@holmes-lab/holmes-kit 0.4.0 → 0.4.1

package/dist/holmes/review/test-runner.js

@@ -46,11 +46,16 @@ exports.runGradle = runGradle;
 exports.runDotnet = runDotnet;
 exports.runGo = runGo;
 exports.runTestScope = runTestScope;
+exports.tailOf = tailOf;
+exports.summarizeJestJson = summarizeJestJson;
 // @implements A-SPEC-102.1
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
+// @implements A-SPEC-514.1 — every TEST spawn goes out through a cleaned environment. The
+// `--version` probes above stay as they are: they do not judge anything.
+const root_1 = require("../project/root");
 const python_env_1 = require("./python-env");
 // Runner stdout ceiling. Measured 2026-09-01 on this repo: a full `jest --json` for 289 suites /
 // 4568 tests emits >2MB, and execFileSync's DEFAULT maxBuffer (1MB) kills the child with ENOBUFS —
@@ -239,8 +244,11 @@ function runJest(files, mode, cwd) {
         ? [...pre, '--silent', '--json', '--runTestsByPath', '--', ...safeFiles]
         : [...pre, '--silent', '--json'];
     try {
-        const out = (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
-        return { passed: true, tail: tailOf(out), executed: parseExecutedCounts(out, cwd) };
+        const out = (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
+        // @implements A-SPEC-515.1 — the green path says what happened instead of handing back the
+        // whole `--json` document. `tailOf` wraps the result too, so an unexpectedly long summary is
+        // still bounded: a cap that any one path can escape is not a cap.
+        return { passed: true, tail: tailOf(summarizeJestJson(out) ?? out), executed: parseExecutedCounts(out, cwd) };
     }
     catch (e) {
         const err = e;
@@ -277,7 +285,7 @@ function runPytest(files, mode, cwd) {
         }
     };
     try {
-        const out = (0, node_child_process_1.execFileSync)(python, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+        const out = (0, node_child_process_1.execFileSync)(python, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
         return { passed: true, tail: tailOf(out), executed: read() };
     }
     catch (e) {
@@ -332,7 +340,7 @@ function runCargo(files, _mode, cwd, opts) {
     let out = '';
     let ok = true;
     try {
-        out = (0, node_child_process_1.execFileSync)('cargo', ['test'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+        out = (0, node_child_process_1.execFileSync)('cargo', ['test'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
     }
     catch (e) {
         const err = e;
@@ -425,7 +433,7 @@ function runGradle(files, _mode, cwd, opts) {
     }
     let ok = true;
     try {
-        (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+        (0, node_child_process_1.execFileSync)(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
     }
     catch {
         ok = false;
@@ -457,7 +465,7 @@ function runDotnet(files, _mode, cwd, opts) {
     const report = path.join(dir, 'junit.xml');
     let ok = true;
     try {
-        (0, node_child_process_1.execFileSync)('dotnet', ['test', '--logger', `junit;LogFilePath=${report}`], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+        (0, node_child_process_1.execFileSync)('dotnet', ['test', '--logger', `junit;LogFilePath=${report}`], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
     }
     catch {
         ok = false;
@@ -504,7 +512,7 @@ function runGo(files, mode, cwd, opts) {
     const runDir = (dirArg, creditFiles) => {
         let out = '';
         try {
-            out = (0, node_child_process_1.execFileSync)('go', ['test', '-json', dirArg], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER });
+            out = (0, node_child_process_1.execFileSync)('go', ['test', '-json', dirArg], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: RUNNER_MAX_BUFFER, env: (0, root_1.cleanTestEnv)() });
         }
         catch (e) {
             const err = e;
@@ -617,6 +625,76 @@ function runTestScope(scope, cwd) {
         executedByFile: {}, unsupported, ranWith: [],
     };
 }
-function tailOf(s, n = 6) {
-    return s.trim().split('\n').slice(-n).join('\n');
+// @implements A-SPEC-515.1
+/**
+ * The last few lines of a runner's output, bounded by SIZE as well as by line count.
+ *
+ * A line budget is only a size budget while the lines are short, and jest `--json` breaks that
+ * assumption completely: it emits one line. Measured 2026-09-02 — a GREEN `test_run` returned
+ * 1,432,092 characters, of which this field was 1,421,327 (99.2%) across "6 lines" whose longest
+ * was 1,420,959. The usefulness was inverted: a red run gave six clean lines of stderr summary,
+ * and a green run gave the whole document.
+ *
+ * The END is what survives a cut. A runner's conclusion is always at the bottom.
+ */
+const TAIL_MAX_CHARS = 4000;
+function tailOf(s, opts = {}) {
+    // The numeric spelling is the one the go adapter uses (`tailOf(err.stderr, 2)`); keeping it means
+    // this change cannot silently alter a caller that only ever wanted fewer lines.
+    const { lines = 6, maxChars = TAIL_MAX_CHARS } = typeof opts === 'number' ? { lines: opts } : opts;
+    const picked = s.trim().split('\n').slice(-lines).join('\n');
+    if (picked.length <= maxChars)
+        return picked;
+    const dropped = picked.length - maxChars;
+    return `[…앞부분 ${dropped}자 생략…]\n${picked.slice(-maxChars)}`;
+}
+// @implements A-SPEC-515.1
+/**
+ * The summary a green jest run always had — it was inside the `--json` payload rather than absent.
+ *
+ * jest writes its human summary to stderr, and the success branch reads stdout only, so the tail of
+ * a passing run carried no counts at all. The counts are right there in the JSON; this assembles
+ * them into the two lines a reader actually wanted.
+ *
+ * Returns null on anything it cannot read, and the caller falls back to the truncated original:
+ * a failed summary must not turn partial information into none.
+ */
+function summarizeJestJson(stdout) {
+    // The payload is not the whole of stdout. A suite that logs anything prints it BEFORE the JSON,
+    // and this repository's own suite does: measured, the first live run after this function landed
+    // still returned 1.4MB because `JSON.parse(stdout)` threw on the console noise and the fallback
+    // handed back the raw document. `parseExecutedCounts` already locates the payload from the first
+    // `{`; using a second, stricter rule for the same string is how the two quietly disagree.
+    const start = stdout.indexOf('{');
+    if (start < 0)
+        return null;
+    let j;
+    try {
+        j = JSON.parse(stdout.slice(start));
+    }
+    catch {
+        return null;
+    }
+    if (j === null || typeof j !== 'object')
+        return null;
+    const num = (k) => (typeof j[k] === 'number' ? j[k] : null);
+    const totalSuites = num('numTotalTestSuites');
+    const totalTests = num('numTotalTests');
+    if (totalSuites === null || totalTests === null)
+        return null;
+    const line = (label, failed, skipped, passed, total) => {
+        const parts = [];
+        if (failed !== null && failed > 0)
+            parts.push(`${failed} failed`);
+        if (skipped !== null && skipped > 0)
+            parts.push(`${skipped} skipped`);
+        if (passed !== null)
+            parts.push(`${passed} passed`);
+        parts.push(`${total} total`);
+        return `${label}${parts.join(', ')}`;
+    };
+    return [
+        line('Test Suites: ', num('numFailedTestSuites'), num('numPendingTestSuites'), num('numPassedTestSuites'), totalSuites),
+        line('Tests:       ', num('numFailedTests'), num('numPendingTests'), num('numPassedTests'), totalTests),
+    ].join('\n');
 }

package/dist/holmes/rtm/dataflow-taint.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DATAFLOW_LIMITS = void 0;
 exports.taintDataFlow = taintDataFlow;
+const sink_matching_1 = require("./sink-matching");
 /**
  * What this pass does NOT model. Carried in every result, for the same reason REQ-138 carries
  * `TAINT_LIMITS`: a screening signal that does not state its blind spots is read as a proof.
@@ -226,7 +227,10 @@ function taintDataFlow(factSet, cfg) {
     // SINK — reported after the fixpoint, so a finding always reflects the complete taint state.
     const all = [];
     for (const c of calls) {
-        if (!matchesName(c.callee, cfg.sinks))
+        // @implements A-SPEC-512.3 — the ONE sink decision, receiver-aware: an exact name match that
+        // is not a RegExp method on a regex receiver. 16 of this repository's 19 findings were
+        // `re.exec(...)` before this delegation.
+        if (!(0, sink_matching_1.isSinkCall)(c.calleeText ?? c.callee, c.callee, cfg.sinks))
             continue;
         for (let i = 0; i < c.args.length; i++) {
             const from = carrier(c.args[i], fid(c.file, c.fn));

package/dist/holmes/rtm/flow-sensitive-taint.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The CPG foundation's FIRST consumer: taint judged on REACHING DEFINITIONS instead of on
+ * "was a sanitizer mentioned anywhere in this function".
+ *
+ * The rules do not change — sources, sinks and sanitizers come from the same config the
+ * flow-insensitive engine uses. What changes is what those rule matches are COMBINED over: a
+ * tainted definition is dangerous only if it actually REACHES the sink's use. Two measured false
+ * positives fall out of that automatically:
+ *   `let c = req.body.cmd; c = "ls"; exec(c);`          → the constant redefinition kills the taint
+ *   `if (s) { c = clean(c); } else { c = clean(c); }`   → every path redefines, so nothing tainted arrives
+ * and one thing deliberately does NOT change: when only ONE branch sanitizes, the tainted
+ * definition still reaches, so the finding stands. This is a may-analysis and stays one —
+ * trading a false positive for a false negative would not be an improvement (REQ-512).
+ */
+import type { PersistedAst } from '../cpg/foundation/ast-store';
+import type { Cfg } from '../cpg/foundation/cfg';
+import type { Ddg } from '../cpg/foundation/ddg';
+import type { DataFlowTaintConfig } from './dataflow-taint';
+export interface FlowTaintFinding {
+    fn: string;
+    callee: string;
+    line: number;
+    argIndex: number;
+    argText: string;
+    /** Why this is reported: the tainted definition that reaches this sink use. */
+    taintedDef: string;
+}
+export interface FlowTaintResult {
+    findings: FlowTaintFinding[];
+    mode: 'flow-sensitive';
+    /** Per-statement classification, exposed so a test can prove the DDG was actually consulted. */
+    taintedDefStmts: number[];
+}
+export declare function flowSensitiveTaint(input: {
+    ast: PersistedAst;
+    cfg: Cfg;
+    ddg: Ddg;
+    source: string;
+    fnName: string;
+    config: DataFlowTaintConfig;
+}): FlowTaintResult;

package/dist/holmes/rtm/flow-sensitive-taint.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.flowSensitiveTaint = flowSensitiveTaint;
+const cfg_1 = require("../cpg/foundation/cfg");
+const sink_matching_1 = require("./sink-matching");
+const lineOf = (source, offset) => source.slice(0, offset).split('\n').length;
+/** The callee's bare last-segment name for a call node, or null when it is not a plain call. */
+function calleeNameOf(ast, kids, call, source) {
+    const fnNode = kids.of(call).find((k) => ast.nodes[k].named);
+    if (fnNode === undefined)
+        return null;
+    const text = source.slice(ast.nodes[fnNode].start, ast.nodes[fnNode].end);
+    const bare = text.split(/[.:]/).pop() ?? text;
+    return /^[A-Za-z_$][\w$]*$/.test(bare) ? bare : null;
+}
+// @implements A-SPEC-512.1
+function flowSensitiveTaint(input) {
+    const { ast, cfg, ddg, source, fnName, config } = input;
+    const kids = (0, cfg_1.childrenIndex)(ast);
+    const text = (i) => source.slice(ast.nodes[i].start, ast.nodes[i].end);
+    const sinks = new Set(config.sinks.map((s) => s.toLowerCase()));
+    const sanitizers = new Set(config.sanitizers.map((s) => s.toLowerCase()));
+    const stmtOfBlock = new Set();
+    for (const b of cfg.blocks)
+        for (const s of b.stmts)
+            stmtOfBlock.add(s);
+    /** Every call node inside a statement, excluding nested function bodies. */
+    const callsIn = (stmt) => {
+        const out = [];
+        const walk = (n) => {
+            const ty = ast.nodes[n].type;
+            if (n !== stmt && stmtOfBlock.has(n))
+                return;
+            if (ty === 'call_expression' || ty === 'call')
+                out.push(n);
+            for (const c of kids.of(n))
+                walk(c);
+        };
+        walk(stmt);
+        return out;
+    };
+    // ── 1/2. Classify each definition statement: tainted (source text) vs sanitized (sanitizer call).
+    const taintedDefs = new Set();
+    for (const [stmt] of ddg.defs) {
+        const t = text(stmt);
+        const isSource = config.sources.some((s) => t.toLowerCase().includes(s.toLowerCase()));
+        if (!isSource)
+            continue;
+        // A definition whose value comes THROUGH a sanitizer is clean even if the source text is
+        // mentioned inside it: `c = escape(req.body.cmd)` reads the source but launders it.
+        const sanitized = callsIn(stmt).some((c) => {
+            const name = calleeNameOf(ast, kids, c, source);
+            return name !== null && sanitizers.has(name.toLowerCase());
+        });
+        if (!sanitized)
+            taintedDefs.add(stmt);
+    }
+    // ── 3/4. For every sink call, ask the DDG which definitions reach the names it consumes.
+    const findings = [];
+    for (const stmt of stmtOfBlock) {
+        for (const call of callsIn(stmt)) {
+            const callee = calleeNameOf(ast, kids, call, source);
+            if (callee === null)
+                continue;
+            // @implements A-SPEC-512.3 — the SAME sink decision the other engine uses, so the two
+            // cannot disagree about what a sink is (a second truth is a drifting truth).
+            const fnNode = kids.of(call).find((k) => ast.nodes[k].named);
+            const calleeText = fnNode === undefined ? callee : text(fnNode);
+            if (!(0, sink_matching_1.isSinkCall)(calleeText, callee, config.sinks))
+                continue;
+            const args = kids.of(call).find((k) => ast.nodes[k].type === 'arguments' || ast.nodes[k].type === 'argument_list');
+            const argNodes = args === undefined ? [] : kids.of(args).filter((k) => ast.nodes[k].named);
+            argNodes.forEach((arg, argIndex) => {
+                // Names this argument reads (identifiers inside the argument expression).
+                const names = new Set();
+                const collect = (n) => {
+                    if (ast.nodes[n].type === 'identifier')
+                        names.add(text(n));
+                    for (const c of kids.of(n))
+                        collect(c);
+                };
+                collect(arg);
+                // An argument that goes through a sanitizer inline is clean: `exec(escape(c))`.
+                const inlineSanitized = callsIn(arg).some((c) => {
+                    const nm = calleeNameOf(ast, kids, c, source);
+                    return nm !== null && sanitizers.has(nm.toLowerCase());
+                });
+                if (inlineSanitized)
+                    return;
+                for (const name of names) {
+                    const reaching = ddg.edges.filter((e) => e.useStmt === stmt && e.name === name);
+                    const tainted = reaching.find((e) => taintedDefs.has(e.defStmt));
+                    if (tainted === undefined)
+                        continue;
+                    findings.push({
+                        fn: fnName,
+                        callee,
+                        line: lineOf(source, ast.nodes[call].start),
+                        argIndex,
+                        argText: text(arg),
+                        taintedDef: text(tainted.defStmt),
+                    });
+                    return; // one finding per argument
+                }
+            });
+        }
+    }
+    return { findings, mode: 'flow-sensitive', taintedDefStmts: [...taintedDefs] };
+}

package/dist/holmes/rtm/reaching-def-filter.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The COMBINATION S-512.1's real-corpus measurement forced: keep the inter-procedural propagation
+ * (its `arg-param` hops are how real taint actually travels — every one of the ten findings on
+ * this repository crossed a function boundary), and use reaching definitions only to REFUTE a
+ * finding inside the function where the sink sits.
+ *
+ * Direction of the filter, stated once because it is the whole design: it may only REMOVE. A
+ * finding survives unless the DDG positively shows that nothing tainted reaches the sink's use —
+ * an unparseable file, an unsupported function, a name the span walk cannot locate, all keep the
+ * finding. Fail-open is the may-analysis direction: not knowing is not a licence to dismiss.
+ *
+ * What it removes is exactly the shape the benchmark measured: a definition that is dead by the
+ * time the sink runs (overwritten with a constant), or one that every path has replaced with a
+ * sanitized value.
+ */
+import type { PersistedAst } from '../cpg/foundation/ast-store';
+import type { Cfg } from '../cpg/foundation/cfg';
+import type { Ddg } from '../cpg/foundation/ddg';
+import type { DataFlowFinding, DataFlowTaintConfig } from './dataflow-taint';
+export interface FilterInput {
+    ast: PersistedAst;
+    cfg: Cfg;
+    ddg: Ddg;
+    source: string;
+    finding: Pick<DataFlowFinding, 'line' | 'callee' | 'argText'>;
+    config: DataFlowTaintConfig;
+}
+/**
+ * Should this finding survive? True unless reaching definitions positively refute it.
+ */
+export declare function keepsFinding(input: FilterInput): boolean;
+export interface FilterOutcome<T> {
+    kept: T[];
+    /** Findings the reaching-definition evidence positively refuted, with the reason. */
+    removed: Array<{
+        finding: T;
+        reason: string;
+    }>;
+}
+/**
+ * Apply the filter to a file's findings. Everything the substrate cannot analyse is KEPT, so the
+ * result is always a subset of the input and never a superset.
+ */
+export declare function filterFindingsForFile<T extends Pick<DataFlowFinding, 'line' | 'callee' | 'argText' | 'file'>>(root: string, relPath: string, findings: T[], config: DataFlowTaintConfig): Promise<FilterOutcome<T>>;

package/dist/holmes/rtm/reaching-def-filter.js

@@ -0,0 +1,167 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keepsFinding = keepsFinding;
+exports.filterFindingsForFile = filterFindingsForFile;
+const cfg_1 = require("../cpg/foundation/cfg");
+const lineOf = (source, offset) => source.slice(0, offset).split('\n').length;
+// @implements A-SPEC-512.2
+/**
+ * Should this finding survive? True unless reaching definitions positively refute it.
+ */
+function keepsFinding(input) {
+    const { ast, cfg, ddg, source, finding, config } = input;
+    const kids = (0, cfg_1.childrenIndex)(ast);
+    const text = (i) => source.slice(ast.nodes[i].start, ast.nodes[i].end);
+    // Locate the sink statement: a statement on the reported line whose text names the callee.
+    const stmts = new Set();
+    for (const b of cfg.blocks)
+        for (const s of b.stmts)
+            stmts.add(s);
+    const sinkStmt = [...stmts].find((s) => lineOf(source, ast.nodes[s].start) === finding.line && text(s).includes(finding.callee));
+    if (sinkStmt === undefined)
+        return true; // cannot locate → keep (fail-open)
+    // The names the reported argument reads. If the argument text is not a bare name chain we can
+    // find in the statement, keep — an argument we cannot resolve is not an argument we can dismiss.
+    const names = new Set();
+    const collect = (n) => {
+        if (ast.nodes[n].type === 'identifier')
+            names.add(text(n));
+        for (const c of kids.of(n))
+            collect(c);
+    };
+    const argNode = (() => {
+        const stack = [sinkStmt];
+        while (stack.length) {
+            const n = stack.pop();
+            if (text(n) === finding.argText)
+                return n;
+            for (const c of kids.of(n))
+                stack.push(c);
+        }
+        return undefined;
+    })();
+    if (argNode === undefined)
+        return true; // argument not found → keep
+    collect(argNode);
+    if (names.size === 0)
+        return true; // a literal argument: not our call
+    const paramPoints = new Set(ddg.params.values());
+    const launders = (t) => config.sanitizers.some((s) => new RegExp(`\\b${s.toLowerCase()}\\s*\\(`).test(t));
+    /**
+     * Can taint arrive at this definition? A BACKWARD walk over REACHING_DEF, not a one-hop look:
+     * `function h(cmd) { const c = cmd; exec(c); }` reaches the sink through an ordinary copy, and
+     * a one-hop filter would refute it — recreating the very under-detection this slice exists to
+     * prevent (measured in S-512.1). The walk stops at a parameter (taint entry), at a source, or
+     * at a laundering definition; `seen` bounds it on cyclic (loop-carried) definitions.
+     */
+    const canCarryTaint = (defStmt, seen) => {
+        if (paramPoints.has(defStmt))
+            return true; // inter-procedural entry point
+        if (seen.has(defStmt))
+            return false;
+        seen.add(defStmt);
+        const t = text(defStmt).toLowerCase();
+        if (launders(t))
+            return false; // value washed here: this path is clean
+        if (config.sources.some((s) => t.includes(s.toLowerCase())))
+            return true;
+        for (const name of ddg.uses.get(defStmt) ?? []) {
+            for (const e of ddg.edges) {
+                if (e.useStmt !== defStmt || e.name !== name)
+                    continue;
+                if (canCarryTaint(e.defStmt, seen))
+                    return true;
+            }
+        }
+        return false;
+    };
+    for (const name of names) {
+        const reaching = ddg.edges.filter((e) => e.useStmt === sinkStmt && e.name === name);
+        if (reaching.length === 0)
+            continue; // no reaching info for this name
+        if (reaching.some((e) => canCarryTaint(e.defStmt, new Set())))
+            return true;
+    }
+    // Every name we could resolve has reaching definitions, and none of them can carry taint.
+    const anyResolved = [...names].some((n) => ddg.edges.some((e) => e.useStmt === sinkStmt && e.name === n));
+    return !anyResolved; // resolved and refuted → drop
+}
+// @implements A-SPEC-512.2
+/**
+ * Apply the filter to a file's findings. Everything the substrate cannot analyse is KEPT, so the
+ * result is always a subset of the input and never a superset.
+ */
+async function filterFindingsForFile(root, relPath, findings, config) {
+    if (findings.length === 0)
+        return { kept: [], removed: [] };
+    const { astOf } = await Promise.resolve().then(() => __importStar(require('../cpg/foundation/ast-store')));
+    const { cfgOf, functionsIn } = await Promise.resolve().then(() => __importStar(require('../cpg/foundation/cfg')));
+    const { ddgOf } = await Promise.resolve().then(() => __importStar(require('../cpg/foundation/ddg')));
+    const fs = await Promise.resolve().then(() => __importStar(require('node:fs')));
+    const path = await Promise.resolve().then(() => __importStar(require('node:path')));
+    let ast = null;
+    let source = '';
+    try {
+        ast = await astOf(root, relPath);
+        source = fs.readFileSync(path.join(root, relPath), 'utf8');
+    }
+    catch { /* unreadable: keep everything */ }
+    if (!ast || ast.errorCount > 0)
+        return { kept: findings, removed: [] };
+    const kept = [];
+    const removed = [];
+    for (const finding of findings) {
+        let verdict = true; // default keep
+        for (const fn of functionsIn(ast)) {
+            const cfg = cfgOf(ast, fn, source);
+            if ('unsupported' in cfg)
+                continue; // unsupported function: no opinion
+            const ddg = ddgOf(ast, cfg, fn, source);
+            if ('unsupported' in ddg)
+                continue;
+            const inThisFn = cfg.blocks.some((b) => b.stmts.some((s) => lineOf(source, ast.nodes[s].start) === finding.line));
+            if (!inThisFn)
+                continue;
+            verdict = keepsFinding({ ast, cfg, ddg, source, finding, config });
+            break; // the function owning the line decides
+        }
+        if (verdict)
+            kept.push(finding);
+        else
+            removed.push({ finding, reason: 'no tainted definition reaches this sink use (reaching-definition refutation)' });
+    }
+    return { kept, removed };
+}

package/dist/holmes/rtm/sink-matching.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Sink matching that reads the RECEIVER, not just the name.
+ *
+ * A-SPEC-140 already learned half of this: substring matching made `evaluateStop` an `eval` sink
+ * and `computeExecutedByAspec` an `exec` sink, so matching moved to exact names. Exact names close
+ * that hole and leave the other one open — `RegExp.prototype.exec` is spelled exactly `exec`.
+ * Measured on this repository (2026-09-02): 16 of 19 data-flow findings were `re.exec(...)` style
+ * regex calls; only three were real process execution. The dominant false-positive source was
+ * never the flow analysis, it was this.
+ *
+ * The exclusion is deliberately NARROW and fail-open. Only a receiver that is syntactically,
+ * unmistakably a regular expression suppresses the sink; an ordinary variable (`x.exec(cmd)`)
+ * stays a finding, because without type information calling it a regex would be a guess — and a
+ * guess that hides a command injection is the wrong direction to be wrong in.
+ */
+/**
+ * Is this call's receiver certainly a regular expression? True only for shapes that cannot be
+ * anything else; everything ambiguous returns false so the caller keeps treating it as a sink.
+ */
+export declare function isRegexReceiverCall(calleeText: string): boolean;
+/**
+ * The ONE sink decision both taint engines consume: an exact name match that is not a regex
+ * method call on a regex receiver. `calleeText` is the call's callee as written (`re.exec`,
+ * `child_process.exec`, `exec`); `bareName` is its last segment, the form the config lists.
+ */
+export declare function isSinkCall(calleeText: string, bareName: string, sinks: readonly string[]): boolean;

package/dist/holmes/rtm/sink-matching.js

@@ -0,0 +1,73 @@
+"use strict";
+// @implements A-SPEC-512.3
+/**
+ * Sink matching that reads the RECEIVER, not just the name.
+ *
+ * A-SPEC-140 already learned half of this: substring matching made `evaluateStop` an `eval` sink
+ * and `computeExecutedByAspec` an `exec` sink, so matching moved to exact names. Exact names close
+ * that hole and leave the other one open — `RegExp.prototype.exec` is spelled exactly `exec`.
+ * Measured on this repository (2026-09-02): 16 of 19 data-flow findings were `re.exec(...)` style
+ * regex calls; only three were real process execution. The dominant false-positive source was
+ * never the flow analysis, it was this.
+ *
+ * The exclusion is deliberately NARROW and fail-open. Only a receiver that is syntactically,
+ * unmistakably a regular expression suppresses the sink; an ordinary variable (`x.exec(cmd)`)
+ * stays a finding, because without type information calling it a regex would be a guess — and a
+ * guess that hides a command injection is the wrong direction to be wrong in.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRegexReceiverCall = isRegexReceiverCall;
+exports.isSinkCall = isSinkCall;
+/** Sink names that also exist as RegExp methods — the only names the receiver rule applies to. */
+const REGEX_METHODS = new Set(['exec', 'test']);
+/** Conventional lowercase names for a compiled pattern, matched WHOLE (never as a prefix). */
+const REGEX_VAR_NAMES = new Set(['re', 'rx', 'regex', 'regexp', 'pattern', 'pat']);
+// @implements A-SPEC-512.3
+/**
+ * Is this call's receiver certainly a regular expression? True only for shapes that cannot be
+ * anything else; everything ambiguous returns false so the caller keeps treating it as a sink.
+ */
+function isRegexReceiverCall(calleeText) {
+    const text = calleeText.trim();
+    const dot = text.lastIndexOf('.');
+    if (dot <= 0)
+        return false; // a bare call has no receiver
+    const method = text.slice(dot + 1).trim();
+    if (!REGEX_METHODS.has(method.toLowerCase()))
+        return false;
+    const receiver = text.slice(0, dot).trim();
+    // A regex literal, with or without flags: /…/.exec, /…/gi.test
+    if (/^\/.*\/[dgimsuvy]*$/s.test(receiver))
+        return true;
+    // An explicitly constructed one: new RegExp(...).exec
+    if (/^new\s+RegExp\s*\(/.test(receiver))
+        return true;
+    // Conventional names. UPPER_SNAKE ending in _RE / RE is the house style for a module-level
+    // pattern (ANCHOR_RE, IMPL_LINE_RE); the lowercase set is the common local spelling.
+    const last = receiver.split(/[.[\]]/).filter(Boolean).pop() ?? receiver;
+    if (/^[A-Z][A-Z0-9_]*$/.test(last) && (last === 'RE' || last.endsWith('_RE')))
+        return true;
+    if (REGEX_VAR_NAMES.has(last.toLowerCase()))
+        return true;
+    // camelCase pattern names — measured on a vendored corpus (2026-09-02): `filePattern.exec`,
+    // `codeBlockFilePattern.exec`, `funcPattern.exec`, `arrowPattern.exec` were four of the seven
+    // findings left after the first cut. A name ENDING in Pattern/Regex/Re is a compiled pattern by
+    // near-universal convention; `Re` requires the preceding character to be lowercase so that
+    // `Store` or `Compare` cannot match.
+    if (/(?:Pattern|Regex|RegExp|Rx)$/.test(last))
+        return true;
+    if (/[a-z]Re$/.test(last))
+        return true;
+    return false;
+}
+// @implements A-SPEC-512.3
+/**
+ * The ONE sink decision both taint engines consume: an exact name match that is not a regex
+ * method call on a regex receiver. `calleeText` is the call's callee as written (`re.exec`,
+ * `child_process.exec`, `exec`); `bareName` is its last segment, the form the config lists.
+ */
+function isSinkCall(calleeText, bareName, sinks) {
+    if (!sinks.some((s) => s.toLowerCase() === bareName.toLowerCase()))
+        return false;
+    return !isRegexReceiverCall(calleeText);
+}

package/dist/holmes/rtm/taint-benchmark.d.ts

@@ -55,6 +55,19 @@ export interface TaintBenchmark {
     controlFlowAttributable: number;
 }
 /** Run the current engine over the labelled cases and score it. */
+export type TaintEngine = 'flow-insensitive' | 'flow-sensitive';
+/** Score the corpus with EITHER engine — an improvement is reported as a contrast, never alone. */
+export declare function runTaintBenchmarkAsync(cases?: readonly TaintCase[], engine?: TaintEngine): Promise<TaintBenchmark>;
+/** before/after in ONE call — the single truth both the report and its test consume. */
+export declare function compareEngines(cases?: readonly TaintCase[]): Promise<{
+    before: TaintBenchmark;
+    after: TaintBenchmark;
+    moved: Array<{
+        name: string;
+        from: CaseOutcome['cell'];
+        to: CaseOutcome['cell'];
+    }>;
+}>;
 export declare function runTaintBenchmark(cases?: readonly TaintCase[]): TaintBenchmark;
 export interface RealCorpusTaint {
     corpus: string;