@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

package/src/posture/secret-history.js

@@ -0,0 +1,72 @@
+// R15 (PRD §5) — git-history secret sweep.
+//
+// A secret removed from HEAD but present in any past commit is still
+// recoverable from `.git` and must be rotated — the most dangerous secret case,
+// and one a working-tree-only scan misses entirely. This sweeps recent history
+// (bounded), feeding the ADDED lines of each commit through the same credential
+// detector the file scan uses.
+//
+// The detector is INJECTED (detectFn) rather than imported, so this module has
+// no dependency back into engine.js (avoids a circular import) and the parsing
+// stays pure + unit-testable. Live-credential validation (is the key active?)
+// needs network and is deferred — see the rollup.
+
+import { execFileSync } from 'node:child_process';
+
+// Pull the post-image (added) lines out of a unified diff: lines starting with
+// a single '+' (not the '+++' file header). Returns reconstructed text.
+export function extractAddedLines(diffText) {
+  const out = [];
+  for (const line of String(diffText || '').split('\n')) {
+    if (line.startsWith('+') && !line.startsWith('+++')) out.push(line.slice(1));
+  }
+  return out.join('\n');
+}
+
+// Pure: run the injected credential detector over a commit's added lines.
+// detectFn has the scanCredentials(fp, raw) shape and returns Finding[].
+export function scanHistoryDiff(diffText, commit, detectFn) {
+  if (typeof detectFn !== 'function') return [];
+  const added = extractAddedLines(diffText);
+  if (!added.trim()) return [];
+  let findings = [];
+  try { findings = detectFn(`git-history@${commit}`, added) || []; } catch { return []; }
+  return findings.map((f) => ({
+    ...f,
+    id: `secret-history:${commit}:${f.id || f.vuln || 'secret'}`,
+    file: `git-history@${commit}`,
+    line: 0,
+    commit,
+    _historical: true,
+    vuln: `${f.vuln || 'Hardcoded Secret'} (in git history)`,
+    description: `${f.description || 'A credential was committed.'} Found in commit ${commit}; even if removed from HEAD it remains recoverable from git and must be rotated.`,
+    remediation: 'Rotate the credential now, then purge it from history (git filter-repo / BFG) and move it to a secrets manager. Removing it from HEAD alone is insufficient.',
+  }));
+}
+
+/**
+ * Sweep up to `maxCommits` of recent history for secrets. Best-effort: returns
+ * [] when `scanRoot` is not a git repo or git is unavailable. Dedups a secret
+ * that recurs across commits to its earliest sighting.
+ */
+export function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 20000 } = {}) {
+  if (!scanRoot || typeof detectFn !== 'function') return [];
+  let out;
+  try {
+    out = execFileSync('git', ['-C', scanRoot, 'log', '-p', '-n', String(maxCommits), '--no-color', '--no-merges', '--no-textconv'],
+      { encoding: 'utf8', maxBuffer: 96 * 1024 * 1024, timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch { return []; }
+  const parts = out.split(/^commit ([0-9a-f]{7,40})/m); // [pre, sha, body, sha, body, ...]
+  const findings = [];
+  const seen = new Set();
+  for (let i = 1; i < parts.length; i += 2) {
+    const sha = (parts[i] || '').slice(0, 12);
+    for (const f of scanHistoryDiff(parts[i + 1] || '', sha, detectFn)) {
+      const key = `${f.vuln}:${(f.snippet || f.match || '').slice(0, 40)}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push(f);
+    }
+  }
+  return findings;
+}

package/src/pr-delta.js

@@ -170,6 +170,19 @@ export async function computePrDelta(root, { baseRef, headRef = 'HEAD' } = {}) {
 /**
  * Lightweight text summary used as a CLI fallback when --json isn't set.
  */
+// R24 (PRD §5) — net-new CI gate. Blocks the build ONLY on findings the PR
+// INTRODUCED (delta.introduced), at or above `failOn` severity — never on the
+// pre-existing backlog. This is the only SAST CI posture teams tolerate
+// long-term. Pure + deterministic: takes a delta, returns the gate decision.
+const _NETNEW_SEV_RANK = { critical: 3, high: 2, medium: 1, low: 0, info: -1 };
+export function netNewGate(delta, failOn = 'critical') {
+  const introduced = (delta && Array.isArray(delta.introduced)) ? delta.introduced : [];
+  if (failOn === 'none') return { fail: false, failOn, introducedCount: introduced.length, blocked: [] };
+  const threshold = _NETNEW_SEV_RANK[failOn] ?? 3;
+  const blocked = introduced.filter((f) => (_NETNEW_SEV_RANK[f.severity] ?? -1) >= threshold);
+  return { fail: blocked.length > 0, failOn, introducedCount: introduced.length, blocked };
+}
+
 export function renderPrDeltaText(delta) {
   const i = delta.summary.introduced;
   const r = delta.summary.resolved;

package/src/report/index.js

@@ -44,6 +44,15 @@ export function normalizeFindings(scan){
       dataClasses: f.dataClasses || [],
       chain: Array.isArray(f.chain) ? f.chain : null,
       confidence: typeof f.confidence === 'number' ? f.confidence : null,
+      // R17: corroboration ("one issue, many signals") — count of independent
+      // analyses that agreed, and which ones.
+      corroborationCount: typeof f.corroborationCount === 'number' ? f.corroborationCount : null,
+      corroboration: f.corroboration || null,
+      multiSignal: f.multiSignal === true ? true : null,
+      // R13: proof verdict — `provablySafe` means a flow proof discharged this
+      // finding (parameterizer on every path / sanitizer excludes metachars).
+      proof: f.proof || null,
+      provablySafe: f.provablySafe === true ? true : null,
       // 0.6.0 Feat-2
       toxicity: f.toxicityScore ?? null,
       toxicityFactors: f.toxicityFactors || null,
@@ -630,6 +639,47 @@ function _esc(s) {
     .replace(/"/g, '"').replace(/'/g, ''');
 }
 
+// R11 (PRD §5) — OpenVEX export. Turns our reachability verdict (R7/R12) into a
+// standard interchange statement per CVE: unreachable tiers → not_affected with
+// the `vulnerable_code_not_in_execute_path` justification; reachable tiers →
+// affected with an action statement; unknown → under_investigation. Lets
+// downstream tools and auditors inherit "this CVE can't fire here" in a format
+// they accept, instead of re-triaging our transitive noise.
+const _VEX_REACHABLE = new Set(['route-reachable-via-function', 'function-reachable', 'import-reachable']);
+const _VEX_NOT_AFFECTED = new Set(['unreachable', 'build-only', 'manifest-only', 'transitive-only']);
+export function toVex(scan, meta = {}) {
+  const deps = (scan.supplyChain || []).filter(s => s && s.type === 'vulnerable_dep');
+  const statements = [];
+  for (const s of deps) {
+    const cves = (Array.isArray(s.cveAliases) && s.cveAliases.length ? s.cveAliases : [s.osvId]).filter(Boolean);
+    if (!cves.length) continue;
+    const purl = s.purl || `pkg:${s.ecosystem || 'generic'}/${s.name}@${s.version || '0'}`;
+    const stmt = {};
+    if (_VEX_NOT_AFFECTED.has(s.reachabilityTier)) {
+      stmt.status = 'not_affected';
+      stmt.justification = 'vulnerable_code_not_in_execute_path';
+      stmt.impact_statement = `agentic-security reachability: ${s.reachabilityTier}`;
+    } else if (_VEX_REACHABLE.has(s.reachabilityTier)) {
+      stmt.status = 'affected';
+      stmt.action_statement = s.scaVerdictReason || s.remediation ||
+        (Array.isArray(s.fixedVersions) && s.fixedVersions.length ? `upgrade ${s.name} to ${s.fixedVersions[0]}` : 'review and remediate');
+    } else {
+      stmt.status = 'under_investigation';
+    }
+    for (const cve of cves) {
+      statements.push({ vulnerability: { name: cve }, products: [{ '@id': purl }], ...stmt });
+    }
+  }
+  return {
+    '@context': 'https://openvex.dev/ns/v0.2.0',
+    '@id': `https://agentic-security/vex/${(meta && meta.scanId) || 'scan'}`,
+    author: 'agentic-security',
+    timestamp: (meta && meta.startedAt) || new Date().toISOString(),
+    version: 1,
+    statements,
+  };
+}
+
 export function toHTML(scan, meta = {}) {
   const findings = normalizeFindings(scan);
   const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
@@ -1001,6 +1051,23 @@ export function toShipVerdict(scan, options = {}) {
   } else if (advisoryCount > 0) {
     lines.push(c(`  ${advisoryCount} advisory item${advisoryCount === 1 ? '' : 's'} — run /security-scan-all --firehose to see them.`, DIM));
   }
+  // Coverage-honesty line (#5/#6): show the scan's blind spots — which
+  // languages got flow analysis vs pattern-only, what was skipped, and how
+  // many dangerous-looking calls had no finding. One concise line, not bloat.
+  const _covMeta = scan._scanMeta;
+  if (_covMeta && _covMeta.analysisTier) {
+    const t = _covMeta.analysisTier;
+    const pat = Object.keys(t.patternOnly || {});
+    const segs = [`${_covMeta.filesScanned ?? '?'} files`];
+    const ir = Object.keys(t.irTaint || {});
+    if (ir.length) segs.push(`flow=[${ir.join(',')}]`);
+    if (pat.length) segs.push(`pattern-only=[${pat.join(',')}]`);
+    const skipped = (_covMeta.filesSkipped || 0) + (_covMeta.filesDenseSkipped || 0);
+    if (skipped) segs.push(`${skipped} skipped`);
+    if (_covMeta.unmodeledSinkCandidates?.count) segs.push(`${_covMeta.unmodeledSinkCandidates.count} unmodeled-sink candidate${_covMeta.unmodeledSinkCandidates.count === 1 ? '' : 's'}`);
+    lines.push('');
+    lines.push(c('  Coverage: ' + segs.join(' · '), DIM));
+  }
   lines.push('');
   lines.push(c('  🛡  agentic-security · created by ClearCapabilities.Com', DIM));
   return lines.join('\n');

package/src/sast/CLAUDE.md

@@ -13,11 +13,17 @@ SAST detector modules. Each file exports one or more `scan*()` functions returni
 
 ## What lives here, by category
 
-**Language-specific** — `cpp.js`, `csharp.js`, `dart-flutter.js`, `go-extended.js`, `java-deserialization.js`, `kotlin.js`, `php.js`, `python-sinks.js`, `ruby.js`, `rust.js`, `solidity.js`, `swift.js`, `xxe.js`.
+**Language-specific** — `cpp.js`, `csharp.js`, `csharp-structural.js` (regex structural: hardcoded-secret incl. split-concat + guarded SSRF — complements the flow-based `csharp.js`), `dart-flutter.js`, `go-extended.js`, `java-deserialization.js`, `java-structural.js` (regex structural SQLi/cmdi/path/SSRF via concat, with path/SSRF guards — complements the AST/flow Java modules), `kotlin.js` (Kotlin idioms + **taint-independent structural injection** detectors: SQLi/cmdi/path via string template/concat, SSRF (guarded), XXE (insecure XML config), ObjectInputStream deser — closes the corpus Kotlin FNs where a tainted-by-convention param has no in-file source), `php.js` (+ structural SQLi/cmdi via concat/`$`-interp: DB::raw/whereRaw, shell_exec/exec; structural path traversal: readfile/file_get_contents/fopen with concat), `python-sinks.js`, `ruby.js` (+ structural ActiveRecord SQLi via `#{}`/concat, backtick/system cmdi, and File/IO path traversal via interpolation/concat), `rust.js`, `solidity.js`, `swift.js`, `xxe.js` (CWE-611 for Java/Python **and** PHP/Go/Ruby — each non-JVM stack is XXE-safe by default, so it flags the explicit external-entity opt-in: PHP `LIBXML_NOENT`/`LIBXML_DTDLOAD`, Go `xml.Decoder` `Strict=false`/custom `Entity`, Ruby Nokogiri `noent`/`dtdload`/`replace_entities`; default-safe parses don't match).
+
+> **Structural-detector pattern (Tier 1 recall).** `kotlin.js`/`ruby.js`/`php.js` carry taint-independent rules: a dangerous sink built with string interpolation/concat is the injection shape regardless of variable names. This closes corpus FNs where a value is routed through a local var (`params[:x]` → `where("…#{x}")`) so the taint engine sees no source. Keep them high-precision: parameterized / array-form / literal variants must NOT match. Verify on the cve-replay `pre/`+`post/` pairs.
+
+**Tree-sitter (long-tail languages, opt-in)** — `tree-sitter-sinks.js` (roadmap #8). AST-accurate detectors for languages with no first-class IR parser (rust/solidity/cpp/go/swift/dart), via `../ir/tree-sitter-loader.js`. Gated behind `AGENTIC_SECURITY_TREE_SITTER=1` and the **optional** `web-tree-sitter` + `tree-sitter-wasms` deps (ABI-pinned 0.20.8 ↔ 0.1.13, marked `--external` so they're never bundled). Degrades to a no-op when the flag or deps are absent. First rule: Rust shell-spawn command injection (CWE-78). Anchoring on real AST nodes means comments/strings can't false-match.
 
 **Framework hardening** — `django-hardening.js`, `fastapi-hardening.js`, `laravel-hardening.js`, `quarkus-hardening.js`, `springboot-hardening.js`. Each detects "you used framework X but forgot the security-hardening step that ships with it" rather than a primary vuln.
 
-**Cross-cutting vuln classes** — `authz.js`, `csrf.js`, `host-header.js`, `jndi.js`, `jwt-exp.js`, `ldap-injection.js`, `xpath-injection.js`, `mass-assignment.js`, `mutation-xss.js`, `nosql-injection.js`, `prototype-pollution.js`, `ssrf-cloud-metadata.js`, `toctou.js`, `zip-slip.js`.
+**Framework structural (taint-independent, JS/Py recall)** — `js-framework-structural.js` (Express/Koa/NestJS/TypeORM: SQLi via `.query`/`.execute` concat-template, koa-send path, `ctx.body` XSS, HttpService SSRF, deep-merge prototype pollution) `python-structural.js` (Flask `render_template_string` XSS/SSTI, Django `.raw`/`.extra` + `cursor.execute` SQLi — robust string-literal matching spans embedded quotes like `"… name = '" + x`; `open()`/`send_file` path traversal via concat/f-string, CWE-22 deferring to `dropGuardedFindings`), and `go-structural.js` (db query + `fmt.Sprintf`/concat SQLi, `os.Open` + concat/Sprintf path traversal). High precision: parameterized/escaped/`{{ }}`-Jinja/`%s`-placeholder forms do NOT match; SSRF/path findings defer to `engine.js dropGuardedFindings` (which also drops a reflected-XSS finding when the reflected value passed through a captured HTML escaper — a *discarded* `escapeHtml(s);` does not count — and skips already-`isSanitized` findings so the suppression pipeline keeps its bookkeeping).
+
+**Cross-cutting vuln classes** — `authz.js`, `csrf.js` (POST/PUT/PATCH/DELETE state-changing routes without CSRF defence; defence-aware suppression covers Express/Fastify/Flask/Django/FastAPI/Spring/Symfony **and Go (gin/echo/mux), Rails routes, ASP.NET MVC** — recognizes `gorilla/csrf`/`protect_from_forgery`/`[ValidateAntiForgeryToken]` defences and exempts token-auth (`[ApiController]`, Bearer scheme); bare ASP.NET `[Authorize]` still flags as cookie auth is CSRF-vulnerable), `code-injection-multilang.js` (CWE-94 for Java/C#/Go/Kotlin — dynamic code/expression evaluators on a NON-LITERAL argument: javax.script `eval`, GroovyShell, Spring SpEL `parseExpression`, MVEL/OGNL, Roslyn `CSharpScript`, `DataTable.Compute`, yaegi `interp.Eval`, `text/template` Parse of a user-controlled body; literal arguments don't match. JS/Python/Ruby eval stay with the flow engine + per-language modules), `csv-injection.js` (formula injection into spreadsheet cells, CWE-1236), `secret-concat.js` (language-agnostic hardcoded-secret SPLIT across concatenated literals — `'AKIA' + 'IOSF…'` / `'ghp' + '_…'` / `'sk' + '_live_…'` — reassembled and matched against provider prefixes; complements the contiguous-token secrets scanner and the C#-only split-concat rule), `host-header.js`, `jndi.js`, `jwt-exp.js`, `ldap-injection.js` (CWE-90 across JS/Java/Python **and** PHP/Go/C#/Ruby/Kotlin — filter built by concat/interpolation; an inline call-guard and a file-level escape-API guard suppress `ldap_escape`/`EscapeFilter`/`escape_filter_chars`/`Net::LDAP::Filter`/`EqualityFilter` forms), `xpath-injection.js` (CWE-643 across Java/Python/JS **and** PHP/Go/Ruby/C#/Kotlin — XPath expression built by concat/interpolation: `DOMXPath->query`, `SelectNodes`, Nokogiri `.xpath`, htmlquery/xmlpath, `XPath.compile`; embedded-quote-tolerant literal matching; parameterized/variable-bound APIs and static literals don't match), `mass-assignment.js`, `mutation-xss.js`, `nosql-injection.js`, `prototype-pollution.js`, `response-splitting.js` (CWE-113 CRLF/header injection across JS/Python/Java/PHP/Go/Ruby/C#/Kotlin — a response header value set from a request source without stripping CR/LF; recognizes CRLF-strip sanitizers — `.replace(/[\r\n]/)`, chained `.replace("\r")`, Ruby `gsub`/`delete`, Go `strings.NewReplacer`, PHP `str_replace` — and a request-scope param heuristic for the JVM/C# single-file shape), `ssrf-cloud-metadata.js`, `xss-reflected-multilang.js` (cross-language reflected XSS for Go/Ruby/PHP/C#/Kotlin/Java — user input written into an HTML response via concat/interpolation, e.g. Java servlet `response.getWriter().write("<…" + q)`, with a per-language escaper exclusion so `htmlspecialchars`/`HtmlEncode`/`template.HTMLEscapeString`/ERB `<%= %>`/OWASP `Encode.forHtml` forms don't match; JS/Python XSS stays with the flow engine + framework structural detectors), `stored-taint.js` (second-order / stored injection — **opt-in** via `AGENTIC_SECURITY_STORED_TAINT=1`), `toctou.js`, `wrong-context-sanitizer.js` (HTML-entity encoder used in a URL context — wrong-context output encoding, CWE-79), `zip-slip.js`.
 
 **Cloud/infra** — `db-rls.js` (Supabase RLS), `env-hygiene.js` (NEXT_PUBLIC_ leaks, .env.example real values), `mobile-manifest.js`, `pipeline.js` (CI/CD integrity), `rate-limit.js`, `webhook.js`.
 
@@ -25,7 +31,7 @@ SAST detector modules. Each file exports one or more `scan*()` functions returni
 
 **Agent-of-agent / Claude Code hardening** — `claude-hook-injection.js`, `claude-md-prompt-injection.js`, `claude-settings.js`.
 
-**Auth / web** — `auth-provider.js`, `client-side.js`.
+**Auth / web** — `auth-provider.js`, `client-side.js`, `frontend-hygiene.js` (reverse tabnabbing CWE-1022, missing Subresource Integrity CWE-353, Angular `bypassSecurityTrust*` sanitizer-bypass CWE-79).
 
 **Bench-shape adapters (label-leakage, OFF by default)** — `bench-shape/` directory, plus `cpp-bench-extras.js`, `java-bench-extras.js`, `juliet-shape.js`, `primary-cwe-java.js`. These read Juliet / OWASP-Benchmark answer keys. Disabled unless `AGENTIC_SECURITY_BENCH_SHAPE=1`; `AGENTIC_SECURITY_BLIND_BENCH=1` overrides to force everything off. **Never use their emissions as a quality signal.**
 

package/src/sast/agent-untrusted-flow.js

@@ -0,0 +1,107 @@
+// R20 (PRD §5) — agent-loop taint: untrusted content → high-privilege tool.
+//
+// The agent threat that pattern matchers and ordinary taint both miss: content
+// the model does NOT control — a retrieved RAG document, a tool's output — is
+// fed into a side-effecting sink (shell/exec/eval). That's indirect prompt
+// injection escalating to code/command execution (OWASP LLM01 + Excessive
+// Agency). agent-tool-escalation.js flags the read+act tool COMBINATION; this
+// flags the actual DATA FLOW from an untrusted source into the sink, and only
+// when there is no mediation step (human approval, allow-list, sanitizer)
+// between them.
+//
+// Precision-first, like the other structural detectors: it runs only in
+// agent/LLM/RAG files, tracks untrusted source variables (+ one assignment
+// hop), and suppresses when a mediation token sits between source and sink.
+
+import { blankComments } from './_comment-strip.js';
+
+const AGENT_CONTEXT = /(retriever|vectorstore|vector_store|similarity_search|get_relevant_documents|langchain|llama_?index|page_content|@tool\b|tool_use|input_schema|ChatOpenAI|ChatAnthropic|create_react_agent|AgentExecutor|\.invoke\s*\()/i;
+
+// RHS APIs whose return value is attacker-influenceable retrieved content.
+const RETRIEVAL_API = /\b(get_relevant_documents|aget_relevant_documents|similarity_search(?:_with_score|_with_relevance_scores)?|max_marginal_relevance_search)\s*\(/;
+
+// A var assignment whose RHS calls a retrieval API → the LHS is untrusted.
+const SRC_ASSIGN = /(?:\b(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?[^\n;=]*?\b(?:get_relevant_documents|aget_relevant_documents|similarity_search(?:_with_score|_with_relevance_scores)?|max_marginal_relevance_search)\s*\(/g;
+
+// Untrusted member access that needs no variable tracking (the doc body).
+const UNTRUSTED_MEMBER = /\.(?:page_content|text)\b/;
+
+// High-privilege / side-effecting sinks (code + command execution).
+const SINKS = [
+  { re: /\b(?:exec|execSync|execFile|execFileSync|spawn|spawnSync)\s*\(/, label: 'child_process exec/spawn' },
+  { re: /\beval\s*\(/, label: 'eval()' },
+  { re: /\bnew\s+Function\s*\(/, label: 'new Function()' },
+  { re: /\bos\.system\s*\(/, label: 'os.system()' },
+  { re: /\bsubprocess\.(?:run|call|check_output|check_call|Popen)\s*\(/, label: 'subprocess' },
+  { re: /\b(?:Popen|check_output|getoutput|getstatusoutput)\s*\(/, label: 'subprocess' },
+];
+
+// A mediation/guard step between source and sink defuses the flow.
+// Substring match (NOT word-bounded): a guard token inside a compound
+// identifier — human_in_the_loop_approve, approveCommand, sanitizeInput,
+// isSafeCommand — must still count as mediation.
+const MEDIATION = /(approve|approval|confirm|human_in_the_loop|human_input|interrupt|require_consent|consent|allow_?list|whitelist|sanitiz|validate_command|validate_input|is_safe|safe_to_run|safeguard|deny|reject)/i;
+
+function lineOf(code, idx) { return code.slice(0, idx).split('\n').length; }
+
+export function scanAgentUntrustedFlow(fp, raw) {
+  if (typeof raw !== 'string' || !raw) return [];
+  if (!/\.(?:js|jsx|ts|tsx|mjs|cjs|py)$/i.test(fp)) return [];
+  const code = blankComments(raw);
+  if (!AGENT_CONTEXT.test(code)) return [];
+  const lines = code.split('\n');
+
+  // 1. Untrusted source variables (retrieval-API results) + one assignment hop.
+  const untrusted = new Map(); // varName -> defining line
+  let m;
+  SRC_ASSIGN.lastIndex = 0;
+  while ((m = SRC_ASSIGN.exec(code))) untrusted.set(m[1], lineOf(code, m.index));
+  // One hop: `X = <expr referencing an untrusted var or .page_content/.text>`.
+  const HOP = /(?:\b(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*([^\n;]+)/g;
+  for (let pass = 0; pass < 2; pass++) {
+    HOP.lastIndex = 0;
+    while ((m = HOP.exec(code))) {
+      const lhs = m[1], rhs = m[2];
+      if (untrusted.has(lhs)) continue;
+      if (UNTRUSTED_MEMBER.test(rhs) || [...untrusted.keys()].some((v) => new RegExp(`\\b${v}\\b`).test(rhs))) {
+        untrusted.set(lhs, lineOf(code, m.index));
+      }
+    }
+  }
+  if (!untrusted.size && !UNTRUSTED_MEMBER.test(code)) return [];
+
+  const findings = [];
+  const seen = new Set();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const sink of SINKS) {
+      if (!sink.re.test(line)) continue;
+      // Does the sink's argument reference untrusted content?
+      const argText = line.slice(line.search(sink.re));
+      const hitsMember = UNTRUSTED_MEMBER.test(argText);
+      const srcVar = [...untrusted.keys()].find((v) => new RegExp(`\\b${v}\\b`).test(argText));
+      if (!hitsMember && !srcVar) continue;
+      // Mediation between the source definition and this sink suppresses it.
+      const srcLine = srcVar ? untrusted.get(srcVar) : Math.max(1, i - 8);
+      const window = lines.slice(Math.max(0, srcLine - 1), i + 1).join('\n');
+      if (MEDIATION.test(window)) continue;
+      const key = `${i + 1}:${sink.label}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push({
+        id: `agent-untrusted-flow:${fp}:${i + 1}`,
+        severity: 'high',
+        file: fp,
+        line: i + 1,
+        vuln: 'Indirect Prompt Injection → Code/Command Execution (untrusted agent content reaches a high-privilege sink)',
+        cwe: '94',
+        owaspLlm: 'LLM01',
+        family: 'agent-untrusted-flow',
+        parser: 'AGENT-FLOW',
+        description: `Untrusted agent content (${srcVar ? `via \`${srcVar}\`` : 'a retrieved document body'}) flows into ${sink.label} with no mediation step. A poisoned document or tool output can drive code/command execution (indirect prompt injection → excessive agency).`,
+        remediation: 'Never pass retrieved/tool-derived content to a code/command sink. Require a human-approval/allow-list/sanitizer mediation step, or constrain the tool to a fixed, non-interpolated command.',
+      });
+    }
+  }
+  return findings;
+}

package/src/sast/api-authz.js

@@ -0,0 +1,71 @@
+// R19 (PRD §5) — OWASP API Top 10: Broken Object/Function Level Authorization.
+//
+// The data-layer IDOR detector (engine.js) catches `findById(req.params.id)`
+// without an ownership clause. This complements it at the ROUTE-INVENTORY
+// layer, where the highest-signal tell is INCONSISTENCY: a route registered in
+// a file whose siblings are authenticated, but which itself has no auth.
+//
+//   BFLA (API5): a state-changing route (POST/PUT/PATCH/DELETE) with no auth
+//                while sibling routes in the same file do enforce it.
+//   BOLA (API1): a route taking an object identifier (:id / {id} / <id>) with
+//                no auth, so object-level ownership cannot be enforced.
+//
+// Precision: we only fire inside files that DO authenticate some routes (an
+// authenticated API surface) — a fully-public API isn't flagged, and the
+// inconsistency is what makes a missing check a likely bug rather than intent.
+
+const STATE_CHANGING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+const ID_PARAM = /\/(?::\w*(?:id|key|uuid|guid|slug)\w*|\{\w*(?:id|key|uuid|guid|slug)\w*\}|<\w*(?:id|key|uuid|guid|slug)\w*>)/i;
+
+function mk(r, kind, api, cwe, why) {
+  return {
+    id: `api-authz:${kind}:${r.file}:${r.line}`,
+    severity: 'high',
+    file: r.file,
+    line: r.line || 0,
+    vuln: `Broken ${kind === 'BOLA' ? 'Object' : 'Function'} Level Authorization (${api})`,
+    cwe,
+    family: 'broken-access-control',
+    parser: 'API-AUTHZ',
+    description: why,
+    remediation: kind === 'BOLA'
+      ? 'Authenticate the route and verify the caller owns the referenced object (scope the lookup by req.user.id / tenantId), don\'t trust the id from the request alone.'
+      : 'Apply the same authentication/authorization middleware the sibling routes use; state-changing endpoints must enforce a role/permission check.',
+  };
+}
+
+/**
+ * Cross-route analysis over the aggregated route inventory (aR).
+ * Pure: takes routes[], returns Finding[].
+ */
+export function scanApiBrokenAuthz(routes) {
+  if (!Array.isArray(routes) || routes.length < 2) return [];
+  const byFile = new Map();
+  for (const r of routes) {
+    if (!r || r.path === '(file-based)' || !r.file) continue;
+    if (!byFile.has(r.file)) byFile.set(r.file, []);
+    byFile.get(r.file).push(r);
+  }
+  const findings = [];
+  const seen = new Set();
+  const push = (f) => { const k = `${f.file}:${f.line}`; if (seen.has(k)) return; seen.add(k); findings.push(f); };
+  for (const group of byFile.values()) {
+    if (group.length < 2) continue;
+    const authed = group.filter((r) => r.hasAuth).length;
+    // Only an authenticated API surface — at least one protected sibling, but
+    // not all (otherwise there's no inconsistency to flag).
+    if (authed < 1 || authed === group.length) continue;
+    for (const r of group) {
+      if (r.hasAuth) continue;
+      const idParam = ID_PARAM.test(r.path || '');
+      if (idParam) {
+        push(mk(r, 'BOLA', 'API1', '639',
+          `${r.method} ${r.path} takes an object identifier but enforces no authorization, while ${authed}/${group.length} sibling routes do. Object-level ownership cannot be enforced — an attacker can substitute another user's id.`));
+      } else if (STATE_CHANGING.has(r.method)) {
+        push(mk(r, 'BFLA', 'API5', '285',
+          `${r.method} ${r.path} is a state-changing route with no authorization, while ${authed}/${group.length} sibling routes in this file enforce it — a likely missing function-level access check.`));
+      }
+    }
+  }
+  return findings;
+}

package/src/sast/code-injection-multilang.js

@@ -0,0 +1,117 @@
+// Cross-language code-injection detector (CWE-94) — Java / C# / Go / Kotlin.
+//
+// The JS/Python/Ruby eval-family sinks are covered by the flow engine + the
+// per-language modules. The compiled second-tier languages had no CWE-94
+// coverage at all. This module flags the canonical dynamic-code-execution
+// sinks in those languages when the evaluated argument is NON-LITERAL (a
+// variable or expression) — a literal `eval("1+1")` is not injection.
+//
+// Sinks covered:
+//   Java/Kotlin (JVM):
+//     - javax.script ScriptEngine.eval(<expr>)
+//     - GroovyShell().evaluate(<expr>) / GroovyShell.parse
+//     - Spring SpEL: (Spel)ExpressionParser().parseExpression(<expr>)
+//     - MVEL.eval / OGNL: Ognl.getValue / OgnlUtil
+//   C#:
+//     - Roslyn: CSharpScript.EvaluateAsync/RunAsync(<expr>)
+//     - DataTable().Compute(<expr>, …)  (expression evaluator → injection)
+//   Go:
+//     - yaegi/gomacro interpreter: interp.Eval(<expr>)
+//     - text/template|html/template Parse(<expr>) of a NON-LITERAL template
+//       (user-controlled template body → action/code execution)
+//
+// Precision: the matched argument must not be a string literal. Escaped/safe
+// constructs (a literal template, a constant expression) don't match.
+
+import { blankComments } from './_comment-strip.js';
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+// A non-literal argument: an identifier / member / call expression — i.e. NOT
+// a bare string/char/number literal as the whole argument. Used as a trailing
+// assertion `(?!\s*STRING\s*\))` after the opening paren.
+const STR_LIT = String.raw`(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|@?"[^"]*")`;
+
+const REMEDIATION =
+  'Never evaluate runtime-built code. Replace the dynamic evaluator with an explicit ' +
+  'dispatch table / allow-list of operations, a sandboxed expression library with no ' +
+  'I/O and a fixed grammar, or precompiled templates whose body is never user-controlled. ' +
+  'For Spring SpEL use a SimpleEvaluationContext (no type/bean access); for Go templates ' +
+  'keep the template body static and pass values as data, never Parse user input.';
+
+// Per-language sink patterns. Each is built so the argument is captured and a
+// negative lookahead rejects a pure string-literal argument.
+function patternsFor(lang) {
+  // `(?!\s*<str>\s*[),])` — reject when the FIRST argument is a bare literal.
+  const notLiteral = String.raw`(?!\s*${STR_LIT}\s*[),])`;
+  if (lang === 'java' || lang === 'kt') {
+    return [
+      // ScriptEngine.eval(expr) — but not eval(reader) literal; require non-literal.
+      { key: 'script-eval', re: new RegExp(String.raw`\.\s*eval\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:ScriptEngine|ScriptEngineManager|getEngineByName|javax\.script|NashornScriptEngine)\b/ },
+      { key: 'groovy', re: new RegExp(String.raw`\bGroovyShell\s*\([^)]*\)\s*\.\s*(?:evaluate|parse)\s*\(\s*${notLiteral}`, 'g') },
+      { key: 'groovy2', re: new RegExp(String.raw`\b(?:GroovyShell|GroovyClassLoader)\b[\s\S]{0,120}?\.\s*(?:evaluate|parse|parseClass)\s*\(\s*${notLiteral}`, 'g') },
+      { key: 'spel', re: new RegExp(String.raw`\bparseExpression\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:SpelExpressionParser|ExpressionParser|org\.springframework\.expression)\b/ },
+      { key: 'mvel', re: new RegExp(String.raw`\bMVEL\s*\.\s*(?:eval|evalToString|compileExpression|executeExpression)\s*\(\s*${notLiteral}`, 'g') },
+      { key: 'ognl', re: new RegExp(String.raw`\bOgnl\s*\.\s*(?:getValue|setValue|parseExpression)\s*\(\s*${notLiteral}`, 'g') },
+    ];
+  }
+  if (lang === 'cs') {
+    return [
+      { key: 'roslyn', re: new RegExp(String.raw`\bCSharpScript\s*\.\s*(?:EvaluateAsync|RunAsync|Create)\s*\(\s*${notLiteral}`, 'g') },
+      { key: 'datatable-compute', re: new RegExp(String.raw`\.\s*Compute\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:DataTable|DataColumn|DataView)\b/ },
+    ];
+  }
+  if (lang === 'go') {
+    return [
+      // yaegi / gomacro interpreter eval of a non-literal.
+      { key: 'interp-eval', re: new RegExp(String.raw`\.\s*Eval\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:interp|yaegi|gomacro|Interpreter)\b/ },
+      // template Parse of a non-literal template body (user-controlled template).
+      { key: 'template-parse', re: new RegExp(String.raw`\.\s*Parse\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:text\/template|html\/template|template\.New)\b/ },
+    ];
+  }
+  return [];
+}
+
+function _lang(fp) {
+  if (/\.java$/i.test(fp)) return 'java';
+  if (/\.kt$/i.test(fp)) return 'kt';
+  if (/\.cs$/i.test(fp)) return 'cs';
+  if (/\.go$/i.test(fp)) return 'go';
+  return null;
+}
+
+export function scanCodeInjectionMultilang(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  const lang = _lang(fp);
+  if (!lang) return [];
+  const code = blankComments(raw);
+  const pats = patternsFor(lang);
+  const findings = [];
+  const seen = new Set();
+
+  for (const { key, re, gate } of pats) {
+    if (gate && !gate.test(code)) continue;
+    const r = new RegExp(re.source, re.flags);
+    let m;
+    while ((m = r.exec(code))) {
+      const line = lineOf(code, m.index);
+      const id = `code-injection-ml:${fp}:${line}:${key}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      findings.push({
+        id, file: fp, line,
+        vuln: 'Code Injection — dynamic code/expression evaluation of a non-literal argument',
+        severity: 'critical', cwe: 'CWE-94', family: 'code-injection',
+        parser: lang.toUpperCase(), confidence: 0.7, stride: 'Elevation of Privilege',
+        snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+        remediation: REMEDIATION,
+      });
+    }
+  }
+  return findings;
+}

package/src/sast/cross-service.js

@@ -0,0 +1,98 @@
+// R22 (PRD §5) — cross-service dataflow (contract-file-free).
+//
+// posture/cross-lang-* links services through a shared contract artifact
+// (OpenAPI/proto). This infers the edge directly from CODE: an HTTP client call
+// whose URL path matches a route registered in ANOTHER file is a service edge.
+// When the client sends user-controlled data over that edge — especially to an
+// UNAUTHENTICATED internal endpoint — data crosses a trust boundary unobserved.
+//
+// Pure cross-file analysis over the aggregated route inventory + file contents.
+// Path matching normalizes dynamic segments (/:id, /{id}, numeric) so a literal
+// client URL aligns with a parameterized route. Precision-first: requires a
+// real route match AND user-controlled data in the client call.
+
+const CLIENT_CALLS = [
+  /\bfetch\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+  /\baxios\s*\.\s*(?:get|post|put|patch|delete|request)\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+  /\baxios\s*\(\s*\{[^}]*?\burl\s*:\s*[`'"]([^`'"]+)[`'"]/g,
+  /\b(?:got|ky|superagent|needle)\s*(?:\.\s*\w+)?\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+  /\brequests\s*\.\s*(?:get|post|put|patch|delete)\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+  /\bhttpClient\s*\.\s*\w+\s*\(\s*[`'"]([^`'"]+)[`'"]/g,
+];
+const USER_DATA = /\b(?:req\.(?:body|params|query|headers)|request\.(?:data|json|args)|ctx\.request|params|\.body\b|userInput|user_input|formData)\b/;
+
+// Normalize a URL path: drop scheme+host, collapse dynamic segments to '*'.
+export function normalizePath(url) {
+  let p = String(url || '').trim();
+  p = p.replace(/^[a-z]+:\/\/[^/]+/i, '');            // strip scheme://host
+  p = p.replace(/[?#].*$/, '');                        // strip query/hash
+  if (!p.startsWith('/')) p = '/' + p;
+  const segs = p.split('/').map((s) => {
+    if (/^(?::\w+|\{\w+\}|<\w+>|\*|\$\{[^}]+\}|\d+)$/.test(s)) return '*';
+    return s.toLowerCase();
+  });
+  let out = segs.join('/').replace(/\/+$/, '');
+  return out || '/';
+}
+
+function lineOf(text, idx) { return text.slice(0, idx).split('\n').length; }
+
+/**
+ * routes: aggregated route inventory (aR). fileContents: { file: text }.
+ * Returns cross-service edge findings.
+ */
+export function scanCrossService(routes, fileContents) {
+  if (!Array.isArray(routes) || !routes.length) return [];
+  // Index server routes by normalized path → list of {route}.
+  const byPath = new Map();
+  for (const r of routes) {
+    if (!r || r.path === '(file-based)' || !r.path || !r.path.startsWith('/')) continue;
+    const np = normalizePath(r.path);
+    if (!byPath.has(np)) byPath.set(np, []);
+    byPath.get(np).push(r);
+  }
+  if (!byPath.size) return [];
+
+  const findings = [];
+  const seen = new Set();
+  for (const [file, content] of Object.entries(fileContents || {})) {
+    if (typeof content !== 'string') continue;
+    for (const re of CLIENT_CALLS) {
+      const rx = new RegExp(re.source, re.flags);
+      let m;
+      while ((m = rx.exec(content))) {
+        const url = m[1];
+        const np = normalizePath(url);
+        const targets = byPath.get(np);
+        if (!targets) continue;
+        // Only a cross-FILE edge is interesting (same-file is a local call).
+        const remote = targets.find((t) => t.file !== file);
+        if (!remote) continue;
+        const line = lineOf(content, m.index);
+        // Is user-controlled data in the call's vicinity?
+        const ctx = content.slice(m.index, m.index + 240);
+        const carriesUserData = USER_DATA.test(ctx);
+        if (!carriesUserData) continue; // precision: only flag tainted edges
+        const key = `${file}:${line}:${np}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        const unauthed = remote.hasAuth === false;
+        findings.push({
+          id: `cross-service:${file}:${line}`,
+          severity: unauthed ? 'high' : 'medium',
+          file, line,
+          vuln: `Cross-service flow: user-controlled data sent to ${remote.method} ${remote.path}${unauthed ? ' (unauthenticated internal endpoint)' : ''}`,
+          cwe: unauthed ? 'CWE-862' : 'CWE-668',
+          family: 'cross-service',
+          parser: 'XSERVICE',
+          description: `This client call carries user-controlled data to ${remote.method} ${remote.path}, defined in ${remote.file}. Data crosses a service boundary here${unauthed ? ', and the target route enforces no authentication — an attacker-reachable internal endpoint' : ''}. Inferred from code (no shared contract file).`,
+          remediation: unauthed
+            ? 'Authenticate/authorize the internal endpoint and validate the forwarded payload at the receiving service; never trust cross-service input implicitly.'
+            : 'Validate and authorize the forwarded payload at the receiving service; treat cross-service input as untrusted.',
+          _edge: { from: file, to: remote.file, route: `${remote.method} ${remote.path}` },
+        });
+      }
+    }
+  }
+  return findings;
+}