@clear-capabilities/agentic-security-scanner 0.172.1 → 0.174.0

package/src/ir/module-resolver.js

@@ -0,0 +1,315 @@
+// Import-aware module resolution (E2-02): which function does `svc.run(x)` in routes.js actually call?
+//
+// The call graph used to resolve a cross-file call by NAME alone: any function called `run` anywhere in the project could be the callee,
+// and a member call through an imported module (`const svc = require('./service'); svc.run(x)`) was not resolved at all because `svc.run`
+// is not a function name. That was a false negative for the second shape and a false-edge risk for the first. This resolver follows the
+// program's own import/export statements instead.
+//
+// WHAT IT UNDERSTANDS (JavaScript and TypeScript, parsed with Babel; Python by line patterns)
+//   imports   `import {a as b} from`, default, namespace, `import x = require()`, `const x = require()`, `const {a: b} = require()`,
+//             `const f = require('m').f`; Python `from m import a as b`, `import m as n`, `import a.b`
+//   exports   `export function/const/class`, `export {a as b}`, `export {a} from`, `export * from`, `export default`, `exports.a =`,
+//             `module.exports.a =`, `module.exports = {a, b: fn}`, `module.exports = fn`, `module.exports = require('./x')`
+//   paths     relative specifiers with extension and index-file probing, TypeScript's `./x.js` -> `./x.ts`, Python dotted modules and
+//             relative `from . import`
+//
+// WHAT IT DOES NOT, SAID OUT LOUD (each shows up as a status, never as a guess)
+//   dynamic `require(expr)` / `import()`, path aliases (`@/x`, `~/x`, tsconfig `paths`), conditional exports, `export * as ns`, call-through
+//   property chains deeper than one level (`a.b.c()`), an export that is not a function, shadowing of an imported name by a local.
+//
+// TERMINATION. Re-export chains are followed to a depth of MAX_HOPS with a visited set, so a cycle (a re-exports b re-exports a) ends as
+// `cycle` and a long chain ends as `depth-limit`. The result always carries the hops it took.
+import { parseSync } from '@babel/core';
+import presetReact from '@babel/preset-react';
+import presetTypescript from '@babel/preset-typescript';
+
+export const MAX_HOPS = 8;
+const MAX_FILE_BYTES = 1_500_000;
+const BUILTINS = new Set(['assert', 'buffer', 'child_process', 'cluster', 'crypto', 'dgram', 'dns', 'events', 'fs', 'http', 'http2', 'https', 'net', 'os', 'path', 'perf_hooks', 'process', 'querystring', 'readline', 'stream', 'string_decoder', 'timers', 'tls', 'url', 'util', 'vm', 'worker_threads', 'zlib']);
+const JS_EXT = ['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.mts', '.cts'];
+
+const posix = (p) => String(p).replace(/\\/g, '/');
+function normalize(p) {
+  const out = [];
+  for (const seg of posix(p).split('/')) { if (seg === '' || seg === '.') continue; if (seg === '..') { if (!out.length) return null; out.pop(); } else out.push(seg); }
+  return out.join('/');
+}
+const dirOf = (f) => { const i = posix(f).lastIndexOf('/'); return i < 0 ? '' : posix(f).slice(0, i); };
+
+// ---- JavaScript / TypeScript extraction -------------------------------------------------------------------------------------
+
+function parseJs(file, code) {
+  try {
+    return parseSync(code, { filename: file, presets: [presetReact, [presetTypescript, { ignoreExtensions: true }]], parserOpts: { plugins: ['decorators-legacy', 'decoratorAutoAccessors'] }, babelrc: false, configFile: false });
+  } catch { return null; }
+}
+const litString = (n) => (n && (n.type === 'StringLiteral' || (n.type === 'Literal' && typeof n.value === 'string')) ? n.value : (n && n.type === 'TemplateLiteral' && !n.expressions.length && n.quasis.length === 1 ? n.quasis[0].value.cooked : null));
+const keyName = (k) => (k.type === 'Identifier' ? k.name : litString(k));
+const isRequire = (n) => n && n.type === 'CallExpression' && n.callee.type === 'Identifier' && n.callee.name === 'require' && n.arguments.length === 1;
+const isFnNode = (n) => n && (n.type === 'FunctionExpression' || n.type === 'ArrowFunctionExpression' || n.type === 'FunctionDeclaration');
+
+export function extractJsFacts(file, code) {
+  const facts = { language: 'js', imports: [], exports: [], unsupported: [] };
+  const ast = parseJs(file, code);
+  if (!ast) { facts.unsupported.push('parse-failed'); return facts; }
+  const addImport = (local, kind, source, imported = null) => facts.imports.push({ local, kind, source, imported });
+  const addExport = (e) => facts.exports.push(e);
+  for (const st of ast.program.body) {
+    switch (st.type) {
+      case 'ImportDeclaration':
+        for (const sp of st.specifiers) {
+          if (sp.type === 'ImportSpecifier') addImport(sp.local.name, 'named', st.source.value, sp.imported.type === 'Identifier' ? sp.imported.name : sp.imported.value);
+          else if (sp.type === 'ImportDefaultSpecifier') addImport(sp.local.name, 'default', st.source.value);
+          else if (sp.type === 'ImportNamespaceSpecifier') addImport(sp.local.name, 'namespace', st.source.value);
+        }
+        break;
+      case 'TSImportEqualsDeclaration':
+        if (st.moduleReference?.type === 'TSExternalModuleReference') addImport(st.id.name, 'namespace', litString(st.moduleReference.expression));
+        break;
+      case 'VariableDeclaration':
+        for (const d of st.declarations) {
+          const init = d.init;
+          if (isRequire(init)) {
+            const src = litString(init.arguments[0]);
+            if (src === null) { facts.unsupported.push('dynamic-require'); continue; }
+            if (d.id.type === 'Identifier') addImport(d.id.name, 'namespace', src);
+            else if (d.id.type === 'ObjectPattern') for (const p of d.id.properties) {
+              if (p.type !== 'ObjectProperty') { facts.unsupported.push('rest-in-require-pattern'); continue; }
+              const v = p.value.type === 'AssignmentPattern' ? p.value.left : p.value;
+              if (v.type === 'Identifier') addImport(v.name, 'named', src, keyName(p.key));
+            }
+          } else if (init && init.type === 'MemberExpression' && isRequire(init.object) && d.id.type === 'Identifier' && !init.computed) {
+            const src = litString(init.object.arguments[0]);
+            if (src !== null) addImport(d.id.name, 'named', src, init.property.name);
+          } else if (init && init.type === 'CallExpression' && init.callee.type === 'CallExpression' && isRequire(init.callee)) facts.unsupported.push('call-of-require-result');
+          if (isFnNode(init) && st.parent === undefined && d.id.type === 'Identifier') { /* local function value: found through the IR by name */ }
+        }
+        break;
+      case 'ExportNamedDeclaration':
+        if (st.declaration) {
+          const dec = st.declaration;
+          if (dec.type === 'FunctionDeclaration' || dec.type === 'ClassDeclaration') addExport({ name: dec.id.name, local: dec.id.name, kind: dec.type === 'FunctionDeclaration' ? 'function' : 'value' });
+          else if (dec.type === 'VariableDeclaration') for (const d of dec.declarations) if (d.id.type === 'Identifier') addExport({ name: d.id.name, local: d.id.name, kind: isFnNode(d.init) ? 'function' : 'value' });
+        }
+        for (const sp of st.specifiers || []) {
+          if (sp.type !== 'ExportSpecifier') { facts.unsupported.push('export-namespace-specifier'); continue; }
+          const exported = sp.exported.type === 'Identifier' ? sp.exported.name : sp.exported.value;
+          if (st.source) addExport({ name: exported, kind: 'reexport', from: st.source.value, imported: sp.local.name });
+          else addExport({ name: exported, local: sp.local.name, kind: 'local' });
+        }
+        break;
+      case 'ExportAllDeclaration':
+        addExport({ name: '*', kind: 'star', from: st.source.value });
+        break;
+      case 'ExportDefaultDeclaration': {
+        const d = st.declaration;
+        if ((d.type === 'FunctionDeclaration' || d.type === 'ClassDeclaration') && d.id) addExport({ name: 'default', local: d.id.name, kind: 'local' });
+        else if (d.type === 'Identifier') addExport({ name: 'default', local: d.name, kind: 'local' });
+        else if (isFnNode(d)) addExport({ name: 'default', local: null, kind: 'anonymous-function' });
+        else addExport({ name: 'default', local: null, kind: 'value' });
+        break;
+      }
+      case 'ExpressionStatement': {
+        const e = st.expression;
+        if (e.type === 'AssignmentExpression' && e.operator === '=' && e.left.type === 'MemberExpression') {
+          const L = e.left;
+          const objIsExports = L.object.type === 'Identifier' && L.object.name === 'exports';
+          const objIsModuleExports = L.object.type === 'MemberExpression' && L.object.object.type === 'Identifier' && L.object.object.name === 'module' && L.object.property.name === 'exports';
+          const isModuleExportsItself = L.object.type === 'Identifier' && L.object.name === 'module' && !L.computed && L.property.name === 'exports';
+          if ((objIsExports || objIsModuleExports) && !L.computed) {
+            const r = e.right;
+            addExport({ name: L.property.name, local: r.type === 'Identifier' ? r.name : null, kind: isFnNode(r) ? 'function' : r.type === 'Identifier' ? 'local' : 'value' });
+          } else if (isModuleExportsItself) {
+            const r = e.right;
+            if (r.type === 'ObjectExpression') for (const p of r.properties) {
+              if (p.type === 'ObjectProperty' || p.type === 'ObjectMethod') { const n = keyName(p.key); if (n) addExport({ name: n, local: p.type === 'ObjectProperty' && p.value.type === 'Identifier' ? p.value.name : null, kind: p.type === 'ObjectMethod' || (p.type === 'ObjectProperty' && isFnNode(p.value)) ? 'function' : p.type === 'ObjectProperty' && p.value.type === 'Identifier' ? 'local' : 'value' }); }
+              else facts.unsupported.push('spread-in-module-exports');
+            }
+            else if (isRequire(r)) { const src = litString(r.arguments[0]); if (src !== null) addExport({ name: '*', kind: 'star', from: src, whole: true }); else facts.unsupported.push('dynamic-require'); }
+            else if (r.type === 'Identifier') addExport({ name: 'default', local: r.name, kind: 'local' });
+            else if (isFnNode(r)) addExport({ name: 'default', local: r.id?.name ?? null, kind: r.id ? 'local' : 'anonymous-function' });
+            else addExport({ name: 'default', local: null, kind: 'value' });
+          }
+        } else if (e.type === 'CallExpression' && e.callee.type === 'Import') facts.unsupported.push('dynamic-import');
+        break;
+      }
+      default: break;
+    }
+  }
+  return facts;
+}
+
+// ---- Python extraction ------------------------------------------------------------------------------------------------------
+
+export function extractPyFacts(file, code) {
+  const facts = { language: 'py', imports: [], exports: [], unsupported: [] };
+  for (const raw of String(code).split('\n')) {
+    const line = raw.replace(/#.*$/, '');
+    let m;
+    if ((m = /^from\s+(\.+)?([\w.]*)\s+import\s+(.+)$/.exec(line))) {
+      const source = `${m[1] || ''}${m[2] || ''}`;
+      const list = m[3].replace(/[()\\]/g, '').split(',').map((s) => s.trim()).filter(Boolean);
+      for (const item of list) { const mm = /^(\w+|\*)(?:\s+as\s+(\w+))?$/.exec(item); if (!mm) continue; if (mm[1] === '*') facts.unsupported.push('star-import'); else facts.imports.push({ local: mm[2] || mm[1], kind: 'py-from', source, imported: mm[1] }); }
+    } else if ((m = /^import\s+(.+)$/.exec(line))) {
+      for (const item of m[1].split(',').map((s) => s.trim()).filter(Boolean)) {
+        const mm = /^([\w.]+)(?:\s+as\s+(\w+))?$/.exec(item); if (!mm) continue;
+        facts.imports.push(mm[2] ? { local: mm[2], kind: 'py-module', source: mm[1] } : { local: mm[1].split('.')[0], kind: 'py-module-root', source: mm[1] });
+      }
+    } else if ((m = /^(?:async\s+)?def\s+(\w+)\s*\(/.exec(line))) facts.exports.push({ name: m[1], local: m[1], kind: 'function' });
+  }
+  return facts;
+}
+
+// ---- index ------------------------------------------------------------------------------------------------------------------
+
+/**
+ * @param {Record<string,string>} fileContents repository-relative path -> source
+ * @param {Record<string,{functions:object[]}>} perFile the IR's perFile map
+ */
+export function buildModuleIndex(fileContents, perFile) {
+  const files = new Set(Object.keys(fileContents || {}).map(posix));
+  const facts = new Map();
+  for (const [f, code] of Object.entries(fileContents || {})) {
+    if (typeof code !== 'string' || code.length > MAX_FILE_BYTES) continue;
+    const file = posix(f);
+    if (/\.(js|jsx|ts|tsx|mjs|cjs|mts|cts)$/.test(file)) { if (/\b(import|export|require|module\.exports|exports\.)/.test(code)) facts.set(file, extractJsFacts(file, code)); }
+    else if (/\.py$/.test(file)) facts.set(file, extractPyFacts(file, code));
+  }
+  const fnsByFile = new Map();
+  for (const [f, ir] of Object.entries(perFile || {})) fnsByFile.set(posix(f), (ir?.functions || []).filter((fn) => fn.name !== '<module>'));
+
+  function resolveSpecifier(from, spec, language) {
+    if (typeof spec !== 'string' || !spec) return { kind: 'unresolved', reason: 'empty specifier' };
+    if (language === 'py') {
+      const rel = /^(\.+)(.*)$/.exec(spec);
+      let baseDir; let dotted;
+      if (rel) { baseDir = dirOf(from); for (let i = 1; i < rel[1].length; i++) baseDir = dirOf(baseDir); dotted = rel[2]; } else { baseDir = ''; dotted = spec; }
+      const rest = dotted ? dotted.split('.').join('/') : '';
+      const stem = normalize(baseDir ? (rest ? `${baseDir}/${rest}` : baseDir) : rest);
+      if (stem === null) return { kind: 'unresolved', reason: 'path leaves the repository' };
+      for (const c of [`${stem}.py`, `${stem}/__init__.py`]) if (stem !== '' && files.has(c)) return { kind: 'file', file: c };
+      if (stem === '' && files.has('__init__.py')) return { kind: 'file', file: '__init__.py' };
+      return rel ? { kind: 'unresolved', reason: `relative module ${spec} not found` } : { kind: 'external', reason: 'not a module of this repository' };
+    }
+    if (spec.startsWith('node:') || BUILTINS.has(spec.split('/')[0])) return { kind: 'external', reason: 'node builtin' };
+    if (spec.startsWith('.') || spec.startsWith('/')) {
+      const stem = normalize(spec.startsWith('/') ? spec.slice(1) : `${dirOf(from)}/${spec}`);
+      if (stem === null) return { kind: 'unresolved', reason: 'path leaves the repository' };
+      const noExt = stem.replace(/\.(m|c)?js$/, '');
+      const cands = [stem, ...JS_EXT.map((e) => stem + e), noExt + '.ts', noExt + '.tsx', noExt + '.mts', noExt + '.cts', ...JS_EXT.map((e) => `${stem}/index${e}`)];
+      for (const c of cands) if (files.has(c)) return { kind: 'file', file: c };
+      return { kind: 'unresolved', reason: `${spec} not found in the repository` };
+    }
+    if (/^(@\/|~\/|#|\$)/.test(spec)) return { kind: 'unresolved', reason: 'path alias: tsconfig paths and bundler aliases are not read' };
+    return { kind: 'external', reason: 'package import' };
+  }
+
+  function functionIn(file, local) {
+    const hits = (fnsByFile.get(file) || []).filter((fn) => fn.name === local || String(fn.name).endsWith(`.${local}`));
+    if (hits.length === 1) return { qid: hits[0].qid };
+    return hits.length ? { ambiguous: hits.map((h) => h.qid) } : null;
+  }
+
+  // follow an export of `file` named `name` to the function that implements it
+  function resolveExport(file, name, hops, visited) {
+    const key = `${file}#${name}`;
+    if (visited.has(key)) return { status: 'cycle', hops, reason: `re-export cycle at ${key}` };
+    if (hops.length >= MAX_HOPS) return { status: 'depth-limit', hops, reason: `more than ${MAX_HOPS} re-export hops` };
+    visited.add(key);
+    const f = facts.get(file);
+    if (!f) return { status: 'unresolved-export', hops, reason: `${file} has no import/export statements` };
+    const hop = (extra) => [...hops, { file, name, ...extra }];
+    const direct = f.exports.filter((e) => e.name === name && e.kind !== 'star');
+    if (direct.length) {
+      const e = direct[direct.length - 1];
+      if (e.kind === 'reexport') {
+        const spec = resolveSpecifier(file, e.from, f.language);
+        if (spec.kind === 'file') return resolveExport(spec.file, e.imported, hop({ via: 're-export', from: e.from }), visited);
+        return { status: spec.kind === 'external' ? 'external' : 'unresolved-import', hops: hop({ via: 're-export', from: e.from }), reason: spec.reason };
+      }
+      if (e.kind === 'anonymous-function') {
+        const cands = (fnsByFile.get(file) || []).filter((fn) => /^(default|anonymous|<anonymous>)/i.test(fn.name));
+        return cands.length === 1 ? { status: 'resolved', qid: cands[0].qid, file, exportName: name, hops: hop({}) } : { status: 'unresolved-export', hops: hop({}), reason: 'anonymous default export function not identifiable in the IR' };
+      }
+      if (e.kind === 'value') {
+        const byName = functionIn(file, name);
+        if (byName?.qid) return { status: 'resolved', qid: byName.qid, file, exportName: name, hops: hop({}) };
+        return { status: 'unresolved-export', hops: hop({}), reason: `${name} is exported but is not a function the IR knows` };
+      }
+      const local = e.local || name;
+      const fn = functionIn(file, local) || (local !== name ? functionIn(file, name) : null);
+      if (fn?.qid) return { status: 'resolved', qid: fn.qid, file, exportName: name, hops: hop({}) };
+      if (fn?.ambiguous) return { status: 'ambiguous', hops: hop({}), reason: `several functions named ${local} in ${file}`, candidates: fn.ambiguous };
+      // an imported binding re-exported by name (`import {a} from './x'; export {a}`)
+      const imp = f.imports.find((i) => i.local === local);
+      if (imp) return resolveBinding(file, imp, hop({ via: 'import-then-export' }), visited);
+      return { status: 'unresolved-export', hops: hop({}), reason: `${local} is exported by ${file} but no function of that name was found` };
+    }
+    // `export * from` / `module.exports = require()`: search each star target; more than one hit is ambiguous
+    const stars = f.exports.filter((e) => e.kind === 'star');
+    const found = [];
+    for (const s of stars) {
+      const spec = resolveSpecifier(file, s.from, f.language);
+      if (spec.kind !== 'file') continue;
+      const r = resolveExport(spec.file, name, hop({ via: s.whole ? 'module.exports = require' : 'export *', from: s.from }), new Set(visited));
+      if (r.status === 'resolved') found.push(r); else if (r.status === 'cycle' || r.status === 'depth-limit') return r;
+    }
+    if (found.length === 1) return found[0];
+    if (found.length > 1) return { status: 'ambiguous', hops: hop({}), reason: `${name} is provided by ${found.length} star re-exports`, candidates: found.map((r) => r.qid) };
+    return { status: 'unresolved-export', hops: hop({}), reason: `${file} does not export ${name}` };
+  }
+
+  function resolveBinding(callerFile, imp, hops, visited) {
+    const f = facts.get(callerFile);
+    const spec = resolveSpecifier(callerFile, imp.source, f?.language);
+    if (spec.kind === 'external') return { status: 'external', hops, reason: spec.reason, source: imp.source };
+    if (spec.kind === 'unresolved') return { status: 'unresolved-import', hops, reason: spec.reason, source: imp.source };
+    const name = imp.kind === 'default' ? 'default' : imp.kind === 'py-from' ? imp.imported : imp.imported;
+    if (name == null) return { status: 'module', file: spec.file, hops, source: imp.source };
+    return resolveExport(spec.file, name, [...hops, { file: callerFile, via: `import ${imp.source}` }], visited);
+  }
+
+  /** Resolve the callee text of a call made in `callerFile`. Never throws; always terminates. */
+  function resolveCall(callerFile, calleeText) {
+    const caller = posix(callerFile);
+    const f = facts.get(caller);
+    if (!f || typeof calleeText !== 'string' || !calleeText) return { status: 'no-facts', hops: [] };
+    const parts = calleeText.split('.');
+    const head = parts[0];
+    const imp = f.imports.find((i) => i.local === head);
+    if (!imp) return { status: 'not-imported', hops: [] };
+    const visited = new Set();
+    if (parts.length === 1) {
+      if (imp.kind === 'namespace' || imp.kind === 'py-module' || imp.kind === 'py-module-root') {
+        // calling the module object itself: `const f = require('./f'); f(x)` -> the module's default / module.exports function
+        const spec = resolveSpecifier(caller, imp.source, f.language);
+        if (spec.kind !== 'file') return { status: spec.kind === 'external' ? 'external' : 'unresolved-import', hops: [], reason: spec.reason, source: imp.source };
+        return resolveExport(spec.file, 'default', [{ file: caller, via: `import ${imp.source}` }], visited);
+      }
+      return resolveBinding(caller, imp, [], visited);
+    }
+    if (parts.length > 2 && !(imp.kind === 'py-module-root')) return { status: 'unsupported', hops: [], reason: `${calleeText}: property chains deeper than one level are not resolved`, source: imp.source };
+    if (imp.kind === 'namespace' || imp.kind === 'py-module') {
+      const spec = resolveSpecifier(caller, imp.source, f.language);
+      if (spec.kind === 'external') return { status: 'external', hops: [], reason: spec.reason, source: imp.source };
+      if (spec.kind !== 'file') return { status: 'unresolved-import', hops: [], reason: spec.reason, source: imp.source };
+      return resolveExport(spec.file, parts[1], [{ file: caller, via: `import ${imp.source}` }], visited);
+    }
+    if (imp.kind === 'py-module-root') {
+      // `import a.b` binds `a`; `a.b.fn()` names the module a/b and the function fn
+      const dotted = parts.slice(0, -1).join('.');
+      if (!imp.source.startsWith(dotted)) return { status: 'unsupported', hops: [], reason: `${calleeText} does not match import ${imp.source}`, source: imp.source };
+      const spec = resolveSpecifier(caller, dotted, 'py');
+      if (spec.kind === 'external') return { status: 'external', hops: [], reason: spec.reason, source: imp.source };
+      if (spec.kind !== 'file') return { status: 'unresolved-import', hops: [], reason: spec.reason, source: imp.source };
+      return resolveExport(spec.file, parts[parts.length - 1], [{ file: caller, via: `import ${imp.source}` }], visited);
+    }
+    // `x.y()` where x is a named/default import: a method on an imported value, not a module member. If the import is an external
+    // package that is still the answer that matters (`axios.get` is the package's, not ours).
+    const specOther = resolveSpecifier(caller, imp.source, f.language);
+    if (specOther.kind === 'external') return { status: 'external', hops: [], reason: specOther.reason, source: imp.source };
+    return { status: 'unsupported', hops: [], reason: `${calleeText}: member of an imported value, not of a module`, source: imp.source };
+  }
+
+  return { facts, resolveSpecifier, resolveExport: (file, name) => resolveExport(posix(file), name, [], new Set()), resolveCall };
+}

package/src/ir/parser-js.js

@@ -182,7 +182,13 @@ function exprOf(n) {
         return { key: resolveObjectKey(p), value: exprOf(p.value) };
       }).filter(Boolean),
     };
-    case 'ArrayExpression':   return { kind: 'array', elements: (n.elements || []).map(exprOf) };
+    case 'ArrayExpression': {
+      // `spreads` is additive and present only when an element is `...x`: the position of every later element is then unknown, which the
+      // engine needs in order to treat the literal index by index (E2-03). Consumers that ignore it see the same shape as before.
+      const spreads = [];
+      (n.elements || []).forEach((el, i) => { if (el && el.type === 'SpreadElement') spreads.push(i); });
+      return spreads.length ? { kind: 'array', elements: (n.elements || []).map(exprOf), spreads } : { kind: 'array', elements: (n.elements || []).map(exprOf) };
+    }
     case 'SpreadElement':     return exprOf(n.argument);
     case 'ThisExpression':    return { kind: 'ident', name: '_this_' };
     // Taint-recall PRD (80%) Tier 3: JSX had ZERO IR modeling at all — every
@@ -486,7 +492,20 @@ export function parseJsFile(file, code) {
             const parentName = stack[stack.length - 1]?.name || '';
             enterFn(name || 'anon', parentName, path.node, path.node.params || []);
           },
-          exit() { exitFn(); },
+          exit(path) {
+            // An arrow with an EXPRESSION body (`(req) => req.query.c`) returns that expression. It has no ReturnStatement, so the function used to
+            // record no return at all and every helper written this way was invisible to return-taint summaries. The return node is added on exit so
+            // it follows any call nodes the expression contained.
+            const fn = currentFn();
+            const body = path.node.body;
+            if (fn && body && body.type !== 'BlockStatement') {
+              const nodeId = nextNodeId();
+              addNode(fn, { id: nodeId, kind: 'return', value: exprOf(body), line: body.loc?.start?.line || path.node.loc?.start?.line || 0, succ: [], pred: [] });
+              fn.returns.push(nodeId);
+              linkCfg(fn, nodeId, fn.cfg.exit);
+            }
+            exitFn();
+          },
         },
         ClassMethod: {
           enter(path) {

package/src/ir/semantic-graph.js

@@ -0,0 +1,245 @@
+// SemanticGraph v1: a typed, versioned, additive view over the Layer-1 IR (E2-01).
+//
+// WHY. The IR (`buildProjectIR`) is a bag of per-function records consumed by the taint engine. It has no stable identifiers, no shared
+// entity types and no serialization contract, so every analysis that needs "the call at this place" or "where did this value come from"
+// re-derives it with its own conventions, and nothing can be compared across runs. This module names the entities once, gives each a
+// STABLE id, and fixes a versioned wire format.
+//
+// ADDITIVE. Building the graph reads the IR and never modifies it; it is not wired into findings, `chain[]` or last-scan.json. Existing
+// output is unchanged by construction (a test pins that). A consumer opts in by calling `buildSemanticGraph`.
+//
+// HONEST. An entity type the IR cannot yet supply (Sanitizer, Guard, ServiceBoundary, StorageEdge) is declared in the schema, emitted as an
+// empty list, and reported `schema-only` in `coverage` with the reason. A location the IR does not carry (column) is `null` and the entity
+// says `locationPrecision: 'line'`. Nothing is guessed to fill a field.
+//
+// STABLE IDS. An id is the first 16 hex of SHA-256 over the entity's kind and its identity fields, which never include a line number: adding
+// a blank line above a function does not change any id in it. Ties between otherwise identical entities (two `exec(x)` in one function) are
+// broken by their order of appearance in that function.
+import { createHash } from 'node:crypto';
+import { analysisLimits } from '../dataflow/analysis-limits.js';
+
+export const SEMANTIC_GRAPH_SCHEMA = 'agentic-security/semantic-graph';
+export const SEMANTIC_GRAPH_VERSION = '1.0.0';
+export const SUPPORTED_MAJOR = 1;
+
+export const ENTITY_LISTS = Object.freeze(['symbols', 'callSites', 'allocations', 'fieldAccesses', 'valueOrigins', 'serviceBoundaries', 'storageEdges', 'sanitizers', 'guards']);
+export const CONFIDENCE_TIERS = Object.freeze(['observed', 'inferred', 'unresolved']);
+const SYMBOL_KINDS = Object.freeze(['module', 'function', 'class', 'variable', 'parameter']);
+const ORIGIN_KINDS = Object.freeze(['parameter', 'call-result', 'literal', 'member', 'concat', 'object', 'array', 'function', 'identifier', 'unknown']);
+
+const ID_PREFIX = Object.freeze({ symbols: 'sym', callSites: 'call', allocations: 'alloc', fieldAccesses: 'field', valueOrigins: 'orig', serviceBoundaries: 'svc', storageEdges: 'store', sanitizers: 'san', guards: 'guard' });
+
+const h16 = (parts) => createHash('sha256').update(JSON.stringify(parts)).digest('hex').slice(0, 16);
+const stripLine = (qid) => String(qid).replace(/@\d+$/, '');
+
+// ---- canonical serialization ------------------------------------------------------------------------------------------------
+
+function canon(v) {
+  if (Array.isArray(v)) return v.map(canon);
+  if (v && typeof v === 'object') return Object.fromEntries(Object.keys(v).sort().map((k) => [k, canon(v[k])]));
+  return v;
+}
+export function serializeGraph(graph) {
+  const g = { ...graph };
+  for (const k of ENTITY_LISTS) g[k] = [...(graph[k] || [])].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+  return JSON.stringify(canon(g));
+}
+
+// ---- validation -------------------------------------------------------------------------------------------------------------
+
+/** @returns {{ok:boolean, errors:{code:string,path:string,message:string}[]}} Never throws on hostile input. */
+export function validateGraph(g) {
+  const errors = [];
+  const err = (code, path, message) => errors.push({ code, path, message });
+  if (!g || typeof g !== 'object' || Array.isArray(g)) return { ok: false, errors: [{ code: 'NOT_AN_OBJECT', path: '', message: 'a graph is an object' }] };
+  if (g.schema !== SEMANTIC_GRAPH_SCHEMA) { err('SCHEMA_MISMATCH', 'schema', `expected ${SEMANTIC_GRAPH_SCHEMA}`); return { ok: false, errors }; }
+  const m = typeof g.schemaVersion === 'string' ? /^(\d+)\.(\d+)\.(\d+)$/.exec(g.schemaVersion) : null;
+  if (!m) { err('BAD_VERSION', 'schemaVersion', 'must be a semantic version'); return { ok: false, errors }; }
+  if (Number(m[1]) !== SUPPORTED_MAJOR) { err('UNSUPPORTED_MAJOR', 'schemaVersion', `major ${m[1]} is not supported (supported: ${SUPPORTED_MAJOR}); migrate it first`); return { ok: false, errors }; }
+  const ids = new Map();
+  for (const list of ENTITY_LISTS) {
+    if (!Array.isArray(g[list])) { err('MISSING_FIELD', list, 'must be a list (empty when none)'); continue; }
+    g[list].forEach((e, i) => {
+      const p = `${list}[${i}]`;
+      if (!e || typeof e !== 'object' || Array.isArray(e)) { err('BAD_TYPE', p, 'must be an object'); return; }
+      if (typeof e.id !== 'string' || !new RegExp(`^${ID_PREFIX[list]}:[0-9a-f]{16}$`).test(e.id)) err('BAD_ID', `${p}.id`, `must look like ${ID_PREFIX[list]}:<16 hex>`);
+      else if (ids.has(e.id)) err('DUPLICATE_ID', `${p}.id`, `duplicate id ${e.id}`); else ids.set(e.id, list);
+      if (typeof e.file !== 'string' || !e.file || e.file.startsWith('/') || e.file.split('/').includes('..')) err('BAD_TYPE', `${p}.file`, 'must be a repository-relative path');
+      if (!(Number.isInteger(e.line) && e.line >= 0)) err('BAD_TYPE', `${p}.line`, 'line must be a non-negative integer');
+      if (!(e.column === null || (Number.isInteger(e.column) && e.column >= 0))) err('BAD_TYPE', `${p}.column`, 'column must be null or a non-negative integer');
+      if (e.column === null && e.locationPrecision !== 'line') err('RULE_VIOLATION', `${p}.locationPrecision`, "a null column requires locationPrecision 'line'");
+      const c = e.confidence;
+      if (!c || typeof c !== 'object' || !CONFIDENCE_TIERS.includes(c.tier) || typeof c.basis !== 'string' || !c.basis) err('BAD_TYPE', `${p}.confidence`, 'needs { tier, basis }');
+    });
+  }
+  if (errors.length) return { ok: false, errors };
+  const need = (e, p, field, list) => { if (e[field] !== null && e[field] !== undefined && ids.get(e[field]) !== list) err('DANGLING_REF', `${p}.${field}`, `${e[field]} is not a ${list} id`); };
+  g.symbols.forEach((e, i) => { if (!SYMBOL_KINDS.includes(e.kind)) err('UNKNOWN_ENUM', `symbols[${i}].kind`, `unknown symbol kind ${e.kind}`); need(e, `symbols[${i}]`, 'parent', 'symbols'); });
+  g.callSites.forEach((e, i) => { need(e, `callSites[${i}]`, 'caller', 'symbols'); need(e, `callSites[${i}]`, 'callee', 'symbols'); if (e.callee && e.resolution !== 'resolved') err('RULE_VIOLATION', `callSites[${i}].resolution`, 'a call with a callee must be resolved'); if (!e.callee && e.resolution === 'resolved') err('RULE_VIOLATION', `callSites[${i}].resolution`, 'a resolved call needs a callee'); (e.args || []).forEach((a, j) => need(a, `callSites[${i}].args[${j}]`, 'origin', 'valueOrigins')); });
+  g.valueOrigins.forEach((e, i) => { if (!ORIGIN_KINDS.includes(e.kind)) err('UNKNOWN_ENUM', `valueOrigins[${i}].kind`, `unknown origin kind ${e.kind}`); need(e, `valueOrigins[${i}]`, 'symbol', 'symbols'); });
+  g.fieldAccesses.forEach((e, i) => { need(e, `fieldAccesses[${i}]`, 'symbol', 'symbols'); if (!['read', 'write'].includes(e.mode)) err('UNKNOWN_ENUM', `fieldAccesses[${i}].mode`, 'mode must be read or write'); });
+  g.allocations.forEach((e, i) => need(e, `allocations[${i}]`, 'symbol', 'symbols'));
+  if (!g.coverage || typeof g.coverage !== 'object') err('MISSING_FIELD', 'coverage', 'coverage is required');
+  else for (const list of ENTITY_LISTS) { const c = g.coverage[list]; if (!c || !['populated', 'schema-only'].includes(c.state) || !c.reason) err('BAD_TYPE', `coverage.${list}`, 'needs { state, reason }'); else if (c.state === 'schema-only' && g[list].length) err('RULE_VIOLATION', `coverage.${list}`, 'schema-only but not empty'); else if (c.state === 'populated' && !g[list].length) err('RULE_VIOLATION', `coverage.${list}`, 'populated but empty'); }
+  return { ok: errors.length === 0, errors };
+}
+
+/** Parse and validate a serialized graph. Returns { ok, graph?, errors }. */
+export function parseGraph(text) {
+  let g; try { g = JSON.parse(text); } catch (e) { return { ok: false, errors: [{ code: 'BAD_JSON', path: '', message: e.message }] }; }
+  const v = validateGraph(g);
+  return v.ok ? { ok: true, graph: g, errors: [] } : { ok: false, errors: v.errors };
+}
+
+/** Bring an older-minor graph to this version. A different major is refused: there is no silent best-effort. */
+export function migrateGraph(g) {
+  const m = typeof g?.schemaVersion === 'string' ? /^(\d+)\.(\d+)\.(\d+)$/.exec(g.schemaVersion) : null;
+  if (!m || g.schema !== SEMANTIC_GRAPH_SCHEMA) return { ok: false, reason: 'not a semantic graph' };
+  if (Number(m[1]) !== SUPPORTED_MAJOR) return { ok: false, reason: `major ${m[1]} has no migration path to ${SEMANTIC_GRAPH_VERSION}` };
+  return { ok: true, graph: { ...g, schemaVersion: SEMANTIC_GRAPH_VERSION }, migrated: g.schemaVersion !== SEMANTIC_GRAPH_VERSION };
+}
+
+// ---- builder ----------------------------------------------------------------------------------------------------------------
+
+const exprText = (e) => {
+  if (!e || typeof e !== 'object') return '';
+  switch (e.kind) {
+    case 'ident': return e.name;
+    case 'member': return `${exprText(e.object)}.${e.prop ?? '[]'}`;
+    case 'call': return `${exprText(e.callee)}(...)`;
+    case 'literal': return JSON.stringify(e.value);
+    default: return `<${e.kind || 'unknown'}>`;
+  }
+};
+const originKindOf = (e, params) => {
+  if (!e) return 'unknown';
+  if (e.kind === 'ident') return params.includes(e.name) ? 'parameter' : 'identifier';
+  if (e.kind === 'call') return 'call-result';
+  if (e.kind === 'literal') return 'literal';
+  if (e.kind === 'member') return 'member';
+  if (e.kind === 'binary' || e.kind === 'tpl') return 'concat';
+  if (e.kind === 'object') return 'object';
+  if (e.kind === 'array') return 'array';
+  if (e.kind === 'function-value') return 'function';
+  return 'unknown';
+};
+const loc = (file, line) => ({ file, line: Number.isInteger(line) ? line : 0, column: null, locationPrecision: 'line' });
+const OBSERVED = { tier: 'observed', basis: 'read directly from the Layer-1 IR' };
+const UNRESOLVED = { tier: 'unresolved', basis: 'the IR holds no resolved target for this call' };
+
+function memberChain(e) {
+  const path = [];
+  let cur = e;
+  while (cur && cur.kind === 'member') { path.unshift(cur.prop ?? '[]'); cur = cur.object; }
+  return cur && cur.kind === 'ident' ? { base: cur.name, path } : null;
+}
+function walkExprs(e, visit) {
+  if (!e || typeof e !== 'object') return;
+  visit(e);
+  for (const k of ['object', 'callee', 'left', 'right', 'test', 'cons', 'alt']) if (e[k]) walkExprs(e[k], visit);
+  for (const k of ['args', 'parts', 'elements', 'values']) if (Array.isArray(e[k])) e[k].forEach((x) => walkExprs(x, visit));
+  if (Array.isArray(e.props)) e.props.forEach((p) => walkExprs(p?.value ?? p, visit));
+}
+
+/**
+ * @param {{perFile:object, callGraph?:object}} projectIR the object `buildProjectIR` returns
+ * @param {{engineVersion?:string}} [meta]
+ */
+export function buildSemanticGraph(projectIR, meta = {}) {
+  const g = Object.fromEntries(ENTITY_LISTS.map((k) => [k, []]));
+  const ordinal = new Map();
+  const next = (key) => { const n = ordinal.get(key) ?? 0; ordinal.set(key, n + 1); return n; };
+  const symByQid = new Map();
+  const files = Object.keys(projectIR?.perFile || {}).sort();
+
+  // pass 1: symbols
+  for (const file of files) {
+    const pf = projectIR.perFile[file];
+    for (const fn of pf.functions || []) {
+      const isModule = fn.name === '<module>';
+      const key = `${file}|${stripLine(fn.qid)}`;
+      const id = `sym:${h16(['symbol', file, stripLine(fn.qid), next(`sym|${key}`)])}`;
+      symByQid.set(fn.qid, id);
+      g.symbols.push({ id, kind: isModule ? 'module' : 'function', name: fn.name, qid: stripLine(fn.qid), parent: null, params: [...(fn.params || [])], ...loc(file, fn.line), confidence: OBSERVED });
+    }
+  }
+  // function-by-name index for DIRECT same-file resolution only; anything else stays unresolved (cross-file resolution is E2-02)
+  const byFileName = new Map();
+  for (const file of files) for (const fn of projectIR.perFile[file].functions || []) if (fn.name !== '<module>') { const k = `${file}|${fn.name}`; byFileName.set(k, byFileName.has(k) ? null : symByQid.get(fn.qid)); }
+
+  // pass 2: call sites, origins, field accesses, allocations
+  for (const file of files) {
+    for (const fn of projectIR.perFile[file].functions || []) {
+      const symId = symByQid.get(fn.qid);
+      const params = fn.params || [];
+      const originFor = (expr, variable, line) => {
+        const kind = originKindOf(expr, params);
+        const o = { id: `orig:${h16(['origin', symId, variable, kind, exprText(expr), next(`orig|${symId}|${variable}|${kind}|${exprText(expr)}`)])}`, symbol: symId, variable, kind, text: exprText(expr), ...loc(file, line), confidence: kind === 'unknown' ? { tier: 'unresolved', basis: 'the IR could not model this expression' } : OBSERVED };
+        g.valueOrigins.push(o);
+        return o.id;
+      };
+      const field = (expr, mode, line) => {
+        const mc = memberChain(expr);
+        if (!mc || !mc.path.length) return;
+        g.fieldAccesses.push({ id: `field:${h16(['field', symId, mc.base, mc.path, mode, next(`field|${symId}|${mc.base}|${mc.path.join('.')}|${mode}`)])}`, symbol: symId, base: mc.base, path: mc.path, mode, ...loc(file, line), confidence: OBSERVED });
+      };
+      const alloc = (expr, line) => {
+        const kind = expr.kind === 'object' ? 'object' : expr.kind === 'array' ? 'array' : expr.kind === 'function-value' ? 'function' : null;
+        if (!kind) return;
+        g.allocations.push({ id: `alloc:${h16(['alloc', symId, kind, next(`alloc|${symId}|${kind}`)])}`, symbol: symId, kind, ...loc(file, line), confidence: OBSERVED });
+      };
+      for (const c of fn.calls || []) {
+        const calleeText = c.callee;
+        const direct = byFileName.get(`${file}|${calleeText}`) || null;
+        const args = (c.args || []).map((a, index) => { walkExprs(a, (x) => { if (x.kind === 'member') field(x, 'read', c.line); alloc(x, c.line); }); return { index, origin: originFor(a, `arg:${calleeText}:${index}`, c.line) }; });
+        g.callSites.push({ id: `call:${h16(['call', symId, calleeText, next(`call|${symId}|${calleeText}`)])}`, caller: symId, calleeText, callee: direct, resolution: direct ? 'resolved' : 'unresolved', args, ...loc(file, c.line), confidence: direct ? { tier: 'inferred', basis: 'a function of this name exists in the same file' } : UNRESOLVED });
+      }
+      const callFromExpr = (x, line) => {
+        const calleeText = exprText(x.callee).replace(/\(\.\.\.\)$/, '');
+        const direct = x.callee?.kind === 'ident' ? (byFileName.get(`${file}|${calleeText}`) || null) : null;
+        const args = (x.args || []).map((a, index) => ({ index, origin: originFor(a, `arg:${calleeText}:${index}`, line) }));
+        g.callSites.push({ id: `call:${h16(['call', symId, calleeText, next(`call|${symId}|${calleeText}`)])}`, caller: symId, calleeText, callee: direct, resolution: direct ? 'resolved' : 'unresolved', args, ...loc(file, line), confidence: direct ? { tier: 'inferred', basis: 'a function of this name exists in the same file' } : UNRESOLVED });
+      };
+      // The CFG is the one structure every language's IR shares (`writes` exists for JavaScript only): assignment nodes carry { target, source, line }.
+      const assigns = Object.values(fn.cfg?.nodes || {}).filter((n) => n.kind === 'assign' && n.target).sort((x, y) => (x.line ?? 0) - (y.line ?? 0) || String(x.id ?? '').localeCompare(String(y.id ?? '')));
+      for (const d of assigns) {
+        const variable = String(d.target);
+        const line = d.line ?? fn.line;
+        originFor(d.source, variable, line);
+        // calls that appear INSIDE an assignment source (`const cmd = h.build(x)`) are not in fn.calls; they are call sites all the same
+        walkExprs(d.source, (x) => { if (x.kind === 'member') field(x, 'read', line); alloc(x, line); if (x.kind === 'call' && x.callee) callFromExpr(x, line); });
+        const mc = variable.includes('.') ? variable.split('.') : null;
+        if (mc) g.fieldAccesses.push({ id: `field:${h16(['field', symId, mc[0], mc.slice(1), 'write', next(`field|${symId}|${mc[0]}|${mc.slice(1).join('.')}|write`)])}`, symbol: symId, base: mc[0], path: mc.slice(1), mode: 'write', ...loc(file, line), confidence: OBSERVED });
+      }
+    }
+  }
+
+  // E2-07: service relationships are opt-in. A caller that ran dataflow/service-edges.js passes the result as `meta.serviceEdges`; HTTP and
+  // messaging relationships become `serviceBoundaries`, persistence relationships become `storageEdges`, and relationships with no counterpart
+  // are kept as boundaries with `to: null` and unresolved confidence. Without it both lists stay schema-only, as before.
+  const se = meta.serviceEdges && meta.serviceEdges.optedIn ? meta.serviceEdges : null;
+  if (se) {
+    const tier = (e) => (e === 'observed' ? 'observed' : e === 'inferred' ? 'inferred' : 'unresolved');
+    for (const e of se.edges) {
+      const list = e.kind === 'persistence' ? g.storageEdges : g.serviceBoundaries;
+      list.push({ id: `${e.kind === 'persistence' ? 'store' : 'svc'}:${e.id.slice('svcedge:'.length)}`, kind: e.kind, from: e.from, to: e.to, via: e.via, ...loc(e.from.file, e.from.line), evidence: e.evidence, confidence: { tier: tier(e.evidence), basis: e.basis } });
+    }
+    for (const u of se.unknown) g.serviceBoundaries.push({ id: `svc:${h16(['unknown', u.service, u.file, u.kind, u.reason])}`, kind: u.kind, from: { service: u.service, file: u.file, line: u.line }, to: null, via: null, ...loc(u.file, u.line), evidence: 'unknown', confidence: { tier: 'unresolved', basis: u.reason } });
+  }
+  const SCHEMA_ONLY = {
+    ...(se ? {} : { serviceBoundaries: 'opt-in: pass meta.serviceEdges (dataflow/service-edges.js) with two or more declared services; the IR itself carries no service-boundary facts', storageEdges: 'opt-in: pass meta.serviceEdges (dataflow/service-edges.js); the IR itself carries no persistence facts' }),
+    sanitizers: 'sanitizer decisions are made by the dataflow layer (sanitizer-gate.js), not recorded in the IR; they are folded in by E2-08',
+    guards: 'guard dominance is computed by dataflow/guard-dominance.js, not recorded in the IR; it is folded in by E2-08',
+  };
+  const REASON_POP = { serviceBoundaries: 'HTTP and messaging relationships between declared services, and the ones with no counterpart', storageEdges: 'tables one declared service writes and another reads', symbols: 'one per IR function and per file top level', callSites: 'every call recorded in an IR function, plus calls nested inside assignment sources', allocations: 'object, array and function-valued expressions in call arguments and assignments', fieldAccesses: 'member reads in arguments and assignments, and dotted writes', valueOrigins: 'every call argument and every assignment node in the CFG of a function' };
+  const coverage = {};
+  for (const k of ENTITY_LISTS) coverage[k] = SCHEMA_ONLY[k] ? { state: 'schema-only', reason: SCHEMA_ONLY[k] } : g[k].length ? { state: 'populated', reason: REASON_POP[k] } : { state: 'schema-only', reason: `no ${k} in this input` };
+  const limits = [
+    'columns are null: the IR carries line numbers only',
+    'a call resolves only to a same-file function of the same name; imports, re-exports and methods are unresolved until E2-02',
+    'heap, alias and closure facts are not in the IR, so field accesses are syntactic, not points-to results',
+  ];
+  // Dynamic constructs the analysis cannot resolve, per function (E2-03): the graph says where precision was given up, instead of leaving it implicit.
+  const dynamicFeatures = analysisLimits(projectIR).map((l) => ({ symbol: symByQid.get(`${l.qid}@${(projectIR.perFile[l.file].functions.find((f) => stripLine(f.qid) === l.qid) || {}).line}`) ?? null, file: l.file, line: l.line, kind: l.kind, detail: l.detail, effect: l.effect }));
+  return { schema: SEMANTIC_GRAPH_SCHEMA, schemaVersion: SEMANTIC_GRAPH_VERSION, producer: { layer: 'ir-v1', engineVersion: meta.engineVersion ?? null }, ...g, coverage, limits, dynamicFeatures };
+}

package/src/language/haskell-findings.js

@@ -15,6 +15,8 @@ export const HS_FAMILY_BY_CWE = Object.freeze({
   'CWE-89': 'sql-injection',
   'CWE-918': 'ssrf',
   'CWE-79': 'xss',
+  'CWE-601': 'open-redirect',
+  'CWE-94': 'code-injection',
 });
 
 export const isHaskellFile = (file) => typeof file === 'string' && HS_FILE.test(file);

package/src/language/haskell-guards.js

@@ -26,7 +26,7 @@ const IS_MEMBER = /^Data\.(?:Set|HashSet|Map|Map\.Strict|HashMap\.Strict)\.membe
 const NOT_MEMBER = /^Data\.(?:Set|HashSet|Map|Map\.Strict|HashMap\.Strict)\.notMember$/;
 const CHARCLASS = new Set(['Data.Char.isAlphaNum', 'Data.Char.isAlpha', 'Data.Char.isDigit', 'Data.Char.isAscii', 'isAlphaNum', 'isAlpha', 'isDigit']);
 
-const FAMILY_BY_CWE = { 'CWE-22': 'path', 'CWE-918': 'url', 'CWE-78': 'cmd', 'CWE-88': 'cmd', 'CWE-89': 'sql', 'CWE-79': 'xss', 'CWE-1427': 'prompt' };
+const FAMILY_BY_CWE = { 'CWE-22': 'path', 'CWE-918': 'url', 'CWE-78': 'cmd', 'CWE-88': 'cmd', 'CWE-89': 'sql', 'CWE-79': 'xss', 'CWE-601': 'redirect', 'CWE-94': 'code', 'CWE-1427': 'prompt' };
 
 const isStr = (e) => e && e.kind === 'literal' && typeof e.value === 'string';