circle-ir-ai 1.1.0

package/dist/analysis/llm-correlated-predicates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-correlated-predicates.js","sourceRoot":"","sources":["../../src/analysis/llm-correlated-predicates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,cAAc,EAAoB,MAAM,qBAAqB,CAAC;AAkDvE;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAQ,EAAE,IAAY;IACtD,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjC,iCAAiC;YACjC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;YACnC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;YAE5C,yBAAyB;YACzB,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACjE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,mCAAmC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAC3D,IAAI,KAAK,EAAE,CAAC;oBACV,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC5B,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,6BAA6B;gBAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAE1E,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,SAAS;oBACf,SAAS;oBACT,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA+B;IACpE,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAEzB,2BAA2B;YAC3B,IAAI,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC;oBACV,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;oBACpB,WAAW,EAAE,eAAe;oBAC5B,UAAU,EAAE,GAAG;oBACf,SAAS,EAAE,mCAAmC,EAAE,CAAC,SAAS,GAAG;oBAC7D,iBAAiB,EAAE,IAAI;oBACvB,kBAAkB,EAAE,IAAI;oBACxB,cAAc,EAAE,KAAK;iBACtB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,qBAAqB;YACrB,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE;gBACnC,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS;gBACnC,EAAE,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC,SAAS,GAAG;gBACrC,KAAK,EAAE,CAAC,SAAS,GAAG,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC;oBACV,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;oBACpB,WAAW,EAAE,UAAU;oBACvB,UAAU,EAAE,GAAG;oBACf,SAAS,EAAE,8BAA8B,EAAE,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,GAAG;oBAC7E,iBAAiB,EAAE,KAAK;oBACxB,kBAAkB,EAAE,KAAK;oBACzB,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,qDAAqD;YACrD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAExD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC;oBACV,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;oBACpB,WAAW,EAAE,eAAe;oBAC5B,UAAU,EAAE,GAAG;oBACf,SAAS,EAAE,oCAAoC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACtE,iBAAiB,EAAE,IAAI,EAAG,wCAAwC;oBAClE,kBAAkB,EAAE,IAAI;oBACxB,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,yBAAyB;IACzB,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjF,iBAAiB;IACjB,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9D,sBAAsB;IACtB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC;IAC1E,sBAAsB;IACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjH,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAY,EACZ,UAA+B,EAC/B,SAAuB;IAEvB,kCAAkC;IAClC,MAAM,YAAY,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAExD,wDAAwD;IACxD,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC;QAC5C,YAAY,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE1E,IAAI,SAAS,GAAsB,EAAE,CAAC;IAEtC,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,IAAI,cAAc,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC;gBACtD,IAAI;gBACJ,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACvC,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,SAAS,EAAE,CAAC,CAAC,SAAS;iBACvB,CAAC,CAAC;aACJ,CAAC,CAAC;YAEH,oCAAoC;YACpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC5C,MAAM,WAAW,GAAI,KAAK,CAAC,UAAuB,IAAI,EAAE,CAAC;gBACzD,MAAM,eAAe,GAAG,WAAW;qBAChC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;qBAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;gBAEhC,IAAI,eAAe,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBAChC,MAAM,WAAW,GAAI,KAAK,CAAC,WAA+B,IAAI,aAAa,CAAC;oBAC5E,SAAS,CAAC,IAAI,CAAC;wBACb,UAAU,EAAE,eAAe;wBAC3B,WAAW;wBACX,UAAU,EAAE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG;wBACzE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;wBACjC,iBAAiB,EAAE,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,kBAAkB;wBACnF,kBAAkB,EAAE,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,kBAAkB;wBACpF,cAAc,EAAE,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,aAAa;qBAC5E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oCAAoC;YACpC,OAAO,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,SAAS,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,sDAAsD;QACtD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAChC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,MAAM;YAClD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAC5E,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAClC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,MAAM;gBAClD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAC5E,CAAC;YACF,IAAI,QAAQ,IAAI,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC1D,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,gBAAgB,GAAoE,EAAE,CAAC;IAE7F,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAC/D,4FAA4F;YAC5F,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YAElC,uBAAuB;YACvB,gBAAgB,CAAC,IAAI,CAAC;gBACpB,UAAU,EAAE,EAAE,CAAC,IAAI;gBACnB,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,MAAM,EAAE,uBAAuB,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC,SAAS,OAAO,EAAE,CAAC,SAAS,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,KAAK,kBAAkB,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YACvE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YAClC,gBAAgB,CAAC,IAAI,CAAC;gBACpB,UAAU,EAAE,EAAE,CAAC,IAAI;gBACnB,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,MAAM,EAAE,uBAAuB,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,IAAI,yBAAyB;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU;QACV,MAAM,EAAE,SAAS;QACjB,gBAAgB;QAChB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAAkB,EAClB,QAAgB,EAChB,cAAyC;IAEzC,iCAAiC;IACjC,MAAM,IAAI,GAAG,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACpD,CAAC,CAAC,CAAC,UAAU,IAAI,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC;QACtD,CAAC,CAAC,CAAC,UAAU,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,UAAU,CAAC,CACvD,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACpD,CAAC;IAED,8DAA8D;IAC9D,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,WAAW,KAAK,eAAe,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7E,SAAS;QACX,CAAC;QAED,6CAA6C;QAC7C,8EAA8E;QAC9E,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;QAElC,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,EAAE,CAAC,IAAI,GAAG,UAAU,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YAC/C,uCAAuC;YACvC,sDAAsD;YACtD,IAAI,KAAK,CAAC,WAAW,KAAK,eAAe,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;gBACpE,uCAAuC;gBACvC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC"}

package/dist/analysis/llm-cross-file-taint.d.ts

@@ -0,0 +1,86 @@
+/**
+ * LLM-based Cross-File Taint Analysis
+ *
+ * Uses LLM to track taint flow across file boundaries through:
+ * - Import/export relationships
+ * - Method return values
+ * - Shared state
+ * - Callback chains
+ *
+ * This is more accurate than simple symbol matching because the LLM
+ * can understand:
+ * - Transitive flows (A -> B -> C)
+ * - Conditional flows (taint only if certain condition)
+ * - Data transformation patterns
+ */
+import type { CircleIR } from 'circle-ir';
+import { type AxLLMClient } from '../llm/ax-client.js';
+/**
+ * Taint export from a source file
+ */
+export interface TaintExport {
+    symbol: string;
+    type: string;
+    line: number;
+    sourceType: string;
+    cwe?: string;
+}
+/**
+ * Cross-file taint flow
+ */
+export interface CrossFileTaintFlow {
+    sourceFile: string;
+    sourceSymbol: string;
+    sourceLine: number;
+    targetFile: string;
+    targetSymbol: string;
+    targetLine?: number;
+    flowType: 'direct' | 'transitive' | 'conditional';
+    confidence: number;
+    reasoning?: string;
+}
+/**
+ * Result of cross-file taint analysis
+ */
+export interface CrossFileTaintResult {
+    flows: CrossFileTaintFlow[];
+    exportedTaint: Map<string, TaintExport[]>;
+    importedTaint: Map<string, string[]>;
+    unresolvedImports: Map<string, string[]>;
+    reasoning: string;
+}
+/**
+ * Extract taint exports from an IR
+ */
+export declare function extractTaintExports(ir: CircleIR): TaintExport[];
+/**
+ * Extract imported symbols that might carry taint
+ */
+export declare function extractTaintImports(ir: CircleIR): string[];
+/**
+ * Analyze cross-file taint using simple pattern matching
+ */
+export declare function analyzeSimpleCrossFileTaint(sourceIR: CircleIR, targetIR: CircleIR): CrossFileTaintFlow[];
+/**
+ * Analyze cross-file taint using LLM for deeper understanding
+ */
+export declare function analyzeCrossFileTaint(sourceFile: string, sourceCode: string, sourceIR: CircleIR, targetFile: string, targetCode: string, targetIR: CircleIR, options?: {
+    llmClient?: AxLLMClient;
+}): Promise<CrossFileTaintResult>;
+/**
+ * Analyze taint across multiple files in a project
+ */
+export declare function analyzeProjectTaint(files: Map<string, {
+    code: string;
+    ir: CircleIR;
+}>, options?: {
+    llmClient?: AxLLMClient;
+}): Promise<CrossFileTaintResult>;
+/**
+ * Check if a sink is reachable from a cross-file source
+ */
+export declare function isSinkReachableFromCrossFileSource(sinkFile: string, sinkLine: number, sinkVariable: string, result: CrossFileTaintResult): {
+    reachable: boolean;
+    flows: CrossFileTaintFlow[];
+};
+//# sourceMappingURL=llm-cross-file-taint.d.ts.map

package/dist/analysis/llm-cross-file-taint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-cross-file-taint.d.ts","sourceRoot":"","sources":["../../src/analysis/llm-cross-file-taint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,GAAG,WAAW,EAAE,CAoD/D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,EAAE,CAc1D;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,GACjB,kBAAkB,EAAE,CAoCtB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,WAAW,CAAA;CAAE,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAwF/B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,CAAC,EAClD,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,WAAW,CAAA;CAAE,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAgE/B;AAED;;GAEG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,oBAAoB,GAC3B;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAWrD"}

package/dist/analysis/llm-cross-file-taint.js

@@ -0,0 +1,264 @@
+/**
+ * LLM-based Cross-File Taint Analysis
+ *
+ * Uses LLM to track taint flow across file boundaries through:
+ * - Import/export relationships
+ * - Method return values
+ * - Shared state
+ * - Callback chains
+ *
+ * This is more accurate than simple symbol matching because the LLM
+ * can understand:
+ * - Transitive flows (A -> B -> C)
+ * - Conditional flows (taint only if certain condition)
+ * - Data transformation patterns
+ */
+import { getAxLLMClient } from '../llm/ax-client.js';
+/**
+ * Extract taint exports from an IR
+ */
+export function extractTaintExports(ir) {
+    const exports = [];
+    // Get exported symbols
+    const exportedSymbols = new Set();
+    if (ir.exports) {
+        for (const exp of ir.exports) {
+            exportedSymbols.add(exp.symbol);
+        }
+    }
+    // Also include public methods in Java (implicitly exported)
+    if (ir.types) {
+        for (const type of ir.types) {
+            if (type.methods) {
+                for (const method of type.methods) {
+                    if (method.modifiers?.includes('public')) {
+                        exportedSymbols.add(method.name);
+                        exportedSymbols.add(`${type.name}.${method.name}`);
+                    }
+                }
+            }
+        }
+    }
+    // Check if any taint sources are associated with exported symbols
+    if (ir.taint?.sources) {
+        for (const source of ir.taint.sources) {
+            // Check if this source is in an exported method
+            const methodName = source.method;
+            if (methodName && exportedSymbols.has(methodName)) {
+                exports.push({
+                    symbol: methodName,
+                    type: 'method',
+                    line: source.line,
+                    sourceType: source.type,
+                });
+            }
+            // Check if the source variable is exported
+            if (source.variable && exportedSymbols.has(source.variable)) {
+                exports.push({
+                    symbol: source.variable,
+                    type: 'variable',
+                    line: source.line,
+                    sourceType: source.type,
+                });
+            }
+        }
+    }
+    return exports;
+}
+/**
+ * Extract imported symbols that might carry taint
+ */
+export function extractTaintImports(ir) {
+    const imports = [];
+    if (ir.imports) {
+        for (const imp of ir.imports) {
+            // Track all imported symbols
+            imports.push(imp.imported_name);
+            if (imp.alias) {
+                imports.push(imp.alias);
+            }
+        }
+    }
+    return imports;
+}
+/**
+ * Analyze cross-file taint using simple pattern matching
+ */
+export function analyzeSimpleCrossFileTaint(sourceIR, targetIR) {
+    const flows = [];
+    // Get exports from source
+    const sourceExports = extractTaintExports(sourceIR);
+    if (sourceExports.length === 0) {
+        return flows;
+    }
+    // Get imports from target
+    const targetImports = extractTaintImports(targetIR);
+    if (targetImports.length === 0) {
+        return flows;
+    }
+    // Match exports to imports
+    for (const exp of sourceExports) {
+        for (const imp of targetImports) {
+            // Check for exact match or suffix match (for qualified names)
+            if (imp === exp.symbol ||
+                imp.endsWith(`.${exp.symbol}`) ||
+                exp.symbol.endsWith(`.${imp}`)) {
+                flows.push({
+                    sourceFile: sourceIR.meta.file,
+                    sourceSymbol: exp.symbol,
+                    sourceLine: exp.line,
+                    targetFile: targetIR.meta.file,
+                    targetSymbol: imp,
+                    flowType: 'direct',
+                    confidence: 0.8,
+                });
+            }
+        }
+    }
+    return flows;
+}
+/**
+ * Analyze cross-file taint using LLM for deeper understanding
+ */
+export async function analyzeCrossFileTaint(sourceFile, sourceCode, sourceIR, targetFile, targetCode, targetIR, options) {
+    // First, do simple analysis
+    const simpleFlows = analyzeSimpleCrossFileTaint(sourceIR, targetIR);
+    // Extract taint exports and imports
+    const exportedTaint = extractTaintExports(sourceIR);
+    const importedSymbols = extractTaintImports(targetIR);
+    // If no potential connections, skip LLM
+    if (exportedTaint.length === 0 || importedSymbols.length === 0) {
+        return {
+            flows: simpleFlows,
+            exportedTaint: new Map([[sourceFile, exportedTaint]]),
+            importedTaint: new Map([[targetFile, importedSymbols]]),
+            unresolvedImports: new Map(),
+            reasoning: 'No cross-file taint potential detected',
+        };
+    }
+    // Use LLM for deeper analysis
+    try {
+        const client = options?.llmClient || getAxLLMClient();
+        const result = await client.analyzeCrossFileTaint({
+            sourceFile,
+            sourceCode,
+            targetFile,
+            targetCode,
+            exportedTaint: exportedTaint.map(e => ({
+                symbol: e.symbol,
+                type: e.type,
+                line: e.line,
+            })),
+            importedSymbols,
+        });
+        // Merge simple and LLM flows
+        const allFlows = [...simpleFlows];
+        for (const flow of result.taintFlows) {
+            // Check if this flow already exists
+            const exists = allFlows.some(f => f.sourceSymbol === flow.sourceSymbol &&
+                f.targetSymbol === flow.targetSymbol);
+            if (!exists) {
+                allFlows.push({
+                    sourceFile,
+                    sourceSymbol: flow.sourceSymbol,
+                    sourceLine: exportedTaint.find(e => e.symbol === flow.sourceSymbol)?.line || 0,
+                    targetFile,
+                    targetSymbol: flow.targetSymbol,
+                    flowType: flow.flowType,
+                    confidence: flow.confidence,
+                    reasoning: result.reasoning,
+                });
+            }
+            else {
+                // Update existing flow with LLM confidence if higher
+                const existing = allFlows.find(f => f.sourceSymbol === flow.sourceSymbol &&
+                    f.targetSymbol === flow.targetSymbol);
+                if (existing && flow.confidence > existing.confidence) {
+                    existing.confidence = flow.confidence;
+                    existing.flowType = flow.flowType;
+                    existing.reasoning = result.reasoning;
+                }
+            }
+        }
+        return {
+            flows: allFlows,
+            exportedTaint: new Map([[sourceFile, exportedTaint]]),
+            importedTaint: new Map([[targetFile, importedSymbols]]),
+            unresolvedImports: new Map(),
+            reasoning: result.reasoning,
+        };
+    }
+    catch (error) {
+        // Fallback to simple analysis
+        console.warn('LLM cross-file taint analysis failed, using simple analysis');
+        return {
+            flows: simpleFlows,
+            exportedTaint: new Map([[sourceFile, exportedTaint]]),
+            importedTaint: new Map([[targetFile, importedSymbols]]),
+            unresolvedImports: new Map(),
+            reasoning: 'Fallback to simple pattern matching due to LLM error',
+        };
+    }
+}
+/**
+ * Analyze taint across multiple files in a project
+ */
+export async function analyzeProjectTaint(files, options) {
+    const allFlows = [];
+    const exportedTaint = new Map();
+    const importedTaint = new Map();
+    const unresolvedImports = new Map();
+    // Extract exports from all files
+    for (const [file, { ir }] of files) {
+        const exports = extractTaintExports(ir);
+        if (exports.length > 0) {
+            exportedTaint.set(file, exports);
+        }
+        const imports = extractTaintImports(ir);
+        if (imports.length > 0) {
+            importedTaint.set(file, imports);
+        }
+    }
+    // Analyze pairs that have potential connections
+    const filePairs = [];
+    for (const [targetFile, imports] of importedTaint) {
+        for (const [sourceFile, exports] of exportedTaint) {
+            if (sourceFile === targetFile)
+                continue;
+            // Check if any export matches any import
+            const hasConnection = exports.some(exp => imports.some(imp => imp === exp.symbol ||
+                imp.endsWith(`.${exp.symbol}`) ||
+                exp.symbol.endsWith(`.${imp}`)));
+            if (hasConnection) {
+                filePairs.push([sourceFile, targetFile]);
+            }
+        }
+    }
+    // Analyze each pair
+    for (const [sourceFile, targetFile] of filePairs) {
+        const sourceData = files.get(sourceFile);
+        const targetData = files.get(targetFile);
+        const result = await analyzeCrossFileTaint(sourceFile, sourceData.code, sourceData.ir, targetFile, targetData.code, targetData.ir, options);
+        allFlows.push(...result.flows);
+    }
+    return {
+        flows: allFlows,
+        exportedTaint,
+        importedTaint,
+        unresolvedImports,
+        reasoning: `Analyzed ${filePairs.length} file pairs for cross-file taint`,
+    };
+}
+/**
+ * Check if a sink is reachable from a cross-file source
+ */
+export function isSinkReachableFromCrossFileSource(sinkFile, sinkLine, sinkVariable, result) {
+    const relevantFlows = result.flows.filter(flow => flow.targetFile === sinkFile &&
+        (flow.targetSymbol === sinkVariable ||
+            sinkVariable.includes(flow.targetSymbol)));
+    return {
+        reachable: relevantFlows.length > 0,
+        flows: relevantFlows,
+    };
+}
+//# sourceMappingURL=llm-cross-file-taint.js.map

package/dist/analysis/llm-cross-file-taint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-cross-file-taint.js","sourceRoot":"","sources":["../../src/analysis/llm-cross-file-taint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,cAAc,EAAoB,MAAM,qBAAqB,CAAC;AAuCvE;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAY;IAC9C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,uBAAuB;IACvB,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7B,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClC,IAAI,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACzC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;wBACjC,eAAe,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QACtB,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,gDAAgD;YAChD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YACjC,IAAI,UAAU,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM,EAAE,UAAU;oBAClB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,UAAU,EAAE,MAAM,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,2CAA2C;YAC3C,IAAI,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM,EAAE,MAAM,CAAC,QAAQ;oBACvB,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,UAAU,EAAE,MAAM,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAY;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7B,6BAA6B;YAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAkB,EAClB,QAAkB;IAElB,MAAM,KAAK,GAAyB,EAAE,CAAC;IAEvC,0BAA0B;IAC1B,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0BAA0B;IAC1B,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,8DAA8D;YAC9D,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC;oBACT,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;oBAC9B,YAAY,EAAE,GAAG,CAAC,MAAM;oBACxB,UAAU,EAAE,GAAG,CAAC,IAAI;oBACpB,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;oBAC9B,YAAY,EAAE,GAAG;oBACjB,QAAQ,EAAE,QAAQ;oBAClB,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,UAAkB,EAClB,QAAkB,EAClB,UAAkB,EAClB,UAAkB,EAClB,QAAkB,EAClB,OAAqC;IAErC,4BAA4B;IAC5B,MAAM,WAAW,GAAG,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEpE,oCAAoC;IACpC,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAEtD,wCAAwC;IACxC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;YACrD,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;YACvD,iBAAiB,EAAE,IAAI,GAAG,EAAE;YAC5B,SAAS,EAAE,wCAAwC;SACpD,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,IAAI,cAAc,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC;YAChD,UAAU;YACV,UAAU;YACV,UAAU;YACV,UAAU;YACV,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrC,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC;YACH,eAAe;SAChB,CAAC,CAAC;QAEH,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,oCAAoC;YACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/B,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;gBACpC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CACrC,CAAC;YAEF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,UAAU;oBACV,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,IAAI,CAAC;oBAC9E,UAAU;oBACV,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,qDAAqD;gBACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACjC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;oBACpC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CACrC,CAAC;gBACF,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;oBACtD,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;oBACtC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;oBAClC,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;YACrD,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;YACvD,iBAAiB,EAAE,IAAI,GAAG,EAAE;YAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,8BAA8B;QAC9B,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC5E,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;YACrD,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;YACvD,iBAAiB,EAAE,IAAI,GAAG,EAAE;YAC5B,SAAS,EAAE,sDAAsD;SAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAkD,EAClD,OAAqC;IAErC,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyB,CAAC;IACvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEtD,iCAAiC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;YAClD,IAAI,UAAU,KAAK,UAAU;gBAAE,SAAS;YAExC,yCAAyC;YACzC,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACvC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACjB,GAAG,KAAK,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAC/B,CACF,CAAC;YAEF,IAAI,aAAa,EAAE,CAAC;gBAClB,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,SAAS,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,UAAU,EACV,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,EAAE,EACb,UAAU,EACV,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,EAAE,EACb,OAAO,CACR,CAAC;QAEF,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,aAAa;QACb,aAAa;QACb,iBAAiB;QACjB,SAAS,EAAE,YAAY,SAAS,CAAC,MAAM,kCAAkC;KAC1E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAgB,EAChB,QAAgB,EAChB,YAAoB,EACpB,MAA4B;IAE5B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC/C,IAAI,CAAC,UAAU,KAAK,QAAQ;QAC5B,CAAC,IAAI,CAAC,YAAY,KAAK,YAAY;YAClC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAC3C,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;QACnC,KAAK,EAAE,aAAa;KACrB,CAAC;AACJ,CAAC"}

package/dist/analysis/pattern-discovery.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Heuristic-based pattern discovery for sources and sinks
+ *
+ * Automatically discovers potential taint sources and sinks based on:
+ * - Method names and signatures
+ * - Parameter and return types
+ * - Class names and contexts
+ * - Common vulnerability patterns
+ */
+import type { TypeInfo, CallInfo } from 'circle-ir';
+import type { SourcePattern, SinkPattern } from 'circle-ir';
+/**
+ * Discovered pattern with confidence score
+ */
+export interface DiscoveredPattern {
+    pattern: SourcePattern | SinkPattern;
+    confidence: number;
+    reason: string;
+    needsVerification: boolean;
+}
+/**
+ * Pattern discovery result
+ */
+export interface DiscoveryResult {
+    sources: DiscoveredPattern[];
+    sinks: DiscoveredPattern[];
+}
+/**
+ * Discover potential source/sink patterns from type information
+ */
+export declare function discoverPatterns(types: TypeInfo[]): DiscoveryResult;
+/**
+ * Discover potential sources from method calls (without full type info)
+ */
+export declare function discoverPatternsFromCalls(calls: CallInfo[]): DiscoveryResult;
+/**
+ * Cache for discovered patterns during runtime
+ */
+export declare class PatternCache {
+    private sources;
+    private sinks;
+    private verified;
+    /**
+     * Add discovered patterns to the cache
+     */
+    addPatterns(result: DiscoveryResult): void;
+    /**
+     * Mark a pattern as LLM-verified
+     */
+    markVerified(pattern: SourcePattern | SinkPattern, isValid: boolean): void;
+    /**
+     * Get all cached source patterns above a confidence threshold
+     */
+    getSources(minConfidence?: number): SourcePattern[];
+    /**
+     * Get all cached sink patterns above a confidence threshold
+     */
+    getSinks(minConfidence?: number): SinkPattern[];
+    /**
+     * Get patterns that need LLM verification
+     */
+    getPatternsNeedingVerification(): DiscoveredPattern[];
+    /**
+     * Get statistics about the cache
+     */
+    getStats(): {
+        sources: number;
+        sinks: number;
+        verified: number;
+        needsVerification: number;
+    };
+    /**
+     * Clear the cache
+     */
+    clear(): void;
+    private getKey;
+}
+export declare const globalPatternCache: PatternCache;
+//# sourceMappingURL=pattern-discovery.d.ts.map

package/dist/analysis/pattern-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-discovery.d.ts","sourceRoot":"","sources":["../../src/analysis/pattern-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAc,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,aAAa,GAAG,WAAW,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAmHD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,eAAe,CAuBnE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,eAAe,CA+C5E;AA6ND;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAA6C;IAC5D,OAAO,CAAC,KAAK,CAA6C;IAC1D,OAAO,CAAC,QAAQ,CAA0B;IAE1C;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI;IAkB1C;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IAW1E;;OAEG;IACH,UAAU,CAAC,aAAa,GAAE,MAAY,GAAG,aAAa,EAAE;IAMxD;;OAEG;IACH,QAAQ,CAAC,aAAa,GAAE,MAAY,GAAG,WAAW,EAAE;IAMpD;;OAEG;IACH,8BAA8B,IAAI,iBAAiB,EAAE;IAkBrD;;OAEG;IACH,QAAQ,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IAS3F;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb,OAAO,CAAC,MAAM;CAGf;AAGD,eAAO,MAAM,kBAAkB,cAAqB,CAAC"}