@clear-capabilities/agentic-security-scanner 0.152.0 → 0.153.1

package/src/dataflow/exploit-prover.js

@@ -22,7 +22,7 @@
 //
 // We do NOT attempt to prove ARBITRARY satisfiability — the v2 use case.
 
-import { provablyMatches } from './string-domain.js';
+import { provablyMatches, safeSanitizerOutputRegex } from './string-domain.js';
 
 // CWE → canonical exploit input. Conservative payloads safe to display.
 const EXPLOIT_INPUTS = {
@@ -62,6 +62,31 @@ const FAMILY_METACHARS = {
 
 // Try to load z3-solver. Returns null if not installed — that's the common
 // case (we don't bundle the WASM blob).
+//
+// SCOPE NOTE (next-gen taint capability #5 rebuild): loading z3-solver here
+// is real — it is a genuine `optionalDependencies` entry in package.json,
+// and `_maybeLoadZ3` performs a real dynamic `import()`, verified against
+// an actual installed copy. What it does NOT yet do is discharge any query
+// TO Z3: `proveExploits` below still routes every feasibility verdict
+// through `smtLiteInfeasibilityCheck`'s JS-native regex check regardless of
+// whether z3 loaded; a present z3 module only labels `_exploitInputSource`
+// on the FEASIBLE branch. Making Z3 do real work here would mean
+// translating each sanitizer's `outputRegexSource` (a JS RegExp source —
+// anchors, character classes, quantifiers, alternation, optional groups;
+// see `string-domain.js`'s `SANITIZER_OUTPUT_REGEX`) into Z3's own
+// string/regex theory and asking it "does any string matching this pattern
+// also contain this metacharacter?" That translator is a real, standalone
+// undertaking, and a translation bug in it is uniquely dangerous for this
+// specific mechanism: it would manufacture a false `feasible: false`
+// (a false safety proof) rather than merely a missed detection. The
+// existing JS-native check (`_backwardSliceExcludesMetachars`) is already
+// SOUND for every regex currently in the hand-vetted catalog (all of them
+// are anchored, closed-under-repetition character classes or fixed-format
+// literals — verified by direct reading of `SANITIZER_OUTPUT_REGEX`), so
+// there is no live soundness gap this would close today. Left as a
+// deliberate, documented boundary rather than an oversight: build the
+// translator as its own reviewed capability if/when the sanitizer catalog
+// grows regex shapes the JS probe can no longer safely reason about.
 let _z3 = null;
 let _z3Loaded = false;
 async function _maybeLoadZ3() {
@@ -90,20 +115,30 @@ export function smtLiteInfeasibilityCheck(finding) {
   if (!metacharsNeeded || metacharsNeeded.length === 0) {
     return { feasible: 'unknown', reason: 'no-metachar-model' };
   }
-  // Walk the trace/chain for sanitizer regex constraints. The `string-domain`
-  // produces a regex abstract value when known sanitizers are on the path;
-  // the soft-taint table independently labels sanitizers. For v1 we check
-  // the chain entries against the known sanitizer-output regexes.
+  // Next-gen taint capability #5 (SMT path-feasibility rebuild): prefer
+  // `finding.backwardSlice` (backward.js's REAL, ordered source-to-sink
+  // path, opt-in via AGENTIC_SECURITY_BACKWARD_SLICE=1) over the
+  // trace/chain fallback below. Confirmed live, during this rebuild, that
+  // `finding.trace`/`finding.chain` are NOT a sequential path at all — they
+  // are the list of SOURCES reaching the sink (see dataflow/engine.js's own
+  // `_sourcesReachingExpr`), so a `.callee` never actually names a
+  // sanitizer in real production data; this function's own pre-rebuild
+  // unit tests only ever exercised a HAND-FABRICATED `chain` shape
+  // (`[{callee: 'htmlspecialchars'}]`) that the real engine never produces.
+  const slicePath = _backwardSliceExcludesMetachars(finding.backwardSlice, metacharsNeeded);
+  if (slicePath) return slicePath;
+  // Fallback for callers that never ran the (opt-in) backward-slice pass —
+  // kept for backward compatibility, though per the finding above it can
+  // realistically only ever return 'unknown' against real finding.trace/
+  // chain data; a caller that wants a real feasibility answer needs
+  // AGENTIC_SECURITY_BACKWARD_SLICE=1 set.
   const trace = Array.isArray(finding.trace) ? finding.trace : [];
   const chain = Array.isArray(finding.chain) ? finding.chain : [];
   const all = [...trace, ...chain];
   for (const step of all) {
     const callee = step.callee || step.label || '';
-    // Heuristic: an encodeURIComponent / parseInt / quote_plus on the path
-    // produces output that cannot contain the family's metacharacters.
     const regex = _sanitizerRegexFor(callee);
     if (!regex) continue;
-    // Test if ALL required metacharacters are excluded by this regex.
     const excludesAll = metacharsNeeded.every(mc => !regex.test(mc.repeat(8)));
     if (excludesAll) {
       return { feasible: false, reason: `sanitizer-excludes-metacharacters:${callee}` };
@@ -112,22 +147,75 @@ export function smtLiteInfeasibilityCheck(finding) {
   return { feasible: 'unknown', reason: 'no-sanitizer-on-path' };
 }
 
+// Parameterized-query API calls: a DIFFERENT kind of "safe" than a
+// regex-constrained output — the value is never concatenated into the
+// query TEXT at all, so no charset restriction on the value itself makes
+// it safe regardless of content. Kept as its own small, explicit,
+// unambiguous list (real database-driver method names, not generic
+// English words) rather than folded into `safeSanitizerOutputRegex`,
+// which models a genuinely different property (output charset).
+const _PARAMETERIZED_CALL_NAMES = new Set(['setString', 'AddWithValue', 'bindParam', 'parameterize']);
+
+// Walk `backwardSlice` (backward.js's source-first ordered path) from the
+// SINK end backward, looking for the CLOSEST sanitize/parameterize step —
+// stopping (refusing to conclude anything) the moment it crosses an OPAQUE
+// 'call' step it cannot reason about, since such a call could have undone
+// or bypassed whatever a sanitizer further upstream proved. Only a
+// sanitizer/parameterization with NOTHING but pure 'assign' aliasing
+// between it and the sink is trusted — this is the conservative,
+// sound-by-construction direction: a missed proof (returning 'unknown')
+// costs nothing but a demotion opportunity, while a WRONG proof would
+// manufacture a false safety claim for a real vulnerability.
+function _backwardSliceExcludesMetachars(backwardSlice, metacharsNeeded) {
+  if (!Array.isArray(backwardSlice) || !backwardSlice.length) return null;
+  // Reverse to walk sink-first (the array itself is stored source-first).
+  for (const step of [...backwardSlice].reverse()) {
+    if (step.kind === 'sink') continue;
+    if (step.kind === 'assign') continue; // pure alias — keep looking upstream
+    if (step.kind === 'sanitize') {
+      if (_PARAMETERIZED_CALL_NAMES.has(step.callee)) {
+        return { feasible: false, reason: `parameterized-call:${step.callee}` };
+      }
+      if (step.outputRegexSource) {
+        // `outputRegexSource` is never attacker-influenced despite flowing
+        // through a `backwardSlice` step object: `backward.js`'s own
+        // `_safeSanitizerOutputRegex` is its ONLY producer, and that
+        // function returns either `null` or one of `string-domain.js`'s
+        // SMALL, HARDCODED `SANITIZER_OUTPUT_REGEX` pattern literals
+        // (encodeURIComponent, parseInt, htmlspecialchars, …) — confirmed
+        // by direct code reading, never a value derived from scanned
+        // source text, a finding, or any other runtime input. This
+        // project's own self-scan correctly cannot see that far through
+        // the call chain and flags this defensively — a genuine false
+        // positive, not a suppressed real risk.
+        const regex = new RegExp(step.outputRegexSource, step.outputRegexFlags || ''); // agentic-security-ignore: CWE-1333
+        const excludesAll = metacharsNeeded.every((mc) => !regex.test(mc.repeat(8)));
+        if (excludesAll) {
+          return { feasible: false, reason: `sanitizer-excludes-metacharacters:${step.callee}` };
+        }
+      }
+      // A recognized-by-catalog-name sanitizer with no PROVEN output
+      // regex (e.g. a project-local function merely NAMED like a known
+      // sanitizer) cannot be trusted for a sound proof — refuse rather
+      // than guess, matching backward.js's own `outputRegexSource`
+      // header comment on exactly this hazard.
+      return { feasible: 'unknown', reason: `sanitizer-without-proven-output-shape:${step.callee || 'unknown'}` };
+    }
+    if (step.kind === 'call') {
+      // An opaque, unmodeled call between here and the sink — refuse. We
+      // cannot know whether it further transforms (or un-does a real
+      // sanitizer's effect on) the value.
+      return { feasible: 'unknown', reason: `opaque-call-on-path:${step.callee || 'unknown'}` };
+    }
+    if (step.kind === 'source') break; // reached the origin with no sanitizer found
+  }
+  return { feasible: 'unknown', reason: 'no-sanitizer-on-path' };
+}
+
 function _sanitizerRegexFor(callee) {
   if (!callee) return null;
-  const tail = String(callee).split('.').pop();
-  const table = {
-    encodeURIComponent: /^[A-Za-z0-9\-_.!~*'()%]*$/,
-    parseInt:           /^-?\d+$/,
-    parseFloat:         /^-?\d+(?:\.\d+)?$/,
-    digest:             /^[0-9a-f]+$/,
-    htmlspecialchars:   /^[^<>&"']*$/,
-    escapeHtml:         /^[^<>&"']*$/,
-    setString:          /^.*$/,   // parameterized → infeasible regardless of content
-    AddWithValue:       /^.*$/,
-    bindParam:          /^.*$/,
-    parameterize:       /^.*$/,
-  };
-  return table[tail] || null;
+  if (_PARAMETERIZED_CALL_NAMES.has(String(callee).split('.').pop())) return /^.*$/;
+  return safeSanitizerOutputRegex(callee);
 }
 
 /**
@@ -180,7 +268,7 @@ export async function proveExploits(findings, opts = {}) {
 
 export const _internal = {
   EXPLOIT_INPUTS, FAMILY_METACHARS, _sanitizerRegexFor, smtLiteInfeasibilityCheck,
-  _maybeLoadZ3,
+  _maybeLoadZ3, _backwardSliceExcludesMetachars,
 };
 
 // Re-export provablyMatches so callers don't have to thread imports.

package/src/dataflow/index.js

@@ -98,7 +98,7 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
   // every consumer degrades to today's behavior when it finds no useful type.
   let classHierarchy = null;
   try {
-    classHierarchy = buildClassHierarchy(perFileIR);
+    classHierarchy = buildClassHierarchy(perFileIR, callGraph);
     // PRD W2.5 (SARD_80_F1_EXECUTION_PRD.md) — RTA-annotate so
     // `engine.js`'s `_resolveMemberCalleeViaCHA` can resolve a
     // parameter-typed (or otherwise non-`new`-tracked) receiver against
@@ -163,7 +163,17 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
     });
   }
   // P1.4 — backward slice (opt-in via AGENTIC_SECURITY_BACKWARD_SLICE=1).
-  if (process.env.AGENTIC_SECURITY_BACKWARD_SLICE === '1') {
+  // Next-gen taint capability #5 (SMT path-feasibility rebuild): ALSO run
+  // this when AGENTIC_SECURITY_SYMEXEC=1 is set, even if the operator never
+  // separately set AGENTIC_SECURITY_BACKWARD_SLICE — `proveExploits`'s own
+  // infeasibility check now depends on `finding.backwardSlice` for a sound
+  // verdict (see exploit-prover.js's own header), and requiring an operator
+  // to know to independently set a SECOND, differently-named flag just to
+  // get a real answer out of the first is exactly the kind of silent,
+  // undiscoverable degradation this codebase's own verification discipline
+  // warns against — SYMEXEC's own soundness must not be a hidden function
+  // of an unrelated flag.
+  if (process.env.AGENTIC_SECURITY_BACKWARD_SLICE === '1' || process.env.AGENTIC_SECURITY_SYMEXEC === '1') {
     findings = annotateBackwardSlices(findings, perFileIR, callGraph);
   }
   // Roadmap #6 — flow-proof: prove SQL sinks reached only through a

package/src/dataflow/string-domain.js

@@ -146,8 +146,44 @@ const SANITIZER_OUTPUT_REGEX = {
   // (We can't distinguish overloads from regex name alone; conservative listing.)
   // PHP htmlspecialchars / htmlentities — HTML-entity escape.
   htmlspecialchars:   /^[^<>&"']*(?:&(?:lt|gt|amp|quot|#039);)*[^<>&"']*$/,
+  // JS-ecosystem HTML escapers (he/escape-html/lodash.escape and similar
+  // libraries all converge on the same five-entity escape set) — same
+  // shape as htmlspecialchars above, different ecosystem name. Added
+  // during the SMT path-feasibility rebuild: this exact name was already
+  // trusted by exploit-prover.js's own (now-superseded) duplicate table,
+  // so omitting it here would have been a real regression, not a
+  // deliberate narrowing.
+  escapeHtml:         /^[^<>&"']*(?:&(?:lt|gt|amp|quot|#039);)*[^<>&"']*$/,
 };
 
+// Next-gen taint capability #5 (SMT path-feasibility rebuild) — a SAFE,
+// bare-tail lookup against the SAME catalog `abstract()` above already
+// uses, exported so a soundness-critical consumer (the SMT/exploit-prover
+// infeasibility check) can reuse this exact table rather than maintaining
+// its own, inevitably-drifting copy — confirmed live that THREE separate,
+// slightly different sanitizer-regex tables existed across this codebase
+// before this fix (this one, exploit-prover.js's own `_sanitizerRegexFor`,
+// and smt-feasibility.js's now-superseded encoder), each with subtly
+// different entries.
+//
+// Deliberately EXCLUDES `toString` from what this function will return:
+// `abstract()`'s own use of the FULL table above is fine with the
+// over-approximation (worst case, a coarser Regex/Unknown classification —
+// never a false SAFETY claim on its own, since nothing downstream of
+// `abstract()` treats its answer as license to PROVE a finding infeasible).
+// A soundness-critical consumer is different in kind: treating "this
+// callee's output matches the regex" as grounds to demote a finding to
+// provably-unreachable must not trust a name as ambiguous as `toString`
+// (matches ANY object's own stringifier, not just a Buffer's base64
+// encoding specifically) — an incorrect match there would manufacture a
+// false "provably safe" verdict for a genuinely exploitable finding.
+export function safeSanitizerOutputRegex(calleeName) {
+  if (!calleeName) return null;
+  const tail = String(calleeName).split('.').pop();
+  if (tail === 'toString') return null;
+  return SANITIZER_OUTPUT_REGEX[tail] || null;
+}
+
 /**
  * SAFE-CHARSET PROOF — does the abstract value provably fit the given regex?
  *

package/src/engine.js

@@ -239,7 +239,6 @@ import { runCrossServiceTaint } from './dataflow/cross-service-taint.js';
 import { annotateRuntimeCorrelation } from './posture/runtime-correlation.js';
 import { applyLearnedCalibration } from './posture/triage-learning.js';
 import { annotateFormalVerification } from './dataflow/formal-verify.js';
-import { annotatePathFeasibility } from './dataflow/smt-feasibility.js';
 import { annotateProofGate } from './dataflow/proof-gate.js';
 import { applySanitizerGate } from './dataflow/sanitizer-gate.js';
 import { annotateFalsification } from './posture/falsification.js';
@@ -9839,11 +9838,16 @@ function _deterministicFileTimings(timings) {
     if (process.env.AGENTIC_SECURITY_FORMAL === '1') {
       await _runAnnotator("annotateFormalVerification", async () => { await annotateFormalVerification(finalFindings, fc, {}); });
     }
-    // SMT path feasibility: Z3-backed proof of reachability. Opt-in via
-    // AGENTIC_SECURITY_SMT_FEASIBILITY=1.
-    if (process.env.AGENTIC_SECURITY_SMT_FEASIBILITY === '1') {
-      await _runAnnotator("annotatePathFeasibility", async () => { await annotatePathFeasibility(finalFindings, {}); });
-    }
+    // SMT path feasibility (`AGENTIC_SECURITY_SMT_FEASIBILITY`) was retired:
+    // its predicate encoder read `f.chain`/`f.taintPath` as a sequential
+    // source-to-sink path, but those fields are actually a flat list of
+    // SOURCES reaching the sink (`_sourcesReachingExpr`), never a path —
+    // confirmed by direct code reading, never fixed by real data. It also
+    // mutated `f.severity` directly on an 'unsat' verdict, violating this
+    // codebase's own recall-preserving-demotion convention that every other
+    // proof gate here follows (see `dataflow/CLAUDE.md`). Superseded by the
+    // real backward-slice-driven mechanism: `dataflow/exploit-prover.js`'s
+    // `proveExploits`, opt-in via `AGENTIC_SECURITY_SYMEXEC=1`.
     // Privacy / PII taint: emits pii-exposure findings + DPIA artifact.
     // FR-405 (assurance-hardening PRD): _privacyIrBacked is declared at
     // function scope above the AGENTIC_SECURITY_NO_INTEGRATION block, not

package/src/ir/class-hierarchy.js

@@ -39,8 +39,15 @@ const _AST_CACHE = new WeakMap();
  * Build the CHA over a perFileIR map (file → parsed IR with raw AST attached
  * under `_ast`). When AST isn't attached, fall back to the IR's own
  * structural hints (class names appearing in qids).
+ *
+ * `callGraph` (optional, from `../ir/callgraph.js#buildCallGraph`) enables
+ * one additional, otherwise-skipped pass: cross-call-site parameter type
+ * inference from the argument a caller actually passes (see that pass's own
+ * header comment below for the full rationale). Every existing caller that
+ * only ever passed `perFileIR` keeps working unchanged — the pass simply
+ * doesn't run without it.
  */
-export function buildClassHierarchy(perFileIR) {
+export function buildClassHierarchy(perFileIR, callGraph) {
   const classes = new Map();       // className -> { file, line, methods, extends }
   const methodOwners = new Map();  // qid -> className
   const typeOfVar = new Map();     // file::scope::var -> className
@@ -261,6 +268,158 @@ export function buildClassHierarchy(perFileIR) {
     }
   }
 
+  // Next-gen taint capability #4b — factory-function RETURN-type inference,
+  // the sibling gap this file's OWN header comment names and explicitly
+  // marks unimplemented ("`function buildFoo(): Foo { ... }` typed-return
+  // inference — NOT implemented. `const x = buildFoo()` is untyped
+  // (correctly: it is a plain call, not a `new`)"). Confirmed still real via
+  // a direct reproduction: `function makeHelper() { return new Helper(); }
+  // const h = makeHelper(); h.getValue(req);` misses the vulnerability
+  // entirely, the identical failure shape 4a (above) closes for the
+  // parameter case. `_inferredFactoryReturnClass` is deliberately
+  // conservative, same "refuse rather than guess" discipline as every other
+  // pass in this file: a function qualifies ONLY when every one of its own
+  // `return` statements is a `new ClassName(...)` literal of the SAME
+  // class — a function with no return, a non-constructor return on any
+  // path, or disagreeing classes across returns all correctly infer
+  // nothing, rather than picking one arbitrarily.
+  function _inferredFactoryReturnClass(fn) {
+    if (!fn || !fn.cfg || !fn.cfg.nodes) return null;
+    let className = null;
+    for (const node of Object.values(fn.cfg.nodes)) {
+      if (node.kind !== 'return' || !node.value) continue;
+      const v = node.value;
+      if (v.kind !== 'call' || !v.isNew) return null;
+      const callee = v.callee;
+      const cn = callee?.kind === 'ident' ? callee.name
+        : typeof callee === 'string' ? (callee.includes('.') ? callee.slice(callee.lastIndexOf('.') + 1) : callee)
+        : null;
+      if (!cn || !(classes.has(cn) || /^[A-Z]/.test(cn))) return null;
+      if (className === null) className = cn;
+      else if (className !== cn) return null;
+    }
+    return className;
+  }
+  if (callGraph && typeof callGraph.resolveKnownCallee === 'function' && callGraph.functions) {
+    const factoryReturnCache = new Map(); // qid -> className|null, memoized
+    const factoryReturnClassOf = (qid, fn) => {
+      if (factoryReturnCache.has(qid)) return factoryReturnCache.get(qid);
+      const cn = _inferredFactoryReturnClass(fn);
+      factoryReturnCache.set(qid, cn);
+      return cn;
+    };
+    for (const [callerFile, ir] of Object.entries(perFileIR)) {
+      if (!ir || !Array.isArray(ir.functions)) continue;
+      for (const fn of ir.functions) {
+        if (!fn.cfg || !fn.cfg.nodes) continue;
+        for (const node of Object.values(fn.cfg.nodes)) {
+          if (node.kind !== 'assign' || typeof node.target !== 'string' || node.target.includes('.')) continue;
+          const src = node.source;
+          // A plain call (isNew must be FALSY — a real `new Foo()` is
+          // already handled by the constructor-assignment pass above, and
+          // conflating the two would just redundantly re-derive the same
+          // answer through a slower path).
+          if (!src || src.kind !== 'call' || src.isNew) continue;
+          const calleeName = typeof src.callee === 'string' ? src.callee
+            : src.callee && src.callee.kind === 'ident' ? src.callee.name : null;
+          if (!calleeName) continue;
+          const calleeQid = callGraph.resolveKnownCallee(calleeName, callerFile);
+          if (!calleeQid) continue;
+          const calleeFn = callGraph.functions.get(calleeQid);
+          if (!calleeFn) continue;
+          const className = factoryReturnClassOf(calleeQid, calleeFn);
+          if (!className) continue;
+          const key = `${callerFile}::${fn.qid}::${node.target}`;
+          if (ambiguousVarKeys.has(key)) continue;
+          if (typeOfVar.has(key) && typeOfVar.get(key) !== className) {
+            ambiguousVarKeys.add(key);
+            typeOfVar.delete(key);
+          } else {
+            typeOfVar.set(key, className);
+          }
+        }
+      }
+    }
+  }
+
+  // Next-gen taint capability #4 (a narrow, call-site-scoped slice of
+  // "Andersen-style points-to", not the full thing): cross-call-site
+  // PARAMETER type inference from the ARGUMENT a caller actually passes, for
+  // JS/TS — which has no declared-type mechanism at all (`fn.paramTypes`
+  // just above only ever fires for Java/C#). Juliet's own dominant
+  // "driver constructs the concrete instance, passes it as a parameter to a
+  // helper that invokes the virtual method" idiom (already solved for
+  // Java/C# via fn.paramTypes) has no JS/TS equivalent: `function
+  // wrapper(h, req) { return h.getValue(req); }`, called only as `const h =
+  // new Helper(); wrapper(h, req);`, leaves `h` permanently untyped inside
+  // wrapper's own body, so `h.getValue()` can never resolve via CHA —
+  // confirmed via a direct reproduction (cold-cache AND warm-incremental-
+  // cache both miss it identically, ruling out a caching-specific cause)
+  // showing a real cross-file taint-recall false negative for exactly this
+  // shape. Requires `callGraph` (optional, backward-compatible — every
+  // existing caller that only ever passed `perFileIR` simply skips this
+  // pass, matching this file's own established graceful-degradation
+  // convention). Deliberately runs as a LAST, separate pass over every file
+  // (not merged into the per-file loop above) because it needs BOTH a
+  // cross-file callee lookup (`callGraph.resolveKnownCallee`) AND the
+  // CALLER's own already-inferred `typeOfVar` entries (an identifier
+  // argument's type, established by the constructor-assignment pass above)
+  // — neither is available mid-way through that loop for an arbitrary file
+  // ordering.
+  if (callGraph && typeof callGraph.resolveKnownCallee === 'function' && callGraph.functions) {
+    for (const [callerFile, ir] of Object.entries(perFileIR)) {
+      if (!ir || !Array.isArray(ir.functions)) continue;
+      for (const callerFn of ir.functions) {
+        if (!Array.isArray(callerFn.calls)) continue;
+        for (const call of callerFn.calls) {
+          const calleeName = typeof call.callee === 'string' ? call.callee
+            : call.callee && call.callee.kind === 'ident' ? call.callee.name : null;
+          if (!calleeName) continue;
+          const calleeQid = callGraph.resolveKnownCallee(calleeName, callerFile);
+          if (!calleeQid) continue;
+          const calleeFn = callGraph.functions.get(calleeQid);
+          if (!calleeFn || !Array.isArray(calleeFn.params) || !calleeFn.params.length || !calleeFn.file) continue;
+          const args = Array.isArray(call.args) ? call.args : [];
+          for (let i = 0; i < args.length && i < calleeFn.params.length; i++) {
+            const arg = args[i];
+            let className = null;
+            if (arg && arg.kind === 'call' && arg.isNew) {
+              // A literal `new ClassName(...)` passed directly as the argument.
+              const argCallee = arg.callee;
+              className = argCallee?.kind === 'ident' ? argCallee.name
+                : typeof argCallee === 'string' ? (argCallee.includes('.') ? argCallee.slice(argCallee.lastIndexOf('.') + 1) : argCallee)
+                : null;
+            } else if (arg && arg.kind === 'ident' && arg.name) {
+              // Juliet's own dominant idiom: `const h = new Helper(); f(h,
+              // ...)`. `h`'s type was already established by the
+              // constructor-assignment pass above (it runs first, in the
+              // SAME outer file loop) — reuse it directly rather than
+              // re-deriving, so this stays in sync with that pass's own
+              // ambiguity handling by construction.
+              className = typeOfVar.get(`${callerFile}::${callerFn.qid}::${arg.name}`) || null;
+            }
+            if (!className || !(classes.has(className) || /^[A-Z]/.test(className))) continue;
+            const paramName = calleeFn.params[i];
+            if (typeof paramName !== 'string' || !paramName) continue;
+            // Same collision-refusal discipline as every other typeOfVar-
+            // populating pass in this file: a wrong "confidently resolved"
+            // type is worse than staying unknown, so a SECOND call site
+            // disagreeing with an already-recorded type for this exact
+            // parameter permanently refuses it, never picks a side.
+            const key = `${calleeFn.file}::${calleeQid}::${paramName}`;
+            if (ambiguousVarKeys.has(key)) continue;
+            if (typeOfVar.has(key) && typeOfVar.get(key) !== className) {
+              ambiguousVarKeys.add(key);
+              typeOfVar.delete(key);
+            } else {
+              typeOfVar.set(key, className);
+            }
+          }
+        }
+      }
+    }
+  }
+
   return { classes, methodOwners, typeOfVar };
 }
 

package/src/report/index.js

@@ -228,6 +228,18 @@ export function normalizeFindings(scan){
       dataClasses: f.dataClasses || [],
       chain: Array.isArray(f.chain) ? f.chain : null,
       sourceProvenance: f.sourceProvenance || null,
+      // Next-gen taint capability #7 (cross-service schema-driven taint):
+      // dataflow/cross-service-taint.js SETS crossService/_severityBumpReason
+      // on findings whose source crosses a declared services.yml trust
+      // boundary, but this allowlist never named either field — the same
+      // "silently dropped field" bug class engine.js's own _funcQid/callee/
+      // argIndex comments already document twice for the raw finding
+      // object, this time at the report layer. Without this, an operator
+      // reading a report saw a bumped severity with no visible reason at
+      // all: `severity` itself IS in this allowlist (so the bump survived),
+      // but its only explanation was silently discarded.
+      crossService: f.crossService || null,
+      _severityBumpReason: f._severityBumpReason || null,
       confidence: typeof f.confidence === 'number' ? f.confidence : null,
       // R17: corroboration ("one issue, many signals") — count of independent
       // analyses that agreed, and which ones.