@clear-capabilities/agentic-security-scanner 0.136.2 → 0.137.0

package/src/ir/CLAUDE.md

@@ -10,7 +10,12 @@ consumed by `scanner/src/dataflow/` for taint analysis.
 | JS / TS  | `parser-js.js`        | `@babel/parser`                                  |
 | Python   | `parser-py-cst.js`    | Python 3.8+ stdlib `ast` via subprocess (default when available) |
 | Python   | `parser-py.js`        | Hand-rolled regex parser (fallback when python3 missing) |
-| Java     | `parser-java.js`      | `java-parser` npm package (async)                |
+| Java     | `parser-java.js`      | `java-parser` npm package (**async only** — the deep path in `engine.js` therefore awaits `buildProjectIRAsync` when any `.java` file is present, and uses the sync builder otherwise).
+⚠ Three defects made Java taint impossible until v0.136.3+: the sync-only call site; a CST walk looking for `blockStatement` on a `block` (java-parser nests `block → blockStatements → blockStatement`), which emptied every method CFG; and `exprFromCst` missing the `primary → primaryPrefix + primarySuffix` form that models **every** method call. Guarded by `test/java-taint-flow.test.js`. Real parameter names (previously always `params: []`, marked "deferred") plus Spring `@RequestParam`/`@PathVariable`/`@RequestBody`/`@RequestHeader` param annotations (`fn.paramAnnotations`) are extracted in one CST walk over `formalParameterList` (PRD R14(a) Task 5). Varargs parameters (`String... args`) live under a distinct `variableArityParameter` node this walk doesn't extract from — they're gracefully dropped, not corrupted or crashed on. **PRD R9 (partial): `fn.calls` is now populated** via the shared `call-sites.js#callSitesFromCfg` (the same language-agnostic helper `parser-py-cst.js` uses) — Java's CFG nodes (`call`, `assign`, `return`, `if`) already matched the documented contract. This creates real cross-file call-graph edges for Java (`callgraph.js`'s `edges`/`callersOf`/`resolveKnownCallee`, previously always empty for Java) — it does NOT change the generic tainted-call-argument fallback in `engine.js`'s `exprTaint`, which reads CFG expression args directly off `expr.args` and already worked for Java independent of `fn.calls`. However, **same-class (intra-class) method calls do not resolve, in both the bare and `this.`-qualified forms**: `parser-java.js` names functions `"App.buildCmd"` (class-qualified), but a bare call extracts `"buildCmd"` (unqualified) and `callgraph.js`'s name-based resolution cannot match them — this is the most idiomatic Java call shape (private helpers, intra-class delegation) and remains a real gap, documented here as a candidate follow-up PRD item (a per-file bare-tail fallback in `callgraph.js`, mirroring the existing `~bare~`-key collision-refusal pattern, would plausibly fix it without touching `parser-java.js`). `this.buildCmd(id)` is not merely unresolved, it's worse: `parser-java.js:76` lowers any `this.`-qualified call whose prefix isn't a plain FQN to the literal callee string `"unknown"`, so it doesn't fail closed, it fails to a fabricated name. Guarded by `test/parser-java-calls.test.js` (the test's honest caveat discloses this; the fixture shows that edges exist but unresolved) (mirrors `test/parser-rb-calls.test.js`, the identical `fn.calls` wiring, though Ruby's unqualified names make bare-call resolution work there). **PRD R8: `walkStmts` now recurses into `for`/`try`/`switch`/`do`/bare-block bodies** (previously only `if`/`while` were walked — every other braced statement kind silently dropped its body from the CFG, including try-with-resources, the single most idiomatic JDBC shape). A fix round closed two further gaps the initial review found: enhanced-for (`for (x : xs)`) now synthesizes an assign binding the loop variable to the iterated expression, so the variable itself carries taint provenance (mirroring `parser-js.js`'s `ForOfStatement` pattern); and Java 14+ arrow-form `switch` (`case 1 -> …`) is now recognized via a second CST-shape branch. Deferred, not fixed: `forInit`/`forUpdate` clauses of a basic 3-clause `for` loop are still not walked (only the loop body is); `synchronized` blocks and labeled statements are still fully dropped. Guarded by `test/parser-java-control-flow.test.js`. **Measured `bench/layer-recall` impact: unchanged, 1/25 before and after** — the fix is real and directly proven by the dedicated unit tests above, but this corpus's existing 25 Java fixtures happen not to place a sink genuinely inside a braced control-flow body (the ones with `if`/`try` syntax use it as a single-line guard clause ahead of a flat-level sink, not a nested one) — see the PRD R8 status entry for the full explanation and the same finding for C#. |
+| Ruby     | `parser-rb.js`        | Hand-rolled. **`DEF_RE` must not let `\s*` cross a newline** — it did, and the body slice then started after the method's first statement, silently dropping it from every method (a one-statement body became empty). Measured as Ruby 0/20 IR-TAINT recall in `bench/layer-recall`. Guarded by `test/parser-php-rb.test.js`. ⚠ Also emitted no `fn.calls` at all (every OTHER parser does) — `callgraph.js`'s edges/callersOf/resolveKnownCallee are built entirely from `fn.calls`, so this left dead-code demotion and any interprocedural signal that depends on real call-graph resolution (rather than engine.js's generic tainted-call-argument fallback) permanently blind to Ruby. Fixed by deriving `fn.calls` from the CFG via the shared `call-sites.js#callSitesFromCfg` (the same helper `parser-py-cst.js` uses) — Ruby's node shapes already matched its documented contract. Guarded by `test/parser-rb-calls.test.js`. |
+| PHP      | `parser-php.js`       | Regex-based, hand-rolled. ⚠ **PRD R8 was this codebase's hardest single task — a genuine 3-fix-round debugging saga, all substantially about line-number precision, not detection shape.** The core fix flushes the statement splitter on a closing `}` (previously only on `;`), and adds `try`/`switch` recognizers plus a recursion guard, so statements inside `if`/`while`/`foreach`/`try`/`switch` bodies are now real CFG nodes instead of being dropped or folded into a bogus call node — this alone also resolved a pre-existing bug where `if`/`while`/`foreach` bodies were already being mis-split even before R8 touched them. Round 1 fixed the naive `}`-flush breaking `if`/`else` and multi-clause `try` (via a continuation-keyword lookahead) and switch/case's first-statement drop (via a `:`-based flush, careful to exclude `::` so PHP 8.1 enum cases and `case Foo::BAR:` class-constant labels aren't false-positived) — but round 1's own line-tracking approach was then found wrong for comment-bearing bodies and multi-line headers, a regression the round itself introduced. Round 2 fixed that (comment-skip handlers were discarding newlines uncounted; use exact `_countNewlines`-based computation everywhere) but its own re-review found the overall "exact line" property still failed, due to a *different*, genuinely pre-existing bug in the function-body's own base-line computation (wrong for Allman-brace style, multi-line signatures, blank-line-preceded functions) plus a genuine new regression from round 1 (a comment between `}` and `else`/`catch`/`finally` dropped that continuation's body entirely). Round 3 fixed both and was confirmed clean by an 8-shape holistic sweep. Also fixed along the way: dead `finally` support (greedy regex capture bug), unrecognized `try{}finally{}` with no `catch`, and the `::` case-label false-positive — via a hand-rolled balanced-brace scanner replacing the fragile regex approach. **Known, deliberately deferred gaps** (full list + grouping in the PRD R8 status entry): the PHP 8 `match` expression is unmodeled (same class as Java's arrow-switch); `if`/`else`'s pre-existing greedy-capture bug still drops the else-body's first statement; a heredoc containing a bare `}` loses its sink entirely (a real regression from R8's original commit, not the fix rounds); `#`-style comments are invisible to the splitter (pre-existing, more exposed now that control-flow bodies are reachable); `_extractBody` is not comment-aware, so an apostrophe inside *any* `//` comment (e.g. "don't" — extremely common in real PHP) silently drops the **entire file's** IR (pre-existing, large, real — see the Kotlin row below for the same defect class); `elseif`/`else if` chains are still fully unsupported (pre-existing). Guarded by `test/parser-php-control-flow.test.js`. **Measured `bench/layer-recall` impact: unchanged, 1/23 before and after — the corpus's own `1/23 → 2/23` movement is real but belongs to R14(b) (PHP `<module>` top-level lowering), not this task**, confirmed by commit-swap A/B testing (the pre-R8 parser still reproduces 2/23; the pre-R14(b) parser reproduces only 1/23). None of this corpus's `pre/` PHP fixtures place a sink genuinely inside a braced control-flow body — same explanation as the other three languages' rows. |
+| C#       | `parser-cs.js`        | Hand-rolled. ⚠ `_lowerExpr`'s string-concat branch **must** guard on `_splitTopLevelPlus` returning more than one part — when the `+` is nested inside parens the splitter returns the input unchanged and the branch recurses on the identical string (stack overflow, swallowed by `buildProjectIR`'s per-file catch, surfacing only as "no IR"). `new Type(args)` is lowered to a call so taint reaches constructor sinks such as `new SqlCommand`. Guarded by `test/parser-cs-kt.test.js`. **PRD R8: `_buildCfg` was rewritten from a flat linear CFG loop into a recursive builder** (ported from `parser-cpp.js`'s proven pattern) that recurses into `if`/`else`/`while`/`for`/`foreach`/`switch`/`do`/`try`/`catch`/`finally` bodies, with exact character-offset line computation and a `foreach`/`for`-init loop-variable assign (same lesson Java's for-each fix needed). Landed with one fix round: `using (...) { }` and `lock (...) { }` bodies were completely invisible (not in the recognized-keyword regex) — `using` is THE canonical ADO.NET wrapper around exactly the sinks this task targets, so this was a real, significant gap, fixed with a one-word regex addition. The task also deliberately deviated from its own brief in one place: it added a guarded `}`-flush to the statement splitter (the brief said not to; the reviewer confirmed the brief's own illustrative code would have dropped every statement following a control-flow block, and independently verified the deviation safe against collection/object initializers and lambda arguments). Deferred, not fixed: a collection-initializer-then-chained-call shape mis-splits (not a regression); the pre-existing `@"C:\"` verbatim-string escape bug (confirmed unchanged). Guarded by `test/parser-cs-control-flow.test.js`. **Measured `bench/layer-recall` impact: unchanged, 1/21 before and after** — same explanation as Java's row: this corpus's existing C# fixtures with `if`/`try`/`using` syntax use it as a guard clause ahead of a flat-level sink rather than nesting the sink inside the body, so they don't exercise the exact shape this fix targets. |
+| Kotlin   | `parser-kt.js`        | Hand-rolled, parallel approach to `parser-cs.js`. **PRD R8: `_buildCfg` was rewritten from a flat linear CFG loop into a new recursive builder mirroring C#'s**, with Kotlin-specific adaptations — a `_consumeChunk` chain-consumer (Kotlin's splitter doesn't flush on `}` the way C#'s does) and dedicated `_buildWhenArms` parsing (`when`'s `else` arm would otherwise collide with `if`/`else` chaining in a generic keyword scan). This was the cleanest of the four R8 tasks — zero fix rounds — in part because the implementer was briefed on the other three tasks' hard-won lessons up front: it self-caught and fixed, before it could become a fix round, the exact same function-body-base-line-anchor bug PHP's hardest round found; it correctly identified and fixed a real gap (trailing-lambda calls like `xs.forEach { x -> ... }` genuinely fell through to `{kind:'unknown'}` before the fix); and it made a deliberate, correctly-scoped decision **not** to special-case `synchronized(lock) { }` — confirmed to be an ordinary Kotlin stdlib `inline fun`, not real keyword grammar, unlike C#'s `lock`. Statement-position control flow (`if`/`while`/`for`/`when`/`do`/`try`/`catch`/`finally`) is now covered; was previously the documented 0% Kotlin taint recall in `bench/layer-recall` (0/20). **Measured `bench/layer-recall` impact: unchanged, 0/20 before and after** — the dedicated unit tests below directly prove the fix works for a sink genuinely nested inside a control-flow body, but none of this corpus's 20 existing Kotlin fixtures happen to place a sink that way (same explanation as Java's and C#'s rows) — a candidate future item is enrolling a Kotlin corpus fixture that actually exercises this shape. **Two important, NOT-a-regression scope boundaries, worth reading before assuming Kotlin's control-flow support is complete:** (1) control flow *inside* any trailing lambda (`.forEach{}`, `.use{}` — the idiomatic Kotlin JDBC/resource-management shape — `.run{}`/`.apply{}`/`.let{}`/`.also{}`) is still invisible; the lambda's call SITE is captured, but its body is not parsed, so a sink one level inside a trailing lambda is exactly as invisible as before this task — and this is plausibly where a lot of real Kotlin taint-relevant code actually lives. (2) expression-position `if` (`val r = if (...) {...} else {...}`, Kotlin's ternary-replacement idiom) still drops both branch bodies. Also deferred: `_extractBody`'s comment-unawareness — the same defect class as PHP's (see the PHP row), an apostrophe inside any `//` comment silently drops the whole function, confirmed possibly larger real-world impact than the CFG gap this task closed. Guarded by `test/parser-kt-control-flow.test.js`. ⚠ **`bench:self-scan:check`, run during this PRD's own Task 5 (full-gate verification), caught a genuine ReDoS this task's new trailing-lambda regex introduced** (`/^([\w.]+)\s*(\([^()]*\))?\s*\{[\s\S]*\}\s*$/` — an optional paren group sandwiched between two `\s*` quantifiers, the identical defect class R14(a)'s C# `attrRegex` ReDoS; confirmed genuinely quadratic by direct timing, not a detector false alarm). Fixed the same way that precedent was: restructured into two mutually-exclusive alternatives (no-parens / with-parens) rather than one optional group, re-verified linear and byte-identical across a 15-shape sweep; no `bench/self-scan/BASELINE.json` bump was needed once fixed. **Separately, and NOT fixed here** (pre-existing since commit `99c2b6a`, 2026-05-20 — predates this PRD entirely, already counted in the pre-R8 self-scan baseline): the variable-declaration regex a few lines above (`decl`, matching `val`/`var … : Type = expr`) has the same adjacent-`\s*`-around-ambiguous-content shape and is also confirmed genuinely quadratic — logged as a candidate future item, matching this PRD's own precedent for pre-existing bugs found incidentally (e.g. the R14(a) C# parenthesized-attribute-argument note). |
 | C / C++  | `parser-cpp.js`       | Hand-rolled parser (functions, qualified names, CFG lowering). Dispatched by extension (`c/cc/cpp/cxx/h/hh/hpp/hxx`) in both `buildProjectIR` and `buildProjectIRAsync`. |
 | Long-tail (rust/solidity/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. |
 
@@ -153,6 +158,11 @@ Every parser must produce this shape:
       name: 'function_name',
       line: 42,
       params: ['arg1', 'arg2', ...],
+      paramAnnotations: [{index, name, decorator}],  // R14(a): OPTIONAL — present only
+                                                        // when a param carries a recognized
+                                                        // framework decorator/attribute.
+                                                        // Populated by parser-cs.js,
+                                                        // parser-js.js, parser-java.js.
       file: 'file.py',
       cfg: {
         entry: 'nodeId',
@@ -174,7 +184,11 @@ Every parser must produce this shape:
       }
     }
   ],
-  topLevel: null,   // reserved for module-level code; not yet used
+  topLevel: null,   // qid of the synthetic <module> function wrapping
+                    // top-level statements, or null if the file has none
+                    // worth lowering. JS, Python (CST + regex), PHP, and
+                    // Ruby all populate this (PRD R14(b)); the other IR
+                    // languages still leave it null.
 }
 ```
 

package/src/ir/balanced-call.js

@@ -0,0 +1,55 @@
+// Shared by every hand-rolled regex IR parser (parser-cs.js, parser-go.js,
+// parser-php.js, parser-rb.js) for extracting a call's callee + argument
+// text without corruption when the call is followed by a chained member
+// access (`Sanitize(x).Trim()`, `$obj->clean($x)->trim()`).
+//
+// The naive pattern every one of those files used —
+// `/^(calleeRe)\s*\((.*)\)\s*$/s` — matches `(.*)` GREEDILY against the
+// LAST `)` in the string, not the one balancing the FIRST `(`. For a
+// chained call that swallows the chain's own parens into the argument
+// text (`Sanitize(x).Trim()` produced argsText = "x).Trim("), which then
+// fails to parse as any recognized expression shape in `_lowerExpr` and
+// falls through to `{kind:'unknown'}` — silently losing whatever
+// taint-relevant identifiers were inside the FIRST call's real argument
+// list, exactly the shape a wrapped-and-then-methodcalled sanitizer or
+// helper produces in real code.
+//
+// This scans forward from the first `(` tracking paren/bracket/brace
+// depth and string-literal state (so a `)` or `,` inside a nested call or
+// a string literal doesn't miscount) to find the REAL matching close
+// paren. It deliberately does NOT require that close paren to be the end
+// of the string — a trailing chain (`.Trim()`, `->trim()`, `::foo()`) is
+// simply left unconsumed rather than corrupting anything. Recovering the
+// first call's real signature is a strict improvement over the prior
+// choice between silent corruption and no match at all.
+export function matchBalancedCall(s, calleeRe) {
+  if (typeof s !== 'string') return null;
+  const m = calleeRe.exec(s);
+  if (!m || m.index !== 0) return null;
+  let i = m[0].length;
+  while (s[i] === ' ' || s[i] === '\t') i++;
+  if (s[i] !== '(') return null;
+  const openIdx = i;
+  let depth = 0;
+  let inStr = null;
+  let escape = false;
+  for (; i < s.length; i++) {
+    const c = s[i];
+    if (escape) { escape = false; continue; }
+    if (inStr) {
+      if (c === '\\') { escape = true; continue; }
+      if (c === inStr) inStr = null;
+      continue;
+    }
+    if (c === '"' || c === '\'') { inStr = c; continue; }
+    if (c === '(' || c === '[' || c === '{') { depth++; continue; }
+    if (c === ')' || c === ']' || c === '}') {
+      depth--;
+      if (depth === 0) break;
+      continue;
+    }
+  }
+  if (depth !== 0 || s[i] !== ')') return null; // unbalanced — refuse to guess
+  const callee = m[1] !== undefined ? m[1] : m[0];
+  return { callee, argsText: s.slice(openIdx + 1, i) };
+}

package/src/ir/class-hierarchy.js

@@ -20,9 +20,18 @@
 // What we DO catch:
 //   - `class Foo {}` declarations + their method signatures.
 //   - `class Bar extends Foo {}` extends relationships.
-//   - `let x = new Foo()` typed-LHS inference.
-//   - `const x: Foo = ...` TS-annotated-LHS inference.
-//   - `function buildFoo(): Foo { ... }` typed-return inference.
+//   - `let x = new Foo()` typed-LHS inference — and ONLY this shape. The
+//     assign's RHS must be a call with `isNew: true` and a bare PascalCase
+//     (or already-known-class) identifier callee.
+//
+// What this header used to claim and the code has never done (corrected in
+// whole-branch review; do not re-add the claim without the code):
+//   - `const x: Foo = ...` TS-annotated-LHS inference — NOT implemented. A
+//     TS type annotation never reaches typeOfVar.
+//   - `function buildFoo(): Foo { ... }` typed-return inference — NOT
+//     implemented. `const x = buildFoo()` is untyped (correctly: it is a
+//     plain call, not a `new`), so classOfVar returns null for `x`.
+// Both are "unknown", which downstream consumers must treat as permissive.
 
 const _AST_CACHE = new WeakMap();
 
@@ -62,16 +71,45 @@ export function buildClassHierarchy(perFileIR) {
       }
     }
     if (!Array.isArray(ir.functions)) continue;
-    // Recover class names from method qids of the shape
-    //   <file>::<scope>::<className.method>
-    // Many of our existing parsers emit class methods as `Foo.bar` in qid.
+    // Recover class names from method qids. Two shapes are recognized:
+    //   1. "Foo.bar@line#hash" — class and method dot-joined in the qid's
+    //      last segment (parser-cpp.js's convention).
+    //   2. "<file>::ClassName::method@line#hash" — class and method as
+    //      separate `::`-joined qid segments (parser-js.js's and
+    //      parser-java.js's ACTUAL convention — this was previously
+    //      unrecognized, which silently left `classes` permanently empty
+    //      for JS/Java, making resolveMethod() a no-op for those languages;
+    //      the only prior test for this coded the dot-joined shape by hand
+    //      rather than checking real parser output, which is how the gap
+    //      went uncaught. See test/receiver-type-and-nested-calls.test.js's
+    //      "registers a real JS class method from actual parser output"
+    //      regression test.)
     for (const fn of ir.functions) {
       if (!fn.qid) continue;
-      const tail = fn.qid.split('::').pop() || '';
+      const segs = fn.qid.split('::');
+      const tail = segs[segs.length - 1] || '';
       const dotIdx = tail.indexOf('.');
-      if (dotIdx <= 0) continue;
-      const className = tail.slice(0, dotIdx);
-      const methodName = tail.slice(dotIdx + 1).replace(/@\d+#[0-9a-f]+$/, '');
+      let className = null;
+      let methodName = null;
+      if (dotIdx > 0) {
+        className = tail.slice(0, dotIdx);
+        methodName = tail.slice(dotIdx + 1).replace(/@\d+#[0-9a-f]+$/, '');
+      } else if (segs.length >= 3 && /^[A-Z]/.test(segs[segs.length - 2])) {
+        // Gated on the second-to-last segment being PascalCase so this
+        // doesn't misfire on an ordinary nested-function scope segment.
+        className = segs[segs.length - 2];
+        // Two sequential strips, not one `(#[0-9a-f]+)?` optional group: the
+        // combined form is flagged by this project's own self-scan gate
+        // (engine.js's safe-regex-backed ReDoS heuristic says unsafe; the
+        // NFA-based analyzer in sast/redos-nfa.js says safe — no genuine
+        // superlinear ambiguity exists here, safe-regex's star-height
+        // heuristic is just coarser). Splitting into two definitively-safe
+        // regexes (each independently passes both checkers) is behavior-
+        // identical — verified against "tail@5#hash" and "tail@5" — and
+        // avoids relying on any one detector's judgment call.
+        methodName = tail.replace(/#[0-9a-f]+$/, '').replace(/@\d+$/, '');
+      }
+      if (!className || !methodName) continue;
       methodOwners.set(fn.qid, className);
       let cls = classes.get(className);
       if (!cls) {
@@ -91,11 +129,19 @@ export function buildClassHierarchy(perFileIR) {
         const src = n.source;
         if (!src || src.kind !== 'call') continue;
         // `new Foo()` is shaped as { kind: 'call', callee: { kind: 'ident', name: 'Foo' }, isNew: true }
+        // `isNew` is REQUIRED, not optional: without it a plain call to a
+        // PascalCase-named function (`let x = SomeFactoryFn()`) is
+        // indistinguishable from a real constructor call and silently
+        // mistypes `x` as class `SomeFactoryFn`. That mistype then flows
+        // into the dataflow engine's receiver-type gate, where a wrong
+        // "confidently resolved" type can suppress a real finding. Same
+        // `n.source.isNew` test collectInstantiatedClasses uses below.
+        if (!src.isNew) continue;
         const callee = src.callee;
         const className = callee?.kind === 'ident' ? callee.name : null;
         if (!className) continue;
         if (classes.has(className) || /^[A-Z]/.test(className)) {
-          // Convention: PascalCase callees treated as constructors.
+          // Convention: PascalCase `new` callees treated as constructors.
           const target = typeof n.target === 'string' ? n.target : null;
           if (target) typeOfVar.set(`${file}::${fn.qid}::${target}`, className);
         }

package/src/ir/index.js

@@ -182,7 +182,13 @@ export function buildProjectIR(fileContents) {
       }
     }
   }
-  const cg = buildCallGraph(perFile);
+  // PRD R7 (docs/DETECTION_GAP_REMEDIATION_PRD.md): buildCallGraph's
+  // re-export map (aliased `export {x as y} from './z'`, CJS
+  // `module.exports = require('./z')`) only populates when fileContents is
+  // passed — without it, a call to an aliased re-export can never resolve
+  // (no function is literally named the alias anywhere), a dropped edge,
+  // not just an imprecise one.
+  const cg = buildCallGraph(perFile, fileContents);
   const cha = buildClassHierarchy(perFile);
   return { perFile, callGraph: cg, cha };
 }
@@ -238,7 +244,13 @@ export async function buildProjectIRAsync(fileContents) {
       }
     }
   }
-  const cg = buildCallGraph(perFile);
+  // PRD R7 (docs/DETECTION_GAP_REMEDIATION_PRD.md): buildCallGraph's
+  // re-export map (aliased `export {x as y} from './z'`, CJS
+  // `module.exports = require('./z')`) only populates when fileContents is
+  // passed — without it, a call to an aliased re-export can never resolve
+  // (no function is literally named the alias anywhere), a dropped edge,
+  // not just an imprecise one.
+  const cg = buildCallGraph(perFile, fileContents);
   const cha = buildClassHierarchy(perFile);
   return { perFile, callGraph: cg, cha };
 }