@holmes-lab/holmes-kit 0.5.0 → 0.7.0

package/dist/holmes/rtm/flow-sensitive-taint.js

@@ -6,7 +6,19 @@ const sink_matching_1 = require("./sink-matching");
 const lineOf = (source, offset) => source.slice(0, offset).split('\n').length;
 /** The callee's bare last-segment name for a call node, or null when it is not a plain call. */
 function calleeNameOf(ast, kids, call, source) {
-    const fnNode = kids.of(call).find((k) => ast.nodes[k].named);
+    const named = kids.of(call).filter((k) => ast.nodes[k].named);
+    // @implements A-SPEC-524.1 — Java's method_invocation is [receiver?, NAME, argument_list]:
+    // the first named child is the RECEIVER when present, so taking it named `runtime` where the
+    // sink is `exec` — measured before sealing. The name is the identifier just before the
+    // argument list.
+    let fnNode;
+    if (ast.nodes[call].type === 'method_invocation') {
+        const argsAt = named.findIndex((k) => ast.nodes[k].type === 'argument_list');
+        fnNode = argsAt > 0 ? named[argsAt - 1] : named[0];
+    }
+    else {
+        fnNode = named[0];
+    }
     if (fnNode === undefined)
         return null;
     const text = source.slice(ast.nodes[fnNode].start, ast.nodes[fnNode].end);
@@ -31,7 +43,11 @@ function flowSensitiveTaint(input) {
             const ty = ast.nodes[n].type;
             if (n !== stmt && stmtOfBlock.has(n))
                 return;
-            if (ty === 'call_expression' || ty === 'call')
+            // @implements A-SPEC-524.1 — the call-node set, measured per grammar: Java spells calls
+            // method_invocation and constructors object_creation_expression (where ProcessBuilder
+            // lives), C# spells them invocation_expression.
+            if (ty === 'call_expression' || ty === 'call' || ty === 'method_invocation'
+                || ty === 'invocation_expression' || ty === 'object_creation_expression')
                 out.push(n);
             for (const c of kids.of(n))
                 walk(c);

package/dist/holmes/rtm/rtm-builder.d.ts

@@ -29,6 +29,12 @@ export interface ResolutionReport {
 export interface BuildRtmOptions {
     /** Resolve a spec id to its source file path (e.g. its .md file) for provenance tagging. */
     specSourcePath?: (id: string) => string | undefined;
+    /**
+     * @implements A-SPEC-525.1 — the Go module path (go.mod's `module` line). Supplied by the
+     * caller that can read go.mod; without it every Go import is external and resolves to nothing,
+     * which is the honest default (no prefix to strip, no guess to make).
+     */
+    goModule?: string;
     /**
      * @implements A-SPEC-281
      * The observation context every fact in this build shares: which commit it was read at, which
@@ -170,20 +176,6 @@ export interface CommitRecord {
  * scanned are still recorded as nodes — they happened.
  */
 export declare function addCommitHistory(history: readonly CommitRecord[], scanned: readonly ScannedFile[], graph: RtmGraph, opts?: BuildRtmOptions): void;
-/**
- * @implements A-SPEC-289
- * FILE nodes and resolved `imports` edges.
- *
- * Import relations were extracted and then dropped, because their endpoints are a file and a module
- * path while the graph knew only symbols and specs — measured on this repository, 1,892 extracted
- * and 0 in the graph. `File` is a node kind Goal Phase 3 names, so it becomes one.
- *
- * ONLY relative specifiers are resolved, and only to a file the scan actually contains. A bare
- * specifier (`node:fs`, `js-yaml`) is an external package with no node to point at, and inventing
- * one would be a guess — the same precision-over-recall rule call resolution follows. Measured: 441
- * of 1,892 specifiers (23%) resolve inside the repository, and the rest failing to resolve is a
- * fact about the imports, not a defect in the resolver.
- */
 export declare function addImportEdges(scanned: readonly ScannedFile[], graph: RtmGraph, opts?: BuildRtmOptions): void;
 /** @implements A-SPEC-293 — one architecture decision as its record states it. */
 export interface DecisionRecord {

package/dist/holmes/rtm/rtm-builder.js

@@ -43,6 +43,7 @@ exports.addCommitHistory = addCommitHistory;
 exports.addImportEdges = addImportEdges;
 exports.addDecisionEdges = addDecisionEdges;
 const path = __importStar(require("node:path"));
+const fs = __importStar(require("node:fs"));
 const language_capability_1 = require("../cpg/language-capability");
 /**
  * @implements A-SPEC-281
@@ -341,12 +342,117 @@ function addCommitHistory(history, scanned, graph, opts) {
  * of 1,892 specifiers (23%) resolve inside the repository, and the rest failing to resolve is a
  * fact about the imports, not a defect in the resolver.
  */
+function fsReadGoMod(p) {
+    try {
+        return fs.readFileSync(p, 'utf8').match(/^module\s+(\S+)/m)?.[1] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 function addImportEdges(scanned, graph, opts) {
     const known = new Set(scanned.map((f) => f.sourcePath));
     const EXTENSIONS = ['', '.ts', '.tsx', '.mts', '.cts', '.js', '.mjs', '.cjs', '.jsx', '.py',
         '/index.ts', '/index.js', '/__init__.py'];
     const firstKnown = (base) => EXTENSIONS.map((ext) => `${base}${ext}`).find((candidate) => known.has(candidate)) ?? null;
+    // @implements A-SPEC-525.1 — the five languages' resolution rules, selected by the IMPORTING
+    // file's extension because resolution IS per-language semantics. The founding rule is unchanged
+    // everywhere: resolve only to files the scan actually contains; the ambiguous resolve to none.
+    const knownList = [...known];
+    const uniqueSuffix = (suffix) => {
+        const hits = knownList.filter((k) => k === suffix || k.endsWith(`/${suffix}`));
+        return hits.length === 1 ? hits[0] : null; // two files may not become a guess
+    };
+    // go.mod discovery: injected via opts when the caller knows it; otherwise walked up from the
+    // first Go file's ABSOLUTE path (bounded), so production builds resolve without extra wiring.
+    let goModCache;
+    const goModuleOf = () => {
+        if (opts?.goModule)
+            return opts.goModule;
+        if (goModCache !== undefined)
+            return goModCache ?? undefined;
+        goModCache = null;
+        const anyGo = scanned.find((f) => /\.go$/.test(f.sourcePath) && f.path);
+        if (anyGo) {
+            let dir = path.dirname(anyGo.path);
+            for (let hops = 0; hops < 12; hops++) {
+                try {
+                    const txt = fsReadGoMod(path.join(dir, 'go.mod'));
+                    if (txt !== null) {
+                        goModCache = txt;
+                        break;
+                    }
+                }
+                catch { /* keep walking */ }
+                const up = path.dirname(dir);
+                if (up === dir)
+                    break;
+                dir = up;
+            }
+        }
+        return goModCache ?? undefined;
+    };
+    const goPackage = (spec) => {
+        const mod = goModuleOf();
+        if (!mod || !(spec === mod || spec.startsWith(`${mod}/`)))
+            return []; // external, honestly
+        const dir = spec === mod ? '' : spec.slice(mod.length + 1);
+        const prefix = dir === '' ? '' : `${dir}/`;
+        return knownList.filter((k) => k.startsWith(prefix) && k.endsWith('.go')
+            && !k.endsWith('_test.go') && !k.slice(prefix.length).includes('/'));
+    };
+    const rustResolve = (fromFile, spec) => {
+        const segs = spec.split('::');
+        const head = segs.shift();
+        let baseDir;
+        if (head === 'crate') {
+            // the crate root is the src/ directory nearest above the importing file
+            const m = fromFile.match(/^(.*?src)\//);
+            baseDir = m ? m[1] : 'src';
+        }
+        else if (head === 'super') {
+            baseDir = path.posix.dirname(path.posix.dirname(fromFile));
+            while (segs[0] === 'super') {
+                segs.shift();
+                baseDir = path.posix.dirname(baseDir);
+            }
+        }
+        else if (head === 'self') {
+            baseDir = path.posix.dirname(fromFile);
+        }
+        else {
+            return null; // external crate
+        }
+        const tryPath = (parts) => {
+            if (parts.length === 0)
+                return null;
+            const base = path.posix.normalize(path.posix.join(baseDir, ...parts));
+            if (known.has(`${base}.rs`))
+                return `${base}.rs`;
+            if (known.has(`${base}/mod.rs`))
+                return `${base}/mod.rs`;
+            return null;
+        };
+        // the last segment may be an ITEM, not a module — drop it once and retry
+        return tryPath(segs) ?? tryPath(segs.slice(0, -1));
+    };
     const resolve = (fromFile, spec) => {
+        // @implements A-SPEC-525.1 — language branches BEFORE the JS/Python-shaped fallthrough.
+        if (/\.go$/.test(fromFile))
+            return null; // Go fans out separately (a package is its files)
+        if (/\.rs$/.test(fromFile))
+            return rustResolve(fromFile, spec);
+        if (/\.java$/.test(fromFile))
+            return uniqueSuffix(`${spec.split('.').join('/')}.java`);
+        if (/\.cs$/.test(fromFile))
+            return uniqueSuffix(`${spec.split('.').join('/')}.cs`);
+        if (/\.(cpp|cc|cxx|hpp|h)$/.test(fromFile)) {
+            // extension preserved: the dotted split below would butcher `util/env.h`
+            const relative = path.posix.normalize(path.posix.join(path.posix.dirname(fromFile), spec));
+            if (known.has(relative))
+                return relative;
+            return known.has(spec) ? spec : null; // repo-root-relative include
+        }
         // @implements A-SPEC-406
         // A specifier without a leading dot used to be refused outright, on the ground that it names an
         // external package. That holds for `node:fs` and `js-yaml`; it does NOT hold for Python, which
@@ -381,6 +487,17 @@ function addImportEdges(scanned, graph, opts) {
             for (const e of f.edges ?? []) {
                 if (e.rel !== 'imports')
                     continue;
+                // @implements A-SPEC-525.1 — Go: importing a package imports ALL its files (that is the
+                // language's semantics, not an invention), so one specifier fans out to each scanned
+                // file of the package directory.
+                if (/\.go$/.test(f.sourcePath)) {
+                    for (const target of goPackage(e.to)) {
+                        graph.addNode(`FILE:${f.sourcePath}`, 'FILE', f.sourcePath, fact(opts, f.sourcePath, 'ast-scan', 1));
+                        graph.addNode(`FILE:${target}`, 'FILE', target, fact(opts, target, 'ast-scan', 1));
+                        graph.addEdge(`FILE:${f.sourcePath}`, `FILE:${target}`, 'imports', f.sourcePath, fact(opts, `${f.sourcePath} -> ${e.to}`, 'import-resolution', 1));
+                    }
+                    continue;
+                }
                 const target = resolve(f.sourcePath, e.to);
                 if (!target)
                     continue;

package/dist/holmes/rtm/taint-vocabulary.d.ts

@@ -13,7 +13,7 @@
  * positives.
  */
 import type { DataFlowTaintConfig } from './dataflow-taint';
-export declare const TAINT_VOCABULARY: Record<'typescript' | 'python', DataFlowTaintConfig>;
+export declare const TAINT_VOCABULARY: Record<'typescript' | 'python' | 'go' | 'java' | 'csharp' | 'rust' | 'cpp', DataFlowTaintConfig>;
 /**
  * The vocabulary this file should be judged with, or null when the file is outside the analysable
  * set. Null is deliberate: degrading an unknown language to the TypeScript list would produce

package/dist/holmes/rtm/taint-vocabulary.js

@@ -35,9 +35,44 @@ const PYTHON_VOCABULARY = {
     ],
     sanitizers: ['quote', 'escape', 'shlex.quote', 're.escape'],
 };
+// @implements A-SPEC-524.1 — five more rows. Same table discipline: sinks are matched on the
+// callee's LAST segment, sources against expression TEXT, and the vocabularies are SELECTED by
+// file extension, never unioned. Rust's `Command::new` is deliberately absent — its bare last
+// segment is 'new', far too general to be a sink; the EXECUTING methods (spawn/output/status)
+// are the sinks instead (sealed in REQ-524).
+const GO_VOCABULARY = {
+    sources: ['os.Getenv', 'os.Environ', 'os.Args', '.FormValue', 'URL.Query', 'PostForm'],
+    sinks: ['Command', 'CommandContext', 'StartProcess', 'Exec', 'Query'],
+    sanitizers: ['Quote', 'QuoteToASCII', 'EscapeString', 'QueryEscape'],
+};
+const JAVA_VOCABULARY = {
+    sources: ['System.getenv', 'System.getProperty', 'getParameter', 'getHeader', 'readLine'],
+    sinks: ['exec', 'ProcessBuilder', 'executeQuery', 'executeUpdate', 'eval', 'loadLibrary'],
+    sanitizers: ['escapeHtml', 'quoteReplacement', 'encode'],
+};
+const CSHARP_VOCABULARY = {
+    sources: ['GetEnvironmentVariable', 'ReadLine', 'QueryString', 'Form'],
+    sinks: ['Start', 'ExecuteReader', 'ExecuteNonQuery', 'ExecuteScalar', 'Deserialize'],
+    sanitizers: ['HtmlEncode', 'UrlEncode', 'EscapeDataString'],
+};
+const RUST_VOCABULARY = {
+    sources: ['env::var', 'env::args', 'read_to_string', 'stdin'],
+    sinks: ['spawn', 'output', 'status', 'exec', 'query'],
+    sanitizers: ['escape', 'quote'],
+};
+const CPP_VOCABULARY = {
+    sources: ['getenv', 'argv', 'cin', 'fgets'],
+    sinks: ['system', 'popen', 'exec', 'execl', 'execlp', 'execle', 'execv', 'execvp', 'ShellExecute'],
+    sanitizers: ['escape', 'quote'],
+};
 exports.TAINT_VOCABULARY = {
     typescript: TYPESCRIPT_VOCABULARY,
     python: PYTHON_VOCABULARY,
+    go: GO_VOCABULARY,
+    java: JAVA_VOCABULARY,
+    csharp: CSHARP_VOCABULARY,
+    rust: RUST_VOCABULARY,
+    cpp: CPP_VOCABULARY,
 };
 const TS_EXT = /\.(ts|mts|cts|tsx|js|mjs|cjs|jsx)$/i;
 const PY_EXT = /\.py$/i;
@@ -52,6 +87,17 @@ function vocabularyFor(relPath) {
         return exports.TAINT_VOCABULARY.typescript;
     if (PY_EXT.test(relPath))
         return exports.TAINT_VOCABULARY.python;
+    // @implements A-SPEC-524.1 — the five languages whose CFG/DDG landed in P2.
+    if (/\.go$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.go;
+    if (/\.rs$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.rust;
+    if (/\.java$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.java;
+    if (/\.cs$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.csharp;
+    if (/\.(cpp|cc|cxx|hpp|h)$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.cpp;
     return null;
 }
 /** Languages this vocabulary table covers — the matrix derives its taint row from this. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",