in ir/index.js.
+//
+// A language with NO entry here stays permissive (matches unconditionally) —
+// that makes this table additive and means it cannot regress a language
+// before its mapping exists.
+const _LANG_EXT = {
+  js:   /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i,
+  py:   /\.py$/i,
+  cs:   /\.cs$/i,
+  kt:   /\.kt$/i,
+  go:   /\.go$/i,
+  php:  /\.(?:php|phtml)$/i,
+  rb:   /\.rb$/i,
+  java: /\.java$/i,
+};
+
+// cpp delegates to cppExtRe() rather than duplicating a literal set, so it
+// stays in lockstep with the parser dispatch in ir/index.js.
+export function _languageExtensions() {
+  return { ..._LANG_EXT, cpp: cppExtRe() };
+}
+
+// ─── Runtime families ─────────────────────────────────────────────────────
+// A catalog `language` names a catalog *dialect*, not a file type. The two are
+// usually the same thing, but not always: `java` and `kt` are two dialects over
+// ONE runtime with ONE library surface. Kotlin code calls the Java standard
+// library, JDBC, Hibernate and the servlet API constantly, and Java code can
+// call Kotlin stdlib extensions — so scoping each dialect to its own extension
+// alone silently deletes real detections in both directions.
+//
+// It did exactly that: after the per-language scoping landed, `.kt` files
+// stopped matching 12 `java`-language sinks (executeUpdate, execute,
+// prepareStatement, addBatch, createQuery, createSQLQuery, createNativeQuery,
+// File, search, compile, sendRedirect, parse) and 4 `java` sources
+// (getCookies, getInputStream, getReader, getProperty), and `.java` files
+// stopped matching `readText`. A `.kt` file with
+// `val q = req.getParameter("q"); stmt.executeUpdate(q)` went from 1 IR-TAINT
+// finding to 0 — JDBC/Hibernate SQLi, servlet open-redirect and XXE going
+// silent in Kotlin.
+//
+// So scoping is by FAMILY, not by dialect: an entry may match any file
+// extension belonging to any dialect in its family. A dialect absent from this
+// map is its own family (the common case). Keep this a declarative map rather
+// than a conditional in `_languageAllowed` — the whole point is that the next
+// person reading it sees "these dialects share a runtime" without having to
+// reverse-engineer a special case. `phase2-scoping.test.js` pins the
+// cross-family behaviour directly (executeUpdate on .kt, readText on .java);
+// the extension-set equality test cannot catch a family error, because the
+// extension sets were never wrong — the one-dialect-one-file-type assumption
+// was.
+const _LANG_FAMILY = {
+  java: ['java', 'kt'],   // JVM
+  kt:   ['java', 'kt'],   // JVM
+};
+
+// Extension regexes a given catalog language is allowed to match against.
+export function _languageFamilyExtensions(language) {
+  const all = _languageExtensions();
+  const dialects = _LANG_FAMILY[language] || [language];
+  return dialects.map(d => all[d]).filter(Boolean);
+}
+
+function _languageAllowed(entry, file) {
+  if (!file) return true;
+  const res = _languageFamilyExtensions(entry.language);
+  if (!res.length) return true;       // unmapped language stays permissive
+  return res.some(re => re.test(file));
+}
+
+// Receiver constraint (`match.receiver`), evaluated against the object chain
+// of a member-call callee. Exists because callee matching is by bare NAME:
+// `js-document-write` matches `write`, which is `document.write` (a real DOM
+// XSS sink) but equally `process.stdout.write`, `fh.write`, `stream.write`.
+// An entry that declares `receiver` only fires when some segment of its
+// receiver chain matches — a bare `write(x)` with no receiver never fires.
+//
+// Segments are collected from both expression callees (member chains) and
+// string callees (dotted names from the Go / C++ parsers).
+function _receiverSegments(calleeExpr) {
+  const segs = [];
+  if (typeof calleeExpr === 'string') {
+    const parts = calleeExpr.split('.');
+    parts.pop();                       // drop the method name itself
+    return parts;
+  }
+  if (!calleeExpr || calleeExpr.kind !== 'member') return segs;
+  let cur = calleeExpr.object;
+  let depth = 0;
+  while (cur && depth++ < 8) {
+    if (cur.kind === 'ident') { segs.push(cur.name); break; }
+    if (cur.kind === 'member') { if (typeof cur.prop === 'string') segs.push(cur.prop); cur = cur.object; continue; }
+    if (cur.kind === 'call') { cur = cur.callee; continue; }
+    break;
+  }
+  return segs;
+}
+function _receiverAllowed(entry, calleeExpr) {
+  const pat = entry.match && entry.match.receiver;
+  // `receiverBase` (optional, additive) requires a SECOND, independent
+  // segment match — e.g. `receiver` pins the property name (`headers`,
+  // `args`) while `receiverBase` pins the object it hangs off (`request`,
+  // `req`). Both are satisfied independently against the segment set (order
+  // doesn't matter — `self.request.args.get()` has `request` in the chain
+  // just like `request.args.get()` does), so a bare `args.get(...)` on an
+  // unrelated local (`args = parse(); args.get("cmd")`) fails the base check
+  // even though it still matches `receiver` on its own. Existing entries
+  // that only set `receiver` are unaffected.
+  const basePat = entry.match && entry.match.receiverBase;
+  if (!pat && !basePat) return true;
+  const segs = _receiverSegments(calleeExpr);
+  if (!segs.length) return false;      // bare `write(x)` — not a DOM call
+  if (pat && !segs.some((s) => new RegExp(pat).test(String(s)))) return false;
+  if (basePat && !segs.some((s) => new RegExp(basePat).test(String(s)))) return false;
+  return true;
+}
 // Merge the expanded sanitizer catalog. We dedupe on `id` (case-insensitive)
 // so a base-catalog entry always wins over a same-id expanded one — the base
 // catalog is the curated/blessed surface; the expansion is additive coverage.
@@ -724,6 +939,7 @@ for (const e of CATALOG) {
 // filter runs per-match by reading the env each call.
 const CALLEE_INDEX = new Map();
 const MEMBER_INDEX = new Map();
+const GLOBAL_INDEX = new Map();
 for (const e of CATALOG) {
   if (!e.match) continue;
   if (e.match.type === 'call' && e.match.callee && e.match.callee !== '*') {
@@ -734,6 +950,14 @@ for (const e of CATALOG) {
     const k = `${e.match.object}.${e.match.prop}`;
     if (!MEMBER_INDEX.has(k)) MEMBER_INDEX.set(k, []);
     MEMBER_INDEX.get(k).push(e);
+  } else if (e.match.type === 'global' && e.match.name) {
+    // Globals (PHP superglobals, rails params/session, JS location) were
+    // indexed nowhere, so matchSource could never return one — every entry
+    // declared this way was dead. Keyed by the bare name the source appears
+    // under in code.
+    const k = e.match.name;
+    if (!GLOBAL_INDEX.has(k)) GLOBAL_INDEX.set(k, []);
+    GLOBAL_INDEX.get(k).push(e);
   }
 }
 
@@ -762,13 +986,52 @@ function filterByProvenance(entries) {
   return list;
 }
 
-export function matchSource(expr) {
+// Round-1 fix follow-up: the PHP IR frontend (parser-php.js `_lowerExpr`)
+// keeps the `$` sigil on variable idents — `$_GET['cmd']` lowers to
+// `{ kind:'member', object:{ kind:'ident', name:'$_GET' }, prop:'cmd' }` —
+// but the catalog's global entries are keyed without it (`_GET`). Every
+// real PHP superglobal therefore missed GLOBAL_INDEX even after it was
+// indexed, and the earlier synthetic-ident unit tests (which built their
+// own sigil-free `{ kind:'ident', name:'_GET' }` nodes) could not catch
+// this because they never exercised the real parser's output.
+//
+// Fixed by normalizing at the lookup, not by re-keying all five PHP
+// entries with a `$`: the catalog's `match.name` is the single spot that
+// already reads naturally for every other language (Ruby `params`, JS
+// `location` carry no sigil), and a lookup-side strip keeps that uniform
+// — a future language whose IR *does* prefix variables doesn't need its
+// own catalog dialect. Ruby (`params`, `cookies`, `session`, `ENV`) and JS
+// (`location`) were checked against their real parsers in this round and
+// need no such stripping — confirmed no sigil or other prefix there.
+function _globalKey(name) {
+  return typeof name === 'string' && name.charCodeAt(0) === 36 /* '$' */ ? name.slice(1) : name;
+}
+
+export function matchSource(expr, file) {
   if (!expr) return null;
   // Member sources (req.query): the original path — unchanged.
   if (expr.kind === 'member' && expr.object?.kind === 'ident') {
     const raw = MEMBER_INDEX.get(`${expr.object.name}.${expr.prop}`);
     if (raw) {
-      const hits = filterByProvenance(raw);
+      const hits = filterByProvenance(raw).filter(h => _languageAllowed(h, file));
+      const s = hits.find(h => h.kind === 'source');
+      if (s) return s;
+    }
+    // Global sources reached as a member read off the global itself:
+    // $_GET['x'], params[:id]. Match on the member's root, not the pair.
+    const rawGlobal = GLOBAL_INDEX.get(_globalKey(expr.object.name));
+    if (rawGlobal) {
+      const hits = filterByProvenance(rawGlobal).filter(h => _languageAllowed(h, file));
+      const s = hits.find(h => h.kind === 'source');
+      if (s) return s;
+    }
+  }
+  // Bare-identifier globals: PHP superglobals, Rails params/session/cookies,
+  // Ruby ENV, JS location — referenced directly without a member access.
+  if (expr.kind === 'ident' && expr.name) {
+    const raw = GLOBAL_INDEX.get(_globalKey(expr.name));
+    if (raw) {
+      const hits = filterByProvenance(raw).filter(h => _languageAllowed(h, file));
       const s = hits.find(h => h.kind === 'source');
       if (s) return s;
     }
@@ -785,7 +1048,9 @@ export function matchSource(expr) {
     if (cn) {
       const raw = CALLEE_INDEX.get(cn);
       if (raw) {
-        const hits = filterByProvenance(raw);
+        const hits = filterByProvenance(raw)
+          .filter(h => _languageAllowed(h, file))
+          .filter(h => _receiverAllowed(h, expr.callee));
         const s = hits.find(h => h.kind === 'source');
         if (s) return s;
       }
@@ -794,7 +1059,7 @@ export function matchSource(expr) {
   return null;
 }
 
-export function matchSinkOrSanitizer(calleeExpr) {
+export function matchSinkOrSanitizer(calleeExpr, file) {
   if (!calleeExpr) return null;
   let calleeName = null;
   // R3 (PRD §5): the Go IR (and other string-callee parsers) represent a call
@@ -806,7 +1071,9 @@ export function matchSinkOrSanitizer(calleeExpr) {
   if (!calleeName) return null;
   const raw = CALLEE_INDEX.get(calleeName);
   if (!raw) return null;
-  const hits = filterByProvenance(raw);
+  const hits = filterByProvenance(raw)
+    .filter(h => _languageAllowed(h, file))
+    .filter(h => _receiverAllowed(h, calleeExpr));
   return hits.length ? hits : null;
 }
 

package/src/dataflow/cross-repo.js

@@ -23,7 +23,7 @@
 // name is the GitHub slug ('owner/name'); specPath is relative within
 // that repo; specContent is the raw YAML/JSON.
 
-import * as yaml from 'js-yaml';
+import * as yaml from '../util/yaml.js';
 
 const METHODS = ['get', 'post', 'put', 'patch', 'delete', 'head', 'options'];
 

package/src/dataflow/cross-service-taint.js

@@ -42,7 +42,7 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import * as yaml from 'js-yaml';
+import * as yaml from '../util/yaml.js';
 
 const SERVICES_FILE_NAMES = ['services.yml', 'services.yaml'];