@clear-capabilities/agentic-security-scanner 0.152.0 → 0.153.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-bead9ace9ed7ff90f2651e838dd0ead1f160e03da759d994a44b8ea46df23740  agentic-security.mjs
+1e727ef20f7fd2c897af4598b51db75771cc0b75e07dd00a30bd840d34736b10  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.152.0",
+  "version": "0.153.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -48,7 +48,8 @@
   },
   "optionalDependencies": {
     "tree-sitter-wasms": "0.1.13",
-    "web-tree-sitter": "0.20.8"
+    "web-tree-sitter": "0.20.8",
+    "z3-solver": "^5.2.0"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",
@@ -70,7 +71,7 @@
     "test:glob": "node --test test/glob-compat.test.js",
     "test:sast": "node --test test/cpp-hardcoded-secret.test.js test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/csharp-cross-file.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/java-structural-cross-file.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/java-ast-folding.test.js test/java-bench-extras.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js test/secrets-coverage.test.js test/prompt-injection-payloads.test.js test/iac-cloud-templates.test.js test/ruby-path-join.test.js test/sast/manifest-line-tracking.test.js test/rust-sast.test.js test/java-deserialization-precision.test.js",
     "test:posture": "node --test test/threat-model.test.js test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/release-workflow.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/ollama-provider.test.js test/ollama-capabilities.test.js test/ollama-offline-egress.test.js test/ollama-fix-proposal.test.js test/ollama-explain-proposal.test.js test/ollama-poc-proposal.test.js test/ollama-model-probe.test.js test/ollama-agent-tools.test.js test/ollama-agent-loop.test.js test/ollama-e2e.test.js test/ollama-oom-feedback.test.js test/ollama-doc-drift.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/module-artifact-liveness.test.js test/supply-chain-provenance-completeness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/models.test.js test/cli/setup-llm.test.js test/cli/fix-retry.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js",
-    "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-rust.test.js test/rust-taint-flow.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js test/sard-leakage-pipeline.test.js test/sard-split-scoring.test.js test/sard-llm-isolation.test.js test/sard-mutation-adversarial.test.js test/sard-baseline-adaptive-tolerance.test.js test/sard-independent-holdout.test.js test/sard-flow-aware-scoring.test.js test/sard-macro-score-support-floor.test.js test/sard-php-split.test.js test/parser-java-nary-concat.test.js test/sard-naive-baseline.test.js test/field-taint-cross-method.test.js test/field-taint-engine-unit.test.js test/coercion-sanitizer-kill.test.js test/constant-propagation-path-sensitivity.test.js test/parser-java-assignments.test.js test/catalog-java-sard.test.js test/parser-cs-juliet-shapes.test.js test/catalog-cs-sard-p2.test.js test/sard-cwe-key-merge.test.js test/parser-php-backtick.test.js test/parser-php-include.test.js test/php-include-merge.test.js test/parser-php-array-field-taint.test.js test/parser-php-cond-assign.test.js test/parser-rust-redos.test.js test/multi-sink-taint-chain.test.js test/static-field-cross-class-call-string.test.js test/regex-guard-narrowing.test.js test/object-instance-field-taint.test.js",
+    "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-rust.test.js test/rust-taint-flow.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js test/sard-leakage-pipeline.test.js test/sard-split-scoring.test.js test/sard-llm-isolation.test.js test/sard-mutation-adversarial.test.js test/sard-baseline-adaptive-tolerance.test.js test/sard-independent-holdout.test.js test/sard-flow-aware-scoring.test.js test/sard-macro-score-support-floor.test.js test/sard-php-split.test.js test/parser-java-nary-concat.test.js test/sard-naive-baseline.test.js test/field-taint-cross-method.test.js test/field-taint-engine-unit.test.js test/coercion-sanitizer-kill.test.js test/constant-propagation-path-sensitivity.test.js test/parser-java-assignments.test.js test/catalog-java-sard.test.js test/parser-cs-juliet-shapes.test.js test/catalog-cs-sard-p2.test.js test/sard-cwe-key-merge.test.js test/parser-php-backtick.test.js test/parser-php-include.test.js test/php-include-merge.test.js test/parser-php-array-field-taint.test.js test/parser-php-cond-assign.test.js test/parser-rust-redos.test.js test/multi-sink-taint-chain.test.js test/static-field-cross-class-call-string.test.js test/regex-guard-narrowing.test.js test/object-instance-field-taint.test.js test/param-type-inference.test.js test/smt-path-feasibility.test.js test/cross-service-taint.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js test/mcp-dataflow-tools.test.js test/cli/governance-propose-edit.test.js test/cli/remediation-open-update.test.js test/cli/remediation-verify-reopen.test.js test/cli/dataflow-observations.test.js test/cli/federate-declare-list.test.js",
     "test:report": "node --test test/report-scan-invariants.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/scan-health.test.js test/finding-schema.test.js test/pipeline/finding-schema-provenance.test.js test/evidence-provenance.test.js test/report/provenance-output.test.js test/report/provenance-format-parity.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",
     "test:lineage": "node --test test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js",

package/src/dataflow/backward.js

@@ -29,6 +29,9 @@
 // callers (BFS-bounded) to keep the slicer fast.
 
 import { accessPathOf, pathIsCoveredByPrefix } from './access-paths.js';
+import { matchSinkOrSanitizer } from './catalog.js';
+import { safeSanitizerOutputRegex as _safeSanitizerOutputRegex } from './string-domain.js';
+import { _collectExprVars } from './engine.js';
 
 const SLICE_BUDGET_NODES = 200;
 const SLICE_BUDGET_CALLERS = 5;
@@ -55,10 +58,20 @@ function _reverseEdges(cfg) {
  *
  * Returns an ordered list of trace steps (source-first):
  *   [
- *     { line, kind: 'source', label, varName, path },
- *     { line, kind: 'assign', from, to, path },
- *     { line, kind: 'call',   callee, argPath, path },
- *     { line, kind: 'sink',   callee, argIndex, path },
+ *     { line, kind: 'source',   label, varName, path },
+ *     { line, kind: 'assign',   from, to, path },
+ *     { line, kind: 'sanitize', callee, sanitizerId, path },  // a RECOGNIZED
+ *                                                              // catalog sanitizer
+ *                                                              // applied on the path
+ *     { line, kind: 'call',     callee, sanitizerId: null, path },  // any OTHER
+ *                                                                    // call — best-effort
+ *                                                                    // continuity only;
+ *                                                                    // a sound consumer
+ *                                                                    // (e.g. the SMT
+ *                                                                    // encoder) must NOT
+ *                                                                    // treat this as a
+ *                                                                    // known transform
+ *     { line, kind: 'sink',     callee, argIndex, path },
  *   ]
  */
 export function sliceBackward(fn, sinkNode, sinkArgPath) {
@@ -127,6 +140,63 @@ export function sliceBackward(fn, sinkNode, sinkArgPath) {
         }
         // Otherwise, follow the def of the new query path upstream.
         work.push({ nid, queryPath: srcAp });
+      } else if (node.source && node.source.kind === 'call') {
+        // Next-gen taint capability #5 (SMT path feasibility rebuild):
+        // `accessPathOf` returns null for a CALL expression by design (it
+        // only handles pure ident/member chains), so `const clean =
+        // sanitize(x); sink(clean);` — arguably the single most common
+        // real-world sanitizer idiom — previously dead-ended the slice
+        // right here with no 'source' step ever appended: `srcAp` is null,
+        // so neither branch above fires, and the bare "walk predecessors
+        // regardless" loop below can only ever find a DIFFERENT def of the
+        // SAME queryPath, never continue into the call's own argument.
+        // Fixed by treating a call-shaped RHS as a real, tracked step: a
+        // recognized CATALOG SANITIZER gets its own 'sanitize' kind (the
+        // SMT encoder below trusts ONLY this shape, via the sanitizer's
+        // proven output-regex, to constrain a value); anything else gets a
+        // generic 'call' kind, for explainability continuity only — the
+        // SMT encoder must refuse to build a sound proof across an opaque
+        // call it cannot reason about, never treat it as either a
+        // transparent passthrough or an implicit sanitizer. Deliberately
+        // single-argument, intraprocedural only, matching this whole
+        // module's own documented v1 scope: continues into the FIRST
+        // argument carrying a resolvable access path, not every argument
+        // (a sanitizer/helper's OTHER arguments are typically
+        // configuration, e.g. `escape(x, {mode: 'html'})`, not additional
+        // taint sources).
+        const callee = node.source.callee;
+        const args = Array.isArray(node.source.args) ? node.source.args : [];
+        let argPath = null;
+        for (const a of args) { const p = accessPathOf(a); if (p) { argPath = p; break; } }
+        const hits = matchSinkOrSanitizer(callee, fn.file);
+        const sanitizerHit = Array.isArray(hits) ? hits.find(h => h.kind === 'sanitizer') : null;
+        const calleeName = typeof callee === 'string' ? callee
+          : callee && callee.kind === 'ident' ? callee.name
+          : callee && callee.kind === 'member' && typeof callee.prop === 'string' ? callee.prop
+          : null;
+        // `outputRegexSource` is a SEPARATE, narrower signal than
+        // `sanitizerId` above: the broad 706-entry catalog match is fine
+        // for EXPLAINABILITY (labelling a step "this looks like a
+        // sanitizer call" for a human reading the trace), but it matches
+        // by bare callee NAME — a project-local function that merely
+        // happens to be named the same as a cataloged sanitizer (e.g. a
+        // local `sanitize()` helper that does something unrelated) would
+        // match it too. A soundness-critical consumer (the SMT
+        // infeasibility check) must never treat that broad match as
+        // license to assume a specific, provable output shape — only
+        // `safeSanitizerOutputRegex`'s own small, hand-vetted set of
+        // unambiguous global builtins earns that trust.
+        const outputRegexSource = calleeName ? _safeSanitizerOutputRegex(calleeName) : null;
+        out.push({
+          line: node.line || 0,
+          kind: sanitizerHit ? 'sanitize' : 'call',
+          callee: calleeName,
+          sanitizerId: sanitizerHit ? sanitizerHit.id : null,
+          outputRegexSource: outputRegexSource ? outputRegexSource.source : null,
+          outputRegexFlags: outputRegexSource ? outputRegexSource.flags : null,
+          path: queryPath,
+        });
+        if (argPath) work.push({ nid, queryPath: argPath });
       }
     }
 
@@ -178,9 +248,36 @@ export function annotateBackwardSlices(findings, perFileIR, callGraph) {
     }
     if (!sinkNode) { skipped++; continue; }
     // The tainted arg path — derive from the tainted argument's expression.
-    const taintedArg = (sinkNode.args || [])[f.argIndex];
-    const argPath = accessPathOf(taintedArg) || `arg[${f.argIndex}]`;
-    const slice = sliceBackward(fn, sinkNode, argPath);
+    // `f.argIndex` can be a real number, the string 'all' (any arg tainted —
+    // no single index to point at) or 'rhs' (a member-write sink) — only a
+    // plain numeric index names one real argument to slice from.
+    const argExprs = sinkNode.args || [];
+    const taintedArg = typeof f.argIndex === 'number' ? argExprs[f.argIndex] : undefined;
+    let argPath = accessPathOf(taintedArg);
+    let slice = argPath ? sliceBackward(fn, sinkNode, argPath) : null;
+    // Next-gen taint capability #5 (SMT path-feasibility rebuild):
+    // `accessPathOf` only ever succeeds for a BARE ident/member chain — the
+    // single most common real shape, a sink argument built by string
+    // concatenation (`'SELECT ...' + id`, a template literal, string.format
+    // args, …), is a `binary`/`tpl`/`call` expression, so `accessPathOf`
+    // returns null and the slice used to fall back to the unmatchable
+    // placeholder string `arg[${f.argIndex}]` — no real variable is ever
+    // named that, so `sliceBackward` could only ever return the bare sink
+    // node, structurally regardless of AGENTIC_SECURITY_BACKWARD_SLICE.
+    // Fixed by extracting every free variable/access-path referenced
+    // ANYWHERE in the tainted argument expression (the same tree-walker
+    // `engine.js`'s own `_sourcesReachingExpr` uses to attribute a finding
+    // to its real source) and trying each one in turn, keeping the first
+    // that yields a genuine (more-than-just-the-sink) slice.
+    if ((!slice || slice.length <= 1) && taintedArg) {
+      const vars = new Set();
+      _collectExprVars(taintedArg, vars);
+      for (const candidate of vars) {
+        const candidateSlice = sliceBackward(fn, sinkNode, candidate);
+        if (candidateSlice && candidateSlice.length > 1) { slice = candidateSlice; break; }
+        if (!slice) slice = candidateSlice;
+      }
+    }
     if (slice && slice.length) {
       f.backwardSlice = slice;
       f.pathSteps = (f.pathSteps || []).concat(slice.map(s => ({

package/src/dataflow/cross-service-taint.js

@@ -39,6 +39,24 @@
 // either a monorepo or a federated-scan API. We DO emit cross-service
 // findings when the local service is on the receiving end of an edge,
 // based on the declared upstream taint contract.
+//
+// SCOPE NOTE (next-gen taint capability #7 rebuild): step 1 of the
+// algorithm above ("mark every consume entry-point as tainted-by-default")
+// is NOT implemented anywhere in this file, or anywhere else in the
+// engine — there is no mechanism that seeds a NEW taint source from a
+// `consumes` declaration (e.g. marking a Kafka consumer callback's
+// message parameter as tainted). This module only ANNOTATES findings the
+// taint engine already discovers via its own normal source catalog
+// (`catalog.js`) with cross-service context; it never makes a
+// previously-invisible flow visible. In practice this means an HTTP
+// edge benefits fully (HTTP request sources — body/query/header/cookie —
+// are extensively cataloged already), while a Kafka/queue edge benefits
+// only when the consumed payload happens to ALSO reach an already-
+// cataloged source through some other path — which is rare, since raw
+// message-queue payloads have no catalog entry of their own. Seeding new
+// sources from `consumes` declarations would be a genuinely separate,
+// larger capability; left as a deliberate, documented boundary here
+// rather than attempted in this rebuild.
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -116,6 +134,52 @@ export function incomingEdges(graph, currentService) {
   return (graph.edges || []).filter(e => e.to === currentService.name);
 }
 
+/**
+ * Split a URL path into its non-empty segments, e.g. "/balances/:id" ->
+ * ["balances", ":id"].
+ */
+function _pathSegments(p) {
+  return String(p || '').split('/').filter(Boolean);
+}
+
+/**
+ * True when a path segment is a parameter placeholder, in EITHER of the
+ * two conventions this file's own schema comment documents:
+ * Express/Koa-style `:userId` or template-style `{userId}`.
+ */
+function _isWildcardSegment(seg) {
+  return /^:.+$/.test(seg) || /^\{[^}]+\}$/.test(seg);
+}
+
+/**
+ * Structural path-template match between an `exposes[].route` entry
+ * (e.g. "GET /balances/:userId") and an `edges[].path` entry (e.g.
+ * "/balances/{userId}").
+ *
+ * The previous implementation did `expose.route.includes(edge.path)` — a
+ * crude substring check. This file's OWN header comment documents the
+ * two sides using DIFFERENT placeholder syntaxes (`:userId` vs
+ * `{userId}`), so that substring check could never succeed on the
+ * example it was written to describe — confirmed by direct reproduction
+ * against that exact example, which returned zero contracts. Fixed by
+ * comparing SEGMENT-BY-SEGMENT: a literal segment must match exactly, a
+ * placeholder segment on EITHER side matches any segment on the other
+ * (since we don't know the upstream's real parameter name convention
+ * without parsing it, and the security question — "does an edge exist
+ * pointing at this exact path shape" — doesn't depend on knowing it).
+ * The route's leading HTTP method token (if present) is stripped before
+ * comparing; method itself is not matched (this schema has no per-edge
+ * method field), matching the pre-existing, unaudited behavior.
+ */
+function _pathTemplateMatches(exposeRoute, edgePath) {
+  if (!exposeRoute || !edgePath) return false;
+  const routePath = String(exposeRoute).replace(/^[A-Z]+\s+/, '');
+  const a = _pathSegments(routePath);
+  const b = _pathSegments(String(edgePath).split('?')[0]);
+  if (a.length !== b.length) return false;
+  return a.every((seg, i) => seg === b[i] || _isWildcardSegment(seg) || _isWildcardSegment(b[i]));
+}
+
 /**
  * For each consume entry on the current service, locate the upstream
  * `exposes` entry that produces it (matched by path/topic) and return
@@ -131,7 +195,7 @@ export function upstreamTaintContract(graph, currentService) {
       const upstream = graph.services[edge.from];
       if (!upstream) continue;
       for (const expose of upstream.exposes || []) {
-        const matches = (edge.via === 'http' && edge.path && expose.route && expose.route.includes(edge.path.split('?')[0]))
+        const matches = (edge.via === 'http' && edge.path && expose.route && _pathTemplateMatches(expose.route, edge.path))
                      || (edge.via === 'kafka' && edge.topic && consume.source === edge.topic);
         if (matches) {
           contracts.push({
@@ -148,10 +212,82 @@ export function upstreamTaintContract(graph, currentService) {
   return contracts;
 }
 
+// Escapes every regex metacharacter in a literal field name before it is
+// embedded in a `\b...\b` pattern. The previous version only replaced the
+// FIRST `.` (`field.replace('.', '\\.')`, no `/g` flag) — any OTHER dot in
+// a multi-segment field name (e.g. "a.b.c") was left as a live regex
+// metacharacter matching any character, silently over-broadening the
+// match. Fixed generally, for every metacharacter, not just repeated dots.
+function _escapeRegex(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+// Provenance values (catalog.js's per-source `provenance` field, e.g.
+// 'http-body' for req.body) that mean "this value arrived over an
+// incoming HTTP request" — the signal used to correlate a finding with a
+// declared `via: 'http'` cross-service edge.
+const HTTP_PROVENANCE = new Set(['http-body', 'url-param', 'path-param', 'header', 'cookie']);
+
+// Every provenance value attached anywhere on a finding: the primary
+// source (`f.sourceProvenance`) plus every step in its source chain
+// (`f.chain[].provenance`) — a finding can have more than one source
+// reaching the sink, and any one of them may be the HTTP-originated one.
+function _findingProvenances(f) {
+  const provs = new Set();
+  if (f && f.sourceProvenance) provs.add(f.sourceProvenance);
+  if (f && Array.isArray(f.chain)) {
+    for (const c of f.chain) { if (c && c.provenance) provs.add(c.provenance); }
+  }
+  return provs;
+}
+
+// Every textual source LABEL attached anywhere on a finding (the catalog
+// entry's own fixed label, e.g. "req.body" — never the specific accessed
+// property, which the engine does not retain on the finding today). Used
+// only as a best-effort fallback for non-HTTP transports (Kafka/queue),
+// where there is no provenance category to correlate against at all.
+function _findingSourceText(f) {
+  const parts = [];
+  if (f && f.source && f.source.label) parts.push(f.source.label);
+  if (f && Array.isArray(f.chain)) {
+    for (const c of f.chain) { if (c && c.label) parts.push(c.label); }
+  }
+  return parts.join(' ');
+}
+
 /**
  * Annotate findings whose source matches a cross-service taint contract.
- * Adds `crossService: { from, via, path, taintedFields }` and bumps
- * severity by one tier (medium → high, high → critical).
+ * Adds `crossService: { from, to, via, taintedFields, matchedField,
+ * precision }` and bumps severity by one tier (medium → high, high →
+ * critical).
+ *
+ * The previous implementation matched a contract's declared field NAMES
+ * as literal text against `f.source.snippet`/`f.source.expr` — fields
+ * that confirmed direct code reading never exist on a real finding (the
+ * real shape, set in `engine.js`, is `f.source = {file, line, label}`).
+ * That made this function a structural no-op for every real taint-engine
+ * finding, verified via a direct `runScan()` reproduction of the exact
+ * scenario this file's own header describes.
+ *
+ * Fixed with two correlation strategies, chosen by transport, since a
+ * real finding never carries the SPECIFIC field name that reached the
+ * sink (only the catalog source's fixed label, e.g. "req.body" — see
+ * `_findingSourceText`'s own comment):
+ *   - `via: 'http'`: correlate by PROVENANCE — an HTTP request source is
+ *     already reliably categorized by the catalog (`http-body`,
+ *     `url-param`, `header`, `cookie`, …), so this is a real, sound
+ *     signal rather than a text-match guess. `matchedField` is left null
+ *     and `precision: 'transport'` records honestly that the match is at
+ *     the endpoint level, not a specific declared field — the security
+ *     conclusion (this value arrived across a declared trust boundary)
+ *     holds regardless of which exact field it was.
+ *   - every other transport (Kafka/queue): no provenance category exists
+ *     for a raw message payload (per this file's own SCOPE NOTE), so the
+ *     best available signal is literal field-name text matching against
+ *     whatever source labels the finding does carry — kept as a
+ *     best-effort fallback, `precision: 'field'` when it hits, but this
+ *     will rarely fire until source-seeding from `consumes` declarations
+ *     exists (documented as a separate, not-yet-attempted capability).
  */
 export function annotateCrossServiceFindings(findings, graph, currentService) {
   if (!Array.isArray(findings) || !graph || !currentService) return { annotated: 0, bumped: 0 };
@@ -159,18 +295,25 @@ export function annotateCrossServiceFindings(findings, graph, currentService) {
   if (!contracts.length) return { annotated: 0, bumped: 0 };
   let annotated = 0, bumped = 0;
   for (const f of findings) {
-    const sourceExpr = (f.source && (f.source.snippet || f.source.expr)) || f.snippet || '';
     for (const contract of contracts) {
-      const matches = contract.taintedFields.some(field => {
-        const pat = new RegExp(`\\b${field.replace('.', '\\.')}\\b`);
-        return pat.test(sourceExpr);
-      });
-      if (!matches) continue;
+      let matchedField = null;
+      let matched = false;
+      if (contract.via === 'http') {
+        const provs = _findingProvenances(f);
+        matched = [...provs].some(p => HTTP_PROVENANCE.has(p));
+      } else {
+        const text = _findingSourceText(f);
+        matchedField = contract.taintedFields.find(field => new RegExp(`\\b${_escapeRegex(field)}\\b`).test(text)) || null;
+        matched = !!matchedField;
+      }
+      if (!matched) continue;
       f.crossService = {
         from: contract.upstreamService,
         to: currentService.name,
         via: contract.via,
-        taintedField: contract.taintedFields.find(field => new RegExp(`\\b${field.replace('.', '\\.')}\\b`).test(sourceExpr)),
+        taintedFields: contract.taintedFields,
+        matchedField,
+        precision: matchedField ? 'field' : 'transport',
       };
       annotated++;
       // Severity bump.
@@ -199,4 +342,4 @@ export function runCrossServiceTaint(scanRoot, findings) {
   return annotateCrossServiceFindings(findings, graph, current);
 }
 
-export const _internals = { _normalizeGraph, SERVICES_FILE_NAMES };
+export const _internals = { _normalizeGraph, SERVICES_FILE_NAMES, _pathTemplateMatches, _escapeRegex };

package/src/dataflow/engine.js

@@ -547,7 +547,15 @@ function exprTaint(expr, state, callContext) {
 // Collects the variable / access-path roots referenced by `expr` and returns
 // the _taintSources entries whose varName matches one of those roots. This
 // replaces "first source we ever saw" with "sources tied to this argument."
-function _collectExprVars(expr, out) {
+// Exported (next-gen taint capability #5, SMT path-feasibility rebuild) so
+// backward.js's `annotateBackwardSlices` can reuse the SAME free-variable
+// extraction for a COMPOUND tainted-sink-argument expression (`'SELECT...'
+// + id`, not a bare identifier) — `accessPathOf` alone returns null for
+// anything but a pure ident/member chain, which previously made
+// `annotateBackwardSlices` fall back to an unmatchable placeholder string
+// for the overwhelmingly common "string-concatenation into a sink" shape,
+// silently degrading the backward slice to just the bare sink node.
+export function _collectExprVars(expr, out) {
   if (!expr) return;
   if (typeof expr === 'string') { out.add(expr); return; }
   if (expr.kind === 'ident' && expr.name) { out.add(expr.name); return; }
@@ -2602,6 +2610,20 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
         // backward-slice annotation was permanently a no-op regardless of
         // AGENTIC_SECURITY_BACKWARD_SLICE.
         ...(f._funcQid ? { _funcQid: f._funcQid } : {}),
+        // argIndex: which sink argument is the tainted one (a number, or the
+        // literal 'all'/'rhs') — set upstream at the finding's creation site
+        // but, exactly like `_funcQid`/`callee` above, silently dropped by
+        // this same allowlist before backward.js's `annotateBackwardSlices`
+        // ever saw it. Without it, `annotateBackwardSlices` falls back to
+        // the placeholder string `arg[undefined]` for EVERY finding (it can
+        // never be a real access path, since no source ever names a
+        // variable that literally), so `sliceBackward` always started and
+        // ended at the bare sink node with no source/sanitize steps at all
+        // — the backward-slice pass was a structural no-op for real findings
+        // regardless of AGENTIC_SECURITY_BACKWARD_SLICE, discovered while
+        // rebuilding the SMT path-feasibility mechanism (next-gen taint
+        // capability #5) to depend on a REAL slice for a sound proof.
+        ...(f.argIndex !== undefined ? { argIndex: f.argIndex } : {}),
         // callee: kept as plain `callee` (not underscore-prefixed) to match
         // backward.js's own contract, which reads `f.callee` on both real and
         // fake-fixture findings throughout its module and test suite. It is