@clear-capabilities/agentic-security-scanner 0.145.0 → 0.147.5

package/src/engine.js

@@ -206,6 +206,7 @@ import { applyPathConstraints } from './posture/path-predicates.js';
 import { buildProjectIR, buildProjectIRAsync } from './ir/index.js';
 import { collectIrStats, irStatsTarget, writeIrStats } from './ir/ir-stats.js';
 import { runDeepAnalysis } from './dataflow/index.js';
+import { buildLineageGraph } from './lineage/index.js';
 // v3 next-gen — Pillars 1, 4, 5, 6, 8, 9.
 import { annotateCloneClusters, findCloneOutliers } from './posture/semantic-clone.js';
 import { annotateAiProvenance } from './posture/ai-code-fingerprint.js';
@@ -9229,6 +9230,95 @@ function _deterministicFileTimings(timings) {
           : (_inCi ? 'not requested (deep analysis defaults to off in CI)' : 'not requested')),
     failure: _deepFailure,
   };
+  // Sub-project E, increment 5 — Data Flow Explorer lineage graph.
+  // DELIBERATELY INDEPENDENT of AGENTIC_SECURITY_DEEP/_deepEnabled above
+  // (see src/lineage/DESIGN_GRAPH_BUILDER.md §9.5): lineage analysis has no
+  // degraded/non-IR-backed mode, so gating it on deep mode ALSO being on
+  // would make AGENTIC_SECURITY_LINEAGE_DEEP=1 alone silently produce
+  // nothing whenever deep mode itself was off.
+  //
+  // Undisclosed-until-final-review side effect (N-4): this block populates
+  // the SAME `_sharedIR` memo the privacy-taint block further below reads
+  // (`_privacyIrBacked = !!(_sharedIR && _sharedIR.perFile)`), so setting
+  // AGENTIC_SECURITY_LINEAGE_DEEP=1 also upgrades privacy-taint annotation
+  // to IR-backed (`privacyIrBacked: true` instead of `false`) even with
+  // AGENTIC_SECURITY_DEEP itself off. A real, deliberate-once-noticed
+  // consequence of the memo sharing, not a bug — but worth knowing about
+  // before being surprised by it.
+  const _lineageRequested = process.env.AGENTIC_SECURITY_LINEAGE_DEEP === '1';
+  const _lineageStatus = {
+    requested: _lineageRequested,
+    enabled: false,
+    reason: _lineageRequested ? null : 'not requested',
+    failure: null,
+  };
+  let _lineageGraph = null;
+  if (_lineageRequested) {
+    _lineageStatus.enabled = true;
+    const _lineageBudgetMs = parseInt(process.env.AGENTIC_SECURITY_LINEAGE_TIMEOUT_MS || '300000', 10);
+    try {
+      // Reuses the SAME _sharedIR memo _deepEnabled's own block above uses —
+      // if deep mode already built it, this is free; if not, this is what
+      // first triggers the build (the whole reason this gate is independent).
+      const { perFile, callGraph } = _sharedIR || (_sharedIR = await _buildIR());
+      const _lr = buildLineageGraph(callGraph, {
+        // scanRoot can be null (e.g. an MCP scan_diff caller, or
+        // runFullScan invoked directly with no scanRoot) — fall back to
+        // undefined rather than inventing a repository name from the
+        // process's own CWD basename, which would make lineage node ids
+        // depend on wherever the process happened to be launched from and
+        // collide across two unrelated repos sharing a directory basename.
+        // `undefined` lets graph-builder.js's own `opts.repository ?? 'repo'`
+        // default apply — the single source of truth for that literal.
+        repository: scanRoot ? path.basename(path.resolve(scanRoot)) : undefined,
+        // Milestone 2, Sub-project G, increment 1 (FR-408/AC-09): the real
+        // scan root, threaded straight through — distinct from `repository`
+        // above, which is only a basename. `index.js`'s own `buildLineageGraph`
+        // uses this ONLY to load `.agentic-security/privacy-policy.json`
+        // (never to derive `repository`/node ids), mirroring how `fileContents`
+        // was threaded through for Sub-project B's own transit-evidence scan.
+        scanRoot,
+        deterministic: isDeterministic(),
+        perFile,
+        fileContents,
+      });
+      if (_lr.status === 'complete') {
+        _lineageGraph = _lr.graph;
+        if (_lr.elapsedMs > _lineageBudgetMs) {
+          // Same "measured, not truly interrupted" disclosure _deepEnabled's
+          // own elapsed > budgetMs branch already makes for IR-taint — see
+          // src/lineage/DESIGN_GRAPH_BUILDER.md §9.5.
+          aF.push({
+            id: `lineage-timeout:${scanRoot || ''}`,
+            file: '(lineage-engine)', line: 0,
+            vuln: `Lineage graph build exceeded ${_lineageBudgetMs}ms budget (${_lr.elapsedMs}ms used) — results may be incomplete`,
+            severity: 'info',
+            parser: 'LINEAGE',
+            confidence: 0.5,
+          });
+        }
+      } else if (_lr.status === 'failed') {
+        _lineageStatus.failure = _lr.failure;
+      }
+      // status === 'not_available' needs no extra handling: _lineageGraph
+      // stays null, and enabled:true/failure:null correctly reads as "ran,
+      // produced nothing" (a genuinely empty/malformed callGraph), distinct
+      // from "never ran" (requested:false).
+    } catch (e) {
+      // Lineage is best-effort, mirroring _deepEnabled's own catch above
+      // (engine.js, `_deepFailure = String((e && e.message) || e);`):
+      // anything OUTSIDE buildLineageGraph's own try/catch — the _buildIR()
+      // call itself, path.resolve, etc. — must never kill the scan. Without
+      // this, a throw here (e.g. from buildCallGraph, which
+      // buildProjectIR/buildProjectIRAsync do NOT guard per-file the way
+      // per-file parsing is guarded) previously took down the entire scan
+      // the moment AGENTIC_SECURITY_LINEAGE_DEEP=1 was set — see
+      // src/lineage/DESIGN_GRAPH_BUILDER.md §9.5 item 1 and the Global
+      // Constraint this violated ("a lineage-build failure must never fail
+      // the scan"). Regression-tested in test/lineage-fault-injection.test.js.
+      _lineageStatus.failure = String((e && e.message) || e);
+    }
+  }
   // Java SCA enrichment: use deep-mode IR call graph to improve Java function reachability
   if (_deepCallGraph) {
     try {
@@ -10585,6 +10675,7 @@ function _deterministicFileTimings(timings) {
     engineErrors: { cppDataflowParseErrors: _cppDataflowParseErrors.value },
     deepStatus: _deepStatus,
     analyzerCoverage: summarizeCoverageForScanHealth(_coverageLedger),
+    lineageStatus: _lineageStatus,
   });
   // FR-207: stale vulnerability feeds, calibration data, and compliance
   // evidence are real assurance gaps, not just findings the feed omits --
@@ -10600,7 +10691,7 @@ function _deterministicFileTimings(timings) {
     compliance: _complianceReport ? { stale: _complianceReport.summary?.stale || 0 } : null,
   });
   } // end if (!skipAnnotators) — FR-PROV-029
-  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,detectorErrors:_detectorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,privacyIrBacked:_privacyIrBacked,privacyTaxonomyVersion:_privacyTaxonomyVersion,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary,scanHealth:_scanHealth,coverageLedger:_coverageLedger};}
+  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,detectorErrors:_detectorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,privacyIrBacked:_privacyIrBacked,privacyTaxonomyVersion:_privacyTaxonomyVersion,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary,scanHealth:_scanHealth,coverageLedger:_coverageLedger,lineageGraph:_lineageGraph,lineageStatus:_lineageStatus};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".
 // Orphans (no finding linkage) are bucketed by file-local heuristic so the UI shows binary states only.

package/src/ir/CLAUDE.md

@@ -10,6 +10,7 @@ consumed by `scanner/src/dataflow/` for taint analysis.
 | JS / TS  | `parser-js.js`        | `@babel/parser`. **Taint-recall PRD (80%) Tier 3: JSX had ZERO IR modeling** — every `JSXElement` fell through `exprOf`'s switch to `{kind:'unknown'}`, so `return <div dangerouslySetInnerHTML={{__html: html}} />` (React's canonical XSS sink, and a real corpus miss) silently dropped `html`'s taint entirely, even though the plain-JS member-write form (`x.dangerouslySetInnerHTML = {...}`) was already cataloged. Deliberately narrow, not general JSX modeling: `exprOf`'s new `JSXElement` case (via `_findDangerouslySetInnerHTML`) extracts ONLY the `dangerouslySetInnerHTML` attribute's `__html` property value — found on the element itself or, recursively, any descendant (the attribute can sit on a nested element, not just the one directly returned) — and lowers it to a synthetic call (`__jsx_dangerously_set_inner_html__`), targeted by a sink of the same name (`react-jsx-dangerouslySetInnerHTML`) sibling to the existing member-write entry. Ordinary JSX children (`<div>{unsafeText}</div>`) are deliberately NOT modeled — React auto-escapes children by default, so that shape isn't itself a vulnerability the way `dangerouslySetInnerHTML` is. Guarded by `test/catalog-xss-p4.test.js`. |
 | Python   | `parser-py-cst.js`    | Python 3.8+ stdlib `ast` via subprocess (default when available) |
 | Python   | `parser-py.js`        | Hand-rolled regex parser (fallback when python3 missing) |
+| (tool capability probe) | `chrome-probe.mjs` | Chrome/Chromium binary discovery — optional local tool, detects and probes availability via `probeChromeAvailable()`, following `parser-py-cst.js`'s established graceful-degradation pattern. Consumed by Milestone 4's image export functions (`exportPng`/`exportPdf`/`exportSvg` in `scripts/export-image.mjs`) for headless rendering. |
 | Java     | `parser-java.js`      | `java-parser` npm package (**async only** — the deep path in `engine.js` therefore awaits `buildProjectIRAsync` when any `.java` file is present, and uses the sync builder otherwise).
 ⚠ Three defects made Java taint impossible until v0.136.3+: the sync-only call site; a CST walk looking for `blockStatement` on a `block` (java-parser nests `block → blockStatements → blockStatement`), which emptied every method CFG; and `exprFromCst` missing the `primary → primaryPrefix + primarySuffix` form that models **every** method call. Guarded by `test/java-taint-flow.test.js`. Real parameter names (previously always `params: []`, marked "deferred") plus Spring `@RequestParam`/`@PathVariable`/`@RequestBody`/`@RequestHeader` param annotations (`fn.paramAnnotations`) are extracted in one CST walk over `formalParameterList` (PRD R14(a) Task 5). Varargs parameters (`String... args`) live under a distinct `variableArityParameter` node this walk doesn't extract from — they're gracefully dropped, not corrupted or crashed on. **PRD R9 (partial): `fn.calls` is now populated** via the shared `call-sites.js#callSitesFromCfg` (the same language-agnostic helper `parser-py-cst.js` uses) — Java's CFG nodes (`call`, `assign`, `return`, `if`) already matched the documented contract. This creates real cross-file call-graph edges for Java (`callgraph.js`'s `edges`/`callersOf`/`resolveKnownCallee`, previously always empty for Java) — it does NOT change the generic tainted-call-argument fallback in `engine.js`'s `exprTaint`, which reads CFG expression args directly off `expr.args` and already worked for Java independent of `fn.calls`. However, **same-class (intra-class) method calls do not resolve, in both the bare and `this.`-qualified forms**: `parser-java.js` names functions `"App.buildCmd"` (class-qualified), but a bare call extracts `"buildCmd"` (unqualified) and `callgraph.js`'s name-based resolution cannot match them — this is the most idiomatic Java call shape (private helpers, intra-class delegation) and remains a real gap, documented here as a candidate follow-up PRD item (a per-file bare-tail fallback in `callgraph.js`, mirroring the existing `~bare~`-key collision-refusal pattern, would plausibly fix it without touching `parser-java.js`). `this.buildCmd(id)` is not merely unresolved, it's worse: `parser-java.js:76` lowers any `this.`-qualified call whose prefix isn't a plain FQN to the literal callee string `"unknown"`, so it doesn't fail closed, it fails to a fabricated name. Guarded by `test/parser-java-calls.test.js` (the test's honest caveat discloses this; the fixture shows that edges exist but unresolved) (mirrors `test/parser-rb-calls.test.js`, the identical `fn.calls` wiring, though Ruby's unqualified names make bare-call resolution work there). **PRD R8: `walkStmts` now recurses into `for`/`try`/`switch`/`do`/bare-block bodies** (previously only `if`/`while` were walked — every other braced statement kind silently dropped its body from the CFG, including try-with-resources, the single most idiomatic JDBC shape). A fix round closed two further gaps the initial review found: enhanced-for (`for (x : xs)`) now synthesizes an assign binding the loop variable to the iterated expression, so the variable itself carries taint provenance (mirroring `parser-js.js`'s `ForOfStatement` pattern); and Java 14+ arrow-form `switch` (`case 1 -> …`) is now recognized via a second CST-shape branch. Deferred, not fixed: `forInit`/`forUpdate` clauses of a basic 3-clause `for` loop are still not walked (only the loop body is); `synchronized` blocks and labeled statements are still fully dropped. Guarded by `test/parser-java-control-flow.test.js`. **Measured `bench/layer-recall` impact: unchanged, 1/25 before and after** — the fix is real and directly proven by the dedicated unit tests above, but this corpus's existing 25 Java fixtures happen not to place a sink genuinely inside a braced control-flow body (the ones with `if`/`try` syntax use it as a single-line guard clause ahead of a flat-level sink, not a nested one) — see the PRD R8 status entry for the full explanation and the same finding for C#. **Taint-recall PRD (80%) Tier 4: chained-call CST fix.** `exprFromCst`'s `primaryPrefix` handling previously used `.find(Boolean)` to grab the FIRST `methodInvocationSuffix` in a `primary` node's `primarySuffix[]` array and discarded the rest — so any 2+-level fluent chain (`DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(xml)`, `new SpelExpressionParser().parseExpression(expr).getValue()`) resolved to the wrong (inner, usually untainted) call, and the real sink call at the end of the chain was invisible to the taint walker. Rewritten to walk the full `primarySuffix[]` array in source order, dot-joining bare member-access segments (`{Dot, Identifier}` suffixes) into the callee name and accumulating args from every `methodInvocationSuffix` encountered — same outermost-first accumulation convention (`args.concat(soFar)`) as the `_followChain` helper shared by the other five hand-rolled parsers (this PRD's earlier, language-general fix for the identical class of bug: a trailing call/member continuation being silently dropped rather than followed). A companion catalog entry (`java-spel-getvalue`, receiver-scoped to `^parseExpression`, `argIndex: 'all'`) was added because the chain fix shifts the terminal callee segment from `parseExpression` to `getValue` — same "terminal segment shift" pattern documented for Kotlin/Go/Java elsewhere in this PRD. Fixes `CVE-2018-1000632-java-xxe` (DocumentBuilderFactory chain) and `CVE-2018-1273-java-code-injection` (SpelExpressionParser chain). Guarded by two new cases in `test/java-taint-flow.test.js`. **UPDATE (Tier 3 command-injection audit): the `_SHELL_META` gap this note originally flagged is fixed.** `CVE-2016-10033-java-cmdi`'s real-world shape `Runtime.getRuntime().exec("ping " + host)` was blocked by a SEPARATE, language-agnostic core-engine bug (`engine.js`'s `literalSkeletonMatchesFamily`/`_SHELL_META`, requiring a shell metacharacter in the STATIC portion of a CWE-78 concat — backwards for command injection, see `dataflow/CLAUDE.md`), now removed entirely. The corpus fixture also needed a Tier 2 fixture enrichment (`@RequestParam` on the `host` parameter — the committed fixture had no cataloged source at all, a second, independent blocker this note's original git-stash bisection had isolated away from before concluding `_SHELL_META` was the (sole, at the time) remaining issue). Both fixed together; `CVE-2016-10033-java-cmdi` now scores `pre:TP post:TN`. **Taint-recall PRD (80%) Tier 5: a THIRD, independent chain-CST bug — a constructor STARTING a chain.** Found via `CVE-2019-3799-spring-ssrf-shape`'s real-world shape `new URL(url).openStream()`: the chained-call fix above (the `primarySuffix[]` walk) only handles a chain that starts from an FQN/identifier prefix (`prefix?.children?.fqnOrRefType?.[0]`) — a chain whose FIRST segment is itself `new X(args)` takes a completely different CST shape and was never checked, so both the class name and the constructor's own args were silently dropped, leaving only the trailing `.openStream()` call with no receiver. Root-caused via temporary `console.error(Object.keys(prefix?.children))` tracing (the first guess, matching the STANDALONE `new X(args)` handling elsewhere in this file at `unqualifiedClassInstanceCreationExpression` directly off `node`, was wrong — a chain-starting constructor sits one level deeper, under `prefix?.children?.newExpression?.[0]?.children?.unqualifiedClassInstanceCreationExpression?.[0]`). Fixed by extending the same `primaryPrefix` chain-seed logic to also recognize this shape (`ctorPrefix`), extracting the class name and constructor args exactly like the FQN case, so the chain fix now covers both "chain starts on an identifier" and "chain starts on a constructor". Companion catalog fix: `java-url-openstream` was previously keyed to the (now-unreachable-via-chain) bare `callee: 'URL'`; corrected to `callee: 'openStream', receiver: '^URL'` — the same "terminal segment shift" pattern this PRD documents repeatedly elsewhere (Kotlin/Go). Guarded by `test/catalog-path-ssrf-p3.test.js`. |
 | Go       | `parser-go.js`        | Hand-rolled. **Taint-recall PRD (80%) Tier 4: inline anonymous closures.** Go's dominant HTTP-handler-registration idiom across every framework this file targets (net/http, gin, echo, fiber, chi) is an inline closure passed as the LAST argument to a registration call — `app.Get(path, func(c *fiber.Ctx) error { ... })`, `http.HandleFunc(path, func(w, r) { ... })`. This parser previously had ZERO support for anonymous functions at all: `FUNC_RE` requires a NAME between `func` and `(`, so an inline closure never matched it, and `_lowerExpr`'s generic call-matching regex mis-parsed `func(params) rtype { body }` as a call to something literally named "func" — `matchBalancedCall` correctly captured only `(params)` as that "call"'s own args, and the return-type token plus the ENTIRE closure body were silently discarded (no `.method(...)` continuation follows a return type, so `_followChain` found nothing to recover). This was very likely this PRD's single most consequential Go gap — it made every framework's route-handler BODY invisible to taint analysis regardless of what it did — found via this PRD's Tier 3 command-injection audit, not the parent PRD's original per-language sweep. Fixed by `_extractTrailingClosureArg` detecting a statement's LAST top-level call argument as an inline closure literal and INLINING its body directly into the enclosing function's CFG right after the registration call — a permissive, recall-preserving approximation (the closure genuinely runs later, but what matters for taint is that its statements become real CFG nodes at all), mirroring the Kotlin trailing-lambda / Ruby trailing-block precedent elsewhere in this PRD. The closure's OWN parameter (`c`, `w`, `r`) needs no synthetic taint binding, unlike Kotlin's `.forEach { x -> ... }`: a framework context object isn't itself a source — `c.Query(...)` is recognized by the EXISTING member/call-source catalog matching regardless of which function scope `c` was declared in. Chained calls before the closure arg (`app.Group("/api").Get(path, func(){...})`) are not specially handled — out of scope, matches this file's "handle the dominant shape" precedent elsewhere. Guarded by `test/parser-go.test.js`. Two catalog/engine precision bugs surfaced in the SAME audit, both fixed alongside: `go-os-exec-command`'s `argIndex: 0` checked the WRONG argument (the real dangerous shape is `exec.Command("/bin/sh", "-c", tainted)`, where arg 0 is always the literal interpreter and the tainted content sits later) — widened to `argIndex: 'all'`, gated by a new `match.requireLiteralArg` precision primitive (`catalog.js`/`engine.js`) requiring arg 0 to literally be a shell interpreter, so the safe array-execve form (`exec.Command("ping", "-c", "1", host)`) does not spuriously fire; and a "terminal segment shift" (same pattern as `kt-xpath-evaluate`/`java-spel-getvalue`/`go-r-uquery-get` elsewhere in this PRD) for `exec.Command(...).Output()`/`.Run()`/`.CombinedOutput()`/`.Start()` — chaining a Cmd-execution method directly onto `exec.Command(...)`, the dominant idiom for actually RUNNING the command, collapses the chain into one dotted string whose last segment is no longer "Command". Guarded by `test/catalog-command-injection-p4.test.js`. **Measured `bench/layer-recall` impact: real movement — command-injection (this corpus's dominant Go family) moved from 5/23 → 18/23 across this fix plus the sibling `literalSkeletonMatchesFamily`/CWE-78 engine fix (`dataflow/CLAUDE.md`).** |

package/src/ir/chrome-probe.mjs

@@ -0,0 +1,150 @@
+// chrome-probe.mjs — Milestone 4, sub-project PNG/SVG/PDF export.
+//
+// Chrome/Chromium binary discovery, mirroring parser-py-cst.js's own
+// already-proven probePythonAvailable() pattern exactly — this
+// codebase's established convention for "optional local tool, detect
+// and degrade gracefully" (see that file's own header comment for the
+// full rationale this file inherits without repeating).
+
+import * as cp from 'node:child_process';
+import * as fs from 'node:fs';
+
+let _capability = null;
+
+// A malformed env var (e.g. AGENTIC_SECURITY_CHROME_PROBE_TIMEOUT_MS=oops)
+// must fall back to the default, never reach spawnSync as NaN — found by
+// the final whole-branch review: `Number('oops')` is NaN, and NaN as a
+// spawnSync `timeout` option throws ERR_OUT_OF_RANGE synchronously.
+// _tryBinary's own try/catch swallows that throw and returns null for
+// EVERY candidate, so probeChromeAvailable would misreport
+// `no-chrome-found` on a machine with a perfectly working Chrome install.
+//
+// Blank/whitespace-only is treated as unset (falls back), not as `0` —
+// found by this fix's own scoped re-review: `Number('')` is `0`, and a
+// naive `n >= 0` guard let an empty-but-exported env var (a blanked
+// .env line, an unset-but-exported CI var) through as a real `timeout:
+// 0`, which spawnSync treats as NO timeout at all — an unbounded hang
+// risk inside this exact capability probe, the failure class
+// parser-py-cst.js's own probePythonAvailable() is already careful
+// about. An explicit `"0"` is still honored (matches this file's
+// pre-fix behavior for that literal value).
+//
+// Must be a safe INTEGER, not merely finite — found by a second scoped
+// re-review, reproduced live: `Number.isFinite(1.5)` is true, so a
+// fractional env var (e.g. "1.5") passed this guard unchanged and then
+// hit spawnSync's own `timeout` option, which throws ERR_OUT_OF_RANGE
+// for any non-integer — the exact class of uncaught throw this whole
+// function exists to prevent, just for a different malformed input
+// than the original NaN case. `-0` is rejected too (Object.is check):
+// it is a safe integer and `-0 >= 0`, so without the explicit check it
+// would silently mean "no timeout", one character away from the "0"
+// this function deliberately allows.
+// Exported test-only — the outcome-based integration tests (a real
+// probe/export succeeding or not) can't distinguish `timeout: 0` from
+// `timeout: <default>` when the underlying command finishes quickly
+// either way, so a direct table of this function's own input/output
+// pairs is the only thing that actually pins the "0"-vs-default
+// boundary — found by a third scoped re-review: the blank-env-var
+// integration test below passed even with the round-2 blank-handling
+// bug fully reintroduced, for exactly this reason.
+export function _validTimeoutMs(raw, fallback) {
+  const s = String(raw ?? '').trim();
+  if (!s) return fallback;
+  const n = Number(s);
+  if (!Number.isSafeInteger(n) || n < 0 || Object.is(n, -0)) return fallback;
+  return n;
+}
+const PROBE_TIMEOUT_MS = _validTimeoutMs(process.env.AGENTIC_SECURITY_CHROME_PROBE_TIMEOUT_MS, 5000);
+
+// Real, common install locations, per platform. Deliberately excludes
+// AGENTIC_SECURITY_CHROME_PATH — that override is handled separately in
+// probeChromeAvailable() as an authoritative, non-fallback choice (see
+// the comment there for why).
+//
+// KNOWN-GOOD ABSOLUTE PATHS ARE TRIED FIRST, PATH-resolvable bare names
+// LAST — found by the final whole-branch review, reproduced live: with
+// bare names tried first, a `chrome` shell script anywhere earlier on
+// PATH than the real browser is silently preferred and then executed
+// with this process's own render arguments. The `--version` output
+// check (`_tryBinary` below) is a functional smoke test, not a security
+// gate — it cannot distinguish a real Chrome/Chromium binary from any
+// script that echoes a matching string. Preferring the well-known
+// install locations narrows, though does not eliminate, this exposure
+// (a compromised PATH entry named exactly `chrome`/`google-chrome`/etc.
+// is still tried if no absolute-path candidate exists on this machine —
+// this feature already assumes local machine trust, same as every other
+// "optional local tool" this codebase shells out to). The `linux` list
+// below was empty in this fix's first pass — found by the scoped
+// re-review to make the whole reordering a no-op on the platform CI
+// images actually run on, since every Linux candidate was a bare PATH
+// name. Package-manager and snap install locations are now included.
+function _candidatePaths() {
+  const onPath = ['google-chrome-stable', 'google-chrome', 'chromium-browser', 'chromium', 'chrome'];
+  const platformPaths = {
+    darwin: [
+      '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+      '/Applications/Chromium.app/Contents/MacOS/Chromium',
+      `${process.env.HOME || ''}/Applications/Google Chrome.app/Contents/MacOS/Google Chrome`,
+    ],
+    win32: [
+      'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+      'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
+      `${process.env.LOCALAPPDATA || ''}\\Google\\Chrome\\Application\\chrome.exe`,
+    ],
+    linux: [
+      '/usr/bin/google-chrome-stable',
+      '/usr/bin/google-chrome',
+      '/usr/bin/chromium-browser',
+      '/usr/bin/chromium',
+      '/opt/google/chrome/chrome',
+      '/snap/bin/chromium',
+    ],
+  };
+  const platformSpecific = platformPaths[process.platform] || [];
+  return [...platformSpecific, ...onPath];
+}
+
+// Tries one candidate binary. Returns {ok:true, chrome:bin} on a real,
+// working Chrome/Chromium, or null on any failure (missing binary, spawn
+// error, non-zero exit, unrecognized --version output) — never throws.
+function _tryBinary(bin) {
+  if (!bin) return null;
+  // An absolute-path candidate that doesn't exist can't spawn — skip the
+  // spawnSync call entirely rather than let it throw ENOENT.
+  if (bin.includes('/') || bin.includes('\\')) {
+    if (!fs.existsSync(bin)) return null;
+  }
+  let r;
+  try {
+    r = cp.spawnSync(bin, ['--version'], { encoding: 'utf8', timeout: PROBE_TIMEOUT_MS });
+  } catch { return null; }
+  if (r.error || r.status !== 0) return null;
+  const out = (r.stdout || r.stderr || '');
+  if (!/Chrom(e|ium)/i.test(out)) return null;
+  return { ok: true, chrome: bin };
+}
+
+export function resetChromeProbe() { _capability = null; }
+
+export function probeChromeAvailable() {
+  if (_capability) return _capability;
+
+  // An explicit override is authoritative, not just "try this one first
+  // then fall back": an operator (or CI environment) who deliberately
+  // pointed AGENTIC_SECURITY_CHROME_PATH at a binary wants a failure
+  // reported when that binary doesn't work — not a silent switch to
+  // whatever else this process happens to auto-detect on the machine.
+  const fromEnv = process.env.AGENTIC_SECURITY_CHROME_PATH;
+  if (fromEnv) {
+    const hit = _tryBinary(fromEnv);
+    _capability = hit || { ok: false, reason: 'chrome-path-invalid' };
+    return _capability;
+  }
+
+  for (const bin of _candidatePaths()) {
+    const hit = _tryBinary(bin);
+    if (hit) { _capability = hit; return _capability; }
+  }
+  _capability = { ok: false, reason: 'no-chrome-found' };
+  return _capability;
+}

package/src/ir/parser-js.js

@@ -47,6 +47,30 @@ import presetTypescript from '@babel/preset-typescript';
 let _nodeIdSeq = 0;
 function nextNodeId() { return 'n' + (++_nodeIdSeq); }
 
+// Round-5 lineage-engine finding, generalized in round 6: resolve a Babel
+// object-property-shaped node's key (`ObjectProperty` from either an
+// `ObjectExpression` or an `ObjectPattern` — both share the same
+// `{computed, key}` shape) to either its real, distinct property name, or
+// the explicit unknown marker '*' when the key is computed and not itself
+// a resolvable literal. A computed key that IS a literal (`{[42]: v}`,
+// `{['literal']: v}` — Babel still marks these `computed: true`) still
+// resolves to that literal's own string form; a computed key that is an
+// arbitrary expression (most commonly an Identifier, e.g. `{[field]: v}`)
+// resolves to '*', NEVER to the key expression's own variable name — using
+// `p.key.name` unconditionally there would attribute the property to the
+// key expression's OWN name as if it were a real, distinct property,
+// colliding e.g. `{ field: a, [field]: b }` onto one shared 'field' key.
+// Originally fixed only for `ObjectExpression` (round 5); round 6 found the
+// identical bug, unfixed, in `lhsPath`'s `ObjectPattern` (destructuring)
+// branch and extracted this shared helper so a third instance of the same
+// bug can't appear in some future object-key-reading code path. See
+// DESIGN_INTRAPROCEDURAL.md §4 and CLAUDE.md's "three hop types" note.
+function resolveObjectKey(p) {
+  return p.computed
+    ? (p.key?.value != null ? String(p.key.value) : '*')
+    : (p.key?.name || (p.key?.value != null ? String(p.key.value) : '*'));
+}
+
 // Compact a Babel AST node into our exprDesc.
 function exprOf(n) {
   if (!n) return { kind: 'unknown' };
@@ -91,10 +115,50 @@ function exprOf(n) {
       return { kind: 'union', branches: [exprOf(n.consequent), exprOf(n.alternate)] };
     case 'ObjectExpression':  return {
       kind: 'object',
-      props: (n.properties || []).filter(p => p.type === 'ObjectProperty' && p.key).map(p => ({
-        key: p.key.name || (p.key.value != null ? String(p.key.value) : '*'),
-        value: exprOf(p.value),
-      })),
+      // Round-5 lineage-engine finding: for a COMPUTED property
+      // (`{[k]: v}`, `p.computed === true`), `p.key` is an arbitrary
+      // expression node, not a name — and an Identifier key expression
+      // (`k`) HAS a `.name` ('k'), same as a real, non-computed property
+      // literally named `k` would. Using `p.key.name` unconditionally
+      // therefore attributed a computed property to the key EXPRESSION's
+      // own variable name as if it were a real, distinct property name,
+      // colliding `{ k: user.ssn, [k]: user.email }` onto one shared 'k'
+      // key. A computed key IS still resolvable when it's itself a literal
+      // (`{[42]: v}`, `{['literal']: v}` — Babel marks these
+      // `computed: true` too, but `p.key.value` gives the real value), so
+      // only an Identifier/expression computed key (no `.value`) falls
+      // back to the literal string '*' — mirroring the EXISTING computed-
+      // MEMBER-access convention (`n.computed` handling just above, and
+      // `lhsPath`'s computed-write handling below) rather than inventing a
+      // new one. See DESIGN_INTRAPROCEDURAL.md §4 and CLAUDE.md's "three
+      // hop types" note.
+      //
+      // A `SpreadElement` (`{...user}`) previously fell out of the
+      // `.filter` entirely — `{...user}` and `{}` were byte-identical in
+      // the emitted IR, a real, pre-existing false negative (the identity
+      // vanishes, not merged, not flattened — found and documented but
+      // not fixed by a final review of an earlier plan). Represented here
+      // as a distinct `{spread: true, value: <expr>}` shape (no `key`
+      // field) rather than a regular `{key, value}` property, so
+      // `scanner/src/lineage/engine.js`'s `resolveExprIdentities` can
+      // merge the spread source's OWN field structure directly into this
+      // object's structure (see that file for the full mechanism) — a
+      // DIFFERENT, more precise handling than a computed-unknown-key
+      // property gets (that case folds into one opaque residual bucket; a
+      // spread's contents are fully known, just not yet assigned a key in
+      // THIS literal, so they can and should stay field-distinguished).
+      // Every consumer of `expr.props` outside this package
+      // (scanner/src/dataflow/engine.js, higher-order.js,
+      // privacy-deep-walker.js — audited before this change) reads only
+      // `p.value`, never `p.key`, so this shape is compatible with all of
+      // them without any change there — and several gain correct taint/
+      // privacy detection through object spread as a direct result, since
+      // the spread's value is no longer silently absent from `props`.
+      props: (n.properties || []).map(p => {
+        if (p.type === 'SpreadElement') return { spread: true, value: exprOf(p.argument) };
+        if (p.type !== 'ObjectProperty' || !p.key) return null;
+        return { key: resolveObjectKey(p), value: exprOf(p.value) };
+      }).filter(Boolean),
     };
     case 'ArrayExpression':   return { kind: 'array', elements: (n.elements || []).map(exprOf) };
     case 'SpreadElement':     return exprOf(n.argument);
@@ -170,10 +234,33 @@ function lhsPath(n) {
     return base + '.' + prop;
   }
   if (n.type === 'ObjectPattern') {
-    // Destructured: return an array of (key, alias) pairs the caller can iterate.
+    // Destructured: return an array of (key, alias) pairs the caller can
+    // iterate. Round 6: uses the same `resolveObjectKey` helper
+    // `ObjectExpression` uses above, so a non-literal computed key
+    // (`const { [field]: value } = user`) resolves to '*' instead of
+    // fabricating a colliding key from the key variable's own name — see
+    // `resolveObjectKey`'s header comment for the full rationale.
+    //
+    // A `RestElement` (`const {a, ...rest} = obj`) has its bound identifier
+    // at `.argument`, not `.value` (only a real `ObjectProperty` has
+    // `.value`) — using `.value` unconditionally here made `lhsPath`
+    // resolve to `null` for every rest binding (`lhsPath(undefined)` hits
+    // the `if (!n) return null;` guard before ever reaching the
+    // `RestElement` case below), so the consumer's `if (!alias) continue;`
+    // guard silently skipped it entirely: a real, pre-existing FR-306
+    // violation where the rest binding vanished with no trace, not merged,
+    // not flattened. `resolveObjectKey(p)` already correctly resolves to
+    // '*' for a RestElement (it has no `.key`/`.computed`), which is
+    // exactly the right marker: the consumer already treats a `'*'`-keyed
+    // destructured binding as a computed-unknown-key selection
+    // (`{kind:'member', object: initExpr, prop: '*'}`), and the lineage
+    // engine's existing wildcard-selection machinery (built for `obj[k]`)
+    // already resolves that correctly — conservatively aggregating the
+    // source's full field set, flagged widened. No engine-level change
+    // needed for this fix.
     return { kind: 'object-pattern', props: (n.properties || []).map(p => ({
-      key: p.key?.name || (p.key?.value != null ? String(p.key.value) : '*'),
-      alias: lhsPath(p.value),
+      key: resolveObjectKey(p),
+      alias: lhsPath(p.type === 'RestElement' ? p.argument : p.value),
     }))};
   }
   if (n.type === 'ArrayPattern') {