@clear-capabilities/agentic-security-scanner 0.185.0 → 0.186.1

package/src/dataflow/ir-cache.js

@@ -0,0 +1,268 @@
+// Cross-scan cache of parsed JavaScript / TypeScript IR (DAG-05, the stage the taint cache does not cover).
+//
+// The dependency-complete taint cache (incremental-session.js) removes most of the cost of the interprocedural
+// engine on a re-scan, and what is left is dominated by parsing every file to IR again. This module keeps one
+// record per source file so an unchanged file is read back instead of parsed. It changes the cost of building
+// the IR and never its content:
+//
+//   * A record is keyed by the SHA-256 of the file's path and text, the analyzer/parser digest (a change to any
+//     source under ir/, dataflow/, graph/ or language/, or to the bundle, invalidates every record) and the
+//     Babel versions the parse ran under. A different file text, parser or toolchain is a miss.
+//   * The IR numbers its CFG nodes from a process-global counter (`n123`). A restored file is given fresh ids
+//     from the same counter, in the same relative order, so an id is as unique across the process as one the
+//     parser made. Ids appear only in the fields remapped below; a file that holds an id anywhere else is
+//     never written.
+//   * A record is written only after the IR has been checked to survive JSON exactly: anything that would not
+//     (an undefined member, a non-finite number, a BigInt, a Map, an object with a foreign prototype, an id
+//     held in a field the remap does not know) is not cached, and that file is parsed every scan. Regular
+//     expressions, which JSON would turn into `{}`, are recorded by path and rebuilt on load.
+//   * Each record carries the SHA-256 of its payload; a truncated, edited or foreign file is a miss, never an
+//     error. Writes go to a temp file and are renamed into place.
+//
+// Scope: JavaScript and TypeScript only (the parser that owns the id counter). Every other language is parsed
+// as before. Trust boundary: the same as the rest of the incremental state under .agentic-security/incremental
+// (digests detect corruption; they are not a signature, so a hostile working tree that plants a consistent
+// record could substitute an IR; a planted record must also match the file's exact text and the analyzer digest).
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { createRequire } from 'node:module';
+
+import { reserveNodeIds } from '../ir/parser-js.js';
+import { analyzerDigest } from './dep-fingerprint.js';
+import { statePath, stateWritesEnabled } from '../posture/state-dir.js';
+
+const IR_CACHE_FORMAT = 'ir-cache/1';
+const ID_RE = /^n\d+$/;
+const ID_NUM = (s) => Number(s.slice(1));
+
+let _toolchain = null;
+function toolchainDigest() {
+  if (_toolchain) return _toolchain;
+  const parts = [IR_CACHE_FORMAT, analyzerDigest()];
+  try {
+    const req = createRequire(import.meta.url);
+    for (const pkg of ['@babel/core', '@babel/preset-react', '@babel/preset-typescript', '@babel/parser']) {
+      try { parts.push(`${pkg}@${req(`${pkg}/package.json`).version}`); } catch { parts.push(`${pkg}@unresolved`); }
+    }
+  } catch { parts.push('toolchain@unresolved'); }
+  _toolchain = crypto.createHash('sha256').update(parts.join('\n')).digest('hex');
+  return _toolchain;
+}
+
+const sha = (s) => crypto.createHash('sha256').update(s).digest('hex');
+
+// ── id handling ─────────────────────────────────────────────────────────────
+
+/** Every node id of a file's IR, or null when the IR holds something this cache cannot place. */
+function fileIds(ir) {
+  if (!ir || !Array.isArray(ir.functions)) return null;
+  const ids = [];
+  for (const fn of ir.functions) {
+    if (!fn || !fn.cfg || !fn.cfg.nodes || typeof fn.cfg.nodes !== 'object') return null;
+    for (const k of Object.keys(fn.cfg.nodes)) { if (!ID_RE.test(k)) return null; ids.push(k); }
+  }
+  return ids;
+}
+
+/**
+ * Give an IR read back from a record new ids. Throws when a reference names an id the file does not define:
+ * the caller treats that as a miss.
+ */
+function remapIds(ir) {
+  const ids = fileIds(ir);
+  if (!ids) throw new Error('unplaceable ids');
+  ids.sort((a, b) => ID_NUM(a) - ID_NUM(b));
+  const base = reserveNodeIds(ids.length);
+  const map = new Map();
+  ids.forEach((id, i) => map.set(id, `n${base + i + 1}`));
+  const m = (id) => { const v = map.get(id); if (v === undefined) throw new Error(`dangling id ${id}`); return v; };
+  for (const fn of ir.functions) {
+    const cfg = fn.cfg;
+    cfg.entry = m(cfg.entry);
+    cfg.exit = m(cfg.exit);
+    const entries = Object.entries(cfg.nodes);
+    for (const [k, node] of entries) {
+      if (node.id !== k) throw new Error('node id differs from its key');
+      node.id = m(node.id);
+      if (!Array.isArray(node.succ) || !Array.isArray(node.pred)) throw new Error('node without edges');
+      node.succ = node.succ.map(m);
+      node.pred = node.pred.map(m);
+    }
+    cfg.nodes = Object.fromEntries(entries.map(([k, node]) => [m(k), node]));
+    fn.returns = (fn.returns || []).map(m);
+    for (const c of (fn.calls || [])) c.site = m(c.site);
+    for (const list of Object.values(fn.writes || {})) for (const w of list) w.node = m(w.node);
+    for (const list of Object.values(fn.reads || {})) { for (let i = 0; i < list.length; i++) list[i] = m(list[i]); }
+  }
+  return ir;
+}
+
+/**
+ * The IR as text with every node id replaced by its rank among the file's ids, and regular expressions kept
+ * distinct from `{}`. Two IRs that differ only in the ids they were numbered with give the same text. Used by
+ * the tests that prove a restored IR equals a fresh parse.
+ */
+function canonical(ir) {
+  const ids = fileIds(ir);
+  if (!ids) return null;
+  ids.sort((a, b) => ID_NUM(a) - ID_NUM(b));
+  const rank = new Map(ids.map((id, i) => [id, `#${i}`]));
+  const walk = (v) => {
+    if (typeof v === 'string') return rank.has(v) ? rank.get(v) : v;
+    if (v instanceof RegExp) return { $re: [v.source, v.flags] };
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === 'object') {
+      const o = {};
+      for (const [k, x] of Object.entries(v)) o[rank.has(k) ? rank.get(k) : k] = walk(x);
+      return o;
+    }
+    return v;
+  };
+  return JSON.stringify(walk(ir));
+}
+
+/**
+ * One walk over a freshly parsed IR: is it exactly what JSON gives back (plus the regular expressions that are
+ * recorded by path), and does every node id sit in a field the remap knows? Returns { regexes } or null.
+ * `ids` is the set of the file's node ids.
+ */
+function analyze(ir, ids) {
+  const regexes = [];
+  let idLike = 0;
+  const trail = [];
+  const walk = (v) => {
+    switch (typeof v) {
+      case 'string': if (ids.has(v)) idLike++; return true;
+      case 'boolean': return true;
+      case 'number': return Number.isFinite(v);
+      case 'object': break;
+      default: return false; // undefined, function, symbol, bigint
+    }
+    if (v === null) return true;
+    if (v instanceof RegExp) {
+      if (v.lastIndex !== 0) return false;
+      regexes.push([trail.slice(), v.source, v.flags]);
+      return true;
+    }
+    if (Array.isArray(v)) {
+      if (Object.getPrototypeOf(v) !== Array.prototype) return false;
+      for (let i = 0; i < v.length; i++) {
+        if (!(i in v)) return false; // a hole
+        trail.push(i);
+        const ok = walk(v[i]);
+        trail.pop();
+        if (!ok) return false;
+      }
+      return true;
+    }
+    if (Object.getPrototypeOf(v) !== Object.prototype) return false;
+    for (const k of Object.keys(v)) {
+      if (ids.has(k)) idLike++;
+      trail.push(k);
+      const ok = walk(v[k]);
+      trail.pop();
+      if (!ok) return false;
+    }
+    return Object.getOwnPropertySymbols(v).length === 0;
+  };
+  if (!walk(ir)) return null;
+  // The ids the remap handles: entry, exit, each node's key and id and edges, returns, call sites, writes, reads.
+  let known = 0;
+  for (const fn of ir.functions) {
+    known += 2 + (fn.returns || []).length + (fn.calls || []).length;
+    for (const node of Object.values(fn.cfg.nodes)) {
+      if (!Array.isArray(node.succ) || !Array.isArray(node.pred)) return null;
+      known += 2 + node.succ.length + node.pred.length;
+    }
+    for (const list of Object.values(fn.writes || {})) known += list.length;
+    for (const list of Object.values(fn.reads || {})) known += list.length;
+  }
+  return idLike === known ? { regexes } : null;
+}
+
+/** Put the recorded regular expressions back where JSON left `{}` (before ids are remapped: the paths use the old ids). */
+function restoreRegexes(ir, regexes) {
+  for (const [trail, source, flags] of regexes) {
+    let holder = ir;
+    for (let i = 0; i < trail.length - 1; i++) holder = holder[trail[i]];
+    holder[trail[trail.length - 1]] = new RegExp(source, flags);
+  }
+}
+
+// ── the cache ───────────────────────────────────────────────────────────────
+
+/**
+ * Open the cache under `<state>/incremental/ir`. `read` / `write` select what it may do (a scan with state
+ * writes off still reads). Returns an object with `load`, `store` and `stats`.
+ */
+export function openIrCache(scanRoot, { read = true, write = stateWritesEnabled() } = {}) {
+  const dir = statePath(scanRoot, 'incremental', 'ir');
+  const stats = { hits: 0, misses: 0, stored: 0, skipped: 0, rejected: 0, loadMs: 0, storeMs: 0, bytesRead: 0, bytesWritten: 0 };
+  let tool = null;
+  const keyOf = (file, code) => sha(`${tool || (tool = toolchainDigest())}\0${file}\0${code}`);
+  const slotOf = (file) => path.join(dir, `${sha(file).slice(0, 40)}.ir.json`);
+
+  function readRecord(file, key) {
+    let text;
+    try { text = fs.readFileSync(slotOf(file), 'utf8'); } catch { return null; }
+    const nl = text.indexOf('\n');
+    if (nl < 0) return { bad: true };
+    let head;
+    try { head = JSON.parse(text.slice(0, nl)); } catch { return { bad: true }; }
+    if (!head || head.format !== IR_CACHE_FORMAT || head.key !== key) return null; // another file text or toolchain: a plain miss
+    const payload = text.slice(nl + 1);
+    stats.bytesRead += payload.length;
+    if (payload.length !== head.bytes || sha(payload) !== head.sha256 || !Array.isArray(head.regexes)) return { bad: true };
+    return { payload, regexes: head.regexes };
+  }
+
+  function load(file, code) {
+    if (!read) return undefined;
+    const t0 = performance.now();
+    try {
+      const key = keyOf(file, code);
+      const rec = readRecord(file, key);
+      if (!rec) { stats.misses++; return undefined; }
+      if (rec.bad) { stats.rejected++; return undefined; }
+      const parsed = JSON.parse(rec.payload);
+      restoreRegexes(parsed, rec.regexes);
+      const ir = remapIds(parsed);
+      if (!ir || ir.file !== file || !Array.isArray(ir.functions)) { stats.rejected++; return undefined; }
+      stats.hits++;
+      return ir;
+    } catch {
+      stats.rejected++;
+      return undefined;
+    } finally { stats.loadMs += performance.now() - t0; }
+  }
+
+  function store(file, code, ir) {
+    if (!write) return false;
+    const t0 = performance.now();
+    try {
+      const ids = fileIds(ir);
+      const found = ids ? analyze(ir, new Set(ids)) : null;
+      if (!found) { stats.skipped++; return false; }
+      const key = keyOf(file, code);
+      const payload = JSON.stringify(ir);
+      const head = JSON.stringify({ format: IR_CACHE_FORMAT, key, sha256: sha(payload), bytes: payload.length, file, regexes: found.regexes });
+      fs.mkdirSync(dir, { recursive: true });
+      const slot = slotOf(file);
+      const tmp = `${slot}.tmp-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
+      fs.writeFileSync(tmp, `${head}\n${payload}`, { mode: 0o600 });
+      fs.renameSync(tmp, slot);
+      stats.stored++;
+      stats.bytesWritten += payload.length;
+      return true;
+    } catch {
+      stats.skipped++;
+      return false;
+    } finally { stats.storeMs += performance.now() - t0; }
+  }
+
+  return { load, store, stats: () => ({ ...stats }), dir };
+}
+
+export const _internals = { remapIds, canonical, fileIds, analyze, restoreRegexes, toolchainDigest };

package/src/dataflow/privacy-taint.js

@@ -37,6 +37,7 @@ import {
   loadPrivacyTaxonomy, classifyFieldAgainst, severityForClasses,
 } from './privacy-taxonomy.js';
 import { loadPrivacySinkPolicy, isSinkPermitted, permittingRules } from './privacy-sink-policy.js';
+import { isListenCallbackParam } from '../sast/listen-bind-address.js';
 import { GOVERNANCE_FIELDS, governanceRecordFor } from './privacy-governance.js';
 
 const _BUILTIN_COMPILED = compileTaxonomy(DEFAULT_TAXONOMY);
@@ -119,8 +120,14 @@ export function annotatePrivacyTaint(perFileIR, opts = {}) {
     // (evidence locations must cover both ends of a flow, not just the
     // sink) without re-deriving it from piiFields by proximity guessing.
     const declLineByName = new Map();
+    const lineStart = [];
+    { let off = 0; for (const l of lines) { lineStart.push(off); off += l.length + 1; } }
     for (const d of ir.decls || []) {
       const classes = classifyFieldAgainst(d.name, compiled);
+      // The name alone does not make a binding personal data: the `address` a `listen` callback
+      // receives is the bound socket address (see sast/listen-bind-address.js).
+      if (classes.length && Number.isInteger(d.line) && lineStart[d.line - 1] !== undefined
+        && isListenCallbackParam(ir._content, lineStart[d.line - 1] + Math.max(0, (lines[d.line - 1] || '').indexOf(d.name)), d.name)) continue;
       if (classes.length) {
         taintedVars.set(d.name, classes);
         declLineByName.set(d.name, d.line);

package/src/engine.js

@@ -183,6 +183,10 @@ import { classifySecretCandidate as _entropyClassifySecret } from './sast/_secre
 // Phase 1 — precision-engineering posture modules.
 import { annotateConfidence, applyUnvalidatedPenalty } from './posture/confidence.js';
 import { backfillFindingDefaults } from './posture/finding-defaults.js';
+import { redirectTargetPinsOriginAt, redirectArgumentPinsOrigin } from './sast/redirect-target.js';
+import { responseReflectsRequestInputAt } from './sast/reflected-input.js';
+import { sendFileConfinedToRootAt } from './sast/send-file-root.js';
+import { insideFunctionBody } from './sast/init-scope.js';
 import { annotatePocs } from './posture/poc-generator.js';
 import { annotateExecutionProofs } from './posture/prove-findings.js';
 import { mineVulnHistory, annotateHistoricalRisk } from './posture/vuln-archaeology.js';
@@ -211,6 +215,7 @@ import { annotateNarration } from './posture/flow-narration.js';
 import { applyPathConstraints } from './posture/path-predicates.js';
 // Phase 3 (Sentinel-parity Layer 1 + 2) — IR + interprocedural taint engine.
 import { buildProjectIR, buildProjectIRAsync } from './ir/index.js';
+import { openIrCache } from './dataflow/ir-cache.js';
 import _v8 from 'node:v8';
 import _vm from 'node:vm';
 import { createStringMemo } from './util/string-memo.js';
@@ -1721,12 +1726,43 @@ export function dropGuardedFindings(findings, fileContents, onDrop = null) {
     const dropped = (kind) => { if (onDrop) onDrop(f, { kind, line, evidence: ctx._guardEvidence || null }); return false; };
     if (cwe === 'CWE-918' && _hasSsrfHostGuard(ctx)) return dropped('ssrf-host-guard');
     if (cwe === 'CWE-22' && _hasPathGuard(ctx)) return dropped('path-containment-guard');
+    if (cwe === 'CWE-22' && sendFileConfinedToRootAt(lines, line) === true) return dropped('send-file-root-confined');
     if (cwe === 'CWE-601' && _hasRedirectGuard(ctx)) return dropped('redirect-target-guard');
+    if (cwe === 'CWE-601' && redirectTargetPinsOriginAt(lines, line) === true) return dropped('redirect-origin-pinned');
     if (isXss && _hasXssOutputEncoding(ctx)) return dropped('xss-output-encoding');
     return true;
   });
 }
 
+// Identifiers a sink call's argument text actually READS as variables. Two things in the raw text are not
+// variable reads and used to be counted as such, which let an unrelated source variable of the same name
+// "reach" the sink: (1) words inside string literals ('Viewing user ' + ...), and (2) property names after
+// a dot (req.user.name reads `req`, not a local called `user` or `name`). Template substitutions
+// (`${x}`) stay, since they are code. Spread (`...x`) is a read of x and stays.
+function _usedIdentifiers(args){
+  const t=String(args);let code='';
+  for(let i=0;i<t.length;i++){
+    const c=t[i];
+    if(c==='"'||c==="'"){const q=c;i++;while(i<t.length&&t[i]!==q){if(t[i]==='\\')i++;i++;}code+=' ';}
+    else if(c==='`'){
+      i++;
+      while(i<t.length&&t[i]!=='`'){
+        if(t[i]==='\\'){i+=2;continue;}
+        if(t[i]==='$'&&t[i+1]==='{'){let d=1;i+=2;code+=' ';while(i<t.length&&d>0){if(t[i]==='{')d++;else if(t[i]==='}'){d--;if(d===0)break;}code+=t[i];i++;}i++;continue;}
+        i++;
+      }
+      code+=' ';
+    } else code+=c;
+  }
+  const out=new Set();
+  const re=/\b[a-zA-Z_]\w*\b/g;let m;
+  while((m=re.exec(code))){
+    let j=m.index-1;while(j>=0&&/\s/.test(code[j]))j--;
+    if(j>=0&&code[j]==='.'&&!(j>0&&code[j-1]==='.'))continue; // property name, not a variable read
+    out.add(m[0]);
+  }
+  return [...out];
+}
 function _detectSafeSinkShape(vuln, args, ctx){
   // 1.1: Reflected XSS / SSRF / Path Traversal / Open Redirect / Code Injection
   // sinks with empty or whitespace-only args cannot reflect user input — skip
@@ -1766,7 +1802,10 @@ function _detectSafeSinkShape(vuln, args, ctx){
   if(/Open Redirect/.test(vuln)) {
     // Static redirect targets (env var or string literal) are not user-controlled
     if (/^\s*process\.env\b/.test(args)) return 'static-redirect-target';
-    if (/^\s*['"`]/.test(args)) return 'static-redirect-target';
+    // A literal that fixes the origin ('/user/' + id) cannot be steered off-origin by the
+    // appended part; a literal that does not ('/' + x, '//' + x, '' + x) can, so the mere
+    // presence of a leading quote is not evidence of a static target.
+    if (/^\s*['"`]/.test(args) && redirectArgumentPinsOrigin(args)) return 'static-redirect-target';
   }
   if(/IDOR/.test(vuln)) {
     if (_IDOR_OWNERSHIP_RE.test(args)) return 'ownership-clause';
@@ -1919,11 +1958,11 @@ function performRegexAnalysis(fp,raw){if(_INTENTIONAL_VULN_PATH_RE.test(fp.repla
     const line=lineAt(cleaned,m.index);const lt=lines[line-1]||"";
     // FP-7: per-pattern surrounding-context gate — required call must appear in nearby lines
     if(sp.contextRe){const surround=lines.slice(Math.max(0,line-5),Math.min(lines.length,line+2)).join("\n");if(!sp.contextRe.test(surround))continue;}
-    const af=raw.substring(m.index,Math.min(raw.length,m.index+500));const am=af.match(/\(((?:[^()]|\([^()]*\)){0,400})\)/);const args=am?am[1]:"";const uv=[...new Set((args.match(/\b[a-zA-Z_]\w*\b/g)||[]).filter(v=>!["true","false","null","undefined","const","let","var","function","return","if","else","new","this","async","await","typeof","instanceof","void"].includes(v)&&v.length>1))];const safeShape=_detectSafeSinkShape(sp.vuln,args,{lines,line});sinks.push({type:sp.type,severity:sp.severity,vuln:sp.vuln,cwe:sp.cwe,stride:sp.stride,line,file:fp,snippet:lt.trim(),usedVars:uv,args:args.trim(),safeShape});}}
+    const af=raw.substring(m.index,Math.min(raw.length,m.index+500));const am=af.match(/\(((?:[^()]|\([^()]*\)){0,400})\)/);const args=am?am[1]:"";const uv=_usedIdentifiers(args).filter(v=>!["true","false","null","undefined","const","let","var","function","return","if","else","new","this","async","await","typeof","instanceof","void"].includes(v)&&v.length>1);const safeShape=_detectSafeSinkShape(sp.vuln,args,{lines,line});sinks.push({type:sp.type,severity:sp.severity,vuln:sp.vuln,cwe:sp.cwe,stride:sp.stride,line,file:fp,snippet:lt.trim(),usedVars:uv,args:args.trim(),safeShape});}}
   for(const sp of SANITIZER_PATTERNS){const re=new RegExp(sp.regex.source,sp.regex.flags);let m;while((m=re.exec(cleaned))){const line=lineAt(cleaned,m.index);const lt=lines[line-1]||"";const am=lt.match(/(?:const|let|var|)\s*(\w+)\s*=/)||lt.match(/(\w+)\s*=/);sanitizers.push({type:sp.type,line,file:fp,snippet:lt.trim(),outputVar:am?am[1]:null});}}
   const tv=new Map();for(const src of sources)if(src.variable)tv.set(src.variable,{source:src,path:[{type:"source",label:"Input: "+src.label,line:src.line,snippet:src.snippet}],sanitized:false,sanitizerType:null});
   for(let i=0;i<lines.length;i++){const lt=lines[i];const am=lt.match(/\b(?:const|let|var)\s+(\w+)(?:\s*:[^=]+?)?\s*=\s*(.+)/)||lt.match(/(?:const|let|var|)\s*(\w+)\s*=(?!=)\s*(.+)/);if(!am)continue;const[,dv,rhs]=am;if(tv.has(dv))continue;for(const[tn,ti]of tv){if(!new RegExp(`\\b${tn}\\b`).test(rhs))continue;let san=false,st=null;for(const s of sanitizers)if(s.line===i+1){san=true;st=s.type;break;}if(!san)for(const sp of SANITIZER_PATTERNS)if(new RegExp(sp.regex.source,sp.regex.flags).test(rhs)){san=true;st=sp.type;break;}tv.set(dv,{source:ti.source,path:[...ti.path,{type:san?"sanitizer":"propagation",label:san?`${st} on ${dv}`:`Assigned to "${dv}"`,line:i+1,snippet:lt.trim(),sanitized:san,sanitizerType:st}],sanitized:san,sanitizerType:st});break;}}
-  for(const sink of sinks){const safeShapeDowngrade=sink.safeShape?{isSan:true,sanType:sink.safeShape}:null;for(const src of sources){const sv=src.variable;let reached=false,pp=[],isSan=false,st=null;if(sv&&sink.usedVars.includes(sv)){const ti=tv.get(sv);if(ti){reached=true;pp=ti.path;isSan=!!ti.sanitized;st=ti.sanitizerType;}}if(!reached)for(const uv of sink.usedVars)if(tv.has(uv)){const ti=tv.get(uv);if(ti.source===src||ti.source.label.includes(src.label)){reached=true;pp=ti.path;isSan=!!ti.sanitized;st=ti.sanitizerType;break;}}if(!reached&&sv&&sink.line>=src.line&&sink.line-src.line<200&&((sink.args&&new RegExp(`\\b${sv}\\b`).test(sink.args))||lines.slice(Math.max(0,sink.line-10),sink.line+5).some(l=>{const re=new RegExp(`\\b${sv}\\b`);if(!re.test(l))return false;/* skip re-declarations: different binding, not a use */if(new RegExp(`\\b(?:const|let|var|function|def)\\s+${sv}\\b`).test(l))return false;return true;}))){reached=true;pp=[{type:"source",label:"Input: "+src.label,line:src.line,snippet:src.snippet}];
+  for(const sink of sinks){const safeShapeDowngrade=sink.safeShape?{isSan:true,sanType:sink.safeShape}:null;for(const src of sources){const sv=src.variable;let reached=false,pp=[],isSan=false,st=null;if(sv&&sink.usedVars.includes(sv)){const ti=tv.get(sv);if(ti){reached=true;pp=ti.path;isSan=!!ti.sanitized;st=ti.sanitizerType;}}if(!reached)for(const uv of sink.usedVars)if(tv.has(uv)){const ti=tv.get(uv);if(ti.source===src||ti.source.label.includes(src.label)){reached=true;pp=ti.path;isSan=!!ti.sanitized;st=ti.sanitizerType;break;}}if(!reached&&sv&&sink.line>=src.line&&sink.line-src.line<200&&((sink.args&&sink.usedVars.includes(sv))||lines.slice(Math.max(0,sink.line-10),sink.line+5).some(l=>{if(!_usedIdentifiers(l).includes(sv))return false;/* skip re-declarations: different binding, not a use */if(new RegExp(`\\b(?:const|let|var|function|def)\\s+${sv}\\b`).test(l))return false;return true;}))){reached=true;pp=[{type:"source",label:"Input: "+src.label,line:src.line,snippet:src.snippet}];
 // FP-3: only credit a sanitizer here if it has a captured outputVar AND that var
 // is what reaches the sink. A bare `escape(s);` (return discarded) does NOT count.
 for(const san of sanitizers){
@@ -2055,6 +2094,9 @@ const STRUCTURAL_VULN_PATTERNS=[
   // ── XSS / Output Encoding ─────────────────────────────────────────────────
   {regex:/res\s*\.\s*(?:send|write|end)\s*\([^;)]*(?:req\.|\.body\.|\.query\.|\.params\.)[^;)]{0,200}\)/g,
    type:"HTTP Response",vuln:"Reflected XSS (User Input in Response)",severity:"high",cwe:"CWE-79",stride:"Tampering",
+   // The call text mentions `req.`, which also carries session, user and app state. Fire only when the
+   // arguments reflect raw request INPUT (body/query/params/headers/...) that is not inside an HTML escaper.
+   predicate:(_m,ctx)=>{const r=responseReflectsRequestInputAt(ctx.lines,ctx.line);return r===false?{fire:false,reason:'no-raw-request-input'}:{fire:true};},
    fix:"Encode all user-supplied data with escapeHtml() before sending in responses"},
   {regex:/bypassSecurityTrust(?:Html|Script|Style|Url|ResourceUrl)\s*\(/g,
    type:"Angular Trust Bypass",vuln:"Angular DomSanitizer Bypass (XSS)",severity:"critical",cwe:"CWE-79",stride:"Tampering",
@@ -2292,6 +2334,9 @@ const STRUCTURAL_VULN_PATTERNS=[
   // ── #25: Synchronous blocking I/O in server context (DoS) ───────────────────
   {regex:/\b(?:fs\.readFileSync|fs\.writeFileSync|fs\.appendFileSync|fs\.readdirSync|fs\.statSync|fs\.existsSync|crypto\.pbkdf2Sync)\s*\(/g,
    type:"Blocking I/O",vuln:"Synchronous Blocking I/O (DoS Risk in Server Context)",severity:"medium",cwe:"CWE-400",stride:"Denial of Service",appliesTo:["server"],
+   // Only a blocking call made while serving stalls other work. At module/initialisation level (reading a TLS
+   // key or config once at startup) it delays startup once; nothing is waiting on the event loop yet.
+   predicate:(_m,ctx)=>ctx.haystack&&Number.isInteger(ctx.index)&&!insideFunctionBody(ctx.haystack,ctx.index)?{fire:false,reason:'module-init-scope'}:{fire:true},
    fix:"Replace with async equivalents: fs.promises.readFile(), fs.promises.stat(), util.promisify(crypto.pbkdf2)()"},
   // ── #26: Body parser without size limit (DoS — large payload / Billion Laughs) ─
   {regex:/(?:app|router)\s*\.\s*use\s*\(\s*express\s*\.\s*(?:json|urlencoded)\s*\(\s*\)\s*\)/g,
@@ -2524,7 +2569,7 @@ function scanStructuralVulns(fp, raw, _suppOut) {
       // FP-8: per-pattern predicate gate. If `predicate` returns {fire:false},
       // the finding is suppressed (and logged for --include-suppressed).
       if (typeof pat.predicate === 'function') {
-        const verdict = pat.predicate(m[0], { file: fp, line, snippet, lines, raw, cleanedNoise });
+        const verdict = pat.predicate(m[0], { file: fp, line, snippet, lines, raw, cleanedNoise, haystack, index: m.index });
         if (verdict && !verdict.fire) {
           _supp.push({vuln:pat.vuln, file:fp, line, snippet, reason:'predicate-pass:'+(verdict.reason||'ok')});
           continue;
@@ -2846,6 +2891,10 @@ function _pragmaSuppresses(pragma, f){
 // `line` property at all (the line survives only inside the id string, e.g.
 // `struct:app.js:22:Mass_Assignment`), so a false positive from one of those
 // cannot be silenced by a pragma and has to be fixed at the source instead.
+// UPDATE: `backfillFindingDefaults` now sets `line` from `sink.line` (then `source.line`) when a
+// detector left it off, so the line-less population is dependency and file-level findings. This
+// function already read `f.sink?.line`, so the backfill mostly makes the schema's `line` true rather
+// than newly enabling suppression.
 //
 // A file-scoped fallback was considered and REJECTED. Widening a line pragma to
 // a whole file would silently suppress findings the author never looked at, and
@@ -9466,7 +9515,15 @@ function _deterministicFileTimings(timings) {
   // import) for projects that contain no Java. `runFullScan` is already async,
   // so the await costs nothing structurally.
   const _hasJava = Object.keys(fc || {}).some(f => /\.java$/i.test(f));
-  const _buildIR = async () => (_hasJava ? await buildProjectIRAsync(fc) : buildProjectIR(fc));
+  // DAG-05: with the cross-scan cache on, an unchanged JavaScript/TypeScript file is read back from the IR cache
+  // instead of parsed again (dataflow/ir-cache.js; the content is the same, only the cost differs).
+  const _buildIR = async () => {
+    let irCache = null;
+    if (process.env.AGENTIC_SECURITY_INCREMENTAL === '1' && scanRoot) {
+      try { irCache = openIrCache(scanRoot); } catch { irCache = null; }
+    }
+    return _hasJava ? await buildProjectIRAsync(fc, { irCache }) : buildProjectIR(fc, { irCache });
+  };
   const _irStatsTarget = irStatsTarget();
   if (_irStatsTarget) {
     try {

package/src/ir/CLAUDE.md

@@ -267,6 +267,10 @@ down enterprise runners sometimes don't. Targets for retirement:
   interprocedural analysis, not just the older, vaguer "some constructs get
   dropped" cost.
 
+## Cross-scan IR cache and node ids
+
+`buildProjectIR(files, { irCache })` and `buildProjectIRAsync` accept an optional cache object (`dataflow/ir-cache.js`, opened by `engine.js` only when the cross-scan cache is on): an unchanged JavaScript or TypeScript file is read back instead of parsed, and a new parse is stored. With no cache the behaviour is exactly as before. Node ids (`n123`) come from a process-global counter in `parser-js.js`; a restored file is renumbered from the same counter through `reserveNodeIds(count)` so ids stay unique across the process. The ids sit in `cfg.entry`, `cfg.exit`, the `cfg.nodes` keys and each node's `id`/`succ`/`pred`, `fn.returns`, `fn.calls[].site`, `fn.writes[*][].node` and `fn.reads[*][]`; if a parser change puts an id anywhere else, the store-time check refuses to cache that file (it counts as `skipped` in the cache's `stats()`, and the file is parsed on every scan), so a new id-bearing field costs speed, never correctness. Name resolution in `callgraph.js` is answered from a name-to-candidates index (`qidsByName`, built in the order the per-file tables were built), so a name that no file defines is a lookup, not a scan of every file.
+
 ## Semantic graph (`semantic-graph.js`, engineering-excellence E2-01)
 
 An additive, typed, versioned view over this IR: `Symbol`, `CallSite`, `Allocation`, `FieldAccess`, `ValueOrigin`, plus the schema-only lists `ServiceBoundary`, `StorageEdge`, `Sanitizer`, `Guard`. Ids are content-derived and never include a line, so a blank line above a function moves no id. It reads the CFG (the one structure every language's IR shares; `writes` exists for JavaScript only). Nothing on the scan path imports it, so findings and `chain[]` cannot change; a test pins that. Columns are `null` (the IR has lines only) and say `locationPrecision: "line"`. Contract and the measured per-language construct matrix: `docs/engineering-excellence/IR_CONTRACT.md` (regenerate with `node scripts/engineering-excellence/ir-matrix.mjs`). Do not add a `site` field: IR site ids come from a process-global counter and are not stable across builds.

package/src/ir/callgraph.js

@@ -272,6 +272,32 @@ export function buildCallGraph(perFileIR, fileContents) {
   // `File::read` in C++): a fabricated cross-language edge, reached through
   // these older, coarser lookups BEFORE the qname-specific gate further down
   // is ever consulted.
+  // Name -> candidate qids across all files, in the order the file tables were
+  // built. The permissive lookups below used to walk EVERY file's table for each
+  // name that was not found locally, which is every call to a library method
+  // (`push`, `get`, `map`): thousands of names times hundreds of files. Visiting
+  // only the tables that hold the name, in the same order, returns the same
+  // first usable candidate.
+  const qidsByName = new Map();
+  for (const m of byNameInFile.values()) {
+    for (const [nm, q] of m) {
+      let l = qidsByName.get(nm);
+      if (!l) { l = []; qidsByName.set(nm, l); }
+      l.push(q);
+    }
+  }
+  // Re-export entries that can match a name (the key ends with `::<name>`, or the
+  // source name equals it), by index into the insertion order.
+  const reexportEntries = [...reexportMap];
+  const reexportCandidates = new Map();
+  if (reexportEntries.length) {
+    const addCand = (nm, i) => { let l = reexportCandidates.get(nm); if (!l) { l = new Set(); reexportCandidates.set(nm, l); } l.add(i); };
+    reexportEntries.forEach(([key, v], i) => {
+      let at = key.indexOf('::');
+      while (at >= 0) { addCand(key.slice(at + 2), i); at = key.indexOf('::', at + 1); }
+      addCand(v.sourceName, i);
+    });
+  }
   function isCrossLanguageUnsafe(qid, callerFile) {
     const cand = qid && functions.get(qid);
     if (!cand || !cand.qname) return false;
@@ -339,23 +365,25 @@ export function buildCallGraph(perFileIR, fileContents) {
         if (viaThis) return viaThis;
       }
     }
-    for (const m of byNameInFile.values()) {
-      if (m.has(name) && !isCrossLanguageUnsafe(m.get(name), callerFile)) return m.get(name);
+    for (const q of qidsByName.get(name) || []) {
+      if (!isCrossLanguageUnsafe(q, callerFile)) return q;
     }
     if (classMethods.has(name) && !isCrossLanguageUnsafe(classMethods.get(name), callerFile)) {
       return classMethods.get(name);
     }
     if (allowTailGuess && name.includes('.')) {
       const tail = name.split('.').slice(-1)[0];
-      for (const m of byNameInFile.values()) {
-        if (m.has(tail) && !isCrossLanguageUnsafe(m.get(tail), callerFile)) return m.get(tail);
+      for (const q of qidsByName.get(tail) || []) {
+        if (!isCrossLanguageUnsafe(q, callerFile)) return q;
       }
     }
     // Follow re-exports: if name was re-exported from another file, resolve there
-    for (const [key, { sourceName }] of reexportMap) {
-      if (key.endsWith(`::${name}`) || (sourceName === name)) {
-        for (const m of byNameInFile.values()) {
-          if (m.has(sourceName) && !isCrossLanguageUnsafe(m.get(sourceName), callerFile)) return m.get(sourceName);
+    const reCands = reexportCandidates.get(name);
+    if (reCands) {
+      for (const i of [...reCands].sort((a, b) => a - b)) {
+        const { sourceName } = reexportEntries[i][1];
+        for (const q of qidsByName.get(sourceName) || []) {
+          if (!isCrossLanguageUnsafe(q, callerFile)) return q;
         }
       }
     }

package/src/ir/index.js

@@ -132,10 +132,23 @@ function _parsePythonFiles(pyEntries) {
   return pyEntries.map(({ file, content }) => parsePythonFileRegex(file, content)).filter(Boolean);
 }
 
+// JavaScript / TypeScript parse through the optional cross-scan IR cache (dataflow/ir-cache.js): an unchanged
+// file is read back with fresh node ids instead of parsed again, and a new parse is stored. `irCache` is an
+// injected object ({load, store}); with none, this is exactly parseJsFile.
+function parseJsCached(file, code, irCache) {
+  if (!irCache) return parseJsFile(file, code);
+  const hit = irCache.load(file, code);
+  if (hit) return hit;
+  const ir = parseJsFile(file, code);
+  if (ir) irCache.store(file, code, ir);
+  return ir;
+}
+
 // Synchronous default — JS/TS + Python only. Engine.js calls this directly.
 // Java IR requires async import of java-parser; callers who want it can use
 // buildProjectIRAsync instead.
-export function buildProjectIR(fileContents) {
+export function buildProjectIR(fileContents, opts = {}) {
+  const irCache = opts && opts.irCache ? opts.irCache : null;
   const perFile = {};
   const pyBatch = [];
   const hsFiles = {};
@@ -148,7 +161,7 @@ export function buildProjectIR(fileContents) {
     // null — it does not zero out every other language's coverage.
     try {
       if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(file)) {
-        const ir = parseJsFile(file, code);
+        const ir = parseJsCached(file, code, irCache);
         if (ir) perFile[file] = ir;
       } else if (/\.hs$/i.test(file)) {
         hsFiles[file] = code;   // lowered together: Haskell resolution is whole-program (imports, re-exports)
@@ -238,7 +251,8 @@ function withHaskellCallGraph(cg, hsCg) {
 }
 
 // Async variant — includes Java IR via java-parser.
-export async function buildProjectIRAsync(fileContents) {
+export async function buildProjectIRAsync(fileContents, opts = {}) {
+  const irCache = opts && opts.irCache ? opts.irCache : null;
   const perFile = {};
   const pyBatch = [];
   const hsFiles = {};
@@ -247,7 +261,7 @@ export async function buildProjectIRAsync(fileContents) {
     // file can't abort IR construction for the whole project.
     try {
       if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(file)) {
-        const ir = parseJsFile(file, code);
+        const ir = parseJsCached(file, code, irCache);
         if (ir) perFile[file] = ir;
       } else if (/\.hs$/i.test(file)) {
         hsFiles[file] = code;

package/src/ir/parser-js.js

@@ -46,6 +46,16 @@ import presetTypescript from '@babel/preset-typescript';
 
 let _nodeIdSeq = 0;
 function nextNodeId() { return 'n' + (++_nodeIdSeq); }
+/**
+ * Reserve `count` consecutive node ids and return the sequence value before them
+ * (the first reserved id is `n<base + 1>`). A cached IR is given fresh ids from
+ * here, so an id is as unique across the whole process as one the parser made.
+ */
+export function reserveNodeIds(count) {
+  const base = _nodeIdSeq;
+  _nodeIdSeq += count;
+  return base;
+}
 
 // Round-5 lineage-engine finding, generalized in round 6: resolve a Babel
 // object-property-shaped node's key (`ObjectProperty` from either an

package/src/language/CLAUDE.md

@@ -96,6 +96,19 @@ Related, outside this directory: `dataflow/catalog-haskell.js`, `lineage/haskell
 - **Bounded**: `maxEvaluations`, `maxExprDepth`, `maxValueSize` are caps that surface as `truncated`, not as a guess.
 - Assumption stated, not proven: `lib` is nixpkgs' `lib` whenever the module declares a `lib` parameter and the file does not rebind it.
 
+## Declared option types (`nix-option-types.js`)
+
+`buildOptionTypeIndex` reads `mkOption { type = ...; }`, `mkEnableOption` and `mkPackageOption` declarations from the files in scope and
+records, per dotted option path, whether the declared type BOUNDS the value (bool, int and `ints.*`, port, float, number, package, a
+literal-word `enum`, and `nullOr`/`either`/`uniq` of bounded types). `nix-script-taint.js` `Evaluator.refine` turns a reference to a
+bounded option into a constant, so a shell interpolation of an `int` option is not an injection and a `bool` option called `forwardPass`
+is not a credential. Rules to keep: only options DECLARED in scope are known (an upstream option keeps its origin, except that the
+module-system convention for a package option, `package`/`finalPackage`/`fooPackage`, is a store path and a declared option of that name
+with an unbounded type is NOT); two declarations of one option are bounded only if both are; `str`, `path`, `lines`, `listOf`,
+`submodule` and anything computed are unbounded. `nix-secrets.js` skips documentation attributes of `mkOption` (`example`,
+`description`, `defaultText`; `default` is configuration and is not skipped) and does not treat a set-valued binding as a credential.
+Pinned both ways in `test/nix/nix-option-types.test.js`.
+
 ## Tests and benches
 
 | Scope | Command | Notes |