circle-ir 3.193.0 → 3.194.0

package/dist/analysis/passes/prompt-injection-safety-gate-pass.d.ts

@@ -0,0 +1,75 @@
+/**
+ * PromptInjectionSafetyGatePass — cognium-dev #267
+ *
+ * Drops `prompt_injection` (CWE-1427) sinks whose untrusted content is
+ * *delimiter-wrapped* — enclosed in matched boundary markers
+ * (`<user_question>…</user_question>`, fences) that keep it as data rather
+ * than instructions. Removes the false positive on the delimiter-wrapped
+ * "safe mirror" of the OWASP-LLM LLM01 probe pairs while leaving genuine
+ * prompt-injection flows untouched.
+ *
+ * The engine already fires `prompt_injection` when tainted input reaches an
+ * LLM-client call (#248); the gap this closes is precision on the wrapped
+ * safe-mitigation shape.
+ *
+ * Scope decision — *role separation alone is NOT treated as a sanitizer*
+ * here: `{"role":"user","content":untrusted}` continues to fire, matching
+ * #248's must-fire contract (untrusted reaching an LLM prompt is a finding
+ * even in the user channel). Only affirmative delimiter-wrapping suppresses.
+ *
+ * Conservative by construction: a sink is dropped ONLY when EVERY dynamic
+ * content placement is delimiter-wrapped and none lands in the instruction
+ * channel (system/assistant role, or instruction concat/interpolation). Any
+ * ambiguity — unparsed value, standalone value, dynamic+dynamic concat —
+ * keeps the sink (no recall loss). Runs after SinkFilterPass and before
+ * TaintPropagationPass so flow generators never see a dropped sink.
+ *
+ * Builder-pattern aware: when the request is constructed in a prior
+ * statement (Go/Java `req := ChatCompletionRequest{Messages: …}`) and passed
+ * as a bare arg, the gate traces the builder var(s) to see the message
+ * structure.
+ *
+ * Pillar I note: `prompt_injection` / CWE-1427 is a deterministic taint
+ * category (#248). This gate is pure structural analysis of the call site —
+ * no model invocation, no LLM concepts in its API surface.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+export interface PromptInjectionSafetyGateResult {
+    droppedSafe: number;
+}
+/**
+ * A string literal is a *delimiter* (structural boundary marker) rather
+ * than *instruction text* when it is a short tag/fence-like token:
+ * `<user_question>`, `</user_question>`, `[data]`, ```` ``` ````, `"""`,
+ * `---`, `###`, `<<<`. Instruction literals ("Follow policy.") contain free
+ * words and do not match.
+ */
+export declare function isDelimiterLiteral(lit: string): boolean;
+/**
+ * Scan a balanced expression starting at `start`, stopping at a top-level
+ * `,` or a closing `) ] }` that closes the enclosing structure. Tracks
+ * bracket depth and string state so `}`/`)` inside strings (f-string
+ * `{user}`, template `${user}`) or nested calls do not truncate the value.
+ */
+export declare function scanValue(code: string, start: number): string;
+/** `+`-concat mixing a dynamic value with a NON-delimiter string literal. */
+export declare function isInstructionConcat(valueExpr: string): boolean;
+/**
+ * Classify a prompt-injection call site.
+ *   'unsafe'  — untrusted in the instruction channel, or mixed into instructions
+ *   'safe'    — every dynamic content is standalone role-separated or delimiter-wrapped
+ *   'unknown' — no confident classification (kept)
+ */
+export declare function classifyPromptCall(callCode: string, codeLines: string[]): 'unsafe' | 'safe' | 'unknown';
+/**
+ * Classify a prompt-injection sink, first on the call line (Python/JS inline
+ * message shape) and — when that is inconclusive — over the builder region
+ * for the call's arg vars (Go/Java builder shape).
+ */
+export declare function classifyPromptSink(callCode: string, codeLines: string[]): 'unsafe' | 'safe' | 'unknown';
+export declare class PromptInjectionSafetyGatePass implements AnalysisPass<PromptInjectionSafetyGateResult> {
+    readonly name = "prompt-injection-safety-gate";
+    readonly category: "security";
+    run(ctx: PassContext): PromptInjectionSafetyGateResult;
+}
+//# sourceMappingURL=prompt-injection-safety-gate-pass.d.ts.map

package/dist/analysis/passes/prompt-injection-safety-gate-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-injection-safety-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/prompt-injection-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAI9E,MAAM,WAAW,+BAA+B;IAC9C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAYvD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA2B7D;AAiBD,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM9D;AAkFD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EAAE,GAClB,QAAQ,GAAG,MAAM,GAAG,SAAS,CAwB/B;AA8DD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EAAE,GAClB,QAAQ,GAAG,MAAM,GAAG,SAAS,CAM/B;AAED,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAExD,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CA4BvD"}

package/dist/analysis/passes/prompt-injection-safety-gate-pass.js

@@ -0,0 +1,353 @@
+/**
+ * PromptInjectionSafetyGatePass — cognium-dev #267
+ *
+ * Drops `prompt_injection` (CWE-1427) sinks whose untrusted content is
+ * *delimiter-wrapped* — enclosed in matched boundary markers
+ * (`<user_question>…</user_question>`, fences) that keep it as data rather
+ * than instructions. Removes the false positive on the delimiter-wrapped
+ * "safe mirror" of the OWASP-LLM LLM01 probe pairs while leaving genuine
+ * prompt-injection flows untouched.
+ *
+ * The engine already fires `prompt_injection` when tainted input reaches an
+ * LLM-client call (#248); the gap this closes is precision on the wrapped
+ * safe-mitigation shape.
+ *
+ * Scope decision — *role separation alone is NOT treated as a sanitizer*
+ * here: `{"role":"user","content":untrusted}` continues to fire, matching
+ * #248's must-fire contract (untrusted reaching an LLM prompt is a finding
+ * even in the user channel). Only affirmative delimiter-wrapping suppresses.
+ *
+ * Conservative by construction: a sink is dropped ONLY when EVERY dynamic
+ * content placement is delimiter-wrapped and none lands in the instruction
+ * channel (system/assistant role, or instruction concat/interpolation). Any
+ * ambiguity — unparsed value, standalone value, dynamic+dynamic concat —
+ * keeps the sink (no recall loss). Runs after SinkFilterPass and before
+ * TaintPropagationPass so flow generators never see a dropped sink.
+ *
+ * Builder-pattern aware: when the request is constructed in a prior
+ * statement (Go/Java `req := ChatCompletionRequest{Messages: …}`) and passed
+ * as a bare arg, the gate traces the builder var(s) to see the message
+ * structure.
+ *
+ * Pillar I note: `prompt_injection` / CWE-1427 is a deterministic taint
+ * category (#248). This gate is pure structural analysis of the call site —
+ * no model invocation, no LLM concepts in its API surface.
+ */
+/**
+ * A string literal is a *delimiter* (structural boundary marker) rather
+ * than *instruction text* when it is a short tag/fence-like token:
+ * `<user_question>`, `</user_question>`, `[data]`, ```` ``` ````, `"""`,
+ * `---`, `###`, `<<<`. Instruction literals ("Follow policy.") contain free
+ * words and do not match.
+ */
+export function isDelimiterLiteral(lit) {
+    const s = lit.trim();
+    if (s.length === 0)
+        return true;
+    return (/^<\/?[\w.-]+\s*\/?>$/.test(s) ||
+        /^\[\/?[\w.-]+\]$/.test(s) ||
+        /^`{1,3}[\w-]*$/.test(s) ||
+        /^"""[\w-]*$/.test(s) ||
+        /^[#*=_~-]{2,}$/.test(s) ||
+        /^<{2,}[\w-]*$/.test(s) ||
+        /^[\w-]*>{2,}$/.test(s));
+}
+/**
+ * Scan a balanced expression starting at `start`, stopping at a top-level
+ * `,` or a closing `) ] }` that closes the enclosing structure. Tracks
+ * bracket depth and string state so `}`/`)` inside strings (f-string
+ * `{user}`, template `${user}`) or nested calls do not truncate the value.
+ */
+export function scanValue(code, start) {
+    let depth = 0;
+    let str = null;
+    let out = '';
+    for (let i = start; i < code.length; i++) {
+        const c = code[i];
+        if (str) {
+            out += c;
+            if (c === str && code[i - 1] !== '\\')
+                str = null;
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            str = c;
+            out += c;
+            continue;
+        }
+        if (c === '(' || c === '[' || c === '{') {
+            depth++;
+            out += c;
+            continue;
+        }
+        if (c === ')' || c === ']' || c === '}') {
+            if (depth === 0)
+                break;
+            depth--;
+            out += c;
+            continue;
+        }
+        if (c === ',' && depth === 0)
+            break;
+        out += c;
+    }
+    return out.trim();
+}
+function stringLiterals(expr) {
+    return [...expr.matchAll(/"([^"]*)"|'([^']*)'/g)].map(m => m[1] ?? m[2] ?? '');
+}
+/** Reference to a bare identifier (a dynamic value) once literals removed. */
+function hasIdentifier(expr) {
+    return /[A-Za-z_$][\w$]*/.test(expr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, ' '));
+}
+/** A content value that is entirely a string literal (no dynamic part). */
+function isPureLiteral(valueExpr) {
+    const stripped = valueExpr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, ' ');
+    return !/[A-Za-z_$][\w$]*/.test(stripped);
+}
+/** `+`-concat mixing a dynamic value with a NON-delimiter string literal. */
+export function isInstructionConcat(valueExpr) {
+    if (!valueExpr.includes('+'))
+        return false;
+    if (!hasIdentifier(valueExpr))
+        return false;
+    const lits = stringLiterals(valueExpr);
+    if (lits.length === 0)
+        return false;
+    return !lits.every(isDelimiterLiteral);
+}
+/**
+ * f-string / template literal that mixes untrusted interpolation with free
+ * instruction text: `f"Follow policy. {user}"` / `` `Follow policy. ${user}` ``.
+ * Pure interpolation (`f"{user}"`) is not instruction-mixing.
+ */
+function isMixedTemplate(v) {
+    const fstr = v.match(/\bf(["'])((?:\\.|(?!\1).)*)\1/);
+    if (fstr) {
+        const body = fstr[2];
+        if (/\{[^}]+\}/.test(body) && /\w/.test(body.replace(/\{[^}]*\}/g, '')))
+            return true;
+    }
+    const tmpl = v.match(/`([^`]*)`/);
+    if (tmpl) {
+        const body = tmpl[1];
+        if (/\$\{[^}]+\}/.test(body) && /\w/.test(body.replace(/\$\{[^}]*\}/g, '')))
+            return true;
+    }
+    return false;
+}
+/**
+ * Assignment-operator matcher for `<var> := …` / `<var> = …`, excluding the
+ * comparisons `==` / `<=` / `>=` / `!=`. `:=` is matched directly; a plain
+ * `=` must not be preceded by `=<>!` nor followed by `=`.
+ */
+function assignmentRe(varName, flags = '') {
+    return new RegExp(`\\b${varName}\\s*(?::=|(?<![=<>!])=(?!=))\\s*`, flags);
+}
+/** Resolve a bare-identifier content value one hop back to its assignment RHS. */
+function resolveAssignmentRHS(varName, codeLines) {
+    const re = assignmentRe(varName);
+    for (const line of codeLines) {
+        const m = line.match(re);
+        if (m && m.index !== undefined) {
+            return scanValue(line, m.index + m[0].length);
+        }
+    }
+    return undefined;
+}
+/**
+ * Classify a fully-scanned content expression.
+ *   'safe'    — standalone dynamic value or delimiter-wrapped concat
+ *   'unsafe'  — instruction concat / instruction-mixing template
+ *   'unknown' — dynamic+dynamic concat / unrecognized — kept
+ */
+function classifyExpr(v) {
+    if (isMixedTemplate(v))
+        return 'unsafe';
+    if (v.includes('+')) {
+        if (isInstructionConcat(v))
+            return 'unsafe';
+        const lits = stringLiterals(v);
+        if (lits.length > 0 && lits.every(isDelimiterLiteral) && hasIdentifier(v))
+            return 'safe';
+        return 'unknown'; // dynamic+dynamic / complex — never claim safe
+    }
+    // No '+', no instruction-mixing template: a standalone value placed as
+    // the whole content. Whether this is "safe" (role-separation as the
+    // mitigation) is a security-semantics choice that conflicts with #248's
+    // must-fire contract — left as 'unknown' (kept) pending that decision;
+    // only delimiter-wrapping is treated as an affirmative sanitizer.
+    return 'unknown';
+}
+/**
+ * Classify one dynamic content placement, resolving a bare identifier one
+ * hop back so `wrapped = "<q>"+x+"</q>"; content: wrapped` and
+ * `bad = "instr "+x; content: bad` are judged on their construction.
+ */
+function classifyContentPlacement(val, codeLines) {
+    const v = val.trim();
+    if (/^[A-Za-z_$][\w$]*$/.test(v)) {
+        const rhs = resolveAssignmentRHS(v, codeLines);
+        // Unresolved bare identifier (param, source var, or local whose
+        // construction we can't see) — standalone/role-separated placement,
+        // which is NOT an affirmative sanitizer (kept; see scope note).
+        if (rhs === undefined)
+            return 'unknown';
+        return classifyExpr(rhs);
+    }
+    return classifyExpr(v);
+}
+/**
+ * Classify a prompt-injection call site.
+ *   'unsafe'  — untrusted in the instruction channel, or mixed into instructions
+ *   'safe'    — every dynamic content is standalone role-separated or delimiter-wrapped
+ *   'unknown' — no confident classification (kept)
+ */
+export function classifyPromptCall(callCode, codeLines) {
+    const contentRe = /["']?[Cc]ontent["']?\s*[:=]\s*/g;
+    let m;
+    let sawDynamic = false;
+    let allSafe = true;
+    while ((m = contentRe.exec(callCode)) !== null) {
+        const val = scanValue(callCode, m.index + m[0].length);
+        if (val === '' || isPureLiteral(val))
+            continue;
+        sawDynamic = true;
+        // Role context: nearest preceding `role: "..."` in the same object.
+        const ctx = callCode.slice(Math.max(0, m.index - 80), m.index);
+        const roleM = ctx.match(/["']?[Rr]ole["']?\s*[:=]\s*["'](\w+)["'][^"']*$/);
+        const role = roleM ? roleM[1].toLowerCase() : 'user';
+        if (role === 'system' || role === 'assistant')
+            return 'unsafe';
+        const placement = classifyContentPlacement(val, codeLines);
+        if (placement === 'unsafe')
+            return 'unsafe';
+        if (placement !== 'safe')
+            allSafe = false;
+    }
+    if (!sawDynamic)
+        return 'unknown';
+    return allSafe ? 'safe' : 'unknown';
+}
+/**
+ * Scan a statement RHS across lines, stopping at a top-level newline (Go/
+ * builder style) or a closing bracket that ends the expression — so a
+ * multi-line composite literal `T{ … }` is captured whole. Tracks bracket
+ * depth and string state.
+ */
+function scanRhsAcrossLines(text, start) {
+    let depth = 0;
+    let str = null;
+    let out = '';
+    for (let i = start; i < text.length; i++) {
+        const c = text[i];
+        if (str) {
+            out += c;
+            if (c === str && text[i - 1] !== '\\')
+                str = null;
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            str = c;
+            out += c;
+            continue;
+        }
+        if (c === '(' || c === '[' || c === '{') {
+            depth++;
+            out += c;
+            continue;
+        }
+        if (c === ')' || c === ']' || c === '}') {
+            if (depth === 0)
+                break;
+            depth--;
+            out += c;
+            continue;
+        }
+        if (c === '\n' && depth === 0)
+            break;
+        out += c;
+    }
+    return out.trim();
+}
+/** Full multi-line RHS of `var := …` / `var = …`. */
+function resolveBuilderRhs(varName, joined) {
+    const re = assignmentRe(varName, 'g');
+    const m = re.exec(joined);
+    if (m)
+        return scanRhsAcrossLines(joined, m.index + m[0].length);
+    return undefined;
+}
+/**
+ * Builder-pattern support (Go/Java): when the request is built in a prior
+ * statement (`req := ChatCompletionRequest{Messages: …}`) and passed as a
+ * bare arg to the client call, the role/content structure is not on the
+ * sink line. Gather the builder text for each identifier arg of the call,
+ * recursively inlining referenced builder vars (bounded), so the classifier
+ * can see the message structure. Returns the concatenated builder region.
+ */
+function collectBuilderRegion(callCode, joined) {
+    const parts = [];
+    const seen = new Set();
+    const stack = [...callCode.matchAll(/[A-Za-z_$][\w$]*/g)].map(x => x[0]);
+    let budget = 40;
+    while (stack.length > 0 && budget-- > 0) {
+        const v = stack.pop();
+        if (seen.has(v))
+            continue;
+        seen.add(v);
+        const rhs = resolveBuilderRhs(v, joined);
+        if (rhs) {
+            parts.push(rhs);
+            for (const mm of rhs.matchAll(/[A-Za-z_$][\w$]*/g))
+                stack.push(mm[0]);
+        }
+    }
+    return parts.join('\n');
+}
+/**
+ * Classify a prompt-injection sink, first on the call line (Python/JS inline
+ * message shape) and — when that is inconclusive — over the builder region
+ * for the call's arg vars (Go/Java builder shape).
+ */
+export function classifyPromptSink(callCode, codeLines) {
+    const direct = classifyPromptCall(callCode, codeLines);
+    if (direct !== 'unknown')
+        return direct;
+    const region = collectBuilderRegion(callCode, codeLines.join('\n'));
+    if (!region)
+        return 'unknown';
+    return classifyPromptCall(region, codeLines);
+}
+export class PromptInjectionSafetyGatePass {
+    name = 'prompt-injection-safety-gate';
+    category = 'security';
+    run(ctx) {
+        const { graph, code } = ctx;
+        const sinks = ctx.hasResult('sink-filter')
+            ? ctx.getResult('sink-filter').sinks
+            : graph.ir.taint.sinks;
+        if (sinks.length === 0)
+            return { droppedSafe: 0 };
+        const codeLines = code.split('\n');
+        let droppedSafe = 0;
+        const kept = sinks.filter(sink => {
+            if (sink.type !== 'prompt_injection')
+                return true;
+            const callCode = sink.code ?? codeLines[sink.line - 1] ?? '';
+            if (!callCode)
+                return true;
+            if (classifyPromptSink(callCode, codeLines) === 'safe') {
+                droppedSafe++;
+                return false;
+            }
+            return true;
+        });
+        if (droppedSafe > 0) {
+            sinks.length = 0;
+            sinks.push(...kept);
+        }
+        return { droppedSafe };
+    }
+}
+//# sourceMappingURL=prompt-injection-safety-gate-pass.js.map

package/dist/analysis/passes/prompt-injection-safety-gate-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-injection-safety-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/prompt-injection-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAUH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,CACL,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACrB,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACvB,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,GAAG,GAAG,IAAI,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,GAAG,GAAG,CAAC,CAAC;YACR,GAAG,IAAI,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,GAAG,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,KAAK,EAAE,CAAC;YACR,GAAG,IAAI,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM;QACpC,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACtD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,KAAK,GAAG,EAAE;IAC/C,OAAO,IAAI,MAAM,CAAC,MAAM,OAAO,kCAAkC,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,kFAAkF;AAClF,SAAS,oBAAoB,CAAC,OAAe,EAAE,SAAmB;IAChE,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,eAAe,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC;QACzF,OAAO,SAAS,CAAC,CAAC,+CAA+C;IACnE,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,GAAW,EAAE,SAAmB;IAChE,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/C,gEAAgE;QAChE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,SAAmB;IAEnB,MAAM,SAAS,GAAG,iCAAiC,CAAC;IACpD,IAAI,CAAyB,CAAC;IAC9B,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,GAAG,IAAI,CAAC;IAEnB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,GAAG,KAAK,EAAE,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/C,UAAU,GAAG,IAAI,CAAC;QAElB,oEAAoE;QACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACrD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,QAAQ,CAAC;QAE/D,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC5C,IAAI,SAAS,KAAK,MAAM;YAAE,OAAO,GAAG,KAAK,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,GAAG,GAAG,IAAI,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,GAAG,GAAG,CAAC,CAAC;YAAC,GAAG,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,GAAG,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YAAC,KAAK,EAAE,CAAC;YAAC,GAAG,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACjG,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM;QACrC,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,qDAAqD;AACrD,SAAS,iBAAiB,CAAC,OAAe,EAAE,MAAc;IACxD,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC;QAAE,OAAO,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,QAAgB,EAAE,MAAc;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,SAAmB;IAEnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,6BAA6B;IAG/B,IAAI,GAAG,8BAA8B,CAAC;IACtC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAE5B,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO,IAAI,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,IAAI,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;gBACvD,WAAW,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/analysis/passes/speculative-prompt-param-source-pass.d.ts

@@ -0,0 +1,67 @@
+/**
+ * SpeculativePromptParamSourcePass — cognium-dev #267
+ *
+ * OPT-IN, OFF-BY-DEFAULT. When `AnalyzerOptions.speculativeParamSources` is
+ * set, seeds function parameters as untrusted sources within functions that
+ * already contain a `prompt_injection` (CWE-1427) sink. This unblocks
+ * library / agent / SDK code whose untrusted entry point is a bare
+ * parameter (`func Ask(user string, client *LLM)`) — there is no in-file
+ * request source to seed taint, so the param → prompt-sink flow never fires
+ * under the deterministic default.
+ *
+ * This is a deliberately speculative, higher-FP heuristic. It is gated
+ * behind an explicit flag that defaults OFF, so the precision-sensitive
+ * benchmarks (OWASP / Juliet / SecuriBench) — which never set it — are
+ * unaffected and the 0%-FPR moat is preserved. Scope is bounded to
+ * parameters of functions containing a prompt-construction sink, not every
+ * function parameter.
+ *
+ * Runs after the sink gates (so the prompt_injection sink set is final) and
+ * before TaintPropagationPass, appending to the sink-filter source set so
+ * the normal flow generators connect param → sink. Pillar-I clean: no model
+ * invocation, no LLM identifiers in its surface (`prompt_injection` /
+ * CWE-1427 is the established deterministic taint category, #248).
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+import type { TaintFlowInfo, TypeInfo } from '../../types/index.js';
+/**
+ * Heuristic: does a string literal read like LLM *prompt / instruction*
+ * text rather than an incidental separator or short token? Used to keep the
+ * client-less construction detector off ordinary string concatenation
+ * (`"/" + name`, `"Hello, " + name`) that structurally looks identical but
+ * is not a prompt. Fires on instruction phrasing or a full sentence.
+ */
+export declare function looksLikePromptText(lit: string): boolean;
+/**
+ * Detect *client-less* prompt-construction flows (cognium-dev #267,
+ * speculative). A function that returns or assigns an instruction-literal
+ * concatenated with one of its own parameters builds a prompt from
+ * untrusted input even without an LLM-client call
+ * (`func BuildPrompt(user string) string { return "You are a bot. " + user }`).
+ * Emitted directly as `prompt_injection` (CWE-1427) flows — there is no
+ * call sink for the flow generators to match. Delimiter-wrapped concats are
+ * NOT instruction-concat, so the safe mirror produces no flow.
+ *
+ * Off-default: only invoked when `speculativeParamSources` is set (the
+ * benchmarks never enable it).
+ */
+export declare function detectPromptConstructionFlows(codeLines: string[], types: TypeInfo[]): TaintFlowInfo[];
+export interface SpeculativePromptParamSourceResult {
+    added: number;
+}
+/**
+ * A parameter is a plausible untrusted-text entry point when its type is
+ * unknown (untyped languages — Python/JS) or string-ish. Handle/dependency
+ * params (a client, context, writer, DB, logger — typically pointer or
+ * well-known infrastructure types) are skipped to keep the speculative FP
+ * surface off obviously-non-data parameters.
+ */
+export declare function looksLikeTextParam(type: string | null | undefined): boolean;
+export declare class SpeculativePromptParamSourcePass implements AnalysisPass<SpeculativePromptParamSourceResult> {
+    private readonly enabled;
+    readonly name = "speculative-prompt-param-source";
+    readonly category: "security";
+    constructor(enabled: boolean);
+    run(ctx: PassContext): SpeculativePromptParamSourceResult;
+}
+//# sourceMappingURL=speculative-prompt-param-source-pass.d.ts.map

package/dist/analysis/passes/speculative-prompt-param-source-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"speculative-prompt-param-source-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/speculative-prompt-param-source-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE9E,OAAO,KAAK,EAA0B,aAAa,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAiB5F;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASxD;AAOD;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,QAAQ,EAAE,GAChB,aAAa,EAAE,CAqCjB;AAED,MAAM,WAAW,kCAAkC;IACjD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAU3E;AAED,qBAAa,gCACX,YAAW,YAAY,CAAC,kCAAkC,CAAC;IAK/C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,QAAQ,CAAC,IAAI,qCAAqC;IAClD,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;gBAEX,OAAO,EAAE,OAAO;IAE7C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,kCAAkC;CAqD1D"}