@clear-capabilities/agentic-security-scanner 0.136.9 → 0.137.0

package/src/dataflow/engine.js

@@ -42,7 +42,7 @@
 // sanitizer must never silently drop a real vulnerability, so the walk never
 // treats a sanitizer call as clearing the tainted path on its own.
 
-import { matchSource, matchSinkOrSanitizer } from './catalog.js';
+import { matchSource, matchSinkOrSanitizer, matchMemberWriteSink, matchAnnotationParams } from './catalog.js';
 import { functionRecord } from '../ir/callgraph.js';
 import { accessPathOf, isCoveredBy, addPath, removePathAndDescendants, joinSets as joinAccessSets, setsEqual as accessSetsEqual } from './access-paths.js';
 import { aliasesForVar } from './points-to.js';
@@ -50,6 +50,13 @@ import { higherOrderTaintFlow } from './higher-order.js';
 import { SummaryCache, entryStateFromCall } from './summaries.js';
 import { lookupBuiltinSummary } from './builtin-summaries.js';
 import { isImplicitFlowEnabled, buildImplicitContext, implicitAssignTarget, markImplicitTaint, createImplicitFinding } from './implicit-flow.js';
+// NOTE: receiver-context.js's receiverTypeAtCall is deliberately NOT imported
+// here. It was the implementation of _receiverTypeFor's old `this.field`
+// branch, whose PascalCase-of-field-name guess is the false-negative bug this
+// file's _receiverTypeFor comment describes. Its other exports are still used
+// (summaries.js imports hashReceiverType for cache keying); only this call
+// site is gone.
+import { resolveMethod, classOfVar } from '../ir/class-hierarchy.js';
 
 // v0.70 #2 — addPath that also taints every alias of the variable.
 // When `target` is a dotted path like "a.x" and the root `a` has aliases
@@ -102,6 +109,74 @@ function _flattenCalleeName(calleeExpr) {
   return null;
 }
 
+// PRD R6/R11 (docs/DETECTION_GAP_REMEDIATION_PRD.md): unlike _flattenCalleeName
+// (which only flattens ONE level — `x.method`/`this.method` — because that is
+// the 2-segment shape catalog matching and resolveKnownCallee both key on),
+// _receiverTypeFor needs the FULL dotted chain, including `this`, to see how
+// LONG the chain actually is: a 3+-segment chain (`this.userRepo.save` ->
+// ['this','userRepo','save'], `svc.db.query` -> ['svc','db','query']) names a
+// receiver that is a property path, and CHA cannot type property paths at all.
+// A partial flatten (`_flattenCalleeName` returns just 'save' for
+// `this.userRepo.save`, since its object isn't a bare ident) would hide that
+// distinction and make a 3-segment chain look like an untyped bare call.
+//
+// Note: parser-js.js encodes ThisExpression as {kind:'ident', name:'_this_'}
+// (a sentinel, not literal 'this'). We convert it to the literal string
+// 'this' so the flattened chain reads the way the source does and its segment
+// count is honest (`this.db.query` is 3 segments, not 2).
+function _fullyFlattenMemberChain(calleeExpr) {
+  if (!calleeExpr) return null;
+  if (typeof calleeExpr === 'string') return calleeExpr;
+  if (calleeExpr.kind === 'ident') {
+    const name = calleeExpr.name || null;
+    // Convert the parser's _this_ sentinel to the literal 'this' string
+    return name === '_this_' ? 'this' : name;
+  }
+  if (calleeExpr.kind === 'member' && typeof calleeExpr.prop === 'string') {
+    const base = _fullyFlattenMemberChain(calleeExpr.object);
+    return base ? `${base}.${calleeExpr.prop}` : calleeExpr.prop;
+  }
+  return null;
+}
+
+// Shared by R6 (catalog receiver-type gating) and R11 (member-call
+// resolution) so both use the exact same precision bar, per the PRD's own
+// sequencing note that R11 must not be more permissive than R6. Returns null
+// whenever CHA has nothing useful to say — callers must treat null as
+// "unknown", never as a signal to suppress or refuse (see this file's
+// "Unknown ≠ clean" global constraint).
+function _receiverTypeFor(calleeExpr, callContext) {
+  if (!callContext || !callContext._cha) return null;
+  const flat = _fullyFlattenMemberChain(calleeExpr);
+  if (!flat || !flat.includes('.')) return null;
+  const parts = flat.split('.');
+  // Only a bare `x.method()` receiver (exactly 2 dot-separated parts) is
+  // something CHA can genuinely verify: classOfVar only tracks bare local
+  // variable -> class bindings from `let/const x = new Foo()`, never
+  // property-path types. This one condition replaces two separate prior
+  // bugs found in whole-branch review: the this.field branch (`this.x.y()`
+  // is 3 parts, `this` as root) used to PascalCase-guess a type from the
+  // field name and could never return null, silently suppressing real
+  // findings on any field name outside a fixed vocabulary
+  // (this.dbConn.query(), this.readReplica.query(), ...); the non-this
+  // branch used to resolve parts[0] (the chain ROOT) for multi-segment
+  // chains like svc.db.query(), which answers "what type is svc?" instead
+  // of the actual question "what type is svc.db?" -- a question CHA has no
+  // way to answer, since it never tracks field types, only local-variable
+  // types. Both were name/shape guesses being trusted as confident
+  // resolutions. A multi-segment or `this`-rooted chain now honestly
+  // returns null (unknown, permissive) rather than guessing.
+  //
+  // The same doctrine already killed a third instance of this bug class: a
+  // receiver assigned via `const c = mysql.createConnection({})` cannot be
+  // typed by CHA (member-call factory, not `new X()`), so classOfVar returns
+  // null — returning the bare name 'c' as a "type" suppressed a real finding
+  // (regression: CVE-2021-22214-node-sqli-shape). There is no name-based
+  // fallback anywhere in this function for exactly that reason.
+  if (parts.length !== 2) return null;
+  return classOfVar(callContext._cha, _currentFile, callContext._currentFnQid, parts[0]);
+}
+
 // Narrower than _flattenCalleeName: the name to hand to callGraph.resolve().
 // Only a bare identifier call (`helper()`) — or a pre-flattened STRING, which
 // is how the Go/PHP/Ruby/Python/C++ parsers already emit call targets —
@@ -120,7 +195,106 @@ function _resolvableCalleeName(calleeExpr) {
   return null;
 }
 
-function exprTaint(expr, state) {
+// R11 (docs/DETECTION_GAP_REMEDIATION_PRD.md): unlike R6's _receiverTypeFor
+// (used only to narrow an ALREADY-pattern-matched catalog sink — safe to be
+// wrong in either direction, since the worst case is over/under-gating an
+// existing match), this function creates a NEW interprocedural call-graph
+// edge. A wrong resolution here fabricates a data-flow path that does not
+// exist, which this codebase's own doctrine treats as strictly worse than
+// a missed one (see _resolvableCalleeName's comment above). It therefore
+// calls classOfVar DIRECTLY, which only returns non-null when the receiver
+// was genuinely assignment-tracked (`let x = new Foo()`), and additionally
+// requires the receiver to be a bare, non-`this` identifier expression.
+//
+// Historically _receiverTypeFor carried NAME-based fallbacks (a
+// PascalCase-of-`this.field` guess and a bare-identifier-name fallback) that
+// this function was careful never to reuse, because a same-named
+// parameter/variable/field (e.g. a duck-typed
+// `function process(Model, data) { Model.save(data); }`) would resolve to an
+// unrelated real class purely by name coincidence. Whole-branch review found
+// those same guesses were also wrong for R6's much softer use, so they are
+// gone: _receiverTypeFor now bottoms out in the same classOfVar call this
+// function makes. The two are deliberately kept as separate functions
+// anyway — they take different inputs (a flattened chain vs. a member
+// expression) and R11's extra `resolveMethod` step means it can still refuse
+// where R6 does not.
+function _resolveMemberCalleeViaCHA(calleeExpr, callContext) {
+  if (!calleeExpr || calleeExpr.kind !== 'member' || typeof calleeExpr.prop !== 'string') return null;
+  if (!callContext || !callContext._cha) return null;
+  if (!calleeExpr.object || calleeExpr.object.kind !== 'ident' || calleeExpr.object.name === '_this_') return null;
+  const className = classOfVar(callContext._cha, _currentFile, callContext._currentFnQid, calleeExpr.object.name);
+  if (!className) return null;
+  const found = resolveMethod(callContext._cha, className, calleeExpr.prop);
+  if (!found) return null;
+  return `${found.className}.${found.methodName}`;
+}
+
+// Resolve calleeExpr to { qid, fn } via the call graph — the shared
+// resolve-and-lookup sequence every summary-consulting call site needs.
+// Extracted from what were two independent, drifting copies (assign-RHS and
+// plain-call-statement) so a future change (like PRD R11 in this same file)
+// only has to land once. See _resolvableCalleeName's own comment for why a
+// bare-name/pre-flattened-string callee is the ONLY case handled here for
+// now — Task 4 (PRD R11) extends this function's body to add a second,
+// CHA-gated resolution path for member-expression callees.
+function _resolveCalleeForSummary(calleeExpr, callContext) {
+  if (!callContext || !callContext._callGraph || !callContext._callGraph.resolveKnownCallee) return null;
+  const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
+  let _resolvableName = _resolvableCalleeName(calleeExpr);
+  // PRD R11: _resolvableCalleeName refuses every member-expression callee.
+  // When that's the reason we have nothing, try the CHA-gated path before
+  // giving up — but ONLY then, so the existing exact/bare-name behavior is
+  // completely unchanged for every case it already handled.
+  if (!_resolvableName) _resolvableName = _resolveMemberCalleeViaCHA(calleeExpr, callContext);
+  if (!_resolvableName) return null;
+  const resolved = callContext._callGraph.resolveKnownCallee(_resolvableName, _callerFile);
+  const fn = functionRecord(callContext._callGraph, resolved);
+  const qid = resolved && (resolved.qid || resolved);
+  return typeof qid === 'string' ? { qid, fn } : null;
+}
+
+// PRD R10 (docs/DETECTION_GAP_REMEDIATION_PRD.md): the only two places that
+// consult a callee's SummaryCache entry are the assign-RHS and plain-call-
+// statement paths in step() below — a call nested INSIDE another expression
+// (most commonly a sink's own argument list, `sink(getUserInput())`) reaches
+// neither, so exprTaint's 'call' case fell back to checking only the nested
+// call's OWN arguments, silently losing the callee's return-taint. Mirrors
+// the same resolve -> get-or-compute -> merge sequence step()'s two existing
+// call sites use, via the Task 3/4 shared _resolveCalleeForSummary.
+function _nestedCallReturnTainted(calleeExpr, argExprs, state, callContext) {
+  if (!callContext || !callContext._summaryCache) return false;
+  const target = _resolveCalleeForSummary(calleeExpr, callContext);
+  if (!target) return false;
+  const { qid, fn } = target;
+  const paramNames = (fn && Array.isArray(fn.params)) ? fn.params : [];
+  const entry = paramNames.length
+    ? entryStateFromCall(paramNames, argExprs || [], state)
+    : new Set();
+  let sum = callContext._summaryCache.get(qid, entry);
+  if (!sum && fn && fn.cfg) {
+    sum = callContext._summaryCache.compute(qid, entry, () => {
+      const inner = {
+        _findings: [], _taintSources: [], _returnTainted: false,
+        _stack: new Set(), deadlineMs: callContext.deadlineMs,
+        _summaryCache: callContext._summaryCache,
+        _callGraph: callContext._callGraph,
+        _mutatedParamsOut: new Set(),
+        _cha: callContext._cha,
+      };
+      try { analyzeFunction(fn, _unionAnnotationTaint(fn, entry), inner); } catch {}
+      return {
+        returnTainted: !!inner._returnTainted,
+        mutatedParams: inner._mutatedParamsOut || new Set(),
+        taintedGlobals: new Set(),
+        findings: inner._findings,
+      };
+    });
+  }
+  _mergeSummaryFindings(callContext, callContext._currentFnQid, sum, 'interproc');
+  return !!(sum && sum.returnTainted);
+}
+
+function exprTaint(expr, state, callContext) {
   if (expr && (expr.kind === 'member' || expr.kind === 'call') && exprIsSource(expr)) return true;
   if (!expr) return false;
   // Constant propagation: variables assigned from literals are never tainted
@@ -134,16 +308,18 @@ function exprTaint(expr, state) {
   switch (expr.kind) {
     case 'literal':           return false;
     case 'binary':
-    case 'logical':           return exprTaint(expr.left, state) || exprTaint(expr.right, state);
-    case 'tpl':               return (expr.parts || []).some(p => exprTaint(p, state));
-    case 'union':             return (expr.branches || []).some(b => exprTaint(b, state));
-    case 'object':            return (expr.props || []).some(p => exprTaint(p.value, state));
-    case 'array':             return (expr.elements || []).some(e => exprTaint(e, state));
+    case 'logical':           return exprTaint(expr.left, state, callContext) || exprTaint(expr.right, state, callContext);
+    case 'tpl':               return (expr.parts || []).some(p => exprTaint(p, state, callContext));
+    case 'union':             return (expr.branches || []).some(b => exprTaint(b, state, callContext));
+    case 'object':            return (expr.props || []).some(p => exprTaint(p.value, state, callContext));
+    case 'array':             return (expr.elements || []).some(e => exprTaint(e, state, callContext));
     case 'call': {
-      // Calls are handled at the CFG level (the call has already been processed).
-      // For an inline call expression, conservatively return whether any arg is tainted.
-      // This loses the sanitizer effect but is safe.
-      return (expr.args || []).some(a => exprTaint(a, state));
+      // The call's own arguments (unchanged from before) OR — PRD R10 — the
+      // resolved callee's own return-taint summary. Args-tainted is checked
+      // FIRST and short-circuits: it's the cheap, no-resolve-attempt case and
+      // was already correct.
+      if ((expr.args || []).some(a => exprTaint(a, state, callContext))) return true;
+      return _nestedCallReturnTainted(expr.callee, expr.args, state, callContext);
     }
     case 'unknown':           return false;
     default:                  return false;
@@ -264,10 +440,12 @@ function literalSkeletonMatchesFamily(expr, cwe) {
 
 // calleeExpr / argExprs: the IR nodes for the call's callee and arguments.
 // state: the taint-state Set to evaluate argument taint against.
+// callContext: context from the engine (contains _cha for CHA lookups).
 // Returns { cat, argTaints }.
-function _matchCallCatalog(calleeExpr, argExprs, state) {
-  const cat = matchSinkOrSanitizer(calleeExpr, _currentFile);
-  const argTaints = (argExprs || []).map(a => exprTaint(a, state));
+function _matchCallCatalog(calleeExpr, argExprs, state, callContext) {
+  const receiverType = _receiverTypeFor(calleeExpr, callContext);
+  const cat = matchSinkOrSanitizer(calleeExpr, _currentFile, receiverType);
+  const argTaints = (argExprs || []).map(a => exprTaint(a, state, callContext));
   return { cat, argTaints };
 }
 
@@ -374,6 +552,38 @@ function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callC
   return { findings };
 }
 
+// PRD R13(a): finding shape for a member-write sink match (el.innerHTML =
+// tainted). Distinct from _sinkFindingsForCall because there is no call
+// argument list to index into — the "argument" of interest is the whole
+// assignment RHS, which the catalog entries already mark via argIndex:'rhs'
+// (a sentinel that existed in these 3 entries since they were added, with no
+// consumer until now). Mirrors _sinkFindingsForCall's trace/sanitizer
+// attribution exactly, so a member-write finding looks like any other
+// deep-mode finding downstream.
+function _memberWriteSinkFindings(hits, sourceExpr, state, callContext, line, targetPath) {
+  const findings = [];
+  for (const e of hits) {
+    const reachingSources = _sourcesReachingExpr(sourceExpr, state, callContext._taintSources);
+    const traceForThisFinding = reachingSources.length ? reachingSources.slice(0, 5) : [];
+    const _sanNames = _sanitizersForExpr(sourceExpr, callContext);
+    findings.push({
+      ...(_sanNames.size ? { _sanitizersOnPath: [..._sanNames] } : {}),
+      kind: 'taint',
+      sinkId: e.id,
+      vuln: e.vuln?.name || 'Tainted Sink',
+      severity: e.vuln?.severity || 'high',
+      cwe: e.vuln?.cwe || null,
+      remediation: e.vuln?.remediation || null,
+      line,
+      argIndex: 'rhs',
+      callee: targetPath,
+      sourceProvenance: (traceForThisFinding[0]?.provenance) || null,
+      trace: traceForThisFinding,
+    });
+  }
+  return findings;
+}
+
 // Surfaces a cached (or freshly computed) summary's `findings` into the
 // CURRENT caller's context — the only place a class-field/k=2 pre-pass's
 // speculative findings (in runTaintEngine) become reportable, because
@@ -426,11 +636,24 @@ function step(node, stateIn, callContext) {
       // return path below, including the early interprocedural returns.
       if (node.source && node.source.kind === 'call') {
         const { cat: _sinkCat, argTaints: _sinkArgTaints } =
-          _matchCallCatalog(node.source.callee, node.source.args, state);
+          _matchCallCatalog(node.source.callee, node.source.args, state, callContext);
         findings.push(..._sinkFindingsForCall(
           node.source.callee, node.source.args, _sinkCat, _sinkArgTaints,
           state, callContext, node.line).findings);
       }
+      // PRD R13(a): the assignment TARGET can itself be a sink shape
+      // (el.innerHTML = tainted) — additive to the RHS-call-sink check
+      // above, which only ever looked at node.source. `target` is only a
+      // dotted member-access path when the LHS was a member expression
+      // (lhsPath in parser-js.js); a bare identifier target ("x") has no
+      // dot and _matchMemberWriteSink correctly returns null for it.
+      if (target && target.includes('.')) {
+        const _memberHits = matchMemberWriteSink(target, _currentFile);
+        if (_memberHits && exprTaint(node.source, state, callContext)) {
+          findings.push(..._memberWriteSinkFindings(
+            _memberHits, node.source, state, callContext, node.line, target));
+        }
+      }
       // Record which sanitizers were applied to the value now held by `target`
       // (inline in the RHS, or inherited from the vars the RHS reads). Placed
       // before every early return in this case so the map cannot go stale on
@@ -457,18 +680,10 @@ function step(node, stateIn, callContext) {
       const calleeName = node.source && node.source.kind === 'call'
         ? _flattenCalleeName(node.source.callee) : null;
       if (target && calleeName && callContext._summaryCache && callContext._callGraph) {
-        const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
-        const _resolvableName = node.source && node.source.kind === 'call'
-          ? _resolvableCalleeName(node.source.callee) : null;
-        // resolveKnownCallee: never guess via resolve()'s bare-tail
-        // fallback. _resolvableCalleeName already refuses JS member
-        // expressions, but a pre-flattened STRING callee (Go/PHP/Ruby/
-        // C++/Python parsers) can still be dotted, and only the resolver
-        // itself can tell — see callgraph.js.
-        const resolved = (_resolvableName && callContext._callGraph.resolveKnownCallee)
-          ? callContext._callGraph.resolveKnownCallee(_resolvableName, _callerFile) : null;
-        const fn  = functionRecord(callContext._callGraph, resolved);
-        const qid = resolved && (resolved.qid || resolved);
+        const _resolvedTarget = node.source && node.source.kind === 'call'
+          ? _resolveCalleeForSummary(node.source.callee, callContext) : null;
+        const fn  = _resolvedTarget && _resolvedTarget.fn;
+        const qid = _resolvedTarget && _resolvedTarget.qid;
         if (typeof qid === 'string') {
           // v0.66 — context-sensitive lookup. Build the entry-state from
           // the call args + current taint; look up (and lazily compute) the
@@ -493,8 +708,9 @@ function step(node, stateIn, callContext) {
                 _summaryCache: callContext._summaryCache,
                 _callGraph: callContext._callGraph,
                 _mutatedParamsOut: new Set(),
+                _cha: callContext._cha,
               };
-              try { analyzeFunction(fn, entry, inner); } catch {}
+              try { analyzeFunction(fn, _unionAnnotationTaint(fn, entry), inner); } catch {}
               return {
                 returnTainted: !!inner._returnTainted,
                 mutatedParams: inner._mutatedParamsOut || new Set(),
@@ -533,16 +749,35 @@ function step(node, stateIn, callContext) {
           // Fallback: check builtin summaries for unresolved external calls
           const builtin = lookupBuiltinSummary(calleeName);
           if (builtin) {
-            if (builtin.returnTainted && (node.source.args || []).some(a => exprTaint(a, newState))) {
+            const _argTainted = (node.source.args || []).some(a => exprTaint(a, newState, callContext));
+            if (builtin.returnTainted && _argTainted) {
               newState = _addPathAliasAware(newState, target, callContext);
             } else if (!builtin.returnTainted) {
-              newState = removePathAndDescendants(newState, target);
+              // PRD R4b: a builtin summary saying returnTainted:false can mean
+              // two very different things — a genuinely non-deriving function
+              // (crypto.randomBytes) where clearing taint is correct, or a
+              // sanitizer-shaped function (encodeURIComponent, parseInt,
+              // DOMPurify.sanitize...) that DOES receive tainted input and
+              // whose safety is family-scoped (a URL encoder does nothing for
+              // SQLi). `_sanitizersForExpr` above already recorded the latter
+              // case into `_sanitizersByVar` when this callee is ALSO a
+              // registered catalog sanitizer — defer to sanitizer-gate.js's
+              // family-aware demotion there instead of unconditionally
+              // killing every family's taint here. Only a genuinely-untainted
+              // argument, or a callee with no catalog-sanitizer registration,
+              // still clears via removePathAndDescendants.
+              const _recordedSan = target && callContext._sanitizersByVar && callContext._sanitizersByVar.get(target);
+              if (_argTainted && _recordedSan && _recordedSan.size) {
+                newState = _addPathAliasAware(newState, target, callContext);
+              } else {
+                newState = removePathAndDescendants(newState, target);
+              }
               return { state: newState, findings };
             }
             if (builtin.mutatedParams && builtin.mutatedParams.size) {
               for (const idx of builtin.mutatedParams) {
                 const argExpr = (node.source.args || [])[parseInt(idx)];
-                if (argExpr && argExpr.kind === 'ident' && (node.source.args || []).some(a => exprTaint(a, newState))) {
+                if (argExpr && argExpr.kind === 'ident' && (node.source.args || []).some(a => exprTaint(a, newState, callContext))) {
                   newState = _addPathAliasAware(newState, argExpr.name, callContext);
                 }
               }
@@ -555,7 +790,7 @@ function step(node, stateIn, callContext) {
         const sourcePath = accessPathOf(node.source);
         if (sourcePath) newState = addPath(newState, sourcePath);
         callContext._taintSources.push({ varName: target, sourceId: src.id, sourceLabel: src.label, provenance: src.provenance || null, line: node.line });
-      } else if (exprTaint(node.source, newState)) {
+      } else if (exprTaint(node.source, newState, callContext)) {
         // P1.1: when the source IS a pure access path (e.g., RHS is `obj.foo.bar`),
         // taint the TARGET as well as transitively propagate the source path so
         // later uses of the same source remain tainted. The target path
@@ -579,20 +814,14 @@ function step(node, stateIn, callContext) {
       // Computed here (before the mutation passes below) so that argTaints
       // reflects the pre-mutation state, exactly as before this logic was
       // extracted into _matchCallCatalog/_sinkFindingsForCall.
-      const { cat, argTaints } = _matchCallCatalog(node.callee, node.args, state);
+      const { cat, argTaints } = _matchCallCatalog(node.callee, node.args, state, callContext);
       // v0.66 — apply mutated-param taint at plain (non-assign) call sites.
       // Object.assign(target, tainted) → target becomes tainted in caller.
       const _plainCallCalleeName = _flattenCalleeName(node.callee);
       if (callContext._summaryCache && callContext._callGraph && _plainCallCalleeName) {
-        const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
-        const _resolvableName = _resolvableCalleeName(node.callee);
-        // resolveKnownCallee: see the comment at the sibling call site above
-        // — a pre-flattened dotted STRING callee must not be guessed via
-        // resolve()'s bare-tail fallback.
-        const resolved = (_resolvableName && callContext._callGraph.resolveKnownCallee)
-          ? callContext._callGraph.resolveKnownCallee(_resolvableName, _callerFile) : null;
-        const fn  = functionRecord(callContext._callGraph, resolved);
-        const qid = resolved && (resolved.qid || resolved);
+        const _resolvedTarget = _resolveCalleeForSummary(node.callee, callContext);
+        const fn  = _resolvedTarget && _resolvedTarget.fn;
+        const qid = _resolvedTarget && _resolvedTarget.qid;
         if (typeof qid === 'string' && fn && Array.isArray(fn.params)) {
           const paramNames = fn.params;
           const entry = paramNames.length
@@ -613,8 +842,9 @@ function step(node, stateIn, callContext) {
                 _summaryCache: callContext._summaryCache,
                 _callGraph: callContext._callGraph,
                 _mutatedParamsOut: new Set(),
+                _cha: callContext._cha,
               };
-              try { analyzeFunction(fn, entry, inner); } catch {}
+              try { analyzeFunction(fn, _unionAnnotationTaint(fn, entry), inner); } catch {}
               return {
                 returnTainted: !!inner._returnTainted,
                 mutatedParams: inner._mutatedParamsOut || new Set(),
@@ -730,7 +960,7 @@ function step(node, stateIn, callContext) {
     }
 
     case 'return': {
-      if (exprTaint(node.value, state)) {
+      if (exprTaint(node.value, state, callContext)) {
         callContext._returnTainted = true;
       }
       return { state, findings };
@@ -746,6 +976,18 @@ function step(node, stateIn, callContext) {
   }
 }
 
+// R14(a): annotation-derived taint is a function-invariant fact — identical
+// for every call to this qid — so it is unioned into the per-call-site entry
+// state, never into the SummaryCache key (that stays exactly what the caller
+// supplied). Returns the ORIGINAL Set unchanged when there's nothing to add,
+// so callers that never touch annotation-shaped params pay zero extra cost.
+function _unionAnnotationTaint(fn, entrySet) {
+  if (!fn.paramAnnotations || !fn.paramAnnotations.length) return entrySet;
+  const extra = matchAnnotationParams(fn.paramAnnotations, fn.file);
+  if (!extra.size) return entrySet;
+  return new Set([...entrySet, ...extra]);
+}
+
 // Worklist traversal of one function's CFG with a given entry-taint-state.
 // Returns the merged exit state + the union of findings on every path + the
 // taint sources observed (for evidence trails).
@@ -812,7 +1054,7 @@ function analyzeFunction(fn, entryState, callContext) {
     try {
       const union = new Set();
       for (const s of inStates.values()) for (const p of s) union.add(p);
-      const ictx = buildImplicitContext(fn.cfg, (expr) => exprTaint(expr, union));
+      const ictx = buildImplicitContext(fn.cfg, (expr) => exprTaint(expr, union, callContext));
       // Mark vars assigned inside a tainted branch as implicit-tainted.
       let implicitState = new Set();
       for (const [nid, ctx] of ictx) {
@@ -849,7 +1091,7 @@ function analyzeFunction(fn, entryState, callContext) {
         const sink = cat && cat.find((e) => e.kind === 'sink');
         if (!sink) continue;
         const inS = inStates.get(nid) || new Set();
-        if ((node.args || []).some((a) => exprTaint(a, inS))) continue;
+        if ((node.args || []).some((a) => exprTaint(a, inS, callContext))) continue;
         const allConst = (node.args || []).length > 0 && (node.args || []).every((a) => a && a.kind === 'literal');
         if (allConst) reportImplicit(nid, node, sink, ctx.conditionLabel);
       }
@@ -863,7 +1105,7 @@ function analyzeFunction(fn, entryState, callContext) {
           const sink = cat && cat.find((e) => e.kind === 'sink');
           if (!sink) continue;
           const inS = inStates.get(nid) || new Set();
-          if ((node.args || []).some((a) => exprTaint(a, inS))) continue;
+          if ((node.args || []).some((a) => exprTaint(a, inS, callContext))) continue;
           const argRefsImplicit = (node.args || []).some((a) => {
             const ap = accessPathOf(a); return ap && isCoveredBy(implicitState, `implicit:${ap}`);
           });
@@ -957,8 +1199,11 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
         _stack: new Set(), deadlineMs,
         _summaryCache: summaryCache, _callGraph: callGraph,
         _mutatedParamsOut: new Set(),
+        _currentFnQid: fn.qid,
+        _cha: opts._cha,
+        _pointsTo: opts._pointsTo,
       };
-      try { analyzeFunction(fn, entry, ctx); } catch {}
+      try { analyzeFunction(fn, _unionAnnotationTaint(fn, entry), ctx); } catch {}
       // Report real findings discovered by this probe rather than letting
       // them die with `ctx` — see _collectFindings's header comment. Safe to
       // call every iteration and again from the main loop below: dedup is by
@@ -1023,8 +1268,11 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
         _stack: new Set(), deadlineMs,
         _summaryCache: summaryCache, _callGraph: callGraph,
         _mutatedParamsOut: new Set(),
+        _currentFnQid: fn.qid,
+        _cha: opts._cha,
+        _pointsTo: opts._pointsTo,
       };
-      try { analyzeFunction(fn, fields, ctx); } catch {}
+      try { analyzeFunction(fn, _unionAnnotationTaint(fn, fields), ctx); } catch {}
       // `findings` carries the REAL findings from this probe (was hardcoded
       // `[]`, discarding them) — but this pass is speculative (every field
       // in `fields` is assumed simultaneously tainted; nothing here confirms
@@ -1055,8 +1303,11 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
       _stack: new Set(), deadlineMs,
       _summaryCache: summaryCache, _callGraph: callGraph,
       _mutatedParamsOut: new Set(),
+      _currentFnQid: fn.qid,
+      _cha: opts._cha,
+      _pointsTo: opts._pointsTo,
     };
-    try { analyzeFunction(fn, taintedEntry, ctx); } catch {}
+    try { analyzeFunction(fn, _unionAnnotationTaint(fn, taintedEntry), ctx); } catch {}
     // `findings` carries the real findings from this probe (was hardcoded
     // `[]`). This pass assumes EVERY param is simultaneously tainted —
     // there's no check that any real caller ever passes tainted data here
@@ -1093,9 +1344,20 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
       deadlineMs,   // honored by the worklist inside analyzeFunction
       _summaryCache: summaryCache,
       _callGraph: callGraph,
+      _currentFnQid: fn.qid,
+      // PRD R12: index.js builds this graph (AGENTIC_SECURITY_POINTS_TO=1)
+      // and passes it in opts._pointsTo, but nothing previously copied it
+      // onto callContext — _addPathAliasAware reads callContext._pointsTo,
+      // which was therefore always undefined, and alias-aware tainting was
+      // a no-op even with the flag set.
+      _pointsTo: opts._pointsTo,
+      // PRD R6/R11: same pattern as _pointsTo above — the CHA opts.js builds
+      // must reach callContext or every receiver-type/member-call consumer
+      // is permanently a no-op.
+      _cha: opts._cha,
     };
     try {
-      analyzeFunction(fn, new Set(), callContext);
+      analyzeFunction(fn, _unionAnnotationTaint(fn, new Set()), callContext);
     } catch { continue; }
     // Process higher-order invocations: resolve callbacks and analyze with
     // tainted first-param. Feed findings back into the caller's finding set.
@@ -1128,8 +1390,9 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
             _stack: new Set(), deadlineMs,
             _summaryCache: summaryCache, _callGraph: callGraph,
             _mutatedParamsOut: new Set(),
+            _cha: callContext._cha,
           };
-          try { analyzeFunction(cbFn, cbEntry, inner); } catch {}
+          try { analyzeFunction(cbFn, _unionAnnotationTaint(cbFn, cbEntry), inner); } catch {}
           return {
             returnTainted: !!inner._returnTainted,
             mutatedParams: inner._mutatedParamsOut || new Set(),
@@ -1151,14 +1414,14 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
   // Dead code suppression: demote findings in functions with zero callers
   // (except route handlers which are entry points)
   const calledQids = new Set();
-  if (callGraph.edges) for (const e of callGraph.edges) calledQids.add(typeof e.to === 'string' ? e.to : e.to?.qid);
-  if (callGraph.callersOf) for (const [qid, callers] of callGraph.callersOf) { if (callers && callers.size) calledQids.add(qid); }
+  if (callGraph.edges) for (const e of callGraph.edges) if (e.callee) calledQids.add(typeof e.callee === 'string' ? e.callee : e.callee?.qid);
+  if (callGraph.callersOf) for (const [qid, callers] of callGraph.callersOf) { if (Array.isArray(callers) ? callers.length : callers?.size) calledQids.add(qid); }
   for (const f of all) {
     if (!f._funcQid) continue;
     const fn = callGraph.functions?.get(f._funcQid);
     if (!fn) continue;
     if (calledQids.has(f._funcQid)) continue;
-    if (/handler|route|controller|middleware|endpoint/i.test(fn.name || '')) continue;
+    if (fn.name === '<module>' || /handler|route|controller|middleware|endpoint/i.test(fn.name || '')) continue;
     f._inDeadCode = true;
     const dg = { critical: 'high', high: 'medium', medium: 'low', low: 'info' };
     if (dg[f.severity]) f.severity = dg[f.severity];

package/src/dataflow/index.js

@@ -12,6 +12,7 @@ import {
   serializeSummaries, commitIncrementalState,
 } from './incremental.js';
 import { buildPointsTo } from './points-to.js';
+import { buildClassHierarchy } from '../ir/class-hierarchy.js';
 import { annotateSoftTaint } from './soft-taint.js';
 import { runIfdsTaintEngine } from './ifds.js';
 import { proveExploits } from './exploit-prover.js';
@@ -79,6 +80,19 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
       priorState = null;
     }
   }
+  // PRD R6/R11 (docs/DETECTION_GAP_REMEDIATION_PRD.md): Class Hierarchy
+  // Analysis. Built once per scan (mirrors the points-to graph immediately
+  // below) and threaded through opts so the taint engine can (a) narrow
+  // catalog sink matches to the receiver's inferred type (R6) and (b) safely
+  // resolve a member call to a concrete callee when the receiver resolves to
+  // exactly one known class (R11). Unlike points-to, this is NOT gated behind
+  // an env flag — receiver-context.js and class-hierarchy.js were both
+  // already built, unit-tested, and left completely unreachable from the
+  // production pipeline (see PRD R6's evidence); building it always is cheap
+  // (a single walk of the already-parsed IR, no fixed-point iteration) and
+  // every consumer degrades to today's behavior when it finds no useful type.
+  let classHierarchy = null;
+  try { classHierarchy = buildClassHierarchy(perFileIR); } catch { classHierarchy = null; }
   // v0.70 #2 — Steensgaard points-to / alias analysis. Built once before
   // the worklist, passed via opts so the engine can resolve aliased
   // mutations (`let a = obj; a.x = tainted; sink(obj.x)`).
@@ -95,6 +109,7 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
     ...opts,
     summaryCache: preSeededCache || undefined,
     _pointsTo: pointsToGraph || undefined,
+    _cha: classHierarchy || undefined,
   });
   if (process.env.AGENTIC_SECURITY_IFDS === '1') {
     try {

package/src/dataflow/points-to.js

@@ -330,14 +330,27 @@ export function aliasesForVar(pointsTo, qid, varName) {
   const fullName = `${qid}::${varName}`;
   const aliases = pointsTo.aliasesOf(fullName);
   const out = new Set([varName]);
+  // PRD R12 (docs/DETECTION_GAP_REMEDIATION_PRD.md): a real function qid is
+  // itself multi-segment (`file::scope::name@line`) and contains `::`, so
+  // stripping up to the FIRST `::` truncates mid-qid instead of removing
+  // it — `app.js::<module>::anon@5::obj` became `<module>::anon@5::obj`,
+  // not the bare `obj` the engine's per-function taint state keys on. Strip
+  // the exact known `${qid}::` prefix first; only fall back to the
+  // first-`::` heuristic for an alias that (unusually) carries a different
+  // qid than the one being queried.
+  const prefix = `${qid}::`;
   for (const a of aliases) {
-    // Strip the qid prefix for engine-state lookups (engine state is per-fn).
-    const idx = a.indexOf('::');
-    if (idx > 0) {
-      const local = a.slice(idx + 2);
-      // Skip __loc: / __virt: synthetic names.
-      if (local && !local.startsWith('__')) out.add(local);
+    let local = null;
+    if (a.startsWith(prefix)) {
+      local = a.slice(prefix.length);
+    } else {
+      const idx = a.indexOf('::');
+      if (idx > 0) local = a.slice(idx + 2);
     }
+    // Skip __loc: / __virt: synthetic names, and any alias that still
+    // carries a qid fragment (a cross-function alias isn't a valid path in
+    // THIS function's per-fn taint state).
+    if (local && !local.startsWith('__') && !local.includes('::')) out.add(local);
   }
   return [...out];
 }