@jshookmcp/jshook 0.2.0 → 0.2.1

package/dist/tests/e2e/overrides.js

@@ -124,7 +124,7 @@ export function getOverrides(ctx, config) {
         js_bundle_search: { pattern: 'fetch' },
         get_token_budget_stats: {}, get_cache_stats: {}, get_collection_stats: {},
         boost_profile: { profile: 'full' }, unboost_profile: {},
-        asar_extract: { inputPath: asarPath || '__placeholder__' },
+        asar_extract: asarPath ? { inputPath: asarPath } : {},
         electron_inspect_app: { appPath: electronPath || '__placeholder__' },
         miniapp_pkg_scan: { searchPath: miniappPath || '__placeholder__' },
         miniapp_pkg_unpack: { inputPath: miniappPath || '__placeholder__' },
@@ -144,6 +144,6 @@ export function getOverrides(ctx, config) {
         browse_extension_registry: {},
         batch_register: { tools: [] },
         list_extension_workflows: {},
-        run_extension_workflow: { workflowId: '__placeholder__' },
+        run_extension_workflow: { workflowId: ctx.workflowId ?? '__placeholder__' },
     };
 }

package/dist/tests/e2e/phases/browser-phases.js

@@ -28,14 +28,14 @@ export const browserPhases = [
     {
         name: 'Page Select (needs injected element)',
         setup: async (call) => {
-            await call('page_evaluate', { code: `
-        if (!document.querySelector('#test_select_e2e')) {
-          const s = document.createElement('select');
-          s.id = 'test_select_e2e';
-          s.innerHTML = '<option value="a">A</option><option value="b">B</option>';
-          document.body.appendChild(s);
-        }
-        'ok'
+            await call('page_evaluate', { code: `
+        if (!document.querySelector('#test_select_e2e')) {
+          const s = document.createElement('select');
+          s.id = 'test_select_e2e';
+          s.innerHTML = '<option value="a">A</option><option value="b">B</option>';
+          document.body.appendChild(s);
+        }
+        'ok'
       ` });
         },
         tools: ['page_select'],

package/dist/tests/e2e/skip-list.d.ts

@@ -1,5 +1,6 @@
 export interface SkipListConfig {
     electronPath: string;
     miniappPath: string;
+    asarPath: string;
 }
 export declare function buildSkipSet(config: SkipListConfig): Set<string>;

package/dist/tests/e2e/skip-list.js

@@ -11,7 +11,9 @@ export function buildSkipSet(config) {
         'debugger_load_session',
         'install_extension',
         'captcha_vision_solve', 'widget_challenge_solve',
+        'run_extension_workflow',
         ...(!config.electronPath ? ['electron_attach', 'electron_inspect_app'] : []),
         ...(!config.miniappPath ? ['miniapp_pkg_analyze', 'miniapp_pkg_scan', 'miniapp_pkg_unpack'] : []),
+        ...(!config.asarPath ? ['asar_extract'] : []),
     ]);
 }

package/dist/tests/errors/PrerequisiteError.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/errors/PrerequisiteError.test.js

@@ -0,0 +1,19 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { ToolError } from '../../src/errors/ToolError.js';
+import { PrerequisiteError } from '../../src/errors/PrerequisiteError.js';
+describe('PrerequisiteError', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('extends ToolError with the PREREQUISITE code and preserved message', () => {
+        const error = new PrerequisiteError('debugger must be enabled first');
+        expect(error).toBeInstanceOf(PrerequisiteError);
+        expect(error).toBeInstanceOf(ToolError);
+        expect(error).toBeInstanceOf(Error);
+        expect(error.name).toBe('PrerequisiteError');
+        expect(error.message).toBe('debugger must be enabled first');
+        expect(error.code).toBe('PREREQUISITE');
+        expect(error.toolName).toBeUndefined();
+        expect(error.details).toBeUndefined();
+    });
+});

package/dist/tests/errors/ToolError.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/errors/ToolError.test.js

@@ -0,0 +1,30 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { ToolError, USER_CORRECTABLE_CODES } from '../../src/errors/ToolError.js';
+describe('ToolError', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('captures code, message, tool metadata, and cause', () => {
+        const cause = new Error('root-cause');
+        const error = new ToolError('RUNTIME', 'tool failed', {
+            toolName: 'page_evaluate',
+            details: { url: 'https://example.com' },
+            cause,
+        });
+        expect(error).toBeInstanceOf(ToolError);
+        expect(error).toBeInstanceOf(Error);
+        expect(error.name).toBe('ToolError');
+        expect(error.message).toBe('tool failed');
+        expect(error.code).toBe('RUNTIME');
+        expect(error.toolName).toBe('page_evaluate');
+        expect(error.details).toEqual({ url: 'https://example.com' });
+        expect(error.cause).toBe(cause);
+    });
+    it('tracks user-correctable error codes separately from fatal ones', () => {
+        expect(USER_CORRECTABLE_CODES.has('PREREQUISITE')).toBe(true);
+        expect(USER_CORRECTABLE_CODES.has('VALIDATION')).toBe(true);
+        expect(USER_CORRECTABLE_CODES.has('NOT_FOUND')).toBe(true);
+        expect(USER_CORRECTABLE_CODES.has('TIMEOUT')).toBe(false);
+        expect(USER_CORRECTABLE_CODES.has('RUNTIME')).toBe(false);
+    });
+});

package/dist/tests/modules/analyzer/CodeAnalyzer.test.js

@@ -51,15 +51,15 @@ describe('CodeAnalyzer', () => {
     it('extracts structure with functions, classes, modules and call graph edges', async () => {
         const { llm } = createLLM(['{"businessLogic":{"mainFeatures":["auth"]}}']);
         const analyzer = new CodeAnalyzer(llm);
-        const code = `
-      import helper from './helper';
-      function b() { return 1; }
-      function a() { return b(); }
-      class Box {
-        value = 1;
-        m(p) { return p; }
-      }
-      export default a;
+        const code = `
+      import helper from './helper';
+      function b() { return 1; }
+      function a() { return b(); }
+      class Box {
+        value = 1;
+        m(p) { return p; }
+      }
+      export default a;
     `;
         const result = await analyzer.understand({ code });
         const functionNames = result.structure.functions.map((fn) => fn.name);
@@ -73,9 +73,9 @@ describe('CodeAnalyzer', () => {
     it('detects non-empty tech stack heuristics from common code patterns', async () => {
         const { llm } = createLLM(['{}']);
         const analyzer = new CodeAnalyzer(llm);
-        const code = `
-      function view() { const [v] = useState(1); return v; }
-      export { view };
+        const code = `
+      function view() { const [v] = useState(1); return v; }
+      export { view };
     `;
         const result = await analyzer.understand({ code });
         expect(typeof result.techStack.framework).toBe('string');
@@ -101,9 +101,9 @@ describe('CodeAnalyzer', () => {
     it('tracks tainted data paths from sources to eval sinks', async () => {
         const { llm } = createLLM(['{}', '{}']);
         const analyzer = new CodeAnalyzer(llm);
-        const code = `
-      const payload = location.search;
-      eval(payload);
+        const code = `
+      const payload = location.search;
+      eval(payload);
     `;
         const result = await analyzer.understand({ code, focus: 'security' });
         expect(result.dataFlow.sources.length).toBeGreaterThan(0);

package/dist/tests/modules/analyzer/CodeAnalyzerDataFlow.branches.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/analyzer/CodeAnalyzerDataFlow.branches.test.js

@@ -0,0 +1,331 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+}));
+const promptState = vi.hoisted(() => ({
+    generateTaintAnalysisPrompt: vi.fn(() => [{ role: 'user', content: 'analyze taint' }]),
+}));
+const sanitizerState = vi.hoisted(() => ({
+    checkSanitizer: vi.fn((call) => {
+        const callee = call.callee;
+        return callee && callee.type === 'Identifier' && callee.name === 'sanitize';
+    }),
+}));
+vi.mock('@utils/logger', () => ({ logger: loggerState }));
+vi.mock('@services/prompts/taint', () => ({ generateTaintAnalysisPrompt: promptState.generateTaintAnalysisPrompt }));
+vi.mock('@modules/analyzer/SecurityCodeAnalyzer', () => ({ checkSanitizer: sanitizerState.checkSanitizer }));
+import { analyzeDataFlowWithTaint } from '../../../src/modules/analyzer/CodeAnalyzerDataFlow.js';
+describe('CodeAnalyzerDataFlow additional branch coverage', () => {
+    beforeEach(() => { vi.clearAllMocks(); });
+    describe('source detection network calls', () => {
+        it('detects fetch as network source', async () => {
+            const r = await analyzeDataFlowWithTaint('const data = api.fetch("/ep");');
+            expect(r.sources.some(s => s.type === 'network')).toBe(true);
+            expect(r.graph.nodes.some(n => n.name === 'fetch()' && n.type === 'source')).toBe(true);
+        });
+        it('detects ajax as network source', async () => {
+            const r = await analyzeDataFlowWithTaint('const d = $.ajax("/url");');
+            expect(r.sources.some(s => s.type === 'network')).toBe(true);
+        });
+        it('detects get post request axios', async () => {
+            const r = await analyzeDataFlowWithTaint('const a=http.get("/"); const b=http.post("/"); const c=http.request("/"); const d=client.axios("/");');
+            expect(r.sources.filter(s => s.type === 'network').length).toBeGreaterThanOrEqual(4);
+        });
+        it('tracks taint from network source into eval', async () => {
+            const r = await analyzeDataFlowWithTaint('const resp = api.fetch("/d"); eval(resp);');
+            expect(r.taintPaths.some(p => p.sink.type === 'eval')).toBe(true);
+        });
+    });
+    describe('source detection DOM query methods', () => {
+        it('detects querySelector', async () => {
+            const r = await analyzeDataFlowWithTaint('const el = document.querySelector("#input");');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+        });
+        it('detects getElementById', async () => {
+            const r = await analyzeDataFlowWithTaint('const el = document.getElementById("myId");');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+        });
+        it('detects getElementsByClassName', async () => {
+            const r = await analyzeDataFlowWithTaint('const els = document.getElementsByClassName("cls");');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+        });
+        it('detects getElementsByTagName', async () => {
+            const r = await analyzeDataFlowWithTaint('const els = document.getElementsByTagName("div");');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+        });
+    });
+    describe('source detection URL location', () => {
+        it('detects location.href', async () => {
+            const r = await analyzeDataFlowWithTaint('const u = location.href;');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+            expect(r.graph.nodes.some(n => n.name === 'location.href')).toBe(true);
+        });
+        it('detects location.search', async () => {
+            const r = await analyzeDataFlowWithTaint('const q = location.search;');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+        });
+        it('detects location.hash', async () => {
+            const r = await analyzeDataFlowWithTaint('const h = location.hash;');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+        });
+        it('detects location.pathname', async () => {
+            const r = await analyzeDataFlowWithTaint('const p = location.pathname;');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+        });
+    });
+    describe('source detection cookies and storage', () => {
+        it('detects document.cookie', async () => {
+            const r = await analyzeDataFlowWithTaint('const c = document.cookie;');
+            expect(r.sources.some(s => s.type === 'storage')).toBe(true);
+        });
+        it('detects localStorage', async () => {
+            const r = await analyzeDataFlowWithTaint('const v = localStorage.getItem;');
+            expect(r.sources.some(s => s.type === 'storage')).toBe(true);
+        });
+        it('detects sessionStorage', async () => {
+            const r = await analyzeDataFlowWithTaint('const v = sessionStorage.getItem;');
+            expect(r.sources.some(s => s.type === 'storage')).toBe(true);
+        });
+    });
+    describe('source detection window.name event.data message.data', () => {
+        it('detects window.name', async () => {
+            const r = await analyzeDataFlowWithTaint('const n = window.name;');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+        });
+        it('detects event.data postMessage', async () => {
+            const r = await analyzeDataFlowWithTaint('const d = event.data;');
+            expect(r.sources.some(s => s.type === 'network')).toBe(true);
+        });
+        it('detects message.data WebSocket', async () => {
+            const r = await analyzeDataFlowWithTaint('const d = message.data;');
+            expect(r.sources.some(s => s.type === 'network')).toBe(true);
+        });
+    });
+    describe('sink detection eval family', () => {
+        it('detects eval', async () => {
+            const r = await analyzeDataFlowWithTaint('eval("code");');
+            expect(r.sinks.some(s => s.type === 'eval')).toBe(true);
+        });
+        it('detects Function', async () => {
+            const r = await analyzeDataFlowWithTaint('Function("return 1")();');
+            expect(r.sinks.some(s => s.type === 'eval')).toBe(true);
+        });
+        it('detects setTimeout', async () => {
+            const r = await analyzeDataFlowWithTaint('setTimeout("alert(1)", 100);');
+            expect(r.sinks.some(s => s.type === 'eval')).toBe(true);
+        });
+        it('detects setInterval', async () => {
+            const r = await analyzeDataFlowWithTaint('setInterval("code", 1000);');
+            expect(r.sinks.some(s => s.type === 'eval')).toBe(true);
+        });
+    });
+    describe('sink detection document.write', () => {
+        it('detects document.write', async () => {
+            const r = await analyzeDataFlowWithTaint('document.write("<b>hi</b>");');
+            expect(r.sinks.some(s => s.type === 'xss')).toBe(true);
+        });
+        it('detects document.writeln', async () => {
+            const r = await analyzeDataFlowWithTaint('document.writeln("<p>text</p>");');
+            expect(r.sinks.some(s => s.type === 'xss')).toBe(true);
+        });
+    });
+    describe('sink detection SQL', () => {
+        it('detects db.query', async () => {
+            const r = await analyzeDataFlowWithTaint('db.query("SELECT * FROM users");');
+            expect(r.sinks.some(s => s.type === 'sql-injection')).toBe(true);
+        });
+        it('detects db.execute', async () => {
+            const r = await analyzeDataFlowWithTaint('db.execute("DROP TABLE");');
+            expect(r.sinks.some(s => s.type === 'sql-injection')).toBe(true);
+        });
+        it('detects db.run', async () => {
+            const r = await analyzeDataFlowWithTaint('db.run("INSERT INTO t VALUES(1)");');
+            expect(r.sinks.some(s => s.type === 'sql-injection')).toBe(true);
+        });
+    });
+    describe('sink detection command injection', () => {
+        it('detects child.spawn', async () => {
+            const r = await analyzeDataFlowWithTaint('child.spawn("ls");');
+            expect(r.sinks.some(s => s.type === 'other')).toBe(true);
+        });
+        it('detects child.execSync', async () => {
+            const r = await analyzeDataFlowWithTaint('child.execSync("ls");');
+            expect(r.sinks.some(s => s.type === 'other')).toBe(true);
+        });
+        it('detects child.spawnSync', async () => {
+            const r = await analyzeDataFlowWithTaint('child.spawnSync("ls");');
+            expect(r.sinks.some(s => s.type === 'other')).toBe(true);
+        });
+    });
+    describe('sink detection file ops', () => {
+        it('detects fs.readFile', async () => {
+            const r = await analyzeDataFlowWithTaint('fs.readFile("/etc/passwd");');
+            expect(r.sinks.some(s => s.type === 'other')).toBe(true);
+        });
+        it('detects fs.writeFile', async () => {
+            const r = await analyzeDataFlowWithTaint('fs.writeFile("/tmp/o", d);');
+            expect(r.sinks.some(s => s.type === 'other')).toBe(true);
+        });
+        it('detects fs.readFileSync', async () => {
+            const r = await analyzeDataFlowWithTaint('fs.readFileSync("/p");');
+            expect(r.sinks.some(s => s.type === 'other')).toBe(true);
+        });
+        it('detects fs.writeFileSync', async () => {
+            const r = await analyzeDataFlowWithTaint('fs.writeFileSync("/p", "d");');
+            expect(r.sinks.some(s => s.type === 'other')).toBe(true);
+        });
+        it('detects fs.open', async () => {
+            const r = await analyzeDataFlowWithTaint('fs.open("/p", "r");');
+            expect(r.sinks.some(s => s.type === 'other')).toBe(true);
+        });
+    });
+    describe('sink detection innerHTML outerHTML', () => {
+        it('detects innerHTML assignment', async () => {
+            const r = await analyzeDataFlowWithTaint('el.innerHTML = "<script>alert(1)</script>";');
+            expect(r.sinks.some(s => s.type === 'xss')).toBe(true);
+        });
+        it('detects outerHTML assignment', async () => {
+            const r = await analyzeDataFlowWithTaint('el.outerHTML = "<div>x</div>";');
+            expect(r.sinks.some(s => s.type === 'xss')).toBe(true);
+        });
+    });
+    describe('taint propagation', () => {
+        it('propagates taint through direct variable assignment in second pass', async () => {
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\nconst c = s;\nconst d = c;');
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+        });
+        it('propagates taint through binary expression left in second pass', async () => {
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\nconst c = s + "suf";');
+            expect(r.sources.length).toBeGreaterThan(0);
+        });
+        it('propagates taint through binary expression right in second pass', async () => {
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\nconst c = "pre" + s;');
+            expect(r.sources.length).toBeGreaterThan(0);
+        });
+        it('propagates taint through function call wrapping in second pass', async () => {
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\nconst w = transform(s);');
+            expect(r.sources.length).toBeGreaterThan(0);
+        });
+        it('propagates through re-assignment in second pass', async () => {
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\nlet t;\nt = s;');
+            expect(r.sources.length).toBeGreaterThan(0);
+        });
+        it('tracks tainted args into document.write via checkTaintedArguments', async () => {
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\ndocument.write(s);');
+            expect(r.taintPaths.some(p => p.sink.type === 'eval')).toBe(true);
+        });
+        it('tracks tainted args into SQL sinks', async () => {
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\ndb.query(s);');
+            expect(r.taintPaths.some(p => p.sink.type === 'eval')).toBe(true);
+        });
+        it('tracks tainted args into command sinks', async () => {
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\nchild.exec(s);');
+            expect(r.taintPaths.some(p => p.sink.type === 'eval')).toBe(true);
+        });
+        it('tracks tainted args into file sinks', async () => {
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\nfs.readFile(s);');
+            expect(r.taintPaths.some(p => p.sink.type === 'eval')).toBe(true);
+        });
+    });
+    describe('sanitizer detection', () => {
+        it('removes taint when sanitizer applied', async () => {
+            sanitizerState.checkSanitizer.mockReturnValue(true);
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\nconst c = sanitize(s);\ndocument.body.innerHTML = c;');
+            expect(r.sources.length).toBeGreaterThan(0);
+        });
+    });
+    describe('error handling', () => {
+        it('handles invalid code gracefully', async () => {
+            const r = await analyzeDataFlowWithTaint('this is not valid @@@!!!');
+            expect(r.graph.nodes).toEqual([]);
+            expect(r.sources).toEqual([]);
+            expect(r.sinks).toEqual([]);
+            expect(r.taintPaths).toEqual([]);
+            expect(loggerState.warn).toHaveBeenCalled();
+        });
+        it('returns valid structure for empty code', async () => {
+            const r = await analyzeDataFlowWithTaint('');
+            expect(r).toHaveProperty('graph');
+            expect(r).toHaveProperty('sources');
+            expect(r).toHaveProperty('sinks');
+            expect(r).toHaveProperty('taintPaths');
+        });
+    });
+    describe('LLM enhanced taint analysis', () => {
+        it('skips LLM when no taint paths', async () => {
+            const llm = { chat: vi.fn() };
+            await analyzeDataFlowWithTaint('const x = 1;', llm);
+            expect(llm.chat).not.toHaveBeenCalled();
+        });
+        it('calls LLM and adds unique paths', async () => {
+            const llm = { chat: vi.fn().mockResolvedValue({ content: JSON.stringify({ taintPaths: [{ source: { type: 'network', location: { file: 'current', line: 99 } }, sink: { type: 'eval', location: { file: 'current', line: 100 } }, path: [] }] }) }) };
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\ndocument.body.innerHTML = s;', llm);
+            expect(llm.chat).toHaveBeenCalled();
+            expect(r.taintPaths.some(p => p.source.location.line === 99)).toBe(true);
+        });
+        it('skips duplicate LLM paths', async () => {
+            const llm = { chat: vi.fn().mockResolvedValue({ content: JSON.stringify({ taintPaths: [{ source: { type: 'user_input', location: { file: 'current', line: 1 } }, sink: { type: 'xss', location: { file: 'current', line: 2 } }, path: [] }] }) }) };
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\ndocument.body.innerHTML = s;', llm);
+            const xssPaths = r.taintPaths.filter(p => p.sink.type === 'xss');
+            expect(xssPaths.length).toBe(1);
+        });
+        it('handles non-JSON LLM response', async () => {
+            const llm = { chat: vi.fn().mockResolvedValue({ content: 'This is not JSON at all' }) };
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\ndocument.body.innerHTML = s;', llm);
+            expect(r.taintPaths.length).toBeGreaterThan(0);
+        });
+        it('handles LLM response without taintPaths', async () => {
+            const llm = { chat: vi.fn().mockResolvedValue({ content: JSON.stringify({ analysis: 'no paths' }) }) };
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\ndocument.body.innerHTML = s;', llm);
+            expect(r.taintPaths.length).toBeGreaterThan(0);
+        });
+        it('handles LLM chat throwing', async () => {
+            const llm = { chat: vi.fn().mockRejectedValue(new Error('LLM fail')) };
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\ndocument.body.innerHTML = s;', llm);
+            expect(r.taintPaths.length).toBeGreaterThan(0);
+        });
+        it('truncates code to 4000 chars', async () => {
+            const longCode = 'const s = location.href;\ndocument.body.innerHTML = s;\n' + 'x'.repeat(5000);
+            const llm = { chat: vi.fn().mockResolvedValue({ content: JSON.stringify({ taintPaths: [] }) }) };
+            await analyzeDataFlowWithTaint(longCode, llm);
+            const calls = promptState.generateTaintAnalysisPrompt.mock.calls;
+            if (calls.length > 0) {
+                const codeArg = calls[0][0];
+                expect(codeArg.length).toBeLessThanOrEqual(4000);
+            }
+        });
+        it('handles LLM path without source or sink', async () => {
+            const llm = { chat: vi.fn().mockResolvedValue({ content: JSON.stringify({ taintPaths: [{ source: null, sink: null, path: [] }, { source: { type: 'network', location: { file: 'current', line: 50 } } }] }) }) };
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\ndocument.body.innerHTML = s;', llm);
+            expect(r.taintPaths.every(p => p.source && p.sink)).toBe(true);
+        });
+        it('uses empty array for missing LLM path', async () => {
+            const llm = { chat: vi.fn().mockResolvedValue({ content: JSON.stringify({ taintPaths: [{ source: { type: 'network', location: { file: 'current', line: 88 } }, sink: { type: 'eval', location: { file: 'current', line: 89 } } }] }) }) };
+            const r = await analyzeDataFlowWithTaint('const s = location.href;\ndocument.body.innerHTML = s;', llm);
+            const llmPath = r.taintPaths.find(p => p.source.location.line === 88);
+            if (llmPath)
+                expect(llmPath.path).toEqual([]);
+        });
+    });
+    describe('combined scenarios', () => {
+        it('handles multiple source and sink types', async () => {
+            const code = 'const u = location.href;\nconst c = document.cookie;\nconst st = localStorage.data;\nconst w = window.name;\nconst e = event.data;\nconst m = message.data;\neval(u);\ndocument.write(u);\ndb.query(u);\nchild.exec(u);\nfs.readFile(u);\ndocument.body.innerHTML = u;\ndocument.body.outerHTML = u;';
+            const r = await analyzeDataFlowWithTaint(code);
+            expect(r.sources.some(s => s.type === 'user_input')).toBe(true);
+            expect(r.sources.some(s => s.type === 'storage')).toBe(true);
+            expect(r.sources.some(s => s.type === 'network')).toBe(true);
+            expect(r.sinks.some(s => s.type === 'eval')).toBe(true);
+            expect(r.sinks.some(s => s.type === 'xss')).toBe(true);
+            expect(r.sinks.some(s => s.type === 'sql-injection')).toBe(true);
+            expect(r.sinks.some(s => s.type === 'other')).toBe(true);
+        });
+        it('handles TypeScript code', async () => {
+            const r = await analyzeDataFlowWithTaint('const url: string = location.href;\neval(url);');
+            expect(r.sources.length).toBeGreaterThan(0);
+            expect(r.sinks.length).toBeGreaterThan(0);
+        });
+    });
+});

package/dist/tests/modules/analyzer/CodeAnalyzerDataFlow.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/analyzer/CodeAnalyzerDataFlow.test.js

@@ -0,0 +1,69 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+}));
+const promptState = vi.hoisted(() => ({
+    generateTaintAnalysisPrompt: vi.fn(() => [{ role: 'user', content: 'analyze taint' }]),
+}));
+const sanitizerState = vi.hoisted(() => ({
+    checkSanitizer: vi.fn((call) => {
+        const callee = call.callee;
+        return callee && callee.type === 'Identifier' && callee.name === 'sanitize';
+    }),
+}));
+vi.mock('@utils/logger', () => ({
+    logger: loggerState,
+}));
+vi.mock('@services/prompts/taint', () => ({
+    generateTaintAnalysisPrompt: promptState.generateTaintAnalysisPrompt,
+}));
+vi.mock('@modules/analyzer/SecurityCodeAnalyzer', () => ({
+    checkSanitizer: sanitizerState.checkSanitizer,
+}));
+import { analyzeDataFlowWithTaint } from '../../../src/modules/analyzer/CodeAnalyzerDataFlow.js';
+describe('CodeAnalyzer data flow analysis', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('tracks taint from browser-controlled sources into xss and eval sinks', async () => {
+        const result = await analyzeDataFlowWithTaint(`
+      const source = location.href;
+      const cleaned = sanitize(source);
+      document.body.innerHTML = source;
+      eval(source);
+    `);
+        expect(result.sources.some((source) => source.type === 'user_input')).toBe(true);
+        expect(result.sinks.some((sink) => sink.type === 'xss')).toBe(true);
+        expect(result.sinks.some((sink) => sink.type === 'eval')).toBe(true);
+        expect(result.taintPaths.some((path) => path.sink.type === 'xss')).toBe(true);
+        expect(result.taintPaths.some((path) => path.sink.type === 'eval')).toBe(true);
+    });
+    it('uses llm taint enhancement to add additional unique taint paths', async () => {
+        const llm = {
+            chat: vi.fn().mockResolvedValue({
+                content: JSON.stringify({
+                    taintPaths: [
+                        {
+                            source: { type: 'network', location: { file: 'current', line: 1 } },
+                            sink: { type: 'eval', location: { file: 'current', line: 5 } },
+                            path: [
+                                { file: 'current', line: 1 },
+                                { file: 'current', line: 5 },
+                            ],
+                        },
+                    ],
+                }),
+            }),
+        };
+        const result = await analyzeDataFlowWithTaint(`
+        const source = location.href;
+        document.body.innerHTML = source;
+      `, llm);
+        expect(promptState.generateTaintAnalysisPrompt).toHaveBeenCalled();
+        expect(llm.chat).toHaveBeenCalled();
+        expect(result.taintPaths.some((path) => path.source.location.line === 1)).toBe(true);
+    });
+});

package/dist/tests/modules/analyzer/PatternDetector.additional.test.d.ts

@@ -0,0 +1 @@
+export {};