@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

package/src/dataflow/summaries.js

@@ -1,9 +1,18 @@
 // Function-summary cache for context-sensitive interprocedural taint.
 //
-// PRD §6.2: "k-CFA configurable per analysis." This module implements the
-// k=1 monovariant version — each function gets ONE summary per distinct
-// entry-taint-state, cached by hash. Higher k = exponential blowup we don't
-// pay yet.
+// PRD §6.2: "k-CFA configurable per analysis." This module is VALUE-context
+// sensitive (FR-SEM-2): a function gets a distinct summary PER distinct
+// entry-taint-state, cached by hash and computed lazily at the call sites
+// that need it (see engine.js). So a helper that is pure when called with
+// clean args but vulnerable when called with tainted args is modelled
+// correctly at each call site, not collapsed to one empty-entry result.
+//
+// To bound the blowup that per-context computation invites, the number of
+// distinct NON-empty contexts kept per function is capped
+// (`_maxContextsPerFn`, env `AGENTIC_SECURITY_KCFA_MAX_CONTEXTS`, default 16;
+// 0 = pure monovariant). Over the cap we reuse the empty-entry summary.
+// Call-string (k>1) sensitivity is still not modelled — context is the
+// value-abstraction (which params are tainted), not the call stack.
 //
 // A summary captures, given a set of tainted parameter names at function
 // entry, what the function does:
@@ -43,12 +52,42 @@ export class SummaryCache {
     this._stack = new Set(); // qids currently being analyzed (recursion guard)
     this._iter = 0;
     this._maxIter = 5000;
+    // FR-SEM-2 (roadmap #2): the engine computes a distinct summary per
+    // entry-taint-state (value-context sensitivity), computed lazily at call
+    // sites. To stop that from blowing up when a hot helper is reached under
+    // many distinct tainted-arg combinations, cap the number of NON-empty
+    // entry contexts kept per function. Over the cap we reuse the empty-entry
+    // (monovariant) summary — the conservative base the pre-pass computed.
+    //   AGENTIC_SECURITY_KCFA_MAX_CONTEXTS=N  (default 16)
+    //   ...=0  disables context-sensitivity (pure monovariant).
+    this._contextsByQid = new Map(); // qid → Set<stateHash> of computed contexts
+    const envCap = Number(process.env.AGENTIC_SECURITY_KCFA_MAX_CONTEXTS);
+    this._maxContextsPerFn = Number.isFinite(envCap) && envCap >= 0 ? envCap : 16;
+    this._contextCapHits = 0;
+    // R2 (PRD §5): bounded k=1 call-string sensitivity. OPT-IN (default OFF).
+    // When on, the cache key is extended with the immediate caller's qid, so two
+    // call paths reaching a helper with the SAME tainted-arg shape get DISTINCT
+    // summaries instead of sharing one (removes the over-merge that the pure
+    // value-context cache produces). Off by default → keys are byte-identical to
+    // before, so no behavior change for the shipped engine.
+    this._callString = process.env.AGENTIC_SECURITY_KCFA_CALLSTRING === '1';
+    this._callerCtx = null;
+  }
+
+  // Set the immediate-caller qid for call-string keying; returns the previous
+  // value so the engine can save/restore it around nested callee analysis.
+  setCallerContext(callerQid) {
+    const prev = this._callerCtx;
+    this._callerCtx = callerQid || null;
+    return prev;
   }
 
   _key(qid, taintedParams, receiverType) {
     // P1.2: when a receiver type is provided, extend the cache key with
     // its hash. Backward-compatible: no receiverType → same key as before.
-    const base = `${qid}::${_hashState(taintedParams)}`;
+    let base = `${qid}::${_hashState(taintedParams)}`;
+    // R2: append the caller qid when call-string sensitivity is enabled.
+    if (this._callString && this._callerCtx) base = `${base}@${this._callerCtx}`;
     if (!receiverType) return base;
     return `${base}::${hashReceiverType(receiverType)}`;
   }
@@ -77,6 +116,24 @@ export class SummaryCache {
       const cached = this._cache.get(k);
       if (!cached._recursive) return cached;
     }
+    // Context cap (FR-SEM-2). Empty entry is always allowed — it's the base
+    // summary the pre-pass computes for every function. For a NON-empty
+    // context that's new and over budget, reuse the empty-entry summary
+    // instead of computing a fresh one.
+    const stateHash = _hashState(taintedParams);
+    if (stateHash !== 'empty') {
+      let ctxs = this._contextsByQid.get(qid);
+      if (!ctxs) { ctxs = new Set(); this._contextsByQid.set(qid, ctxs); }
+      if (!ctxs.has(stateHash) && ctxs.size >= this._maxContextsPerFn) {
+        this._contextCapHits++;
+        const base = this._cache.get(this._key(qid, new Set()));
+        if (base && !base._recursive) return base;
+        // No base summary yet → fall through and compute this one (we need a
+        // result), but don't grow the context set.
+      } else {
+        ctxs.add(stateHash);
+      }
+    }
     if (this._stack.has(qid)) {
       this._hitRecursion = true;
       return { returnTainted: false, mutatedParams: new Set(), taintedGlobals: new Set(), findings: [], _recursive: true };
@@ -125,7 +182,7 @@ export class SummaryCache {
   }
 
   size() { return this._cache.size; }
-  clear() { this._cache.clear(); this._iter = 0; }
+  clear() { this._cache.clear(); this._iter = 0; this._contextsByQid.clear(); this._contextCapHits = 0; }
 }
 
 function _summaryEq(a, b) {

package/src/engine.js

@@ -35,6 +35,10 @@ import { scanMobileManifest } from './sast/mobile-manifest.js';
 import { scanQuarkusHardening } from './sast/quarkus-hardening.js';
 import { scanFastapiHardening } from './sast/fastapi-hardening.js';
 import { scanAuthZ } from './sast/authz.js';
+import { scanApiBrokenAuthz } from './sast/api-authz.js';
+import { scanTerraform } from './sast/iac-terraform.js';
+import { scanCrossService } from './sast/cross-service.js';
+import { scanRbacConsistency } from './sast/rbac-consistency.js';
 import { scanModelLoad } from './sast/model-load.js';
 import { scanPromptTemplate } from './sast/prompt-template.js';
 import { scanXXE } from './sast/xxe.js';
@@ -81,10 +85,27 @@ import { scanLDAPInjection } from './sast/ldap-injection.js';
 import { scanXPathInjection } from './sast/xpath-injection.js';
 import { scanSSTI } from './sast/ssti.js';
 import { scanOpenRedirect } from './sast/open-redirect.js';
+import { scanWrongContextSanitizer, scanSanitizerContextMismatch } from './sast/wrong-context-sanitizer.js';
+import { scanFrontendHygiene } from './sast/frontend-hygiene.js';
+import { scanCsvInjection } from './sast/csv-injection.js';
+import { scanStoredTaint } from './sast/stored-taint.js';
+import { scanTreeSitterSinks } from './sast/tree-sitter-sinks.js';
+import { scanJavaStructural } from './sast/java-structural.js';
+import { scanCsharpStructural } from './sast/csharp-structural.js';
+import { scanJsFrameworkStructural } from './sast/js-framework-structural.js';
+import { scanPythonStructural } from './sast/python-structural.js';
+import { scanGoStructural } from './sast/go-structural.js';
+import { scanSecretConcat } from './sast/secret-concat.js';
+import { scanXssReflectedMultilang } from './sast/xss-reflected-multilang.js';
+import { scanCodeInjectionMultilang } from './sast/code-injection-multilang.js';
+import { scanRegexReDoS } from './sast/redos-nfa.js';
 import { scanResponseSplitting } from './sast/response-splitting.js';
 import { scanStoredPromptInjection, scanStoredPromptInjectionCrossFile } from './sast/llm-stored-prompt.js';
 import { scanRAGPoisoning } from './sast/rag-poisoning.js';
 import { scanAgentToolEscalation } from './sast/agent-tool-escalation.js';
+import { scanAgentUntrustedFlow } from './sast/agent-untrusted-flow.js';
+import { scanInstallScripts } from './sca/install-script-analysis.js';
+import { scanEventEntrypoints } from './sast/event-entrypoint.js';
 import { scanDbTaint, scanDbTaintCrossFile } from './sast/db-taint.js';
 import { scanSSRFCloudMetadata } from './sast/ssrf-cloud-metadata.js';
 import { scanMutationXSS } from './sast/mutation-xss.js';
@@ -129,6 +150,8 @@ import { annotateFeatureFlagGating } from './posture/feature-flags.js';
 import { annotatePersonaScores } from './posture/persona-prioritization.js';
 import { annotateMitigationComposite } from './posture/mitigation-composite.js';
 import { annotateCompositeRisk } from './posture/composite-risk.js';
+import { annotateScaVerdicts } from './posture/sca-verdict.js';
+import { annotateFindingProvenance } from './posture/provenance.js';
 
 // ── Integration block: world-class scaffolded modules ──────────────────────
 // Each module is opt-in via its own env var so partial adoption is safe.
@@ -148,6 +171,8 @@ import { annotateRuntimeCorrelation } from './posture/runtime-correlation.js';
 import { applyLearnedCalibration } from './posture/triage-learning.js';
 import { annotateFormalVerification } from './dataflow/formal-verify.js';
 import { annotatePathFeasibility } from './dataflow/smt-feasibility.js';
+import { annotateProofGate } from './dataflow/proof-gate.js';
+import { computeAnalysisTiers, countUnmodeledSinkCandidates } from './posture/coverage-report.js';
 import { annotatePrivacyTaint, emitDpiaArtifact } from './dataflow/privacy-taint.js';
 import { buildThreatModel as buildAutoThreatModel, persistThreatModel as persistAutoThreatModel } from './posture/threat-model-auto.js';
 import { runApiContractScan } from './posture/api-contract.js';
@@ -1187,6 +1212,111 @@ function _hasPostLookupOwnershipCheck(lines, sinkLine){
   return false;
 }
 
+// An SSRF host allow/deny guard near the request sink: a hostname checked
+// against an allow/deny-list, an RFC1918 / loopback / link-local / metadata
+// prefix check, or a known SSRF-filter helper. Control-flow (not assignment),
+// so it isn't caught by the sanitizer-on-assignment path. Recall-safe: an
+// unguarded fetch still has no guard in its window.
+const _SSRF_HOST_GUARD_RE = /\b(?:DENY|ALLOW(?:ED)?|allow_?list|deny_?list|block_?list|allowed_?hosts?|blocked_?hosts?|ALLOWED_HOSTS)\b|\.(?:hostname|host|getHost\s*\(\s*\))\b[\s\S]{0,60}?(?:\bin\b|\.has\s*\(|\.includes\s*\(|\.contains\s*\(|[!=]=|\.startsWith\s*\(|\.startswith\s*\()|\b(?:startsWith|startswith)\s*\(\s*['"](?:10\.|192\.168\.|127\.|169\.254\.|172\.(?:1[6-9]|2\d|3[01])\.|::1|fc00|fd)|\bipaddress\b|\bis_private\b|\bis_loopback\b|getaddrinfo|gethostbyname|ssrf[-_]?req[-_]?filter|isSafeUrl|isPrivateIp|validateUrl|_is_metadata_or_private|urlparse\s*\([^)]*\)\s*\.\s*(?:hostname|netloc)/i;
+
+// A comment-stripped window around the sink. Comments must not read as guards
+// (e.g. a "no host allow-list / 169.254.169.254" comment describing the vuln).
+function _guardWindow(ctx, before = 25, after = 5) {
+  if (!ctx || !Array.isArray(ctx.lines)) return '';
+  const line = ctx.line || 1;
+  const lo = Math.max(0, line - before);
+  const hi = Math.min(ctx.lines.length, line + after);
+  return ctx.lines.slice(lo, hi).join('\n')
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/\/\/[^\n]*/g, ' ')
+    .replace(/(^|[^\w'"`])#[^\n]*/g, '$1 ');
+}
+
+function _hasSsrfHostGuard(ctx) { return _SSRF_HOST_GUARD_RE.test(_guardWindow(ctx)); }
+
+// A path-traversal containment guard near the file sink: a basename/strip
+// helper that removes directory components, a framework safe-join, or a
+// canonicalize-then-startsWith containment check.
+const _PATH_GUARD_RE = /\b(?:basename|GetFileName|secure_filename|sanitize_filename|send_from_directory|safe_join)\s*\(|\b(?:startsWith|startswith|StartsWith|HasPrefix)\s*\(|\bgetCanonicalPath\b|\btoRealPath\b|\bfilepath\s*\.\s*(?:Clean|Base|Abs)\b/;
+function _hasPathGuard(ctx) { return _PATH_GUARD_RE.test(_guardWindow(ctx)); }
+
+// Reflected-XSS output-encoding guard: an HTML escaper applied near the sink.
+const _XSS_ESCAPER = String.raw`(?:escapeHtml|escape_html|escape-html|sanitizeHtml|sanitize_html|DOMPurify\.sanitize|he\.encode|he\.escape|_\.escape|validator\.escape|bleach\.clean|markupsafe|htmlspecialchars|htmlentities|html\.escape|escapeHTML|encodeURIComponent|escape)\s*\(`;
+const _XSS_ESCAPE_RE = new RegExp(_XSS_ESCAPER);
+// An escaper whose RESULT is captured (assigned / returned) — not a bare,
+// return-discarded `escapeHtml(s);` call, which does nothing for the reflected
+// value (FP-3 in smoke). Requires `… = <escaper>(` or `return <escaper>(`.
+const _XSS_ASSIGNED_ESCAPE_RE = new RegExp(String.raw`(?:[:=]|\breturn\b)\s*[^=;\n]*?` + _XSS_ESCAPER);
+// A raw request source appearing on the sink line itself (not via a prior
+// escaped var). If present, the reflection is unescaped — keep the finding.
+const _XSS_RAW_SOURCE_RE = /\breq(?:uest)?\s*\.|\bctx\s*\.\s*(?:query|params|request|body)\b|\$_(?:GET|POST|REQUEST|COOKIE)\b|\bparams\s*\[|\.(?:query|body|params)\s*\.[A-Za-z_$]/;
+function _hasXssOutputEncoding(ctx) {
+  if (!ctx || !Array.isArray(ctx.lines)) return false;
+  const line = ctx.lines[(ctx.line || 1) - 1] || '';
+  // The reflected-XSS finding is anchored either on the escaped-assignment line
+  // (`const safe = escape(req.query.x)`) or on the response sink line
+  // (`res.send('…' + safe + '…')`).
+  //  - If the finding line itself captures the escaped value (`const safe =
+  //    escape(req.query.x)`), the reflection is encoded → safe. A bare,
+  //    return-discarded `escapeHtml(s);` does NOT count.
+  if (_XSS_ASSIGNED_ESCAPE_RE.test(line)) return true;
+  //  - A raw, unescaped request source on the finding line is the real vuln
+  //    shape (`res.send('…' + req.query.x)`) → keep it.
+  if (_XSS_RAW_SOURCE_RE.test(line)) return false;
+  //  - Otherwise the sink reflects a variable; drop only if that variable was
+  //    escaped (and the result captured) in the surrounding window. A bare
+  //    `escapeHtml(s);` with a discarded return does NOT count.
+  return _XSS_ASSIGNED_ESCAPE_RE.test(_guardWindow(ctx, 8, 2));
+}
+
+// Centralized guard-recognition pass (#1). SSRF (CWE-918) and path-traversal
+// (CWE-22) are emitted by several independent detectors (regex, structural,
+// per-language flow, PY-SAST, CSHARP, GO) — none of which shared a notion of
+// "the sink is hardened by a host allow/deny check or a path containment
+// guard." This single pass drops such findings uniformly, regardless of which
+// detector produced them, using the same comment-stripped window guards.
+// Recall-safe: a genuinely-unguarded sink has no guard in its window (the
+// cve-replay vulnerable-tier TP count is the invariant that proves this).
+export function dropGuardedFindings(findings, fileContents) {
+  if (!Array.isArray(findings)) return findings;
+  const cache = new Map();
+  const linesOf = (file) => {
+    if (cache.has(file)) return cache.get(file);
+    const c = fileContents && fileContents[file];
+    const arr = typeof c === 'string' ? c.split('\n') : null;
+    cache.set(file, arr);
+    return arr;
+  };
+  return findings.filter((f) => {
+    if (!f || !f.file) return true;
+    // Already-sanitized findings (isSanitized / info) are owned by the
+    // sanitizer-dataflow pipeline, which records them in scan.suppressions.
+    // Don't hard-drop them here or that bookkeeping is lost (smoke FP-3).
+    if (f.isSanitized) return true;
+    const cwe = f.cwe || '';
+    const isXss = cwe === 'CWE-79' && /reflected xss/i.test(f.vuln || '');
+    if (cwe !== 'CWE-918' && cwe !== 'CWE-22' && !isXss) return true;
+    // Flow-pair findings (REGEX parser) carry the line on sink/source, not at
+    // the top level; fall back to those before parsing it out of the id.
+    let line = f.line;
+    if (typeof line !== 'number') {
+      line = (f.sink && f.sink.line) ?? (f.source && f.source.line);
+      if (typeof line !== 'number') {
+        const m = /:(\d+):/.exec(f.id || '');
+        if (m) line = Number(m[1]);
+      }
+    }
+    if (typeof line !== 'number') return true;
+    const lines = linesOf(f.file);
+    if (!lines) return true;
+    const ctx = { lines, line };
+    if (cwe === 'CWE-918' && _hasSsrfHostGuard(ctx)) return false;
+    if (cwe === 'CWE-22' && _hasPathGuard(ctx)) return false;
+    if (isXss && _hasXssOutputEncoding(ctx)) return false;
+    return true;
+  });
+}
+
 function _detectSafeSinkShape(vuln, args, ctx){
   // 1.1: Reflected XSS / SSRF / Path Traversal / Open Redirect / Code Injection
   // sinks with empty or whitespace-only args cannot reflect user input — skip
@@ -1221,6 +1351,8 @@ function _detectSafeSinkShape(vuln, args, ctx){
     if (_isSafeExecFileCall(args)) return 'execFile-list';
   }
   if(/SSRF/.test(vuln) && _isStaticUrlFirstArg(args)) return 'static-url';
+  if(/SSRF/.test(vuln) && _hasSsrfHostGuard(ctx)) return 'ssrf-host-guard';
+  if(/Path Traversal/.test(vuln) && _hasPathGuard(ctx)) return 'path-contained';
   if(/Open Redirect/.test(vuln)) {
     // Static redirect targets (env var or string literal) are not user-controlled
     if (/^\s*process\.env\b/.test(args)) return 'static-redirect-target';
@@ -1959,6 +2091,17 @@ function scanStructuralVulns(fp, raw) {
         }
         effectiveSeverity = s;
       }
+      // Guard recognition (precision, #1): a structural SSRF/path finding on
+      // hardened code — an SSRF host allow/deny check, or a path
+      // basename/containment guard near the sink — is a false positive.
+      if (/SSRF/.test(pat.vuln) && _hasSsrfHostGuard({ lines, line })) {
+        _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'ssrf-host-guard'});
+        continue;
+      }
+      if (/Path Traversal/.test(pat.vuln) && _hasPathGuard({ lines, line })) {
+        _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'path-contained'});
+        continue;
+      }
       const id = `struct:${fp}:${line}:${pat.vuln.replace(/\s/g, '_')}`;
       if (!findings.find(f => f.id === id)) {
         findings.push({
@@ -5512,8 +5655,17 @@ function dedupeFindingsWithEvidence(findings){
     const key=`${file}:${sinkLine}:${fam}`;
     if(!buckets.has(key)){buckets.set(key,f);continue;}
     const kept=buckets.get(key);
-    // Keep highest-severity entry; preserve evidence from both.
-    const keepNew = (SEV_RANK[f.severity]??9) < (SEV_RANK[kept.severity]??9);
+    // Winner selection: an interprocedural flow finding (carries source→sink
+    // attribution) is the better carrier than a flat structural/regex match at
+    // the same sink — keep its chain/source-line attribution. When neither or
+    // both carry flow, fall back to severity. The winner keeps its own severity
+    // (we must not resurrect a rating that ownership/reachability analysis
+    // deliberately downgraded on one of the two findings).
+    const fHasFlow = !!(f.source && f.sink);
+    const kHasFlow = !!(kept.source && kept.sink);
+    const keepNew = (fHasFlow !== kHasFlow)
+      ? fHasFlow
+      : (SEV_RANK[f.severity]??9) < (SEV_RANK[kept.severity]??9);
     const winner = keepNew ? f : kept;
     const loser  = keepNew ? kept : f;
     if(!winner.evidence)winner.evidence=[winner.parser||"UNKNOWN"];
@@ -6548,6 +6700,42 @@ function _parseMavenDependencyTree(text, filePath){
   return out;
 }
 
+// R10 (PRD §5): Gradle transitive graph. `gradle dependencies` (or
+// `gradle :app:dependencies`) prints the FULL resolved tree; build.gradle alone
+// only declares direct deps. Canonical committed path: `gradle-dependencies.txt`.
+// Format (tree-drawing prefixes we strip), version may be conflict-resolved:
+//   +--- group:artifact:1.0
+//   |    \--- group:artifact:1.0 -> 1.2   (resolved to 1.2)
+// Config headers ("compileClasspath - …"), project deps, and (*)/(c) markers skipped.
+function _parseGradleDependencies(text, filePath) {
+  const out = [];
+  const seen = new Set();
+  for (const rawLine of String(text).split('\n')) {
+    if (!rawLine.trim()) continue;
+    const indent = rawLine.length - rawLine.replace(/^[\s|+\\-]+/, '').length;
+    const stripped = rawLine.replace(/^[\s|+\\-]+/, '').trim();
+    if (!stripped || stripped.startsWith('project ') || /\bproject\s+[':]/.test(stripped)) continue;
+    // group:artifact:version, with optional `-> resolved` and trailing (*)/(c)/(n).
+    const m = stripped.match(/^([A-Za-z0-9._-]+):([A-Za-z0-9._-]+):([^\s(]+?)(?:\s*->\s*([^\s(]+))?\s*(?:\([*cn]\))?\s*$/);
+    if (!m) continue;
+    const group = m[1], artifact = m[2];
+    let ver = (m[4] || m[3] || '').replace(/[{}]/g, '');
+    ver = ver.replace(/^(?:strictly|require|prefer)\s+/, '');
+    if (!group || !artifact || !ver) continue;
+    const key = `${group}:${artifact}:${ver}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({
+      name: `${group}:${artifact}`, version: ver, group, scope: 'required',
+      purl: _makePurl('maven', artifact, ver, group), ecosystem: 'maven', filePath,
+      isUnpinned: false,
+      isTransitive: indent > 6,
+      pomSource: 'gradle-dependencies',
+    });
+  }
+  return out;
+}
+
 function _parseBuildGradle(text,filePath){
   const out=[];
   const pat=/(?:implementation|api|compile|runtimeOnly|testImplementation|testCompile|compileOnly|classpath)\s*(?:\(|['"])\s*['"]?([a-zA-Z0-9._\-]+):([a-zA-Z0-9._\-]+):([^'")\s,]+)/g;
@@ -6826,6 +7014,8 @@ function parseManifests(allFileContents){
     // `target/dependency-tree.txt` (per `mvn dependency:tree -DoutputFile=...`)
     // but users sometimes commit it as `dependency-tree.txt` at repo root.
     'dependency-tree.txt':_parseMavenDependencyTree,
+    // R10: Gradle resolved transitive graph — `gradle dependencies > gradle-dependencies.txt`.
+    'gradle-dependencies.txt':_parseGradleDependencies,
   };
   const out=[],seen=new Set();
   for(const[fp,content]of Object.entries(allFileContents)){
@@ -7202,13 +7392,14 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   catch { _GLOBAL_JAVA_TAINTED_METHODS = new Set(); }
   const _perFileTimeoutMs = parseInt(process.env.AGENTIC_SECURITY_PER_FILE_TIMEOUT_MS || '10000', 10);
   const _fileTimings = [];
-  let _filesSkipped = 0, _filesTimedOut = 0;
-  const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000)continue;fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));
+  let _filesSkipped = 0, _filesTimedOut = 0, _filesDenseSkipped = 0;
+  const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));aF.push(...scanTerraform(p,c));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
       aLogic.push(...scanBusinessLogic(p,c));
       aF.push(...scanPipeline(p,c));
       aF.push(...scanContainer(p,c));
+      aF.push(...scanInstallScripts(p,c));
       aF.push(...scanMCP(p,c));
       aF.push(...scanClaudeSettings(p,c));
       aF.push(...scanClaudeMdPromptInjection(p,c));
@@ -7265,10 +7456,25 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
       aF.push(...scanXPathInjection(p,c));
       aF.push(...scanSSTI(p,c));
       aF.push(...scanOpenRedirect(p,c));
+      aF.push(...scanWrongContextSanitizer(p,c));
+      aF.push(...scanSanitizerContextMismatch(p,c));
+      aF.push(...scanFrontendHygiene(p,c));
+      aF.push(...scanCsvInjection(p,c));
+      aF.push(...scanStoredTaint(p,c));
+      aF.push(...scanJavaStructural(p,c));
+      aF.push(...scanCsharpStructural(p,c));
+      aF.push(...scanJsFrameworkStructural(p,c));
+      aF.push(...scanPythonStructural(p,c));
+      aF.push(...scanGoStructural(p,c));
+      aF.push(...scanSecretConcat(p,c));
+      aF.push(...scanXssReflectedMultilang(p,c));
+      aF.push(...scanCodeInjectionMultilang(p,c));
       aF.push(...scanResponseSplitting(p,c));
       aF.push(...scanStoredPromptInjection(p,c));
       aF.push(...scanRAGPoisoning(p,c));
       aF.push(...scanAgentToolEscalation(p,c));
+      aF.push(...scanAgentUntrustedFlow(p,c));
+      aF.push(...scanEventEntrypoints(p,c));
       aF.push(...scanDbTaint(p,c));
       aF.push(...scanSSRFCloudMetadata(p,c));
       aF.push(...scanMutationXSS(p,c));
@@ -7430,6 +7636,12 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   setProgress({current:i,total:files.length,file:"Stored taint...",phase:"Linking"});const storedRegistry=buildStoredTaintRegistry(fc);const stf=crossStoredTaint(fc,storedRegistry);aF.push(...stf);
   setProgress({current:i,total:files.length,file:"Session taint...",phase:"Linking"});const sess=crossSessionTaint(fc);aF.push(...sess);
   setProgress({current:i,total:files.length,file:"Call graph...",phase:"Linking"});const callGraph=buildCallGraph(fc);
+  // R19 (PRD §5): cross-route BOLA/BFLA over the aggregated route inventory.
+  try{aF.push(...scanApiBrokenAuthz(aR));}catch(_){}
+  // R22 (PRD §5): cross-service edges inferred from code (client call → matched route).
+  try{aF.push(...scanCrossService(aR,fc));}catch(_){}
+  // R21 (PRD §5): RBAC role-tier consistency over the route inventory.
+  try{aF.push(...scanRbacConsistency(aR,fc));}catch(_){}
   setProgress({current:i,total:files.length,file:"Reachability + guards...",phase:"Linking"});annotateReachability(aF,aR,callGraph,fc);aF.forEach(f=>detectGuardsForFinding(f,fc));
   setProgress({current:i,total:files.length,file:"Inferring sanitizers...",phase:"Linking"});const learned=inferSanitizers(fc);applyLearnedSanitizers(aF,learned,fc);
   setProgress({current:i,total:files.length,file:"Sanitizer effectiveness...",phase:"Linking"});applySanitizerEffectiveness(aF);
@@ -7438,6 +7650,9 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   setProgress({current:i,total:files.length,file:"OSV vulnerability database...",phase:"SCA"});
   const allFileContents={...fc, ...depFileContents};
   const components=parseManifests(allFileContents);
+  // R8 (PRD §5): OS packages from an extracted container image's package DBs
+  // (dpkg/apk) — baked-in deps the Dockerfile never names. Feed the OSV/SBOM pipeline.
+  try{const{extractImagePackages}=await import('./sca/image-packages.js');for(const ip of extractImagePackages(allFileContents)){if(!components.some(c=>c.ecosystem===ip.ecosystem&&c.name===ip.name&&c.version===ip.version))components.push(ip);}}catch(_){}
   try{const{detectVendoredLibraries}=await import('./sca/vendor-detect.js');const vendored=detectVendoredLibraries(fc);for(const v of vendored){const key=`${v.ecosystem}:${v.name}:${v.version}`;if(!components.some(c=>`${c.ecosystem}:${c.name}:${c.version}`===key))components.push({...v,group:'',purl:`pkg:${v.ecosystem}/${v.name}@${v.version}`,filePath:v.file,isUnpinned:false,reachable:true});}}catch(_){}
   const reach=buildReachabilitySet(fc);
   const reachabilitySet=reach.imported;
@@ -7452,6 +7667,14 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   // 0.10.0: enrich SCA findings with CISA KEV (CISA KEV catalog)
   try{supplyChain=await _enrichWithKEV(supplyChain);}catch(_){}
   try{markUsedVulnFunctions(supplyChain,fc);}catch(_){}
+  // R7 (PRD §5): import-aware call-site augmentation for npm/pypi deps. The regex
+  // pass above misses aliased / namespace imports (import {merge as deepMerge};
+  // deepMerge()) and over-matches bare names in files that don't import the
+  // package. This parses each JS/TS + Python file's imports, resolves vuln-fn
+  // calls THROUGH the alias map, and gates them to files that actually import the
+  // package — then ADDS the recovered sites so the route-reachability classifier
+  // below (which decides reachable/unreachable/unknown) sees them. Additive only.
+  try{const{augmentReachabilityViaImports}=await import('./sca/import-reachability.js');augmentReachabilityViaImports(supplyChain,fc,VULN_FUNCTION_HINTS);}catch(_){}
   // Python AST-based function validation (deep mode only)
   if(process.env.AGENTIC_SECURITY_DEEP==='1'){try{const{validateOsvFunctionsExist}=await import('./sca/py-package-functions.js');for(const sc of supplyChain){if(sc.type!=='vulnerable_dep'||sc.ecosystem!=='pypi')continue;if(!sc.osvVulnFunctions||!sc.osvVulnFunctions.length)continue;const{validated,missing}=validateOsvFunctionsExist(sc.name,sc.osvVulnFunctions,scanRoot);if(validated.length)sc._pyAstValidated=validated;if(missing.length)sc._pyAstMissing=missing;}}catch(_){}}
   // LLM-assisted function extraction for CVEs without hints (opt-in: AGENTIC_SECURITY_LLM_SCA=1)
@@ -7552,7 +7775,14 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   const annotatedComponents=components.map(c=>{const key=`${c.ecosystem}:${c.name}:${c.version}`;const vulns=vulnsByKey[key]||[];const riKey=c.ecosystem==='maven'&&c.group?`maven:${c.group}/${c.name}`:`${c.ecosystem}:${c.name}`;const ri=registryInfo.get(riKey)||{};const latestVersion=ri.latestVersion||'';const vd=(ri.versions||{})[c.version]||{};const isDeprecated=typeof vd.deprecated==='string'&&vd.deprecated.length>0;const deprecationMessage=isDeprecated?vd.deprecated:'';const isOutdated=!isDeprecated&&typeof vd.outdated==='string'&&vd.outdated.length>0;const outdatedMessage=isOutdated?vd.outdated:'';const license=ri.license||vd.license||'';return{...c,vulns,hasVulns:vulns.length>0,hasAttackPath:attackResult.flagged.has(key),attackPaths:attackResult.pathsByKey.get(key)||[],latestVersion,isDeprecated,deprecationMessage,isOutdated,outdatedMessage,license};});
   try{aF.push(...scanDbTaintCrossFile(fc));}catch(_){}
   try{aF.push(...scanStoredPromptInjectionCrossFile(fc));}catch(_){}
+  // Roadmap #8 — tree-sitter sinks for long-tail languages (opt-in,
+  // AGENTIC_SECURITY_TREE_SITTER=1; degrades to no-op without the optional dep).
+  if(process.env.AGENTIC_SECURITY_TREE_SITTER==='1'){try{aF.push(...await scanTreeSitterSinks(fc));}catch(_){}}
   let finalFindings;try{finalFindings=dedupeFindingsWithEvidence(aF);}catch(_){finalFindings=dd(aF,f=>f.id);}
+  // #1 — centralized SSRF/path guard recognition: drop CWE-918/CWE-22 findings
+  // on code hardened by a host allow/deny check or a path containment guard,
+  // regardless of which detector emitted them. Opt out: AGENTIC_SECURITY_NO_GUARD_RECOGNITION=1.
+  if(process.env.AGENTIC_SECURITY_NO_GUARD_RECOGNITION!=='1'){try{finalFindings=dropGuardedFindings(finalFindings,fc);}catch(_){}}
   // 0.34.6: filter out Java FPs where a sanitizer pattern (argv-form ProcessBuilder,
   // parameterized prepareStatement, constant-folded dead-branch) is present.
   // applyJavaBenchSuppressions is a no-op on non-.java files.
@@ -7670,6 +7900,14 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   _runAnnotator("annotateCalibratedConfidence", () => { annotateCalibratedConfidence(finalFindings, { scanRoot }); });
   const _projectCtx = (() => { try { return detectProjectContext(fc, aR); } catch { return {}; } })();
   _runAnnotator("annotateExploitability", () => { annotateExploitability(finalFindings, _projectCtx); });
+  // Roadmap #6 — proof-gate precision pass. Runs AFTER confidence +
+  // exploitability so it can demote their tiers, and BEFORE mitigation /
+  // composite-risk so the demotion flows into the canonical ranking. Default
+  // on; opt out with AGENTIC_SECURITY_NO_PROOF_GATE=1. Demotes proven-clean /
+  // proven-infeasible flows (confidence + tiers only, never severity).
+  if (process.env.AGENTIC_SECURITY_NO_PROOF_GATE !== '1') {
+    _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
+  }
   // v3 next-gen: production-aware context ingest (Pillar 9). Must run BEFORE
   // the mitigation composite, persona prioritization, and final why-fired
   // record so those see the demotion signals.
@@ -7880,10 +8118,14 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   try { await annotateNarration(finalFindings); }
   catch (e) { _annotatorErrors.push({ phase: 'annotateNarration', err: String((e && e.message) || e) }); }
   // Phase 3 (Sentinel-parity FR-L1, FR-L2) — IR + interprocedural taint.
-  // Opt-in via AGENTIC_SECURITY_DEEP=1 because it's currently breadth-first,
-  // not benchmark-tuned. Findings ride through the standard dedup/cluster/
-  // confidence pipeline below; the LLM-validator stage above already ran but
-  // any deep-mode finding emitted here will be unvalidated.
+  // R1 (PRD §5): the CLI entry (bin/agentic-security.js#cmdScan) now sets
+  // AGENTIC_SECURITY_DEEP=1 by default for local/interactive scans, so deep mode
+  // runs on the default `/scan --all` path. This gate is the enforcement +
+  // CI-safety point: it honors an explicit opt-out (DEEP=0) and keeps deep off in
+  // CI unless DEEP_IN_CI=1. In-process callers (tests, the cve-replay corpus) invoke
+  // runScan()/runFullScan() directly without the CLI default, so they stay deep-off
+  // and remain deterministic regression gates. Findings ride through the standard
+  // dedup/cluster/confidence pipeline below and the LLM-validator stage that follows.
   //
   // SAFETY: Deep mode is gated for CI safety:
   //   - Global timeout via AGENTIC_SECURITY_DEEP_TIMEOUT_MS (default 300_000 = 5 min)
@@ -8025,13 +8267,29 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   // apply accept-risk / SLA / major-version-freeze rules. supplyChain
   // findings get suppressed/tagged in place.
   try { const sp = loadScaPolicy(scanRoot); if (sp && !sp._error) applyScaPolicy(supplyChain, sp); } catch (_) {}
+  // R12 (PRD §5): deterministic decision-first verdict per dep, derived from the
+  // signals enriched above (composite risk × KEV × EPSS × reachability × policy).
+  // testsDetected is read from the UNFILTERED fileContents because shouldScan()
+  // strips test files out of `fc`.
+  try {
+    const _testsDetected = Object.keys(fileContents).some(f =>
+      /(?:^|\/)(?:tests?|spec|__tests__)\//i.test(f) ||
+      /\.(?:test|spec)\.[cm]?[jt]sx?$/i.test(f) ||
+      /(?:^|\/)test_[^/]*\.py$/i.test(f) || /_test\.(?:py|go)$/i.test(f));
+    annotateScaVerdicts(supplyChain, { testsDetected: _testsDetected });
+  } catch (_) {}
   // 0.9.0 Feat-15: dep confusion
   try{const dc=detectDepConfusion(annotatedComponents,scanRoot);aF.push(...dc);}catch(_){}
   // Deployment-platform security checklist
   try{const dpf=scanDeployPlatform(scanRoot);aLogic.push(...dpf);}catch(_){}
   // Stack-specific security playbook
   try{const sp=runStackPlaybook(scanRoot);if(sp&&sp.findings)aLogic.push(...sp.findings);}catch(_){}
-  finalFindings.sort((a,b)=>(b.toxicityScore||0)-(a.toxicityScore||0)||(b.triageScore||0)-(a.triageScore||0)||({critical:0,high:1,medium:2,low:3}[a.severity]??4)-({critical:0,high:1,medium:2,low:3}[b.severity]??4));
+  // R17 (PRD §5): annotate per-finding corroboration ("one issue, many signals")
+  // after evidence + validator verdicts are populated, then use it as a final
+  // tiebreaker so multi-signal findings rank above single-signal ones at equal
+  // severity. Does not alter calibrated confidence.
+  try { annotateFindingProvenance(finalFindings); } catch (_) {}
+  finalFindings.sort((a,b)=>(b.toxicityScore||0)-(a.toxicityScore||0)||(b.triageScore||0)-(a.triageScore||0)||({critical:0,high:1,medium:2,low:3}[a.severity]??4)-({critical:0,high:1,medium:2,low:3}[b.severity]??4)||((b.corroborationCount||1)-(a.corroborationCount||1)));
   // Auto-PoC filter: tag whether a concrete payload+test can be derived. When
   // AGENTIC_SECURITY_POC=1, demote ≥medium findings that fail this check.
   // Used as a precision lever for users who want to ship clean reports —
@@ -8150,6 +8408,25 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   finalFindings = finalFindings.filter(_shouldKeep);
   _filterInPlace(aLogic);
   _filterInPlace(aSecrets);
+  // Drop a generic High-Entropy Credential Candidate when a named/structural
+  // secret detector (e.g. secret-concat, hardcoded-secret) already flagged the
+  // SAME file:line — otherwise one split/hardcoded key is reported twice (the
+  // named finding lives in `findings`, the entropy candidate in `secrets`).
+  {
+    const _namedSecretLines = new Set();
+    for (const f of finalFindings) {
+      const ln = f.line ?? f.source?.line;
+      if (typeof ln === 'number' && (f.cwe === 'CWE-798' || /hardcoded|credential|secret/i.test(f.vuln || ''))) {
+        _namedSecretLines.add(`${f.file}:${ln}`);
+      }
+    }
+    const _kept = aSecrets.filter((s) => {
+      if (!/High-Entropy|entropy/i.test(s.vuln || '')) return true;
+      return !_namedSecretLines.has(`${s.file}:${s.line}`);
+    });
+    aSecrets.length = 0;
+    aSecrets.push(..._kept);
+  }
   _filterInPlace(supplyChain);
   classifyOrphans(aSrc,aSink,finalFindings,fc);
   // v3 next-gen: capture scan-level reports (counterfactual, threat model,
@@ -8255,7 +8532,12 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
     }
   }
 
-  const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesTimedOut:_filesTimedOut,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length}};
+  // Coverage-honesty report (#5 + #6): per-language analysis tier (IR-taint vs
+  // pattern-only), dense/large/timeout skips, and unmodeled-sink candidates.
+  let _analysisTier = null, _unmodeledSinks = null;
+  try { _analysisTier = computeAnalysisTiers(Object.keys(fc)); } catch {}
+  try { _unmodeledSinks = countUnmodeledSinkCandidates(fc, finalFindings); } catch {}
+  const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length}};
   return{routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,threatModel:_threatModel,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".

package/src/ir/CLAUDE.md

@@ -11,6 +11,7 @@ consumed by `scanner/src/dataflow/` for taint analysis.
 | Python   | `parser-py-cst.js`    | Python 3.8+ stdlib `ast` via subprocess (default when available) |
 | Python   | `parser-py.js`        | Hand-rolled regex parser (fallback when python3 missing) |
 | Java     | `parser-java.js`      | `java-parser` npm package (async)                |
+| Long-tail (rust/solidity/cpp/c/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. |
 
 ## Python parser — dual-path with auto fallback
 

package/src/ir/callgraph.js

@@ -67,8 +67,19 @@ export function buildCallGraph(perFileIR, fileContents) {
   // the call graph for the callee's qid at the assign-from-call site.
   // Same precedence as the edge resolution above (same-file ident wins,
   // ClassName.method falls back).
-  function resolve(name) {
+  function resolve(name, callerFile) {
     if (!name || typeof name !== 'string') return null;
+    // Roadmap #3: same-file preference. A bare name (`handler`, `save`,
+    // `query`) defined in several files would otherwise resolve to whichever
+    // file Map is iterated first, mis-targeting interprocedural taint to a
+    // same-named function in an unrelated file. When the caller's own file
+    // defines the name, that is overwhelmingly the intended callee — prefer
+    // it. Backward-compatible: with no callerFile (or no local match) the
+    // original resolution order is unchanged, so no edge is ever dropped.
+    if (callerFile) {
+      const local = byNameInFile.get(callerFile);
+      if (local && local.has(name)) return local.get(name);
+    }
     for (const m of byNameInFile.values()) {
       if (m.has(name)) return m.get(name);
     }

package/src/ir/parser-go.js

@@ -79,6 +79,14 @@ function _lowerExpr(text) {
     const parts = _splitTopLevelCommas(inner).map(_lowerExpr);
     return { kind: 'tpl', parts };
   }
+  // R3 (PRD §5): string concat with `+` MUST be checked before the bare-literal
+  // rule below — otherwise `"SELECT " + q` (starts with `"`) is captured whole as
+  // a single literal and taint cannot flow through the concatenation. Only fires
+  // when there's a top-level `+` (a pure literal still falls through to literal).
+  if (/["'`]/.test(s) && s.includes('+')) {
+    const plusParts = _splitTopLevelPlus(s);
+    if (plusParts.length > 1) return { kind: 'tpl', parts: plusParts.map(_lowerExpr) };
+  }
   if (/^"/.test(s) || /^`/.test(s)) return { kind: 'literal', value: s };
   if (/^\d/.test(s)) return { kind: 'literal', value: s };
   if (/^(true|false|nil)\b/.test(s)) return { kind: 'literal', value: s };