feat(core): cross-flow analysis — subflow resolution, cross-subflow taint tracing, all-distribution wiring

[RubenHalman]

Summary

Gives LFS its first analysis tier that crosses flow boundaries, wired into every distribution. Every rule today is single-flow; this adds subflow resolution, a data-flow (def-use) layer, interprocedural taint tracing on top of it, and the plumbing so it works in the CLI, VS Code extension, GitHub Action, and browser/UMD consumers.

Four self-contained commits, each building and tested independently.

What's included

1. Subflow resolution foundation

Restores the previously-closed subflow-resolution work (PR #292) on top of current main and finishes the CLI wiring it never had.

• SubflowResolver interface with NoOpResolver / PreloadedResolver, plumbed through IRulesConfig.subflowResolver → ScanFlows → each rule's check().
• LoopRuleCommon gains interprocedural traversal: dml-in-loop / soql-in-loop / action-call-in-loop now follow subflow call chains (cycle-safe) and report on the subflow call node, including nested Parent → Middle → Child chains.
• New system rule UnresolvedSubflow (issue #272). Flow.getSubflowNodes/getSubflowNames/hasSubflows helpers.
• RuleRegistry reconciled with current main (options-object register(), isSystem filtering) preserving all existing rules.
• Original review fixes applied (file-handle finally, async glob, CommonJS-safe imports).

2. Def-use / data-flow layer (FlowDataFlow)

Per-element read/write variable sets resolved from raw element data — the foundation taint tracing needs. ReferenceExtractor handles base-variable reduction, {!merge} fields, structured <value> references. Covers assignments (incl. compound operators), decisions, record ops (all output modes), loops (self-named current item), action calls, screens (nested fields), custom errors; formula resolution; subflow call boundaries; input/screen variables as sources.

3. Cross-subflow taint tracing + rule

• TaintAnalyzer: propagates untrusted markings from sources (screen inputs, flow input variables, configurable globals) through the def-use graph to sinks via a flow-insensitive fixpoint (sound "may be tainted"); formula taint is transitive; cross-flow analysis follows subflow calls through the resolver with cycle detection.
• New beta rule PreventPassingUserDataIntoElementWithSharing: flags user data reaching a DB op in a flow running System Mode Without Sharing, or passed into a subflow that runs without sharing.

4. All-distribution wiring + browser support

• Core (browser-safe, pure): buildResolver(roots, source) resolves the transitive subflow closure breadth-first (deduped, cycle-safe, managed-skip, maxDepth) and returns an eager PreloadedResolver; parseFlowXml / createFlowParser parse Flow XML from a string with no filesystem. The environment supplies how to load one flow; core owns which flows are needed.
• VS Code extension: both scan paths build a FileSystemResolver over the workspace and pass it in.
• GitHub Action: builds a PreloadedResolver over all parsed flows once, passed into each per-flow scan.
• Browser / UMD (e.g. Inspector Reloaded / Chrome): documented buildResolver + org-API source pattern in SUBFLOW_RESOLUTION.md.

Design note: why buildResolver

The rule engine resolves subflows synchronously (getSync) so rules stay sync. Node distributions read from disk eagerly; async sources (browser/org API) can't fetch mid-traversal, so the subflow dependency closure must be pre-resolved up front — that's what buildResolver does. The analysis core stays pure (no fs/glob); discovery lives behind the resolver interface per environment. UMD bundle grows ~0.3 KB gzipped.

Testing

• 209 core unit tests pass (44 suites); all four packages build; UMD build verified.
• New fixtures + suites: cross-subflow DML-in-loop (one and two hops); def-use extraction; taint (positive case, intra-flow sink, no-resolver case, and — guarding the false-positive class — a parent handing the same data to a with-sharing subflow, correctly not flagged); buildResolver closure/cycle/managed/maxDepth behavior.
• Verified end-to-end through the CLI.

Notes for reviewers

• Taint propagation is flow-insensitive — a deliberate first cut (sound over-approximation); flow-sensitivity is a follow-up precision upgrade.
• New taint rule and UnresolvedSubflow are opt-in (beta / system), so default scans are unchanged.
• buildResolver lives in core for now; it can be extracted to a dedicated package if/when it generalizes past flows (cross-object / OmniScript).
• Minor deferred item: validateFlowContent is duplicated across the CLI and VSX resolvers and could be centralized.

Closes #272.

[RubenHalman]

Follow-up to the review comment above: the cli/vsx FileSystemResolver duplication is now resolved in this PR (b3fa617) rather than deferred. The shared implementation lives in core (which already uses fs for parse()), with file discovery injected via a findFlowFiles option so core gains no glob dependency — cli and vsx are now ~25-line wrappers supplying their own glob strategy. Net −257 lines; all tests green.

🤖 Generated with Claude Code

[RubenHalman]

v7 breaking change: flat, uniformly-typed violations (c653283)

Violation.details was a polymorphic bag — {dataType} for variables, {connectsTo, locationX, locationY} for nodes, {expression} for attributes, plus ad-hoc per-rule keys — which made core's output hard to consume flat and led to real bugs (the GitHub Action read detail.dataType/detail.expression at the top level where they never existed, so those columns were always empty).

v7 shape: every field lives at the top level of Violation with a fixed name and type. Rule-specific context uses one shared vocabulary across all rules: description, referencedFlow, referencedElement, referencedType, callChain, taintedVariables, sinkType.

New API: scanFlat(flows, config): FlatViolation[] — one lossless, self-contained record per violation (violation + flow + rule context) — and flatten(results) for flattening an existing tree. exportDetails() is removed (it whitelisted 5 keys and silently dropped all cross-flow/taint fields). scan() keeps returning the per-flow tree for consumers that need grouping (SARIF).

All in-repo consumers migrated (CLI CSV/JSON, vsx CSV export, SARIF properties, Action). 216 tests green, CSV smoke test confirms cross-flow call chains and tainted variables now survive into flat output.

🤖 Generated with Claude Code