circle-ir 3.192.0 → 3.194.0

package/dist/browser/circle-ir.js

@@ -9935,6 +9935,7 @@ var GO_KEYWORDS = /* @__PURE__ */ new Set([
 function buildGoDFG(tree) {
   const defs = [];
   const uses = [];
+  const extraChains = [];
   let defIdCounter = 1;
   let useIdCounter = 1;
   const scopeStack = [/* @__PURE__ */ new Map()];
@@ -9956,7 +9957,7 @@ function buildGoDFG(tree) {
     }
     const body2 = func2.childForFieldName("body");
     if (body2) {
-      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter });
+      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter }, extraChains);
       defIdCounter = defs.length + 1;
       useIdCounter = uses.length + 1;
     }
@@ -9971,6 +9972,15 @@ function buildGoDFG(tree) {
     }
   }
   const chains = computeChains(defs, uses);
+  const seen = new Set(chains.map((c) => `${c.from_def}|${c.to_def}|${c.via}`));
+  for (const ch of extraChains) {
+    const key = `${ch.from_def}|${ch.to_def}|${ch.via}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      chains.push(ch);
+    }
+  }
+  chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
   return { defs, uses, chains };
 }
 function extractGoParamDefs(params, defs, _startId, scopeStack) {
@@ -9995,28 +10005,47 @@ function extractGoParamDefs(params, defs, _startId, scopeStack) {
     }
   }
 }
-function processGoBlock(node, defs, uses, scopeStack, counters) {
+function processGoBlock(node, defs, uses, scopeStack, counters, extraChains = []) {
+  const linkMultiLineRhs = (right, useStart, useEnd, defStart, defEnd) => {
+    if (right.endPosition.row <= right.startPosition.row) return;
+    for (let ui = useStart; ui < useEnd; ui++) {
+      const u = uses[ui];
+      if (!u || u.def_id === null) continue;
+      for (let di = defStart; di < defEnd; di++) {
+        const d = defs[di];
+        if (d && d.kind === "local" && d.id !== u.def_id) {
+          extraChains.push({ from_def: u.def_id, to_def: d.id, via: u.variable });
+        }
+      }
+    }
+  };
   walkTree(node, (child) => {
     if (child.type === "short_var_declaration") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "var_declaration") {
       processGoVarDecl(child, defs, scopeStack, counters);
     } else if (child.type === "assignment_statement") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {
@@ -28591,12 +28620,12 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
 function findJavaPathGetFileNameSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
-  const assignmentRe = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const assignmentRe2 = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const rhsHasGetFileNameRe = /\.\s*getFileName\s*\(\s*\)/;
   const rhsHasPathsChainRe = /\b(?:Paths\s*\.\s*get|Path\s*\.\s*of)\s*\(/;
   const candidates = [];
   for (let i2 = 0; i2 < lines.length; i2++) {
-    const m = assignmentRe.exec(lines[i2]);
+    const m = assignmentRe2.exec(lines[i2]);
     if (!m) continue;
     const rhs = m[2];
     if (!rhsHasGetFileNameRe.test(rhs)) continue;
@@ -33831,6 +33860,333 @@ var DeserializationSafetyGatePass = class {
   }
 };
 
+// src/analysis/passes/prompt-injection-safety-gate-pass.ts
+function isDelimiterLiteral(lit) {
+  const s = lit.trim();
+  if (s.length === 0) return true;
+  return /^<\/?[\w.-]+\s*\/?>$/.test(s) || /^\[\/?[\w.-]+\]$/.test(s) || /^`{1,3}[\w-]*$/.test(s) || /^"""[\w-]*$/.test(s) || /^[#*=_~-]{2,}$/.test(s) || /^<{2,}[\w-]*$/.test(s) || /^[\w-]*>{2,}$/.test(s);
+}
+function scanValue(code, start2) {
+  let depth = 0;
+  let str = null;
+  let out2 = "";
+  for (let i2 = start2; i2 < code.length; i2++) {
+    const c = code[i2];
+    if (str) {
+      out2 += c;
+      if (c === str && code[i2 - 1] !== "\\") str = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      str = c;
+      out2 += c;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      out2 += c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) break;
+      depth--;
+      out2 += c;
+      continue;
+    }
+    if (c === "," && depth === 0) break;
+    out2 += c;
+  }
+  return out2.trim();
+}
+function stringLiterals(expr) {
+  return [...expr.matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => m[1] ?? m[2] ?? "");
+}
+function hasIdentifier(expr) {
+  return /[A-Za-z_$][\w$]*/.test(expr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, " "));
+}
+function isPureLiteral(valueExpr) {
+  const stripped = valueExpr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, " ");
+  return !/[A-Za-z_$][\w$]*/.test(stripped);
+}
+function isInstructionConcat(valueExpr) {
+  if (!valueExpr.includes("+")) return false;
+  if (!hasIdentifier(valueExpr)) return false;
+  const lits = stringLiterals(valueExpr);
+  if (lits.length === 0) return false;
+  return !lits.every(isDelimiterLiteral);
+}
+function isMixedTemplate(v) {
+  const fstr = v.match(/\bf(["'])((?:\\.|(?!\1).)*)\1/);
+  if (fstr) {
+    const body2 = fstr[2];
+    if (/\{[^}]+\}/.test(body2) && /\w/.test(body2.replace(/\{[^}]*\}/g, ""))) return true;
+  }
+  const tmpl = v.match(/`([^`]*)`/);
+  if (tmpl) {
+    const body2 = tmpl[1];
+    if (/\$\{[^}]+\}/.test(body2) && /\w/.test(body2.replace(/\$\{[^}]*\}/g, ""))) return true;
+  }
+  return false;
+}
+function assignmentRe(varName, flags2 = "") {
+  return new RegExp(`\\b${varName}\\s*(?::=|(?<![=<>!])=(?!=))\\s*`, flags2);
+}
+function resolveAssignmentRHS(varName, codeLines) {
+  const re = assignmentRe(varName);
+  for (const line of codeLines) {
+    const m = line.match(re);
+    if (m && m.index !== void 0) {
+      return scanValue(line, m.index + m[0].length);
+    }
+  }
+  return void 0;
+}
+function classifyExpr(v) {
+  if (isMixedTemplate(v)) return "unsafe";
+  if (v.includes("+")) {
+    if (isInstructionConcat(v)) return "unsafe";
+    const lits = stringLiterals(v);
+    if (lits.length > 0 && lits.every(isDelimiterLiteral) && hasIdentifier(v)) return "safe";
+    return "unknown";
+  }
+  return "unknown";
+}
+function classifyContentPlacement(val, codeLines) {
+  const v = val.trim();
+  if (/^[A-Za-z_$][\w$]*$/.test(v)) {
+    const rhs = resolveAssignmentRHS(v, codeLines);
+    if (rhs === void 0) return "unknown";
+    return classifyExpr(rhs);
+  }
+  return classifyExpr(v);
+}
+function classifyPromptCall(callCode, codeLines) {
+  const contentRe = /["']?[Cc]ontent["']?\s*[:=]\s*/g;
+  let m;
+  let sawDynamic = false;
+  let allSafe = true;
+  while ((m = contentRe.exec(callCode)) !== null) {
+    const val = scanValue(callCode, m.index + m[0].length);
+    if (val === "" || isPureLiteral(val)) continue;
+    sawDynamic = true;
+    const ctx = callCode.slice(Math.max(0, m.index - 80), m.index);
+    const roleM = ctx.match(/["']?[Rr]ole["']?\s*[:=]\s*["'](\w+)["'][^"']*$/);
+    const role = roleM ? roleM[1].toLowerCase() : "user";
+    if (role === "system" || role === "assistant") return "unsafe";
+    const placement = classifyContentPlacement(val, codeLines);
+    if (placement === "unsafe") return "unsafe";
+    if (placement !== "safe") allSafe = false;
+  }
+  if (!sawDynamic) return "unknown";
+  return allSafe ? "safe" : "unknown";
+}
+function scanRhsAcrossLines(text, start2) {
+  let depth = 0;
+  let str = null;
+  let out2 = "";
+  for (let i2 = start2; i2 < text.length; i2++) {
+    const c = text[i2];
+    if (str) {
+      out2 += c;
+      if (c === str && text[i2 - 1] !== "\\") str = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      str = c;
+      out2 += c;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      out2 += c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) break;
+      depth--;
+      out2 += c;
+      continue;
+    }
+    if (c === "\n" && depth === 0) break;
+    out2 += c;
+  }
+  return out2.trim();
+}
+function resolveBuilderRhs(varName, joined) {
+  const re = assignmentRe(varName, "g");
+  const m = re.exec(joined);
+  if (m) return scanRhsAcrossLines(joined, m.index + m[0].length);
+  return void 0;
+}
+function collectBuilderRegion(callCode, joined) {
+  const parts2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...callCode.matchAll(/[A-Za-z_$][\w$]*/g)].map((x) => x[0]);
+  let budget = 40;
+  while (stack.length > 0 && budget-- > 0) {
+    const v = stack.pop();
+    if (seen.has(v)) continue;
+    seen.add(v);
+    const rhs = resolveBuilderRhs(v, joined);
+    if (rhs) {
+      parts2.push(rhs);
+      for (const mm of rhs.matchAll(/[A-Za-z_$][\w$]*/g)) stack.push(mm[0]);
+    }
+  }
+  return parts2.join("\n");
+}
+function classifyPromptSink(callCode, codeLines) {
+  const direct = classifyPromptCall(callCode, codeLines);
+  if (direct !== "unknown") return direct;
+  const region = collectBuilderRegion(callCode, codeLines.join("\n"));
+  if (!region) return "unknown";
+  return classifyPromptCall(region, codeLines);
+}
+var PromptInjectionSafetyGatePass = class {
+  name = "prompt-injection-safety-gate";
+  category = "security";
+  run(ctx) {
+    const { graph, code } = ctx;
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0) return { droppedSafe: 0 };
+    const codeLines = code.split("\n");
+    let droppedSafe = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "prompt_injection") return true;
+      const callCode = sink.code ?? codeLines[sink.line - 1] ?? "";
+      if (!callCode) return true;
+      if (classifyPromptSink(callCode, codeLines) === "safe") {
+        droppedSafe++;
+        return false;
+      }
+      return true;
+    });
+    if (droppedSafe > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { droppedSafe };
+  }
+};
+
+// src/analysis/passes/speculative-prompt-param-source-pass.ts
+function returnOrAssignRhs(text) {
+  const t = text.trim();
+  const ret = t.match(/^return\s+(.+?);?$/);
+  if (ret) return ret[1];
+  const asg = t.match(/^[A-Za-z_$][\w$.]*\s*(?::=|(?<![=<>!])=(?!=))\s*(.+?);?$/);
+  if (asg) return asg[1];
+  return void 0;
+}
+function looksLikePromptText(lit) {
+  const s = lit.trim();
+  if (/\b(you are|you're|assistant|system prompt|follow (the )?(policy|instructions|rules)|act as|your task|instructions?\s*:|ignore (all )?previous|do not reveal|respond (to|with|as)|answer the (question|user)|you (must|should|will)|helpful (ai|assistant))\b/i.test(s)) {
+    return true;
+  }
+  const words = s.split(/\s+/).filter(Boolean);
+  return words.length >= 4 && s.length >= 20;
+}
+function literalsOf(expr) {
+  return [...expr.matchAll(/"([^"]*)"|'([^']*)'|`([^`]*)`/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+}
+function detectPromptConstructionFlows(codeLines, types) {
+  const flows = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const type of types) {
+    for (const method of type.methods) {
+      const params = (method.parameters ?? []).map((p) => ({ name: p.name, line: p.line ?? method.start_line })).filter((p) => p.name && p.name !== "_");
+      if (params.length === 0) continue;
+      for (let line = method.start_line; line <= method.end_line; line++) {
+        const text = codeLines[line - 1] ?? "";
+        const rhs = returnOrAssignRhs(text);
+        if (!rhs || !isInstructionConcat(rhs)) continue;
+        if (!literalsOf(rhs).some(looksLikePromptText)) continue;
+        const param = params.find((p) => new RegExp(`\\b${p.name}\\b`).test(rhs));
+        if (!param) continue;
+        const key = `${param.line}|${line}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        flows.push({
+          source_line: param.line,
+          sink_line: line,
+          source_type: "http_body",
+          sink_type: "prompt_injection",
+          path: [
+            { variable: param.name, line: param.line, type: "source" },
+            { variable: param.name, line, type: "sink" }
+          ],
+          confidence: 1,
+          sanitized: false
+        });
+      }
+    }
+  }
+  return flows;
+}
+function looksLikeTextParam(type) {
+  if (!type) return true;
+  const t = type.trim();
+  if (t.startsWith("*") || t.startsWith("&")) return false;
+  if (/\b(Client|Context|Writer|Reader|Conn|DB|Logger|Handler|Server|Request|Response|Pool|Session|Engine|Service|Repository|Config)\b/.test(t)) {
+    return false;
+  }
+  return /(?:^|\b)(string|str|String|text|any|object|interface\{\}|\[\]byte|\[\]string|List\[str\]|Optional\[str\])(?:\b|$)/i.test(t) || // TS unions / plain identifiers without a handle keyword default to text.
+  /^[A-Za-z_$][\w$<>[\], |]*$/.test(t);
+}
+var SpeculativePromptParamSourcePass = class {
+  constructor(enabled) {
+    this.enabled = enabled;
+  }
+  enabled;
+  name = "speculative-prompt-param-source";
+  category = "security";
+  run(ctx) {
+    if (!this.enabled) return { added: 0 };
+    if (!ctx.hasResult("sink-filter")) return { added: 0 };
+    const sinkFilter = ctx.getResult("sink-filter");
+    const { types } = ctx.graph.ir;
+    const promptSinks = sinkFilter.sinks.filter(
+      (s) => s.type === "prompt_injection"
+    );
+    if (promptSinks.length === 0) return { added: 0 };
+    const existing = new Set(
+      sinkFilter.sources.filter((s) => typeof s.variable === "string").map((s) => `${s.variable}:${s.line}`)
+    );
+    const added = [];
+    for (const type of types) {
+      for (const method of type.methods) {
+        const hasPromptSink = promptSinks.some(
+          (s) => s.line >= method.start_line && s.line <= method.end_line
+        );
+        if (!hasPromptSink) continue;
+        for (const param of method.parameters) {
+          if (!param.name || param.name === "_") continue;
+          if (!looksLikeTextParam(param.type)) continue;
+          const line = param.line ?? method.start_line;
+          const key = `${param.name}:${line}`;
+          if (existing.has(key)) continue;
+          existing.add(key);
+          added.push({
+            // `http_body` reaches `prompt_injection` via the flow
+            // generators; a generic untrusted request-shaped type.
+            type: "http_body",
+            location: `speculative untrusted parameter '${param.name}' in ${method.name}`,
+            severity: "high",
+            line,
+            confidence: 1,
+            variable: param.name,
+            in_method: method.name
+          });
+        }
+      }
+    }
+    if (added.length > 0) {
+      sinkFilter.sources.push(...added);
+    }
+    return { added: added.length };
+  }
+};
+
 // src/analysis/passes/cli-main-reflection-suppress-pass.ts
 var REFLECTION_SINK_METHODS = /* @__PURE__ */ new Set([
   "forName",
@@ -44077,6 +44433,9 @@ async function analyze(code, filePath, language, options = {}) {
     if (!disabledPasses.has("sink-semantics")) pipeline.add(new SinkSemanticsPass());
     if (!disabledPasses.has("deserialization-safety-gate"))
       pipeline.add(new DeserializationSafetyGatePass(options.dependencyContext));
+    if (!disabledPasses.has("prompt-injection-safety-gate"))
+      pipeline.add(new PromptInjectionSafetyGatePass());
+    pipeline.add(new SpeculativePromptParamSourcePass(options.speculativeParamSources === true));
     if (!disabledPasses.has("cli-main-reflection-suppress"))
       pipeline.add(new CliMainReflectionSuppressPass());
     if (!disabledPasses.has("library-profile-sink-gate"))
@@ -44156,6 +44515,17 @@ async function analyze(code, filePath, language, options = {}) {
       flows: interProc.additionalFlows,
       interprocedural: interProc.interprocedural
     };
+    if (options.speculativeParamSources === true) {
+      const existingFlowKeys = new Set(
+        (taint.flows ?? []).map((f) => `${f.source_line}|${f.sink_line}|${f.sink_type}`)
+      );
+      const constructionFlows = detectPromptConstructionFlows(code.split("\n"), types).filter(
+        (f) => !existingFlowKeys.has(`${f.source_line}|${f.sink_line}|${f.sink_type}`)
+      );
+      if (constructionFlows.length > 0) {
+        taint.flows = [...taint.flows ?? [], ...constructionFlows];
+      }
+    }
     if (taint.flows && taint.flows.length > 0 && taint.sinks.length > 0) {
       const sinkTagsByKey = /* @__PURE__ */ new Map();
       for (const s of taint.sinks) {

package/dist/core/circle-ir-core.cjs

@@ -9981,6 +9981,7 @@ var GO_KEYWORDS = /* @__PURE__ */ new Set([
 function buildGoDFG(tree) {
   const defs = [];
   const uses = [];
+  const extraChains = [];
   let defIdCounter = 1;
   let useIdCounter = 1;
   const scopeStack = [/* @__PURE__ */ new Map()];
@@ -10002,7 +10003,7 @@ function buildGoDFG(tree) {
     }
     const body2 = func2.childForFieldName("body");
     if (body2) {
-      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter });
+      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter }, extraChains);
       defIdCounter = defs.length + 1;
       useIdCounter = uses.length + 1;
     }
@@ -10017,6 +10018,15 @@ function buildGoDFG(tree) {
     }
   }
   const chains = computeChains(defs, uses);
+  const seen = new Set(chains.map((c) => `${c.from_def}|${c.to_def}|${c.via}`));
+  for (const ch of extraChains) {
+    const key = `${ch.from_def}|${ch.to_def}|${ch.via}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      chains.push(ch);
+    }
+  }
+  chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
   return { defs, uses, chains };
 }
 function extractGoParamDefs(params, defs, _startId, scopeStack) {
@@ -10041,28 +10051,47 @@ function extractGoParamDefs(params, defs, _startId, scopeStack) {
     }
   }
 }
-function processGoBlock(node, defs, uses, scopeStack, counters) {
+function processGoBlock(node, defs, uses, scopeStack, counters, extraChains = []) {
+  const linkMultiLineRhs = (right, useStart, useEnd, defStart, defEnd) => {
+    if (right.endPosition.row <= right.startPosition.row) return;
+    for (let ui = useStart; ui < useEnd; ui++) {
+      const u = uses[ui];
+      if (!u || u.def_id === null) continue;
+      for (let di = defStart; di < defEnd; di++) {
+        const d = defs[di];
+        if (d && d.kind === "local" && d.id !== u.def_id) {
+          extraChains.push({ from_def: u.def_id, to_def: d.id, via: u.variable });
+        }
+      }
+    }
+  };
   walkTree(node, (child) => {
     if (child.type === "short_var_declaration") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "var_declaration") {
       processGoVarDecl(child, defs, scopeStack, counters);
     } else if (child.type === "assignment_statement") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {

package/dist/core/circle-ir-core.js

@@ -9915,6 +9915,7 @@ var GO_KEYWORDS = /* @__PURE__ */ new Set([
 function buildGoDFG(tree) {
   const defs = [];
   const uses = [];
+  const extraChains = [];
   let defIdCounter = 1;
   let useIdCounter = 1;
   const scopeStack = [/* @__PURE__ */ new Map()];
@@ -9936,7 +9937,7 @@ function buildGoDFG(tree) {
     }
     const body2 = func2.childForFieldName("body");
     if (body2) {
-      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter });
+      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter }, extraChains);
       defIdCounter = defs.length + 1;
       useIdCounter = uses.length + 1;
     }
@@ -9951,6 +9952,15 @@ function buildGoDFG(tree) {
     }
   }
   const chains = computeChains(defs, uses);
+  const seen = new Set(chains.map((c) => `${c.from_def}|${c.to_def}|${c.via}`));
+  for (const ch of extraChains) {
+    const key = `${ch.from_def}|${ch.to_def}|${ch.via}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      chains.push(ch);
+    }
+  }
+  chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
   return { defs, uses, chains };
 }
 function extractGoParamDefs(params, defs, _startId, scopeStack) {
@@ -9975,28 +9985,47 @@ function extractGoParamDefs(params, defs, _startId, scopeStack) {
     }
   }
 }
-function processGoBlock(node, defs, uses, scopeStack, counters) {
+function processGoBlock(node, defs, uses, scopeStack, counters, extraChains = []) {
+  const linkMultiLineRhs = (right, useStart, useEnd, defStart, defEnd) => {
+    if (right.endPosition.row <= right.startPosition.row) return;
+    for (let ui = useStart; ui < useEnd; ui++) {
+      const u = uses[ui];
+      if (!u || u.def_id === null) continue;
+      for (let di = defStart; di < defEnd; di++) {
+        const d = defs[di];
+        if (d && d.kind === "local" && d.id !== u.def_id) {
+          extraChains.push({ from_def: u.def_id, to_def: d.id, via: u.variable });
+        }
+      }
+    }
+  };
   walkTree(node, (child) => {
     if (child.type === "short_var_declaration") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "var_declaration") {
       processGoVarDecl(child, defs, scopeStack, counters);
     } else if (child.type === "assignment_statement") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {