circle-ir 3.193.0 → 3.195.0

package/dist/browser/circle-ir.js

@@ -9935,6 +9935,7 @@ var GO_KEYWORDS = /* @__PURE__ */ new Set([
 function buildGoDFG(tree) {
   const defs = [];
   const uses = [];
+  const extraChains = [];
   let defIdCounter = 1;
   let useIdCounter = 1;
   const scopeStack = [/* @__PURE__ */ new Map()];
@@ -9956,7 +9957,7 @@ function buildGoDFG(tree) {
     }
     const body2 = func2.childForFieldName("body");
     if (body2) {
-      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter });
+      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter }, extraChains);
       defIdCounter = defs.length + 1;
       useIdCounter = uses.length + 1;
     }
@@ -9971,6 +9972,15 @@ function buildGoDFG(tree) {
     }
   }
   const chains = computeChains(defs, uses);
+  const seen = new Set(chains.map((c) => `${c.from_def}|${c.to_def}|${c.via}`));
+  for (const ch of extraChains) {
+    const key = `${ch.from_def}|${ch.to_def}|${ch.via}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      chains.push(ch);
+    }
+  }
+  chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
   return { defs, uses, chains };
 }
 function extractGoParamDefs(params, defs, _startId, scopeStack) {
@@ -9995,28 +10005,47 @@ function extractGoParamDefs(params, defs, _startId, scopeStack) {
     }
   }
 }
-function processGoBlock(node, defs, uses, scopeStack, counters) {
+function processGoBlock(node, defs, uses, scopeStack, counters, extraChains = []) {
+  const linkMultiLineRhs = (right, useStart, useEnd, defStart, defEnd) => {
+    if (right.endPosition.row <= right.startPosition.row) return;
+    for (let ui = useStart; ui < useEnd; ui++) {
+      const u = uses[ui];
+      if (!u || u.def_id === null) continue;
+      for (let di = defStart; di < defEnd; di++) {
+        const d = defs[di];
+        if (d && d.kind === "local" && d.id !== u.def_id) {
+          extraChains.push({ from_def: u.def_id, to_def: d.id, via: u.variable });
+        }
+      }
+    }
+  };
   walkTree(node, (child) => {
     if (child.type === "short_var_declaration") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "var_declaration") {
       processGoVarDecl(child, defs, scopeStack, counters);
     } else if (child.type === "assignment_statement") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {
@@ -11331,7 +11360,11 @@ var DEFAULT_SOURCES = [
   { method: "Json", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Query", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Path", type: "http_path", severity: "high", return_tainted: true, languages: ["rust"] },
-  { method: "Form", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
+  // `Form<T>` decodes the urlencoded request *body* (`Query<T>` above is the
+  // query-string extractor), so it is http_body — retyped from http_param
+  // when the RustPlugin's http_body duplicate was removed, so the two
+  // surfaces no longer disagree. Matches Gin's `Context.PostForm`.
+  { method: "Form", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   // Rust std library
   { method: "var", class: "env", type: "env_input", severity: "medium", return_tainted: true },
   { method: "var_os", class: "env", type: "env_input", severity: "medium", return_tainted: true },
@@ -12609,7 +12642,11 @@ var DEFAULT_SINKS = [
   // Also match without receiver (destructured imports: const { exec } = require('child_process'))
   // `exec` is intentionally classless: catches Node.js child_process.exec AND
   // Java Runtime.exec (via `r.exec()` where heuristic can't resolve r → Runtime).
-  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0] },
+  // Excluded from Python: there, bare `exec(code)` is the code-execution
+  // builtin, registered below as code_injection / CWE-94. Before the exclusion
+  // a Python `exec(user_code)` matched both patterns and emitted two findings
+  // for one call — CWE-78 (wrong: no shell is involved) and CWE-94 (right).
+  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], exclude_languages: ["python"] },
   // `execSync`/`spawn`/`spawnSync`/`execFile` are Node-specific — language-scope them.
   { method: "execSync", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "spawn", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -12637,7 +12674,11 @@ var DEFAULT_SINKS = [
   // Note: classless { method: 'query' } removed — too many FPs (UriComponentsBuilder.query(), etc.)
   // SQL query calls are covered by class-specific patterns above (Connection, Pool, Client, JdbcTemplate)
   // Note: `raw` is shared with Python (Django ORM) — scoped to JS+TS to avoid leaking.
-  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Severity `critical` (not `high`) preserves what the JS plugin's duplicate
+  // builtin emitted before the #4 follow-up consolidation removed it: the
+  // plugin copy carried `critical`, which won the `findSinks` dedup slot via
+  // the +0.1 critical-severity confidence boost.
+  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // sqlite3 (npm) — Database/Statement methods. The JS plugin resolves
   // `const db = new sqlite3.Database(...); db.all(sql)` to the resolution
   // target `Connection.all`, so class-scoped patterns matching `Connection`
@@ -13196,10 +13237,30 @@ var DEFAULT_SINKS = [
   { method: "Sprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Printf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Errorf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  // `fmt.Fprintf` is deliberately dual-classified: this CWE-134 entry and the
+  // Go plugin's xss (CWE-79) entry both cover arg[1], so a tainted format
+  // string emits two findings. Unlike the logger case above, neither is
+  // redundant — CWE-134 holds for any writer, while CWE-79 is the actionable
+  // finding when the writer is an http.ResponseWriter (`fmt.Fprintf(w, taint)`
+  // is the standard Go reflected-XSS shape). Collapsing it requires deciding
+  // by the *type of arg[0]*, which sink patterns cannot express today: the
+  // options are a Go-specific gate (mirroring isSafeGoJsonUnmarshalCall) that
+  // emits xss only for a resolved ResponseWriter, or dropping one CWE and
+  // accepting either lost XSS recall or a mis-classified stderr write.
+  // Left as-is pending the Go corpus run — see tasks.md.
   { method: "Fprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [1], languages: ["go"] },
   // cognium-dev #264 — Go stdlib `log` package format-string entry points.
   // log.Printf / Fatalf / Panicf take the format string at arg[0]; tainted
   // format string reaches the same fmt.Sprintf machinery internally.
+  //
+  // These deliberately coexist with the Go plugin's log_injection (CWE-117)
+  // entries for the same methods, so such a call emits both. The Logger
+  // decision note in the Java log_injection section above does NOT apply
+  // here: it reasons about SLF4J-style APIs where the format string is a
+  // literal with `{}` placeholders, whereas Go's `log.Printf(fmt, ...)` takes
+  // a real format string that an attacker can control. CWE-117 covers the
+  // forged log line, CWE-134 the format string itself. Locked by
+  // tests/analysis/passes/format-string-additions.test.ts.
   { method: "Printf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Fatalf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Panicf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
@@ -13213,6 +13274,14 @@ var DEFAULT_SINKS = [
   { method: "cookie", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
   // Express: res.location(url) and res.redirect(url) — Location header.
   { method: "location", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // `redirect` is deliberately dual-classified: this crlf (CWE-113) entry
+  // coexists with the open_redirect (CWE-601) entry for js/ts, so a tainted
+  // redirect target emits two flows. That is intentional, not duplication —
+  // #189 Sprint 82 shipped a sink-type-aware flow dedup specifically so both
+  // survive ("res.redirect is both open_redirect AND crlf"), and #132 added a
+  // crlf recall test for the bare `res.redirect(req.query.url)` shape. Locked
+  // by issue-189-sprint82-open-redirect-cluster.test.ts and
+  // crlf-stage8-fp.test.ts — do not collapse without revisiting both tickets.
   { method: "redirect", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Go net/http: w.Header().Set(k, v) / Add(k, v) — first arg is the value
   // (Header is a map; the actual `value` is arg 1 of the call). We flag the
@@ -14133,18 +14202,28 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function sinkPatternAppliesTo(pattern, language) {
+  if (language === void 0) return true;
+  if (pattern.languages && pattern.languages.length > 0 && !pattern.languages.includes(language)) {
+    return false;
+  }
+  if (pattern.exclude_languages && pattern.exclude_languages.includes(language)) {
+    return false;
+  }
+  return true;
+}
 function expandPromisifyAliases(patterns, sourceLines, language) {
   if (!sourceLines || sourceLines.length === 0) return patterns;
   if (language !== "javascript" && language !== "typescript") return patterns;
   const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
   const innerToPattern = /* @__PURE__ */ new Map();
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language)) continue;
+    if (!sinkPatternAppliesTo(p, language)) continue;
     if (p.class !== void 0) continue;
     if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
   }
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language)) continue;
+    if (!sinkPatternAppliesTo(p, language)) continue;
     if (innerToPattern.has(p.method)) continue;
     innerToPattern.set(p.method, p);
   }
@@ -14178,7 +14257,7 @@ function expandIndirectEvalAliases(patterns, sourceLines, language) {
   const INDIRECT_EVAL_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*(eval|Function)\b(?!\s*\()/;
   const innerToPattern = /* @__PURE__ */ new Map();
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language)) continue;
+    if (!sinkPatternAppliesTo(p, language)) continue;
     if (p.class !== void 0) continue;
     if (p.method !== "eval" && p.method !== "Function") continue;
     if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
@@ -14886,9 +14965,7 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   return false;
 }
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
-  const patternsForLanguage = language === void 0 ? patterns : patterns.filter(
-    (p) => !p.languages || p.languages.length === 0 || p.languages.includes(language)
-  );
+  const patternsForLanguage = language === void 0 ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = /* @__PURE__ */ new Map();
   for (const call of calls) {
     for (const pattern of patternsForLanguage) {
@@ -15233,10 +15310,8 @@ var SINK_FQN_EXCLUSIONS = {
   ]
 };
 function matchesSinkPattern(call, pattern, typeHierarchy, language) {
-  if (pattern.languages && pattern.languages.length > 0 && language !== void 0) {
-    if (!pattern.languages.includes(language)) {
-      return false;
-    }
+  if (!sinkPatternAppliesTo(pattern, language)) {
+    return false;
   }
   const callMethodName = call.method_name;
   const patternMethod = pattern.method;
@@ -22117,107 +22192,30 @@ var JavaPlugin = class extends BaseLanguagePlugin {
         severity: "high",
         confidence: 0.9,
         returnTainted: true
-      },
-      // Servlet API
-      {
-        method: "getParameter",
-        class: "HttpServletRequest",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "getParameterValues",
-        class: "HttpServletRequest",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "getHeader",
-        class: "HttpServletRequest",
-        type: "http_header",
-        severity: "high",
-        confidence: 0.9,
-        returnTainted: true
-      },
-      {
-        method: "getCookies",
-        class: "HttpServletRequest",
-        type: "http_cookie",
-        severity: "high",
-        confidence: 0.9,
-        returnTainted: true
-      },
-      {
-        method: "getInputStream",
-        class: "HttpServletRequest",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.85,
-        returnTainted: true
-      },
-      {
-        method: "getReader",
-        class: "HttpServletRequest",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.85,
-        returnTainted: true
       }
+      // NOTE: the Servlet API call sources (`HttpServletRequest.getParameter`,
+      // `getParameterValues`, `getHeader`, `getCookies`, `getInputStream`,
+      // `getReader`) are registered identically in DEFAULT_SOURCES. Because
+      // `findSources` pushes one TaintSource per matching pattern with no
+      // dedup, the duplicates emitted a second, byte-identical source at every
+      // call site. Removed in the #4 follow-up consolidation — DEFAULT_SOURCES
+      // is the canonical registry (ADR-004).
     ];
   }
   /**
    * Java-specific taint sink patterns.
-   * These supplement the YAML configuration.
+   *
+   * Only patterns that have NO counterpart in `DEFAULT_SINKS` belong here —
+   * `DEFAULT_SINKS` (`analysis/config-loader.ts`) is the canonical registry
+   * (ADR-004). Duplicated entries were dead weight: `TaintMatcherPass` merges
+   * plugin builtins *after* the config patterns, and `findSinks` dedupes by
+   * `location:line:cwe` keeping the higher-confidence match, so the config
+   * copy always won the slot. Removed in the #4 follow-up consolidation
+   * (`Statement.execute*`, `Runtime.exec`, `ProcessBuilder.start`,
+   * `PrintWriter.write/println`, `DirContext.search`, `XPath.evaluate`).
    */
   getBuiltinSinks() {
     return [
-      // SQL Injection
-      {
-        method: "executeQuery",
-        class: "Statement",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "executeUpdate",
-        class: "Statement",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "execute",
-        class: "Statement",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      // Command Injection
-      {
-        method: "exec",
-        class: "Runtime",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "start",
-        class: "ProcessBuilder",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: []
-        // Constructor args are dangerous
-      },
       // Path Traversal
       {
         method: "FileInputStream",
@@ -22233,41 +22231,6 @@ var JavaPlugin = class extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      // XSS
-      {
-        method: "write",
-        class: "PrintWriter",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "println",
-        class: "PrintWriter",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
-      // LDAP Injection
-      {
-        method: "search",
-        class: "DirContext",
-        type: "ldap_injection",
-        cwe: "CWE-90",
-        severity: "high",
-        argPositions: [0, 1]
-      },
-      // XPath Injection
-      {
-        method: "evaluate",
-        class: "XPath",
-        type: "xpath_injection",
-        cwe: "CWE-643",
-        severity: "high",
-        argPositions: [0]
-      },
       // Deserialization
       {
         method: "readObject",
@@ -22826,42 +22789,17 @@ var JavaScriptPlugin = class extends BaseLanguagePlugin {
   }
   /**
    * JavaScript/TypeScript taint sink patterns.
+   *
+   * Only patterns that have NO counterpart in `DEFAULT_SINKS` belong here —
+   * `DEFAULT_SINKS` (`analysis/config-loader.ts`) is the canonical registry
+   * (ADR-004). Duplicated entries were dead weight: `TaintMatcherPass` merges
+   * plugin builtins *after* the config patterns, and `findSinks` dedupes by
+   * `location:line:cwe` keeping the higher-confidence match, so the config
+   * copy always won the slot. Removed in the #4 follow-up consolidation.
    */
   getBuiltinSinks() {
     return [
-      // Command Injection
-      {
-        method: "exec",
-        class: "child_process",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "execSync",
-        class: "child_process",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "spawn",
-        class: "child_process",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0, 1]
-      },
       // Code Injection
-      {
-        method: "eval",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "Function",
         type: "code_injection",
@@ -22885,46 +22823,7 @@ var JavaScriptPlugin = class extends BaseLanguagePlugin {
         argPositions: [0]
         // When first arg is string
       },
-      // Path Traversal
-      {
-        method: "readFileSync",
-        class: "fs",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "writeFileSync",
-        class: "fs",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "createReadStream",
-        class: "fs",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
       // XSS (DOM)
-      {
-        method: "innerHTML",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "outerHTML",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "document.write",
         type: "xss",
@@ -22976,13 +22875,6 @@ var JavaScriptPlugin = class extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "raw",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
       // Prisma ORM - unsafe raw query methods ($executeRaw/$queryRaw with template literals are safe/parameterized)
       {
         method: "$executeRawUnsafe",
@@ -22998,30 +22890,6 @@ var JavaScriptPlugin = class extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      // SSRF
-      {
-        method: "fetch",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "get",
-        class: "axios",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "request",
-        class: "http",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
       // NoSQL Injection
       {
         method: "find",
@@ -23030,13 +22898,6 @@ var JavaScriptPlugin = class extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "findOne",
-        type: "nosql_injection",
-        cwe: "CWE-943",
-        severity: "high",
-        argPositions: [0]
-      },
       // Prototype Pollution (JS-specific)
       {
         method: "merge",
@@ -23130,14 +22991,9 @@ var JavaScriptPlugin = class extends BaseLanguagePlugin {
       // =========================================================
       // Next.js Sinks
       // =========================================================
-      {
-        // Server-side redirect
-        method: "redirect",
-        type: "open_redirect",
-        cwe: "CWE-601",
-        severity: "high",
-        argPositions: [0]
-      },
+      // NOTE: classless `redirect` (CWE-601) lives in DEFAULT_SINKS, scoped to
+      // javascript+typescript — the duplicate builtin here never won the dedup
+      // slot (equal confidence, config pattern iterates first).
       {
         // Router push with user-controlled URL
         method: "push",
@@ -23419,13 +23275,15 @@ var PythonPlugin = class extends BaseLanguagePlugin {
         returnTainted: true
       },
       // Standard library sources
-      {
-        method: "input",
-        type: "user_input",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
+      //
+      // `input()` and `os.getenv()` are registered in DEFAULT_SOURCES as
+      // `io_input` / `env_input`. The duplicates that used to sit here typed
+      // them `user_input` / `env_var` — strings outside the published
+      // `SourceType` union, which reach consumers only because the merge in
+      // TaintMatcherPass casts `TaintSourcePattern.type` (a bare `string`) to
+      // `SourceType`. Both entries fired, so one call emitted two sources with
+      // two different type strings. Removed in favour of the canonical
+      // registry (ADR-004).
       {
         method: "argv",
         class: "sys",
@@ -23441,137 +23299,28 @@ var PythonPlugin = class extends BaseLanguagePlugin {
         severity: "medium",
         confidence: 0.85,
         returnTainted: true
-      },
-      {
-        method: "getenv",
-        class: "os",
-        type: "env_var",
-        severity: "medium",
-        confidence: 0.85,
-        returnTainted: true
-      },
-      // File reading
-      {
-        method: "read",
-        type: "file_input",
-        severity: "medium",
-        confidence: 0.8,
-        returnTainted: true
-      },
-      {
-        method: "readline",
-        type: "file_input",
-        severity: "medium",
-        confidence: 0.8,
-        returnTainted: true
-      },
-      {
-        method: "readlines",
-        type: "file_input",
-        severity: "medium",
-        confidence: 0.8,
-        returnTainted: true
       }
+      // NOTE: the file-reading sources (`read`, `readline`, `readlines` as
+      // file_input) are registered identically in DEFAULT_SOURCES. Since
+      // `findSources` pushes one TaintSource per matching pattern with no
+      // dedup, these duplicates emitted a second, byte-identical source at
+      // every call site. Removed in the #4 follow-up consolidation —
+      // DEFAULT_SOURCES is the canonical registry (ADR-004).
     ];
   }
   /**
    * Python taint sink patterns.
+   *
+   * Only patterns that have NO counterpart in `DEFAULT_SINKS` belong here —
+   * `DEFAULT_SINKS` (`analysis/config-loader.ts`) is the canonical registry
+   * (ADR-004). Duplicated entries were dead weight: `TaintMatcherPass` merges
+   * plugin builtins *after* the config patterns, and `findSinks` dedupes by
+   * `location:line:cwe` keeping the higher-confidence match, so the config
+   * copy always won the slot. Removed in the #4 follow-up consolidation.
    */
   getBuiltinSinks() {
     return [
-      // Command Injection
-      {
-        method: "system",
-        class: "os",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "popen",
-        class: "os",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "run",
-        class: "subprocess",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "call",
-        class: "subprocess",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "Popen",
-        class: "subprocess",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      // Code Injection
-      {
-        method: "eval",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "exec",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "compile",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "high",
-        argPositions: [0]
-      },
-      // SQL Injection
-      {
-        method: "execute",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "executemany",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "raw",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
       // Path Traversal
-      {
-        method: "open",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "read",
         class: "pathlib",
@@ -23581,13 +23330,6 @@ var PythonPlugin = class extends BaseLanguagePlugin {
         argPositions: [0]
       },
       // XSS (template injection)
-      {
-        method: "Markup",
-        type: "xss",
-        cwe: "CWE-79",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "safe",
         type: "xss",
@@ -23596,22 +23338,6 @@ var PythonPlugin = class extends BaseLanguagePlugin {
         argPositions: [0]
       },
       // SSRF
-      {
-        method: "get",
-        class: "requests",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "post",
-        class: "requests",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "urlopen",
         class: "urllib",
@@ -23639,34 +23365,11 @@ var PythonPlugin = class extends BaseLanguagePlugin {
         argPositions: [1]
       },
       // Deserialization
-      {
-        method: "loads",
-        class: "pickle",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "load",
-        class: "pickle",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "critical",
-        argPositions: [0]
-      },
       // NOTE: yaml.safe_load / yaml.SafeLoader are intentionally NOT sinks.
       // safe_load constructs only standard scalar/list/dict types and cannot
       // instantiate arbitrary Python objects, so it is not a CWE-502 sink
-      // (unlike yaml.load / yaml.unsafe_load / yaml.full_load below).
-      {
-        method: "load",
-        class: "yaml",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "critical",
-        argPositions: [0]
-      },
+      // (unlike yaml.load — registered in DEFAULT_SINKS — and
+      // yaml.unsafe_load / yaml.full_load below).
       {
         method: "unsafe_load",
         class: "yaml",
@@ -23825,34 +23528,17 @@ var RustPlugin = class extends BaseLanguagePlugin {
   getBuiltinSources() {
     return [
       // Actix-web request extractors
-      {
-        method: "Query",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Json",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Path",
-        type: "http_path",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Form",
-        type: "http_body",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
+      // NOTE: `Query` (http_param), `Json` (http_body) and `Path` (http_path)
+      // are registered identically in DEFAULT_SOURCES; the duplicates here
+      // emitted a second, byte-identical source at every call site
+      // (`findSources` has no dedup). Removed in the #4 follow-up
+      // consolidation — DEFAULT_SOURCES is the canonical registry (ADR-004).
+      // `Form` stays because the two surfaces disagree on its type
+      // `Form` is registered in DEFAULT_SOURCES, retyped there to `http_body`
+      // to match this entry (actix/axum `Form<T>` decodes the urlencoded
+      // request body, not the query string — `Query<T>` is the query one).
+      // The duplicate that used to sit here made every extractor emit two
+      // sources with different types.
       // Standard library sources
       {
         method: "args",
@@ -23902,20 +23588,22 @@ var RustPlugin = class extends BaseLanguagePlugin {
         severity: "medium",
         confidence: 0.8,
         returnTainted: true
-      },
-      // Network input
-      {
-        method: "read",
-        class: "TcpStream",
-        type: "network_input",
-        severity: "high",
-        confidence: 0.85,
-        returnTainted: true
       }
+      // NOTE: `TcpStream.read` (network_input) is registered identically in
+      // DEFAULT_SOURCES — duplicate removed in the #4 follow-up consolidation.
     ];
   }
   /**
    * Rust taint sink patterns.
+   *
+   * Only patterns that have NO counterpart in `DEFAULT_SINKS` belong here —
+   * `DEFAULT_SINKS` (`analysis/config-loader.ts`) is the canonical registry
+   * (ADR-004). Duplicated entries were dead weight: `TaintMatcherPass` merges
+   * plugin builtins *after* the config patterns, and `findSinks` dedupes by
+   * `location:line:cwe` keeping the higher-confidence match, so the config
+   * copy always won the slot. Removed in the #4 follow-up consolidation
+   * (`Command.arg/args`, classless `execute`, `File.open/create`,
+   * `serde_json.from_str/from_slice`, `reqwest.get/post`).
    */
   getBuiltinSinks() {
     return [
@@ -23928,30 +23616,7 @@ var RustPlugin = class extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      {
-        method: "arg",
-        class: "Command",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
-      {
-        method: "args",
-        class: "Command",
-        type: "command_injection",
-        cwe: "CWE-78",
-        severity: "critical",
-        argPositions: [0]
-      },
       // SQL Injection
-      {
-        method: "execute",
-        type: "sql_injection",
-        cwe: "CWE-89",
-        severity: "critical",
-        argPositions: [0]
-      },
       {
         method: "query",
         type: "sql_injection",
@@ -23967,22 +23632,6 @@ var RustPlugin = class extends BaseLanguagePlugin {
         argPositions: [0]
       },
       // Path Traversal
-      {
-        method: "open",
-        class: "File",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "create",
-        class: "File",
-        type: "path_traversal",
-        cwe: "CWE-22",
-        severity: "high",
-        argPositions: [0]
-      },
       {
         method: "read_to_string",
         class: "std::fs",
@@ -24022,40 +23671,6 @@ var RustPlugin = class extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
-      // Deserialization (with serde)
-      {
-        method: "from_str",
-        class: "serde_json",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "medium",
-        argPositions: [0]
-      },
-      {
-        method: "from_slice",
-        class: "serde_json",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "medium",
-        argPositions: [0]
-      },
-      // SSRF
-      {
-        method: "get",
-        class: "reqwest",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
-      {
-        method: "post",
-        class: "reqwest",
-        type: "ssrf",
-        cwe: "CWE-918",
-        severity: "high",
-        argPositions: [0]
-      },
       // Regex DoS
       {
         method: "new",
@@ -24170,14 +23785,13 @@ var BashPlugin = class extends BaseLanguagePlugin {
    */
   getBuiltinSources() {
     return [
-      // read built-in reads user input from stdin.
-      {
-        method: "read",
-        type: "io_input",
-        severity: "high",
-        confidence: 0.9,
-        returnTainted: true
-      },
+      // NOTE: no `read` entry here. The `read` builtin is covered precisely by
+      // `findBashTaintSources` (language-sources-pass, #213 slice 3), which
+      // emits `io_input` *with the bound variable name* for `read x`,
+      // `read -p "…" x`, `read -a arr`, bare `read` → `$REPLY`, etc. This
+      // pattern-based duplicate added a second, variable-less source on the
+      // same line, and typed it differently from the classless `read`
+      // (file_input) entry in DEFAULT_SOURCES that it collided with.
       // curl/wget output as taint sources for supply-chain attack patterns
       // (e.g., curl ... | sh, $(curl ...) piped to eval/bash).
       {
@@ -24203,14 +23817,11 @@ var BashPlugin = class extends BaseLanguagePlugin {
    */
   getBuiltinSinks() {
     return [
-      // Code / command injection via eval
-      {
-        method: "eval",
-        type: "code_injection",
-        cwe: "CWE-94",
-        severity: "critical",
-        argPositions: [0]
-      },
+      // NOTE: classless `eval` (CWE-94, critical) is registered unscoped in
+      // DEFAULT_SINKS and already covers Bash; the duplicate builtin that used
+      // to sit here never won the findSinks dedup slot (equal confidence, the
+      // config pattern iterates first). Removed in the #4 follow-up
+      // consolidation — DEFAULT_SINKS is the canonical registry (ADR-004).
       // Command injection: spawning a sub-shell with -c flag
       {
         method: "bash",
@@ -24652,30 +24263,15 @@ var GoPlugin = class extends BaseLanguagePlugin {
         returnTainted: true
       },
       // Gin framework
-      {
-        method: "Query",
-        class: "Context",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "Param",
-        class: "Context",
-        type: "http_path",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
-      {
-        method: "PostForm",
-        class: "Context",
-        type: "http_param",
-        severity: "high",
-        confidence: 0.95,
-        returnTainted: true
-      },
+      // NOTE: `Context.Query` (http_param) and `Context.Param` (http_path) are
+      // registered identically in DEFAULT_SOURCES; the duplicates here emitted
+      // a second, byte-identical source at every call site (`findSources` has
+      // no dedup). Removed in the #4 follow-up consolidation — DEFAULT_SOURCES
+      // is the canonical registry (ADR-004). `PostForm` stays because the two
+      // `Context.PostForm` is registered in DEFAULT_SOURCES as `http_body`,
+      // which is the accurate type — Gin reads it from the POST body, not the
+      // query string. The duplicate that used to sit here typed it
+      // `http_param`, so one call emitted two sources with different types.
       {
         method: "GetRawData",
         class: "Context",
@@ -24721,6 +24317,10 @@ var GoPlugin = class extends BaseLanguagePlugin {
   }
   /**
    * Go taint sink patterns.
+   *
+   * Only patterns that have NO counterpart in `DEFAULT_SINKS` belong here —
+   * `DEFAULT_SINKS` (`analysis/config-loader.ts`) is the canonical registry
+   * (ADR-004). See the #4 follow-up consolidation note on the other plugins.
    */
   getBuiltinSinks() {
     return [
@@ -24897,14 +24497,9 @@ var GoPlugin = class extends BaseLanguagePlugin {
         severity: "medium",
         argPositions: [0]
       },
-      {
-        method: "Decode",
-        class: "Decoder",
-        type: "deserialization",
-        cwe: "CWE-502",
-        severity: "medium",
-        argPositions: [0]
-      },
+      // NOTE: `Decoder.Decode` (CWE-502) lives in DEFAULT_SINKS at severity
+      // `high`, which outranked this duplicate's `medium` in the findSinks
+      // dedup — removed in the #4 follow-up consolidation.
       // Log Injection — `log.Printf("event=%s", userInput)` allows
       // CRLF/log forging when the format string interpolates user data.
       // CWE-117. (cognium-dev #107)
@@ -26254,6 +25849,7 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(...findPythonRangeCheckGuardSanitizers(code));
       additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
       additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
+      additionalSanitizers.push(...findPythonTraversalRejectGuardSanitizers(code));
       additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
       additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
@@ -28038,6 +27634,59 @@ function findPythonSetMembershipXssGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findPythonTraversalRejectGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const guardOpen = /^(\s*)if\s+(['"])(\.\.[/\\]?)\2\s+in\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*$/;
+  const terminator = /\b(return|raise|abort\s*\(|sys\.exit\s*\()/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = guardOpen.exec(lines[i2]);
+    if (!m) continue;
+    const guardIndent = m[1].length;
+    const guardedVar = m[4];
+    let bodyHasTerminator = false;
+    let blockEnd = -1;
+    const maxScan = Math.min(lines.length, i2 + 26);
+    for (let j = i2 + 1; j < maxScan; j++) {
+      const line = lines[j];
+      if (line.trim() === "") continue;
+      const indent = line.length - line.trimStart().length;
+      if (indent <= guardIndent) {
+        blockEnd = j - 1;
+        break;
+      }
+      if (terminator.test(line)) bodyHasTerminator = true;
+    }
+    if (blockEnd === -1) blockEnd = Math.min(lines.length - 1, i2 + 25);
+    if (!bodyHasTerminator) continue;
+    const guarded = /* @__PURE__ */ new Set([guardedVar]);
+    const assignRe = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=(?!=)\s*(.*)$/;
+    const mentionsGuarded = (text) => {
+      for (const name2 of guarded) {
+        if (new RegExp(`\\b${name2}\\b`).test(text)) return true;
+      }
+      return false;
+    };
+    for (let l = blockEnd + 2; l <= lines.length; l++) {
+      const lineText = lines[l - 1];
+      const assign = assignRe.exec(lineText);
+      if (assign) {
+        const target = assign[1];
+        const rhs = assign[2];
+        if (mentionsGuarded(rhs)) guarded.add(target);
+        else if (target !== guardedVar) guarded.delete(target);
+      }
+      if (!mentionsGuarded(lineText)) continue;
+      sanitizers.push({
+        type: "python_traversal_reject_guard",
+        method: "if",
+        line: l,
+        sanitizes: ["path_traversal"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findPythonDefusedXmlSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -28591,12 +28240,12 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
 function findJavaPathGetFileNameSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
-  const assignmentRe = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const assignmentRe2 = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const rhsHasGetFileNameRe = /\.\s*getFileName\s*\(\s*\)/;
   const rhsHasPathsChainRe = /\b(?:Paths\s*\.\s*get|Path\s*\.\s*of)\s*\(/;
   const candidates = [];
   for (let i2 = 0; i2 < lines.length; i2++) {
-    const m = assignmentRe.exec(lines[i2]);
+    const m = assignmentRe2.exec(lines[i2]);
     if (!m) continue;
     const rhs = m[2];
     if (!rhsHasGetFileNameRe.test(rhs)) continue;
@@ -33831,6 +33480,333 @@ var DeserializationSafetyGatePass = class {
   }
 };
 
+// src/analysis/passes/prompt-injection-safety-gate-pass.ts
+function isDelimiterLiteral(lit) {
+  const s = lit.trim();
+  if (s.length === 0) return true;
+  return /^<\/?[\w.-]+\s*\/?>$/.test(s) || /^\[\/?[\w.-]+\]$/.test(s) || /^`{1,3}[\w-]*$/.test(s) || /^"""[\w-]*$/.test(s) || /^[#*=_~-]{2,}$/.test(s) || /^<{2,}[\w-]*$/.test(s) || /^[\w-]*>{2,}$/.test(s);
+}
+function scanValue(code, start2) {
+  let depth = 0;
+  let str = null;
+  let out2 = "";
+  for (let i2 = start2; i2 < code.length; i2++) {
+    const c = code[i2];
+    if (str) {
+      out2 += c;
+      if (c === str && code[i2 - 1] !== "\\") str = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      str = c;
+      out2 += c;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      out2 += c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) break;
+      depth--;
+      out2 += c;
+      continue;
+    }
+    if (c === "," && depth === 0) break;
+    out2 += c;
+  }
+  return out2.trim();
+}
+function stringLiterals(expr) {
+  return [...expr.matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => m[1] ?? m[2] ?? "");
+}
+function hasIdentifier(expr) {
+  return /[A-Za-z_$][\w$]*/.test(expr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, " "));
+}
+function isPureLiteral(valueExpr) {
+  const stripped = valueExpr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, " ");
+  return !/[A-Za-z_$][\w$]*/.test(stripped);
+}
+function isInstructionConcat(valueExpr) {
+  if (!valueExpr.includes("+")) return false;
+  if (!hasIdentifier(valueExpr)) return false;
+  const lits = stringLiterals(valueExpr);
+  if (lits.length === 0) return false;
+  return !lits.every(isDelimiterLiteral);
+}
+function isMixedTemplate(v) {
+  const fstr = v.match(/\bf(["'])((?:\\.|(?!\1).)*)\1/);
+  if (fstr) {
+    const body2 = fstr[2];
+    if (/\{[^}]+\}/.test(body2) && /\w/.test(body2.replace(/\{[^}]*\}/g, ""))) return true;
+  }
+  const tmpl = v.match(/`([^`]*)`/);
+  if (tmpl) {
+    const body2 = tmpl[1];
+    if (/\$\{[^}]+\}/.test(body2) && /\w/.test(body2.replace(/\$\{[^}]*\}/g, ""))) return true;
+  }
+  return false;
+}
+function assignmentRe(varName, flags2 = "") {
+  return new RegExp(`\\b${varName}\\s*(?::=|(?<![=<>!])=(?!=))\\s*`, flags2);
+}
+function resolveAssignmentRHS(varName, codeLines) {
+  const re = assignmentRe(varName);
+  for (const line of codeLines) {
+    const m = line.match(re);
+    if (m && m.index !== void 0) {
+      return scanValue(line, m.index + m[0].length);
+    }
+  }
+  return void 0;
+}
+function classifyExpr(v) {
+  if (isMixedTemplate(v)) return "unsafe";
+  if (v.includes("+")) {
+    if (isInstructionConcat(v)) return "unsafe";
+    const lits = stringLiterals(v);
+    if (lits.length > 0 && lits.every(isDelimiterLiteral) && hasIdentifier(v)) return "safe";
+    return "unknown";
+  }
+  return "unknown";
+}
+function classifyContentPlacement(val, codeLines) {
+  const v = val.trim();
+  if (/^[A-Za-z_$][\w$]*$/.test(v)) {
+    const rhs = resolveAssignmentRHS(v, codeLines);
+    if (rhs === void 0) return "unknown";
+    return classifyExpr(rhs);
+  }
+  return classifyExpr(v);
+}
+function classifyPromptCall(callCode, codeLines) {
+  const contentRe = /["']?[Cc]ontent["']?\s*[:=]\s*/g;
+  let m;
+  let sawDynamic = false;
+  let allSafe = true;
+  while ((m = contentRe.exec(callCode)) !== null) {
+    const val = scanValue(callCode, m.index + m[0].length);
+    if (val === "" || isPureLiteral(val)) continue;
+    sawDynamic = true;
+    const ctx = callCode.slice(Math.max(0, m.index - 80), m.index);
+    const roleM = ctx.match(/["']?[Rr]ole["']?\s*[:=]\s*["'](\w+)["'][^"']*$/);
+    const role = roleM ? roleM[1].toLowerCase() : "user";
+    if (role === "system" || role === "assistant") return "unsafe";
+    const placement = classifyContentPlacement(val, codeLines);
+    if (placement === "unsafe") return "unsafe";
+    if (placement !== "safe") allSafe = false;
+  }
+  if (!sawDynamic) return "unknown";
+  return allSafe ? "safe" : "unknown";
+}
+function scanRhsAcrossLines(text, start2) {
+  let depth = 0;
+  let str = null;
+  let out2 = "";
+  for (let i2 = start2; i2 < text.length; i2++) {
+    const c = text[i2];
+    if (str) {
+      out2 += c;
+      if (c === str && text[i2 - 1] !== "\\") str = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      str = c;
+      out2 += c;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      out2 += c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) break;
+      depth--;
+      out2 += c;
+      continue;
+    }
+    if (c === "\n" && depth === 0) break;
+    out2 += c;
+  }
+  return out2.trim();
+}
+function resolveBuilderRhs(varName, joined) {
+  const re = assignmentRe(varName, "g");
+  const m = re.exec(joined);
+  if (m) return scanRhsAcrossLines(joined, m.index + m[0].length);
+  return void 0;
+}
+function collectBuilderRegion(callCode, joined) {
+  const parts2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...callCode.matchAll(/[A-Za-z_$][\w$]*/g)].map((x) => x[0]);
+  let budget = 40;
+  while (stack.length > 0 && budget-- > 0) {
+    const v = stack.pop();
+    if (seen.has(v)) continue;
+    seen.add(v);
+    const rhs = resolveBuilderRhs(v, joined);
+    if (rhs) {
+      parts2.push(rhs);
+      for (const mm of rhs.matchAll(/[A-Za-z_$][\w$]*/g)) stack.push(mm[0]);
+    }
+  }
+  return parts2.join("\n");
+}
+function classifyPromptSink(callCode, codeLines) {
+  const direct = classifyPromptCall(callCode, codeLines);
+  if (direct !== "unknown") return direct;
+  const region = collectBuilderRegion(callCode, codeLines.join("\n"));
+  if (!region) return "unknown";
+  return classifyPromptCall(region, codeLines);
+}
+var PromptInjectionSafetyGatePass = class {
+  name = "prompt-injection-safety-gate";
+  category = "security";
+  run(ctx) {
+    const { graph, code } = ctx;
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0) return { droppedSafe: 0 };
+    const codeLines = code.split("\n");
+    let droppedSafe = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "prompt_injection") return true;
+      const callCode = sink.code ?? codeLines[sink.line - 1] ?? "";
+      if (!callCode) return true;
+      if (classifyPromptSink(callCode, codeLines) === "safe") {
+        droppedSafe++;
+        return false;
+      }
+      return true;
+    });
+    if (droppedSafe > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { droppedSafe };
+  }
+};
+
+// src/analysis/passes/speculative-prompt-param-source-pass.ts
+function returnOrAssignRhs(text) {
+  const t = text.trim();
+  const ret = t.match(/^return\s+(.+?);?$/);
+  if (ret) return ret[1];
+  const asg = t.match(/^[A-Za-z_$][\w$.]*\s*(?::=|(?<![=<>!])=(?!=))\s*(.+?);?$/);
+  if (asg) return asg[1];
+  return void 0;
+}
+function looksLikePromptText(lit) {
+  const s = lit.trim();
+  if (/\b(you are|you're|assistant|system prompt|follow (the )?(policy|instructions|rules)|act as|your task|instructions?\s*:|ignore (all )?previous|do not reveal|respond (to|with|as)|answer the (question|user)|you (must|should|will)|helpful (ai|assistant))\b/i.test(s)) {
+    return true;
+  }
+  const words = s.split(/\s+/).filter(Boolean);
+  return words.length >= 4 && s.length >= 20;
+}
+function literalsOf(expr) {
+  return [...expr.matchAll(/"([^"]*)"|'([^']*)'|`([^`]*)`/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+}
+function detectPromptConstructionFlows(codeLines, types) {
+  const flows = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const type of types) {
+    for (const method of type.methods) {
+      const params = (method.parameters ?? []).map((p) => ({ name: p.name, line: p.line ?? method.start_line })).filter((p) => p.name && p.name !== "_");
+      if (params.length === 0) continue;
+      for (let line = method.start_line; line <= method.end_line; line++) {
+        const text = codeLines[line - 1] ?? "";
+        const rhs = returnOrAssignRhs(text);
+        if (!rhs || !isInstructionConcat(rhs)) continue;
+        if (!literalsOf(rhs).some(looksLikePromptText)) continue;
+        const param = params.find((p) => new RegExp(`\\b${p.name}\\b`).test(rhs));
+        if (!param) continue;
+        const key = `${param.line}|${line}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        flows.push({
+          source_line: param.line,
+          sink_line: line,
+          source_type: "http_body",
+          sink_type: "prompt_injection",
+          path: [
+            { variable: param.name, line: param.line, type: "source" },
+            { variable: param.name, line, type: "sink" }
+          ],
+          confidence: 1,
+          sanitized: false
+        });
+      }
+    }
+  }
+  return flows;
+}
+function looksLikeTextParam(type) {
+  if (!type) return true;
+  const t = type.trim();
+  if (t.startsWith("*") || t.startsWith("&")) return false;
+  if (/\b(Client|Context|Writer|Reader|Conn|DB|Logger|Handler|Server|Request|Response|Pool|Session|Engine|Service|Repository|Config)\b/.test(t)) {
+    return false;
+  }
+  return /(?:^|\b)(string|str|String|text|any|object|interface\{\}|\[\]byte|\[\]string|List\[str\]|Optional\[str\])(?:\b|$)/i.test(t) || // TS unions / plain identifiers without a handle keyword default to text.
+  /^[A-Za-z_$][\w$<>[\], |]*$/.test(t);
+}
+var SpeculativePromptParamSourcePass = class {
+  constructor(enabled) {
+    this.enabled = enabled;
+  }
+  enabled;
+  name = "speculative-prompt-param-source";
+  category = "security";
+  run(ctx) {
+    if (!this.enabled) return { added: 0 };
+    if (!ctx.hasResult("sink-filter")) return { added: 0 };
+    const sinkFilter = ctx.getResult("sink-filter");
+    const { types } = ctx.graph.ir;
+    const promptSinks = sinkFilter.sinks.filter(
+      (s) => s.type === "prompt_injection"
+    );
+    if (promptSinks.length === 0) return { added: 0 };
+    const existing = new Set(
+      sinkFilter.sources.filter((s) => typeof s.variable === "string").map((s) => `${s.variable}:${s.line}`)
+    );
+    const added = [];
+    for (const type of types) {
+      for (const method of type.methods) {
+        const hasPromptSink = promptSinks.some(
+          (s) => s.line >= method.start_line && s.line <= method.end_line
+        );
+        if (!hasPromptSink) continue;
+        for (const param of method.parameters) {
+          if (!param.name || param.name === "_") continue;
+          if (!looksLikeTextParam(param.type)) continue;
+          const line = param.line ?? method.start_line;
+          const key = `${param.name}:${line}`;
+          if (existing.has(key)) continue;
+          existing.add(key);
+          added.push({
+            // `http_body` reaches `prompt_injection` via the flow
+            // generators; a generic untrusted request-shaped type.
+            type: "http_body",
+            location: `speculative untrusted parameter '${param.name}' in ${method.name}`,
+            severity: "high",
+            line,
+            confidence: 1,
+            variable: param.name,
+            in_method: method.name
+          });
+        }
+      }
+    }
+    if (added.length > 0) {
+      sinkFilter.sources.push(...added);
+    }
+    return { added: added.length };
+  }
+};
+
 // src/analysis/passes/cli-main-reflection-suppress-pass.ts
 var REFLECTION_SINK_METHODS = /* @__PURE__ */ new Set([
   "forName",
@@ -44077,6 +44053,9 @@ async function analyze(code, filePath, language, options = {}) {
     if (!disabledPasses.has("sink-semantics")) pipeline.add(new SinkSemanticsPass());
     if (!disabledPasses.has("deserialization-safety-gate"))
       pipeline.add(new DeserializationSafetyGatePass(options.dependencyContext));
+    if (!disabledPasses.has("prompt-injection-safety-gate"))
+      pipeline.add(new PromptInjectionSafetyGatePass());
+    pipeline.add(new SpeculativePromptParamSourcePass(options.speculativeParamSources === true));
     if (!disabledPasses.has("cli-main-reflection-suppress"))
       pipeline.add(new CliMainReflectionSuppressPass());
     if (!disabledPasses.has("library-profile-sink-gate"))
@@ -44156,6 +44135,17 @@ async function analyze(code, filePath, language, options = {}) {
       flows: interProc.additionalFlows,
       interprocedural: interProc.interprocedural
     };
+    if (options.speculativeParamSources === true) {
+      const existingFlowKeys = new Set(
+        (taint.flows ?? []).map((f) => `${f.source_line}|${f.sink_line}|${f.sink_type}`)
+      );
+      const constructionFlows = detectPromptConstructionFlows(code.split("\n"), types).filter(
+        (f) => !existingFlowKeys.has(`${f.source_line}|${f.sink_line}|${f.sink_type}`)
+      );
+      if (constructionFlows.length > 0) {
+        taint.flows = [...taint.flows ?? [], ...constructionFlows];
+      }
+    }
     if (taint.flows && taint.flows.length > 0 && taint.sinks.length > 0) {
       const sinkTagsByKey = /* @__PURE__ */ new Map();
       for (const s of taint.sinks) {