@oddessentials/odd-ai-reviewers 1.10.1 → 1.12.0

package/dist/report/finding-validator.js

@@ -67,7 +67,7 @@ const CAUTIONARY_ADVICE_PATTERNS = [
  * If the combined message+suggestion contains any of these, the finding
  * is treated as a legitimate concern, not hedging advice.
  */
-const SECURITY_BLOCKLIST = /\b(?:sql|injection|xss|cross.?site|sanitiz|escap|authenti|authoriz|csrf|ssrf|path.?traversal|command.?inject|exec\s*\(|eval\s*\(|deseria|privilege|encrypt|password|credential|secret|vulnerab|exploit|attack|malicious|buffer.?overflow|bypass|jwt|token|signature|session|cors|cookie|rate.?limit(?:ing)?|redirect)\b/i;
+const SECURITY_BLOCKLIST = /\b(?:sql|injection|xss|cross.?site|sanitiz\w*|escap\w*|authenti\w*|authoriz\w*|csrf|ssrf|path.?traversal|command.?inject|exec\s*\(|eval\s*\(|deseria\w*|privilege|encrypt|password|credential|secret|vulnerab\w*|exploit|attack|malicious|buffer.?overflow|bypass|jwt|token|signature|session|cors|cookie|rate.?limit(?:ing)?|redirect)\b/i;
 /**
  * Check if a suggestion is actionable (contains concrete guidance beyond dismissive language).
  */
@@ -395,54 +395,9 @@ export function validateNormalizedFindings(findings, lineResolver, diffFiles) {
             }
         }
     }
-    // Pass 3: Self-contradiction detection (all findings that passed Pass 2)
-    for (const result of results) {
-        if (!result.valid)
-            continue;
-        if (result.finding.severity !== 'info')
-            continue;
-        // FR-015: Normalize Unicode before matching to prevent zero-width character bypass
-        const normalizedMessage = normalizeUnicode(result.finding.message);
-        const matchedPattern = DISMISSIVE_PATTERNS.find((p) => p.test(normalizedMessage));
-        if (!matchedPattern)
-            continue;
-        const normalizedSuggestion = result.finding.suggestion
-            ? normalizeUnicode(result.finding.suggestion)
-            : undefined;
-        if (hasActionableSuggestion(normalizedSuggestion))
-            continue;
-        result.valid = false;
-        result.filterReason = `Self-contradicting: info severity with dismissive language (${matchedPattern.source})`;
-        result.filterType = 'self_contradicting';
-        stats.filteredBySelfContradiction++;
-        console.log('[router] [finding-validator] [filtered:semantic]', {
-            file: result.finding.file,
-            line: result.finding.line,
-            reason: result.filterReason,
-        });
-    }
-    // Pass 3.5: Cautionary advice detection (same as in validateFindingsSemantics)
-    for (const result of results) {
-        if (!result.valid)
-            continue;
-        if (result.finding.severity !== 'info')
-            continue;
-        const combinedText = normalizeUnicode(result.finding.message + ' ' + (result.finding.suggestion ?? ''));
-        const matchedCautionary = CAUTIONARY_ADVICE_PATTERNS.find((p) => p.test(combinedText));
-        if (!matchedCautionary)
-            continue;
-        if (SECURITY_BLOCKLIST.test(combinedText))
-            continue;
-        result.valid = false;
-        result.filterReason = `Cautionary advice: info severity with hedging language (${matchedCautionary.source}) and no security concern`;
-        result.filterType = 'cautionary_advice';
-        stats.filteredByCautionaryAdvice++;
-        console.log('[router] [finding-validator] [filtered:cautionary]', {
-            file: result.finding.file,
-            line: result.finding.line,
-            reason: result.filterReason,
-        });
-    }
+    // FR-018: Pass 3 (self-contradiction) and Pass 3.5 (cautionary advice) REMOVED.
+    // These are now handled exclusively by validateFindingsSemantics() (Stage 1).
+    // Stage 2 only performs diff-bound validation (classification + line validation).
     // Build final arrays
     const validFindings = [];
     const filtered = [];
@@ -487,10 +442,7 @@ export function normalizeAndValidateFindings(findings, diffFiles, platform) {
 /**
  * Validate and classify findings, filtering out invalid lines and self-contradicting findings.
  *
- * Three-pass validation:
- * 1. Classify each finding (inline, file-level, global, cross-file)
- * 2. Validate line numbers for inline findings
- * 3. Detect self-contradicting findings (info + dismissive + no suggestion)
+ * Runs both Stage 1 (semantic validation) and Stage 2 (diff-bound validation) in sequence.
  *
  * @deprecated Use validateFindingsSemantics() in processFindings and
  * validateNormalizedFindings() in platform reporters after normalization.
@@ -502,6 +454,23 @@ export function normalizeAndValidateFindings(findings, diffFiles, platform) {
  * @returns Validation summary with valid findings, filtered findings, and stats
  */
 export function validateFindings(findings, lineResolver, diffFiles) {
-    return validateNormalizedFindings(findings, lineResolver, diffFiles);
+    // FR-018: Stage 1 semantic validation first (self-contradiction, cautionary advice),
+    // then Stage 2 diff-bound validation (classification, line validation).
+    const stage1 = validateFindingsSemantics(findings);
+    const stage2 = validateNormalizedFindings(stage1.validFindings, lineResolver, diffFiles);
+    // Merge stats from both stages
+    return {
+        validFindings: stage2.validFindings,
+        filtered: [...stage1.filtered, ...stage2.filtered],
+        stats: {
+            total: stage1.stats.total,
+            valid: stage2.stats.valid,
+            filteredByLine: stage2.stats.filteredByLine,
+            filteredBySelfContradiction: stage1.stats.filteredBySelfContradiction,
+            filteredByCautionaryAdvice: stage1.stats.filteredByCautionaryAdvice,
+            filteredByPRIntent: stage1.stats.filteredByPRIntent,
+            byClassification: stage2.stats.byClassification,
+        },
+    };
 }
 //# sourceMappingURL=finding-validator.js.map

package/dist/report/finding-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"finding-validator.js","sourceRoot":"","sources":["../../src/report/finding-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,GAIzB,MAAM,oBAAoB,CAAC;AA2C5B;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAa;IACpC,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,uBAAuB;IACvB,qBAAqB;IACrB,0BAA0B;IAC1B,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,0BAA0B,GAAa;IAC3C,6DAA6D;IAC7D,4EAA4E;IAC5E,kEAAkE;IAClE,6DAA6D;CAC9D,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GACtB,0TAA0T,CAAC;AAE7T;;GAEG;AACH,SAAS,uBAAuB,CAAC,UAA8B;IAC7D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,GAAG,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAC9C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE5C,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC;SAC1E,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IAEV,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAE9E;;;GAGG;AACH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,eAAe;IACf,OAAO;IACP,UAAU;IACV,aAAa;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,6BAA6B,GAA6B;IAC9D,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACzB,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAmB,EACnB,aAAqB,EACrB,mBAAmB,GAAG,IAAI;IAE1B,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAE/D,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAc,EAAE,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,6BAA6B;QAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,mGAAmG;QACnG,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEnD,6EAA6E;QAC7E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,eAAe,GACnB,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,2CAA2C;QAC3C,OAAO,CAAC,GAAG,CAAC,mDAAmD,EAAE;YAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7B,iBAAiB,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC/E,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC9C,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,IAAI;gBAC1B,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,YAAY;gBAChB,CAAC,CAAC,QAAQ;YACZ,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,qCAAqC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC;YAChH,UAAU,EAAE,yBAAyB;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAmB,EACnB,aAAsB;IAEtB,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,CAAC;QACjB,2BAA2B,EAAE,CAAC;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SACyB;KAC3C,CAAC;IAEF,mFAAmF;IACnF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,cAAqC,CAAC;QAE1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,cAAc,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAEzC,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,cAAc;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAE9E,uCAAuC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,yDAAyD;QACzD,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,mFAAmF;QACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU;YACpD,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,uBAAuB,CAAC,oBAAoB,CAAC;YAAE,SAAS;QAE5D,qEAAqE;QACrE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,+DAA+D,cAAc,CAAC,MAAM,GAAG,CAAC;QAC9G,MAAM,CAAC,UAAU,GAAG,oBAAoB,CAAC;QACzC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,oFAAoF;IACpF,gFAAgF;IAChF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,0DAA0D;QAC1D,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,MAAM,YAAY,GAAG,gBAAgB,CACnC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CACjE,CAAC;QAEF,iDAAiD;QACjD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,iBAAiB;YAAE,SAAS;QAEjC,kEAAkE;QAClE,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAEpD,6DAA6D;QAC7D,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,2DAA2D,iBAAiB,CAAC,MAAM,2BAA2B,CAAC;QACrI,MAAM,CAAC,UAAU,GAAG,mBAAmB,CAAC;QACxC,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,oDAAoD,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,aAAa,GAAc,EAAE,CAAC;IAClC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,4BAA4B,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAClF,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,YAAiC,EACjC,SAAoB;IAEpB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,CAAC;QACjB,2BAA2B,EAAE,CAAC;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SACyB;KAC3C,CAAC;IAEF,gCAAgC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,cAAqC,CAAC;QAE1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,cAAc,GAAG,YAAY,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,uDAAuD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,cAAc,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAEzC,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,cAAc;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5E,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,YAAY,GAAG,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,0BAA0B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjG,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC;gBACnC,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE;oBACjE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;oBACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;oBACzB,MAAM,EAAE,MAAM,CAAC,YAAY;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,mFAAmF;QACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU;YACpD,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,uBAAuB,CAAC,oBAAoB,CAAC;YAAE,SAAS;QAE5D,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,+DAA+D,cAAc,CAAC,MAAM,GAAG,CAAC;QAC9G,MAAM,CAAC,UAAU,GAAG,oBAAoB,CAAC;QACzC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAC5B,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,MAAM,YAAY,GAAG,gBAAgB,CACnC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CACjE,CAAC;QAEF,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,iBAAiB;YAAE,SAAS;QAEjC,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAEpD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,2DAA2D,iBAAiB,CAAC,MAAM,2BAA2B,CAAC;QACrI,MAAM,CAAC,UAAU,GAAG,mBAAmB,CAAC;QACxC,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,oDAAoD,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAkBD,MAAM,UAAU,4BAA4B,CAC1C,QAAmB,EACnB,SAAqB,EACrB,QAAgB;IAEhB,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE7E,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CACT,IAAI,QAAQ,sBAAsB,mBAAmB,CAAC,KAAK,CAAC,KAAK,UAAU;YACzE,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,gBAAgB,mBAAmB,CAAC,KAAK,CAAC,OAAO,UAAU,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,0BAA0B,CAC7C,mBAAmB,CAAC,QAAQ,EAC5B,YAAY,EACZ,aAAa,CACd,CAAC;IAEF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CACT,IAAI,QAAQ,yBAAyB,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU;YACrE,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,qBAAqB;YACzD,GAAG,YAAY,CAAC,KAAK,CAAC,2BAA2B,uBAAuB;YACxE,GAAG,YAAY,CAAC,KAAK,CAAC,0BAA0B,oBAAoB,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CACpC,mBAAmB,CAAC,KAAK,EACzB,mBAAmB,CAAC,cAAc,CACnC,CAAC;IAEF,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,mBAAmB,CAAC,KAAK,EACzB,mBAAmB,CAAC,cAAc,CACnC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,YAAY,CAAC,aAAa;QAC7C,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,mBAAmB,CAAC,KAAK;QAC7C,cAAc,EAAE,mBAAmB,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmB,EACnB,YAAiC,EACjC,SAAoB;IAEpB,OAAO,0BAA0B,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"finding-validator.js","sourceRoot":"","sources":["../../src/report/finding-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,GAIzB,MAAM,oBAAoB,CAAC;AA2C5B;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAa;IACpC,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,uBAAuB;IACvB,qBAAqB;IACrB,0BAA0B;IAC1B,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,0BAA0B,GAAa;IAC3C,6DAA6D;IAC7D,4EAA4E;IAC5E,kEAAkE;IAClE,6DAA6D;CAC9D,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GACtB,4UAA4U,CAAC;AAE/U;;GAEG;AACH,SAAS,uBAAuB,CAAC,UAA8B;IAC7D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,GAAG,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAC9C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE5C,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC;SAC1E,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IAEV,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAE9E;;;GAGG;AACH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,eAAe;IACf,OAAO;IACP,UAAU;IACV,aAAa;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,6BAA6B,GAA6B;IAC9D,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACzB,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAmB,EACnB,aAAqB,EACrB,mBAAmB,GAAG,IAAI;IAE1B,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAE/D,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAc,EAAE,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,6BAA6B;QAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,mGAAmG;QACnG,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEnD,6EAA6E;QAC7E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,eAAe,GACnB,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,2CAA2C;QAC3C,OAAO,CAAC,GAAG,CAAC,mDAAmD,EAAE;YAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7B,iBAAiB,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC/E,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC9C,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,IAAI;gBAC1B,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,YAAY;gBAChB,CAAC,CAAC,QAAQ;YACZ,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,qCAAqC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC;YAChH,UAAU,EAAE,yBAAyB;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAmB,EACnB,aAAsB;IAEtB,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,CAAC;QACjB,2BAA2B,EAAE,CAAC;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SACyB;KAC3C,CAAC;IAEF,mFAAmF;IACnF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,cAAqC,CAAC;QAE1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,cAAc,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAEzC,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,cAAc;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAE9E,uCAAuC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,yDAAyD;QACzD,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,mFAAmF;QACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU;YACpD,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,uBAAuB,CAAC,oBAAoB,CAAC;YAAE,SAAS;QAE5D,qEAAqE;QACrE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,+DAA+D,cAAc,CAAC,MAAM,GAAG,CAAC;QAC9G,MAAM,CAAC,UAAU,GAAG,oBAAoB,CAAC;QACzC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,oFAAoF;IACpF,gFAAgF;IAChF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,0DAA0D;QAC1D,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,MAAM,YAAY,GAAG,gBAAgB,CACnC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CACjE,CAAC;QAEF,iDAAiD;QACjD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,iBAAiB;YAAE,SAAS;QAEjC,kEAAkE;QAClE,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAEpD,6DAA6D;QAC7D,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,2DAA2D,iBAAiB,CAAC,MAAM,2BAA2B,CAAC;QACrI,MAAM,CAAC,UAAU,GAAG,mBAAmB,CAAC;QACxC,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,oDAAoD,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,aAAa,GAAc,EAAE,CAAC;IAClC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,4BAA4B,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAClF,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,YAAiC,EACjC,SAAoB;IAEpB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,CAAC;QACjB,2BAA2B,EAAE,CAAC;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SACyB;KAC3C,CAAC;IAEF,gCAAgC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,cAAqC,CAAC;QAE1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,cAAc,GAAG,YAAY,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,uDAAuD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,cAAc,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAEzC,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,cAAc;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5E,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,YAAY,GAAG,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,0BAA0B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjG,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC;gBACnC,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE;oBACjE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;oBACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;oBACzB,MAAM,EAAE,MAAM,CAAC,YAAY;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,8EAA8E;IAC9E,kFAAkF;IAElF,qBAAqB;IACrB,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAkBD,MAAM,UAAU,4BAA4B,CAC1C,QAAmB,EACnB,SAAqB,EACrB,QAAgB;IAEhB,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE7E,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CACT,IAAI,QAAQ,sBAAsB,mBAAmB,CAAC,KAAK,CAAC,KAAK,UAAU;YACzE,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,gBAAgB,mBAAmB,CAAC,KAAK,CAAC,OAAO,UAAU,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,0BAA0B,CAC7C,mBAAmB,CAAC,QAAQ,EAC5B,YAAY,EACZ,aAAa,CACd,CAAC;IAEF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CACT,IAAI,QAAQ,yBAAyB,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU;YACrE,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,qBAAqB;YACzD,GAAG,YAAY,CAAC,KAAK,CAAC,2BAA2B,uBAAuB;YACxE,GAAG,YAAY,CAAC,KAAK,CAAC,0BAA0B,oBAAoB,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CACpC,mBAAmB,CAAC,KAAK,EACzB,mBAAmB,CAAC,cAAc,CACnC,CAAC;IAEF,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,mBAAmB,CAAC,KAAK,EACzB,mBAAmB,CAAC,cAAc,CACnC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,YAAY,CAAC,aAAa;QAC7C,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,mBAAmB,CAAC,KAAK;QAC7C,cAAc,EAAE,mBAAmB,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmB,EACnB,YAAiC,EACjC,SAAoB;IAEpB,qFAAqF;IACrF,wEAAwE;IACxE,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAEzF,+BAA+B;IAC/B,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,KAAK,EAAE;YACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;YACzB,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;YAC3C,2BAA2B,EAAE,MAAM,CAAC,KAAK,CAAC,2BAA2B;YACrE,0BAA0B,EAAE,MAAM,CAAC,KAAK,CAAC,0BAA0B;YACnE,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB;YACnD,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB;SAChD;KACF,CAAC;AACJ,CAAC"}

package/dist/report/framework-pattern-filter.d.ts

@@ -45,7 +45,7 @@ export interface FrameworkFilterSummary {
  * @param diffContent - Raw diff content for evidence validation
  * @returns Summary with suppressed/passed findings and diagnostic details
  */
-export declare function filterFrameworkConventionFindings(findings: Finding[], diffContent: string): FrameworkFilterSummary;
+export declare function filterFrameworkConventionFindings(findings: Finding[], diffContent: string, disableMatchers?: string[]): FrameworkFilterSummary;
 /**
  * Get the list of valid findings (non-suppressed) from a filter summary.
  */

package/dist/report/framework-pattern-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework-pattern-filter.d.ts","sourceRoot":"","sources":["../../src/report/framework-pattern-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAMlD,MAAM,WAAW,uBAAuB;IACtC,gCAAgC;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACtE,0DAA0D;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAqnBD;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,MAAM,GAClB,sBAAsB,CAuCxB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,EAAE,CAE3E"}
+{"version":3,"file":"framework-pattern-filter.d.ts","sourceRoot":"","sources":["../../src/report/framework-pattern-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAMlD,MAAM,WAAW,uBAAuB;IACtC,gCAAgC;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACtE,0DAA0D;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAwpBD;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,MAAM,EACnB,eAAe,GAAE,MAAM,EAAO,GAC7B,sBAAsB,CA+CxB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,EAAE,CAE3E"}

package/dist/report/framework-pattern-filter.js

@@ -65,6 +65,33 @@ function extractLinesNearFinding(diffSection, findingLine, windowSize = 10) {
     }
     return result;
 }
+/**
+ * Extract nearby context from a diff for a finding.
+ * Replaces the 4-line boilerplate pattern used in 8 of 9 matchers.
+ * Returns null if the finding's file is not found in the diff.
+ */
+function extractNearbyContext(finding, diffContent, windowSize = 10) {
+    const fileSection = extractFileDiffSection(finding, diffContent);
+    if (!fileSection)
+        return null;
+    const nearbyLines = extractLinesNearFinding(fileSection, finding.line, windowSize);
+    const nearbyText = nearbyLines.join('\n');
+    return { fileSection, nearbyLines, nearbyText };
+}
+/**
+ * Build a RegExp that matches a word-bounded variable name followed by a suffix.
+ * Validates that varName contains only word characters to prevent regex injection.
+ * SAFETY: All call sites extract varName from \w+ regex matches.
+ */
+function boundedVarPattern(varName, suffix) {
+    // eslint-disable-next-line security/detect-non-literal-regexp
+    return new RegExp('\\b' + varName + suffix);
+}
+/**
+ * Matches server-side HTTP response output calls: res.send(), res.write(), res.end().
+ * Extracted from 4 duplicate inline regexes across the error-object-xss matcher.
+ */
+const RES_RESPONSE_SINK = /\bres\s*\.\s*(?:send|write|end)\s*\(/;
 // =============================================================================
 // Closed Matcher Table — DEFAULT DENY
 // Only these 9 matchers. No additions without spec change.
@@ -76,25 +103,21 @@ const FRAMEWORK_MATCHERS = [
         name: 'Express Error Middleware',
         messagePattern: /unused.*param|declared\s+but\s+never\s+referenced|dead\s+code.*never\s+called|parameter\s+not\s+referenced/i,
         evidenceValidator(finding, diffContent) {
-            const fileSection = extractFileDiffSection(finding, diffContent);
-            if (!fileSection)
+            const ctx = extractNearbyContext(finding, diffContent, 5);
+            if (!ctx)
                 return false;
             // Must have a 4-parameter function near the finding line
             // Express error middleware signature: (err, req, res, next) or variants
-            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 5);
-            const nearbyText = nearbyLines.join('\n');
-            // Match 4-param function: (param1, param2, param3, param4) with optional type annotations
             const fourParamPattern = /\(\s*\w+\s*(?::\s*[^,)]+)?\s*,\s*\w+\s*(?::\s*[^,)]+)?\s*,\s*\w+\s*(?::\s*[^,)]+)?\s*,\s*\w+\s*(?::\s*[^,)]+)?\s*\)/;
-            const hasFourParams = fourParamPattern.test(nearbyText);
-            if (!hasFourParams)
+            if (!fourParamPattern.test(ctx.nearbyText))
                 return false;
             // At least one Express indicator required (in the file section):
             // - .use() middleware registration call
             // - import from 'express' package
             // - Express type annotations (Request, Response, NextFunction, ErrorRequestHandler)
-            const hasUseCall = /\.use\s*\(/.test(fileSection);
-            const hasExpressImport = /from\s+['"]express['"]/.test(fileSection);
-            const hasExpressTypes = /:\s*(?:Request|Response|NextFunction|ErrorRequestHandler)\b/.test(nearbyText);
+            const hasUseCall = /\.use\s*\(/.test(ctx.fileSection);
+            const hasExpressImport = /from\s+['"]express['"]/.test(ctx.fileSection);
+            const hasExpressTypes = /:\s*(?:Request|Response|NextFunction|ErrorRequestHandler)\b/.test(ctx.nearbyText);
             return hasUseCall || hasExpressImport || hasExpressTypes;
         },
         suppressionReason: 'Express 4-param error middleware — unused params required by framework',
@@ -122,14 +145,12 @@ const FRAMEWORK_MATCHERS = [
         name: 'Exhaustive Switch',
         messagePattern: /missing.*case|unhandled.*case|default.*unreachable/i,
         evidenceValidator(finding, diffContent) {
-            const fileSection = extractFileDiffSection(finding, diffContent);
-            if (!fileSection)
+            const ctx = extractNearbyContext(finding, diffContent, 8);
+            if (!ctx)
                 return false;
             // Scan near finding line for assertNever( or exhaustive throw
-            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 8);
-            const nearbyText = nearbyLines.join('\n');
-            const hasAssertNever = /assertNever\s*\(/.test(nearbyText);
-            const hasExhaustiveThrow = /throw\s+new\s+\w*[Ee]rror\s*\(\s*['"`].*(?:exhaustive|unreachable|unexpected)/i.test(nearbyText);
+            const hasAssertNever = /assertNever\s*\(/.test(ctx.nearbyText);
+            const hasExhaustiveThrow = /throw\s+new\s+\w*[Ee]rror\s*\(\s*['"`].*(?:exhaustive|unreachable|unexpected)/i.test(ctx.nearbyText);
             return hasAssertNever || hasExhaustiveThrow;
         },
         suppressionReason: 'Exhaustive switch with assertNever/throw — all cases handled at compile time',
@@ -140,19 +161,17 @@ const FRAMEWORK_MATCHERS = [
         name: 'React Query Advisory',
         messagePattern: /duplicate|double.?fetch|redundant.*query|multiple.*useQuery|(?:verify|ensure|validate).*(?:endpoint|api|fetch).*(?:return|format|response|error|handle)|missing.*error.*handling.*(?:fetch|query|useQuery)|error.?handling.*(?:useQuery|useSWR)/i,
         evidenceValidator(finding, diffContent) {
-            const fileSection = extractFileDiffSection(finding, diffContent);
-            if (!fileSection)
+            const ctx = extractNearbyContext(finding, diffContent, 10);
+            if (!ctx)
                 return false;
             // Evidence 1: Query library import in file section
-            const hasQueryImport = /from\s+['"]@tanstack\/react-query['"]/.test(fileSection) ||
-                /from\s+['"]swr['"]/.test(fileSection) ||
-                /from\s+['"]@apollo\/client['"]/.test(fileSection);
+            const hasQueryImport = /from\s+['"]@tanstack\/react-query['"]/.test(ctx.fileSection) ||
+                /from\s+['"]swr['"]/.test(ctx.fileSection) ||
+                /from\s+['"]@apollo\/client['"]/.test(ctx.fileSection);
             if (!hasQueryImport)
                 return false;
             // Evidence 2: Query hook call near the finding line
-            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 10);
-            const nearbyText = nearbyLines.join('\n');
-            const hasQueryHook = /\b(useQuery|useSWR|useInfiniteQuery)\s*\(/.test(nearbyText);
+            const hasQueryHook = /\b(useQuery|useSWR|useInfiniteQuery)\s*\(/.test(ctx.nearbyText);
             if (!hasQueryHook)
                 return false;
             // Evidence 3: Exclude raw HTTP findings (not about library dedup)
@@ -172,7 +191,7 @@ const FRAMEWORK_MATCHERS = [
                 const errorBindings = [];
                 // Match shorthand `{ ..., error, ... }` or `{ ..., isError, ... }`
                 // and aliased `{ ..., error: NAME, ... }` or `{ ..., isError: NAME, ... }`
-                const destructuringBlock = nearbyText.match(/\{\s*([^}]*\b(?:error|isError)\b[^}]*)\}/);
+                const destructuringBlock = ctx.nearbyText.match(/\{\s*([^}]*\b(?:error|isError)\b[^}]*)\}/);
                 if (!destructuringBlock?.[1])
                     return false;
                 const blockContent = destructuringBlock[1];
@@ -203,12 +222,12 @@ const FRAMEWORK_MATCHERS = [
                 const hasErrorUsage = errorBindings.some((binding) => {
                     // eslint-disable-next-line security/detect-non-literal-regexp
                     const ifCheck = new RegExp('\\bif\\s*\\(\\s*' + binding + '\\b');
-                    // eslint-disable-next-line security/detect-non-literal-regexp
-                    const shortCircuit = new RegExp('\\b' + binding + '\\s*&&');
+                    const shortCircuit = boundedVarPattern(binding, '\\s*&&');
                     // Ternary: `binding ? ... : ...` — must exclude optional chaining `binding?.`
-                    // eslint-disable-next-line security/detect-non-literal-regexp
-                    const ternary = new RegExp('\\b' + binding + '\\s*\\?(?!\\.)');
-                    return (ifCheck.test(nearbyText) || shortCircuit.test(nearbyText) || ternary.test(nearbyText));
+                    const ternary = boundedVarPattern(binding, '\\s*\\?(?!\\.)');
+                    return (ifCheck.test(ctx.nearbyText) ||
+                        shortCircuit.test(ctx.nearbyText) ||
+                        ternary.test(ctx.nearbyText));
                 });
                 if (!hasErrorUsage)
                     return false;
@@ -223,20 +242,18 @@ const FRAMEWORK_MATCHERS = [
         name: 'Promise.allSettled Convention',
         messagePattern: /allSettled.*(?:order|sequence|reject|unhandled|error.?handling|silent)|(?:order|sequence).*allSettled|(?:unhandled|missing|silent).*(?:reject|error|exception).*(?:promise|settled)|allSettled.*results.*not.*(?:match|correspond|align)|(?:additional|need).*error.*handling.*(?:promise|fetch|request|response|processing)|verify.*(?:fetch|request).*(?:error|handling|additional|response)/i,
         evidenceValidator(finding, diffContent) {
-            const fileSection = extractFileDiffSection(finding, diffContent);
-            if (!fileSection)
+            const ctx = extractNearbyContext(finding, diffContent, 10);
+            if (!ctx)
                 return false;
             // Evidence 1: Promise.allSettled call near the finding line (not just file-wide)
-            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 10);
-            const nearbyText = nearbyLines.join('\n');
-            if (!/Promise\.allSettled\s*\(/.test(nearbyText))
+            if (!/Promise\.allSettled\s*\(/.test(ctx.nearbyText))
                 return false;
             // Evidence 2+3: Iteration and .status must be BOUND to the allSettled result variable.
             // Unscoped checks (any .forEach + any .status in nearbyText) allow false suppression
             // when unrelated iteration or HTTP .status references exist nearby.
             // Step 2a: Extract the result variable name.
             // Primary: `const/let/var X = await Promise.allSettled(...)`
-            const allSettledVarMatch = nearbyText.match(/\b(?:const|let|var)\s+(\w+)\s*=\s*await\s+Promise\.allSettled\s*\(/);
+            const allSettledVarMatch = ctx.nearbyText.match(/\b(?:const|let|var)\s+(\w+)\s*=\s*await\s+Promise\.allSettled\s*\(/);
             let varName = allSettledVarMatch?.[1];
             // Fallback: `.then()` chain — `Promise.allSettled(...).then((X) => ...)` or
             // `.then(X => ...)` or `.then(function(X) { ... })`.
@@ -249,7 +266,7 @@ const FRAMEWORK_MATCHERS = [
             //   - named function reference: `.then(handleResults)`
             //   - generator patterns
             if (!varName) {
-                const thenMatch = nearbyText.match(/Promise\.allSettled\s*\([\s\S]*?\)\.then\s*\(\s*(?:function\s*\(\s*(\w+)|(\w+)\s*=>|\(\s*(\w+)\s*\)\s*=>)/);
+                const thenMatch = ctx.nearbyText.match(/Promise\.allSettled\s*\([\s\S]*?\)\.then\s*\(\s*(?:function\s*\(\s*(\w+)|(\w+)\s*=>|\(\s*(\w+)\s*\)\s*=>)/);
                 varName = thenMatch?.[1] ?? thenMatch?.[2] ?? thenMatch?.[3];
             }
             if (!varName)
@@ -266,36 +283,31 @@ const FRAMEWORK_MATCHERS = [
                 '|\\b' +
                 varName +
                 '\\s*\\[');
-            if (!iterationPattern.test(nearbyText))
+            if (!iterationPattern.test(ctx.nearbyText))
                 return false;
             // Step 2c: .status check must appear on the iteration callback parameter,
             // not on an unrelated variable. Extract the callback/loop variable name
             // and require PARAM.status in nearbyText.
             let hasStatusCheck = false;
             // Pattern A: VARNAME.forEach((PARAM, ...) => { ... PARAM.status ... })
-            const forEachParamMatch = nearbyText.match(
-            // eslint-disable-next-line security/detect-non-literal-regexp
-            new RegExp('\\b' + varName + '\\s*\\.\\s*forEach\\s*\\(\\s*(?:\\(\\s*)?(\\w+)'));
+            const forEachParamMatch = ctx.nearbyText.match(boundedVarPattern(varName, '\\s*\\.\\s*forEach\\s*\\(\\s*(?:\\(\\s*)?(\\w+)'));
             if (forEachParamMatch?.[1]) {
                 const cbParam = forEachParamMatch[1];
-                // eslint-disable-next-line security/detect-non-literal-regexp
-                hasStatusCheck = new RegExp('\\b' + cbParam + '\\.status\\b').test(nearbyText);
+                hasStatusCheck = boundedVarPattern(cbParam, '\\.status\\b').test(ctx.nearbyText);
             }
             // Pattern B: for (const LOOPVAR of VARNAME) { ... LOOPVAR.status ... }
             if (!hasStatusCheck) {
-                const forOfMatch = nearbyText.match(
+                const forOfMatch = ctx.nearbyText.match(
                 // eslint-disable-next-line security/detect-non-literal-regexp
                 new RegExp('for\\s*\\(\\s*(?:const|let|var)\\s+(\\w+)\\s+of\\s+' + varName + '\\b'));
                 if (forOfMatch?.[1]) {
                     const loopVar = forOfMatch[1];
-                    // eslint-disable-next-line security/detect-non-literal-regexp
-                    hasStatusCheck = new RegExp('\\b' + loopVar + '\\.status\\b').test(nearbyText);
+                    hasStatusCheck = boundedVarPattern(loopVar, '\\.status\\b').test(ctx.nearbyText);
                 }
             }
             // Pattern C: indexed access VARNAME[i].status
             if (!hasStatusCheck) {
-                // eslint-disable-next-line security/detect-non-literal-regexp
-                hasStatusCheck = new RegExp('\\b' + varName + '\\s*\\[\\w+\\]\\s*\\.\\s*status\\b').test(nearbyText);
+                hasStatusCheck = boundedVarPattern(varName, '\\s*\\[\\w+\\]\\s*\\.\\s*status\\b').test(ctx.nearbyText);
             }
             if (!hasStatusCheck)
                 return false;
@@ -309,14 +321,13 @@ const FRAMEWORK_MATCHERS = [
         name: 'Safe Local File Read',
         messagePattern: /path.*traversal|directory.*traversal|local.*file.*read|file.*inclusion|readFileSync.*block|synchronous.*file.*read|block.*event.*loop.*(?:read|file)/i,
         evidenceValidator(finding, diffContent) {
-            const fileSection = extractFileDiffSection(finding, diffContent);
-            if (!fileSection)
+            const ctx = extractNearbyContext(finding, diffContent, 10);
+            if (!ctx)
                 return false;
-            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 10);
             // Single-line only: check each line individually (per FR-011 scope limitation)
             const canonicalPattern = /path\.(join|resolve)\s*\(\s*(?:__dirname|__filename|import\.meta\.(?:dirname|filename|url))\s*(?:,\s*(['"])[^'"]*\2\s*)*\)/;
             let match = null;
-            for (const line of nearbyLines) {
+            for (const line of ctx.nearbyLines) {
                 match = canonicalPattern.exec(line);
                 if (match)
                     break;
@@ -360,16 +371,15 @@ const FRAMEWORK_MATCHERS = [
                 // Require that at least one nearby line is a module-top-level declaration
                 // (starts with at most 2 spaces of indentation followed by const/let/var/export).
                 // Lines indented ≥4 spaces are inside a function body (not top-level).
-                const hasTopLevelDecl = nearbyLines.some((l) => /^\s{0,2}(?:export\s+)?(?:const|let|var)\s+\w+\s*=/.test(l));
+                const hasTopLevelDecl = ctx.nearbyLines.some((l) => /^\s{0,2}(?:export\s+)?(?:const|let|var)\s+\w+\s*=/.test(l));
                 if (!hasTopLevelDecl)
                     return false;
                 // Reject if a request-handler, middleware, or event-listener pattern appears
                 // anywhere within the ±10-line window (nearbyText).
-                const nearbyText = nearbyLines.join('\n');
-                if (/\b(?:app|router)\s*\.\s*(?:get|post|put|patch|delete|use|all)\s*\(/.test(nearbyText) ||
-                    /\.on\s*\(\s*['"]/.test(nearbyText) ||
-                    /addEventListener\s*\(/.test(nearbyText) ||
-                    /(?:req|request)\s*,\s*(?:res|response)\s*[,)]/.test(nearbyText))
+                if (/\b(?:app|router)\s*\.\s*(?:get|post|put|patch|delete|use|all)\s*\(/.test(ctx.nearbyText) ||
+                    /\.on\s*\(\s*['"]/.test(ctx.nearbyText) ||
+                    /addEventListener\s*\(/.test(ctx.nearbyText) ||
+                    /(?:req|request)\s*,\s*(?:res|response)\s*[,)]/.test(ctx.nearbyText))
                     return false;
             }
             return true;
@@ -382,24 +392,19 @@ const FRAMEWORK_MATCHERS = [
         name: 'Exhaustive Type-Narrowed Switch',
         messagePattern: /missing.*(?:case|default)|no.*default|add.*default|non-?exhaustive/i,
         evidenceValidator(finding, diffContent) {
-            const fileSection = extractFileDiffSection(finding, diffContent);
-            if (!fileSection)
+            const ctx = extractNearbyContext(finding, diffContent, 10);
+            if (!ctx)
                 return false;
-            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 10);
-            const nearbyText = nearbyLines.join('\n');
             // Evidence 1: switch target must be a simple identifier (not a property access).
             // Property-access targets like switch(node.type) or switch(event.kind) cannot
             // have their type proven from a local annotation — fail open (do not suppress).
-            const switchTargetMatch = nearbyText.match(/\bswitch\s*\((\w+)\)/);
-            if (!switchTargetMatch)
+            const switchTargetMatch = ctx.nearbyText.match(/\bswitch\s*\((\w+)\)/);
+            if (!switchTargetMatch?.[1])
                 return false;
             const varName = switchTargetMatch[1];
             // Safety constraint: reject if the switch target variable is typed as string or number.
             // A string/number-typed switch is inherently open-domain — not exhaustive.
-            // SAFETY: varName is from \w+ match — only [a-zA-Z0-9_], no regex special chars.
-            // eslint-disable-next-line security/detect-non-literal-regexp
-            const varPrimitivePattern = new RegExp('\\b' + varName + '\\s*:\\s*(?:string|number)\\b');
-            if (varPrimitivePattern.test(nearbyText))
+            if (boundedVarPattern(varName, '\\s*:\\s*(?:string|number)\\b').test(ctx.nearbyText))
                 return false;
             // Evidence 2: the switch variable must have a named type annotation (PascalCase),
             // and that exact named type must be declared as a string-literal union in the
@@ -408,10 +413,7 @@ const FRAMEWORK_MATCHERS = [
             //
             // Step 2a: extract the type name from the variable's annotation in ±10 lines.
             // e.g., `function f(theme: Theme)` → typeName = 'Theme'
-            // SAFETY: varName is from \w+ match — only [a-zA-Z0-9_], no regex special chars.
-            // eslint-disable-next-line security/detect-non-literal-regexp
-            const varTypePattern = new RegExp('\\b' + varName + '\\s*:\\s*([A-Z][\\w]*)');
-            const typeNameMatch = nearbyText.match(varTypePattern);
+            const typeNameMatch = ctx.nearbyText.match(boundedVarPattern(varName, '\\s*:\\s*([A-Z][\\w]*)'));
             if (!typeNameMatch?.[1])
                 return false; // no visible annotation → cannot prove union
             const typeName = typeNameMatch[1];
@@ -421,7 +423,7 @@ const FRAMEWORK_MATCHERS = [
             // SAFETY: typeName is from [A-Z][\w]* match — only [a-zA-Z0-9_], no regex special chars.
             // eslint-disable-next-line security/detect-non-literal-regexp
             const unionDeclarationPattern = new RegExp('\\btype\\s+' + typeName + '\\s*=\\s*((?:[\'"][^\'"]+[\'"]\\s*\\|?\\s*)+)');
-            const unionMatch = fileSection.match(unionDeclarationPattern);
+            const unionMatch = ctx.fileSection.match(unionDeclarationPattern);
             if (!unionMatch?.[1])
                 return false;
             // Step 2c: verify every union member VALUE has a corresponding case branch.
@@ -434,7 +436,7 @@ const FRAMEWORK_MATCHERS = [
             // Extract raw string values (without quotes) from union members
             const unionMemberValues = unionMemberQuoted.map((m) => m.slice(1, -1));
             // Extract raw string values from case branches (deduplicated via Set)
-            const caseBranchMatches = nearbyText.match(/\bcase\s+['"]([^'"]+)['"]\s*:/g) ?? [];
+            const caseBranchMatches = ctx.nearbyText.match(/\bcase\s+['"]([^'"]+)['"]\s*:/g) ?? [];
             const caseValues = new Set(caseBranchMatches.map((m) => {
                 const val = m.match(/['"]([^'"]+)['"]/);
                 return val?.[1] ?? '';
@@ -453,45 +455,53 @@ const FRAMEWORK_MATCHERS = [
         name: 'Error Object XSS',
         messagePattern: /(?:xss|inject).*(?:error|err)\b.*(?:message|\.message)|(?:error|err)\b.*(?:message|\.message).*(?:xss|inject|innerHTML|template)|(?:xss|inject).*error.*(?:directly|message)|error\s+message.*(?:xss|inject|innerHTML)/i,
         evidenceValidator(finding, diffContent) {
-            const fileSection = extractFileDiffSection(finding, diffContent);
-            if (!fileSection)
+            const ctx = extractNearbyContext(finding, diffContent, 10);
+            if (!ctx)
                 return false;
-            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 10);
-            const nearbyText = nearbyLines.join('\n');
             // MANDATORY: catch clause visible (structural proof of error origin)
             // No naming heuristics, no function-name matching (security-engineer mandate)
-            if (!/\bcatch\s*\(\s*\w+/.test(nearbyText))
+            if (!/\bcatch\s*\(\s*\w+/.test(ctx.nearbyText))
                 return false;
             // MANDATORY: error.message usage visible (the flagged construct)
-            if (!/\.\s*message\b/.test(nearbyText))
+            if (!/\.\s*message\b/.test(ctx.nearbyText))
                 return false;
             // REJECT: error constructed from user input or external API data.
             // Errors built from req.body, query params, or external input can contain
             // attacker-controlled data — suppression would hide real XSS.
-            if (/new\s+(?:\w+)?Error\s*\(\s*(?:req\.|request\.|body\.|params\.|query\.|input\.|data\.|payload\.)/.test(nearbyText))
+            if (/new\s+(?:\w+)?Error\s*\(\s*(?:req\.|request\.|body\.|params\.|query\.|input\.|data\.|payload\.)/.test(ctx.nearbyText))
                 return false;
             // REJECT: direct DOM manipulation (browser-side sinks)
-            if (/\.innerHTML\s*=|\.outerHTML\s*=|document\.write\s*\(|insertAdjacentHTML\s*\(/.test(nearbyText))
+            if (/\.innerHTML\s*=|\.outerHTML\s*=|document\.write\s*\(|insertAdjacentHTML\s*\(/.test(ctx.nearbyText))
                 return false;
             // REJECT: React dangerouslySetInnerHTML (always renders raw HTML)
-            if (/dangerouslySetInnerHTML/.test(nearbyText))
+            if (/dangerouslySetInnerHTML/.test(ctx.nearbyText))
                 return false;
             // REJECT: server-side HTTP response sinks that render error.message as HTML.
             // Only triggers when BOTH a response output call AND .message appear within
             // the same ±10-line window (nearbyText), proving the error data flows into
             // the response. Plain-text responses (res.send(err.message) without HTML
             // markup) are excluded by requiring an HTML indicator (< or template literal).
-            if (/\bres\s*\.\s*(?:send|write|end)\s*\(/.test(nearbyText)) {
+            if (RES_RESPONSE_SINK.test(ctx.nearbyText)) {
                 // Check for HTML evidence: template literal with tags, or string with '<'
-                const hasHtmlInResponse = /\bres\s*\.\s*(?:send|write|end)\s*\(\s*`[^`]*</.test(nearbyText) ||
-                    /\bres\s*\.\s*(?:send|write|end)\s*\([^)]*['"][^'"]*</.test(nearbyText) ||
-                    /\bres\s*\.\s*(?:send|write|end)\s*\([^)]*\+[^)]*['"]?\s*</.test(nearbyText);
+                const hasHtmlInResponse = /\bres\s*\.\s*(?:send|write|end)\s*\(\s*`[^`]*</.test(ctx.nearbyText) ||
+                    /\bres\s*\.\s*(?:send|write|end)\s*\([^)]*['"][^'"]*</.test(ctx.nearbyText) ||
+                    /\bres\s*\.\s*(?:send|write|end)\s*\([^)]*\+[^)]*['"]?\s*</.test(ctx.nearbyText);
                 if (hasHtmlInResponse)
                     return false;
+                // FR-015: Variable-backed HTML detection.
+                // Catches: `const html = `<p>${err}</p>`; res.send(html);`
+                // Extract variable name from res.send(varName) and check if the variable
+                // was assigned HTML-containing content in the nearby text.
+                const varMatch = ctx.nearbyText.match(/\bres\s*\.\s*(?:send|write|end)\s*\(\s*(\w+)\s*\)/);
+                if (varMatch?.[1]) {
+                    const sendVarName = varMatch[1];
+                    if (boundedVarPattern(sendVarName, '\\s*=\\s*(?:`[^`]*<|[\'"][^\'"]*<)').test(ctx.nearbyText))
+                        return false;
+                }
             }
             // REJECT: template engine render calls (always produce HTML output)
-            if (/\bres\s*\.\s*render\s*\(/.test(nearbyText) ||
-                /\b(?:ejs|pug|handlebars|hbs|nunjucks|mustache)\s*[.(]/.test(nearbyText))
+            if (/\bres\s*\.\s*render\s*\(/.test(ctx.nearbyText) ||
+                /\b(?:ejs|pug|handlebars|hbs|nunjucks|mustache)\s*[.(]/.test(ctx.nearbyText))
                 return false;
             return true;
         },
@@ -503,26 +513,24 @@ const FRAMEWORK_MATCHERS = [
         name: 'Thin Wrapper Stdlib',
         messagePattern: /(?:missing|add|no).*try.?catch|(?:could|may|might).*throw|unhandled.*(?:error|exception).*(?:JSON\.parse|parseInt|parseFloat|new\s+URL|Buffer\.from|decodeURI)|directly.*(?:return|call).*(?:JSON\.parse|parseInt|parseFloat)/i,
         evidenceValidator(finding, diffContent) {
-            const fileSection = extractFileDiffSection(finding, diffContent);
-            if (!fileSection)
+            const ctx = extractNearbyContext(finding, diffContent, 5);
+            if (!ctx)
                 return false;
-            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 5);
-            const nearbyText = nearbyLines.join('\n');
             // Evidence 1: WHITELISTED stdlib call present (no open patterns)
             const SAFE_STDLIB = /\b(?:JSON\.parse|JSON\.stringify|parseInt|parseFloat|Number\(|new\s+URL|Buffer\.from|decodeURIComponent|decodeURI|atob|btoa)\s*\(/;
-            if (!SAFE_STDLIB.test(nearbyText))
+            if (!SAFE_STDLIB.test(ctx.nearbyText))
                 return false;
             // Evidence 2: thin wrapper structure (return + stdlib)
-            if (!/\breturn\s+/.test(nearbyText))
+            if (!/\breturn\s+/.test(ctx.nearbyText))
                 return false;
             // REJECT: I/O operations (not pure stdlib delegation)
-            if (/\b(?:fs\.|fetch\s*\(|await\s|\.readFile|\.writeFile|database|\.query\s*\()/.test(nearbyText))
+            if (/\b(?:fs\.|fetch\s*\(|await\s|\.readFile|\.writeFile|database|\.query\s*\()/.test(ctx.nearbyText))
                 return false;
             // REJECT: conditional logic (not a thin wrapper)
-            if (/\b(?:if\s*\(|else\b|switch\s*\()/.test(nearbyText))
+            if (/\b(?:if\s*\(|else\b|switch\s*\()/.test(ctx.nearbyText))
                 return false;
             // REJECT: request handler context (caller responsibility matters here)
-            if (/\b(?:req\.|request\.|res\.|response\.|app\.\w+\(|router\.\w+\()/.test(nearbyText))
+            if (/\b(?:req\.|request\.|res\.|response\.|app\.\w+\(|router\.\w+\()/.test(ctx.nearbyText))
                 return false;
             return true;
         },
@@ -540,12 +548,19 @@ const FRAMEWORK_MATCHERS = [
  * @param diffContent - Raw diff content for evidence validation
  * @returns Summary with suppressed/passed findings and diagnostic details
  */
-export function filterFrameworkConventionFindings(findings, diffContent) {
+export function filterFrameworkConventionFindings(findings, diffContent, disableMatchers = []) {
+    const disabledSet = new Set(disableMatchers);
     const results = [];
     let suppressed = 0;
+    if (disabledSet.size > 0) {
+        console.error(`[router] [framework-filter] Disabled matchers: ${[...disabledSet].join(', ')}`);
+    }
     for (const finding of findings) {
         let matched = false;
         for (const matcher of FRAMEWORK_MATCHERS) {
+            // Skip disabled matchers (FR-022 disable_matchers)
+            if (disabledSet.has(matcher.id))
+                continue;
             // Step 1: Does the message pattern match?
             if (!matcher.messagePattern.test(finding.message))
                 continue;