@clear-capabilities/agentic-security-scanner 0.136.9 → 0.137.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-97962939dfdb49667c5808ca441d6db28a2032f1ecf34f582e106adca48c1f16  agentic-security.mjs
+c8726408d88159f1954448e223340231893809e7cfeaa72d0fce196a39a1395c  agentic-security.mjs

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.136.9",
-  "description": "Scanner engine for the agentic-security Claude Code plugin \u2014 SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
+  "version": "0.137.0",
+  "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
   "bin": {
@@ -40,7 +40,7 @@
     "@babel/preset-react": "^8.0.1",
     "@babel/preset-typescript": "^8.0.1",
     "java-parser": "^3.0.1",
-    "js-yaml": "^5.2.3",
+    "js-yaml": "^5.3.0",
     "safe-regex": "^2.1.1"
   },
   "optionalDependencies": {
@@ -49,7 +49,7 @@
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
-    "@vercel/ncc": "^0.44.1"
+    "@vercel/ncc": "^0.45.0"
   },
   "overrides": {
     "lodash": "^4.18.1",
@@ -61,11 +61,11 @@
     "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs && node ../scripts/release-check.mjs",
     "test": "npm run test:smoke && npm run test:glob && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && npm run test:discovery && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && npm run test:python",
     "test:python": "node ../scripts/run-python-tests.mjs",
-    "test:smoke": "node --test test/smoke.test.js",
+    "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
     "test:glob": "node --test test/glob-compat.test.js",
-    "test:sast": "node --test test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js",
-    "test:posture": "node --test test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/independent-population.test.js test/evidence-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js",
-    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js",
+    "test:sast": "node --test test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/reachability-missing-callgraph-data.test.js",
+    "test:posture": "node --test test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/independent-population.test.js test/evidence-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js",
+    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js",
     "test:report": "node --test test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",

package/src/dataflow/CLAUDE.md

@@ -6,7 +6,9 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
 
 - **Intra-procedural field-sensitive taint** with access-path lattice (`access-paths.js`). `user.email` is distinguishable from `user.password`.
 - **Value-context-sensitive interprocedural taint (FR-SEM-2).** `SummaryCache` (`summaries.js`) holds a distinct summary per distinct entry-taint-state. A pre-pass computes the empty-entry base for every function; call sites then lazily compute the summary under their actual tainted-arg context (at both assign-from-call and plain-call sites) so a helper that is clean with clean args but tainted with user input is detected per call site. Bounded by a per-function context cap (`AGENTIC_SECURITY_KCFA_MAX_CONTEXTS`, default 16; 0 = monovariant). Over the cap → reuse the empty-entry summary.
-- **Catalog-driven source/sink matching.** Add entries in `catalog.js`. Each entry: `kind` ∈ {source, sink, sanitizer}, plus language + framework + match shape. 641 entries (136 source, 124 sink, 381 sanitizer — re-derive via `CATALOG.length` / a per-`kind` count rather than trusting a hardcoded number here again) spanning Express/Flask/FastAPI/Django/Rails/PHP/Go-net-http/Gin/Echo.
+- **Catalog-driven source/sink matching.** Add entries in `catalog.js`. Each entry: `kind` ∈ {source, sink, sanitizer}, plus language + framework + match shape. `match.type` ∈ {`call`, `member`, `global`, `annotation`} — 655 entries (149 source, 124 sink, 382 sanitizer — re-derive via `CATALOG.length` / a per-`kind` count rather than trusting a hardcoded number here again; this has already drifted once) spanning Express/Flask/FastAPI/Django/Rails/PHP/Go-net-http/Gin/Echo.
+  - **`match.type: 'call'`/`'member'`/`'global'`** are matched against an *expression* the taint-walker encounters while visiting a CFG node (`matchSource` / `matchSinkOrSanitizer`) — `call` against a call expression's callee, `member` against a property-access chain (`match.object` + `match.prop`), `global` against a bare identifier read.
+  - **`match.type: 'annotation'`** (R14(a): Spring `@RequestParam`/`@PathVariable`/`@RequestBody`/`@RequestHeader`, ASP.NET Core `[FromQuery]`/`[FromBody]`/`[FromForm]`/`[FromRoute]`/`[FromHeader]`, NestJS `@Query()`/`@Body()`/`@Param()`/`@Headers()`) works differently from the other three, and this is the one fact worth internalizing before touching it: **it is not consulted during the CFG walk.** There is no CFG node for "this function's own declared parameter list." Instead `matchAnnotationParams` (`catalog.js`) is called once per function — by `engine.js`'s `_unionAnnotationTaint`, before `analyzeFunction` runs — against the IR's `fn.paramAnnotations` side-channel (`{index, name, decorator}[]`, populated by `parser-cs.js`/`parser-js.js`/`parser-java.js`; see `../ir/CLAUDE.md`), and the resulting tainted param names are unioned into the entry taint-state for that function/call-site. A reader who assumes `annotation` entries get matched against expressions mid-walk, the way `call`/`member`/`global` do, will be wrong.
   - **Sanitizer entries are RECORDED, never trusted to kill taint.** `_sanitizersForExpr()` collects the sanitizer callees applied to the value reaching each sink argument — inline in the argument, or inherited from the variable it reads (`_sanitizersByVar`, updated on every assignment and cleared when the RHS is clean). They are stamped on the finding as `_sanitizersOnPath` and consumed by `sanitizer-gate.js`, which sets `sanitized` + `sanitizerProof` **only when the sanitizer's `appliesTo` family covers the finding's threat class** (`*` covers everything). The proof gate then demotes. Taint itself still dies only on clean re-assignment (`removePathAndDescendants`).
     - **Why the sanitizer does not kill the taint.** A blanket "any sanitizer clears the flow" rule scores well on benchmarks and silently drops a real SQL injection whenever the code applied an HTML escaper — `htmlspecialchars` neutralises XSS and does nothing for SQLi. Labelling demotes confidence; killing taint would delete the finding. Recall-preserving, same precedent as `falsification.js` / `proof-gate.js`: never removed, never severity-touched.
     - **The sanitization signal is may-, not must-.** `_sanitizersByVar` is keyed per variable within a function and is not branch-sensitive, so a value sanitized on only one path still carries the label. That is deliberate and safe *because* the label only demotes — the same imprecision under a taint-killing design would be a false negative.

package/src/dataflow/catalog-expanded.js

@@ -117,6 +117,7 @@ const JS_XML_JSON = [
 ];
 
 const JS_VALIDATORS = [
+  san('js', 'validator', 'validator.escape',      ['xss']),
   san('js', 'validator', 'validator.isEmail',     ['xss', 'sql']),
   san('js', 'validator', 'validator.isURL',       ['url']),
   san('js', 'validator', 'validator.isUUID',      ['*']),

package/src/dataflow/catalog.js

@@ -63,10 +63,10 @@ export const CATALOG = [
 
   // ─── SINKS (JS/TS) ─────────────────────────────────────────────────────────
   // SQL.
-  { kind: 'sink', id: 'js-sql-query',  language: 'js', framework: 'sql', match: { type: 'call', callee: 'query'    }, argIndex: 0,
+  { kind: 'sink', id: 'js-sql-query',  language: 'js', framework: 'sql', match: { type: 'call', callee: 'query', receiverTypeIn: ['db|pool|conn(?:ection)?|client|sql|database|pg|mysql|sequelize|knex|prisma'] }, argIndex: 0,
     vuln: { name: 'SQL Injection (db.query)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Use parameterized queries: db.query("SELECT * FROM t WHERE id = ?", [id]). Never interpolate untrusted strings into SQL.' } },
-  { kind: 'sink', id: 'js-sql-execute', language: 'js', framework: 'sql', match: { type: 'call', callee: 'execute' }, argIndex: 0,
+  { kind: 'sink', id: 'js-sql-execute', language: 'js', framework: 'sql', match: { type: 'call', callee: 'execute', receiverTypeIn: ['db|pool|conn(?:ection)?|client|sql|database|pg|mysql|sequelize|knex|prisma'] }, argIndex: 0,
     vuln: { name: 'SQL Injection (db.execute)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Use parameterized queries: db.execute("SELECT * FROM t WHERE id = ?", [id]).' } },
   // OS command.
@@ -173,8 +173,25 @@ export const CATALOG = [
   { kind: 'source', id: 'java-request-getReader',      language: 'java', framework: 'servlet', match: { type: 'call', callee: 'getReader' },      label: 'request.getReader' },
   { kind: 'source', id: 'java-system-getenv',          language: 'java', framework: 'stdlib',  match: { type: 'call', callee: 'getenv' },         label: 'System.getenv' },
   { kind: 'source', id: 'java-system-getProperty',     language: 'java', framework: 'stdlib',  match: { type: 'call', callee: 'getProperty' },    label: 'System.getProperty' },
-  // Spring annotation-style sources are detected per-rule, not as catalog
-  // members (they're parameter decorators rather than callable shapes).
+
+  // ─── SOURCES (Annotation/Decorator-shaped) ────────────────────────────────
+  // R14(a): annotation/decorator-shaped framework sources (Spring @RequestParam,
+  // ASP.NET Core [FromQuery], NestJS @Query()). These are indexed and matched via
+  // matchAnnotationParams, which is called once per function against the IR's
+  // paramAnnotations side-channel.
+  { kind: 'source', id: 'java-spring-requestparam',  language: 'java', framework: 'spring', match: { type: 'annotation', name: 'RequestParam' },  label: '@RequestParam (Spring)' },
+  { kind: 'source', id: 'java-spring-pathvariable',  language: 'java', framework: 'spring', match: { type: 'annotation', name: 'PathVariable' },  label: '@PathVariable (Spring)' },
+  { kind: 'source', id: 'java-spring-requestbody',   language: 'java', framework: 'spring', match: { type: 'annotation', name: 'RequestBody' },   label: '@RequestBody (Spring)' },
+  { kind: 'source', id: 'java-spring-requestheader',  language: 'java', framework: 'spring', match: { type: 'annotation', name: 'RequestHeader' }, label: '@RequestHeader (Spring)' },
+  { kind: 'source', id: 'cs-aspnet-fromquery',   language: 'cs', framework: 'aspnet', match: { type: 'annotation', name: 'FromQuery' },   label: '[FromQuery] (ASP.NET Core)' },
+  { kind: 'source', id: 'cs-aspnet-frombody',    language: 'cs', framework: 'aspnet', match: { type: 'annotation', name: 'FromBody' },    label: '[FromBody] (ASP.NET Core)' },
+  { kind: 'source', id: 'cs-aspnet-fromform',    language: 'cs', framework: 'aspnet', match: { type: 'annotation', name: 'FromForm' },    label: '[FromForm] (ASP.NET Core)' },
+  { kind: 'source', id: 'cs-aspnet-fromroute',   language: 'cs', framework: 'aspnet', match: { type: 'annotation', name: 'FromRoute' },   label: '[FromRoute] (ASP.NET Core)' },
+  { kind: 'source', id: 'cs-aspnet-fromheader',  language: 'cs', framework: 'aspnet', match: { type: 'annotation', name: 'FromHeader' },  label: '[FromHeader] (ASP.NET Core)' },
+  { kind: 'source', id: 'js-nestjs-query',   language: 'js', framework: 'nestjs', match: { type: 'annotation', name: 'Query' },   label: '@Query() (NestJS)',   provenance: 'url-param' },
+  { kind: 'source', id: 'js-nestjs-body',    language: 'js', framework: 'nestjs', match: { type: 'annotation', name: 'Body' },    label: '@Body() (NestJS)',    provenance: 'http-body' },
+  { kind: 'source', id: 'js-nestjs-param',   language: 'js', framework: 'nestjs', match: { type: 'annotation', name: 'Param' },   label: '@Param() (NestJS)',   provenance: 'path-param' },
+  { kind: 'source', id: 'js-nestjs-headers', language: 'js', framework: 'nestjs', match: { type: 'annotation', name: 'Headers' }, label: '@Headers() (NestJS)', provenance: 'header' },
 
   // ─── SOURCES (Go) ─────────────────────────────────────────────────────────
   { kind: 'source', id: 'go-r-form',     language: 'go', framework: 'net/http', match: { type: 'member', object: 'r', prop: 'Form' },     label: 'r.Form' },
@@ -360,7 +377,7 @@ export const CATALOG = [
             remediation: 'Sanitize the __html field via DOMPurify before passing it to dangerouslySetInnerHTML — better, render text via children.' } },
 
   // ─── SINKS (HTTP outbound / SSRF) ─────────────────────────────────────────
-  { kind: 'sink', id: 'py-requests-get',   language: 'py', framework: 'requests', match: { type: 'call', callee: 'get' },   argIndex: 0,
+  { kind: 'sink', id: 'py-requests-get',   language: 'py', framework: 'requests', match: { type: 'call', callee: 'get', receiverTypeIn: ['requests|session|client|http'] },   argIndex: 0,
     vuln: { name: 'SSRF (requests.get)', severity: 'high', cwe: 'CWE-918',
             remediation: 'Resolve the URL host and reject RFC1918 + metadata endpoints before fetching. Use an allow-list.' } },
   { kind: 'sink', id: 'py-requests-post',  language: 'py', framework: 'requests', match: { type: 'call', callee: 'post' },  argIndex: 0,
@@ -414,7 +431,7 @@ export const CATALOG = [
   { kind: 'sink', id: 'py-jinja-from-string', language: 'py', framework: 'jinja2', match: { type: 'call', callee: 'from_string' }, argIndex: 0,
     vuln: { name: 'SSTI (Jinja2.from_string)', severity: 'critical', cwe: 'CWE-94',
             remediation: 'Never feed a user-supplied string into a template engine. Use pre-registered templates and pass values as variables.' } },
-  { kind: 'sink', id: 'rb-erb-new',           language: 'rb', framework: 'erb',    match: { type: 'call', callee: 'new' }, argIndex: 0,
+  { kind: 'sink', id: 'rb-erb-new',           language: 'rb', framework: 'erb',    match: { type: 'call', callee: 'new', receiverTypeIn: ['^ERB$'] }, argIndex: 0,
     vuln: { name: 'SSTI (ERB.new)', severity: 'critical', cwe: 'CWE-94',
             remediation: 'Use pre-existing templates with binding/locals — never construct a template from user input.' } },
   { kind: 'sink', id: 'js-handlebars-compile',language: 'js', framework: 'handlebars', match: { type: 'call', callee: 'compile' }, argIndex: 0,
@@ -605,7 +622,7 @@ export const CATALOG = [
     vuln: { name: 'Unsafe Deserialization (yaml.load)', severity: 'high', cwe: 'CWE-502',
             remediation: 'Use yaml.safe_load instead of yaml.load on untrusted YAML.' } },
   // SSRF / HTTP-out.
-  { kind: 'sink', id: 'py-requests-get-v2',  language: 'py', framework: 'requests', match: { type: 'call', callee: 'get'  }, argIndex: 0,
+  { kind: 'sink', id: 'py-requests-get-v2',  language: 'py', framework: 'requests', match: { type: 'call', callee: 'get', receiverTypeIn: ['requests|session|client|http'] },  argIndex: 0,
     vuln: { name: 'SSRF (requests.get)', severity: 'high', cwe: 'CWE-918',
             remediation: 'Resolve the host first, reject 169.254.169.254 / RFC1918 / localhost; or proxy through a server-side allow-list.' } },
   { kind: 'sink', id: 'py-requests-post-v2', language: 'py', framework: 'requests', match: { type: 'call', callee: 'post' }, argIndex: 0,
@@ -903,6 +920,46 @@ function _receiverAllowed(entry, calleeExpr) {
   if (basePat && !segs.some((s) => new RegExp(basePat).test(String(s)))) return false;
   return true;
 }
+
+// PRD R6 (docs/DETECTION_GAP_REMEDIATION_PRD.md): a SECOND, independent
+// receiver constraint — this one checked against the CHA-INFERRED TYPE of
+// the receiver (computed by the caller, engine.js's `_receiverTypeFor`), not
+// the textual receiver-chain segments `_receiverAllowed` above checks. The
+// two are complementary: `_receiverAllowed`'s `match.receiver` regex can only
+// ever see the SOURCE TEXT of the call site (`db.query` vs `cache.query` —
+// both pass any receiver regex that doesn't special-case exact names); this
+// gate can additionally use a resolved class/variable-type hint, so a bare
+// `.query()` on something confidently NOT database-shaped can be excluded
+// without hand-listing every possible non-DB variable name as a `receiver`
+// exclusion (which `_receiverAllowed`'s regex form cannot express at all —
+// it only expresses required patterns, never forbidden ones).
+//
+// Unknown != clean: a null/undefined receiverType (CHA could not resolve
+// anything for this call site) NEVER suppresses a match — only a receiver
+// type that was confidently resolved and does not appear in the entry's
+// `receiverTypeIn` allow-list does. An entry with no `receiverTypeIn` is
+// completely unaffected by this gate (returns true unconditionally), exactly
+// like `_receiverAllowed` when neither `receiver` nor `receiverBase` is set.
+//
+// The vocabulary patterns are deliberately UNANCHORED (substring, case-
+// insensitive). They were originally written `^(?:db|pool|conn…)$` back when
+// the value reaching this gate could be a bare variable/field NAME. It no
+// longer can — after the whole-branch-review fix, `_receiverTypeFor` only
+// ever yields a real `classOfVar`-resolved CLASS name — and real class names
+// are compound: `DatabaseConnection`, `PrismaClient`, `MySQLConnection` all
+// failed the exact-anchored form and were silently suppressed, while only a
+// class literally named `Db` survived. Substring matching is the honest
+// shape for a vocabulary check over compound identifiers. `rb-erb-new`
+// stays anchored (`^ERB$`) because it names ONE exact class, not a
+// vocabulary. Over-matching here is the safe direction: it only ever
+// *permits* a match the pattern layer already made.
+function _receiverTypeAllowed(entry, receiverType) {
+  const pats = entry.match && entry.match.receiverTypeIn;
+  if (!pats || !pats.length) return true;
+  if (!receiverType) return true;
+  return pats.some((p) => new RegExp(p, 'i').test(String(receiverType)));
+}
+
 // Merge the expanded sanitizer catalog. We dedupe on `id` (case-insensitive)
 // so a base-catalog entry always wins over a same-id expanded one — the base
 // catalog is the curated/blessed surface; the expansion is additive coverage.
@@ -940,6 +997,7 @@ for (const e of CATALOG) {
 const CALLEE_INDEX = new Map();
 const MEMBER_INDEX = new Map();
 const GLOBAL_INDEX = new Map();
+const ANNOTATION_INDEX = new Map();
 for (const e of CATALOG) {
   if (!e.match) continue;
   if (e.match.type === 'call' && e.match.callee && e.match.callee !== '*') {
@@ -958,6 +1016,10 @@ for (const e of CATALOG) {
     const k = e.match.name;
     if (!GLOBAL_INDEX.has(k)) GLOBAL_INDEX.set(k, []);
     GLOBAL_INDEX.get(k).push(e);
+  } else if (e.match.type === 'annotation' && e.match.name) {
+    const k = e.match.name;
+    if (!ANNOTATION_INDEX.has(k)) ANNOTATION_INDEX.set(k, []);
+    ANNOTATION_INDEX.get(k).push(e);
   }
 }
 
@@ -1007,6 +1069,35 @@ function _globalKey(name) {
   return typeof name === 'string' && name.charCodeAt(0) === 36 /* '$' */ ? name.slice(1) : name;
 }
 
+// PRD R4a (docs/DETECTION_GAP_REMEDIATION_PRD.md): this module's own shape
+// contract above documents two callee forms — 'name' (bare, matched by last
+// segment) and 'name.foo' (matched by FULL PATH) — but both lookup sites
+// used to reduce every callee to its last segment unconditionally, so an
+// entry indexed under a full dotted key (catalog-expanded.js's `san()`
+// helper builds many: 'Encode.forHtml', 'pg.escapeLiteral',
+// 'filepath.Clean', ...) could never be retrieved. An entry lives under
+// exactly one CALLEE_INDEX key (its own `match.callee`, dotted or bare), so
+// looking up both the full path and the last segment and concatenating
+// hits never double-counts — it just also finds entries the last-segment
+// key alone was missing.
+function _calleeIndexHits(calleeExpr) {
+  let last = null;
+  let full = null;
+  if (typeof calleeExpr === 'string') {
+    full = calleeExpr;
+    last = calleeExpr.includes('.') ? calleeExpr.slice(calleeExpr.lastIndexOf('.') + 1) : calleeExpr;
+  } else if (calleeExpr && calleeExpr.kind === 'member' && calleeExpr.prop) {
+    last = calleeExpr.prop;
+    if (calleeExpr.object && calleeExpr.object.kind === 'ident') full = `${calleeExpr.object.name}.${calleeExpr.prop}`;
+  } else if (calleeExpr && calleeExpr.kind === 'ident') {
+    last = calleeExpr.name || null;
+  }
+  const raw = [];
+  if (full && full !== last) { const h = CALLEE_INDEX.get(full); if (h) raw.push(...h); }
+  if (last) { const h = CALLEE_INDEX.get(last); if (h) raw.push(...h); }
+  return raw;
+}
+
 export function matchSource(expr, file) {
   if (!expr) return null;
   // Member sources (req.query): the original path — unchanged.
@@ -1041,41 +1132,76 @@ export function matchSource(expr, file) {
   // sources were never recognized at the assignment RHS. Match by callee last
   // segment (Go gives a dotted string; JS/Py a member/ident expr).
   if (expr.kind === 'call') {
-    let cn = null;
-    if (typeof expr.callee === 'string') cn = expr.callee.includes('.') ? expr.callee.slice(expr.callee.lastIndexOf('.') + 1) : expr.callee;
-    else if (expr.callee && expr.callee.kind === 'member') cn = expr.callee.prop;
-    else if (expr.callee && expr.callee.kind === 'ident') cn = expr.callee.name;
-    if (cn) {
-      const raw = CALLEE_INDEX.get(cn);
-      if (raw) {
-        const hits = filterByProvenance(raw)
-          .filter(h => _languageAllowed(h, file))
-          .filter(h => _receiverAllowed(h, expr.callee));
-        const s = hits.find(h => h.kind === 'source');
-        if (s) return s;
-      }
+    const raw = _calleeIndexHits(expr.callee);
+    if (raw.length) {
+      const hits = filterByProvenance(raw)
+        .filter(h => _languageAllowed(h, file))
+        .filter(h => _receiverAllowed(h, expr.callee));
+      const s = hits.find(h => h.kind === 'source');
+      if (s) return s;
     }
   }
   return null;
 }
 
-export function matchSinkOrSanitizer(calleeExpr, file) {
+export function matchSinkOrSanitizer(calleeExpr, file, receiverType) {
   if (!calleeExpr) return null;
-  let calleeName = null;
-  // R3 (PRD §5): the Go IR (and other string-callee parsers) represent a call
-  // target as a dotted STRING ("db.Query") rather than a member expr. Match on
-  // the last segment so those languages' sinks/sanitizers are recognized too.
-  if (typeof calleeExpr === 'string') calleeName = calleeExpr.includes('.') ? calleeExpr.slice(calleeExpr.lastIndexOf('.') + 1) : calleeExpr;
-  else if (calleeExpr.kind === 'ident') calleeName = calleeExpr.name;
-  else if (calleeExpr.kind === 'member') calleeName = calleeExpr.prop;
-  if (!calleeName) return null;
-  const raw = CALLEE_INDEX.get(calleeName);
+  const raw = _calleeIndexHits(calleeExpr);
+  if (!raw.length) return null;
+  const hits = filterByProvenance(raw)
+    .filter(h => _languageAllowed(h, file))
+    .filter(h => _receiverAllowed(h, calleeExpr))
+    .filter(h => _receiverTypeAllowed(h, receiverType));
+  return hits.length ? hits : null;
+}
+
+// PRD R13(a) (docs/DETECTION_GAP_REMEDIATION_PRD.md): three sink entries
+// (js-innerHTML-assign, js-outerHTML-assign, react-dangerouslySetInnerHTML)
+// have sat in MEMBER_INDEX under the object:'_any_' wildcard since they were
+// added, but nothing ever queried MEMBER_INDEX for an ASSIGNMENT TARGET —
+// matchSinkOrSanitizer only reads CALLEE_INDEX, and matchSource's MEMBER_INDEX
+// lookups are for READS keyed by a SPECIFIC object name (e.g. "document.cookie"),
+// not the "any receiver" wildcard a DOM sink needs. `targetPath` is the
+// flattened LHS access-path string parser-js.js's lhsPath already produces
+// for a member-expression assignment target (e.g. "el.innerHTML" for
+// `el.innerHTML = x`) — this function extracts the property name and looks
+// it up under the wildcard key the same way `object:'_any_'` entries are
+// indexed (catalog.js's own indexing loop keys every entry by
+// `${match.object}.${match.prop}` regardless of what object names are, so a
+// wildcard entry lives under the literal key "_any_.<prop>").
+export function matchMemberWriteSink(targetPath, file) {
+  if (typeof targetPath !== 'string' || !targetPath.includes('.')) return null;
+  const prop = targetPath.slice(targetPath.lastIndexOf('.') + 1);
+  if (!prop) return null;
+  const raw = MEMBER_INDEX.get(`_any_.${prop}`);
   if (!raw) return null;
   const hits = filterByProvenance(raw)
     .filter(h => _languageAllowed(h, file))
-    .filter(h => _receiverAllowed(h, calleeExpr));
+    .filter(h => h.kind === 'sink');
   return hits.length ? hits : null;
 }
 
+// R14(a): annotation/decorator-shaped framework sources (Spring @RequestParam,
+// ASP.NET Core [FromQuery], NestJS @Query()). Unlike matchSource/matchSinkOrSanitizer,
+// this does not consult an expression encountered while walking a CFG node —
+// there is no CFG node for "this function's own declared parameter list." It is
+// consulted once per function, against the IR's paramAnnotations side-channel,
+// by engine.js's _unionAnnotationTaint before each analyzeFunction call.
+export function matchAnnotationParams(paramAnnotations, file) {
+  const tainted = new Set();
+  if (!paramAnnotations || !paramAnnotations.length) return tainted;
+  for (const pa of paramAnnotations) {
+    const raw = ANNOTATION_INDEX.get(pa.decorator);
+    if (!raw) continue;
+    const hits = filterByProvenance(raw)
+      .filter(h => _languageAllowed(h, file))
+      .filter(h => h.kind === 'source');
+    if (hits.length) {
+      tainted.add(pa.name);
+    }
+  }
+  return tainted;
+}
+
 // For tests and reflection.
 export function _catalogSize() { return CATALOG.length; }