@securecode-ai/mcp 0.4.0 → 0.4.1

package/dist/project-map/agentMemory.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Agent memory — per-workspace store of false positives and known facts.
+ *
+ * The agent reads this at the start of each scan so it doesn't repeat
+ * mistakes from prior scans. False positives are patterns the user has
+ * explicitly dismissed; known facts are structural facts about the project
+ * (e.g. "uses requireMembership for auth") that speed up investigation.
+ *
+ * Storage: <workspaceRoot>/.securecode/agent-memory.json
+ * Pattern: same as scanCache.ts — lazy mkdir, atomic write (.tmp + rename).
+ *
+ * Privacy: per-workspace only. No cross-tenant leakage. User-owned, deletable.
+ */
+export interface FalsePositiveEntry {
+    id: string;
+    findingType: string;
+    file: string;
+    line: number;
+    /** SHA-256 of the evidence string — for dedup. */
+    evidenceHash: string;
+    /** Short pattern description for the prompt. */
+    pattern: string;
+    /** User's reason for dismissing. */
+    reason: string;
+    /** Code snippet (truncated) for context. */
+    codeSnippet?: string;
+    addedAt: string;
+}
+export interface KnownFactEntry {
+    id: string;
+    fact: string;
+    source: string;
+    addedAt: string;
+}
+export interface AgentMemory {
+    version: number;
+    falsePositives: FalsePositiveEntry[];
+    knownFacts: KnownFactEntry[];
+}
+/**
+ * Load agent memory for a workspace. Returns an empty memory object
+ * (version + empty arrays) if the file doesn't exist or is corrupt.
+ */
+export declare function loadAgentMemory(workspaceRoot: string): AgentMemory;
+export interface RecordFalsePositiveInput {
+    filePath: string;
+    findingType: string;
+    line: number;
+    evidence: string;
+    reason: string;
+    pattern?: string;
+    codeSnippet?: string;
+}
+/**
+ * Record a false positive. Dedupes by (findingType + evidenceHash).
+ * Returns the entry (existing or new). Returns null if input is invalid.
+ */
+export declare function recordFalsePositive(workspaceRoot: string, input: RecordFalsePositiveInput): FalsePositiveEntry | null;
+/**
+ * Remove a false positive by ID. Returns true if removed.
+ */
+export declare function removeFalsePositive(workspaceRoot: string, id: string): boolean;
+/**
+ * Add a known fact. Dedupes by fact text (case-insensitive).
+ */
+export declare function addKnownFact(workspaceRoot: string, fact: string, source: string): KnownFactEntry | null;
+/**
+ * Clear all agent memory (false positives + known facts) for a workspace.
+ */
+export declare function clearAgentMemory(workspaceRoot: string): boolean;
+/**
+ * Format agent memory into a string block for injection into the agent's
+ * target context. Returns empty string if no memory.
+ */
+export declare function formatMemoryForPrompt(memory: AgentMemory): string;

package/dist/project-map/agentMemory.js

@@ -0,0 +1,230 @@
+"use strict";
+/**
+ * Agent memory — per-workspace store of false positives and known facts.
+ *
+ * The agent reads this at the start of each scan so it doesn't repeat
+ * mistakes from prior scans. False positives are patterns the user has
+ * explicitly dismissed; known facts are structural facts about the project
+ * (e.g. "uses requireMembership for auth") that speed up investigation.
+ *
+ * Storage: <workspaceRoot>/.securecode/agent-memory.json
+ * Pattern: same as scanCache.ts — lazy mkdir, atomic write (.tmp + rename).
+ *
+ * Privacy: per-workspace only. No cross-tenant leakage. User-owned, deletable.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadAgentMemory = loadAgentMemory;
+exports.recordFalsePositive = recordFalsePositive;
+exports.removeFalsePositive = removeFalsePositive;
+exports.addKnownFact = addKnownFact;
+exports.clearAgentMemory = clearAgentMemory;
+exports.formatMemoryForPrompt = formatMemoryForPrompt;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const MEMORY_DIR = '.securecode';
+const MEMORY_FILE = 'agent-memory.json';
+const MEMORY_VERSION = 1;
+const MAX_FALSE_POSITIVES = 100; // cap to prevent unbounded growth
+const MAX_KNOWN_FACTS = 50;
+// ── Path helpers ────────────────────────────────────────────────────────────
+function memoryPath(workspaceRoot) {
+    return path.join(workspaceRoot, MEMORY_DIR, MEMORY_FILE);
+}
+function hashEvidence(evidence) {
+    return crypto.createHash('sha256').update(evidence).digest('hex').slice(0, 16);
+}
+function genId() {
+    return 'fp_' + crypto.randomBytes(4).toString('hex');
+}
+// ── Read / Write ────────────────────────────────────────────────────────────
+/**
+ * Load agent memory for a workspace. Returns an empty memory object
+ * (version + empty arrays) if the file doesn't exist or is corrupt.
+ */
+function loadAgentMemory(workspaceRoot) {
+    const p = memoryPath(workspaceRoot);
+    try {
+        if (!fs.existsSync(p)) {
+            return { version: MEMORY_VERSION, falsePositives: [], knownFacts: [] };
+        }
+        const raw = fs.readFileSync(p, 'utf8');
+        const data = JSON.parse(raw);
+        if (!data.version || data.version > MEMORY_VERSION) {
+            // Forward-incompatible — start fresh
+            return { version: MEMORY_VERSION, falsePositives: [], knownFacts: [] };
+        }
+        return {
+            version: MEMORY_VERSION,
+            falsePositives: data.falsePositives || [],
+            knownFacts: data.knownFacts || [],
+        };
+    }
+    catch {
+        return { version: MEMORY_VERSION, falsePositives: [], knownFacts: [] };
+    }
+}
+/** Save agent memory (atomic write). */
+function saveAgentMemory(workspaceRoot, memory) {
+    const dir = path.join(workspaceRoot, MEMORY_DIR);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    const p = memoryPath(workspaceRoot);
+    const tmp = p + '.tmp';
+    fs.writeFileSync(tmp, JSON.stringify(memory, null, 2), 'utf8');
+    fs.renameSync(tmp, p);
+}
+/**
+ * Record a false positive. Dedupes by (findingType + evidenceHash).
+ * Returns the entry (existing or new). Returns null if input is invalid.
+ */
+function recordFalsePositive(workspaceRoot, input) {
+    if (!input.filePath || !input.findingType || !input.evidence || !input.reason) {
+        return null;
+    }
+    const memory = loadAgentMemory(workspaceRoot);
+    const evidenceHash = hashEvidence(input.evidence);
+    // Dedup: if the same finding type + evidence hash exists, update the reason
+    const existingIdx = memory.falsePositives.findIndex(fp => fp.findingType === input.findingType && fp.evidenceHash === evidenceHash);
+    if (existingIdx >= 0) {
+        memory.falsePositives[existingIdx].reason = input.reason;
+        memory.falsePositives[existingIdx].pattern = input.pattern || memory.falsePositives[existingIdx].pattern;
+        saveAgentMemory(workspaceRoot, memory);
+        return memory.falsePositives[existingIdx];
+    }
+    const entry = {
+        id: genId(),
+        findingType: input.findingType,
+        file: input.filePath,
+        line: input.line,
+        evidenceHash,
+        pattern: input.pattern || input.evidence.slice(0, 200),
+        reason: input.reason,
+        codeSnippet: input.codeSnippet ? input.codeSnippet.slice(0, 500) : undefined,
+        addedAt: new Date().toISOString(),
+    };
+    memory.falsePositives.push(entry);
+    // Cap growth — drop oldest
+    if (memory.falsePositives.length > MAX_FALSE_POSITIVES) {
+        memory.falsePositives = memory.falsePositives.slice(-MAX_FALSE_POSITIVES);
+    }
+    saveAgentMemory(workspaceRoot, memory);
+    return entry;
+}
+/**
+ * Remove a false positive by ID. Returns true if removed.
+ */
+function removeFalsePositive(workspaceRoot, id) {
+    const memory = loadAgentMemory(workspaceRoot);
+    const before = memory.falsePositives.length;
+    memory.falsePositives = memory.falsePositives.filter(fp => fp.id !== id);
+    if (memory.falsePositives.length === before)
+        return false;
+    saveAgentMemory(workspaceRoot, memory);
+    return true;
+}
+/**
+ * Add a known fact. Dedupes by fact text (case-insensitive).
+ */
+function addKnownFact(workspaceRoot, fact, source) {
+    if (!fact || !source)
+        return null;
+    const memory = loadAgentMemory(workspaceRoot);
+    const lower = fact.toLowerCase().trim();
+    if (memory.knownFacts.some(kf => kf.fact.toLowerCase().trim() === lower)) {
+        return null; // already exists
+    }
+    const entry = {
+        id: 'fact_' + crypto.randomBytes(4).toString('hex'),
+        fact,
+        source,
+        addedAt: new Date().toISOString(),
+    };
+    memory.knownFacts.push(entry);
+    if (memory.knownFacts.length > MAX_KNOWN_FACTS) {
+        memory.knownFacts = memory.knownFacts.slice(-MAX_KNOWN_FACTS);
+    }
+    saveAgentMemory(workspaceRoot, memory);
+    return entry;
+}
+/**
+ * Clear all agent memory (false positives + known facts) for a workspace.
+ */
+function clearAgentMemory(workspaceRoot) {
+    const p = memoryPath(workspaceRoot);
+    try {
+        if (fs.existsSync(p)) {
+            fs.unlinkSync(p);
+            return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+// ── Prompt formatting ───────────────────────────────────────────────────────
+/**
+ * Format agent memory into a string block for injection into the agent's
+ * target context. Returns empty string if no memory.
+ */
+function formatMemoryForPrompt(memory) {
+    const hasFps = memory.falsePositives.length > 0;
+    const hasFacts = memory.knownFacts.length > 0;
+    if (!hasFps && !hasFacts)
+        return '';
+    const lines = ['Workspace memory (from previous scans in this workspace):'];
+    if (hasFps) {
+        lines.push('', `False positives — DO NOT report similar patterns (${memory.falsePositives.length}):`);
+        memory.falsePositives.forEach((fp, i) => {
+            lines.push(`  ${i + 1}. [${fp.findingType}] "${fp.pattern}"`);
+            lines.push(`     Reason: ${fp.reason}`);
+            if (fp.file)
+                lines.push(`     Was at: ${fp.file}:${fp.line}`);
+        });
+        lines.push('', 'Before reporting a finding, check if it matches any false positive above.');
+        lines.push('If the finding type AND code pattern match a known FP, do NOT report it.');
+    }
+    if (hasFacts) {
+        lines.push('', `Known facts about this project (${memory.knownFacts.length}):`);
+        memory.knownFacts.forEach((f, i) => {
+            lines.push(`  ${i + 1}. ${f.fact} (source: ${f.source})`);
+        });
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=agentMemory.js.map

package/dist/project-map/agentMemory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentMemory.js","sourceRoot":"","sources":["../../src/project-map/agentMemory.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DH,0CAoBC;AA8BD,kDA2CC;AAKD,kDAOC;AAKD,oCAuBC;AAKD,4CAWC;AAQD,sDA0BC;AApPD,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AAEjC,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,mBAAmB,GAAG,GAAG,CAAC,CAAE,kCAAkC;AACpE,MAAM,eAAe,GAAG,EAAE,CAAC;AAiC3B,+EAA+E;AAE/E,SAAS,UAAU,CAAC,aAAqB;IACrC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,KAAK;IACV,OAAO,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,eAAe,CAAC,aAAqB;IACjD,MAAM,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACpC,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;YACjD,qCAAqC;YACrC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO;YACH,OAAO,EAAE,cAAc;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;YACzC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;SACpC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3E,CAAC;AACL,CAAC;AAED,wCAAwC;AACxC,SAAS,eAAe,CAAC,aAAqB,EAAE,MAAmB;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC;IACvB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAcD;;;GAGG;AACH,SAAgB,mBAAmB,CAC/B,aAAqB,EACrB,KAA+B;IAE/B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAElD,4EAA4E;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,CAC/C,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,YAAY,KAAK,YAAY,CACjF,CAAC;IACF,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACzD,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;QACzG,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAuB;QAC9B,EAAE,EAAE,KAAK,EAAE;QACX,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACtD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5E,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElC,2BAA2B;IAC3B,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrD,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAC9E,CAAC;IAED,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,aAAqB,EAAE,EAAU;IACjE,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;IAC5C,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CACxB,aAAqB,EACrB,IAAY,EACZ,MAAc;IAEd,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,CAAE,iBAAiB;IACnC,CAAC;IACD,MAAM,KAAK,GAAmB;QAC1B,EAAE,EAAE,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnD,IAAI;QACJ,MAAM;QACN,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAC7C,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IACD,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,aAAqB;IAClD,MAAM,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACpC,IAAI,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,MAAmB;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAa,CAAC,2DAA2D,CAAC,CAAC;IAEtF,IAAI,MAAM,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qDAAqD,MAAM,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC;QACtG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,MAAM,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,2EAA2E,CAAC,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,mCAAmC,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;QAChF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC/B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/project-map/crossFileTaintTracker.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Cross-file taint tracker — follows taint across file boundaries.
+ *
+ * The single-file `trackTaint` engine finds source→sink flows within one
+ * file. This module extends that to multi-file flows by:
+ *
+ *   1. Parsing the entry file's imports (collectImports)
+ *   2. Resolving each import to a file on disk (resolveModulePath)
+ *   3. Indexing each imported function: does it return tainted data?
+ *      Does it propagate taint through a specific parameter?
+ *   4. Running taint tracking on the entry file with the cross-file
+ *      function index, so calls to imported functions that propagate
+ *      taint are recognised.
+ *
+ * Limits prevent runaway analysis on large codebases:
+ *   maxDepth (3)  — how many import hops to follow
+ *   maxFiles (10) — total files parsed per trace
+ *   maxFunctionBodySize (5000 chars) — skip oversized functions
+ */
+export interface CrossFileStep {
+    file: string;
+    line: number;
+    variable: string;
+    operation: 'source' | 'call-cross-file' | 'return-tainted' | 'sink-arg';
+    description: string;
+}
+export interface CrossFileTaintResult {
+    source: string;
+    sourceLine: number;
+    sourceFile: string;
+    sink: string;
+    sinkLine: number;
+    sinkFile: string;
+    canonicalType: string;
+    crossFileSteps: CrossFileStep[];
+}
+export interface CrossFileTaintOptions {
+    workspaceRoot: string;
+    filePath: string;
+    maxDepth?: number;
+    maxFiles?: number;
+}
+/**
+ * Track taint propagation across file boundaries.
+ *
+ * Parses the entry file, resolves its imports, indexes imported functions
+ * for taint behavior, then runs taint tracking with cross-file knowledge.
+ *
+ * Returns CrossFileTaintResult[] with full file:line paths.
+ */
+export declare function trackTaintCrossFile(opts: CrossFileTaintOptions): Promise<CrossFileTaintResult[]>;