cognium-dev 4.9.16 → 4.9.19

package/dist/cli.js

@@ -3232,7 +3232,7 @@ var Query = class {
   }
 };
 
-// node_modules/circle-ir/dist/core/parser.js
+// ../circle-ir/dist/core/parser.js
 var nodeModules = null;
 var moduleDir = null;
 async function getNodeModules() {
@@ -3472,7 +3472,7 @@ async function getDefaultLanguagePath(language) {
   }
   return `wasm/tree-sitter-${language}.wasm`;
 }
-// node_modules/circle-ir/dist/core/extractors/meta.js
+// ../circle-ir/dist/core/extractors/meta.js
 function extractMeta(code, tree, filePath, language) {
   const loc = countLinesOfCode(code);
   const hash = computeHash(code);
@@ -3554,7 +3554,7 @@ function extractPackage(tree, language) {
   }
   return null;
 }
-// node_modules/circle-ir/dist/core/extractors/types.js
+// ../circle-ir/dist/core/extractors/types.js
 function detectLanguage(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -5222,7 +5222,7 @@ function findChildByType(node, type) {
   }
   return null;
 }
-// node_modules/circle-ir/dist/core/extractors/calls.js
+// ../circle-ir/dist/core/extractors/calls.js
 function detectLanguageFromTree(tree, cache) {
   const rustStructs = getNodesFromCache(tree.rootNode, "struct_item", cache);
   const rustImpls = getNodesFromCache(tree.rootNode, "impl_item", cache);
@@ -6055,6 +6055,14 @@ function buildResolutionContext(tree, cache) {
       }
     }
   }
+  const resourceDecls = getNodesFromCache(tree.rootNode, "resource", cache);
+  for (const res of resourceDecls) {
+    const typeNode = res.childForFieldName("type");
+    const nameNode = res.childForFieldName("name");
+    if (typeNode && nameNode) {
+      context.localVarTypes.set(getNodeText(nameNode), getNodeText(typeNode));
+    }
+  }
   const imports = getNodesFromCache(tree.rootNode, "import_declaration", cache);
   for (const imp of imports) {
     const text = getNodeText(imp);
@@ -7336,7 +7344,7 @@ function extractGoTypeLastSegment(typeNode) {
   }
   return null;
 }
-// node_modules/circle-ir/dist/core/extractors/imports.js
+// ../circle-ir/dist/core/extractors/imports.js
 function detectLanguage2(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -8023,7 +8031,7 @@ function findGoChildByType(node, type) {
   }
   return null;
 }
-// node_modules/circle-ir/dist/core/extractors/exports.js
+// ../circle-ir/dist/core/extractors/exports.js
 function extractExports(types) {
   const exports = [];
   for (const type of types) {
@@ -8076,7 +8084,7 @@ function getVisibilityFromModifiers(modifiers) {
   }
   return "package";
 }
-// node_modules/circle-ir/dist/core/extractors/cfg.js
+// ../circle-ir/dist/core/extractors/cfg.js
 function detectLanguage3(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -8725,7 +8733,7 @@ function isGoStatement(node) {
   ]);
   return goStatementTypes.has(node.type);
 }
-// node_modules/circle-ir/dist/core/extractors/dfg.js
+// ../circle-ir/dist/core/extractors/dfg.js
 function detectLanguage4(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -8796,6 +8804,7 @@ function buildCSharpDFG(tree, cache) {
   ];
   for (const method of methods) {
     scopeStack.push(new Map);
+    const methodDefStart = defs.length;
     const params = method.childForFieldName("parameters");
     if (params) {
       for (const def of extractParameterDefs(params, defIdCounter)) {
@@ -8825,6 +8834,7 @@ function buildCSharpDFG(tree, cache) {
         }
       }
       const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
       uses.push(...bodyUses.uses);
       useIdCounter = bodyUses.nextId;
     }
@@ -9547,6 +9557,38 @@ function findReachingDef(name2, scopeStack) {
   }
   return null;
 }
+function resolveReassignedUses(methodDefs, methodUses) {
+  const defsByVar = new Map;
+  for (const def of methodDefs) {
+    if (def.kind !== "local" && def.kind !== "param")
+      continue;
+    const existing = defsByVar.get(def.variable);
+    if (existing)
+      existing.push(def);
+    else
+      defsByVar.set(def.variable, [def]);
+  }
+  for (const list of defsByVar.values()) {
+    if (list.length > 1)
+      list.sort((a, b) => a.line - b.line || a.id - b.id);
+  }
+  for (const use of methodUses) {
+    const list = defsByVar.get(use.variable);
+    if (!list || list.length < 2)
+      continue;
+    let strictlyBefore;
+    let sameLine;
+    for (const def of list) {
+      if (def.line < use.line)
+        strictlyBefore = def;
+      else if (def.line === use.line)
+        sameLine = def;
+    }
+    const reaching = strictlyBefore ?? sameLine;
+    if (reaching)
+      use.def_id = reaching.id;
+  }
+}
 function computeChains(defs, uses) {
   const chains = [];
   const defById = new Map;
@@ -10246,7 +10288,7 @@ function extractGoAddressableVarName(node) {
   }
   return null;
 }
-// node_modules/circle-ir/dist/core/extractors/runtime-registrations.js
+// ../circle-ir/dist/core/extractors/runtime-registrations.js
 var HTTP_VERB_METHODS = new Set([
   "get",
   "post",
@@ -10994,7 +11036,7 @@ function parseDistributedSliceAttribute(attrItem) {
     }
   };
 }
-// node_modules/circle-ir/dist/analysis/config-loader.js
+// ../circle-ir/dist/analysis/config-loader.js
 var DEFAULT_SOURCES = [
   { method: "getParameter", class: "HttpServletRequest", type: "http_param", severity: "high", return_tainted: true },
   { method: "getParameterValues", class: "HttpServletRequest", type: "http_param", severity: "high", return_tainted: true },
@@ -11533,8 +11575,8 @@ var DEFAULT_SINKS = [
   { method: "selectByExample", class: "*Mapper", type: "mybatis_mapper_call", cwe: "CWE-89", severity: "medium", arg_positions: [0], languages: ["java"] },
   { method: "exec", class: "Runtime", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "start", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [] },
-  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   { method: "execute", class: "DefaultExecutor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "CommandLine", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "parse", class: "CommandLine", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -12335,7 +12377,6 @@ var DEFAULT_SINKS = [
   { method: "fatal", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
   { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
   { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "step", class: "StepExecution", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "invokeMethod", class: "Script", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "evaluate", class: "Script", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
@@ -13097,7 +13138,33 @@ var DEFAULT_HEADER_RULES = [
     note: "Fires when the value is not a string literal (likely reflected from request)"
   }
 ];
-// node_modules/circle-ir/dist/analysis/arg-type-resolver.js
+// ../circle-ir/dist/analysis/literal-expression.js
+function isProvablyLiteralExpression(expr) {
+  let e = (expr ?? "").trim();
+  if (e.length === 0)
+    return false;
+  e = e.replace(/\/\/.*$/, "").replace(/;\s*$/, "").trim();
+  if (e.length === 0)
+    return false;
+  if (e.includes("${"))
+    return false;
+  if (/[+]\s*$/.test(e))
+    return false;
+  const stripped = e.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\$]|\\.)*`/g, "");
+  if (/["'`]/.test(stripped))
+    return false;
+  return /^[\s+()]*$/.test(stripped);
+}
+var DOM_ASSIGNMENT_SINK_METHODS = new Set([
+  "innerHTML",
+  "outerHTML",
+  "cssText",
+  "src",
+  "href",
+  "textContent"
+]);
+
+// ../circle-ir/dist/analysis/arg-type-resolver.js
 function findEnclosingType(callInMethod, types) {
   if (!callInMethod)
     return null;
@@ -13175,7 +13242,7 @@ function isArgvContainerType(rawType) {
   return /^(?:List|ArrayList|LinkedList|Collection|Iterable|Deque|Queue)\s*<\s*(?:String|CharSequence|java\.lang\.String)\b/.test(s);
 }
 
-// node_modules/circle-ir/dist/analysis/taint-matcher.js
+// ../circle-ir/dist/analysis/taint-matcher.js
 var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.args\b/, sourceType: "http_param" },
   { pattern: /\brequest\.form\b/, sourceType: "http_body" },
@@ -14050,7 +14117,7 @@ function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)
     if (!guards)
       continue;
     for (const g of guards) {
-      if (g.i >= sinkIdx || checked.has(g))
+      if (g.i > sinkIdx || checked.has(g))
         continue;
       checked.add(g);
       const block = csThenBlock(sourceLines, g.i, g.rest);
@@ -14193,6 +14260,21 @@ function isRegexReceiver(receiver, sourceLines) {
   const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
   return sourceLines.some((l) => decl.test(l));
 }
+function isDeclaredFunctionReference(arg, sourceLines) {
+  if (arg.literal !== null && arg.literal !== undefined)
+    return false;
+  if (!sourceLines)
+    return false;
+  const name2 = (arg.expression ?? "").trim();
+  if (!/^[A-Za-z_$][\w$]*$/.test(name2))
+    return false;
+  const n = escapeRe(name2);
+  const decls = [
+    new RegExp(`\\bfunction\\s+${n}\\s*\\(`),
+    new RegExp(`\\b(?:const|let|var)\\s+${n}\\s*=\\s*(?:async\\s+)?(?:function\\b|\\(|[A-Za-z_$][\\w$]*\\s*=>)`)
+  ];
+  return sourceLines.some((l) => decls.some((re) => re.test(l)));
+}
 function isFunctionCallbackArgument(arg) {
   if (arg.literal !== null && arg.literal !== undefined)
     return false;
@@ -14396,11 +14478,17 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         }
         if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
-          if (firstArg && isFunctionCallbackArgument(firstArg)) {
+          if (firstArg && (isFunctionCallbackArgument(firstArg) || isDeclaredFunctionReference(firstArg, sourceLines))) {
             continue;
           }
         }
-        if (pattern.type === "command_injection" && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
+        if (pattern.type === "xss" && (language === "javascript" || language === "typescript") && DOM_ASSIGNMENT_SINK_METHODS.has(call.method_name) && call.arguments.length > 0) {
+          const rhs = call.arguments.find((a) => a.position === 0);
+          if (rhs && isProvablyLiteralExpression(rhs.expression ?? "")) {
+            continue;
+          }
+        }
+        if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }
         if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {
@@ -15216,7 +15304,7 @@ function formatSanitizerMethod(call) {
   return `${call.method_name}()`;
 }
 
-// node_modules/circle-ir/dist/analysis/unresolved.js
+// ../circle-ir/dist/analysis/unresolved.js
 function detectUnresolved(calls, types, dfg) {
   const unresolved = [];
   unresolved.push(...detectVirtualDispatch(calls));
@@ -15380,7 +15468,7 @@ function formatCallCode(call) {
   }
   return `${call.method_name}(${args2})`;
 }
-// node_modules/circle-ir/dist/analysis/non-executable-lines.js
+// ../circle-ir/dist/analysis/non-executable-lines.js
 function isNonExecutableSourceLine(sourceCode, line, language) {
   if (!sourceCode || line < 1)
     return false;
@@ -15440,7 +15528,7 @@ function isNonExecutablePython(trimmed) {
   return false;
 }
 
-// node_modules/circle-ir/dist/analysis/sanitizer-index.js
+// ../circle-ir/dist/analysis/sanitizer-index.js
 var SANITIZER_SET_CACHE = new WeakMap;
 function getSanitizesSet(san) {
   let s = SANITIZER_SET_CACHE.get(san);
@@ -15454,7 +15542,7 @@ function sanitizerCoversSink(san, sinkType) {
   return getSanitizesSet(san).has(sinkType);
 }
 
-// node_modules/circle-ir/dist/analysis/dfg-walk.js
+// ../circle-ir/dist/analysis/dfg-walk.js
 var walkBackwardDefsMemo = new WeakMap;
 function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   const maxHops = options.maxHops ?? 32;
@@ -15507,7 +15595,7 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   return result;
 }
 
-// node_modules/circle-ir/dist/analysis/findings.js
+// ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
     http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
@@ -15538,7 +15626,7 @@ function sourceSemanticsAllowed(source, sinkType) {
   return true;
 }
 
-// node_modules/circle-ir/dist/analysis/findings-instrumentation.js
+// ../circle-ir/dist/analysis/findings-instrumentation.js
 var instrumentEnabled = false;
 function setFindingsInstrumentation(enabled) {
   instrumentEnabled = enabled;
@@ -15601,7 +15689,7 @@ function emitFindingsInstrumentation(filePath, findings, taint) {
   };
   console.error(`[findings-summary] ${JSON.stringify(summary)}`);
 }
-// node_modules/circle-ir/dist/graph/code-graph.js
+// ../circle-ir/dist/graph/code-graph.js
 class CodeGraph {
   ir;
   constructor(ir) {
@@ -15811,7 +15899,7 @@ class CodeGraph {
     return result;
   }
 }
-// node_modules/circle-ir/dist/resolution/type-hierarchy.js
+// ../circle-ir/dist/resolution/type-hierarchy.js
 class TypeHierarchyResolver {
   types = new Map;
   nameToFqn = new Map;
@@ -16383,7 +16471,7 @@ function registerCommonLibraries(resolver) {
   resolver.registerFactoryReturnType("HttpClients", "createSystem", "org.apache.http.impl.client.CloseableHttpClient");
   resolver.registerFactoryReturnType("HttpClients", "createMinimal", "org.apache.http.impl.client.MinimalHttpClient");
 }
-// node_modules/circle-ir/dist/resolution/symbol-table.js
+// ../circle-ir/dist/resolution/symbol-table.js
 class SymbolTable {
   exports = new Map;
   nameToFqns = new Map;
@@ -16606,7 +16694,7 @@ class SymbolTable {
     return "package";
   }
 }
-// node_modules/circle-ir/dist/resolution/cross-file.js
+// ../circle-ir/dist/resolution/cross-file.js
 function buildFileIndex(ir) {
   const callsByLine = new Map;
   for (const c of ir.calls) {
@@ -17104,10 +17192,12 @@ class CrossFileResolver {
     }
     return callers;
   }
-  findCrossFileTaintFlows() {
+  findCrossFileTaintFlows(deadline) {
     const flows = [];
     const seen = new Set;
     for (const [filePath, ir] of this.fileIRs) {
+      if (deadline?.())
+        break;
       for (const source of ir.taint.sources) {
         if (source.type === "interprocedural_param")
           continue;
@@ -17182,11 +17272,13 @@ class CrossFileResolver {
     }
     return flows;
   }
-  findInterproceduralTaintPaths() {
+  findInterproceduralTaintPaths(deadline) {
     const paths = [];
     const seen = new Set;
     const methodIndex = this.buildMethodIndex();
     for (const [callerFile, callerIR] of this.fileIRs) {
+      if (deadline?.())
+        break;
       const callerIdx = this.getFileIndex(callerIR);
       for (const type of callerIR.types) {
         for (const method of type.methods) {
@@ -17325,7 +17417,7 @@ class CrossFileResolver {
     }
     return paths;
   }
-  findFieldBindingTaintPaths() {
+  findFieldBindingTaintPaths(deadline) {
     const paths = [];
     const seen = new Set;
     if (this.fieldTaintInfo.size === 0)
@@ -17333,6 +17425,8 @@ class CrossFileResolver {
     const fieldExprRe = /^(\w+)\.(\w+)$/;
     const methodIndex = this.buildMethodIndex();
     for (const [callerFile, callerIR] of this.fileIRs) {
+      if (deadline?.())
+        break;
       const callerIdx = this.getFileIndex(callerIR);
       for (const type of callerIR.types) {
         const callerTypeFqn = callerIR.meta.package ? `${callerIR.meta.package}.${type.name}` : type.name;
@@ -17694,7 +17788,7 @@ class CrossFileResolver {
     return this.fieldTaintInfo.get(`${typeFqn}.${fieldName}`);
   }
 }
-// node_modules/circle-ir/dist/graph/project-graph.js
+// ../circle-ir/dist/graph/project-graph.js
 class ProjectGraph {
   files = new Map;
   _symbolTable = null;
@@ -17746,7 +17840,7 @@ class ProjectGraph {
     return this._resolver;
   }
 }
-// node_modules/circle-ir/dist/graph/analysis-pass.js
+// ../circle-ir/dist/graph/analysis-pass.js
 class AnalysisPipeline {
   passes = [];
   add(pass) {
@@ -17793,7 +17887,7 @@ class AnalysisPipeline {
     return { results, findings };
   }
 }
-// node_modules/circle-ir/dist/analysis/taint-propagation.js
+// ../circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
   for (const san of sanitizers) {
@@ -18068,7 +18162,7 @@ function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
 function buildTaintFlow(source, sink, taintInfo) {
   const path = [];
   path.push({
-    variable: taintInfo.variable,
+    variable: source.variable ?? taintInfo.variable,
     line: source.line,
     type: "source",
     description: `Tainted data enters via ${source.type}`
@@ -18095,7 +18189,7 @@ function buildTaintFlow(source, sink, taintInfo) {
     confidence: taintInfo.confidence * 0.9
   };
 }
-// node_modules/circle-ir/dist/analysis/constant-propagation/ast-utils.js
+// ../circle-ir/dist/analysis/constant-propagation/ast-utils.js
 function isKnown(cv) {
   return cv.type !== "unknown";
 }
@@ -18112,7 +18206,7 @@ function getNodeLine(node) {
   return node.startPosition.row + 1;
 }
 
-// node_modules/circle-ir/dist/analysis/constant-propagation/evaluator.js
+// ../circle-ir/dist/analysis/constant-propagation/evaluator.js
 class ExpressionEvaluator {
   source;
   getSymbol;
@@ -18382,7 +18476,7 @@ class ExpressionEvaluator {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/constant-propagation/patterns.js
+// ../circle-ir/dist/analysis/constant-propagation/patterns.js
 var TAINT_PATTERNS = [
   "request.getParameter",
   "request.getHeader",
@@ -18577,7 +18671,7 @@ var PROPAGATOR_METHODS = new Set([
   "decodeRequestString"
 ]);
 
-// node_modules/circle-ir/dist/analysis/constant-propagation/propagator.js
+// ../circle-ir/dist/analysis/constant-propagation/propagator.js
 class ConstantPropagator {
   symbols = new Map;
   tainted = new Set;
@@ -20434,7 +20528,7 @@ class ConstantPropagator {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/constant-propagation/index.js
+// ../circle-ir/dist/analysis/constant-propagation/index.js
 function analyzeConstantPropagation(tree, sourceCode, options = {}) {
   const propagator = new ConstantPropagator;
   return propagator.analyze(tree, sourceCode, options.additionalTaintPatterns ?? [], options.sanitizerMethods ?? [], options.taintedParameters ?? []);
@@ -20522,7 +20616,7 @@ function normalizeCondition(cond) {
   }
   return normalized;
 }
-// node_modules/circle-ir/dist/utils/logger.js
+// ../circle-ir/dist/utils/logger.js
 var LOG_LEVELS = {
   trace: 0,
   debug: 1,
@@ -20594,7 +20688,7 @@ var logger = {
   }
 };
 
-// node_modules/circle-ir/dist/analysis/per-file-finding-cap.js
+// ../circle-ir/dist/analysis/per-file-finding-cap.js
 var DEFAULT_PER_FILE_FINDING_CAP = 1000;
 var SATURATED_FILE_RULE_ID = "saturated-file";
 function applyPerFileFindingCap(filePath, findings, cap) {
@@ -20630,7 +20724,7 @@ function applyPerFileFindingCap(filePath, findings, cap) {
   return [advisory];
 }
 
-// node_modules/circle-ir/dist/analysis/confidence-filter.js
+// ../circle-ir/dist/analysis/confidence-filter.js
 function applyConfidenceFilter(findings, includeSpeculative) {
   if (includeSpeculative)
     return findings;
@@ -20640,7 +20734,7 @@ function isHighConfidence(finding) {
   return finding.confidence === undefined || finding.confidence === "high";
 }
 
-// node_modules/circle-ir/dist/analysis/library-api-surface-downgrade.js
+// ../circle-ir/dist/analysis/library-api-surface-downgrade.js
 var LIBRARY_API_SURFACE_TAG = "library-api-surface:caller-responsibility";
 function applyLibraryApiSurfaceDowngrade(findings) {
   return findings.map((f) => {
@@ -20657,7 +20751,7 @@ function applyLibraryApiSurfaceDowngrade(findings) {
   });
 }
 
-// node_modules/circle-ir/dist/analysis/note-coalescer.js
+// ../circle-ir/dist/analysis/note-coalescer.js
 var CLICKJACKING_PAIR = new Set(["missing-x-frame-options", "missing-csp-frame-ancestors"]);
 function levelRank(level) {
   return level === "error" ? 0 : level === "warning" ? 1 : 2;
@@ -20721,7 +20815,7 @@ function coalesceNoteLevelFindings(findings) {
   return out2;
 }
 
-// node_modules/circle-ir/dist/analysis/entry-point-detection.js
+// ../circle-ir/dist/analysis/entry-point-detection.js
 var TIER_1_METHOD_ANNOTATIONS = new Set([
   "RequestMapping",
   "GetMapping",
@@ -21378,7 +21472,7 @@ function methodIsRuntimeRegistrationHandler(method, regs) {
   return false;
 }
 
-// node_modules/circle-ir/dist/analysis/require-entry-path.js
+// ../circle-ir/dist/analysis/require-entry-path.js
 var RULE_ID_REQUIRE_ENTRY_PATH = "require-entry-path";
 var MAX_VISITED_METHODS = 2000;
 var TAINT_FLOW_RULE_IDS = new Set([
@@ -21767,7 +21861,7 @@ function normalizeDisabled(input) {
   return new Set(input);
 }
 
-// node_modules/circle-ir/dist/analysis/project-profile-transform.js
+// ../circle-ir/dist/analysis/project-profile-transform.js
 var DOWNGRADE_ELIGIBLE_RULE_IDS = new Set([
   "code_injection",
   "template_injection",
@@ -21829,7 +21923,7 @@ function applyProjectProfileTransform(findings, resolveProfile) {
   });
 }
 
-// node_modules/circle-ir/dist/languages/registry.js
+// ../circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
   extensionMap = new Map;
@@ -21876,7 +21970,7 @@ function registerLanguage(plugin) {
 function getLanguagePlugin(language) {
   return getLanguageRegistry().get(language);
 }
-// node_modules/circle-ir/dist/languages/plugins/base.js
+// ../circle-ir/dist/languages/plugins/base.js
 class BaseLanguagePlugin {
   parser = null;
   async initialize(parser) {
@@ -21937,7 +22031,7 @@ class BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/java.js
+// ../circle-ir/dist/languages/plugins/java.js
 class JavaPlugin extends BaseLanguagePlugin {
   id = "java";
   name = "Java";
@@ -22194,7 +22288,7 @@ class JavaPlugin extends BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/javascript.js
+// ../circle-ir/dist/languages/plugins/javascript.js
 class JavaScriptPlugin extends BaseLanguagePlugin {
   id = "javascript";
   name = "JavaScript/TypeScript";
@@ -22860,7 +22954,7 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/python.js
+// ../circle-ir/dist/languages/plugins/python.js
 class PythonPlugin extends BaseLanguagePlugin {
   id = "python";
   name = "Python";
@@ -23136,7 +23230,7 @@ class PythonPlugin extends BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/rust.js
+// ../circle-ir/dist/languages/plugins/rust.js
 class RustPlugin extends BaseLanguagePlugin {
   id = "rust";
   name = "Rust";
@@ -23369,7 +23463,7 @@ class RustPlugin extends BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/bash.js
+// ../circle-ir/dist/languages/plugins/bash.js
 class BashPlugin extends BaseLanguagePlugin {
   id = "bash";
   name = "Bash/Shell";
@@ -23575,7 +23669,7 @@ class BashPlugin extends BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/html.js
+// ../circle-ir/dist/languages/plugins/html.js
 class HtmlPlugin extends BaseLanguagePlugin {
   id = "html";
   name = "HTML";
@@ -23640,7 +23734,7 @@ class HtmlPlugin extends BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/vue.js
+// ../circle-ir/dist/languages/plugins/vue.js
 class VuePlugin extends BaseLanguagePlugin {
   id = "vue";
   name = "Vue";
@@ -23705,7 +23799,7 @@ class VuePlugin extends BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/go.js
+// ../circle-ir/dist/languages/plugins/go.js
 class GoPlugin extends BaseLanguagePlugin {
   id = "go";
   name = "Go";
@@ -23930,6 +24024,54 @@ class GoPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
+      {
+        method: "Create",
+        class: "os",
+        type: "path_traversal",
+        cwe: "CWE-22",
+        severity: "high",
+        argPositions: [0]
+      },
+      {
+        method: "OpenFile",
+        class: "os",
+        type: "path_traversal",
+        cwe: "CWE-22",
+        severity: "high",
+        argPositions: [0]
+      },
+      {
+        method: "Remove",
+        class: "os",
+        type: "path_traversal",
+        cwe: "CWE-22",
+        severity: "high",
+        argPositions: [0]
+      },
+      {
+        method: "RemoveAll",
+        class: "os",
+        type: "path_traversal",
+        cwe: "CWE-22",
+        severity: "high",
+        argPositions: [0]
+      },
+      {
+        method: "ReadFile",
+        class: "ioutil",
+        type: "path_traversal",
+        cwe: "CWE-22",
+        severity: "high",
+        argPositions: [0]
+      },
+      {
+        method: "WriteFile",
+        class: "ioutil",
+        type: "path_traversal",
+        cwe: "CWE-22",
+        severity: "high",
+        argPositions: [0]
+      },
       {
         method: "Fprintf",
         class: "fmt",
@@ -24354,7 +24496,7 @@ class GoPlugin extends BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/csharp.js
+// ../circle-ir/dist/languages/plugins/csharp.js
 class CSharpPlugin extends BaseLanguagePlugin {
   id = "csharp";
   name = "C#";
@@ -24413,7 +24555,7 @@ class CSharpPlugin extends BaseLanguagePlugin {
   }
 }
 
-// node_modules/circle-ir/dist/languages/plugins/index.js
+// ../circle-ir/dist/languages/plugins/index.js
 function registerBuiltinPlugins() {
   registerLanguage(new JavaPlugin);
   registerLanguage(new JavaScriptPlugin);
@@ -24425,7 +24567,7 @@ function registerBuiltinPlugins() {
   registerLanguage(new GoPlugin);
   registerLanguage(new CSharpPlugin);
 }
-// node_modules/circle-ir/dist/analysis/passes/cross-file-pass.js
+// ../circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
   run(projectGraph, sourceLines, options = {}) {
     const resolver = projectGraph.resolver;
@@ -24436,7 +24578,8 @@ class CrossFilePass {
     logger.info("cross-file: starting", { files: fileCount, budgetMs });
     const phase1Start = Date.now();
     logger.debug("cross-file: phase 1/4 starting (findCrossFileTaintFlows)");
-    const flows = resolver.findCrossFileTaintFlows();
+    const flows = resolver.findCrossFileTaintFlows(budgetExceeded);
+    let phase1Truncated = budgetExceeded();
     logger.info("cross-file: phase 1/4 done", {
       flows: flows.length,
       elapsedMs: Date.now() - phase1Start
@@ -24486,7 +24629,7 @@ class CrossFilePass {
         confidence: 0.7
       }];
     });
-    let exceeded = false;
+    let exceeded = phase1Truncated;
     const ipPaths = [];
     if (budgetExceeded()) {
       exceeded = true;
@@ -24498,7 +24641,7 @@ class CrossFilePass {
     } else {
       const phase2Start = Date.now();
       logger.debug("cross-file: phase 2/4 starting (findInterproceduralTaintPaths)");
-      const phase2 = resolver.findInterproceduralTaintPaths();
+      const phase2 = resolver.findInterproceduralTaintPaths(budgetExceeded);
       ipPaths.push(...phase2);
       logger.info("cross-file: phase 2/4 done", {
         paths: phase2.length,
@@ -24515,7 +24658,7 @@ class CrossFilePass {
     } else if (!exceeded) {
       const phase3Start = Date.now();
       logger.debug("cross-file: phase 3/4 starting (findFieldBindingTaintPaths)");
-      const phase3 = resolver.findFieldBindingTaintPaths();
+      const phase3 = resolver.findFieldBindingTaintPaths(budgetExceeded);
       ipPaths.push(...phase3);
       logger.info("cross-file: phase 3/4 done", {
         paths: phase3.length,
@@ -24751,7 +24894,7 @@ function findCrossInstanceAliasingPaths(projectGraph, _sourceLines) {
   return paths;
 }
 
-// node_modules/circle-ir/dist/analysis/html/html-extractor.js
+// ../circle-ir/dist/analysis/html/html-extractor.js
 var EVENT_HANDLER_ATTRS = new Set([
   "onclick",
   "ondblclick",
@@ -24906,7 +25049,7 @@ function stripQuotes2(text) {
   return text;
 }
 
-// node_modules/circle-ir/dist/analysis/html/html-attribute-security-pass.js
+// ../circle-ir/dist/analysis/html/html-attribute-security-pass.js
 function runHtmlAttributeSecurityChecks(rootNode, filePath) {
   const findings = [];
   walkForSecurityChecks(rootNode, filePath, findings);
@@ -25132,7 +25275,7 @@ function truncate(s, maxLen) {
   return s.length > maxLen ? s.slice(0, maxLen) + "..." : s;
 }
 
-// node_modules/circle-ir/dist/analysis/html/vue-template-xss-pass.js
+// ../circle-ir/dist/analysis/html/vue-template-xss-pass.js
 var DANGEROUS_BINDINGS = new Set([
   "v-html",
   "v-bind:innerhtml",
@@ -25252,7 +25395,7 @@ function collectTaintedNames(blocks) {
   return names;
 }
 
-// node_modules/circle-ir/dist/analysis/html/html-merge.js
+// ../circle-ir/dist/analysis/html/html-merge.js
 function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   const allTypes = [];
   const allCalls = [];
@@ -25402,7 +25545,7 @@ function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   };
 }
 
-// node_modules/circle-ir/dist/analysis/passes/taint-matcher-pass.js
+// ../circle-ir/dist/analysis/passes/taint-matcher-pass.js
 class TaintMatcherPass {
   name = "taint-matcher";
   category = "security";
@@ -25463,7 +25606,7 @@ class TaintMatcherPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/constant-propagation-pass.js
+// ../circle-ir/dist/analysis/passes/constant-propagation-pass.js
 class ConstantPropagationPass {
   tree;
   name = "constant-propagation";
@@ -25493,7 +25636,7 @@ class ConstantPropagationPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/language-sources-pass.js
+// ../circle-ir/dist/analysis/passes/language-sources-pass.js
 var JS_DOM_XSS_SINKS = [
   { pattern: /\.innerHTML\s*=/, type: "xss", cwe: "CWE-79", severity: "critical" },
   { pattern: /\.outerHTML\s*=/, type: "xss", cwe: "CWE-79", severity: "critical" },
@@ -25611,6 +25754,8 @@ class LanguageSourcesPass {
     additionalSources.push(...findCSharpBindingAttributeSources(code, language));
     additionalSources.push(...findCSharpMinimalApiSources(code, language));
     additionalSources.push(...findGoArgvSources(code, language));
+    additionalSources.push(...findGoArchiveEntrySources(code, language));
+    additionalSources.push(...findGoMultipartUploadSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -25681,6 +25826,7 @@ class LanguageSourcesPass {
     if (language === "go") {
       additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findGoHtmlTemplateImportSanitizers(code));
+      additionalSanitizers.push(...findGoPathContainmentGuardSanitizers(code));
       const goMisconfigFindings = findGoPatternFindings(code, graph.ir.meta.file);
       for (const finding of goMisconfigFindings) {
         ctx.addFinding(finding);
@@ -25718,6 +25864,7 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findPythonUrlAllowlistRedirectSanitizers(code));
       additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
       additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
+      additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, "python"));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
       for (const finding of pyMisconfigFindings) {
         ctx.addFinding(finding);
@@ -25821,12 +25968,16 @@ class LanguageSourcesPass {
         ctx.addFinding(finding);
       }
     }
+    if (language === "csharp") {
+      additionalSanitizers.push(...findCSharpFullPathStartsWithGuardSanitizers(code));
+    }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
       additionalSanitizers.push(...findJavaPathNormalizeStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaPathGetFileNameSanitizers(code));
       additionalSanitizers.push(...findJavaCanonicalPathStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
+      additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, "java"));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
@@ -26242,13 +26393,121 @@ function findGoArgvSources(sourceCode, language) {
   }
   return sources;
 }
+function findGoArchiveEntrySources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!/\bimport\b[\s\S]{0,400}?archive\/(?:zip|tar)|"archive\/(?:zip|tar)"/.test(sourceCode))
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const entryVars = new Set;
+  const zipRange = /\bfor\b[^;{]*?,\s*([A-Za-z_]\w*)\s*:?=\s*range\s+[A-Za-z_][\w.]*\.File\b/;
+  const tarNext = /\b([A-Za-z_]\w*)\s*,\s*[A-Za-z_]\w*\s*:?=\s*[A-Za-z_][\w.]*\.Next\s*\(\s*\)/;
+  for (const line of lines) {
+    const z = zipRange.exec(line);
+    if (z)
+      entryVars.add(z[1]);
+    const t = tarNext.exec(line);
+    if (t)
+      entryVars.add(t[1]);
+  }
+  if (entryVars.size === 0)
+    return sources;
+  const assignRe = /^\s*(?:var\s+)?([A-Za-z_]\w*)\s*(?::?=|=)\s*(.+?)\s*$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = assignRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    const [, lhs, rhs] = m;
+    let matched = null;
+    for (const v of entryVars) {
+      if (new RegExp(`(?<![\\w.])${v}\\s*\\.\\s*Name\\b`).test(rhs)) {
+        matched = v;
+        break;
+      }
+    }
+    if (!matched)
+      continue;
+    const lineNumber = i2 + 1;
+    if (sources.some((sc) => sc.line === lineNumber && sc.variable === lhs))
+      continue;
+    sources.push({
+      type: "file_input",
+      location: `${lhs} derived from archive entry name ${matched}.Name (Zip/Tar Slip)`,
+      severity: "high",
+      line: lineNumber,
+      confidence: 0.9,
+      variable: lhs
+    });
+  }
+  return sources;
+}
+function findGoMultipartUploadSources(sourceCode, language) {
+  if (language !== "go")
+    return [];
+  if (!/\.\s*(?:FormFile|MultipartForm|MultipartReader)\b/.test(sourceCode))
+    return [];
+  const sources = [];
+  const lines = sourceCode.split(`
+`);
+  const headerVars = new Set;
+  const formFileRe = /\b[A-Za-z_]\w*\s*,\s*([A-Za-z_]\w*)\s*(?:,\s*[A-Za-z_]\w*\s*)?:?=\s*[A-Za-z_][\w.]*\.\s*FormFile\s*\(/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = formFileRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    const v = m[1];
+    if (v === "_")
+      continue;
+    headerVars.add(v);
+    sources.push({
+      type: "http_param",
+      location: `${v}.Filename from r.FormFile (client-supplied upload filename)`,
+      severity: "high",
+      line: i2 + 1,
+      confidence: 0.9,
+      variable: v
+    });
+  }
+  const assignRe = /^\s*(?:var\s+)?([A-Za-z_]\w*)\s*(?::?=|=)\s*(.+?)\s*$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = assignRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    const [, lhs, rhs] = m;
+    if (lhs === "_")
+      continue;
+    let matched = null;
+    for (const v of headerVars) {
+      if (new RegExp(`(?<![\\w.])${v}\\s*\\.\\s*Filename\\b`).test(rhs)) {
+        matched = v;
+        break;
+      }
+    }
+    if (!matched)
+      continue;
+    const lineNumber = i2 + 1;
+    if (sources.some((sc) => sc.line === lineNumber && sc.variable === lhs))
+      continue;
+    sources.push({
+      type: "http_param",
+      location: `${lhs} derived from upload filename ${matched}.Filename`,
+      severity: "high",
+      line: lineNumber,
+      confidence: 0.9,
+      variable: lhs
+    });
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp")
     return [];
   const sources = [];
   const lines = sourceCode.split(`
 `);
-  const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+  const assignRe = /^\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
@@ -26954,6 +27213,12 @@ function findPythonReflectionInvocationSinks(sourceCode, taintedVars) {
   }
   return sinks;
 }
+function isProvablyLiteralDomAssignment(line) {
+  const eq = line.indexOf("=");
+  if (eq < 0)
+    return false;
+  return isProvablyLiteralExpression(line.slice(eq + 1));
+}
 function findJavaScriptDOMSinks(sourceCode, language) {
   if (!["javascript", "typescript"].includes(language))
     return [];
@@ -26982,6 +27247,9 @@ function findJavaScriptDOMSinks(sourceCode, language) {
           method = "cssText";
         else if (line.includes("style.textContent"))
           method = "textContent";
+        if (DOM_ASSIGNMENT_SINK_METHODS.has(method) && isProvablyLiteralDomAssignment(line)) {
+          continue;
+        }
         if (method === "document.write" || method === "document.writeln") {
           const argMatch = line.match(/document\.write(?:ln)?\s*\(\s*([^)]*)\)/);
           if (argMatch) {
@@ -27747,6 +28015,47 @@ function findGoMapAllowlistGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findGoPathContainmentGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const REJECT = /\b(?:continue|break|return|panic|fmt\.Errorf|errors\.New)\b/;
+  const guarded = new Map;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const hp = /if\s*!\s*strings\s*\.\s*HasPrefix\s*\(\s*([A-Za-z_]\w*)\s*,/.exec(line);
+    if (hp && guardRejects(lines, i2, REJECT, 4)) {
+      if (!guarded.has(hp[1]))
+        guarded.set(hp[1], i2 + 1);
+      continue;
+    }
+    const rel = /([A-Za-z_]\w*)\s*,\s*[A-Za-z_]\w*\s*:?=\s*filepath\s*\.\s*Rel\s*\(\s*[A-Za-z_]\w*\s*,\s*([A-Za-z_]\w*)\s*\)/.exec(line);
+    if (rel) {
+      const window2 = lines.slice(i2, i2 + 5).join(`
+`);
+      if (/\.\./.test(window2) && REJECT.test(window2)) {
+        if (!guarded.has(rel[2]))
+          guarded.set(rel[2], i2 + 1);
+      }
+    }
+  }
+  if (guarded.size === 0)
+    return sanitizers;
+  for (const [name2, guardLine] of guarded) {
+    const useRe = new RegExp(`(?<![\\w.])${name2}(?![\\w])`);
+    for (let l = guardLine;l < lines.length; l++) {
+      if (!useRe.test(lines[l]))
+        continue;
+      sanitizers.push({
+        type: "go_path_containment_guard",
+        method: "strings.HasPrefix",
+        line: l + 1,
+        sanitizes: ["path_traversal"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findGoHtmlTemplateImportSanitizers(code) {
   const sanitizers = [];
   const hasHtmlTemplate = /["\s]html\/template["\s]/.test(code);
@@ -28713,7 +29022,7 @@ function findJsPathResolveStartsWithGuardSanitizers(code) {
     for (let l = c.line;l < Math.min(lines.length, c.line + 6); l++) {
       if (!guardRe.test(lines[l]))
         continue;
-      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+      if (guardRejects(lines, l, terminatorRe, 2)) {
         guardLine = l + 1;
         break;
       }
@@ -28833,7 +29142,7 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
     for (let l = c.line;l < Math.min(lines.length, c.line + 6); l++) {
       if (!guardRe.test(lines[l]))
         continue;
-      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+      if (guardRejects(lines, l, terminatorRe, 2)) {
         guardLine = l + 1;
         break;
       }
@@ -28871,18 +29180,7 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
     const m = guardRe.exec(lines[i2]);
     if (!m)
       continue;
-    let hasTerminator = terminatorRe.test(lines[i2]);
-    if (!hasTerminator) {
-      for (let j = i2 + 1;j < Math.min(lines.length, i2 + 6); j++) {
-        if (terminatorRe.test(lines[j])) {
-          hasTerminator = true;
-          break;
-        }
-        if (lines[j].includes("}"))
-          break;
-      }
-    }
-    if (!hasTerminator)
+    if (!guardRejects(lines, i2, terminatorRe, 6))
       continue;
     const guarded = new Set([m[1]]);
     const mentions = (t) => {
@@ -28912,6 +29210,71 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function guardRejects(lines, i2, terminatorRe, window2) {
+  if (terminatorRe.test(lines[i2]))
+    return true;
+  const opens = (lines[i2].match(/\{/g) ?? []).length;
+  const closes = (lines[i2].match(/\}/g) ?? []).length;
+  if (opens > 0 && closes >= opens)
+    return false;
+  for (let j = i2 + 1;j < Math.min(lines.length, i2 + window2); j++) {
+    if (terminatorRe.test(lines[j]))
+      return true;
+    if (lines[j].includes("}"))
+      return false;
+  }
+  return false;
+}
+function findCSharpFullPathStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const assignRe = /^\s*(?:(?:var|string)\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  const fullPathRe = /\bPath\s*\.\s*GetFullPath\s*\(/;
+  const canonicalVars = new Set;
+  for (const line of lines) {
+    const a = assignRe.exec(line);
+    if (a && fullPathRe.test(a[2]))
+      canonicalVars.add(a[1]);
+  }
+  if (canonicalVars.size === 0)
+    return sanitizers;
+  const guardRe = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*StartsWith\s*\(/;
+  const terminatorRe = /\b(throw|return)\b/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = guardRe.exec(lines[i2]);
+    if (!m || !canonicalVars.has(m[1]))
+      continue;
+    if (!guardRejects(lines, i2, terminatorRe, 6))
+      continue;
+    const guarded = new Set([m[1]]);
+    const mentions = (t) => {
+      for (const n of guarded)
+        if (new RegExp(`\\b${n}\\b`).test(t))
+          return true;
+      return false;
+    };
+    for (let l = 0;l < lines.length; l++) {
+      const lt = lines[l];
+      const a = assignRe.exec(lt);
+      if (a) {
+        if (mentions(a[2]))
+          guarded.add(a[1]);
+        else if (a[1] !== m[1])
+          guarded.delete(a[1]);
+      }
+      if (mentions(lt)) {
+        sanitizers.push({
+          type: "csharp_fullpath_startswith_guard",
+          method: "GetFullPath",
+          line: l + 1,
+          sanitizes: ["path_traversal", "external_taint_escape"]
+        });
+      }
+    }
+  }
+  return sanitizers;
+}
 function findJavaPathGetFileNameSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -28955,6 +29318,41 @@ function findJavaPathGetFileNameSanitizers(code) {
   }
   return sanitizers;
 }
+function findCrlfWrapperFunctionSanitizers(code, language) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const declRe = language === "java" ? /^\s*(?:public|private|protected)?\s*(?:static\s+)?(?:final\s+)?(?:String|CharSequence)\s+([A-Za-z_]\w*)\s*\(/ : /^\s*def\s+([A-Za-z_]\w*)\s*\(/;
+  const stripRe = language === "java" ? /\.\s*replace(?:All)?\s*\(\s*(?:"[^"]*\\[rnt]|'\\[rnt]')/ : /(?:re\s*\.\s*sub\s*\(\s*r?["'][^"']*\\[rnt]|\.\s*replace\s*\(\s*["']\\[rnt])/;
+  const bodyWindow = 10;
+  const wrappers = new Set;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = declRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    const body2 = lines.slice(i2, Math.min(lines.length, i2 + bodyWindow)).join(`
+`);
+    if (stripRe.test(body2))
+      wrappers.add(m[1]);
+  }
+  if (wrappers.size === 0)
+    return sanitizers;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    for (const name2 of wrappers) {
+      if (declRe.test(lines[i2]) && new RegExp(`\\b${name2}\\s*\\(`).test(lines[i2]))
+        continue;
+      if (!new RegExp(`\\b${name2}\\s*\\(`).test(lines[i2]))
+        continue;
+      sanitizers.push({
+        type: language === "java" ? "java_wrapper_crlf_strip" : "python_wrapper_crlf_strip",
+        method: name2,
+        line: i2 + 1,
+        sanitizes: ["log_injection", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findJavaInlineCrlfStripLogSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -32550,7 +32948,7 @@ function findJsTemplateInjectionSstiFindings(code, file) {
   return findings;
 }
 
-// node_modules/circle-ir/dist/analysis/passes/source-semantics-pass.js
+// ../circle-ir/dist/analysis/passes/source-semantics-pass.js
 var DEMO_PATH_RE = /(?:^|\/)(?:demo|example|examples|samples|integration-tests|integration_tests)(?:\/|$)/i;
 var CONST_STRING_ASSIGN_RE = /^\s*(?:final\s+|static\s+final\s+)?[A-Za-z_][\w.<>\[\]]*\s+[A-Za-z_]\w*\s*=\s*"[^"]*"\s*;?\s*$/;
 var STATIC_FINAL_RE = /^\s*(?:public\s+|private\s+|protected\s+)?static\s+final\s+/;
@@ -32638,7 +33036,7 @@ class SourceSemanticsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
+// ../circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
 var SPECULATIVE_SOURCE_TYPES = new Set([
   "interprocedural_param",
   "constructor_field"
@@ -32663,7 +33061,7 @@ class LibraryProfileSourceGatePass {
         droppedByType: {}
       };
     }
-    const sources = graph.ir.taint.sources;
+    const sources = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sources : graph.ir.taint.sources;
     if (sources.length === 0) {
       return {
         profile,
@@ -32673,17 +33071,12 @@ class LibraryProfileSourceGatePass {
       };
     }
     const droppedByType = {};
-    const kept = [];
     for (const src of sources) {
       if (SPECULATIVE_SOURCE_TYPES.has(src.type)) {
         droppedByType[src.type] = (droppedByType[src.type] ?? 0) + 1;
-        continue;
       }
-      kept.push(src);
     }
-    const dropped = sources.length - kept.length;
-    sources.length = 0;
-    sources.push(...kept);
+    const dropped = 0;
     return {
       profile,
       applied: true,
@@ -32693,7 +33086,7 @@ class LibraryProfileSourceGatePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
+// ../circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
 var MYBATIS_SQL_ANNOTATIONS = new Set([
   "Select",
   "Update",
@@ -32920,7 +33313,7 @@ class MyBatisAnnotationSqlSinkPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/sink-filter-pass.js
+// ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 function escapeReSf(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -33027,7 +33420,32 @@ var PROTOCOL_CLIENT_PACKAGES = [
   "org.eclipse.paho"
 ];
 var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
+var JAVA_STDOUT_PRINT_RE = /\bSystem\s*\.\s*(?:out|err)\s*\.\s*(?:println|print|printf|write|append)\s*\(/;
 var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+var PROCESS_BUILDER_COMMAND_ARGV_FORM_RE = /\.\s*command\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+var SHELL_PROGRAMS = new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "ksh",
+  "dash",
+  "ash",
+  "csh",
+  "tcsh",
+  "fish",
+  "cmd",
+  "command",
+  "powershell",
+  "pwsh"
+]);
+var ARGV_FIRST_LITERAL_RE = /(?:\bnew\s+ProcessBuilder\s*\(|\.\s*command\s*\()\s*(?:Arrays\.asList\s*\(|List\.of\s*\(|Collections\.singletonList\s*\(|new\s+ArrayList\s*(?:<[^>]*>)?\s*\(\s*(?:Arrays\.asList\s*\()?|new\s+String\s*\[\s*\]\s*\{)?\s*"([^"]*)"/;
+function argvFirstLiteralIsShell(lineText) {
+  const m = ARGV_FIRST_LITERAL_RE.exec(lineText);
+  if (!m)
+    return false;
+  const base = m[1].split(/[\\/]/).pop().replace(/\.exe$/i, "").toLowerCase();
+  return SHELL_PROGRAMS.has(base);
+}
 var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b[^;]*;\s*(?:\/\/.*|\/\*.*)?$/;
 var JEXL_ENGINE_TYPES = new Set(["JexlEngine", "Jexl", "JxltEngine"]);
 var JEXL_EXPRESSION_TYPE_RE = /(?:Jexl)?(?:Expression|Script|Template)(?:Script)?$/;
@@ -33197,10 +33615,41 @@ function jsSsrfHostGuardedLines(code) {
   }
   return covered;
 }
+var CSHARP_ALLOWLIST_STRIP_RE = /\bRegex\s*\.\s*Replace\s*\([^,]*,\s*@?"\[\^(?:[A-Za-z0-9_\- ]|\\w|\\d|\\s)+\]"\s*,\s*@?"[A-Za-z0-9_]?"\s*\)/;
+function isUnwrittenLocalMapKeyRead(code, source) {
+  if (source.type !== "plugin_param")
+    return false;
+  const lines = code.split(`
+`);
+  const lineText = lines[source.line - 1] ?? "";
+  const read = /\b([A-Za-z_]\w*)\s*\.\s*get\s*\(\s*"([^"]*)"\s*\)/.exec(lineText);
+  if (!read)
+    return false;
+  const [, recv, key] = read;
+  const ctorRe = new RegExp(`\\b${recv}\\s*=\\s*new\\s+(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`);
+  if (!lines.some((l) => ctorRe.test(l)))
+    return false;
+  const escapeRe2 = new RegExp(`\\w\\s*\\([^)]*(?<![\\w.])${recv}(?![\\w.])[^)]*\\)`);
+  for (const l of lines) {
+    if (!escapeRe2.test(l))
+      continue;
+    const stripped = l.replace(new RegExp(`\\b${recv}\\s*\\.\\s*\\w+\\s*\\(`, "g"), "X(");
+    if (escapeRe2.test(stripped))
+      return false;
+  }
+  const putRe = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}"`);
+  if (lines.some((l) => putRe.test(l)))
+    return false;
+  return true;
+}
 var CSHARP_SANITIZER_RES = [
   { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
   { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: "xss" },
-  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" }
+  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "ldap_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "xpath_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "command_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "sql_injection" }
 ];
 function csharpSanitizedVarsByType(code) {
   const lines = code.split(`
@@ -33444,6 +33893,24 @@ function hasJavaImportFromPackage(packagePrefix, sourceLines) {
   }
   return false;
 }
+function hasSameOriginLiteralPrefix(lineText) {
+  const m = lineText.match(/\(\s*(['"`])([^'"`]*)\1\s*(?:\+|,|\))/);
+  const prefix = m?.[2];
+  if (prefix === undefined) {
+    const t = lineText.match(/\(\s*`([^`$]*)\$\{/);
+    if (!t)
+      return false;
+    return isSameOriginQueryPrefix(t[1]);
+  }
+  return isSameOriginQueryPrefix(prefix);
+}
+function isSameOriginQueryPrefix(prefix) {
+  if (!prefix.startsWith("/"))
+    return false;
+  if (prefix.startsWith("//"))
+    return false;
+  return prefix.includes("?");
+}
 
 class SinkFilterPass {
   name = "sink-filter";
@@ -33455,7 +33922,8 @@ class SinkFilterPass {
     const constProp = ctx.getResult("constant-propagation");
     const langSources = ctx.getResult("language-sources");
     const mergedSources = [...taintMatcher.sources, ...langSources.additionalSources];
-    const sources = ctx.code && ctx.language ? mergedSources.filter((s) => !isNonExecutableSourceLine(ctx.code, s.line, ctx.language)) : mergedSources;
+    const executableSources = ctx.code && ctx.language ? mergedSources.filter((s) => !isNonExecutableSourceLine(ctx.code, s.line, ctx.language)) : mergedSources;
+    const sources = ctx.code ? executableSources.filter((s) => !isUnwrittenLocalMapKeyRead(ctx.code, s)) : executableSources;
     const sinks = [...taintMatcher.sinks];
     for (const s of langSources.additionalSinks) {
       if (!sinks.some((x) => x.line === s.line && x.cwe === s.cwe && x.type === s.type)) {
@@ -33608,6 +34076,9 @@ class SinkFilterPass {
         if (setHeaderMatch) {
           return false;
         }
+        if (sink.type === "open_redirect" && hasSameOriginLiteralPrefix(sinkLineText)) {
+          return false;
+        }
         if (sink.method === "cookie" && sink.type === "crlf") {
           return false;
         }
@@ -33747,13 +34218,23 @@ class SinkFilterPass {
       filtered = filtered.filter((sink) => {
         if (sink.type !== "command_injection")
           return true;
-        if (sink.method !== "ProcessBuilder" && sink.method !== "start")
+        if (sink.method !== "ProcessBuilder" && sink.method !== "start" && sink.method !== "command") {
           return true;
+        }
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText))
+        const isCtorLine = /\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText);
+        const isCommandLine = /\.\s*command\s*\(/.test(sinkLineText);
+        if (!isCtorLine && !isCommandLine)
           return true;
-        if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText))
+        if (argvFirstLiteralIsShell(sinkLineText))
+          return true;
+        if (isCtorLine && PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText))
+          return false;
+        if (isCommandLine && PROCESS_BUILDER_COMMAND_ARGV_FORM_RE.test(sinkLineText)) {
           return false;
+        }
+        if (!isCtorLine)
+          return true;
         const ctorCall = irCalls.find((c) => c.method_name === "ProcessBuilder" && c.location.line === sink.line && (c.receiver === null || c.receiver === undefined));
         if (!ctorCall || ctorCall.arguments.length === 0)
           return true;
@@ -34023,6 +34504,15 @@ class SinkFilterPass {
     if (language === "java" && !HTML_CONTENT_TYPE_RE.test(ctx.code)) {
       filtered = filtered.filter((sink) => !(sink.type === "xss" && sink.method === "body"));
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "xss" || sink.class !== undefined)
+          return true;
+        return !JAVA_STDOUT_PRINT_RE.test(sourceLines[sink.line - 1] ?? "");
+      });
+    }
     if (language === "java") {
       const guardedLines = javaTraversalRejectGuardedLines(ctx.code);
       if (guardedLines.size > 0) {
@@ -34108,6 +34598,43 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (language === "csharp") {
+      const sourceLines = ctx.code.split(`
+`);
+      const constBaseClients = new Set;
+      const declRe = /\b(?:var|HttpClient)\s+([A-Za-z_]\w*)\s*=\s*new\s+HttpClient\s*\{[^}]*\bBaseAddress\s*=\s*new\s+Uri\s*\(\s*(?:@?"[^"]*"|\$?"[^"{}]*")\s*\)/;
+      for (const line of sourceLines) {
+        const m = declRe.exec(line);
+        if (m)
+          constBaseClients.add(m[1]);
+      }
+      if (constBaseClients.size > 0) {
+        const relativeLiteralArgRe = /\.\s*(?:Get|Post|Put|Patch|Delete|Send|GetString|GetByteArray|GetStream)\w*Async\s*\(\s*(?:@?\$?)"([^"]*)"/;
+        filtered = filtered.filter((sink) => {
+          if (sink.type !== "ssrf")
+            return true;
+          const text = sourceLines[sink.line - 1] ?? "";
+          let onConstClient = false;
+          for (const v of constBaseClients) {
+            if (new RegExp(`(?<![\\w])${escapeRegex(v)}\\s*\\.`).test(text)) {
+              onConstClient = true;
+              break;
+            }
+          }
+          if (!onConstClient)
+            return true;
+          const m = relativeLiteralArgRe.exec(text);
+          if (!m)
+            return true;
+          const lit = m[1];
+          if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(lit))
+            return true;
+          if (lit.startsWith("//"))
+            return true;
+          return false;
+        });
+      }
+    }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split(`
 `);
@@ -34724,7 +35251,7 @@ function isXPathQuoteEscapedOnLine(lineText, varName) {
   return seen > 0;
 }
 
-// node_modules/circle-ir/dist/analysis/passes/sink-semantics-pass.js
+// ../circle-ir/dist/analysis/passes/sink-semantics-pass.js
 function buildRegistry(entries) {
   const registry = new Map;
   for (const entry of entries) {
@@ -34772,7 +35299,7 @@ class SinkSemanticsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/dependency-versions.js
+// ../circle-ir/dist/analysis/dependency-versions.js
 function resolveFastjsonFromPom(pomXml) {
   if (!pomXml)
     return null;
@@ -34950,7 +35477,7 @@ function fileConfiguresSnakeYamlSafely(source) {
   return false;
 }
 
-// node_modules/circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
+// ../circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
 var FASTJSON_METHODS = new Set(["parseObject", "parse"]);
 var FASTJSON_CLASSES = new Set(["JSON", "JSONObject"]);
 var JACKSON_METHODS = new Set(["readValue", "convertValue", "treeToValue"]);
@@ -35027,7 +35554,7 @@ class DeserializationSafetyGatePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
+// ../circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
 function isDelimiterLiteral(lit) {
   const s = lit.trim();
   if (s.length === 0)
@@ -35270,7 +35797,7 @@ class PromptInjectionSafetyGatePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
+// ../circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
 function returnOrAssignRhs(text) {
   const t = text.trim();
   const ret = t.match(/^return\s+(.+?);?$/);
@@ -35396,7 +35923,7 @@ class SpeculativePromptParamSourcePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
+// ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
   "newInstance",
@@ -35584,7 +36111,7 @@ class CliMainReflectionSuppressPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
+// ../circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
 var DROPPED_SINK_TYPES = new Set([
   "log_injection"
 ]);
@@ -35658,7 +36185,7 @@ class LibraryProfileCwe22PathGatePass {
         droppedBySourceType: {}
       };
     }
-    const flows = graph.ir.taint.flows;
+    const flows = ctx.hasResult("interprocedural") ? ctx.getResult("interprocedural").additionalFlows : graph.ir.taint.flows;
     if (!flows || flows.length === 0) {
       return {
         profile,
@@ -35668,19 +36195,18 @@ class LibraryProfileCwe22PathGatePass {
       };
     }
     const droppedBySourceType = {};
-    const kept = [];
+    let tagged = 0;
     for (const flow of flows) {
       if (flow.sink_type === "path_traversal" && CWE22_SPECULATIVE_SOURCE_TYPES.has(flow.source_type)) {
         droppedBySourceType[flow.source_type] = (droppedBySourceType[flow.source_type] ?? 0) + 1;
-        continue;
+        const tags = flow.tags ?? [];
+        if (!tags.includes(LIBRARY_API_SURFACE_TAG)) {
+          flow.tags = [...tags, LIBRARY_API_SURFACE_TAG];
+        }
+        tagged++;
       }
-      kept.push(flow);
-    }
-    const dropped = flows.length - kept.length;
-    if (dropped > 0) {
-      flows.length = 0;
-      flows.push(...kept);
     }
+    const dropped = tagged;
     return {
       profile,
       applied: true,
@@ -35690,7 +36216,7 @@ class LibraryProfileCwe22PathGatePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
+// ../circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
 var XSS_NON_HTML_OUTPUT_CLASSES = new Set([
   "StringBuilder",
   "StringBuffer",
@@ -35771,7 +36297,7 @@ class LibraryProfileXssGatePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/taint-propagation-pass.js
+// ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
   category = "security";
@@ -35826,6 +36352,63 @@ class TaintPropagationPass {
       flows.push(f);
       return true;
     };
+    if (ctx.language === "python" && typeof ctx.code === "string") {
+      const pyTainted = buildPythonTaintedVars(ctx.code);
+      if (pyTainted.size > 0) {
+        for (const v of findPythonTrustBoundaryViolations(ctx.code, pyTainted)) {
+          const sink = sinks.find((sk) => sk.line === v.sinkLine && sk.type === "trust_boundary");
+          if (!sink)
+            continue;
+          const src = sources.find((sc) => sc.line === v.sourceLine) ?? sources.filter((sc) => sc.line <= v.sinkLine).sort((a, b) => b.line - a.line)[0];
+          if (!src)
+            continue;
+          if (constProp.unreachableLines.has(v.sinkLine))
+            continue;
+          pushIfNew({
+            source_line: src.line,
+            sink_line: v.sinkLine,
+            source_type: src.type,
+            sink_type: "trust_boundary",
+            path: [
+              { variable: src.variable ?? "session_key", line: src.line, type: "source" },
+              { variable: src.variable ?? "session_key", line: v.sinkLine, type: "sink" }
+            ],
+            confidence: (src.confidence ?? 1) * (sink.confidence ?? 1),
+            sanitized: false
+          });
+        }
+      }
+    }
+    if (ctx.language === "python" && typeof ctx.code === "string") {
+      const pyTainted = buildPythonTaintedVars(ctx.code);
+      if (pyTainted.size > 0) {
+        const xssSanitizerLines = sanitizers.filter((sa) => sa.sanitizes.includes("xss")).map((sa) => sa.line);
+        for (const rx of findPythonReturnXSSSinks(ctx.code, pyTainted)) {
+          if (constProp.unreachableLines.has(rx.sinkLine))
+            continue;
+          const sink = sinks.find((sk) => sk.line === rx.sinkLine && sk.type === "xss");
+          if (!sink)
+            continue;
+          const src = sources.filter((sc) => sc.line <= rx.sinkLine).sort((a, b) => b.line - a.line)[0];
+          if (!src)
+            continue;
+          if (xssSanitizerLines.some((l) => l >= src.line && l <= rx.sinkLine))
+            continue;
+          pushIfNew({
+            source_line: src.line,
+            sink_line: rx.sinkLine,
+            source_type: src.type,
+            sink_type: "xss",
+            path: [
+              { variable: src.variable ?? "response", line: src.line, type: "source" },
+              { variable: src.variable ?? "response", line: rx.sinkLine, type: "sink" }
+            ],
+            confidence: (src.confidence ?? 1) * (sink.confidence ?? 1),
+            sanitized: false
+          });
+        }
+      }
+    }
     const arrayFlows = detectArrayElementFlows(calls, sources, sinks, constProp.taintedArrayElements, constProp.unreachableLines, types) ?? [];
     for (const f of arrayFlows) {
       pushIfNew(f);
@@ -36515,6 +37098,108 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   }
   return false;
 }
+var MASKABLE_STRING_LANGUAGES = new Set(["python", "javascript", "typescript"]);
+function maskStringLiteralsForTokenScan(expr) {
+  let out2 = "";
+  let i2 = 0;
+  const braceExprs = (body2) => {
+    let acc = "";
+    for (let j = 0;j < body2.length; ) {
+      if (body2[j] === "{" && body2[j + 1] === "{") {
+        j += 2;
+        continue;
+      }
+      if (body2[j] === "}" && body2[j + 1] === "}") {
+        j += 2;
+        continue;
+      }
+      if (body2[j] === "{") {
+        j++;
+        let depth = 1;
+        let inner = "";
+        while (j < body2.length && depth > 0) {
+          if (body2[j] === "{")
+            depth++;
+          else if (body2[j] === "}") {
+            depth--;
+            if (depth === 0)
+              break;
+          }
+          inner += body2[j];
+          j++;
+        }
+        j++;
+        acc += " " + maskStringLiteralsForTokenScan(inner) + " ";
+        continue;
+      }
+      j++;
+    }
+    return acc;
+  };
+  while (i2 < expr.length) {
+    const ch = expr[i2];
+    if (ch === "`") {
+      i2++;
+      let acc = "";
+      while (i2 < expr.length && expr[i2] !== "`") {
+        if (expr[i2] === "\\") {
+          i2 += 2;
+          continue;
+        }
+        if (expr[i2] === "$" && expr[i2 + 1] === "{") {
+          i2 += 2;
+          let depth = 1;
+          let inner = "";
+          while (i2 < expr.length && depth > 0) {
+            if (expr[i2] === "{")
+              depth++;
+            else if (expr[i2] === "}") {
+              depth--;
+              if (depth === 0)
+                break;
+            }
+            inner += expr[i2];
+            i2++;
+          }
+          i2++;
+          acc += " " + maskStringLiteralsForTokenScan(inner) + " ";
+          continue;
+        }
+        i2++;
+      }
+      i2++;
+      out2 += " " + acc + " ";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      const pm = /[A-Za-z_][A-Za-z0-9_]*$/.exec(out2);
+      const prefix = pm ? pm[0] : "";
+      const isPrefix = prefix.length > 0 && /^[rRbBuUfF]+$/.test(prefix);
+      const isF = isPrefix && /[fF]/.test(prefix);
+      if (isPrefix)
+        out2 = out2.slice(0, out2.length - prefix.length) + " ";
+      const triple = expr.startsWith(ch.repeat(3), i2);
+      const delim = triple ? ch.repeat(3) : ch;
+      i2 += delim.length;
+      let body2 = "";
+      while (i2 < expr.length && !expr.startsWith(delim, i2)) {
+        if (expr[i2] === "\\") {
+          body2 += " ";
+          i2 += 2;
+          continue;
+        }
+        body2 += expr[i2];
+        i2++;
+      }
+      i2 += delim.length;
+      out2 += isF ? " " + braceExprs(body2) + " " : " ";
+      continue;
+    }
+    out2 += ch;
+    i2++;
+  }
+  return out2;
+}
 function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language, types) {
   const flows = [];
   const sourcesWithVar = sources.filter((s) => typeof s.variable === "string" && s.variable.length > 0);
@@ -36904,7 +37589,8 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         const expr = arg.expression;
         if (!expr)
           continue;
-        const exprIdentMatches = expr.match(/[\p{L}\p{N}_]+/gu);
+        const scannable = language !== undefined && MASKABLE_STRING_LANGUAGES.has(language) ? maskStringLiteralsForTokenScan(expr) : expr;
+        const exprIdentMatches = scannable.match(/[\p{L}\p{N}_]+/gu);
         let candidates = complexSources.length > 0 ? complexSources.slice() : null;
         if (exprIdentMatches) {
           for (const id of new Set(exprIdentMatches)) {
@@ -37054,7 +37740,7 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
   return sources[0];
 }
 
-// node_modules/circle-ir/dist/analysis/interprocedural.js
+// ../circle-ir/dist/analysis/interprocedural.js
 function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourcesOrSanitizers, sinksOrOptions, sanitizersArg, optionsArg = {}) {
   let graph;
   let sources;
@@ -37568,7 +38254,7 @@ function findTaintBridges2(result) {
   return bridges;
 }
 
-// node_modules/circle-ir/dist/analysis/passes/interprocedural-pass.js
+// ../circle-ir/dist/analysis/passes/interprocedural-pass.js
 class InterproceduralPass {
   name = "interprocedural";
   category = "security";
@@ -37774,7 +38460,7 @@ class InterproceduralPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/dead-code-pass.js
+// ../circle-ir/dist/analysis/passes/dead-code-pass.js
 class DeadCodePass {
   name = "dead-code";
   category = "reliability";
@@ -37850,7 +38536,7 @@ class DeadCodePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/missing-await-pass.js
+// ../circle-ir/dist/analysis/passes/missing-await-pass.js
 var ASYNC_METHODS = new Set([
   "readFile",
   "writeFile",
@@ -37929,7 +38615,7 @@ class MissingAwaitPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/n-plus-one-pass.js
+// ../circle-ir/dist/analysis/passes/n-plus-one-pass.js
 var HIGH_CONFIDENCE_DB_METHODS = new Set([
   "executeQuery",
   "executeUpdate",
@@ -38052,7 +38738,7 @@ class NPlusOnePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/missing-public-doc-pass.js
+// ../circle-ir/dist/analysis/passes/missing-public-doc-pass.js
 var TEST_PATH_RE = /[/._](test|tests|spec|specs|__tests?__|__mocks?__)[/._]/i;
 var UTIL_DIR_RE = /[/](utils?|helpers?|internal|private|common|shared)[/]/i;
 function hasDocCommentBefore(lines, startLine) {
@@ -38159,7 +38845,7 @@ class MissingPublicDocPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/todo-in-prod-pass.js
+// ../circle-ir/dist/analysis/passes/todo-in-prod-pass.js
 var TEST_PATH_RE2 = /[/._](test|tests|spec|specs|__tests?__|__mocks?__)[/._]/i;
 var MARKER_RE = /(?:\/\/|#|--|^\s*\*)\s*(TODO|FIXME|HACK|XXX)\b/i;
 function markerSeverity(marker) {
@@ -38205,7 +38891,7 @@ class TodoInProdPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/string-concat-loop-pass.js
+// ../circle-ir/dist/analysis/passes/string-concat-loop-pass.js
 var CONCAT_RE = /\b([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\+=/;
 var NUMERIC_VAR_RE = /^(i|j|k|n|m|x|y|z|count|sum|total|size|index|len|length|num|idx|score|counter|offset|pos|col|row|result|ret|value|acc|bits|byte|bytes|flag|flags|step|delta|diff|dist|min|max|avg|mean|page|line|err|error)$/i;
 var NUMERIC_SUFFIX_RE = /(Count|Sum|Total|Size|Index|Length|Offset|Position|Score|Counter|Num|Amount|Val|Idx|Len|Max|Min|Avg|Delta|Diff|Step|Flag|Flags|Bits|Byte|Bytes|Calls|Items|Nodes|Edges|Blocks|Lines|Chars|Entries|Records|Rows)$/;
@@ -38268,7 +38954,7 @@ class StringConcatLoopPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/sync-io-async-pass.js
+// ../circle-ir/dist/analysis/passes/sync-io-async-pass.js
 var BLOCKING_METHODS = new Set([
   "sleep"
 ]);
@@ -38329,7 +39015,7 @@ class SyncIoAsyncPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/unchecked-return-pass.js
+// ../circle-ir/dist/analysis/passes/unchecked-return-pass.js
 var MUST_CHECK_HIGH = new Set([
   "createNewFile",
   "mkdir",
@@ -38402,7 +39088,7 @@ class UncheckedReturnPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/null-deref-pass.js
+// ../circle-ir/dist/analysis/passes/null-deref-pass.js
 var NULL_EXPR_RE = /^\s*(null|None|undefined)\s*$/;
 function escRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -38484,7 +39170,7 @@ class NullDerefPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/resource-leak-pass.js
+// ../circle-ir/dist/analysis/passes/resource-leak-pass.js
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -38761,7 +39447,7 @@ class ResourceLeakPass {
   }
 }
 
-// node_modules/circle-ir/dist/graph/scope-graph.js
+// ../circle-ir/dist/graph/scope-graph.js
 function hasDeclKeyword(lineText, language) {
   switch (language) {
     case "java":
@@ -38801,7 +39487,7 @@ class ScopeGraph {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/variable-shadowing-pass.js
+// ../circle-ir/dist/analysis/passes/variable-shadowing-pass.js
 var SKIP_NAMES = new Set([
   "let",
   "const",
@@ -38959,7 +39645,7 @@ class VariableShadowingPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/leaked-global-pass.js
+// ../circle-ir/dist/analysis/passes/leaked-global-pass.js
 var SKIP_NAMES2 = new Set([
   "_",
   "e",
@@ -39046,7 +39732,7 @@ class LeakedGlobalPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/unused-variable-pass.js
+// ../circle-ir/dist/analysis/passes/unused-variable-pass.js
 var SKIP_NAMES3 = new Set([
   "_",
   "unused",
@@ -39191,7 +39877,7 @@ class UnusedVariablePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/dependency-fan-out-pass.js
+// ../circle-ir/dist/analysis/passes/dependency-fan-out-pass.js
 var DEFAULT_THRESHOLD = 20;
 
 class DependencyFanOutPass {
@@ -39223,7 +39909,7 @@ class DependencyFanOutPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/stale-doc-ref-pass.js
+// ../circle-ir/dist/analysis/passes/stale-doc-ref-pass.js
 var DOC_BLOCK_RE = /\/\*\*([\s\S]*?)\*\//g;
 var LINK_RE = /\{@link\s+([\w.#]+)/g;
 var SEE_RE = /@see\s+([\w.#]+)/g;
@@ -39302,7 +39988,7 @@ class StaleDocRefPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/infinite-loop-pass.js
+// ../circle-ir/dist/analysis/passes/infinite-loop-pass.js
 var EXIT_KEYWORDS = /\b(return|throw|raise|break|System\.exit|process\.exit|os\._exit|exit!\()\b/;
 var ITERATOR_LOOP_PATTERNS = [
   /\bfor\s*\([^)]*\s+of\s+/,
@@ -39421,7 +40107,7 @@ class InfiniteLoopPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/deep-inheritance-pass.js
+// ../circle-ir/dist/analysis/passes/deep-inheritance-pass.js
 var DEPTH_THRESHOLD = 5;
 var CYCLE_GUARD = 20;
 
@@ -39484,7 +40170,7 @@ class DeepInheritancePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/redundant-loop-pass.js
+// ../circle-ir/dist/analysis/passes/redundant-loop-pass.js
 var LENGTH_PATTERN = /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*(?:length|size\(\)|count\(\))/g;
 var LENGTH_PATTERN_METHODS = /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*(?:size\(\)|count\(\))/g;
 var OBJECT_STATIC_PATTERN = /\bObject\s*\.\s*(?:keys|values|entries)\s*\(\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*\)/g;
@@ -39607,7 +40293,7 @@ class RedundantLoopPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/unbounded-collection-pass.js
+// ../circle-ir/dist/analysis/passes/unbounded-collection-pass.js
 var GROW_METHODS = {
   java: new Set(["add", "put", "offer", "push", "addAll", "addFirst", "addLast", "enqueue", "insert"]),
   javascript: new Set(["push", "set", "add", "unshift", "append", "prepend"]),
@@ -39731,7 +40417,7 @@ class UnboundedCollectionPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/serial-await-pass.js
+// ../circle-ir/dist/analysis/passes/serial-await-pass.js
 var AWAIT_ASSIGN_RE = /(?:const|let|var)?\s*(\w+)\s*=\s*await\s/;
 var AWAIT_RE = /\bawait\s/;
 
@@ -39827,7 +40513,7 @@ class SerialAwaitPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/react-inline-jsx-pass.js
+// ../circle-ir/dist/analysis/passes/react-inline-jsx-pass.js
 var JSX_COMPONENT_RE = /<[A-Z][A-Za-z0-9]*/;
 var INLINE_OBJECT_RE = /\s([A-Za-z][A-Za-z0-9_]*)=\{\{/g;
 var INLINE_ARROW_RE = /\s([A-Za-z][A-Za-z0-9_]*)=\{(?:\(|[A-Za-z_$]).*?=>/g;
@@ -39931,7 +40617,7 @@ class ReactInlineJsxPass {
   }
 }
 
-// node_modules/circle-ir/dist/graph/exception-flow-graph.js
+// ../circle-ir/dist/graph/exception-flow-graph.js
 class ExceptionFlowGraph2 {
   pairs;
   catchEntryIds;
@@ -39982,7 +40668,7 @@ class ExceptionFlowGraph2 {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/swallowed-exception-pass.js
+// ../circle-ir/dist/analysis/passes/swallowed-exception-pass.js
 var MEANINGFUL_ACTION_RE = /\b(throw|raise|log|logger|console\.(error|warn|log|debug|info)|System\.(out|err)\.|print(?:ln|f)?|warn|error|debug|info|fatal|LOGGER|LOG|logging\.(warning|error|debug|info|critical))\b|\breturn\s+\S/;
 
 class SwallowedExceptionPass {
@@ -40080,7 +40766,7 @@ class SwallowedExceptionPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/broad-catch-pass.js
+// ../circle-ir/dist/analysis/passes/broad-catch-pass.js
 var JAVA_BROAD_RE = /catch\s*\(\s*(Exception|Throwable|RuntimeException|Error)\s/;
 var PYTHON_BROAD_RE = /^\s*except\s*:|except\s+(Exception|BaseException)\b/;
 
@@ -40136,7 +40822,7 @@ class BroadCatchPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/unhandled-exception-pass.js
+// ../circle-ir/dist/analysis/passes/unhandled-exception-pass.js
 var JS_THROW_RE = /^\s*throw\s+/;
 var PYTHON_RAISE_RE = /^\s*raise\b/;
 function isValidationThrow(lines, throwLine) {
@@ -40306,7 +40992,7 @@ class UnhandledExceptionPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/double-close-pass.js
+// ../circle-ir/dist/analysis/passes/double-close-pass.js
 var RESOURCE_CTORS2 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40421,7 +41107,7 @@ class DoubleClosePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/use-after-close-pass.js
+// ../circle-ir/dist/analysis/passes/use-after-close-pass.js
 var RESOURCE_CTORS3 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40529,7 +41215,7 @@ class UseAfterClosePass {
   }
 }
 
-// node_modules/circle-ir/dist/graph/dominator-graph.js
+// ../circle-ir/dist/graph/dominator-graph.js
 function computeRPO(cfg, entryId) {
   const outgoing = new Map;
   for (const edge of cfg.edges) {
@@ -40694,7 +41380,7 @@ class DominatorGraph2 {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/cleanup-verify-pass.js
+// ../circle-ir/dist/analysis/passes/cleanup-verify-pass.js
 var RESOURCE_CTORS4 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40819,7 +41505,7 @@ class CleanupVerifyPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/missing-override-pass.js
+// ../circle-ir/dist/analysis/passes/missing-override-pass.js
 class MissingOverridePass {
   name = "missing-override";
   category = "maintainability";
@@ -40906,7 +41592,7 @@ class MissingOverridePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/unused-interface-method-pass.js
+// ../circle-ir/dist/analysis/passes/unused-interface-method-pass.js
 class UnusedInterfaceMethodPass {
   name = "unused-interface-method";
   category = "maintainability";
@@ -40949,7 +41635,7 @@ class UnusedInterfaceMethodPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/blocking-main-thread-pass.js
+// ../circle-ir/dist/analysis/passes/blocking-main-thread-pass.js
 var HTTP_DECORATORS = new Set([
   "Get",
   "Post",
@@ -40988,6 +41674,18 @@ var CRYPTO_BLOCKING_METHODS = new Set([
   "deriveKeySync"
 ]);
 var SYNC_SUFFIX_RE2 = /Sync$/;
+var ROUTER_METHODS = new Set([
+  "get",
+  "post",
+  "put",
+  "patch",
+  "delete",
+  "all",
+  "options",
+  "head",
+  "use"
+]);
+var FN_ARG_PARAMS_RE = /^(?:async\s+)?(?:function\s*[\w$]*\s*)?\(([^)]*)\)\s*(?:=>|\{)|^(?:async\s+)?([A-Za-z_$][\w$]*)\s*=>/;
 
 class BlockingMainThreadPass {
   name = "blocking-main-thread";
@@ -41010,8 +41708,10 @@ class BlockingMainThreadPass {
         }
       }
     }
-    if (handlerRanges.length === 0)
+    const inlineHandlers = this.collectInlineHandlerNames(graph.ir.calls);
+    if (handlerRanges.length === 0 && inlineHandlers.size === 0) {
       return { blockingInHandlers: [] };
+    }
     const blockingInHandlers = [];
     for (const call of graph.ir.calls) {
       const name2 = call.method_name;
@@ -41020,7 +41720,8 @@ class BlockingMainThreadPass {
       if (!isCrypto && !isSyncSuffix)
         continue;
       const line = call.location.line;
-      const range = handlerRanges.find((r) => line >= r.start && line <= r.end);
+      const enclosing = call.in_method ?? null;
+      const range = handlerRanges.find((r) => line >= r.start && line <= r.end) ?? (enclosing && inlineHandlers.has(enclosing) ? { start: line, end: line, name: enclosing } : undefined);
       if (!range)
         continue;
       const reason = isCrypto ? "crypto" : "sync-suffix";
@@ -41042,6 +41743,24 @@ class BlockingMainThreadPass {
     }
     return { blockingInHandlers };
   }
+  collectInlineHandlerNames(calls) {
+    const names = new Set;
+    for (const call of calls) {
+      if (!ROUTER_METHODS.has(call.method_name))
+        continue;
+      for (const arg of call.arguments) {
+        const match = FN_ARG_PARAMS_RE.exec((arg.expression ?? "").trim());
+        if (!match)
+          continue;
+        const params = (match[1] ?? match[2] ?? "").split(",").map((p) => p.trim().toLowerCase()).filter((p) => p.length > 0);
+        if (params.some((p) => HANDLER_PARAM_NAMES.has(p))) {
+          names.add(`${call.method_name}_handler`);
+          break;
+        }
+      }
+    }
+    return names;
+  }
   isRequestHandler(method) {
     if (method.annotations.some((a) => HTTP_DECORATORS.has(a)))
       return true;
@@ -41052,7 +41771,7 @@ class BlockingMainThreadPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/excessive-allocation-pass.js
+// ../circle-ir/dist/analysis/passes/excessive-allocation-pass.js
 var ALLOC_PATTERNS = {
   javascript: /\bnew\s+(Array|Map|Set|Object|WeakMap|WeakSet|Error|RegExp|Date|Buffer|Uint8Array|Int8Array|Float32Array|ArrayBuffer)\s*[(<]|\bArray\.from\s*\(|\bstructuredClone\s*\(|\bObject\.create\s*\(/,
   typescript: /\bnew\s+(Array|Map|Set|Object|WeakMap|WeakSet|Error|RegExp|Date|Buffer|Uint8Array|Int8Array|Float32Array|ArrayBuffer)\s*[(<]|\bArray\.from\s*\(|\bstructuredClone\s*\(|\bObject\.create\s*\(/,
@@ -41119,7 +41838,7 @@ class ExcessiveAllocationPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/missing-stream-pass.js
+// ../circle-ir/dist/analysis/passes/missing-stream-pass.js
 var JS_WHOLE_LOAD_RE = /\b(?:readFileSync|fs\.readFile\b|response\.text\b|response\.json\b|res\.text\b|res\.json\b|body\.text\b|body\.json\b)\s*\(/;
 var JS_STREAM_RE = /\.pipe\s*\(|\.on\s*\(\s*['"]data['"]|for\s+await\s*\(|\bcreateReadStream\b|\bstream\b/i;
 var JAVA_WHOLE_READ_RE = /\bFiles\.readAllBytes\s*\(|\bFiles\.readAllLines\s*\(|\bFiles\.readString\s*\(|\bnew\s+BufferedReader\s*\(|\bFileInputStream\b/;
@@ -41266,7 +41985,7 @@ class MissingStreamPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/god-class-pass.js
+// ../circle-ir/dist/analysis/passes/god-class-pass.js
 var WMC_THRESHOLD = 47;
 var LCOM2_THRESHOLD = 0.8;
 var CBO_THRESHOLD = 14;
@@ -41432,7 +42151,7 @@ class GodClassPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/naming-convention-pass.js
+// ../circle-ir/dist/analysis/passes/naming-convention-pass.js
 var PASCAL_CASE_RE = /^[A-Z][A-Za-z0-9]*$/;
 var CAMEL_CASE_RE = /^[a-z][a-zA-Z0-9]*$/;
 var SNAKE_CASE_RE = /^[a-z_][a-z0-9_]*$/;
@@ -41572,7 +42291,7 @@ class NamingConventionPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/security-headers-pass.js
+// ../circle-ir/dist/analysis/passes/security-headers-pass.js
 var HEADER_WRITE_METHODS = new Set([
   "setHeader",
   "addHeader",
@@ -42033,7 +42752,7 @@ function mapReturnValueToCorsRule(returnValue) {
   };
 }
 
-// node_modules/circle-ir/dist/analysis/passes/_fp-allowlists.js
+// ../circle-ir/dist/analysis/passes/_fp-allowlists.js
 var PEM_BODY_RE = /[A-Za-z0-9+/]{30,}/;
 function pemHasInlineBody(lines, hitLineIdx) {
   const end = Math.min(hitLineIdx + 5, lines.length);
@@ -42060,7 +42779,7 @@ function isProtocolMandatedCryptoFile(file, code) {
   return false;
 }
 
-// node_modules/circle-ir/dist/analysis/passes/scan-secrets-pass.js
+// ../circle-ir/dist/analysis/passes/scan-secrets-pass.js
 function applyDemoDowngrade(demoPath, severity, level) {
   if (!demoPath)
     return { severity, level };
@@ -42638,7 +43357,7 @@ class ScanSecretsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/python-receiver-taint-format-pass.js
+// ../circle-ir/dist/analysis/passes/python-receiver-taint-format-pass.js
 class PythonReceiverTaintFormatPass {
   name = "python-receiver-taint-format";
   category = "security";
@@ -42690,7 +43409,7 @@ class PythonReceiverTaintFormatPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/spring4shell-pass.js
+// ../circle-ir/dist/analysis/passes/spring4shell-pass.js
 var CONTROLLER_ANNOTATIONS = new Set([
   "Controller",
   "RestController",
@@ -42898,7 +43617,7 @@ function isPotentialPojo(type) {
   return first >= 65 && first <= 90;
 }
 
-// node_modules/circle-ir/dist/analysis/passes/insecure-cookie-pass.js
+// ../circle-ir/dist/analysis/passes/insecure-cookie-pass.js
 var COOKIE_RESPONSE_RECEIVERS = new Set([
   "res",
   "response",
@@ -43134,7 +43853,7 @@ class InsecureCookiePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/weak-hash-pass.js
+// ../circle-ir/dist/analysis/passes/weak-hash-pass.js
 var WEAK_HASH_NAMES = new Set([
   "md2",
   "md4",
@@ -43354,7 +44073,7 @@ class WeakHashPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/path-classification.js
+// ../circle-ir/dist/analysis/path-classification.js
 var TEST_PATH_PATTERNS = [
   /(^|\/)test\//i,
   /(^|\/)tests\//i,
@@ -43391,7 +44110,7 @@ function isTestPath(filepath) {
   return false;
 }
 
-// node_modules/circle-ir/dist/analysis/passes/weak-crypto-pass.js
+// ../circle-ir/dist/analysis/passes/weak-crypto-pass.js
 var WEAK_CIPHER_BASES = new Set([
   "des",
   "3des",
@@ -43896,7 +44615,7 @@ class WeakCryptoPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/weak-random-pass.js
+// ../circle-ir/dist/analysis/passes/weak-random-pass.js
 var JAVA_RANDOM_METHODS = new Set([
   "nextInt",
   "nextLong",
@@ -44069,7 +44788,7 @@ class WeakRandomPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/_credential-helpers.js
+// ../circle-ir/dist/analysis/passes/_credential-helpers.js
 var CRED_KEYWORD_RE2 = /(?:password|passwd|pwd|secret|api[_-]?key|auth[_-]?token|private[_-]?key|access[_-]?key|credential)/i;
 function isCredentialIdentifier(name2) {
   if (!name2)
@@ -44162,7 +44881,7 @@ function priorHashOf(varName, priorCalls) {
   return false;
 }
 
-// node_modules/circle-ir/dist/analysis/passes/weak-password-hash-pass.js
+// ../circle-ir/dist/analysis/passes/weak-password-hash-pass.js
 var FAST_HASH_NAMES = new Set([
   "sha224",
   "sha-224",
@@ -44321,7 +45040,7 @@ class WeakPasswordHashPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/weak-password-encoding-pass.js
+// ../circle-ir/dist/analysis/passes/weak-password-encoding-pass.js
 function isBasicAuthContext(call, code) {
   const line = call.location.line;
   if (line < 1)
@@ -44433,7 +45152,7 @@ class WeakPasswordEncodingPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/info-disclosure-stacktrace-pass.js
+// ../circle-ir/dist/analysis/passes/info-disclosure-stacktrace-pass.js
 var RESPONSE_RECEIVER_RE = /^(res|response|w|writer|ctx|c)$/i;
 var LOGGER_RECEIVER_RE = /^(log|logger|slog|console|pino|winston|sentry)$/i;
 var RESPONSE_SEND_METHODS = new Set([
@@ -44619,7 +45338,7 @@ class InfoDisclosureStacktracePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
+// ../circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
 var UPLOAD_NAME_RE = /(?:getOriginalFilename|getSubmittedFileName|originalname|originalName|\.filename|\.Filename|FileHeader\.Filename|UploadFile)/;
 var FILE_SAFE_CALL_RE = /(?:secure_filename|FilenameUtils\.getExtension|\.lastIndexOf\(['"]\.['"]\)|ALLOWED_EXT|ALLOWED_EXTENSIONS|allowedExtensions|\bfileFilter\b|filepath\.Ext|path\.extname)/;
 function lineWindow(lines, startLine, endLine) {
@@ -44770,7 +45489,7 @@ class UnrestrictedFileUploadPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
+// ../circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
 var HTML_OUTPUT_SINKS = new Set([
   "addAttribute",
   "setAttribute",
@@ -44918,7 +45637,7 @@ function methodAcceptsHtmlShapedParam(method) {
   return false;
 }
 
-// node_modules/circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
+// ../circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
 var ANY_TYPE_PERMISSION_RE = /\bAnyTypePermission\b/;
 
 class InsecureDeserializationConfigPass {
@@ -44996,7 +45715,7 @@ class InsecureDeserializationConfigPass {
 }
 var INSECURE_TYPE_NAME_HANDLING_RE = /\bTypeNameHandling\s*=\s*(?:Newtonsoft\.Json\.)?TypeNameHandling\.(All|Auto|Objects|Arrays)\b/;
 
-// node_modules/circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
+// ../circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
   const receiver = call.receiver ?? "";
@@ -45107,7 +45826,7 @@ class PlaintextPasswordStoragePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/cleartext-credential-transport-pass.js
+// ../circle-ir/dist/analysis/passes/cleartext-credential-transport-pass.js
 var LOCALHOST_RE = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0)(?::\d+)?$/i;
 function isInsecureHttpUrl(urlLiteral) {
   if (!urlLiteral)
@@ -45235,7 +45954,7 @@ class CleartextCredentialTransportPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/tls-verify-disabled-pass.js
+// ../circle-ir/dist/analysis/passes/tls-verify-disabled-pass.js
 var PY_HTTP_METHODS = new Set([
   "get",
   "post",
@@ -45448,7 +46167,7 @@ class TlsVerifyDisabledPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/module-side-effect-pass.js
+// ../circle-ir/dist/analysis/passes/module-side-effect-pass.js
 var JS_EXEC_METHODS = new Set([
   "exec",
   "spawn",
@@ -45679,7 +46398,7 @@ class ModuleSideEffectPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/cache-no-vary-pass.js
+// ../circle-ir/dist/analysis/passes/cache-no-vary-pass.js
 function isSharedCacheable(value) {
   const v = value.toLowerCase();
   if (/\b(private|no-store|no-cache)\b/.test(v))
@@ -45966,7 +46685,7 @@ class CacheNoVaryPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/jwt-verify-disabled-pass.js
+// ../circle-ir/dist/analysis/passes/jwt-verify-disabled-pass.js
 var PY_VERIFY_SIGNATURE_FALSE_RE = /["']verify_signature["']\s*:\s*False\b/;
 var PY_VERIFY_KW_FALSE_RE = /\bverify\s*=\s*False\b/;
 var PY_ALG_NONE_RE = /\balgorithms\s*=\s*[\[\(]\s*["']none["']/i;
@@ -46091,7 +46810,7 @@ class JwtVerifyDisabledPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/csrf-protection-disabled-pass.js
+// ../circle-ir/dist/analysis/passes/csrf-protection-disabled-pass.js
 var JAVA_CSRF_DISABLE_RE = /\.csrf\s*\([^)]*\)\s*\.\s*disable\b/;
 var JAVA_CSRF_LAMBDA_DISABLE_RE = /\bcsrf\s*\(\s*\w+\s*->\s*\w+\s*\.\s*disable\s*\(/;
 var JAVA_CSRF_METHODREF_RE = /\bcsrf\s*\(\s*[\w.]+::disable\s*\)/;
@@ -46227,7 +46946,7 @@ class CsrfProtectionDisabledPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/xml-entity-expansion-pass.js
+// ../circle-ir/dist/analysis/passes/xml-entity-expansion-pass.js
 var JAVA_FACTORIES = new Set([
   "SAXParserFactory",
   "DocumentBuilderFactory",
@@ -46367,7 +47086,7 @@ class XmlEntityExpansionPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/mass-assignment-pass.js
+// ../circle-ir/dist/analysis/passes/mass-assignment-pass.js
 var PY_KWARGS_SPLAT_RE = /\*\*\s*(?:request|self\.request|flask\.request|ctx|self)\s*\.\s*(?:form|args|values|json|get_json\s*\(\s*\)|files|data)/;
 var JS_OBJECT_SPREAD_RE = /\{\s*\.\.\.\s*(?:req|request|ctx|context)(?:\.request)?\s*\.\s*(?:body|query|params|form)\b/;
 
@@ -46451,7 +47170,7 @@ class MassAssignmentPass {
   }
 }
 
-// node_modules/circle-ir/dist/graph/import-graph.js
+// ../circle-ir/dist/graph/import-graph.js
 function dirname(filePath) {
   const idx = filePath.lastIndexOf("/");
   return idx >= 0 ? filePath.slice(0, idx) : "";
@@ -46584,7 +47303,7 @@ class ImportGraph2 {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/circular-dependency-pass.js
+// ../circle-ir/dist/analysis/passes/circular-dependency-pass.js
 class CircularDependencyPass {
   run(_projectGraph, importGraph) {
     const findings = [];
@@ -46611,7 +47330,7 @@ class CircularDependencyPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/passes/orphan-module-pass.js
+// ../circle-ir/dist/analysis/passes/orphan-module-pass.js
 class OrphanModulePass {
   run(_projectGraph, importGraph) {
     const findings = [];
@@ -46635,7 +47354,7 @@ class OrphanModulePass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/passes/size-metrics-pass.js
+// ../circle-ir/dist/analysis/metrics/passes/size-metrics-pass.js
 class SizeMetricsPass {
   name = "size-metrics";
   run(ctx) {
@@ -46691,7 +47410,7 @@ class SizeMetricsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/passes/complexity-metrics-pass.js
+// ../circle-ir/dist/analysis/metrics/passes/complexity-metrics-pass.js
 class ComplexityMetricsPass {
   name = "complexity-metrics";
   run(ctx) {
@@ -46755,7 +47474,7 @@ class ComplexityMetricsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/passes/halstead-metrics-pass.js
+// ../circle-ir/dist/analysis/metrics/passes/halstead-metrics-pass.js
 var KEYWORDS = new Set([
   "if",
   "else",
@@ -46910,7 +47629,7 @@ class HalsteadMetricsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/passes/data-flow-metrics-pass.js
+// ../circle-ir/dist/analysis/metrics/passes/data-flow-metrics-pass.js
 class DataFlowMetricsPass {
   name = "data-flow-metrics";
   run(ctx) {
@@ -46928,7 +47647,7 @@ class DataFlowMetricsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/passes/coupling-metrics-pass.js
+// ../circle-ir/dist/analysis/metrics/passes/coupling-metrics-pass.js
 class CouplingMetricsPass {
   name = "coupling-metrics";
   run(ctx) {
@@ -47006,7 +47725,7 @@ class CouplingMetricsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/passes/inheritance-metrics-pass.js
+// ../circle-ir/dist/analysis/metrics/passes/inheritance-metrics-pass.js
 class InheritanceMetricsPass {
   name = "inheritance-metrics";
   run(ctx) {
@@ -47066,7 +47785,7 @@ class InheritanceMetricsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/passes/cohesion-metrics-pass.js
+// ../circle-ir/dist/analysis/metrics/passes/cohesion-metrics-pass.js
 class CohesionMetricsPass {
   name = "cohesion-metrics";
   run(ctx) {
@@ -47149,7 +47868,7 @@ class CohesionMetricsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/passes/documentation-metrics-pass.js
+// ../circle-ir/dist/analysis/metrics/passes/documentation-metrics-pass.js
 class DocumentationMetricsPass {
   name = "documentation-metrics";
   run(ctx) {
@@ -47202,7 +47921,7 @@ class DocumentationMetricsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/passes/composite-metrics-pass.js
+// ../circle-ir/dist/analysis/metrics/passes/composite-metrics-pass.js
 class CompositeMetricsPass {
   name = "composite-metrics";
   run(ctx) {
@@ -47261,7 +47980,7 @@ class CompositeMetricsPass {
   }
 }
 
-// node_modules/circle-ir/dist/analysis/metrics/metric-runner.js
+// ../circle-ir/dist/analysis/metrics/metric-runner.js
 class MetricRunner {
   passes = [
     new SizeMetricsPass,
@@ -47283,7 +48002,7 @@ class MetricRunner {
     return accumulated;
   }
 }
-// node_modules/circle-ir/dist/analyzer.js
+// ../circle-ir/dist/analyzer.js
 var initialized = false;
 async function initAnalyzer(options = {}) {
   if (initialized)
@@ -47599,8 +48318,6 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new LanguageSourcesPass);
     if (!disabledPasses.has("source-semantics"))
       pipeline.add(new SourceSemanticsPass);
-    if (!disabledPasses.has("library-profile-source-gate"))
-      pipeline.add(new LibraryProfileSourceGatePass);
     if (!disabledPasses.has("mybatis-annotation-sql-sink"))
       pipeline.add(new MyBatisAnnotationSqlSinkPass);
     pipeline.add(new SinkFilterPass);
@@ -47617,6 +48334,8 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new LibraryProfileSinkGatePass);
     if (!disabledPasses.has("library-profile-xss-gate"))
       pipeline.add(new LibraryProfileXssGatePass);
+    if (!disabledPasses.has("library-profile-source-gate"))
+      pipeline.add(new LibraryProfileSourceGatePass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
@@ -47880,7 +48599,19 @@ async function analyzeProject(files, options = {}) {
   const fileAnalyses = [];
   const projectGraph = new ProjectGraph;
   const sourceLinesByFile = new Map;
+  const perFileBudgetMs = options.perFileBudgetMs ?? 0;
+  const perFileStart = Date.now();
+  let perFileBudgetExceeded = false;
   for (const { code, filePath, language } of files) {
+    if (perFileBudgetMs > 0 && Date.now() - perFileStart > perFileBudgetMs) {
+      perFileBudgetExceeded = true;
+      logger.warn("analyzeProject: per-file budget exceeded, skipping remaining files", {
+        analysed: fileAnalyses.length,
+        total: files.length,
+        budgetMs: perFileBudgetMs
+      });
+      break;
+    }
     const ir = await analyze(code, filePath, language, options);
     fileAnalyses.push({ file: filePath, analysis: ir });
     projectGraph.addFile(filePath, new CodeGraph(ir));
@@ -47936,6 +48667,9 @@ async function analyzeProject(files, options = {}) {
   if (crossFileResult.budgetExceeded) {
     projectAnalysis.cross_file_budget_exceeded = true;
   }
+  if (perFileBudgetExceeded) {
+    projectAnalysis.per_file_budget_exceeded = true;
+  }
   return projectAnalysis;
 }
 function deriveProjectName(paths) {
@@ -47955,7 +48689,7 @@ function deriveProjectRoot(paths) {
   }
   return common.join("/") || "/";
 }
-// node_modules/circle-ir/dist/analysis/sbom.js
+// ../circle-ir/dist/analysis/sbom.js
 function purlVersion(spec) {
   const stripped = spec.trim().replace(/^[\s^~=<>]+/, "");
   if (/^v?[0-9][\w.\-+]*$/.test(stripped))
@@ -49011,7 +49745,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.16";
+var version = "4.9.19";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -49564,8 +50298,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "e4c3d1b",
-  builtAt: "2026-09-18T20:18:22.063Z"
+  gitSha: "edf0335",
+  builtAt: "2026-09-19T15:34:15.780Z"
 };
 
 // src/utils/args.ts