@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-3bcd69ed73117d5a5954acfd240bd0f870ade6ca6fab6ce6ff255fbc3ce340aa  agentic-security.mjs
+40d6882dc7b5dbd62ac41f10cb01ec4e43fa42081dbcc0427553e0282748fedb  agentic-security.mjs

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.86.0",
-  "description": "Scanner engine for the agentic-security Claude Code plugin \u2014 SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
+  "version": "0.119.1",
+  "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
   "bin": {
@@ -27,7 +27,9 @@
     "src/",
     "bin/",
     "dist/",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "!**/.agentic-security",
+    "!**/.agentic-security/**"
   ],
   "engines": {
     "node": ">=24.0.0"
@@ -41,6 +43,10 @@
     "js-yaml": "^4.1.1",
     "safe-regex": "^2.1.1"
   },
+  "optionalDependencies": {
+    "web-tree-sitter": "0.20.8",
+    "tree-sitter-wasms": "0.1.13"
+  },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "@vercel/ncc": "^0.38.3"
@@ -50,17 +56,20 @@
     "lodash-es": "^4.18.1"
   },
   "scripts": {
-    "build": "ncc build bin/agentic-security.js -o dist --minify && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
-    "prepublishOnly": "npm run build && node -e \"const fs=require('fs');const cur=fs.existsSync('CHANGELOG.md')?fs.readFileSync('CHANGELOG.md','utf8'):'';const src=fs.readFileSync('../CHANGELOG.md','utf8');if(cur && cur!==src){console.error('scanner/CHANGELOG.md has local edits that differ from ../CHANGELOG.md.');console.error('Refusing to overwrite. Either commit the edit upstream first or rm scanner/CHANGELOG.md to accept the upstream copy.');process.exit(1);}fs.writeFileSync('CHANGELOG.md',src);\"",
-    "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
+    "build": "ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
+    "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs",
+    "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
     "test:smoke": "node --test test/smoke.test.js",
-    "test:sast": "node --test test/llm.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js",
-    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js",
-    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js",
+    "test:sast": "node --test test/llm.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
+    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js",
+    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js",
-    "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js",
+    "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js",
     "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js && node ../scripts/lint-command-descriptions.mjs",
+    "test:eval": "node --test test/independent-eval.test.js",
+    "eval:independent": "node ../bench/independent-eval/runner.mjs",
+    "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",
     "smoke": "node bin/agentic-security.js scan test/fixtures/vulnerable-js",
     "prebench": "npm run build",
     "bench": "node test/benchmark/bench.js",
@@ -70,6 +79,8 @@
     "bench:llm-goats": "node test/benchmark/llm-goats/bench-llm-goats.js",
     "bench:cve-replay": "node ../bench/cve-replay/runner.mjs",
     "bench:cve-replay:ci": "node ../bench/cve-replay/runner.mjs --ci",
+    "bench:cve-replay:check": "node ../bench/cve-replay/runner.mjs --check-baseline",
+    "bench:cve-replay:update-baseline": "node ../bench/cve-replay/runner.mjs --update-baseline",
     "bench:bigquery:smoke": "node ../bench/bigquery-github/bin/run-cycle.mjs --smoke",
     "bench:bigquery": "node ../bench/bigquery-github/bin/run-cycle.mjs",
     "bench:agent-tasks": "node ../bench/agent-tasks/security-fixer/runner.mjs",

package/src/dataflow/CLAUDE.md

@@ -5,23 +5,34 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
 ## Scope — what we actually model
 
 - **Intra-procedural field-sensitive taint** with access-path lattice (`access-paths.js`). `user.email` is distinguishable from `user.password`.
-- **k=1 monovariant interprocedural return-taint.** `SummaryCache` (`summaries.js`) holds one summary per function under empty entry state. At an assign-from-call site, if the resolved callee's summary says `returnTainted`, the LHS becomes tainted. Premortem-derived; was previously dead code.
+- **Value-context-sensitive interprocedural taint (FR-SEM-2).** `SummaryCache` (`summaries.js`) holds a distinct summary per distinct entry-taint-state. A pre-pass computes the empty-entry base for every function; call sites then lazily compute the summary under their actual tainted-arg context (at both assign-from-call and plain-call sites) so a helper that is clean with clean args but tainted with user input is detected per call site. Bounded by a per-function context cap (`AGENTIC_SECURITY_KCFA_MAX_CONTEXTS`, default 16; 0 = monovariant). Over the cap → reuse the empty-entry summary.
 - **Catalog-driven source/sink/sanitizer matching.** Add entries in `catalog.js`. Each entry: `kind` ∈ {source, sink, sanitizer}, plus language + framework + match shape. 200+ entries spanning Express/Flask/FastAPI/Django/Rails/PHP/Go-net-http/Gin/Echo.
 - **Path feasibility.** Constant-folds `if` conditions to prune unreachable branches.
 - **Per-flow source attribution.** Sources reported on a finding are the ones actually reaching the sink argument (via free-var matching in the sink expression), NOT the first source the worklist happened to see. Premortem-derived.
 
-## Scope — what we do NOT model (today)
+## Scope — now modelled (was previously listed as gaps; closed in v0.66)
 
-- **Arbitrary entry-taint-state context-sensitivity.** Each function gets ONE summary, computed under empty entry. A function that's pure when called with clean args but vulnerable when called with tainted args is modelled as the empty-state result. Track FR-SEM-2 to lift this.
-- **Mutated-parameter taint at call sites.** The `SummaryCache.applyAtCallSite` helper exists for it; the engine doesn't consult it yet. If you want a helper that mutates its argument (`Object.assign(target, tainted)`) to taint the caller's `target`, this is the modelling gap.
-- **Higher-order taint flow** — partial. `higher-order.js` propagates taint into `arr.map(fn)` / `promise.then(fn)` callbacks at the IR level, but the recorded `_higherOrderInvocations` aren't fed back into the worklist yet.
+- **Mutated-parameter taint at call sites.** `engine.js` consults `SummaryCache.applyAtCallSite` at both assign-from-call and plain-call sites: a callee that mutates a param (e.g. `Object.assign(target, tainted)`, `_.merge`) taints the caller's argument variable. Covered by `test/interproc-k2.test.js`.
+- **Higher-order taint flow.** `_higherOrderInvocations` recorded during `analyzeFunction` are consumed in `runTaintEngine`: the callback is resolved, analyzed with a tainted parameter, and its findings merged back into the caller (`_via: 'higher-order'`, capped at `HO_CAP`). Covered by `test/closure-capture.test.js` and `test/phase6-taint.test.js`.
+- **Recursion via fixed point.** `runTaintEngine` runs a multi-pass fixed-point loop (`MAX_FP_ITERS=3`) until the summary cache stabilizes, so recursive cycles and call chains converge instead of under-approximating on a single pass.
+
+## Scope — what we still do NOT model (today)
+
+- **Call-string (k>1) context-sensitivity.** Context is the *value* abstraction — which params are tainted at entry — not the call stack. Two call paths that reach a helper with the same tainted-arg shape share a summary. Entry-state granularity is also param-level, not arbitrary access paths (`f(obj)` with `obj.a` tainted ≡ `obj.b` tainted).
+- **Contexts beyond the per-function cap.** Once a function has been computed under `AGENTIC_SECURITY_KCFA_MAX_CONTEXTS` distinct tainted-arg shapes, further shapes fall back to the empty-entry summary (an under-approximation, bounded on purpose).
 - **Implicit flow.** `implicit-flow.js` exists for `if (tainted) { x = "yes" }` propagation but is conservative-by-default.
 
+## Precision: centralized SSRF/path guard recognition
+
+`engine.js` `dropGuardedFindings(findings, fc)` runs after all detectors and drops a CWE-918 (SSRF) finding when the sink window has a host allow/deny check (deny/allow-list, `getHost`/`hostname` comparison, RFC1918/`169.254.169.254` prefix check, `ipaddress`/`getaddrinfo`/`ssrf-req-filter`), or a CWE-22 (path) finding when the window has a containment guard (`basename`/`GetFileName`/`secure_filename`/`send_from_directory`, or canonicalize+`startsWith`). It's the single source of truth so every emitter (regex, structural, per-language flow, PY-SAST, CSHARP, GO) is treated uniformly. The window is **comment-stripped** (a "no allow-list / 169.254…" vuln comment must not read as a guard). Opt out: `AGENTIC_SECURITY_NO_GUARD_RECOGNITION=1`.
+
 ## Entry points
 
-- `runTaintEngine(perFileIR, callGraph, opts)` — the public entry. Called from `engine.js` when `AGENTIC_SECURITY_DEEP=1` (or auto-enabled outside CI).
+- `runTaintEngine(perFileIR, callGraph, opts)` — the public entry. Runs from `engine.js` when `AGENTIC_SECURITY_DEEP=1`. **R1 (PRD §5):** the CLI entry (`bin/agentic-security.js#cmdScan`) sets that env var by default for local/interactive scans (not in CI, and not when `--no-deep`/`AGENTIC_SECURITY_DEEP=0`), so the default `/scan --all` runs deep. In-process callers (tests, the cve-replay corpus) invoke `runScan()` directly without the CLI default and therefore stay deep-off unless they set the env var themselves (e.g. `test/deep-taint.test.js`).
 - `applyPathFeasibility` — constant-fold pass that runs before the worklist.
 - `annotateBackwardSlices` — backward-slice annotation for already-emitted findings.
+- `annotateProvenClean(findings, perFileIR)` (`proven-clean.js`) — proves a SQL sink is reached only through a parameterizer; sets `provenClean`. Wired by default in `runDeepAnalysis` (opt out: `AGENTIC_SECURITY_NO_PROOF_GATE=1`).
+- `annotateProofGate(findings)` (`proof-gate.js`) — the precision gate. Consolidates `provenClean` + `_provenUnreachable` into one `finding.proof = { verdict, reasons }` and applies a **recall-preserving demotion** (lowers `confidence` + `confidenceTier` + `exploitabilityTier`, never `severity`). Runs in `engine.js` after confidence/exploitability, before mitigation/composite-risk. Default on.
 
 ## Configuration / opt-in
 
@@ -29,6 +40,7 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
 - `AGENTIC_SECURITY_DEEP_TIMEOUT_MS` — global walltime budget (default 300_000).
 - `AGENTIC_SECURITY_DEEP_FN_LIMIT` — function-count budget (default 5000).
 - `AGENTIC_SECURITY_DEEP_IN_CI=1` — also enable in CI (off by default; CI runs are time-bounded).
+- `AGENTIC_SECURITY_KCFA_MAX_CONTEXTS` — distinct non-empty entry contexts kept per function (default 16; 0 = monovariant).
 
 ## Gotchas
 

package/src/dataflow/catalog.js

@@ -99,6 +99,15 @@ export const CATALOG = [
   { kind: 'sanitizer', id: 'js-String-coerce',       language: 'js', match: { type: 'call', callee: 'String'              }, effect: 'strip', appliesTo: ['mongo-operator'] },
   { kind: 'sanitizer', id: 'js-validator-escape',    language: 'js', match: { type: 'call', callee: 'escape'              }, effect: 'strip', appliesTo: ['xss'] },
   { kind: 'sanitizer', id: 'js-strip_tags',          language: 'js', match: { type: 'call', callee: 'stripTags'            }, effect: 'strip', appliesTo: ['xss'] },
+  // Schema-validation libraries (#7). Scoped to NoSQL/operator injection ONLY:
+  // validating that input matches a typed shape defeats operator injection
+  // (a `{$gt:''}` object can't satisfy `z.string()`). It does NOT sanitize the
+  // value for XSS/SQL/cmd — a validated string is still a payload — so these
+  // are deliberately NOT tagged for those families (doing so would cause false
+  // negatives). Only distinctive callees, to avoid colliding with JSON.parse.
+  { kind: 'sanitizer', id: 'js-zod-safeParse',     language: 'js', match: { type: 'call', callee: 'safeParse'         }, effect: 'strip', appliesTo: ['mongo-operator'] },
+  { kind: 'sanitizer', id: 'js-zod-parseAsync',    language: 'js', match: { type: 'call', callee: 'parseAsync'        }, effect: 'strip', appliesTo: ['mongo-operator'] },
+  { kind: 'sanitizer', id: 'js-class-validator',   language: 'js', match: { type: 'call', callee: 'validateOrReject'  }, effect: 'strip', appliesTo: ['mongo-operator'] },
 
   // ─── SOURCES (Python — Flask / FastAPI / Django) ──────────────────────────
   { kind: 'source', id: 'py-flask-request-args',   language: 'py', framework: 'flask',   match: { type: 'member', object: 'request', prop: 'args'    }, label: 'request.args' },
@@ -157,6 +166,21 @@ export const CATALOG = [
   { kind: 'source', id: 'go-buffalo-request',language:'go', framework:'buffalo',match: { type: 'member', object: 'c', prop: 'Request' }, label: 'c.Request (buffalo)' },
   { kind: 'source', id: 'go-gorilla-vars',  language: 'go', framework: 'gorilla',match: { type: 'call', callee: 'Vars' },        label: 'mux.Vars (gorilla)' },
 
+  // ─── SINKS (Go — database/sql) — R3 (PRD §5) ──────────────────────────────
+  // callee 'Query' is also a net/http SOURCE (r.URL.Query). The engine
+  // disambiguates by position — source at the assignment RHS, sink at a call
+  // with a tainted query argument — so coexistence is benign (a source call
+  // like r.URL.Query() has no tainted arg, so it never fires the sink).
+  { kind: 'sink', id: 'go-sql-query',    language: 'go', framework: 'database/sql', match: { type: 'call', callee: 'Query' },    argIndex: 0,
+    vuln: { name: 'SQL Injection (db.Query — Go)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use parameterized queries: db.Query("SELECT … WHERE id = $1", id). Never concatenate untrusted input into the SQL string.' } },
+  { kind: 'sink', id: 'go-sql-queryrow', language: 'go', framework: 'database/sql', match: { type: 'call', callee: 'QueryRow' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (db.QueryRow — Go)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use placeholders ($1 / ?) and pass args separately.' } },
+  { kind: 'sink', id: 'go-sql-exec',     language: 'go', framework: 'database/sql', match: { type: 'call', callee: 'Exec' },     argIndex: 0,
+    vuln: { name: 'SQL Injection (db.Exec — Go)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use parameterized statements: db.Exec("UPDATE t SET x=$1 WHERE id=$2", x, id).' } },
+
   // ─── SOURCES (Ruby — Rails / Sinatra) ─────────────────────────────────────
   { kind: 'source', id: 'rb-rails-params',  language: 'rb', framework: 'rails', match: { type: 'global', name: 'params' }, label: 'params (Rails)' },
   { kind: 'source', id: 'rb-rails-cookies', language: 'rb', framework: 'rails', match: { type: 'global', name: 'cookies' }, label: 'cookies (Rails)' },
@@ -738,22 +762,46 @@ function filterByProvenance(entries) {
   return list;
 }
 
-export function matchSource(memberExpr) {
-  // memberExpr is exprDesc: { kind: 'member', object: {kind:'ident',name}, prop }
-  if (!memberExpr || memberExpr.kind !== 'member') return null;
-  if (memberExpr.object?.kind !== 'ident') return null;
-  const k = `${memberExpr.object.name}.${memberExpr.prop}`;
-  const raw = MEMBER_INDEX.get(k);
-  if (!raw) return null;
-  const hits = filterByProvenance(raw);
-  if (!hits.length) return null;
-  return hits.find(h => h.kind === 'source') || null;
+export function matchSource(expr) {
+  if (!expr) return null;
+  // Member sources (req.query): the original path — unchanged.
+  if (expr.kind === 'member' && expr.object?.kind === 'ident') {
+    const raw = MEMBER_INDEX.get(`${expr.object.name}.${expr.prop}`);
+    if (raw) {
+      const hits = filterByProvenance(raw);
+      const s = hits.find(h => h.kind === 'source');
+      if (s) return s;
+    }
+  }
+  // R3 (PRD §5): CALL sources (r.FormValue(), r.URL.Query(), c.QueryParam()).
+  // matchSource previously handled only member reads, so Go's call-shaped
+  // sources were never recognized at the assignment RHS. Match by callee last
+  // segment (Go gives a dotted string; JS/Py a member/ident expr).
+  if (expr.kind === 'call') {
+    let cn = null;
+    if (typeof expr.callee === 'string') cn = expr.callee.includes('.') ? expr.callee.slice(expr.callee.lastIndexOf('.') + 1) : expr.callee;
+    else if (expr.callee && expr.callee.kind === 'member') cn = expr.callee.prop;
+    else if (expr.callee && expr.callee.kind === 'ident') cn = expr.callee.name;
+    if (cn) {
+      const raw = CALLEE_INDEX.get(cn);
+      if (raw) {
+        const hits = filterByProvenance(raw);
+        const s = hits.find(h => h.kind === 'source');
+        if (s) return s;
+      }
+    }
+  }
+  return null;
 }
 
 export function matchSinkOrSanitizer(calleeExpr) {
   if (!calleeExpr) return null;
   let calleeName = null;
-  if (calleeExpr.kind === 'ident') calleeName = calleeExpr.name;
+  // R3 (PRD §5): the Go IR (and other string-callee parsers) represent a call
+  // target as a dotted STRING ("db.Query") rather than a member expr. Match on
+  // the last segment so those languages' sinks/sanitizers are recognized too.
+  if (typeof calleeExpr === 'string') calleeName = calleeExpr.includes('.') ? calleeExpr.slice(calleeExpr.lastIndexOf('.') + 1) : calleeExpr;
+  else if (calleeExpr.kind === 'ident') calleeName = calleeExpr.name;
   else if (calleeExpr.kind === 'member') calleeName = calleeExpr.prop;
   if (!calleeName) return null;
   const raw = CALLEE_INDEX.get(calleeName);

package/src/dataflow/engine.js

@@ -39,6 +39,7 @@ import { aliasesForVar } from './points-to.js';
 import { higherOrderTaintFlow } from './higher-order.js';
 import { SummaryCache, entryStateFromCall } from './summaries.js';
 import { lookupBuiltinSummary } from './builtin-summaries.js';
+import { isImplicitFlowEnabled, buildImplicitContext, implicitAssignTarget, markImplicitTaint, createImplicitFinding } from './implicit-flow.js';
 
 // v0.70 #2 — addPath that also taints every alias of the variable.
 // When `target` is a dotted path like "a.x" and the root `a` has aliases
@@ -157,6 +158,13 @@ function exprIsSource(expr) {
     const hit = matchSource(expr);
     if (hit) return hit;
   }
+  // R3 (PRD §5): call-shaped sources (r.FormValue(), r.URL.Query(), c.Query()).
+  // Previously only member reads were recognized, so Go's call-style sources
+  // never tainted the assignment target. matchSource now resolves call sources.
+  if (expr.kind === 'call') {
+    const hit = matchSource(expr);
+    if (hit) return hit;
+  }
   if (expr.kind === 'member' && expr.object) {
     return exprIsSource(expr.object);
   }
@@ -215,7 +223,8 @@ function step(node, stateIn, callContext) {
       const calleeName = node.source && node.source.kind === 'call' && typeof node.source.callee === 'string'
         ? node.source.callee : null;
       if (target && calleeName && callContext._summaryCache && callContext._callGraph) {
-        const resolved = callContext._callGraph.resolve ? callContext._callGraph.resolve(calleeName) : null;
+        const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
+        const resolved = callContext._callGraph.resolve ? callContext._callGraph.resolve(calleeName, _callerFile) : null;
         const fn  = resolved && resolved.qid ? resolved : null;
         const qid = resolved && (resolved.qid || resolved);
         if (typeof qid === 'string') {
@@ -322,8 +331,9 @@ function step(node, stateIn, callContext) {
       // Object.assign(target, tainted) → target becomes tainted in caller.
       if (callContext._summaryCache && callContext._callGraph
           && typeof node.callee === 'string') {
+        const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
         const resolved = callContext._callGraph.resolve
-          ? callContext._callGraph.resolve(node.callee) : null;
+          ? callContext._callGraph.resolve(node.callee, _callerFile) : null;
         const fn  = resolved && resolved.qid ? resolved : null;
         const qid = resolved && (resolved.qid || resolved);
         if (typeof qid === 'string' && fn && Array.isArray(fn.params)) {
@@ -331,7 +341,31 @@ function step(node, stateIn, callContext) {
           const entry = paramNames.length
             ? entryStateFromCall(paramNames, node.args || [], state)
             : new Set();
-          const sum = callContext._summaryCache.get(qid, entry);
+          let sum = callContext._summaryCache.get(qid, entry);
+          // FR-SEM-2: context-sensitive lazy compute at the plain-call site,
+          // mirroring the assign-call site. On a miss for a NON-empty entry,
+          // compute the callee's summary UNDER that tainted-arg context so a
+          // param mutated only when called with user input is detected here
+          // too (not just when the call's result is assigned). Bounded by the
+          // SummaryCache context cap.
+          if (!sum && entry.size && fn && fn.cfg) {
+            sum = callContext._summaryCache.compute(qid, entry, () => {
+              const inner = {
+                _findings: [], _taintSources: [], _returnTainted: false,
+                _stack: new Set(), deadlineMs: callContext.deadlineMs,
+                _summaryCache: callContext._summaryCache,
+                _callGraph: callContext._callGraph,
+                _mutatedParamsOut: new Set(),
+              };
+              try { analyzeFunction(fn, entry, inner); } catch {}
+              return {
+                returnTainted: !!inner._returnTainted,
+                mutatedParams: inner._mutatedParamsOut || new Set(),
+                taintedGlobals: new Set(),
+                findings: [],
+              };
+            });
+          }
           if (sum && sum.mutatedParams && sum.mutatedParams.size) {
             const mutated = callContext._summaryCache.applyAtCallSite(
               sum, paramNames, node.args || [], state);
@@ -357,6 +391,20 @@ function step(node, stateIn, callContext) {
           });
         }
       }
+      // R4 (PRD §5): array-element taint. A mutating array method (push/unshift/
+      // splice/fill/copyWithin) called with a tainted argument taints the
+      // receiver array; an index read (a[0] → access path "a.0") is then covered
+      // by the receiver prefix. Object-property taint already flows via the
+      // access-path lattice — this closes the array case.
+      if (node.callee && node.callee.kind === 'member' && typeof node.callee.prop === 'string'
+          && /^(?:push|unshift|splice|fill|copyWithin)$/.test(node.callee.prop)
+          && Array.isArray(argTaints) && argTaints.some(Boolean)) {
+        // Mutate the state Set IN PLACE (the binding is const; the call case
+        // returns this same Set ref). Avoids touching the unrelated mutated-param
+        // paths in this case, keeping the blast radius to array-element taint only.
+        const _arrRecv = accessPathOf(node.callee.object);
+        if (_arrRecv) state.add(_arrRecv);
+      }
       if (cat) {
         for (const e of cat) {
           if (e.kind === 'sink' && (
@@ -467,6 +515,11 @@ function step(node, stateIn, callContext) {
 // control flow) can otherwise hold past the global timeout.
 function analyzeFunction(fn, entryState, callContext) {
   const nodes = fn.cfg.nodes;
+  // R2 (PRD §5): set the call-string caller context to THIS function while its
+  // worklist computes callee summaries (so a callee is keyed by its caller).
+  // No-op for the key unless AGENTIC_SECURITY_KCFA_CALLSTRING=1. Restored below.
+  const _prevCallerCtx = (callContext && callContext._summaryCache && callContext._summaryCache.setCallerContext)
+    ? callContext._summaryCache.setCallerContext(fn.qid) : undefined;
   const work = [];
   const inStates = new Map();
   const outStates = new Map();
@@ -509,6 +562,47 @@ function analyzeFunction(fn, entryState, callContext) {
     }
   }
 
+  // R4 (PRD §5) — implicit / control-dependence flow. OPT-IN (default OFF, see
+  // isImplicitFlowEnabled). Post-pass over the converged CFG: a sink reached
+  // INSIDE a tainted-condition branch can leak information even when its
+  // argument is constant or only implicitly tainted (a var assigned in that
+  // branch). Findings carry implicit:true + capped confidence.
+  if (isImplicitFlowEnabled() && fn.cfg) {
+    try {
+      const union = new Set();
+      for (const s of inStates.values()) for (const p of s) union.add(p);
+      const ictx = buildImplicitContext(fn.cfg, (expr) => exprTaint(expr, union));
+      // Mark vars assigned inside a tainted branch as implicit-tainted.
+      let implicitState = new Set();
+      for (const [nid, ctx] of ictx) {
+        const t = implicitAssignTarget(nodes[nid], ctx);
+        if (t) implicitState = markImplicitTaint(implicitState, t);
+      }
+      // A sink in a tainted branch whose arg is implicit-tainted (or constant)
+      // — and NOT already explicitly tainted (the normal pass covers that).
+      for (const [nid, ctx] of ictx) {
+        const node = nodes[nid];
+        if (!node || node.kind !== 'call') continue;
+        const cat = matchSinkOrSanitizer(node.callee);
+        const sink = cat && cat.find((e) => e.kind === 'sink');
+        if (!sink) continue;
+        const inS = inStates.get(nid) || new Set();
+        if ((node.args || []).some((a) => exprTaint(a, inS))) continue;
+        const argRefsImplicit = (node.args || []).some((a) => {
+          const ap = accessPathOf(a); return ap && isCoveredBy(implicitState, `implicit:${ap}`);
+        });
+        const allConst = (node.args || []).length > 0 && (node.args || []).every((a) => a && a.kind === 'literal');
+        if (argRefsImplicit || allConst) {
+          callContext._findings.push({
+            ...createImplicitFinding(node, ctx.conditionLabel),
+            _funcQid: fn.qid, sinkId: sink.id,
+            cwe: (sink.vuln && sink.vuln.cwe) || 'CWE-200',
+          });
+        }
+      }
+    } catch { /* implicit flow is best-effort + opt-in */ }
+  }
+
   const exit = outStates.get(fn.cfg.exit) || new Set();
   // v0.66 — record which params are tainted at function exit so the
   // caller's applyAtCallSite can propagate that mutated taint back. We
@@ -520,6 +614,10 @@ function analyzeFunction(fn, entryState, callContext) {
       if (isCoveredBy(exit, p)) callContext._mutatedParamsOut.add(p);
     }
   }
+  // R2: restore the caller context for the enclosing function's analysis.
+  if (_prevCallerCtx !== undefined && callContext && callContext._summaryCache && callContext._summaryCache.setCallerContext) {
+    callContext._summaryCache.setCallerContext(_prevCallerCtx);
+  }
   return exit;
 }
 
@@ -685,7 +783,7 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
       if (Date.now() > deadlineMs) break;
       const inv = hoInvocations[hi];
       if (!inv.callee || !inv.taintedParam) continue;
-      const resolved = callGraph.resolve ? callGraph.resolve(inv.callee) : null;
+      const resolved = callGraph.resolve ? callGraph.resolve(inv.callee, fn && fn.file) : null;
       const cbFn = resolved && resolved.qid ? resolved : null;
       if (!cbFn || !cbFn.params || !cbFn.params.length) continue;
       const cbEntry = new Set([cbFn.params[inv.paramIndex || 0]]);
@@ -723,7 +821,10 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
         cwe: f.cwe,
         remediation: f.remediation,
         parser: 'IR-TAINT',
-        confidence: 0.75,
+        // R4 implicit-flow: preserve the implicit flag + its capped confidence
+        // (a control-dependence finding, not an explicit data-flow one).
+        confidence: (f.implicit && typeof f.confidence === 'number') ? f.confidence : 0.75,
+        ...(f.implicit === true ? { implicit: true } : {}),
         source: f.trace && f.trace.length ? {
           file: fn.file,
           line: f.trace[0].line,

package/src/dataflow/implicit-flow.js

@@ -34,8 +34,10 @@
 import { addPath } from './access-paths.js';
 
 export function isImplicitFlowEnabled() {
-  if (process.env.AGENTIC_SECURITY_IMPLICIT_FLOW === '0') return false;
-  return true;
+  // OPT-IN (default OFF): implicit/control-dependence flow is famously noisy, so
+  // it must be explicitly requested. Findings carry implicit:true + capped
+  // confidence so the standard pipeline ranks them below explicit flows.
+  return process.env.AGENTIC_SECURITY_IMPLICIT_FLOW === '1';
 }
 
 /**

package/src/dataflow/index.js

@@ -1,5 +1,6 @@
 // Layer 2 entry point.
 import { runTaintEngine } from './engine.js';
+import { annotateProvenClean } from './proven-clean.js';
 import { CATALOG, matchSource, matchSinkOrSanitizer, _catalogSize } from './catalog.js';
 import { applyPathFeasibility } from './path-feasibility.js';
 import { SummaryCache, entryStateFromCall } from './summaries.js';
@@ -47,12 +48,17 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
       scanner: opts.scannerVersion || 'unknown',
       rules: opts.rulesDigest || `catalog:${_catalogSize()}`,
     };
+    // Compute current file hashes UNCONDITIONALLY — the first scan (and any
+    // scan after a version/rule invalidation) must persist a baseline so the
+    // NEXT scan has something to reuse. This previously lived inside the
+    // valid-state branch, so a cold cache never committed and incremental was
+    // a permanent no-op (the commit guard at the bottom keys on currentFileHashes).
+    currentFileHashes = {};
+    for (const [fp, content] of Object.entries(opts.fileContents)) {
+      currentFileHashes[fp] = hashFileContent(content);
+    }
     const valid = validateIncrementalState(priorState, currentVersion);
     if (valid.valid) {
-      currentFileHashes = {};
-      for (const [fp, content] of Object.entries(opts.fileContents)) {
-        currentFileHashes[fp] = hashFileContent(content);
-      }
       const diff = diffFileHashes(priorState.files || {}, currentFileHashes);
       const changedQids = new Set();
       // Map a changed file to the qids it owns. perFileIR exposes file→fns.
@@ -114,6 +120,13 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
   if (process.env.AGENTIC_SECURITY_BACKWARD_SLICE === '1') {
     findings = annotateBackwardSlices(findings, perFileIR, callGraph);
   }
+  // Roadmap #6 — flow-proof: prove SQL sinks reached only through a
+  // parameterizer (`provenClean`). Runs by default in the deep pass; it only
+  // touches IR-TAINT SQL findings and never drops anything. The proof-gate
+  // annotator (engine.js) consolidates this into the demotion verdict.
+  if (process.env.AGENTIC_SECURITY_NO_PROOF_GATE !== '1') {
+    try { findings = annotateProvenClean(findings, perFileIR); } catch { /* proof failure must not fail the scan */ }
+  }
   // v0.70 #6 — probabilistic / soft taint. Walks each finding's trace +
   // chain, multiplies (1 - effectiveness) across sanitizers, demotes
   // below-threshold findings to lower severity (never drops).

package/src/dataflow/proof-gate.js

@@ -0,0 +1,100 @@
+// Proof-gate precision pass — roadmap item #6 ("perfect multi-language SAST").
+//
+// The engine produces two INDEPENDENT flow-proof signals that, until now,
+// were either informational-only or wired in isolation:
+//
+//   f.provenClean        (proven-clean.js)   — every reaching path to a SQL
+//                                              sink passes a parameterizer.
+//   f._provenUnreachable (exploit-prover.js) — a sanitizer on the path emits
+//                                              output that cannot contain the
+//                                              vuln family's metacharacters.
+//
+// This pass consolidates them into ONE verdict per finding and applies a
+// precision demotion — the central idea of the precision gate:
+//
+//   "Report only provably-feasible flows. A flow we can PROVE is clean or
+//    infeasible is demoted, not dropped — the auditor still sees it, and a
+//    severity-based CI gate still fires, but it stops dominating the risk
+//    ranking and stops tripping confidence filters."
+//
+// Output stamped on every finding:
+//   f.proof = { verdict, reasons[] }
+//     verdict ∈ 'proven-clean' | 'proven-infeasible' | 'feasible' | 'unproven'
+//   f.proofGated = true            (only when a demotion was applied)
+//
+// Demotion policy is deliberately RECALL-PRESERVING:
+//   - lower `confidence` by DEMOTE_FACTOR and recompute its tier,
+//   - drop `confidenceTier` / `exploitabilityTier` one notch,
+//   - record an `exploitabilityFactors` breadcrumb,
+//   - leave `severity` UNTOUCHED. The proofs here are heuristic (path-
+//     existence / regex-exclusion), so they must never hide a finding from a
+//     severity gate. Confidence/exploitability are the safe levers.
+
+const DEMOTE_FACTOR = 0.4;
+
+// Tier ladders, lowest → highest. demoteTier moves one step down.
+const CONFIDENCE_TIERS = ['very-low', 'low', 'medium', 'high'];
+const EXPLOITABILITY_TIERS = ['low', 'medium', 'high', 'critical'];
+
+function demoteTier(tier, ladder) {
+  const i = ladder.indexOf(tier);
+  if (i <= 0) return ladder[0];
+  return ladder[i - 1];
+}
+
+// Decide the proof verdict for a single finding from the upstream signals.
+export function verdictForFinding(f) {
+  if (f.provenClean === true) {
+    const sanitizers = (f.provenanceProof && f.provenanceProof.sanitizers) || [];
+    return { verdict: 'proven-clean', reason: sanitizers.length ? `parameterized via ${sanitizers.join(', ')}` : 'sql-parameterizer-on-path' };
+  }
+  if (f._provenUnreachable === true) {
+    return { verdict: 'proven-infeasible', reason: f._provenUnreachableReason || 'sanitizer-excludes-metacharacters' };
+  }
+  // A taint finding that reached a sink with attributed sources, for which we
+  // could NOT discharge a clean/infeasible proof, is "feasible" — the flows
+  // a precision-gated report should lead with. Non-taint findings are simply
+  // outside the proof model → "unproven" (no demotion, no claim).
+  if (f.parser === 'IR-TAINT') return { verdict: 'feasible', reason: 'reaches-sink, no clean/infeasible proof discharged' };
+  return { verdict: 'unproven', reason: 'no flow-proof applicable to this finding class' };
+}
+
+// Annotate findings in place. Returns the same array with a non-enumerable
+// `_proofGateStats` for benchmarking.
+export function annotateProofGate(findings, opts = {}) {
+  if (!Array.isArray(findings)) return findings;
+  const factor = typeof opts.demoteFactor === 'number' ? opts.demoteFactor : DEMOTE_FACTOR;
+  const stats = { gated: 0, feasible: 0, provenClean: 0, provenInfeasible: 0, unproven: 0 };
+
+  for (const f of findings) {
+    if (!f || typeof f !== 'object') continue;
+    const { verdict, reason } = verdictForFinding(f);
+    f.proof = { verdict, reasons: [reason] };
+
+    if (verdict === 'feasible') { stats.feasible++; continue; }
+    if (verdict === 'unproven') { stats.unproven++; continue; }
+
+    // proven-clean | proven-infeasible → recall-preserving demotion.
+    if (verdict === 'proven-clean') stats.provenClean++; else stats.provenInfeasible++;
+    // R13 (PRD §5): make "provably safe" a first-class, queryable verdict — not
+    // just a quiet confidence demotion. "We proved this can't fire" is a
+    // stronger, rarer claim than any confidence score, and lets the report
+    // optionally hide discharged findings (--hide-proven-safe).
+    f.provablySafe = true;
+
+    if (typeof f.confidence === 'number') {
+      f._confidenceBeforeProofGate = f.confidence;
+      f.confidence = Math.max(0.01, Number((f.confidence * factor).toFixed(4)));
+    }
+    if (f.confidenceTier) f.confidenceTier = demoteTier(f.confidenceTier, CONFIDENCE_TIERS);
+    if (f.exploitabilityTier) f.exploitabilityTier = demoteTier(f.exploitabilityTier, EXPLOITABILITY_TIERS);
+    if (Array.isArray(f.exploitabilityFactors)) f.exploitabilityFactors.push(`proof:${verdict}`);
+    f.proofGated = true;
+    stats.gated++;
+  }
+
+  Object.defineProperty(findings, '_proofGateStats', { value: stats, enumerable: false, configurable: true });
+  return findings;
+}
+
+export const _internals = { DEMOTE_FACTOR, CONFIDENCE_TIERS, EXPLOITABILITY_TIERS, demoteTier };