circle-ir-ai 1.1.0

package/dist/project/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Project-Level Analysis Module
+ *
+ * Exports for multi-file project analysis including:
+ * - Project analyzer
+ * - Type hierarchy builder
+ * - Cross-file call graph
+ * - Multi-file taint paths
+ */
+export { analyzeProject } from './analyzer.js';
+export type { ProjectOptions, FileInput } from './analyzer.js';
+export { analyzeProjectTwoPhase } from './two-phase-analyzer.js';
+export type { TwoPhaseOptions, EnrichedFileAnalysis, ProjectContext, CrossFileTaintFlow, TwoPhaseProjectAnalysis, } from './two-phase-analyzer.js';
+export { buildTypeHierarchy, findAllImplementations, findAllSubclasses, findTypeFile, isSubtypeOf, } from './type-hierarchy.js';
+export { buildCrossFileCalls, findCallers, findCallees, } from './call-graph.js';
+export { findTaintPaths, findPathsFromSource, findPathsToSink, } from './taint-paths.js';
+export type { ProjectAnalysis, ProjectMeta, FileAnalysis, TypeHierarchy, ClassHierarchyInfo, InterfaceHierarchyInfo, CrossFileCall, ArgMapping, TaintPath, TaintHop, } from 'circle-ir';
+//# sourceMappingURL=index.d.ts.map

package/dist/project/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,eAAe,EACf,WAAW,EACX,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,EACT,QAAQ,GACT,MAAM,WAAW,CAAC"}

package/dist/project/index.js

@@ -0,0 +1,20 @@
+/**
+ * Project-Level Analysis Module
+ *
+ * Exports for multi-file project analysis including:
+ * - Project analyzer
+ * - Type hierarchy builder
+ * - Cross-file call graph
+ * - Multi-file taint paths
+ */
+// Main project analyzer
+export { analyzeProject } from './analyzer.js';
+// Two-phase project analyzer (with LLM enrichment)
+export { analyzeProjectTwoPhase } from './two-phase-analyzer.js';
+// Type hierarchy
+export { buildTypeHierarchy, findAllImplementations, findAllSubclasses, findTypeFile, isSubtypeOf, } from './type-hierarchy.js';
+// Cross-file call graph
+export { buildCrossFileCalls, findCallers, findCallees, } from './call-graph.js';
+// Taint paths
+export { findTaintPaths, findPathsFromSource, findPathsToSink, } from './taint-paths.js';
+//# sourceMappingURL=index.js.map

package/dist/project/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/project/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wBAAwB;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,mDAAmD;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AASjE,iBAAiB;AACjB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,wBAAwB;AACxB,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAEzB,cAAc;AACd,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/project/taint-paths.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Multi-File Taint Path Finder
+ *
+ * Traces taint flow across files by:
+ * - Following cross-file calls with taint-propagating arguments
+ * - Tracking data flow through method parameters and return values
+ * - Identifying sanitizers in the path
+ */
+import type { FileAnalysis, CrossFileCall, TaintPath } from 'circle-ir';
+/**
+ * Find all taint paths across files.
+ */
+export declare function findTaintPaths(files: FileAnalysis[], crossFileCalls: CrossFileCall[]): TaintPath[];
+/**
+ * Find all paths from a specific source.
+ */
+export declare function findPathsFromSource(sourceFile: string, sourceLine: number, files: FileAnalysis[], crossFileCalls: CrossFileCall[]): TaintPath[];
+/**
+ * Find all paths to a specific sink.
+ */
+export declare function findPathsToSink(sinkFile: string, sinkLine: number, files: FileAnalysis[], crossFileCalls: CrossFileCall[]): TaintPath[];
+//# sourceMappingURL=taint-paths.d.ts.map

package/dist/project/taint-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-paths.d.ts","sourceRoot":"","sources":["../../src/project/taint-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,SAAS,EAMV,MAAM,WAAW,CAAC;AAcnB;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,YAAY,EAAE,EACrB,cAAc,EAAE,aAAa,EAAE,GAC9B,SAAS,EAAE,CAgDb;AA+QD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,YAAY,EAAE,EACrB,cAAc,EAAE,aAAa,EAAE,GAC9B,SAAS,EAAE,CAKb;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EAAE,EACrB,cAAc,EAAE,aAAa,EAAE,GAC9B,SAAS,EAAE,CAKb"}

package/dist/project/taint-paths.js

@@ -0,0 +1,265 @@
+/**
+ * Multi-File Taint Path Finder
+ *
+ * Traces taint flow across files by:
+ * - Following cross-file calls with taint-propagating arguments
+ * - Tracking data flow through method parameters and return values
+ * - Identifying sanitizers in the path
+ */
+/**
+ * Find all taint paths across files.
+ */
+export function findTaintPaths(files, crossFileCalls) {
+    const paths = [];
+    let pathId = 0;
+    // Collect all sources and sinks with their file locations
+    const sources = collectSources(files);
+    const sinks = collectSinks(files);
+    // Build a call graph for path finding
+    const callGraph = buildCallGraph(crossFileCalls);
+    // For each source, try to find paths to sinks
+    for (const source of sources) {
+        for (const sink of sinks) {
+            // Skip if source and sink are in the same file (handled by single-file analysis)
+            if (source.file === sink.file) {
+                continue;
+            }
+            // Try to find a path from source to sink
+            const path = findPath(source, sink, callGraph, files);
+            if (path) {
+                paths.push({
+                    id: `path-${++pathId}`,
+                    source: {
+                        file: source.file,
+                        line: source.source.line,
+                        type: source.source.type,
+                        code: source.code,
+                    },
+                    sink: {
+                        file: sink.file,
+                        line: sink.sink.line,
+                        type: sink.sink.type,
+                        cwe: sink.sink.cwe,
+                        code: sink.code,
+                    },
+                    hops: path.hops,
+                    sanitizers_in_path: path.sanitizers,
+                    path_exists: true,
+                    confidence: calculatePathConfidence(path.hops, source.source, sink.sink),
+                });
+            }
+        }
+    }
+    return paths;
+}
+/**
+ * Collect all taint sources with their file locations.
+ */
+function collectSources(files) {
+    const sources = [];
+    for (const fileAnalysis of files) {
+        const file = fileAnalysis.file;
+        const analysis = fileAnalysis.analysis;
+        for (const source of analysis.taint.sources) {
+            sources.push({
+                file,
+                source,
+                code: source.location,
+            });
+        }
+    }
+    return sources;
+}
+/**
+ * Collect all taint sinks with their file locations.
+ */
+function collectSinks(files) {
+    const sinks = [];
+    for (const fileAnalysis of files) {
+        const file = fileAnalysis.file;
+        const analysis = fileAnalysis.analysis;
+        for (const sink of analysis.taint.sinks) {
+            sinks.push({
+                file,
+                sink,
+                code: sink.location,
+            });
+        }
+    }
+    return sinks;
+}
+/**
+ * Build a call graph for path finding.
+ */
+function buildCallGraph(crossFileCalls) {
+    const graph = new Map();
+    // Helper to get or create a node
+    function getNode(file, method) {
+        const key = `${file}:${method}`;
+        let node = graph.get(key);
+        if (!node) {
+            node = { file, method, outgoing: [], incoming: [] };
+            graph.set(key, node);
+        }
+        return node;
+    }
+    // Build the graph
+    for (const call of crossFileCalls) {
+        const fromNode = getNode(call.from.file, call.from.method);
+        const toNode = getNode(call.to.file, call.to.method);
+        fromNode.outgoing.push(call);
+        toNode.incoming.push(call);
+    }
+    return graph;
+}
+/**
+ * Find a path from source to sink through cross-file calls.
+ */
+function findPath(source, sink, callGraph, files) {
+    // Find the method containing the source
+    const sourceMethod = findContainingMethod(source.file, source.source.line, files);
+    if (!sourceMethod) {
+        return null;
+    }
+    // Find the method containing the sink
+    const sinkMethod = findContainingMethod(sink.file, sink.sink.line, files);
+    if (!sinkMethod) {
+        return null;
+    }
+    // BFS to find path from source method to sink method
+    const visited = new Set();
+    const queue = [];
+    // Start from the source file/method
+    const startKey = `${source.file}:${sourceMethod}`;
+    queue.push({ node: startKey, path: [] });
+    visited.add(startKey);
+    const targetKey = `${sink.file}:${sinkMethod}`;
+    while (queue.length > 0) {
+        const current = queue.shift();
+        const currentNode = callGraph.get(current.node);
+        if (!currentNode) {
+            continue;
+        }
+        // Check if we reached the target
+        if (current.node === targetKey) {
+            return buildPathResult(current.path, source, sink, files);
+        }
+        // Explore outgoing calls
+        for (const call of currentNode.outgoing) {
+            // Check if this call propagates taint
+            const propagatesTaint = call.args_mapping.some(m => m.taint_propagates);
+            if (!propagatesTaint) {
+                continue;
+            }
+            const nextKey = `${call.to.file}:${call.to.method}`;
+            if (!visited.has(nextKey)) {
+                visited.add(nextKey);
+                queue.push({
+                    node: nextKey,
+                    path: [...current.path, call],
+                });
+            }
+        }
+    }
+    return null; // No path found
+}
+/**
+ * Find the method containing a given line in a file.
+ */
+function findContainingMethod(file, line, files) {
+    const fileAnalysis = files.find(f => f.file === file);
+    if (!fileAnalysis) {
+        return null;
+    }
+    for (const type of fileAnalysis.analysis.types) {
+        for (const method of type.methods) {
+            if (line >= method.start_line && line <= method.end_line) {
+                return method.name;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Build the path result from cross-file calls.
+ */
+function buildPathResult(calls, source, sink, files) {
+    const hops = [];
+    const sanitizers = [];
+    // Add source as first hop
+    hops.push({
+        file: source.file,
+        method: findContainingMethod(source.file, source.source.line, files) ?? 'unknown',
+        line: source.source.line,
+        code: source.code,
+        variable: extractVariable(source.code),
+    });
+    // Add intermediate hops
+    for (const call of calls) {
+        hops.push({
+            file: call.from.file,
+            method: call.from.method,
+            line: call.from.line,
+            code: `call to ${call.to.method}`,
+            variable: 'arg',
+        });
+        hops.push({
+            file: call.to.file,
+            method: call.to.method,
+            line: call.to.line,
+            code: `${call.to.method} entry`,
+            variable: 'param',
+        });
+        // Check for sanitizers in the target file
+        const targetFile = files.find(f => f.file === call.to.file);
+        if (targetFile) {
+            for (const sanitizer of targetFile.analysis.taint.sanitizers ?? []) {
+                sanitizers.push(sanitizer.method);
+            }
+        }
+    }
+    // Add sink as last hop
+    hops.push({
+        file: sink.file,
+        method: findContainingMethod(sink.file, sink.sink.line, files) ?? 'unknown',
+        line: sink.sink.line,
+        code: sink.code,
+        variable: extractVariable(sink.code),
+    });
+    return { hops, sanitizers };
+}
+/**
+ * Extract variable name from code snippet.
+ */
+function extractVariable(code) {
+    // Try to extract variable from patterns like "var.method()" or "method(var)"
+    const match = code.match(/(\w+)\.\w+\(/) || code.match(/\((\w+)\)/);
+    return match ? match[1] : 'data';
+}
+/**
+ * Calculate confidence for a taint path.
+ */
+function calculatePathConfidence(hops, source, sink) {
+    let confidence = source.confidence * sink.confidence;
+    // Reduce confidence for longer paths
+    const pathLength = hops.length;
+    if (pathLength > 2) {
+        confidence *= Math.pow(0.95, pathLength - 2);
+    }
+    return Math.max(0.1, Math.min(1.0, confidence));
+}
+/**
+ * Find all paths from a specific source.
+ */
+export function findPathsFromSource(sourceFile, sourceLine, files, crossFileCalls) {
+    const allPaths = findTaintPaths(files, crossFileCalls);
+    return allPaths.filter(path => path.source.file === sourceFile && path.source.line === sourceLine);
+}
+/**
+ * Find all paths to a specific sink.
+ */
+export function findPathsToSink(sinkFile, sinkLine, files, crossFileCalls) {
+    const allPaths = findTaintPaths(files, crossFileCalls);
+    return allPaths.filter(path => path.sink.file === sinkFile && path.sink.line === sinkLine);
+}
+//# sourceMappingURL=taint-paths.js.map

package/dist/project/taint-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-paths.js","sourceRoot":"","sources":["../../src/project/taint-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyBH;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAqB,EACrB,cAA+B;IAE/B,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,0DAA0D;IAC1D,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAElC,sCAAsC;IACtC,MAAM,SAAS,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IAEjD,8CAA8C;IAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,iFAAiF;YACjF,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC9B,SAAS;YACX,CAAC;YAED,yCAAyC;YACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAEtD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;oBACtB,MAAM,EAAE;wBACN,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;wBACxB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;wBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;wBACpB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;wBACpB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;wBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;qBAChB;oBACD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,kBAAkB,EAAE,IAAI,CAAC,UAAU;oBACnC,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAqB;IAC3C,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,KAAK,MAAM,YAAY,IAAI,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;QAEvC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,QAAQ;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAqB;IACzC,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,KAAK,MAAM,YAAY,IAAI,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;QAEvC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI;gBACJ,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,QAAQ;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;GAEG;AACH,SAAS,cAAc,CACrB,cAA+B;IAE/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE/C,iCAAiC;IACjC,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;QAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACpD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kBAAkB;IAClB,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAErD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;GAEG;AACH,SAAS,QAAQ,CACf,MAAsB,EACtB,IAAkB,EAClB,SAAqC,EACrC,KAAqB;IAErB,wCAAwC;IACxC,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qDAAqD;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAGL,EAAE,CAAC;IAET,oCAAoC;IACpC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEtB,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;IAE/C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC/B,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;QAED,yBAAyB;QACzB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YACxC,sCAAsC;YACtC,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACxE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;YACpD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,gBAAgB;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAC3B,IAAY,EACZ,IAAY,EACZ,KAAqB;IAErB,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACzD,OAAO,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CACtB,KAAsB,EACtB,MAAsB,EACtB,IAAkB,EAClB,KAAqB;IAErB,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,0BAA0B;IAC1B,IAAI,CAAC,IAAI,CAAC;QACR,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS;QACjF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC;KACvC,CAAC,CAAC;IAEH,wBAAwB;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,IAAI,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YACjC,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM;YACtB,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI;YAClB,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,QAAQ;YAC/B,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QAEH,0CAA0C;QAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;gBACnE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,CAAC,IAAI,CAAC;QACR,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS;QAC3E,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;QACpB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,6EAA6E;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAC9B,IAAgB,EAChB,MAAmB,EACnB,IAAe;IAEf,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAErD,qCAAqC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/B,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,UAAkB,EAClB,KAAqB,EACrB,cAA+B;IAE/B,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,QAAgB,EAChB,KAAqB,EACrB,cAA+B;IAE/B,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC"}

package/dist/project/two-phase-analyzer.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Two-Phase Project Analyzer
+ *
+ * Phase 1: Per-file analysis (parallelizable)
+ *   - Static analysis (circle-ir)
+ *   - LLM enrichment (sources, sinks, roles)
+ *   - CFG/DFG extraction
+ *
+ * Phase 2: Cross-file LLM analysis
+ *   - Sees ALL enriched IRs
+ *   - Cross-file taint path detection
+ *   - Virtual dispatch resolution across files
+ *   - Final vulnerability verification
+ */
+import { type CircleIR, type ProjectAnalysis, type TaintPath, type TaintSource, type TaintSink, type SupportedLanguage, type TypeHierarchy, type CrossFileCall } from 'circle-ir';
+import type { DiscoveredSource, DiscoveredSink } from '../llm/enrichment.js';
+export interface FileInput {
+    path: string;
+    content: string;
+}
+export interface TwoPhaseOptions {
+    name?: string;
+    root?: string;
+    language?: SupportedLanguage;
+    framework?: string;
+    frameworkVersion?: string;
+    enableEnrichment?: boolean;
+    parallelPhase1?: boolean;
+    maxConcurrency?: number;
+    enablePhase2?: boolean;
+    verifyVulnerabilities?: boolean;
+    enrichmentConfidence?: number;
+    crossFileConfidence?: number;
+    onFileStart?: (file: string, index: number, total: number) => void;
+    onFileComplete?: (file: string, index: number, total: number) => void;
+    onPhase1Complete?: (results: EnrichedFileAnalysis[]) => void;
+    onPhase2Start?: () => void;
+}
+/**
+ * Per-file analysis result after Phase 1 (static + LLM enrichment)
+ */
+export interface EnrichedFileAnalysis {
+    file: string;
+    staticAnalysis: CircleIR;
+    enrichment?: {
+        role?: {
+            role: string;
+            confidence: number;
+            reasoning: string;
+        };
+        additionalSources: DiscoveredSource[];
+        additionalSinks: DiscoveredSink[];
+        framework?: {
+            name: string;
+            version?: string;
+            confidence: number;
+        };
+    };
+    allSources: TaintSource[];
+    allSinks: TaintSink[];
+    intraFileFlows: Array<{
+        sourceIndex: number;
+        sinkIndex: number;
+        confidence: number;
+        sanitized: boolean;
+    }>;
+    analysisTimeMs: number;
+    enrichmentTimeMs?: number;
+}
+/**
+ * Aggregated project context for Phase 2
+ */
+export interface ProjectContext {
+    files: EnrichedFileAnalysis[];
+    typeHierarchy: TypeHierarchy;
+    crossFileCalls: CrossFileCall[];
+    allSources: Array<TaintSource & {
+        file: string;
+    }>;
+    allSinks: Array<TaintSink & {
+        file: string;
+    }>;
+    candidatePaths: TaintPath[];
+    meta: {
+        totalFiles: number;
+        totalLoc: number;
+        totalSources: number;
+        totalSinks: number;
+        framework?: string;
+    };
+}
+/**
+ * Final cross-file taint flow verified by Phase 2 LLM
+ */
+export interface CrossFileTaintFlow {
+    id: string;
+    source: {
+        file: string;
+        line: number;
+        type: string;
+        code: string;
+        method?: string;
+    };
+    sink: {
+        file: string;
+        line: number;
+        type: string;
+        cwe: string;
+        code: string;
+        method?: string;
+    };
+    path: Array<{
+        file: string;
+        line: number;
+        variable: string;
+        operation: string;
+    }>;
+    verified: boolean;
+    confidence: number;
+    exploitability: 'high' | 'medium' | 'low' | 'none';
+    reasoning: string;
+    attackVector?: string;
+}
+/**
+ * Enhanced project analysis result
+ */
+export interface TwoPhaseProjectAnalysis extends ProjectAnalysis {
+    enrichedFiles: EnrichedFileAnalysis[];
+    crossFileFlows: CrossFileTaintFlow[];
+    timing: {
+        phase1TotalMs: number;
+        phase2TotalMs: number;
+        totalMs: number;
+    };
+}
+/**
+ * Analyze a project using two-phase LLM-enhanced analysis.
+ *
+ * Phase 1: Per-file static analysis + LLM enrichment (parallelizable)
+ * Phase 2: Cross-file LLM analysis with full project context
+ */
+export declare function analyzeProjectTwoPhase(files: FileInput[], options?: TwoPhaseOptions): Promise<TwoPhaseProjectAnalysis>;
+//# sourceMappingURL=two-phase-analyzer.d.ts.map

package/dist/project/two-phase-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-phase-analyzer.d.ts","sourceRoot":"","sources":["../../src/project/two-phase-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAOL,KAAK,QAAQ,EACb,KAAK,eAAe,EAGpB,KAAK,SAAS,EAEd,KAAK,WAAW,EAChB,KAAK,SAAS,EAGd,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAC;AAMnB,OAAO,KAAK,EAAoB,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAO/F,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAE9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAGhC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAG7B,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtE,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,IAAI,CAAC;IAC7D,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IAGb,cAAc,EAAE,QAAQ,CAAC;IAGzB,UAAU,CAAC,EAAE;QACX,IAAI,CAAC,EAAE;YACL,IAAI,EAAE,MAAM,CAAC;YACb,UAAU,EAAE,MAAM,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;QACF,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;QACtC,eAAe,EAAE,cAAc,EAAE,CAAC;QAClC,SAAS,CAAC,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC;KACH,CAAC;IAGF,UAAU,EAAE,WAAW,EAAE,CAAC;IAC1B,QAAQ,EAAE,SAAS,EAAE,CAAC;IAGtB,cAAc,EAAE,KAAK,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IAGH,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAE7B,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAG9B,aAAa,EAAE,aAAa,CAAC;IAG7B,cAAc,EAAE,aAAa,EAAE,CAAC;IAGhC,UAAU,EAAE,KAAK,CAAC,WAAW,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,QAAQ,EAAE,KAAK,CAAC,SAAS,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAG9C,cAAc,EAAE,SAAS,EAAE,CAAC;IAG5B,IAAI,EAAE;QACJ,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IAGX,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAGF,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAGF,IAAI,EAAE,KAAK,CAAC;QACV,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;IAGH,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAE9D,aAAa,EAAE,oBAAoB,EAAE,CAAC;IAGtC,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAGrC,MAAM,EAAE;QACN,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAibD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,SAAS,EAAE,EAClB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAyJlC"}