@clear-capabilities/agentic-security-scanner 0.151.3 → 0.153.0

package/src/ir/class-hierarchy.js

@@ -39,11 +39,30 @@ const _AST_CACHE = new WeakMap();
  * Build the CHA over a perFileIR map (file → parsed IR with raw AST attached
  * under `_ast`). When AST isn't attached, fall back to the IR's own
  * structural hints (class names appearing in qids).
+ *
+ * `callGraph` (optional, from `../ir/callgraph.js#buildCallGraph`) enables
+ * one additional, otherwise-skipped pass: cross-call-site parameter type
+ * inference from the argument a caller actually passes (see that pass's own
+ * header comment below for the full rationale). Every existing caller that
+ * only ever passed `perFileIR` keeps working unchanged — the pass simply
+ * doesn't run without it.
  */
-export function buildClassHierarchy(perFileIR) {
+export function buildClassHierarchy(perFileIR, callGraph) {
   const classes = new Map();       // className -> { file, line, methods, extends }
   const methodOwners = new Map();  // qid -> className
   const typeOfVar = new Map();     // file::scope::var -> className
+  // A variable assigned two DIFFERENT constructed types within one function
+  // must never resolve to either — same "refuse to guess on ambiguity"
+  // convention `_localVarConstructedTypes` (parser-java.js/parser-cs.js)
+  // already enforces at parse time for the callee-string-rewrite path. This
+  // map had NO ambiguity tracking of its own (last assign silently won) —
+  // latent since day one, but never exercised for hand-rolled-parser
+  // languages because `_resolveMemberCalleeViaCHA` (engine.js) only ever
+  // consulted `classOfVar` for the Babel `{kind:'member'}` shape (JS-only)
+  // until PRD W2.5 extended it to flat dotted-string callees too. Caught by
+  // `test/catalog-cs-p1.test.js`'s existing ambiguity-refusal regression
+  // test the moment that extension shipped.
+  const ambiguousVarKeys = new Set();
 
   if (!perFileIR || typeof perFileIR !== 'object') {
     return { classes, methodOwners, typeOfVar };
@@ -59,15 +78,37 @@ export function buildClassHierarchy(perFileIR) {
         if (!c || !c.name) continue;
         let cls = classes.get(c.name);
         if (!cls) {
-          cls = { name: c.name, file, line: c.line || 0, methods: new Set(), extends: null };
+          cls = { name: c.name, file, line: c.line || 0, methods: new Set(), extends: null, bases: [], fields: new Set() };
           classes.set(c.name, cls);
         }
+        if (!cls.bases) cls.bases = [];
+        if (!cls.fields) cls.fields = new Set();
         // v1 keeps a single base: the CHA walk in resolveMethod follows one
         // chain. Multiple inheritance is flattened to the first base, which is
         // a deliberate over-simplification recorded in PRD §6.8.
         if (!cls.extends && Array.isArray(c.bases) && c.bases.length) {
           cls.extends = c.bases[0];
         }
+        // Full base/interface list (SARD_80_F1_SCANNER_PRD.md — abstract/
+        // interface-receiver dispatch, Juliet flow variants 81/82): `extends`
+        // above follows exactly one chain for resolveMethod's walk, but a
+        // receiver typed as an INTERFACE (`IAction b = new BadImpl();`) needs
+        // to know every implemented name, not just the first. Purely additive
+        // — nothing previously read `cls.bases`.
+        if (Array.isArray(c.bases)) {
+          for (const b of c.bases) if (b && !cls.bases.includes(b)) cls.bases.push(b);
+        }
+        // Declared field names (SARD_80_F1_SCANNER_PRD.md — cross-method field
+        // taint, Juliet flow variants 45/65-68): lets the taint engine tell a
+        // field write (`sf = data;`, `this.inst = data;`) apart from an
+        // ordinary local variable with the same name in a DIFFERENT method of
+        // the same class, without which a field write in one method could
+        // never be told to taint a read in another. Merged across every file
+        // that contributes to this class (partial classes, or a parser that
+        // emits one `ir.classes` entry per method's enclosing file).
+        if (Array.isArray(c.fields)) {
+          for (const f of c.fields) if (f) cls.fields.add(f);
+        }
       }
     }
     if (!Array.isArray(ir.functions)) continue;
@@ -94,9 +135,15 @@ export function buildClassHierarchy(perFileIR) {
       if (dotIdx > 0) {
         className = tail.slice(0, dotIdx);
         methodName = tail.slice(dotIdx + 1).replace(/@\d+#[0-9a-f]+$/, '');
-      } else if (segs.length >= 3 && /^[A-Z]/.test(segs[segs.length - 2])) {
-        // Gated on the second-to-last segment being PascalCase so this
-        // doesn't misfire on an ordinary nested-function scope segment.
+      } else if (segs.length >= 3 && (classes.has(segs[segs.length - 2]) || /^[A-Z]/.test(segs[segs.length - 2]))) {
+        // PRD W1 (SARD_80_F1_EXECUTION_PRD.md) — `classes` was already
+        // populated from this file's real `ir.classes` structural facts
+        // above (lines 57-94), so `classes.has(...)` recognizes a scrambled
+        // class name (`case_<hash>`, no longer PascalCase) exactly as
+        // reliably as a real one. The `/^[A-Z]/` fallback stays for
+        // languages that don't emit `ir.classes` yet (JS/Python/PHP/Ruby/Go/
+        // Kotlin — W1.1) so an ordinary nested-function scope segment still
+        // doesn't misfire there, same as before this change.
         className = segs[segs.length - 2];
         // Two sequential strips, not one `(#[0-9a-f]+)?` optional group: the
         // combined form is flagged by this project's own self-scan gate
@@ -113,7 +160,7 @@ export function buildClassHierarchy(perFileIR) {
       methodOwners.set(fn.qid, className);
       let cls = classes.get(className);
       if (!cls) {
-        cls = { name: className, file, line: fn.line || 0, methods: new Set(), extends: null };
+        cls = { name: className, file, line: fn.line || 0, methods: new Set(), extends: null, bases: [], fields: new Set() };
         classes.set(className, cls);
       }
       cls.methods.add(methodName);
@@ -160,7 +207,214 @@ export function buildClassHierarchy(perFileIR) {
         if (classes.has(className) || /^[A-Z]/.test(className)) {
           // Convention: PascalCase `new` callees treated as constructors.
           const target = typeof n.target === 'string' ? n.target : null;
-          if (target) typeOfVar.set(`${file}::${fn.qid}::${target}`, className);
+          if (target) {
+            const key = `${file}::${fn.qid}::${target}`;
+            if (ambiguousVarKeys.has(key)) continue;
+            if (typeOfVar.has(key) && typeOfVar.get(key) !== className) {
+              ambiguousVarKeys.add(key);
+              typeOfVar.delete(key);
+            } else {
+              typeOfVar.set(key, className);
+            }
+          }
+        }
+      }
+    }
+    // PRD W2.5 (SARD_80_F1_EXECUTION_PRD.md) — a PARAMETER's declared type is
+    // just as real a type binding as a local `let x = new Foo()`, and it's
+    // Juliet's OWN dominant abstract/interface dispatch idiom: the "runTest"
+    // driver constructs the concrete (bad/good) instance and passes it as a
+    // parameter to a helper that invokes the virtual method — `_localVarConstructedTypes`
+    // (parser-java.js/parser-cs.js) only ever sees the CONSTRUCTOR site, not
+    // this call site, so `b` in `void helper(BaseType b, ...) { b.action(x); }`
+    // was completely untyped. Reuses the EXACT same `typeOfVar` map and key
+    // shape `classOfVar` already reads — no new lookup mechanism, so every
+    // existing consumer (engine.js's `_resolveMemberCalleeViaCHA` once it
+    // learns to read a flat dotted-string callee, `receiver-context.js`)
+    // benefits with no changes on their end. Only populated when
+    // `fn.paramTypes` exists (currently parser-java.js; parser-cs.js is a
+    // candidate follow-up, same shape). Deliberately does NOT overwrite an
+    // existing binding for the same key — a parameter name can never collide
+    // with a local var name in the same scope in Java, so this is purely
+    // additive, but the guard costs nothing and documents the intent.
+    for (const fn of ir.functions) {
+      if (!fn.paramTypes) continue;
+      for (const [paramName, paramType] of Object.entries(fn.paramTypes)) {
+        const key = `${file}::${fn.qid}::${paramName}`;
+        if (!typeOfVar.has(key) && !ambiguousVarKeys.has(key)) typeOfVar.set(key, paramType);
+      }
+    }
+    // SARD_80_F1 W4: a local's DECLARED type (`PrintWriter out =
+    // response.getWriter();`, parser-java.js's `declaredType` on the assign
+    // node) is the third source of a type binding, alongside a constructor
+    // call above and a parameter's declared type. This is Java's dominant
+    // "get an object via a factory/getter method, not `new`" idiom — the
+    // constructor pass above can never see it (there is no `new` at all).
+    // Deliberately consulted via `receiverTypeIn` only (additive — see
+    // `catalog.js`'s `java-writer-*` entries), never via the destructive
+    // callee-string rewrite `parser-java.js`'s `_localVarConstructedTypes`
+    // does for constructor types: that mechanism was tried for declared
+    // types too and reverted after it broke an unrelated, name-scoped
+    // catalog entry (see its own comment). Populated by both
+    // parser-java.js and parser-cs.js (C#'s `Type x = expr;` decl-typeClause
+    // capture, same field name and rationale).
+    for (const fn of ir.functions) {
+      if (!fn.cfg || !fn.cfg.nodes) continue;
+      for (const node of Object.values(fn.cfg.nodes)) {
+        if (node.kind !== 'assign' || !node.declaredType || typeof node.target !== 'string' || node.target.includes('.')) continue;
+        const key = `${file}::${fn.qid}::${node.target}`;
+        if (!typeOfVar.has(key) && !ambiguousVarKeys.has(key)) typeOfVar.set(key, node.declaredType);
+      }
+    }
+  }
+
+  // Next-gen taint capability #4b — factory-function RETURN-type inference,
+  // the sibling gap this file's OWN header comment names and explicitly
+  // marks unimplemented ("`function buildFoo(): Foo { ... }` typed-return
+  // inference — NOT implemented. `const x = buildFoo()` is untyped
+  // (correctly: it is a plain call, not a `new`)"). Confirmed still real via
+  // a direct reproduction: `function makeHelper() { return new Helper(); }
+  // const h = makeHelper(); h.getValue(req);` misses the vulnerability
+  // entirely, the identical failure shape 4a (above) closes for the
+  // parameter case. `_inferredFactoryReturnClass` is deliberately
+  // conservative, same "refuse rather than guess" discipline as every other
+  // pass in this file: a function qualifies ONLY when every one of its own
+  // `return` statements is a `new ClassName(...)` literal of the SAME
+  // class — a function with no return, a non-constructor return on any
+  // path, or disagreeing classes across returns all correctly infer
+  // nothing, rather than picking one arbitrarily.
+  function _inferredFactoryReturnClass(fn) {
+    if (!fn || !fn.cfg || !fn.cfg.nodes) return null;
+    let className = null;
+    for (const node of Object.values(fn.cfg.nodes)) {
+      if (node.kind !== 'return' || !node.value) continue;
+      const v = node.value;
+      if (v.kind !== 'call' || !v.isNew) return null;
+      const callee = v.callee;
+      const cn = callee?.kind === 'ident' ? callee.name
+        : typeof callee === 'string' ? (callee.includes('.') ? callee.slice(callee.lastIndexOf('.') + 1) : callee)
+        : null;
+      if (!cn || !(classes.has(cn) || /^[A-Z]/.test(cn))) return null;
+      if (className === null) className = cn;
+      else if (className !== cn) return null;
+    }
+    return className;
+  }
+  if (callGraph && typeof callGraph.resolveKnownCallee === 'function' && callGraph.functions) {
+    const factoryReturnCache = new Map(); // qid -> className|null, memoized
+    const factoryReturnClassOf = (qid, fn) => {
+      if (factoryReturnCache.has(qid)) return factoryReturnCache.get(qid);
+      const cn = _inferredFactoryReturnClass(fn);
+      factoryReturnCache.set(qid, cn);
+      return cn;
+    };
+    for (const [callerFile, ir] of Object.entries(perFileIR)) {
+      if (!ir || !Array.isArray(ir.functions)) continue;
+      for (const fn of ir.functions) {
+        if (!fn.cfg || !fn.cfg.nodes) continue;
+        for (const node of Object.values(fn.cfg.nodes)) {
+          if (node.kind !== 'assign' || typeof node.target !== 'string' || node.target.includes('.')) continue;
+          const src = node.source;
+          // A plain call (isNew must be FALSY — a real `new Foo()` is
+          // already handled by the constructor-assignment pass above, and
+          // conflating the two would just redundantly re-derive the same
+          // answer through a slower path).
+          if (!src || src.kind !== 'call' || src.isNew) continue;
+          const calleeName = typeof src.callee === 'string' ? src.callee
+            : src.callee && src.callee.kind === 'ident' ? src.callee.name : null;
+          if (!calleeName) continue;
+          const calleeQid = callGraph.resolveKnownCallee(calleeName, callerFile);
+          if (!calleeQid) continue;
+          const calleeFn = callGraph.functions.get(calleeQid);
+          if (!calleeFn) continue;
+          const className = factoryReturnClassOf(calleeQid, calleeFn);
+          if (!className) continue;
+          const key = `${callerFile}::${fn.qid}::${node.target}`;
+          if (ambiguousVarKeys.has(key)) continue;
+          if (typeOfVar.has(key) && typeOfVar.get(key) !== className) {
+            ambiguousVarKeys.add(key);
+            typeOfVar.delete(key);
+          } else {
+            typeOfVar.set(key, className);
+          }
+        }
+      }
+    }
+  }
+
+  // Next-gen taint capability #4 (a narrow, call-site-scoped slice of
+  // "Andersen-style points-to", not the full thing): cross-call-site
+  // PARAMETER type inference from the ARGUMENT a caller actually passes, for
+  // JS/TS — which has no declared-type mechanism at all (`fn.paramTypes`
+  // just above only ever fires for Java/C#). Juliet's own dominant
+  // "driver constructs the concrete instance, passes it as a parameter to a
+  // helper that invokes the virtual method" idiom (already solved for
+  // Java/C# via fn.paramTypes) has no JS/TS equivalent: `function
+  // wrapper(h, req) { return h.getValue(req); }`, called only as `const h =
+  // new Helper(); wrapper(h, req);`, leaves `h` permanently untyped inside
+  // wrapper's own body, so `h.getValue()` can never resolve via CHA —
+  // confirmed via a direct reproduction (cold-cache AND warm-incremental-
+  // cache both miss it identically, ruling out a caching-specific cause)
+  // showing a real cross-file taint-recall false negative for exactly this
+  // shape. Requires `callGraph` (optional, backward-compatible — every
+  // existing caller that only ever passed `perFileIR` simply skips this
+  // pass, matching this file's own established graceful-degradation
+  // convention). Deliberately runs as a LAST, separate pass over every file
+  // (not merged into the per-file loop above) because it needs BOTH a
+  // cross-file callee lookup (`callGraph.resolveKnownCallee`) AND the
+  // CALLER's own already-inferred `typeOfVar` entries (an identifier
+  // argument's type, established by the constructor-assignment pass above)
+  // — neither is available mid-way through that loop for an arbitrary file
+  // ordering.
+  if (callGraph && typeof callGraph.resolveKnownCallee === 'function' && callGraph.functions) {
+    for (const [callerFile, ir] of Object.entries(perFileIR)) {
+      if (!ir || !Array.isArray(ir.functions)) continue;
+      for (const callerFn of ir.functions) {
+        if (!Array.isArray(callerFn.calls)) continue;
+        for (const call of callerFn.calls) {
+          const calleeName = typeof call.callee === 'string' ? call.callee
+            : call.callee && call.callee.kind === 'ident' ? call.callee.name : null;
+          if (!calleeName) continue;
+          const calleeQid = callGraph.resolveKnownCallee(calleeName, callerFile);
+          if (!calleeQid) continue;
+          const calleeFn = callGraph.functions.get(calleeQid);
+          if (!calleeFn || !Array.isArray(calleeFn.params) || !calleeFn.params.length || !calleeFn.file) continue;
+          const args = Array.isArray(call.args) ? call.args : [];
+          for (let i = 0; i < args.length && i < calleeFn.params.length; i++) {
+            const arg = args[i];
+            let className = null;
+            if (arg && arg.kind === 'call' && arg.isNew) {
+              // A literal `new ClassName(...)` passed directly as the argument.
+              const argCallee = arg.callee;
+              className = argCallee?.kind === 'ident' ? argCallee.name
+                : typeof argCallee === 'string' ? (argCallee.includes('.') ? argCallee.slice(argCallee.lastIndexOf('.') + 1) : argCallee)
+                : null;
+            } else if (arg && arg.kind === 'ident' && arg.name) {
+              // Juliet's own dominant idiom: `const h = new Helper(); f(h,
+              // ...)`. `h`'s type was already established by the
+              // constructor-assignment pass above (it runs first, in the
+              // SAME outer file loop) — reuse it directly rather than
+              // re-deriving, so this stays in sync with that pass's own
+              // ambiguity handling by construction.
+              className = typeOfVar.get(`${callerFile}::${callerFn.qid}::${arg.name}`) || null;
+            }
+            if (!className || !(classes.has(className) || /^[A-Z]/.test(className))) continue;
+            const paramName = calleeFn.params[i];
+            if (typeof paramName !== 'string' || !paramName) continue;
+            // Same collision-refusal discipline as every other typeOfVar-
+            // populating pass in this file: a wrong "confidently resolved"
+            // type is worse than staying unknown, so a SECOND call site
+            // disagreeing with an already-recorded type for this exact
+            // parameter permanently refuses it, never picks a side.
+            const key = `${calleeFn.file}::${calleeQid}::${paramName}`;
+            if (ambiguousVarKeys.has(key)) continue;
+            if (typeOfVar.has(key) && typeOfVar.get(key) !== className) {
+              ambiguousVarKeys.add(key);
+              typeOfVar.delete(key);
+            } else {
+              typeOfVar.set(key, className);
+            }
+          }
         }
       }
     }

package/src/ir/csharp-ir.js

@@ -47,6 +47,10 @@ const TYPE_MODIFIERS = new Set(['readonly', 'const', 'static', 'public', 'privat
 
 const BUILTIN_TYPES = new Set(['void', 'bool', 'byte', 'sbyte', 'char', 'short', 'ushort', 'int', 'uint', 'long', 'ulong', 'float', 'double', 'decimal', 'string', 'object', 'var', 'dynamic']);
 
+// SARD_80_F1 W4.C11 — compound assignment operators, tokenized as single
+// 'op' tokens by csharp-tokenizer.js but previously never checked for here.
+const CS_COMPOUND_ASSIGN_OPS = new Set(['+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '??=']);
+
 function isType(tok) {
   if (!tok) return false;
   if (tok.kind === 'kw' && BUILTIN_TYPES.has(tok.value)) return true;
@@ -268,7 +272,7 @@ function readMethodHeader(tokens, i, attachedAttrs) {
 }
 
 function walkMethodBody(method) {
-  const out = { calls: [], ctors: [], assignments: [], decls: [], strings: [] };
+  const out = { calls: [], ctors: [], assignments: [], decls: [], strings: [], returns: [] };
   const tokens = method.bodyTokens;
   for (let i = 0; i < tokens.length; i++) {
     const t = tokens[i];
@@ -277,6 +281,45 @@ function walkMethodBody(method) {
       out.strings.push({ kind: t.kind, value: t.value || tokenText([t]), line: t.line, parts: t.parts || null });
       continue;
     }
+    // `return <expr>;` (bare `return;` produces no expr and is skipped —
+    // interprocedural return-taint resolution has nothing to check there).
+    // SARD_80_F1 W3.x: gives `analyzeMethodFlow` visibility into what a
+    // same-file callee actually returns, so a call-shaped assignment RHS
+    // (`data = GoodG2BSource(req, resp);`) can be resolved against the
+    // callee's OWN return taint instead of blindly matching every
+    // identifier NAME in the call text (which wrongly taints on `req`/
+    // `resp` merely being passed as arguments — see the taintMap loop
+    // below and its `_asBareCall`/`resolveCalleeReturnTaint` usage).
+    if (t.kind === 'kw' && t.value === 'return') {
+      let j = i + 1;
+      let depth = 0;
+      while (j < tokens.length && (depth > 0 || tokens[j].kind !== 'semi')) {
+        const tk = tokens[j];
+        if (tk.kind === 'lparen' || tk.kind === 'lbrace' || tk.kind === 'lbracket') depth++;
+        else if (tk.kind === 'rparen' || tk.kind === 'rbrace' || tk.kind === 'rbracket') {
+          // SARD_80_F1 W3.x — an unbalanced closer (depth already 0) closes
+          // an ENCLOSING construct we didn't open (e.g. this `return` sits
+          // inside a `using (...)`/`if (...)` clause with no `;` of its
+          // own before the surrounding `)`), not part of our own
+          // expression — stop here rather than scanning past it into
+          // whatever follows. See the identical fix on the decl/assign/
+          // field loops below for the full incident writeup.
+          if (depth === 0) break;
+          depth--;
+        }
+        j++;
+      }
+      const exprTokens = tokens.slice(i + 1, j);
+      if (exprTokens.length) {
+        out.returns.push({ line: t.line, exprTokens, exprText: tokenText(exprTokens) });
+      }
+      // Deliberately do NOT skip past the expression tokens (`i = j`): the
+      // main loop's own ident/call/assignment branches below still need to
+      // walk them, so a statement-level call inside the return
+      // (`return string.Format(...)`) is still recorded in `out.calls`
+      // exactly as it was before this branch existed.
+      continue;
+    }
     // new Type(args)
     if (t.kind === 'kw' && t.value === 'new') {
       const tr = readType(tokens, i + 1);
@@ -301,8 +344,27 @@ function walkMethodBody(method) {
           let j = tr.next + 2;
           let depth = 0;
           while (j < tokens.length && (depth > 0 || tokens[j].kind !== 'semi')) {
-            if (tokens[j].kind === 'lparen' || tokens[j].kind === 'lbrace' || tokens[j].kind === 'lbracket') depth++;
-            if (tokens[j].kind === 'rparen' || tokens[j].kind === 'rbrace' || tokens[j].kind === 'rbracket') depth--;
+            const tk = tokens[j];
+            if (tk.kind === 'lparen' || tk.kind === 'lbrace' || tk.kind === 'lbracket') depth++;
+            else if (tk.kind === 'rparen' || tk.kind === 'rbrace' || tk.kind === 'rbracket') {
+              // SARD_80_F1 W3.x — a declaration with no `;` of its own,
+              // sitting inside an enclosing `using (Type x = expr)` / `for
+              // (Type x = expr; …)` clause: the FIRST `)` we see here is
+              // that outer construct's own close, not one WE opened (depth
+              // is already 0), so stop before consuming it. Previously this
+              // fell through to `depth--` unconditionally, going negative
+              // and then scanning straight through into the following
+              // block body looking for a `;` that could be arbitrarily far
+              // away — corrupting this decl's rhsText with everything up to
+              // that stray semicolon AND silently absorbing whatever real
+              // statement lived in between (found via SARD_80_F1 W4.C14:
+              // `using (StreamReader sr = new StreamReader("f")) { data =
+              // sr.ReadLine(); }` swallowed the `data = sr.ReadLine()`
+              // assignment into `sr`'s own rhsText, deleting it from
+              // `out.assignments` entirely).
+              if (depth === 0) break;
+              depth--;
+            }
             j++;
           }
           const rhs = tokens.slice(tr.next + 2, j);
@@ -329,12 +391,31 @@ function walkMethodBody(method) {
         targetParts.push(tokens[j + 1].value);
         j += 2;
       }
-      if (tokens[j] && tokens[j].kind === 'op' && tokens[j].value === '=') {
+      // SARD_80_F1 W4.C11 — compound assignment (`+=`, `-=`, …) was
+      // previously invisible here (only bare `=` matched), so a statement
+      // like `cmd.CommandText += "..." + tainted + "...";` — Juliet's own
+      // universal convention for building CommandText — produced NO
+      // assignment record at all, silently dropping it from this
+      // detector's taint model. This model (`analyzeMethodFlow`, see
+      // csharp-analysis.js) has no un-taint step — a taintMap entry is
+      // only ever set true, never cleared — so treating the compound RHS
+      // exactly like a plain assign's RHS is already correct: if the
+      // target was tainted before, that status is never touched (no
+      // clearing branch exists); if this RHS is tainted, it becomes
+      // tainted now, same as a `+=` should.
+      if (tokens[j] && tokens[j].kind === 'op' &&
+          (tokens[j].value === '=' || CS_COMPOUND_ASSIGN_OPS.has(tokens[j].value))) {
         let k = j + 1;
         let depth = 0;
         while (k < tokens.length && (depth > 0 || tokens[k].kind !== 'semi')) {
-          if (tokens[k].kind === 'lparen' || tokens[k].kind === 'lbrace' || tokens[k].kind === 'lbracket') depth++;
-          if (tokens[k].kind === 'rparen' || tokens[k].kind === 'rbrace' || tokens[k].kind === 'rbracket') depth--;
+          const tk = tokens[k];
+          if (tk.kind === 'lparen' || tk.kind === 'lbrace' || tk.kind === 'lbracket') depth++;
+          else if (tk.kind === 'rparen' || tk.kind === 'rbrace' || tk.kind === 'rbracket') {
+            // SARD_80_F1 W3.x — see the decl "typed init" loop above for the
+            // full incident writeup; same enclosing-construct boundary fix.
+            if (depth === 0) break;
+            depth--;
+          }
           k++;
         }
         const rhs = tokens.slice(j + 1, k);
@@ -419,6 +500,7 @@ function walkMethodBody(method) {
   method.ctors = out.ctors;
   method.assignments = out.assignments;
   method.decls = out.decls;
+  method.returns = out.returns;
   method.strings = out.strings;
   return out;
 }
@@ -555,8 +637,15 @@ export function buildCSharpIR(source) {
             if (tokens[f] && tokens[f].kind === 'op' && tokens[f].value === '=') {
               let fj = f + 1, depth = 0;
               while (fj < tokens.length && (depth > 0 || tokens[fj].kind !== 'semi')) {
-                if (tokens[fj].kind === 'lparen' || tokens[fj].kind === 'lbrace' || tokens[fj].kind === 'lbracket') depth++;
-                if (tokens[fj].kind === 'rparen' || tokens[fj].kind === 'rbrace' || tokens[fj].kind === 'rbracket') depth--;
+                const tk = tokens[fj];
+                if (tk.kind === 'lparen' || tk.kind === 'lbrace' || tk.kind === 'lbracket') depth++;
+                else if (tk.kind === 'rparen' || tk.kind === 'rbrace' || tk.kind === 'rbracket') {
+                  // SARD_80_F1 W3.x — see the decl "typed init" loop's
+                  // header comment for the full incident writeup; same
+                  // enclosing-construct boundary fix.
+                  if (depth === 0) break;
+                  depth--;
+                }
                 fj++;
               }
               ir.decls.push({ name: tokens[tr.next].value, type: tr.type, rhsTokens: tokens.slice(f + 1, fj), rhsText: tokenText(tokens.slice(f + 1, fj)), line: tk.line, isVar: false, isField: true });

package/src/ir/index.js

@@ -18,7 +18,9 @@ import {
 import { parseJavaFile } from './parser-java.js';
 import { parseGoFile } from './parser-go.js';
 import { parsePhpFile } from './parser-php.js';
+import { mergePhpIncludes } from './php-include-merge.js';
 import { parseRubyFile } from './parser-rb.js';
+import { parseRustFile } from './parser-rust.js';
 import { parseCppFile, cppExtRe } from './parser-cpp.js';
 import { buildCallGraph } from './callgraph.js';
 import { buildClassHierarchy } from './class-hierarchy.js';
@@ -164,6 +166,9 @@ export function buildProjectIR(fileContents) {
       } else if (/\.rb$/i.test(file)) {
         const ir = parseRubyFile(file, code);
         if (ir) perFile[file] = ir;
+      } else if (/\.rs$/i.test(file)) {
+        const ir = parseRustFile(file, code);
+        if (ir) perFile[file] = ir;
       } else if (cppExtRe().test(file)) {
         const ir = parseCppFile(file, code);
         if (ir) perFile[file] = ir;
@@ -175,6 +180,12 @@ export function buildProjectIR(fileContents) {
       if (ir && ir.file) perFile[ir.file] = ir;
     }
   }
+  // SARD_80_F1 W5.7 — merge PHP include/require targets' top-level
+  // assignments into the includer's own scope before anything else touches
+  // the CFGs (SSA numbering included), since PHP's `include` genuinely
+  // executes in the caller's variable namespace. See php-include-merge.js's
+  // module header for the full rationale and scope.
+  try { mergePhpIncludes(perFile); } catch {}
   if (isSSAEnabled()) {
     for (const ir of Object.values(perFile)) {
       for (const fn of (ir.functions || [])) {
@@ -226,6 +237,9 @@ export async function buildProjectIRAsync(fileContents) {
       } else if (/\.rb$/i.test(file)) {
         const ir = parseRubyFile(file, code);
         if (ir) perFile[file] = ir;
+      } else if (/\.rs$/i.test(file)) {
+        const ir = parseRustFile(file, code);
+        if (ir) perFile[file] = ir;
       } else if (cppExtRe().test(file)) {
         const ir = parseCppFile(file, code);
         if (ir) perFile[file] = ir;
@@ -237,6 +251,12 @@ export async function buildProjectIRAsync(fileContents) {
       if (ir && ir.file) perFile[ir.file] = ir;
     }
   }
+  // SARD_80_F1 W5.7 — merge PHP include/require targets' top-level
+  // assignments into the includer's own scope before anything else touches
+  // the CFGs (SSA numbering included), since PHP's `include` genuinely
+  // executes in the caller's variable namespace. See php-include-merge.js's
+  // module header for the full rationale and scope.
+  try { mergePhpIncludes(perFile); } catch {}
   if (isSSAEnabled()) {
     for (const ir of Object.values(perFile)) {
       for (const fn of (ir.functions || [])) {
@@ -269,4 +289,4 @@ export function parsePythonFile(file, code) {
   return parsePythonFileRegex(file, code);
 }
 
-export { parseJsFile, parseJavaFile, parseCSharpFile, parseKotlinFile, parseGoFile, parsePhpFile, parseRubyFile, parseCppFile, buildCallGraph, buildClassHierarchy, computeSSA, isSSAEnabled, probePythonAvailable, pythonParserDegradation, resetPythonParserDegradation };
+export { parseJsFile, parseJavaFile, parseCSharpFile, parseKotlinFile, parseGoFile, parsePhpFile, parseRubyFile, parseRustFile, parseCppFile, buildCallGraph, buildClassHierarchy, computeSSA, isSSAEnabled, probePythonAvailable, pythonParserDegradation, resetPythonParserDegradation };