@holmes-lab/holmes-kit 0.3.11 → 0.4.1

package/dist/holmes/mcp/handlers.d.ts

@@ -312,15 +312,27 @@ declare function makeRawHandlers(store: SpecStore, opts?: ElicitOpts): {
      */
     taint_scan(a: {
         root: string;
+        dataFlow?: boolean;
     }): Promise<{
+        kind: string;
+        limits: ("name-based matching" | "no def-use" | "no sanitizers" | "call-edge-only")[];
+        maxPaths: number | undefined;
+        truncated: number;
+        pairs: import("../rtm/taint").TaintPair[];
+    } | {
         ok: boolean;
         reason: string;
-        kind?: undefined;
-        limits?: undefined;
-        maxPaths?: undefined;
-        truncated?: undefined;
-        pairs?: undefined;
     } | {
+        dataFlow: {
+            findings: Record<string, unknown>[];
+            /** Findings the reaching-definition evidence positively refuted (dead or fully sanitized). */
+            refutedByReachingDefs: number;
+            limits: ("no field sensitivity (obj.a and obj.b are one value)" | "no aliasing" | "no path sensitivity" | "no container/element tracking" | "no reflection or dynamic dispatch" | "sink matching is by callee NAME with no receiver type — RE.exec(s) is indistinguishable from child_process.exec(s)" | "no anonymous-function parameters (arrow/function-expression params are not bound)" | "not statement-order sensitive — a variable tainted anywhere in a function is tainted throughout it" | "reports reachability of tainted data to a sink, never exploitability")[];
+            converged: boolean;
+            truncated: number;
+            /** Which languages this run could actually judge, so a zero is readable. */
+            languagesAnalysed: (string | null)[];
+        };
         kind: string;
         limits: ("name-based matching" | "no def-use" | "no sanitizers" | "call-edge-only")[];
         maxPaths: number | undefined;

package/dist/holmes/mcp/handlers.js

@@ -1688,7 +1688,104 @@ function makeRawHandlers(store, opts) {
                 (0, rtm_builder_1.buildRtm)(await store.list(), scanned, g);
                 const cfg = taint_1.DEFAULT_TAINT_CONFIG;
                 const { pairs, truncated } = (0, taint_1.taintReachability)(g, cfg);
-                return { kind: 'call-reachability', limits: [...taint_1.TAINT_LIMITS], maxPaths: cfg.maxPaths, truncated, pairs };
+                const base = { kind: 'call-reachability', limits: [...taint_1.TAINT_LIMITS], maxPaths: cfg.maxPaths, truncated, pairs };
+                if (a.dataFlow !== true)
+                    return base;
+                // @implements A-SPEC-512.2
+                // OPT-IN def-use lane. Measured 2026-09-02: extracting data-flow facts over this
+                // repository costs 7.6s on top of the scan, which is why this follows the `cpg_scan
+                // lints:true` precedent instead of running by default. Before this slice the engine
+                // (A-SPEC-140.1, with its own 13-case benchmark) had NO caller at all — capability
+                // present, unreachable. Findings are filtered by reaching definitions: inter-procedural
+                // arrival is preserved, and only what the DDG positively refutes is dropped.
+                const { TreeSitterTsParser } = require('../cpg/language-parser');
+                const { taintDataFlow, DATAFLOW_LIMITS } = require('../rtm/dataflow-taint');
+                const { filterFindingsForFile } = require('../rtm/reaching-def-filter');
+                // @implements A-SPEC-513.1 — vocabulary is SELECTED per file language, never unioned:
+                // Python's `input(` must not taint a TypeScript `input`, and `req.body` means nothing in
+                // Python. Measured on jarvis: the shipped (JS) list missed `subprocess.run`, `os.environ`
+                // and `input(` entirely, so a Python repository could only ever report zero.
+                const { vocabularyFor } = require('../rtm/taint-vocabulary');
+                const parser = new TreeSitterTsParser();
+                const factSet = [];
+                const pythonFiles = [];
+                for (const f of scanned) {
+                    const vocab = vocabularyFor(f.sourcePath);
+                    if (!vocab)
+                        continue;
+                    if (/\.py$/i.test(f.sourcePath)) {
+                        pythonFiles.push(f.sourcePath);
+                        continue;
+                    }
+                    let src;
+                    try {
+                        src = fs.readFileSync(path.join(root, f.sourcePath), 'utf8');
+                    }
+                    catch {
+                        continue;
+                    }
+                    const facts = parser.extractDataFlow(src, f.sourcePath.endsWith('x') ? 'tsx' : 'typescript');
+                    if (facts)
+                        factSet.push({ file: f.sourcePath, facts });
+                }
+                const tsVocab = vocabularyFor('x.ts');
+                const raw = taintDataFlow(factSet, tsVocab);
+                const byFile = new Map();
+                for (const fnd of raw.findings)
+                    byFile.set(fnd.file, [...(byFile.get(fnd.file) ?? []), fnd]);
+                const kept = [];
+                let refuted = 0;
+                for (const [rel, fs2] of byFile) {
+                    const out = await filterFindingsForFile(root, rel, fs2, tsVocab);
+                    kept.push(...out.kept.map((f) => ({ ...f, lane: 'facts+reaching-defs' })));
+                    refuted += out.removed.length;
+                }
+                // @implements A-SPEC-513.1 — Python takes the flow-sensitive lane directly: its facts
+                // extractor has no Python walk, but its CFG/DDG do (S-510.7), and the judgement above
+                // them is language-agnostic.
+                const pyVocab = vocabularyFor('x.py');
+                if (pythonFiles.length > 0) {
+                    const { parseAst } = require('../cpg/foundation/ast-store');
+                    const { cfgOf, functionsIn } = require('../cpg/foundation/cfg');
+                    const { ddgOf } = require('../cpg/foundation/ddg');
+                    const { flowSensitiveTaint } = require('../rtm/flow-sensitive-taint');
+                    for (const rel of pythonFiles) {
+                        let src;
+                        try {
+                            src = fs.readFileSync(path.join(root, rel), 'utf8');
+                        }
+                        catch {
+                            continue;
+                        }
+                        const ast = await parseAst(src, rel);
+                        if (!ast || ast.errorCount > 0)
+                            continue;
+                        for (const fn of functionsIn(ast)) {
+                            const fcfg = cfgOf(ast, fn, src);
+                            if ('unsupported' in fcfg)
+                                continue;
+                            const fddg = ddgOf(ast, fcfg, fn, src);
+                            if ('unsupported' in fddg)
+                                continue;
+                            const r = flowSensitiveTaint({ ast, cfg: fcfg, ddg: fddg, source: src, fnName: rel, config: pyVocab });
+                            for (const f of r.findings)
+                                kept.push({ ...f, file: rel, lane: 'flow-sensitive' });
+                        }
+                    }
+                }
+                return {
+                    ...base,
+                    dataFlow: {
+                        findings: kept,
+                        /** Findings the reaching-definition evidence positively refuted (dead or fully sanitized). */
+                        refutedByReachingDefs: refuted,
+                        limits: [...DATAFLOW_LIMITS],
+                        converged: raw.converged,
+                        truncated: raw.truncated,
+                        /** Which languages this run could actually judge, so a zero is readable. */
+                        languagesAnalysed: [...new Set([factSet.length > 0 ? 'typescript' : null, pythonFiles.length > 0 ? 'python' : null].filter(Boolean))],
+                    },
+                };
             }
             finally {
                 g.close();

package/dist/holmes/mcp/supervisor.d.ts

@@ -15,6 +15,30 @@ export declare function autoreloadEnabled(env: NodeJS.ProcessEnv): boolean;
  * question, which is worse than the staleness it was fixing.
  */
 export declare function shouldSwap(loaded: string, disk: string | undefined, inflight: number): boolean;
+export interface ResponseCounter {
+    /** How many JSON-RPC replies COMPLETED in this chunk. */
+    push(chunk: string): number;
+}
+/**
+ * Counts JSON-RPC replies by LINE, because a chunk is not a line.
+ *
+ * The previous rule — `line.startsWith('{') && line.includes('"id"')` applied to each stdout chunk —
+ * held only while replies were small. JSON-RPC puts `"id"` at the END of a reply object, so a 1.4MB
+ * response arrives as ~22 chunks of which the first begins with `{` but carries no `"id"`, and the
+ * last carries `"id"` but does not begin with `{`. Measured: zero decrements, `inflight` stuck at 1
+ * forever, and the child never replaced again — live, the server ran three commits behind across
+ * four rebuilds while the isolated supervisor swapped correctly every time.
+ *
+ * The root was an asymmetry inside this one file: the stdin direction already buffers into lines and
+ * only this direction did not. It is fixed here rather than by buffering the line, because holding a
+ * 1.4MB string purely to count it would allocate a second copy of something already relayed. Two
+ * bits and a three-character tail are all the decision needs.
+ *
+ * Pure and exported for the same reason `shouldSwap` is: the sibling of this bug (incrementing
+ * before deciding, A-SPEC-162) also passed every unit test and was caught only by a live probe.
+ * The predicate was testable and its caller was not, which is exactly where both defects lived.
+ */
+export declare function createResponseCounter(): ResponseCounter;
 /**
  * Runs the real server as a child and relays stdio, replacing the child when the build changes.
  *

package/dist/holmes/mcp/supervisor.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Supervisor = exports.AUTORELOAD_ENV = void 0;
 exports.autoreloadEnabled = autoreloadEnabled;
 exports.shouldSwap = shouldSwap;
+exports.createResponseCounter = createResponseCounter;
 // @implements A-SPEC-162
 const node_child_process_1 = require("node:child_process");
 const path = __importStar(require("node:path"));
@@ -66,6 +67,59 @@ function shouldSwap(loaded, disk, inflight) {
         return false;
     return inflight === 0;
 }
+const ID_NEEDLE = '"id"';
+// @implements A-SPEC-516.1
+/**
+ * Counts JSON-RPC replies by LINE, because a chunk is not a line.
+ *
+ * The previous rule — `line.startsWith('{') && line.includes('"id"')` applied to each stdout chunk —
+ * held only while replies were small. JSON-RPC puts `"id"` at the END of a reply object, so a 1.4MB
+ * response arrives as ~22 chunks of which the first begins with `{` but carries no `"id"`, and the
+ * last carries `"id"` but does not begin with `{`. Measured: zero decrements, `inflight` stuck at 1
+ * forever, and the child never replaced again — live, the server ran three commits behind across
+ * four rebuilds while the isolated supervisor swapped correctly every time.
+ *
+ * The root was an asymmetry inside this one file: the stdin direction already buffers into lines and
+ * only this direction did not. It is fixed here rather than by buffering the line, because holding a
+ * 1.4MB string purely to count it would allocate a second copy of something already relayed. Two
+ * bits and a three-character tail are all the decision needs.
+ *
+ * Pure and exported for the same reason `shouldSwap` is: the sibling of this bug (incrementing
+ * before deciding, A-SPEC-162) also passed every unit test and was caught only by a live probe.
+ * The predicate was testable and its caller was not, which is exactly where both defects lived.
+ */
+function createResponseCounter() {
+    let startsWithBrace = null;
+    let sawId = false;
+    let carry = '';
+    const reset = () => { startsWithBrace = null; sawId = false; carry = ''; };
+    return {
+        push(chunk) {
+            let counted = 0;
+            const parts = chunk.split('\n');
+            parts.forEach((part, i) => {
+                if (startsWithBrace === null) {
+                    const firstChar = part.trimStart().charAt(0);
+                    if (firstChar !== '')
+                        startsWithBrace = firstChar === '{';
+                }
+                // The carry covers a needle torn across the boundary; without it a reply whose `"id"` lands
+                // on a chunk seam is invisible to both chunks.
+                if (!sawId && (carry + part).includes(ID_NEEDLE))
+                    sawId = true;
+                if (i < parts.length - 1) {
+                    if (startsWithBrace === true && sawId)
+                        counted++;
+                    reset(); // the line ended; nothing carries into the next
+                }
+                else {
+                    carry = part.slice(-(ID_NEEDLE.length - 1));
+                }
+            });
+            return counted;
+        },
+    };
+}
 /**
  * Runs the real server as a child and relays stdio, replacing the child when the build changes.
  *
@@ -160,15 +214,18 @@ class Supervisor {
         });
         child.stderr.on('data', (d) => process.stderr.write(d));
         this.child = child;
+        // @implements A-SPEC-516.1 — one counter per child: a half-read line from the process being
+        // replaced must not be finished by its successor's first chunk.
+        const counter = createResponseCounter();
         child.stdout.on('data', (d) => {
             const text = d.toString();
-            // Count replies out so `inflight` returns to zero; the id itself does not matter here, only
-            // that a response arrived for something that was counted in.
-            for (const line of text.split('\n')) {
-                if (line.trim().startsWith('{') && line.includes('"id"') && this.inflight > 0)
-                    this.inflight--;
-            }
+            // Relay FIRST. Counting is an observation and must never delay or alter the bytes.
             stdout.write(text);
+            // Count replies out so `inflight` returns to zero; the id itself does not matter here, only
+            // that a response arrived for something that was counted in. Never below zero — a negative
+            // count would let a swap happen mid-request, which is the mis-delivered answer this whole
+            // mechanism defers swaps to avoid.
+            this.inflight = Math.max(0, this.inflight - counter.push(text));
         });
     }
     stop() {

package/dist/holmes/mcp/tool-schemas.js

@@ -182,7 +182,14 @@ exports.TOOL_SCHEMAS = {
         description: 'Call-graph taint REACHABILITY screen: source-named functions (getenv/argv/req.body/…) that reach sink-named functions (exec/eval/query/…) through call edges. Returns { kind:"call-reachability", limits, maxPaths, truncated, pairs } where each pair is a source→sink candidate call path. This is a SCREENING signal that routes a security review — NOT a data-flow proof and NOT a vulnerability verdict (no def-use, no sanitizers, name-based matching, call-edge-only, as the limits state).',
         inputSchema: {
             type: 'object',
-            properties: { root: ROOT },
+            properties: {
+                root: ROOT,
+                // @implements A-SPEC-512.2 — opt-in def-use lane (measured +7.6s on a 500-file repo), the
+                // same shape `cpg_scan lints` uses. Adds `dataFlow: { findings, refutedByReachingDefs,
+                // limits }`: source→sink flows recovered from definitions and uses, with findings the
+                // reaching-definition evidence refutes (dead or fully sanitized values) removed.
+                dataFlow: { type: 'boolean', description: 'Also run the def-use data-flow lane (slower). Adds a `dataFlow` section with reaching-definition-filtered findings.' },
+            },
             required: ['root'],
         },
     },

package/dist/holmes/project/root.d.ts

@@ -1,4 +1,5 @@
 export declare function cleanSubprocessEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function cleanTestEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /**
  * Where a project begins, for a harness that must not require version control.
  *

package/dist/holmes/project/root.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.canonicalPath = exports.MARKER = void 0;
 exports.cleanSubprocessEnv = cleanSubprocessEnv;
+exports.cleanTestEnv = cleanTestEnv;
 exports.resolveProjectRoot = resolveProjectRoot;
 // @implements A-SPEC-205
 // @implements A-SPEC-128
@@ -56,6 +57,35 @@ function cleanSubprocessEnv(env = process.env) {
     }
     return cleaned;
 }
+// @implements A-SPEC-514.1
+/**
+ * The environment a TEST subprocess gets — the secret scrub plus the configuration that steers a
+ * project's own judgement.
+ *
+ * `cleanSubprocessEnv` removes secrets, and configuration is not a secret, which is exactly how
+ * `HOLMES_SPECS` reached jest. Measured 2026-09-02: `test_run` reported 1 failed / 2142 passed
+ * twice on a commit whose full suite was green, because the MCP server's `HOLMES_SPECS` reached
+ * the suite and `isGovernedProject` short-circuited on it. The recorded lesson until then was
+ * contamination masking RED as GREEN; this is the same root pointing the other way. Evidence that
+ * depends on the shell it was measured in is not evidence.
+ *
+ * The list is EXPLICIT rather than a `/^HOLMES_/` sweep. A prefix sweep would pass every test here
+ * and still take a variable some project's own suite needs — the same false red, from the other
+ * side.
+ *
+ * `HOLMES_GATE_BYPASS` is scrubbed too: the operator's out-of-band escape hatch leaking into an
+ * evidence run would disarm every test that verifies a gate, and that contamination masks red as
+ * green — the worse direction of the two.
+ */
+const TEST_SCRUB_KEYS = new Set(['HOLMES_SPECS', 'HOLMES_GATE_BYPASS', 'HOLMES_MCP_AUTORELOAD', 'HOLMES_MCP_PROFILE']);
+function cleanTestEnv(env = process.env) {
+    const cleaned = cleanSubprocessEnv(env);
+    for (const k of Object.keys(cleaned)) {
+        if (TEST_SCRUB_KEYS.has(k.toUpperCase()))
+            delete cleaned[k];
+    }
+    return cleaned;
+}
 /** The marker directory that makes a directory a Holmes-Kit project. */
 exports.MARKER = '.ax';
 /**

package/dist/holmes/review/test-runner.d.ts

@@ -160,3 +160,18 @@ export declare function runGo(files: string[], mode: TestRunPlan['mode'], cwd: s
  * gate that ran part of its scope has verified less than it reports.
  */
 export declare function runTestScope(scope: TestScope, cwd: string): TestRunResult;
+export declare function tailOf(s: string, opts?: number | {
+    lines?: number;
+    maxChars?: number;
+}): string;
+/**
+ * The summary a green jest run always had — it was inside the `--json` payload rather than absent.
+ *
+ * jest writes its human summary to stderr, and the success branch reads stdout only, so the tail of
+ * a passing run carried no counts at all. The counts are right there in the JSON; this assembles
+ * them into the two lines a reader actually wanted.
+ *
+ * Returns null on anything it cannot read, and the caller falls back to the truncated original:
+ * a failed summary must not turn partial information into none.
+ */
+export declare function summarizeJestJson(stdout: string): string | null;

package/dist/holmes/review/test-runner.js

@@ -46,11 +46,16 @@ exports.runGradle = runGradle;
 exports.runDotnet = runDotnet;
 exports.runGo = runGo;
 exports.runTestScope = runTestScope;
+exports.tailOf = tailOf;
+exports.summarizeJestJson = summarizeJestJson;
 // @implements A-SPEC-102.1
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
+// @implements A-SPEC-514.1 — every TEST spawn goes out through a cleaned environment. The
+// `--version` probes above stay as they are: they do not judge anything.
+const root_1 = require("../project/root");
 const python_env_1 = require("./python-env");
 // Runner stdout ceiling. Measured 2026-09-01 on this repo: a full `jest --json` for 289 suites /
 // 4568 tests emits >2MB, and execFileSync's DEFAULT maxBuffer (1MB) kills the child with ENOBUFS —
@@ -239,8 +244,11 @@ function runJest(files, mode, cwd) {
         ? [...pre, '--silent', '--json', '--runTestsByPath', '--', ...safeFiles]
         : [...pre, '--silent', '--json'];
     try {
-        const out = (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
-        return { passed: true, tail: tailOf(out), executed: parseExecutedCounts(out, cwd) };
+        const out = (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
+        // @implements A-SPEC-515.1 — the green path says what happened instead of handing back the
+        // whole `--json` document. `tailOf` wraps the result too, so an unexpectedly long summary is
+        // still bounded: a cap that any one path can escape is not a cap.
+        return { passed: true, tail: tailOf(summarizeJestJson(out) ?? out), executed: parseExecutedCounts(out, cwd) };
     }
     catch (e) {
         const err = e;
@@ -277,7 +285,7 @@ function runPytest(files, mode, cwd) {
         }
     };
     try {
-        const out = (0, node_child_process_1.execFileSync)(python, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+        const out = (0, node_child_process_1.execFileSync)(python, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
         return { passed: true, tail: tailOf(out), executed: read() };
     }
     catch (e) {
@@ -332,7 +340,7 @@ function runCargo(files, _mode, cwd, opts) {
     let out = '';
     let ok = true;
     try {
-        out = (0, node_child_process_1.execFileSync)('cargo', ['test'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+        out = (0, node_child_process_1.execFileSync)('cargo', ['test'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
     }
     catch (e) {
         const err = e;
@@ -425,7 +433,7 @@ function runGradle(files, _mode, cwd, opts) {
     }
     let ok = true;
     try {
-        (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+        (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
     }
     catch {
         ok = false;
@@ -457,7 +465,7 @@ function runDotnet(files, _mode, cwd, opts) {
     const report = path.join(dir, 'junit.xml');
     let ok = true;
     try {
-        (0, node_child_process_1.execFileSync)('dotnet', ['test', '--logger', `junit;LogFilePath=${report}`], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+        (0, node_child_process_1.execFileSync)('dotnet', ['test', '--logger', `junit;LogFilePath=${report}`], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
     }
     catch {
         ok = false;
@@ -504,7 +512,7 @@ function runGo(files, mode, cwd, opts) {
     const runDir = (dirArg, creditFiles) => {
         let out = '';
         try {
-            out = (0, node_child_process_1.execFileSync)('go', ['test', '-json', dirArg], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+            out = (0, node_child_process_1.execFileSync)('go', ['test', '-json', dirArg], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
         }
         catch (e) {
             const err = e;
@@ -617,6 +625,76 @@ function runTestScope(scope, cwd) {
         executedByFile: {}, unsupported, ranWith: [],
     };
 }
-function tailOf(s, n = 6) {
-    return s.trim().split('\n').slice(-n).join('\n');
+// @implements A-SPEC-515.1
+/**
+ * The last few lines of a runner's output, bounded by SIZE as well as by line count.
+ *
+ * A line budget is only a size budget while the lines are short, and jest `--json` breaks that
+ * assumption completely: it emits one line. Measured 2026-09-02 — a GREEN `test_run` returned
+ * 1,432,092 characters, of which this field was 1,421,327 (99.2%) across "6 lines" whose longest
+ * was 1,420,959. The usefulness was inverted: a red run gave six clean lines of stderr summary,
+ * and a green run gave the whole document.
+ *
+ * The END is what survives a cut. A runner's conclusion is always at the bottom.
+ */
+const TAIL_MAX_CHARS = 4000;
+function tailOf(s, opts = {}) {
+    // The numeric spelling is the one the go adapter uses (`tailOf(err.stderr, 2)`); keeping it means
+    // this change cannot silently alter a caller that only ever wanted fewer lines.
+    const { lines = 6, maxChars = TAIL_MAX_CHARS } = typeof opts === 'number' ? { lines: opts } : opts;
+    const picked = s.trim().split('\n').slice(-lines).join('\n');
+    if (picked.length <= maxChars)
+        return picked;
+    const dropped = picked.length - maxChars;
+    return `[…앞부분 ${dropped}자 생략…]\n${picked.slice(-maxChars)}`;
+}
+// @implements A-SPEC-515.1
+/**
+ * The summary a green jest run always had — it was inside the `--json` payload rather than absent.
+ *
+ * jest writes its human summary to stderr, and the success branch reads stdout only, so the tail of
+ * a passing run carried no counts at all. The counts are right there in the JSON; this assembles
+ * them into the two lines a reader actually wanted.
+ *
+ * Returns null on anything it cannot read, and the caller falls back to the truncated original:
+ * a failed summary must not turn partial information into none.
+ */
+function summarizeJestJson(stdout) {
+    // The payload is not the whole of stdout. A suite that logs anything prints it BEFORE the JSON,
+    // and this repository's own suite does: measured, the first live run after this function landed
+    // still returned 1.4MB because `JSON.parse(stdout)` threw on the console noise and the fallback
+    // handed back the raw document. `parseExecutedCounts` already locates the payload from the first
+    // `{`; using a second, stricter rule for the same string is how the two quietly disagree.
+    const start = stdout.indexOf('{');
+    if (start < 0)
+        return null;
+    let j;
+    try {
+        j = JSON.parse(stdout.slice(start));
+    }
+    catch {
+        return null;
+    }
+    if (j === null || typeof j !== 'object')
+        return null;
+    const num = (k) => (typeof j[k] === 'number' ? j[k] : null);
+    const totalSuites = num('numTotalTestSuites');
+    const totalTests = num('numTotalTests');
+    if (totalSuites === null || totalTests === null)
+        return null;
+    const line = (label, failed, skipped, passed, total) => {
+        const parts = [];
+        if (failed !== null && failed > 0)
+            parts.push(`${failed} failed`);
+        if (skipped !== null && skipped > 0)
+            parts.push(`${skipped} skipped`);
+        if (passed !== null)
+            parts.push(`${passed} passed`);
+        parts.push(`${total} total`);
+        return `${label}${parts.join(', ')}`;
+    };
+    return [
+        line('Test Suites: ', num('numFailedTestSuites'), num('numPendingTestSuites'), num('numPassedTestSuites'), totalSuites),
+        line('Tests:       ', num('numFailedTests'), num('numPendingTests'), num('numPassedTests'), totalTests),
+    ].join('\n');
 }

package/dist/holmes/rtm/dataflow-taint.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DATAFLOW_LIMITS = void 0;
 exports.taintDataFlow = taintDataFlow;
+const sink_matching_1 = require("./sink-matching");
 /**
  * What this pass does NOT model. Carried in every result, for the same reason REQ-138 carries
  * `TAINT_LIMITS`: a screening signal that does not state its blind spots is read as a proof.
@@ -226,7 +227,10 @@ function taintDataFlow(factSet, cfg) {
     // SINK — reported after the fixpoint, so a finding always reflects the complete taint state.
     const all = [];
     for (const c of calls) {
-        if (!matchesName(c.callee, cfg.sinks))
+        // @implements A-SPEC-512.3 — the ONE sink decision, receiver-aware: an exact name match that
+        // is not a RegExp method on a regex receiver. 16 of this repository's 19 findings were
+        // `re.exec(...)` before this delegation.
+        if (!(0, sink_matching_1.isSinkCall)(c.calleeText ?? c.callee, c.callee, cfg.sinks))
             continue;
         for (let i = 0; i < c.args.length; i++) {
             const from = carrier(c.args[i], fid(c.file, c.fn));

package/dist/holmes/rtm/flow-sensitive-taint.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The CPG foundation's FIRST consumer: taint judged on REACHING DEFINITIONS instead of on
+ * "was a sanitizer mentioned anywhere in this function".
+ *
+ * The rules do not change — sources, sinks and sanitizers come from the same config the
+ * flow-insensitive engine uses. What changes is what those rule matches are COMBINED over: a
+ * tainted definition is dangerous only if it actually REACHES the sink's use. Two measured false
+ * positives fall out of that automatically:
+ *   `let c = req.body.cmd; c = "ls"; exec(c);`          → the constant redefinition kills the taint
+ *   `if (s) { c = clean(c); } else { c = clean(c); }`   → every path redefines, so nothing tainted arrives
+ * and one thing deliberately does NOT change: when only ONE branch sanitizes, the tainted
+ * definition still reaches, so the finding stands. This is a may-analysis and stays one —
+ * trading a false positive for a false negative would not be an improvement (REQ-512).
+ */
+import type { PersistedAst } from '../cpg/foundation/ast-store';
+import type { Cfg } from '../cpg/foundation/cfg';
+import type { Ddg } from '../cpg/foundation/ddg';
+import type { DataFlowTaintConfig } from './dataflow-taint';
+export interface FlowTaintFinding {
+    fn: string;
+    callee: string;
+    line: number;
+    argIndex: number;
+    argText: string;
+    /** Why this is reported: the tainted definition that reaches this sink use. */
+    taintedDef: string;
+}
+export interface FlowTaintResult {
+    findings: FlowTaintFinding[];
+    mode: 'flow-sensitive';
+    /** Per-statement classification, exposed so a test can prove the DDG was actually consulted. */
+    taintedDefStmts: number[];
+}
+export declare function flowSensitiveTaint(input: {
+    ast: PersistedAst;
+    cfg: Cfg;
+    ddg: Ddg;
+    source: string;
+    fnName: string;
+    config: DataFlowTaintConfig;
+}): FlowTaintResult;