What causes "[taint] lang=${provider.language}: ${parts.join('; ')}" in abhigyanpatwari/GitNexus?

Use gapExamples/dropExamples from the warn to find the exact functions losing findings

[taint] lang=

Error message

[taint] lang=${provider.language}: ${parts.join('; ')}

What it means

R4: after the taint pass, per-language aggregates surface coverage gaps and dropped findings unconditionally (never debug, never input.onWarn). The single warn line joins parts: how many functions had taint coverage gaps (with up to 5 example function names) and how many findings were dropped by the per-function fact cap (with examples). Solver-status gaps were already per-function-warned by the RD layer, which shares the solver and fact cap.

Solutions

Use gapExamples/dropExamples from the warn to find the exact functions losing findings
Split oversized functions so per-function finding counts fall under the cap — the cap is per-function, so decomposition directly restores coverage
Narrow the taint spec (fewer sources/sinks) if the volume is configuration-driven rather than code-driven
Treat remaining gaps as known-underreported when triaging explain() results for those functions

Defensive patterns

Strategy: validation

Validate before calling

// Parse the aggregate line and gate security review on it:
const m = log.match(/\[taint\] lang=(\w+): (.+)/);
if (m) {
  const gaps = m[2].match(/(\d+) finding\(s\) dropped by the per-function cap — e\.g\. ([^;]+)/);
  if (gaps) markFunctionsUnderreported(gaps[2].split(', '));
}

Prevention

Split very large functions before taint review — the finding cap is per-function
Treat explain() results for warn-listed functions as a lower bound, never exhaustive
Correlate gapExamples with security-critical code first; those are exactly where under-reporting hurts

When it happens

Trigger: Running analyze with a taint spec configured (PDG layer active) where some functions' taint solving hit coverage gaps or exceeded the per-function finding cap; taintTotals.gapExamples/dropExamples fill and parts.join('; ') forms the message.

Common situations: Monorepos or very large functions with many source→sink flows (taint findings in the hundreds per function), broad source/sink configurations, or codebases where the shared solver fact cap (same as the RD layer's) saturates for hot functions.

Related errors

AI-assisted analysis of abhigyanpatwari/GitNexus@ac9a4e9abd (2026-08-20). Data as JSON: /api/errors/4ed87c6f6470e506. Report an issue: GitHub.

Appendix: source

Thrown at gitnexus/src/core/ingestion/scope-resolution/pipeline/run.ts:1645

        if (gapCount > 0) {
          parts.push(
            `${gapCount} function(s) skipped for taint ` +
              `(${taintTotals.gapTruncated} fact-limit, ${taintTotals.gapOverflow} overflow, ` +
              `${taintTotals.gapNoFacts} no-facts, ${taintTotals.unsafeSites} malformed sites)` +
              (taintTotals.gapExamples.length > 0
                ? ` — e.g. ${taintTotals.gapExamples.join(', ')}`
                : ''),
          );
        }
        if (taintTotals.dropped > 0) {
          parts.push(
            `${taintTotals.dropped} finding(s) dropped by the per-function cap` +
              (taintTotals.dropExamples.length > 0
                ? ` — e.g. ${taintTotals.dropExamples.join(', ')}`
                : ''),
          );
        }
        logger.warn(`[taint] lang=${provider.language}: ${parts.join('; ')}`);
      }
    }
    // M4 (#2084 U1): summary harvest volume + anchor-resolution diagnostics.
    if (harvestedSummaries.length > 0 || summaryUnresolved > 0) {
      logger.debug(
        `[taint-summary] lang=${provider.language}: ${harvestedSummaries.length} function ` +
          `summary/summaries harvested` +
          (summaryUnresolved > 0
            ? `, ${summaryUnresolved} CFG anchor(s) unresolved (same-line collision or missing node)`
            : ''),
      );
    }
    // FU-C (U-C2): call-summary harvest volume + anchor-resolution diagnostics.
    if (harvestedCallSummaries.length > 0 || callSummaryUnresolved > 0) {
      logger.debug(
        `[call-summary] lang=${provider.language}: ${harvestedCallSummaries.length} function ` +
          `return-ascent summary/summaries harvested` +
          (callSummaryUnresolved > 0

View on GitHub (pinned to ac9a4e9abd)