circle-ir-ai 2.16.0 → 2.17.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +48 -0
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,54 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.17.0] - 2026-06-22
|
|
9
|
+
|
|
10
|
+
### Dependencies
|
|
11
|
+
|
|
12
|
+
- Bump `circle-ir` `3.89.1` → `3.90.0`.
|
|
13
|
+
|
|
14
|
+
### What 3.90.0 brings (inherited, no source-side changes here)
|
|
15
|
+
|
|
16
|
+
`circle-ir@3.90.0` adds the **findings-emission instrumentation hook**
|
|
17
|
+
that closes out cognium-dev#145 (PR B). Per-file `SastFinding[]`
|
|
18
|
+
finalization now emits to an opt-in JSONL sink controlled by the
|
|
19
|
+
engine's instrumentation surface (`emitFindingsInstrumentation`
|
|
20
|
+
callback / env-var hook — see circle-ir 3.90.0 release notes for the
|
|
21
|
+
exact wiring). This is the data source #143 will consume to evaluate
|
|
22
|
+
coalesce hypotheses against real CLI workloads.
|
|
23
|
+
|
|
24
|
+
Per-finding payload includes at minimum: `ruleId`, `file`, `line`,
|
|
25
|
+
`sinkType`, `sourceType`, `severity`, `confidence`, `dedup_group_id`.
|
|
26
|
+
**Payload schema is stable-additive** — the engine reserves the right
|
|
27
|
+
to add new fields driven by #143's analysis without a major bump.
|
|
28
|
+
Consumers should ignore unknown keys. Function signature is the
|
|
29
|
+
freeze point.
|
|
30
|
+
|
|
31
|
+
### What `circle-ir-ai` does with the hook (today: nothing)
|
|
32
|
+
|
|
33
|
+
Engine-side surface is opt-in; no `circle-ir-ai` source exercises
|
|
34
|
+
the hook yet. The intended consumer is PR C in `circle-ir-ai`
|
|
35
|
+
itself (separate cycle), which will wire the hook through the
|
|
36
|
+
mastra `runPatternMatch → analyze()` path so cognium-ai scans
|
|
37
|
+
surface the instrumentation without users having to import
|
|
38
|
+
`circle-ir` directly. Until PR C ships, the hook fires only for
|
|
39
|
+
direct `circle-ir` consumers that opt in.
|
|
40
|
+
|
|
41
|
+
### Verification
|
|
42
|
+
|
|
43
|
+
- `npm install --prefer-online` — clean; `npm ls circle-ir` shows
|
|
44
|
+
`3.90.0`.
|
|
45
|
+
- `npm run build` — clean.
|
|
46
|
+
- `npm run typecheck` — clean.
|
|
47
|
+
- `npm test` — **898 / 898 pass** (3 skipped).
|
|
48
|
+
|
|
49
|
+
### Why minor (`2.16.0 → 2.17.0`)
|
|
50
|
+
|
|
51
|
+
New engine surface is reachable via direct `circle-ir` import even
|
|
52
|
+
though no `circle-ir-ai` code-path exercises it yet. Minor bump
|
|
53
|
+
signals the underlying capability uplift to downstream consumers
|
|
54
|
+
(mcp-server, circle-pack) that may wire the hook independently.
|
|
55
|
+
|
|
8
56
|
## [2.16.0] - 2026-06-22
|
|
9
57
|
|
|
10
58
|
### Added
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.17.0",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -95,7 +95,7 @@
|
|
|
95
95
|
"dependencies": {
|
|
96
96
|
"@ax-llm/ax": "^20.0.0",
|
|
97
97
|
"@mastra/core": "^1.18.0",
|
|
98
|
-
"circle-ir": "3.
|
|
98
|
+
"circle-ir": "3.90.0",
|
|
99
99
|
"minimatch": "^10.2.5",
|
|
100
100
|
"p-queue": "^9.1.0"
|
|
101
101
|
},
|