@clear-capabilities/agentic-security-scanner 0.151.3 → 0.152.0

package/src/ir/parser-cs.js

@@ -123,6 +123,18 @@ function _findClassRanges(code) {
   let m;
   while ((m = CLASS_RE.exec(code)) !== null) {
     const name = m[1];
+    // `CLASS_RE`'s leading `(?:^|[\s;{}])` consumes exactly one boundary
+    // character into `m[0]` (or zero, at `^`). When that boundary
+    // character is itself the newline ending the PREVIOUS line — the
+    // common case for a top-level declaration with no leading
+    // indentation — `m.index` points at that newline, and `_lineAt`
+    // (which counts newlines strictly before its offset) undercounts by
+    // one line as a result. Stepping one character past a real boundary
+    // char lands on the declaration's own first character, which is
+    // always on the correct line regardless of which boundary character
+    // matched (a same-line boundary like a space or `{` is unaffected by
+    // the shift).
+    const declStart = m.index + (/^[\s;{}]/.test(m[0][0]) ? 1 : 0);
     // Skip past an optional generic parameter list and/or base/interface
     // list to find the REAL opening brace — `class Foo<T> : Base<T>, IBar`
     // has two `<...>` regions before the body even starts. Track angle-
@@ -130,26 +142,131 @@ function _findClassRanges(code) {
     // generics don't nest with unbalanced `<`/`>` in valid code), and a
     // `{` encountered while depth > 0 (an unlikely default-value-in-
     // generic-constraint edge case) is simply skipped rather than
-    // mis-treated as the class body.
+    // mis-treated as the class body. `colonAt` records where the
+    // base/interface list starts (the FIRST top-level `:`, C# allows only
+    // one) so it can be sliced out once the real body brace is found.
     let i = m.index + m[0].length;
     let angleDepth = 0;
+    let colonAt = -1;
     while (i < code.length) {
       const c = code[i];
       if (c === '<') angleDepth++;
       else if (c === '>') { if (angleDepth > 0) angleDepth--; }
+      else if (c === ':' && angleDepth === 0 && colonAt === -1) colonAt = i;
       else if (c === '{' && angleDepth === 0) break;
       else if ((c === ';') && angleDepth === 0) { i = -1; break; } // forward-declaration-shaped or malformed; bail
       i++;
     }
     if (i < 0 || i >= code.length || code[i] !== '{') continue;
+    let bases = [];
+    if (colonAt !== -1) {
+      // A generic constraint clause (`where T : class`) can follow the
+      // base list before the body brace and would otherwise be read as
+      // more base names; it always starts with a top-level `where` after
+      // the base list, so truncate there first.
+      let baseText = code.slice(colonAt + 1, i);
+      const whereIdx = baseText.search(/\bwhere\b/);
+      if (whereIdx !== -1) baseText = baseText.slice(0, whereIdx);
+      // Each base/interface name, stripped of its own generic argument
+      // list (`BaseRepo<T>` → `BaseRepo`) — `class-hierarchy.js`-style
+      // consumers key allocation/dispatch types by simple name, same as
+      // every other class-metadata producer in this codebase.
+      bases = _splitTopLevelCommas(baseText).map(p => p.trim().split(/[<\s]/)[0]).filter(Boolean);
+    }
     const extracted = _extractBody(code, i);
     if (!extracted) continue;
-    ranges.push({ name, start: i, end: extracted.end });
+    ranges.push({ name, start: i, end: extracted.end, bases, line: _lineAt(code, declStart) });
     CLASS_RE.lastIndex = i + 1; // resume scanning INSIDE the class body too, for nested classes
   }
   return ranges;
 }
 
+// Scan a member statement (as produced by `_splitStatements` over a class
+// body) to decide whether it's method/constructor-SHAPED (a `(` appears at
+// the statement's own top level, before any `=` or `{`) versus a field or
+// auto-property declaration. Attributes (`[Foo] [Bar(...)]`) prefixing the
+// member push `[`/`]` onto the SAME depth counter `{`/`(` use, so they are
+// transparently skipped without any special-casing — by the time a real
+// modifier/type token appears, depth is back to 0.
+function _memberHeadInfo(stmt) {
+  let depth = 0;
+  let inStr = null;
+  let escape = false;
+  for (let i = 0; i < stmt.length; i++) {
+    const c = stmt[i];
+    if (escape) { escape = false; continue; }
+    if (inStr) {
+      if (c === '\\') { escape = true; continue; }
+      if (c === inStr) inStr = null;
+      continue;
+    }
+    if (c === '"' || c === "'") { inStr = c; continue; }
+    if (c === '(' && depth === 0) return { isMethodLike: true };
+    if (c === '{' && depth === 0) return { isMethodLike: false, headEnd: i };
+    if (c === '(' || c === '{' || c === '[' || c === '<') { depth++; continue; }
+    if (c === ')' || c === '}' || c === ']' || c === '>') { if (depth > 0) depth--; continue; }
+    // A real assignment `=`, not `==`/`!=`/`<=`/`>=`/`=>`.
+    if (depth === 0 && c === '=' && stmt[i + 1] !== '=' && stmt[i + 1] !== '>' &&
+        !['=', '!', '<', '>'].includes(stmt[i - 1])) {
+      return { isMethodLike: false, headEnd: i };
+    }
+  }
+  return { isMethodLike: false, headEnd: stmt.length };
+}
+
+// The last bare identifier in `text` — used to pull a declared name off
+// the tail of a type/modifier clause (`private static string sf` → `sf`,
+// `public readonly Dictionary<string, T> map` → `map`) without needing to
+// parse the type itself, which can contain internal whitespace (generic
+// argument lists) that a naive whitespace-split would mis-split on.
+function _lastIdent(text) {
+  const m = String(text || '').match(/([A-Za-z_]\w*)\s*$/);
+  return m ? m[1] : null;
+}
+
+const _NESTED_TYPE_RE = /^(?:(?:public|private|protected|internal|static|sealed|abstract|partial|new|readonly)\s+)*(?:class|struct|interface|enum)\s/;
+
+// Declared field/auto-property names for one class range, from the SAME
+// statement split `_buildCfg` uses for method bodies (`_splitStatements`
+// already treats a balanced `{...}` — a method body, or a property's
+// `{ get; set; }` accessor block — as part of ONE flushed statement, so
+// method declarations and multi-statement bodies never need to be
+// specially excluded here: `_memberHeadInfo` rejects anything method-
+// shaped outright). Nested type declarations are recognized and skipped
+// as a whole (their own fields are not modeled — out of scope for the
+// cross-method field-taint use this exists for).
+function _extractClassFields(code, range) {
+  const bodyText = code.slice(range.start + 1, range.end);
+  const fields = [];
+  for (const { text: stmt } of _splitStatements(bodyText)) {
+    if (!stmt || stmt.startsWith('//') || stmt.startsWith('/*')) continue;
+    if (_NESTED_TYPE_RE.test(stmt)) continue;
+    const info = _memberHeadInfo(stmt);
+    if (info.isMethodLike) continue;
+    const head = stmt.slice(0, info.headEnd);
+    if (stmt[info.headEnd] === '{') {
+      // Auto-property: `public string Name { get; set; }` — one name, no
+      // multi-declarator syntax exists for properties.
+      const name = _lastIdent(head);
+      if (name) fields.push(name);
+      continue;
+    }
+    // Field declaration, possibly multiple comma-separated declarators
+    // (`protected int a, b;`), each optionally carrying its own `= init`.
+    // `_splitTopLevelCommas` is already `<`/`(`/`{`/`[`-depth-aware (used
+    // elsewhere in this file for argument lists), so a comma inside a
+    // generic type argument or an initializer's own call/object literal
+    // does not fracture the declarator list.
+    for (const part of _splitTopLevelCommas(stmt)) {
+      const eq = part.indexOf('=');
+      const before = eq === -1 ? part : part.slice(0, eq);
+      const name = _lastIdent(before);
+      if (name) fields.push(name);
+    }
+  }
+  return fields;
+}
+
 // Innermost class whose range contains `pos` (a method declaration's match
 // offset), or null when the method sits outside any class (top-level
 // statements — legal but rare).
@@ -180,12 +297,33 @@ function _enclosingClassName(ranges, pos) {
 // is (re)assigned to more than one distinct constructed type in the same
 // function — ambiguous, same "refuse rather than fabricate an edge"
 // convention `bareTailInFile` already uses.
+// SARD_80_F1 W2.3 — ported from the identical fix in parser-java.js (see
+// its own comment for the full story, found first for Java): a BCL
+// collection type (`List`, `Dictionary`, `Stack`, `Queue`, `HashSet`, …)
+// is never an entry in `callgraph.js`'s `classMethods` index (built only
+// from THIS project's own `ir.classes`), so class-qualifying
+// `list.Add(data)` to `List.Add(data)` buys dispatch resolution nothing —
+// while breaking `engine.js`'s mutator rule, which needs the REAL
+// variable name to attribute taint correctly. A `foreach (var s in list)`
+// read over the container itself lowers to a bare-identifier assign
+// (`s = list`, no callee to rewrite), so it stays keyed on "list" while
+// the (rewritten) write lands on the fake receiver "List" — the taint is
+// silently lost. Confirmed via a direct CFG dump: `List<string> list =
+// new List<string>(); list.Add(data);` didn't even trigger the bug (this
+// parser's generic-constructor lowering produces `{kind:'unknown'}` for
+// `new List<string>()`, so it's never added to `varTypes` at all) — but
+// the non-generic `ArrayList`/`Hashtable`-style BCL collections DO lower
+// to a proper `isNew:true` call and DO exhibit the exact same desync as
+// Java's `ArrayList`.
+const _BCL_CONTAINER_TYPES = /^(?:List|ArrayList|LinkedList|Stack|Queue|Dictionary|Hashtable|SortedList|SortedDictionary|HashSet|SortedSet|ArrayDeque|ConcurrentBag|ConcurrentQueue|ConcurrentStack|ConcurrentDictionary|BlockingCollection|ObservableCollection|Collection|CollectionBase)$/;
+
 function _localVarConstructedTypes(nodes) {
   const varTypes = new Map(); // varName -> className | null (ambiguous)
   for (const node of Object.values(nodes)) {
     if (node.kind !== 'assign') continue;
     const src = node.source;
     if (!src || src.kind !== 'call' || !src.isNew || typeof src.callee !== 'string') continue;
+    if (_BCL_CONTAINER_TYPES.test(src.callee)) continue;
     const varName = node.target;
     if (!varName || varName.includes('.')) continue; // only a bare local, never a member-write target
     if (varTypes.has(varName)) {
@@ -468,16 +606,70 @@ function _followChain(s, endIdx, calleeSoFar, argsSoFar, isNew) {
   return _followChain(rest, outer.endIdx, `${calleeSoFar}.${outer.callee}`, outerArgs.concat(argsSoFar), false);
 }
 
+// A C-style cast `(Type)expr` / `(Type) expr` is transparent for taint: the
+// value is the operand. Juliet's collection variants (`Object o = data;
+// string d = (string)o;`) and every `(string)reader.GetValue(0)` read hit
+// this shape; before it was recognised the whole expression fell through to
+// `{kind:'unknown'}` and the taint died at the cast. The type token must
+// look like a type (identifier, optional generics/array/nullable) so a
+// parenthesised arithmetic expression like `(a + b)` is not mistaken for a
+// cast.
+const _CAST_RE = /^\(\s*[A-Za-z_][\w.]*(?:<[^()]*>)?(?:\[\s*\])*\??\s*\)\s*(?=[A-Za-z_("@$])/;
+
 function _lowerExpr(text) {
   const s = String(text || '').trim();
   if (!s) return { kind: 'unknown' };
-  // Member access: a.b.c["foo"]
-  if (/^[A-Za-z_][\w.]*\[[^\]]*\]$/.test(s)) {
-    // E.g. Request.Form["name"]. Split on first '[' to isolate index.
-    const lb = s.indexOf('[');
-    const base = s.slice(0, lb);
-    const dots = base.split('.');
-    return _buildMemberChain(dots, /*indexed*/ s.slice(lb));
+  const castM = s.match(_CAST_RE);
+  if (castM) return _lowerExpr(s.slice(castM[0].length));
+  // Parenthesised object creation starting a chain: `(new X()).M(args)`.
+  // Same shape as the un-parenthesised `new X().M(args)` branch below,
+  // which cannot see it because the leading `(` blocks the `^new` anchor.
+  if (s.startsWith('(')) {
+    const closeIdx = _matchDelim(s, 0, '(', ')');
+    if (closeIdx !== -1 && /^\s*new\s/.test(s.slice(1, closeIdx))) {
+      const inner = _lowerExpr(s.slice(1, closeIdx).trim());
+      if (inner.kind === 'call' && s.slice(closeIdx + 1).trim().startsWith('.')) {
+        return _followChain(s, closeIdx + 1, inner.callee, inner.args, inner.isNew);
+      }
+      return inner;
+    }
+  }
+  // Member access: a.b.c["foo"], and a.b.c["foo"].d.e — an indexer
+  // followed by further property access. The indexer-only form (E.g.
+  // `Request.Form["name"]`) used to be the only shape recognized, requiring
+  // the bracket to end the whole expression; anything indexed-then-accessed
+  // (`cookieSources[0].Value`) fell through every later branch to
+  // `{kind:'unknown'}`, silently dropping the base's source taint. Confirmed
+  // via the public C# Juliet mirror's own ASP.NET cookie-collection idiom
+  // (`req.Cookies[0].Value`,
+  // `CWE113_HTTP_Response_Splitting__Web_Get_Cookies_Web_setHeader_01.cs`) —
+  // a real, structural recall gap, not a scoring quirk: `runScan` produced
+  // zero findings on this exact shape before this fix. `_matchDelim` (bracket-
+  // depth- and string-aware) replaces the old `[^\]]*` scan, which could not
+  // have handled a nested bracket correctly either.
+  const idxBaseM = s.match(/^([A-Za-z_][\w.]*)\[/);
+  if (idxBaseM) {
+    const lb = idxBaseM[1].length;
+    const rb = _matchDelim(s, lb, '[', ']');
+    if (rb !== -1) {
+      const dots = idxBaseM[1].split('.');
+      let cur = _buildMemberChain(dots, s.slice(lb, rb + 1));
+      let rest = s.slice(rb + 1);
+      // Follow zero or more trailing `.prop` continuations (a bare property
+      // read, no call parens) — a `.Method(...)` continuation is a
+      // genuinely different shape (handled by matchBalancedCall/_followChain
+      // elsewhere) and is deliberately not duplicated here.
+      let restM;
+      while ((restM = rest.match(/^\.([A-Za-z_]\w*)(?!\s*\()/))) {
+        cur = { kind: 'member', object: cur, prop: restM[1] };
+        rest = rest.slice(restM[0].length);
+      }
+      if (rest === '') return cur;
+      // Anything left (a call, another bracket) is out of scope for this
+      // branch — fall through to the rest of `_lowerExpr` below, which will
+      // most likely land on `{kind:'unknown'}` for it, same as before this
+      // fix (recall-preserving: never worse than the pre-fix behavior).
+    }
   }
   // Plain dotted ident: Request.Form / Request.QueryString
   if (/^[A-Za-z_][\w.]*$/.test(s)) {
@@ -493,7 +685,7 @@ function _lowerExpr(text) {
   // per-file, so the crash surfaced only as "this file has no IR" — 12 of 21 C#
   // corpus entries, and the catalog's own `cs-sqlcommand` rule ("SQL Injection
   // (new SqlCommand with concatenated user input)") could never fire.
-  const newMatch = matchBalancedCall(s, /^new\s+([\w.]+)/);
+  const newMatch = matchBalancedCall(s, /^new\s+([\w.]+)/, { skipGenerics: true });
   if (newMatch) {
     const callee = newMatch.callee.split('.').pop();
     const args = _splitTopLevelCommas(newMatch.argsText).map(_lowerExpr);
@@ -516,7 +708,24 @@ function _lowerExpr(text) {
   // the input as a single part, and mapping `_lowerExpr` over it recurses on the
   // identical string forever. Any future expression form that reaches here
   // unsplit would otherwise reintroduce the same stack overflow.
-  if (s.includes('+') && /["']/.test(s)) {
+  //
+  // SARD 80% F1 push: this branch previously ALSO required a quote character
+  // (`"`/`'`) to appear SOMEWHERE in `s` before even attempting the split —
+  // meant to avoid misreading plain numeric addition (`a + b`) as string
+  // concatenation, but it silently excluded the equally common shape where
+  // BOTH operands are already-built string variables with no inline literal
+  // (`Process.Start(osCommand + data)`, Juliet's own canonical C# CWE-78
+  // shape — confirmed via the public Juliet C# mirror this project's SARD
+  // manifest pins, not assumed). `osCommand + data` has no quote anywhere,
+  // so the whole expression fell through every later branch to
+  // `{kind:'unknown'}`, silently dropping `data`'s taint. Removed: treating
+  // a numeric `a + b` as a 2-part template is harmless for taint purposes
+  // (the engine only cares whether either operand is tainted, not whether
+  // the runtime operation is numeric addition or string concatenation), and
+  // the `rawParts.length > 1` guard immediately below already fully
+  // prevents the specific stack-overflow this comment documents,
+  // independent of whether a quote was ever present.
+  if (s.includes('+')) {
     const rawParts = _splitTopLevelPlus(s);
     if (rawParts.length > 1) return { kind: 'tpl', parts: rawParts.map(_lowerExpr) };
   }
@@ -618,12 +827,82 @@ function _lowerStmt(stmt, line) {
   }
   // throw
   if (/^throw\b/.test(s)) return { kind: 'throw', line, value: _lowerExpr(s.replace(/^throw\s*/, '')) };
+  // compound assign: `x += y`  `x.y -= z`  etc. SARD_80_F1 W4.C11 — this
+  // was previously unrecognized entirely (the plain-assign regex below
+  // requires a literal `=` with nothing but `[\w.]` before it, which a
+  // compound operator's own leading char, e.g. `+`, never satisfies), so
+  // the whole statement fell through every branch in this function and
+  // was silently dropped from the CFG — no assign, no call, nothing.
+  // Juliet's C# corpus builds `CommandText` this way UNIVERSALLY
+  // (`cmd.CommandText += "..." + tainted + "...";`), so this was a
+  // total blackout for that shape, not a rare corner case.
+  // Modeled as `x = x <op-without-'='> y` (a self-referencing binary),
+  // NOT as a plain `x = y` reassignment — `case 'assign'` in engine.js
+  // calls `removePathAndDescendants` on a clean RHS, and a naive
+  // "just treat it like `=`" lowering would WRONGLY clear x's own
+  // pre-existing taint whenever this particular append happens to be
+  // clean (e.g. a literal SQL fragment appended after an earlier
+  // tainted append). The self-reference makes taint the OR of "x was
+  // already tainted" and "this RHS is tainted", which is what `+=`
+  // actually means.
+  const cm2 = s.match(/^([A-Za-z_][\w.]*)\s*(\+=|-=|\*=|\/=|%=|&=|\|=|\^=|<<=|>>=|\?\?=)\s*(.+)$/s);
+  if (cm2) {
+    const target = cm2[1];
+    const rhs = _lowerExpr(cm2[3]);
+    return {
+      kind: 'assign', line, target,
+      source: { kind: 'binary', op: cm2[2].slice(0, -1), left: { kind: 'ident', name: target }, right: rhs },
+    };
+  }
   // assign:   `var x = …`  `Type x = …`  `x = …`  `x.y = …`
-  const m = s.match(/^(?:(?:var|[A-Za-z_][\w<>?,\s.]*)\s+)?([A-Za-z_][\w.]*?)\s*=\s*(.+)$/s);
+  // The leading type/`var` clause is now its own capture group: when it's
+  // present the regex engine could only have reached a valid overall match
+  // by consuming a real type token before the target (a plain reassignment
+  // like `data = other` never lets that branch match, per the backtracking
+  // this file's other capture-group comments already document — the
+  // optional group fails to close at any point before `=` when the target
+  // itself carries no leading type). That gives a free, correct signal for
+  // `decl` — a local variable's DECLARATION vs. a later reassignment —
+  // needed by cross-method field-taint analysis to tell a genuine field
+  // write (`sf = data;`, no type clause, class field) from a shadowing
+  // local declaration of the same name.
+  const m = s.match(/^(?:((?:var|[A-Za-z_][\w<>?,\s.]*))\s+)?([A-Za-z_][\w.]*?)\s*=\s*(.+)$/s);
   if (m) {
-    const target = m[1];
-    const sourceText = m[2];
-    return { kind: 'assign', line, target, source: _lowerExpr(sourceText) };
+    const typeClause = m[1];
+    const target = m[2];
+    const sourceText = m[3];
+    const node = { kind: 'assign', line, target, source: _lowerExpr(sourceText) };
+    if (typeClause) {
+      node.decl = true;
+      // SARD_80_F1 W4 — mirrors parser-java.js's identical `declaredType`
+      // field (see its own comment for the full rationale): the declared
+      // TYPE of a local, not just the fact that this is a declaration.
+      // Consumed by class-hierarchy.js's `typeOfVar` (ADDITIVE only, via
+      // `receiverTypeIn` — never a destructive callee rewrite, per the
+      // regression that mechanism caused for Java and was reverted).
+      // Strips generics (`List<string>` -> `List`), array brackets
+      // (`Foo[]` -> `Foo`), and a namespace-qualified prefix (last dot
+      // segment); `var` is not a real type name and yields undefined.
+      const bare = typeClause.replace(/<.*$/, '').replace(/\[\]$/, '').trim();
+      if (bare && bare !== 'var') {
+        const segs = bare.split('.');
+        node.declaredType = segs[segs.length - 1];
+      }
+    }
+    return node;
+  }
+  // Bare declaration with no initializer: `string data;`, `int i;`,
+  // `List<T> xs;`. `_splitStatements` has already stripped the trailing
+  // `;`, so a genuine no-initializer declaration is exactly two
+  // whitespace-separated tokens (type, name) with none of `=(){}` anywhere
+  // — no other valid C# statement shape looks like that. Modeled as an
+  // assign with an unknown source (there is nothing to propagate yet) so
+  // `decl:true` on it is visible to the same consumers that read the
+  // initializer-bearing case above, rather than being silently absent as
+  // an `unknown`-kind node.
+  const declOnly = s.match(/^(?:var|[A-Za-z_][\w<>?[\],.]*?)\s+([A-Za-z_]\w*)$/);
+  if (declOnly && !/[=(){}]/.test(s)) {
+    return { kind: 'assign', line, target: declOnly[1], source: { kind: 'unknown' }, decl: true };
   }
   // statement-form call
   const cm = matchBalancedCall(s, /^([A-Za-z_][\w.]*)/);
@@ -641,7 +920,7 @@ function _lowerStmt(stmt, line) {
   // has (this statement-form path is otherwise a strict subset of that
   // one), and inherits `classMethods`'s cross-class resolution for free
   // once the chain's callee dot-joins to `ClassName.method`.
-  const nm = matchBalancedCall(s, /^new\s+([\w.]+)/);
+  const nm = matchBalancedCall(s, /^new\s+([\w.]+)/, { skipGenerics: true });
   if (nm) {
     const ctorArgs = _splitTopLevelCommas(nm.argsText).map(_lowerExpr);
     const chained = _followChain(s, nm.endIdx, nm.callee.split('.').pop(), ctorArgs, true);
@@ -653,6 +932,17 @@ function _lowerStmt(stmt, line) {
     // existing "nothing to lower" convention for a no-op statement.
     if (chained.callee.includes('.')) return { kind: 'call', line, callee: chained.callee, args: chained.args };
   }
+  // Parenthesised form of the same idiom: `(new Helper()).BadSink(data);`.
+  // The statement-form call branch above anchors on an identifier and the
+  // `new` branch anchors on the keyword, so a leading `(` matched neither
+  // and the statement was dropped whole. `_lowerExpr` already understands
+  // the shape; only a chained call (dotted callee) is worth a node.
+  if (s.startsWith('(')) {
+    const e = _lowerExpr(s);
+    if (e.kind === 'call' && typeof e.callee === 'string' && e.callee.includes('.')) {
+      return { kind: 'call', line, callee: e.callee, args: e.args };
+    }
+  }
   return { kind: 'unknown', line, text: s };
 }
 
@@ -746,10 +1036,232 @@ function _linkNodes(nodes, src, dst) {
 // already-trimmed/reconstructed text can. That drift is exactly what cost
 // the PHP port of this same task 3 fix rounds; getting the exact-offset
 // version right from the start avoids repeating it here.
-function _buildCfg(bodyText, nodes, prevId, funcStartLine, lineStarts, baseAbs, depth = 0) {
+// SARD_80_F1 W4.C36 — Juliet's OWN "how is the constant represented" sweep
+// (the same exhaustive variant family this session already fixed 4 times
+// for Java: literal → `final`/`const` field → private/effectively-final
+// field → equality comparison) has a direct C# counterpart the W4.C28 fix
+// above never covered: "Flow Variant 04: Control flow: if(PRIVATE_CONST_TRUE)
+// and if(PRIVATE_CONST_FALSE)" (confirmed via the public C# Juliet mirror's
+// own `CWE80_XSS__CWE182_Web_Connect_tcp_04.cs`) uses `private const bool
+// PRIVATE_CONST_TRUE = true;` — a genuine, provable compile-time constant
+// exactly like the literal keyword, but W4.C28's own guard only matched the
+// bare `true`/`false` token, so this idiom fell straight through to the
+// GENERAL (non-literal) if/else path — the one W4.C27 already documented
+// as losing taint entirely when a dead arm's clean assignment sequentially
+// clobbers the live arm's genuine one. Confirmed by direct reproduction:
+// the file above produced ZERO findings at all (not just a suppressed
+// `good()` — `bad()`'s own genuine sink was invisible too), matching that
+// exact documented failure mode precisely. File-scoped (not per-class) for
+// simplicity, matching Juliet's own convention of never reusing a constant
+// name across classes in one file: a `const`/`static readonly` field is
+// unconditionally safe to fold (it cannot be reassigned by definition,
+// unlike Java's separate "effectively final" extension, which needed a
+// reassignment scan precisely because ordinary fields CAN be reassigned).
+// SARD_80_F1 W4.C38 — the direct C# counterpart of Java's W4.J36 extension.
+// CWE-80 remained BY FAR C#'s worst meaningful-support CWE even after
+// W4.C36 (fn=108 of support=130, tp only 20→22) because W4.C36 covers only
+// the `const`/`readonly` sub-variant (Flow Variant 04); Juliet's own
+// "Flow Variant 05: if(privateTrue) and if(privateFalse)" (confirmed via
+// the public mirror's `CWE80_XSS__CWE182_Web_Connect_tcp_05.cs`) uses a
+// PLAIN, non-const, non-readonly `private bool privateTrue = true;`
+// instance field — not a compile-time constant in the general C# sense,
+// but "effectively final" (written to exactly once, at its own
+// declaration) covers it exactly as soundly as Java's own extension does,
+// for the identical reason: a field that is never reassigned anywhere in
+// the file can never actually change. `_isEffectivelyFinal` is a
+// deliberately simple, conservative TEXT scan (not a full alias/call-graph
+// analysis): counting `\bname\s*=(?!=)` occurrences across the WHOLE file
+// can only ever OVER-count (an unrelated same-named field/local elsewhere)
+// — which only means the optimization is missed, never that a genuinely
+// reassignable field gets folded.
+function _isEffectivelyFinal(code, name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const assignRe = new RegExp(`\\b${escaped}\\s*=(?!=)`, 'g');
+  const matches = code.match(assignRe) || [];
+  return matches.length <= 1;
+}
+
+function _collectCsConstants(code) {
+  const consts = new Map();
+  const re = /\b(?:const\s+(?:static\s+)?|static\s+readonly\s+|readonly\s+static\s+)(?:bool|int)\s+(\w+)\s*=\s*(true|false|-?\d+)\s*;/g;
+  let m;
+  while ((m = re.exec(code))) {
+    const raw = m[2];
+    consts.set(m[1], raw === 'true' ? true : raw === 'false' ? false : parseInt(raw, 10));
+  }
+  // Effectively-final plain fields — deliberately a SEPARATE, second pass:
+  // a field already captured as a real const/readonly constant above must
+  // not be re-evaluated here (harmless either way since the value would
+  // match, but scanning only fields NOT already known keeps this pass's
+  // own regex simpler and its intent — "plain fields only" — explicit).
+  // Requires at least one real ACCESS modifier (private/public/protected/
+  // internal) — C# forbids those on a local variable, so this shape can
+  // only ever be a field declaration, never an incidentally-similar local
+  // (`bool ok = true;` inside a method body is deliberately NOT matched).
+  const plainRe = /\b(?:private|public|protected|internal)\s+(?:static\s+)?(?:bool|int)\s+(\w+)\s*=\s*(true|false|-?\d+)\s*;/g;
+  while ((m = plainRe.exec(code))) {
+    const name = m[1];
+    if (consts.has(name)) continue;
+    if (!_isEffectivelyFinal(code, name)) continue;
+    const raw = m[2];
+    consts.set(name, raw === 'true' ? true : raw === 'false' ? false : parseInt(raw, 10));
+  }
+  return consts;
+}
+
+// SARD_80_F1 W5.28 — C#'s own counterpart to Java's W5.27 (java-ast-folding
+// .js's `_collectClassMethodConstants`): Juliet's "Flow Variant 08/11:
+// Control flow: if(PrivateReturnsTrue()) and if(PrivateReturnsFalse())"
+// idiom branches on a CALL to a same-class, zero-arg, single-`return true;`
+// /`return false;`-bodied private helper (confirmed via the public C#
+// mirror's own `CWE80_XSS__CWE182_Web_Connect_tcp_08.cs`:
+// `private static bool PrivateReturnsTrue() { return true; }`) — a shape
+// `_resolveConstCondition` never modeled (literal / field / int-comparison
+// only). Namespaced under `()<name>` in the SAME `classConsts` map
+// `_collectCsConstants` already builds, mirroring the Java fix's identical
+// collision-avoidance reasoning (C# also permits a field and a method to
+// share one identifier, since a call always needs its own parens). Fails
+// closed on anything but a body that is EXACTLY one `return <expr>;`
+// statement (2+ statements, or a body with side effects, is ambiguous —
+// `body.match` requires the WHOLE trimmed body to be just that one line);
+// the returned expression resolves through `consts` too, so `return
+// SOME_KNOWN_CONST;` also folds correctly.
+function _collectCsMethodConstants(code, consts) {
+  const declRe = /\b(?:private|public|protected|internal)\s+(?:static\s+)?bool\s+(\w+)\s*\(\s*\)\s*\{/g;
+  let m;
+  while ((m = declRe.exec(code))) {
+    const name = m[1];
+    const openIdx = m.index + m[0].length - 1;
+    const closeIdx = _matchDelim(code, openIdx, '{', '}');
+    if (closeIdx === -1) continue;
+    const body = code.slice(openIdx + 1, closeIdx).trim();
+    const retM = body.match(/^return\s+([^;]+);$/);
+    if (!retM) continue;
+    const expr = retM[1].trim();
+    if (expr === 'true') consts.set(`()${name}`, true);
+    else if (expr === 'false') consts.set(`()${name}`, false);
+    else if (consts.has(expr)) {
+      const v = consts.get(expr);
+      if (typeof v === 'boolean') consts.set(`()${name}`, v);
+    }
+  }
+}
+
+// Resolves `condRaw` to a boolean when it's a literal `true`/`false`, a bare
+// reference to a known boolean constant, a bare zero-arg call to a known
+// boolean-constant helper (W5.28), a LITERAL-vs-LITERAL `==`/`!=` comparison
+// (W5.29 — see below), or an `==`/`!=` comparison of a known int constant
+// against a literal — Juliet's own Flow Variant 03/04/08/09/11/13-style
+// idioms. Returns `null` (not `false`) when unresolvable, so callers can
+// distinguish "genuinely false" from "not a constant at all".
+function _resolveConstCondition(condRaw, classConsts) {
+  const trimmed = condRaw.trim();
+  if (trimmed === 'true') return true;
+  if (trimmed === 'false') return false;
+  if (classConsts && classConsts.has(trimmed)) {
+    const v = classConsts.get(trimmed);
+    return typeof v === 'boolean' ? v : null;
+  }
+  const callM = trimmed.match(/^(\w+)\s*\(\s*\)$/);
+  if (callM && classConsts && classConsts.has(`()${callM[1]}`)) {
+    const v = classConsts.get(`()${callM[1]}`);
+    return typeof v === 'boolean' ? v : null;
+  }
+  // SARD_80_F1 W5.29 — Juliet's "Flow Variant 03: if(5==5) and if(5!=5)"
+  // (confirmed via the public C# mirror's own
+  // CWE80_XSS__CWE182_Web_Connect_tcp_03.cs): BOTH sides are bare integer
+  // literals, needing no `classConsts` lookup at all — Java's own AST
+  // evaluator (`evalBinary`) already resolves this shape for free (it
+  // evaluates both operands recursively regardless of whether either is a
+  // known identifier), but this hand-rolled regex evaluator's own `cmp`
+  // check two lines below requires the LHS to be an identifier
+  // (`(\w+)`), so a pure literal-vs-literal comparison never matched.
+  // Checked BEFORE the identifier-based `cmp` check since `\d+` is also
+  // valid `\w+` text and would otherwise shadow this branch.
+  const litCmp = trimmed.match(/^(-?\d+)\s*(==|!=)\s*(-?\d+)$/);
+  if (litCmp) {
+    const lhs = parseInt(litCmp[1], 10);
+    const rhs = parseInt(litCmp[3], 10);
+    return litCmp[2] === '==' ? lhs === rhs : lhs !== rhs;
+  }
+  const cmp = trimmed.match(/^(\w+)\s*(==|!=)\s*(-?\d+)$/);
+  if (cmp && classConsts && classConsts.has(cmp[1])) {
+    const v = classConsts.get(cmp[1]);
+    if (typeof v !== 'number') return null;
+    const rhs = parseInt(cmp[3], 10);
+    return cmp[2] === '==' ? v === rhs : v !== rhs;
+  }
+  return null;
+}
+
+// SARD_80_F1 W5.36 — resolves a `switch` scrutinee to a constant INT value
+// when it's a bare integer literal or a known int constant (reusing the SAME
+// `classConsts` map `_resolveConstCondition`'s own `cmp` branch already
+// consults) — the switch-scrutinee analog of that function's boolean
+// resolution, needed separately because a switch's scrutinee is a VALUE to
+// match against case labels, not a boolean condition. Returns `null` (not
+// a number) when unresolvable, matching that function's own convention.
+function _resolveConstIntValue(expr, classConsts) {
+  const trimmed = expr.trim();
+  if (/^-?\d+$/.test(trimmed)) return parseInt(trimmed, 10);
+  if (classConsts && classConsts.has(trimmed)) {
+    const v = classConsts.get(trimmed);
+    return typeof v === 'number' ? v : null;
+  }
+  return null;
+}
+
+// Splits a switch statement's braced BODY text into label segments —
+// `{kind:'case', value, bodyStart, bodyEnd}` or `{kind:'default', bodyStart,
+// bodyEnd}` — scanning at bracket/string-aware DEPTH 0 so a `case`/`default`
+// keyword appearing inside a nested block, string, or (extremely rare in
+// this corpus) nested switch is never mistaken for a real label. `bodyStart`
+// is the offset immediately after the label's own `:`; `bodyEnd` is the next
+// label's own start (or the whole body's length for the last label) — the
+// exact text a live case's statements occupy, `break;` and all (never
+// stripped: it is simply never reached during recursion since nothing reads
+// past the live section's own end).
+function _splitSwitchCases(bodyText) {
+  const labels = [];
+  let depth = 0, inStr = null, escape = false;
+  for (let i = 0; i < bodyText.length; i++) {
+    const c = bodyText[i];
+    if (escape) { escape = false; continue; }
+    if (inStr) {
+      if (c === '\\') { escape = true; continue; }
+      if (c === inStr) inStr = null;
+      continue;
+    }
+    if (c === '"' || c === "'") { inStr = c; continue; }
+    if (c === '{' || c === '(' || c === '[') { depth++; continue; }
+    if (c === '}' || c === ')' || c === ']') { depth--; continue; }
+    if (depth !== 0) continue;
+    const atBoundary = i === 0 || /[\s;}]/.test(bodyText[i - 1]);
+    if (!atBoundary) continue;
+    const rest = bodyText.slice(i);
+    const caseM = rest.match(/^case\s+(-?\d+)\s*:/);
+    if (caseM) {
+      labels.push({ kind: 'case', value: parseInt(caseM[1], 10), labelStart: i, bodyStart: i + caseM[0].length });
+      continue;
+    }
+    const defM = rest.match(/^default\s*:/);
+    if (defM) {
+      labels.push({ kind: 'default', labelStart: i, bodyStart: i + defM[0].length });
+      continue;
+    }
+  }
+  for (let idx = 0; idx < labels.length; idx++) {
+    labels[idx].bodyEnd = idx + 1 < labels.length ? labels[idx + 1].labelStart : bodyText.length;
+  }
+  return labels;
+}
+
+function _buildCfg(bodyText, nodes, prevId, funcStartLine, lineStarts, baseAbs, depth = 0, classConsts = null) {
   if (depth > 12) return prevId;
   let prev = prevId;
-  for (const { text: s, start } of _splitStatements(bodyText)) {
+  const stmts = _splitStatements(bodyText);
+  for (let stmtIdx = 0; stmtIdx < stmts.length; stmtIdx++) {
+    const { text: s, start } = stmts[stmtIdx];
     if (!s) continue;
     const absStart = baseAbs + start;
     const line = funcStartLine + _lineForOffset(lineStarts, absStart) - 1;
@@ -811,6 +1323,145 @@ function _buildCfg(bodyText, nodes, prevId, funcStartLine, lineStarts, baseAbs,
             prev = assignId;
           }
         }
+      } else if (kwNorm === 'if' && condRaw !== null && _resolveConstCondition(condRaw, classConsts) !== null) {
+        // Juliet's `if (true) { … } else { … }` / `if (false) { … } else
+        // { … }` constant-condition idiom — its OWN "Flow Variant 02"
+        // naming convention, used across dozens of CWEs, not just one —
+        // must be pruned HERE, at IR-build time, not left to the general
+        // if/else handling below. The general path deliberately builds a
+        // STRAIGHT-LINE CFG for if/else (recurse into the if-body, then
+        // — because bare `else` has no `needsCond` match and isn't linked
+        // as a real second branch of the `if` node — treat the following
+        // `else { … }` as an unconditionally-sequential block that runs
+        // AFTER the if-body). That's a deliberate recall-preserving
+        // tradeoff for a REAL runtime condition (never drop a sink hidden
+        // in either arm) — but it is actively WRONG for a LITERAL
+        // true/false condition, where the dead arm provably never runs at
+        // all: a clean/null assignment in the dead arm was overwriting —
+        // "clobbering" at the CFG-sequencing level, not a taint-engine
+        // merge — the live arm's genuine taint by the time a later sink
+        // read the variable. Confirmed via the public C# Juliet mirror's
+        // own `CWE78_..._NetClient_02.cs`: `if (true) { data =
+        // sr.ReadLine(); } else { data = null; }` lost ALL taint on
+        // `data` before this fix, while the same source with no `else`
+        // (or no `if` at all) worked correctly — isolating the defect to
+        // exactly this construct. `_lowerExpr` never models C#'s `true`/
+        // `false` keywords as `{kind:'literal'}` (they fall through to
+        // `{kind:'ident', name:'true'|'false'}`), so `evalConst` in
+        // `dataflow/path-feasibility.js` — which only prunes an already-
+        // built two-successor `if` node — never even gets the chance;
+        // the straight-line shape here never HAD two successors to prune.
+        // No `if` CFG node is emitted at all for a literal condition:
+        // there is no real branch to represent, only dead code to skip.
+        const isTrue = _resolveConstCondition(condRaw, classConsts);
+        const restIf = s.slice(afterHeader);
+        const leadIf = restIf.match(/^\s*/)[0].length;
+        let liveText = null, liveBaseAbs = null;
+        if (restIf[leadIf] === '{') {
+          const closeRel = _matchDelim(restIf, leadIf, '{', '}');
+          if (closeRel !== -1) {
+            liveText = restIf.slice(leadIf + 1, closeRel);
+            liveBaseAbs = absStart + afterHeader + leadIf + 1;
+          }
+        } else if (restIf.trim()) {
+          liveText = restIf;
+          liveBaseAbs = absStart + afterHeader;
+        }
+        // Peek at the immediately-following statement: a bare `else` (NOT
+        // `else if`, which is a fresh conditional the general path must
+        // still handle) belongs to THIS if and must be consumed here —
+        // either as the live branch (condition false) or discarded
+        // outright (condition true) — never left for the outer loop to
+        // fall through to the generic bare-`else`-as-sequential-block
+        // handling that IS the bug this branch exists to avoid.
+        let elseText = null, elseBaseAbs = null;
+        const next = stmts[stmtIdx + 1];
+        if (next) {
+          const em = next.text.match(/^else\b(?!\s*if\b)/);
+          if (em) {
+            let ep = em[0].length;
+            while (ep < next.text.length && /\s/.test(next.text[ep])) ep++;
+            const erest = next.text.slice(ep);
+            const elead = erest.match(/^\s*/)[0].length;
+            const eAbsStart = baseAbs + next.start;
+            if (erest[elead] === '{') {
+              const closeRel = _matchDelim(erest, elead, '{', '}');
+              if (closeRel !== -1) {
+                elseText = erest.slice(elead + 1, closeRel);
+                elseBaseAbs = eAbsStart + ep + elead + 1;
+              }
+            } else if (erest.trim()) {
+              elseText = erest;
+              elseBaseAbs = eAbsStart + ep;
+            }
+            stmtIdx++; // consumed — the outer loop must not process it again
+          }
+        }
+        if (isTrue) {
+          if (liveText !== null) prev = _buildCfg(liveText, nodes, prev, funcStartLine, lineStarts, liveBaseAbs, depth + 1, classConsts);
+        } else if (elseText !== null) {
+          prev = _buildCfg(elseText, nodes, prev, funcStartLine, lineStarts, elseBaseAbs, depth + 1, classConsts);
+        }
+        continue;
+      } else if (kwNorm === 'switch' && condRaw !== null && _resolveConstIntValue(condRaw, classConsts) !== null) {
+        // SARD_80_F1 W5.36 — Juliet's own "Flow Variant 15: switch(6) and
+        // switch(7)" idiom (confirmed via the public C# mirror's own
+        // CWE78_OS_Command_Injection__NetClient_15.cs), the switch-scrutinee
+        // sibling of the already-modeled `if(true)/if(false)` idiom just
+        // above. Before this fix, `switch` had NO constant-folding at all —
+        // the general fallback below builds an `if`-shaped CFG node whose
+        // `cond` is never consulted for branching, then recurses into the
+        // WHOLE braced body as ONE STRAIGHT-LINE SEQUENTIAL block, meaning
+        // `case 6: data = tainted; break; default: data = null; break;`
+        // executes BOTH assignments in sequence, with whichever is
+        // TEXTUALLY LAST always clobbering the other — silently destroying
+        // real taint (a false negative when the tainted case is textually
+        // first) or fabricating a false positive/negative for the opposite
+        // ordering, entirely independent of which case the switch would
+        // ACTUALLY take at runtime. Resolves ONLY when the scrutinee is a
+        // constant int (bare literal or a known int class-constant, via
+        // `_resolveConstIntValue` — the switch-scrutinee analog of
+        // `_resolveConstCondition`'s own boolean resolution); when it is,
+        // finds the matching `case`, falls back to `default` if no case
+        // matches, and recurses ONLY into that one section's own text —
+        // exactly mirroring the if(true)/if(false) pattern's "no CFG node
+        // for a literal condition, only the live branch's text" shape. A
+        // switch with neither a matching case nor any `default` is a
+        // genuine C# no-op (nothing runs) and is silently skipped, matching
+        // real language semantics.
+        const restSw = s.slice(afterHeader);
+        const leadSw = restSw.match(/^\s*/)[0].length;
+        if (restSw[leadSw] === '{') {
+          const closeRel = _matchDelim(restSw, leadSw, '{', '}');
+          if (closeRel !== -1) {
+            const scrutineeVal = _resolveConstIntValue(condRaw, classConsts);
+            const bodyText = restSw.slice(leadSw + 1, closeRel);
+            const bodyBaseAbs = absStart + afterHeader + leadSw + 1;
+            const cases = _splitSwitchCases(bodyText);
+            let live = cases.find(c => c.kind === 'case' && c.value === scrutineeVal);
+            if (!live) live = cases.find(c => c.kind === 'default');
+            if (live) {
+              const liveText = bodyText.slice(live.bodyStart, live.bodyEnd);
+              prev = _buildCfg(liveText, nodes, prev, funcStartLine, lineStarts, bodyBaseAbs + live.bodyStart, depth + 1, classConsts);
+            }
+          }
+        }
+        continue;
+      } else if (kwNorm === 'using' && condRaw !== null) {
+        // `using (SqlCommand cmd = new SqlCommand(query, conn)) { … }`: the
+        // resource clause is a real declaration, and in ADO.NET it is where
+        // the command text (the SQL-injection sink argument) is bound. It
+        // was previously discarded with the header, so `cmd` had no
+        // provenance and the constructor sink never saw its argument.
+        // Lowered as an ordinary assign ahead of the body; a bare
+        // expression clause (`using (GetLock())`) has no target and is
+        // skipped as before.
+        const declNode = _lowerStmt(condRaw.trim(), line);
+        if (declNode && declNode.kind === 'assign') {
+          const declId = _addNode(nodes, declNode);
+          _linkNodes(nodes, prev, declId);
+          prev = declId;
+        }
       } else {
         const needsCond = /^(?:if|while|for|switch|else if|catch)$/.test(kwNorm);
         if (needsCond && condRaw !== null) {
@@ -849,11 +1500,11 @@ function _buildCfg(bodyText, nodes, prevId, funcStartLine, lineStarts, baseAbs,
         const closeRel = _matchDelim(rest, lead, '{', '}');
         if (closeRel !== -1) {
           const innerBaseAbs = absStart + afterHeader + lead + 1;
-          prev = _buildCfg(rest.slice(lead + 1, closeRel), nodes, prev, funcStartLine, lineStarts, innerBaseAbs, depth + 1);
+          prev = _buildCfg(rest.slice(lead + 1, closeRel), nodes, prev, funcStartLine, lineStarts, innerBaseAbs, depth + 1, classConsts);
         }
       } else if (rest.trim()) {
         const innerBaseAbs = absStart + afterHeader;
-        prev = _buildCfg(rest, nodes, prev, funcStartLine, lineStarts, innerBaseAbs, depth + 1);
+        prev = _buildCfg(rest, nodes, prev, funcStartLine, lineStarts, innerBaseAbs, depth + 1, classConsts);
       }
       continue;
     }
@@ -862,7 +1513,7 @@ function _buildCfg(bodyText, nodes, prevId, funcStartLine, lineStarts, baseAbs,
     const bare = s.match(/^\{([\s\S]*)\}$/);
     if (bare) {
       const innerBaseAbs = absStart + 1;
-      prev = _buildCfg(bare[1], nodes, prev, funcStartLine, lineStarts, innerBaseAbs, depth + 1);
+      prev = _buildCfg(bare[1], nodes, prev, funcStartLine, lineStarts, innerBaseAbs, depth + 1, classConsts);
       continue;
     }
 
@@ -879,6 +1530,8 @@ export function parseCSharpFile(file, code) {
   if (!file || typeof code !== 'string') return null;
   const functions = [];
   const classRanges = _findClassRanges(code);
+  const classConsts = _collectCsConstants(code);
+  _collectCsMethodConstants(code, classConsts);
   METHOD_RE.lastIndex = 0;
   let m;
   while ((m = METHOD_RE.exec(code)) !== null) {
@@ -886,6 +1539,7 @@ export function parseCSharpFile(file, code) {
     const className = _enclosingClassName(classRanges, m.index);
     const paramsText = m[3] || '';
     const paramAnnotations = [];
+    const paramTypes = {};
     // `keptIdx` tracks the parameter's position in the FILTERED array — the
     // same array `fn.params` ends up being — not the raw pre-filter split
     // position (`idx` below). It only advances when a fragment actually
@@ -932,8 +1586,28 @@ export function parseCSharpFile(file, code) {
         remaining = remaining.slice(match[0].length).trim();
       }
       // "Type name" → name. "Type<T> name" → name. "Type[] name = default" → name.
-      const last = remaining.replace(/=.*$/, '').trim().split(/\s+/).pop();
+      const beforeDefault = remaining.replace(/=.*$/, '').trim();
+      const nameTokens = beforeDefault.split(/\s+/);
+      const last = nameTokens.pop();
       const paramName = last && /^[A-Za-z_][\w]*$/.test(last) ? last : null;
+      // Declared TYPE (SARD_80_F1 W4 — same rationale as parser-java.js's
+      // `paramTypes`/parser-cs.js's own local-var `declaredType` above):
+      // Web Forms' dominant `Render(HtmlTextWriter writer)` override idiom
+      // is a PARAMETER, not a local declaration, and a param's type was
+      // never captured before this. `nameTokens` (everything before the
+      // param name, after stripping attributes and a default value) is
+      // the type clause — `ref`/`out`/`params`/`in` modifiers are stripped
+      // as bare keywords, generics/arrays reduced to the base name, same
+      // normalization as the local-variable case.
+      let paramType;
+      if (paramName && nameTokens.length) {
+        const typeText = nameTokens.filter(w => !/^(?:ref|out|params|in|this)$/.test(w)).join(' ');
+        const bare = typeText.replace(/<.*$/, '').replace(/\[\]$/, '').trim();
+        if (bare && bare !== 'var') {
+          const segs = bare.split('.');
+          paramType = segs[segs.length - 1];
+        }
+      }
       // Add an entry for each decorator found, indexed by position in the
       // FILTERED params array (see `keptIdx` comment above) — not `idx`,
       // the raw pre-filter split position.
@@ -941,6 +1615,7 @@ export function parseCSharpFile(file, code) {
         for (const decorator of decorators) {
           paramAnnotations.push({ index: keptIdx, name: paramName, decorator });
         }
+        if (paramType) paramTypes[paramName] = paramType;
         keptIdx++;
       }
       return paramName;
@@ -969,7 +1644,7 @@ export function parseCSharpFile(file, code) {
     nodes.entry = { kind: 'entry', line: startLine, succ: [], pred: [] };
     nodes.exit  = { kind: 'exit',  line: startLine, succ: [], pred: [] };
     _csNid = 0;
-    const tail = _buildCfg(extracted.body, nodes, 'entry', bodyStartLine, lineStarts, 0, 0);
+    const tail = _buildCfg(extracted.body, nodes, 'entry', bodyStartLine, lineStarts, 0, 0, classConsts);
     nodes[tail].succ.push('exit');
     nodes.exit.pred.push(tail);
     _applyVarTypeRewrite(nodes);
@@ -980,8 +1655,15 @@ export function parseCSharpFile(file, code) {
       cfg,
       calls: callSitesFromCfg(cfg),
       ...(paramAnnotations.length ? { paramAnnotations } : {}),
+      ...(Object.keys(paramTypes).length ? { paramTypes } : {}),
     });
     METHOD_RE.lastIndex = extracted.end + 1;
   }
-  return { file, functions, topLevel: null };
+  const classes = classRanges.map(r => ({
+    name: r.name,
+    line: r.line,
+    bases: r.bases,
+    fields: _extractClassFields(code, r),
+  }));
+  return { file, functions, classes, topLevel: null };
 }