circle-ir-ai 2.22.0 → 2.26.0

package/dist/cache/discovery-cache.js

@@ -0,0 +1,95 @@
+/**
+ * Discovery Cache
+ *
+ * Persistent on-disk cache for LLM discovery results per (className,
+ * methodName, methodCode, CWE-set) tuple (cognium-ai#134, P2 of epic
+ * #155). Sits in front of the in-memory `_discoveryDedupCache` from
+ * discovery.ts (#136) so that identical method-level discovery requests
+ * survive across processes, CI runs, and developer iterations — not just
+ * within one process.
+ *
+ * Built on top of `ClassificationCache<DiscoveryResult>` (which already
+ * carries the cognium-ai#151 model-fingerprint key dimension), with
+ * discovery-specific key construction:
+ *
+ *   content    = className + '\\0' + methodName + '\\0' +
+ *                SHA-256(methodCode) + '\\0' + sortedCweSet
+ *   classifier = 'discovery-method'
+ *   fingerprint = getPhaseModelFingerprint(config)  // includes discovery model
+ *
+ * Cache directory: `.cognium/cache/discovery/` (separate from the
+ * verify-phase `.cognium/cache/verify/` so each phase can be cleared
+ * independently — `rm -rf .cognium/cache/discovery/` only nukes
+ * discovery entries).
+ *
+ * Invalidation matrix (#134 acceptance criteria):
+ *   - Edit one method     → only that method's entry invalidates
+ *                           (methodCode SHA-256 is part of the key)
+ *   - Add a new CWE       → existing entries still hit for old CWE-sets;
+ *                           new CWE-set requests miss
+ *   - Change disc model   → entire cache invalidates
+ *                           (fingerprint is part of the singleton key)
+ *
+ * Env toggles:
+ *   LLM_DISCOVERY_CACHE=0  → disable persistent discovery cache
+ *                             (in-memory dedup from #136 still applies)
+ */
+import * as crypto from 'crypto';
+import * as path from 'path';
+import { ClassificationCache } from './classification-cache.js';
+import { getDefaultLLMConfig, getPhaseModelFingerprint } from '../llm/config.js';
+const DISCOVERY_CACHE_SUBDIR = path.join('.cognium', 'cache', 'discovery');
+/**
+ * Module-scoped singleton — distinct from the discovery-phase singleton
+ * in `classification-cache.ts` and the verify-phase singleton in
+ * `verify-cache.ts` so each phase can carry its own model fingerprint
+ * (e.g. cheap discovery + strong verifier) without thrashing.
+ */
+let _instance = null;
+let _instanceFingerprint = '';
+/**
+ * Get the discovery-phase persistent cache, keyed by per-phase model
+ * fingerprint. When `LLM_DISCOVERY_CACHE=0` returns a disabled cache that
+ * no-ops on get/set (callers don't need to branch).
+ */
+export function getDiscoveryCache(config = getDefaultLLMConfig()) {
+    const enabled = process.env.LLM_DISCOVERY_CACHE !== '0';
+    const fingerprint = getPhaseModelFingerprint(config);
+    if (!_instance || _instanceFingerprint !== fingerprint || _instance.getModelFingerprint() !== fingerprint) {
+        _instance = new ClassificationCache({
+            cacheDir: path.join(process.cwd(), DISCOVERY_CACHE_SUBDIR),
+            modelFingerprint: fingerprint,
+            enabled,
+        });
+        _instanceFingerprint = fingerprint;
+    }
+    return _instance;
+}
+/** Reset the module-scoped singleton — test-only. */
+export function resetDiscoveryCache() {
+    _instance = null;
+    _instanceFingerprint = '';
+}
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache. The fingerprint dimension is folded in by the
+ * cache itself (see classification-cache.ts:computeKey).
+ *
+ * Components:
+ *   - className — disambiguates same-named methods across classes
+ *   - methodName — per-method granularity (matches the per-method LLM call)
+ *   - methodCode SHA-256 — method edit invalidates only that method's entry
+ *   - sortedCweSet — different CWE-set requests on the same method don't
+ *     reuse each other's prompts (different system prompt, different answer)
+ *   - classifier 'discovery-method' — namespace for future
+ *     'discovery-file' / 'discovery-class' tiers without collision
+ */
+export function computeDiscoveryCacheKey(input) {
+    const methodSha = crypto.createHash('sha256').update(input.methodCode).digest('hex');
+    const sortedCweSet = [...input.targetCWEs].sort().join(',');
+    return {
+        content: `${input.className}\0${input.methodName}\0${methodSha}\0${sortedCweSet}`,
+        classifier: 'discovery-method',
+    };
+}
+//# sourceMappingURL=discovery-cache.js.map

package/dist/cache/discovery-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-cache.js","sourceRoot":"","sources":["../../src/cache/discovery-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAkB,MAAM,kBAAkB,CAAC;AAGjG,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,IAAI,SAAS,GAAgD,IAAI,CAAC;AAClE,IAAI,oBAAoB,GAAG,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAoB,mBAAmB,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;IACxD,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,SAAS,IAAI,oBAAoB,KAAK,WAAW,IAAI,SAAS,CAAC,mBAAmB,EAAE,KAAK,WAAW,EAAE,CAAC;QAC1G,SAAS,GAAG,IAAI,mBAAmB,CAAkB;YACnD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;YAC1D,gBAAgB,EAAE,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,oBAAoB,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB;IACjC,SAAS,GAAG,IAAI,CAAC;IACjB,oBAAoB,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAKxC;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,KAAK,SAAS,KAAK,YAAY,EAAE;QACjF,UAAU,EAAE,kBAAkB;KAC/B,CAAC;AACJ,CAAC"}

package/dist/cache/tree-cache.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Tree Cache
+ *
+ * Persistent on-disk cache for `runPatternMatch` output (cognium-ai#153,
+ * P3 of epic #155). Pattern-match output is a pure function of file
+ * content + engine version, so caching it eliminates the parse +
+ * AST-walk + SAST-rule firing on warm runs.
+ *
+ * Empirically (v2.20.6 gson re-verify, 2026-06-29) the scan stage ate
+ * 179s of 358s end-to-end — ~half the wall-clock is re-discovering
+ * structure circle-ir already knows. Caching the pattern-match seam
+ * is the smallest empirical win in the cache stack (no LLM-token
+ * reduction, only CPU + wall-clock), but it stacks cleanly on the
+ * #145 static pre-filter — a cached tree means the pre-filter has
+ * more to chew on, which reduces enrichment calls downstream.
+ *
+ * **Scope:** caches `PatternMatchResult` only, NOT full `CircleIR`.
+ * The full graph (cross-file CFG, project-level type hierarchy) is
+ * too entangled with project context to cache safely without a full
+ * `CircleIR.serialize()` upstream — that's a separate D3 design
+ * question, file separately if pursued.
+ *
+ * **Key composition:**
+ *   content = SHA-256(sourceCode) + '\0' +
+ *             circleIrVersion + '\0' +
+ *             circleIrAiVersion + '\0' +
+ *             language + '\0' +
+ *             ruleSetFingerprint
+ *   classifier = 'tree-pattern-match'
+ *
+ * Any of: file edit, circle-ir bump, circle-ir-ai bump, language
+ * change, or rule-set change → cache miss.
+ *
+ * **Storage:** `ClassificationCache<PatternMatchResult>` under
+ * `.cognium/cache/tree/`, 7-day TTL (longer than discovery cache
+ * because the input is structural and stable — pattern-match output
+ * doesn't drift between scans the way an LLM call would).
+ *
+ * **Env toggles:**
+ *   LLM_TREE_CACHE=0  → disable persistent tree cache.
+ *
+ * **Versioning note:** unlike discovery-cache / verify-cache, this
+ * cache is NOT keyed on the LLM model fingerprint (pattern-match is
+ * static — circle-ir doesn't call any LLM). It IS keyed on the
+ * circle-ir and circle-ir-ai package versions because either bump
+ * can change the workflow-level transforms applied to the result.
+ */
+import { ClassificationCache } from './classification-cache.js';
+import type { TaintSource, TaintSink, TypeInfo, DFG, SastFinding } from 'circle-ir';
+/**
+ * Shape persisted to disk. Mirrors the return of `runPatternMatch` in
+ * `src/agents/mastra/workflow.ts`. All fields are plain JSON-serializable
+ * (no class instances, no cycles) so the underlying ClassificationCache
+ * round-trip is safe.
+ */
+export interface PatternMatchResult {
+    patternSources: TaintSource[];
+    patternSinks: TaintSink[];
+    types: TypeInfo[];
+    imports: string[];
+    sastFindings: SastFinding[];
+    dfg: DFG;
+}
+/**
+ * Get the tree-cache singleton. When `LLM_TREE_CACHE=0` returns a
+ * disabled cache that no-ops on get/set (callers don't need to branch).
+ */
+export declare function getTreeCache(): ClassificationCache<PatternMatchResult>;
+/** Reset the module-scoped singleton — test-only. */
+export declare function resetTreeCache(): void;
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache.
+ *
+ * Components:
+ *   - source code SHA-256 — file edit invalidates only that file's entry
+ *   - circleIrVersion — bumping circle-ir invalidates all entries
+ *   - circleIrAiVersion — bumping circle-ir-ai (which may change
+ *     workflow-level transforms applied to pattern-match output)
+ *     invalidates all entries
+ *   - language — same source, different language tag must miss (the
+ *     analyzer's behavior depends on the language argument)
+ *   - ruleSetFingerprint — caller-supplied digest of the active rule
+ *     set (disabledPasses + projectProfile). Empty string is fine for
+ *     the default rule set.
+ */
+export declare function computeTreeCacheKey(input: {
+    sourceCode: string;
+    language: string;
+    ruleSetFingerprint?: string;
+}): {
+    content: string;
+    classifier: string;
+};
+/**
+ * Compute a stable fingerprint over an arbitrary rule-set descriptor
+ * (disabledPasses array + projectProfile object). Result is suitable to
+ * pass as `ruleSetFingerprint` to `computeTreeCacheKey`. Order-stable
+ * for arrays so re-ordering `--disable a,b` vs `--disable b,a` still
+ * hits the cache.
+ */
+export declare function computeRuleSetFingerprint(input: {
+    disabledPasses?: string[];
+    projectProfile?: unknown;
+}): string;
+/** Test-only: expose the captured engine versions for assertions. */
+export declare function getTreeCacheVersions(): {
+    circleIrVersion: string;
+    circleIrAiVersion: string;
+};
+//# sourceMappingURL=tree-cache.d.ts.map

package/dist/cache/tree-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree-cache.d.ts","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAMH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAKpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9B,YAAY,EAAE,SAAS,EAAE,CAAC;IAC1B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,GAAG,EAAE,GAAG,CAAC;CACV;AAiDD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAUtE;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAO1C;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,MAAM,CAWT;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,IAAI;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAKA"}

package/dist/cache/tree-cache.js

@@ -0,0 +1,171 @@
+/**
+ * Tree Cache
+ *
+ * Persistent on-disk cache for `runPatternMatch` output (cognium-ai#153,
+ * P3 of epic #155). Pattern-match output is a pure function of file
+ * content + engine version, so caching it eliminates the parse +
+ * AST-walk + SAST-rule firing on warm runs.
+ *
+ * Empirically (v2.20.6 gson re-verify, 2026-06-29) the scan stage ate
+ * 179s of 358s end-to-end — ~half the wall-clock is re-discovering
+ * structure circle-ir already knows. Caching the pattern-match seam
+ * is the smallest empirical win in the cache stack (no LLM-token
+ * reduction, only CPU + wall-clock), but it stacks cleanly on the
+ * #145 static pre-filter — a cached tree means the pre-filter has
+ * more to chew on, which reduces enrichment calls downstream.
+ *
+ * **Scope:** caches `PatternMatchResult` only, NOT full `CircleIR`.
+ * The full graph (cross-file CFG, project-level type hierarchy) is
+ * too entangled with project context to cache safely without a full
+ * `CircleIR.serialize()` upstream — that's a separate D3 design
+ * question, file separately if pursued.
+ *
+ * **Key composition:**
+ *   content = SHA-256(sourceCode) + '\0' +
+ *             circleIrVersion + '\0' +
+ *             circleIrAiVersion + '\0' +
+ *             language + '\0' +
+ *             ruleSetFingerprint
+ *   classifier = 'tree-pattern-match'
+ *
+ * Any of: file edit, circle-ir bump, circle-ir-ai bump, language
+ * change, or rule-set change → cache miss.
+ *
+ * **Storage:** `ClassificationCache<PatternMatchResult>` under
+ * `.cognium/cache/tree/`, 7-day TTL (longer than discovery cache
+ * because the input is structural and stable — pattern-match output
+ * doesn't drift between scans the way an LLM call would).
+ *
+ * **Env toggles:**
+ *   LLM_TREE_CACHE=0  → disable persistent tree cache.
+ *
+ * **Versioning note:** unlike discovery-cache / verify-cache, this
+ * cache is NOT keyed on the LLM model fingerprint (pattern-match is
+ * static — circle-ir doesn't call any LLM). It IS keyed on the
+ * circle-ir and circle-ir-ai package versions because either bump
+ * can change the workflow-level transforms applied to the result.
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { createRequire } from 'module';
+import { ClassificationCache } from './classification-cache.js';
+const TREE_CACHE_SUBDIR = path.join('.cognium', 'cache', 'tree');
+const TREE_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days — structural, stable
+/**
+ * Module-scoped singleton — distinct from the verify/discovery
+ * singletons so the tree cache (which doesn't depend on the LLM model)
+ * doesn't get invalidated when the operator swaps discovery model.
+ */
+let _instance = null;
+/**
+ * Read package versions once at module load (best-effort). Wrapped in a
+ * try/catch so unit tests that don't ship a package.json next to the
+ * source can still construct the cache; in that case the version
+ * component degrades to 'unknown' and the cache still works (just isn't
+ * cross-version-safe).
+ */
+function safeReadVersion(spec, baseUrl) {
+    try {
+        const require = createRequire(baseUrl);
+        return require(spec).version || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+const _circleIrVersion = safeReadVersion('circle-ir/package.json', import.meta.url);
+const _circleIrAiVersion = (() => {
+    // The package's own version is harder to resolve via require, so read
+    // it directly from disk by walking up from this file.
+    try {
+        // Compiled output sits at dist/cache/tree-cache.js → ../../package.json
+        const candidates = [
+            path.resolve(new URL(import.meta.url).pathname, '../../../package.json'),
+            path.resolve(new URL(import.meta.url).pathname, '../../package.json'),
+        ];
+        for (const p of candidates) {
+            if (fs.existsSync(p)) {
+                const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
+                if (pkg.name === 'circle-ir-ai' && pkg.version) {
+                    return pkg.version;
+                }
+            }
+        }
+    }
+    catch {
+        /* fallthrough */
+    }
+    return 'unknown';
+})();
+/**
+ * Get the tree-cache singleton. When `LLM_TREE_CACHE=0` returns a
+ * disabled cache that no-ops on get/set (callers don't need to branch).
+ */
+export function getTreeCache() {
+    const enabled = process.env.LLM_TREE_CACHE !== '0';
+    if (!_instance) {
+        _instance = new ClassificationCache({
+            cacheDir: path.join(process.cwd(), TREE_CACHE_SUBDIR),
+            maxAge: TREE_CACHE_TTL_MS,
+            enabled,
+        });
+    }
+    return _instance;
+}
+/** Reset the module-scoped singleton — test-only. */
+export function resetTreeCache() {
+    _instance = null;
+}
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache.
+ *
+ * Components:
+ *   - source code SHA-256 — file edit invalidates only that file's entry
+ *   - circleIrVersion — bumping circle-ir invalidates all entries
+ *   - circleIrAiVersion — bumping circle-ir-ai (which may change
+ *     workflow-level transforms applied to pattern-match output)
+ *     invalidates all entries
+ *   - language — same source, different language tag must miss (the
+ *     analyzer's behavior depends on the language argument)
+ *   - ruleSetFingerprint — caller-supplied digest of the active rule
+ *     set (disabledPasses + projectProfile). Empty string is fine for
+ *     the default rule set.
+ */
+export function computeTreeCacheKey(input) {
+    const sourceSha = crypto.createHash('sha256').update(input.sourceCode).digest('hex');
+    const ruleSet = input.ruleSetFingerprint ?? '';
+    return {
+        content: `${sourceSha}\0${_circleIrVersion}\0${_circleIrAiVersion}\0${input.language}\0${ruleSet}`,
+        classifier: 'tree-pattern-match',
+    };
+}
+/**
+ * Compute a stable fingerprint over an arbitrary rule-set descriptor
+ * (disabledPasses array + projectProfile object). Result is suitable to
+ * pass as `ruleSetFingerprint` to `computeTreeCacheKey`. Order-stable
+ * for arrays so re-ordering `--disable a,b` vs `--disable b,a` still
+ * hits the cache.
+ */
+export function computeRuleSetFingerprint(input) {
+    const passes = [...(input.disabledPasses ?? [])].sort().join(',');
+    // projectProfile JSON-stringifies; key order in objects matters only
+    // if the producer is non-deterministic — `@cognium/project-profile-detect`
+    // emits stable keys, so this is fine. If a future profile producer is
+    // less stable we can switch to a sorted-keys serializer.
+    const profile = input.projectProfile === undefined
+        ? ''
+        : JSON.stringify(input.projectProfile);
+    if (!passes && !profile)
+        return '';
+    return crypto.createHash('sha256').update(`${passes}\0${profile}`).digest('hex');
+}
+/** Test-only: expose the captured engine versions for assertions. */
+export function getTreeCacheVersions() {
+    return {
+        circleIrVersion: _circleIrVersion,
+        circleIrAiVersion: _circleIrAiVersion,
+    };
+}
+//# sourceMappingURL=tree-cache.js.map

package/dist/cache/tree-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree-cache.js","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,8BAA8B;AAiBjF;;;;GAIG;AACH,IAAI,SAAS,GAAmD,IAAI,CAAC;AAErE;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpF,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE;IAC/B,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;YACxE,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtE,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBACnD,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAC/C,OAAO,GAAG,CAAC,OAAiB,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC,EAAE,CAAC;AAEL;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,mBAAmB,CAAqB;YACtD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC;YACrD,MAAM,EAAE,iBAAiB;YACzB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc;IAC5B,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE,GAAG,SAAS,KAAK,gBAAgB,KAAK,kBAAkB,KAAK,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE;QAClG,UAAU,EAAE,oBAAoB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAGzC;IACC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS;QAChD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB;IAIlC,OAAO;QACL,eAAe,EAAE,gBAAgB;QACjC,iBAAiB,EAAE,kBAAkB;KACtC,CAAC;AACJ,CAAC"}

package/dist/cache/verify-cache.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Verify Cache
+ *
+ * Persistent on-disk cache for LLM verification batch results
+ * (cognium-ai#152, P1 of epic #155). Sits in front of the in-memory
+ * `_verifierDedupCache` from verification.ts (#138 step 3) so that
+ * identical `(file SHA, pair-set)` requests survive across processes,
+ * CI runs, and developer iterations — not just within one process.
+ *
+ * Built on top of `ClassificationCache<BatchVerificationResult>` (which
+ * already carries the cognium-ai#151 model-fingerprint key dimension),
+ * with verify-specific key construction:
+ *
+ *   content    = SHA-256(code) + '\\0' + pairsFingerprint
+ *   classifier = 'verify-batch'
+ *   fingerprint = getPhaseModelFingerprint(config)  // includes verify model
+ *
+ * Cache directory: `.cognium/cache/verify/` (separate from the
+ * discovery-phase `.cognium/cache/` so a `rm -rf .cognium/cache/verify/`
+ * only nukes verifier entries).
+ *
+ * Invalidation matrix (acceptance criteria #152):
+ *   - Edit one file in a project   → only that file's entries invalidate
+ *     (file SHA-256 is part of the cache content key)
+ *   - Add a new sink to the engine → existing entries still hit if the
+ *     new sink doesn't change the pair-set for that file
+ *   - Change verification model    → entire cache invalidates
+ *     (model fingerprint is part of the singleton key)
+ *
+ * Env toggles:
+ *   LLM_VERIFY_CACHE=0  → disable persistent verify cache (in-memory
+ *                         dedup from #138 still applies)
+ */
+import { ClassificationCache } from './classification-cache.js';
+import { type LLMConfig } from '../llm/config.js';
+import type { BatchVerificationInput, BatchVerificationResult } from '../llm/verification.js';
+/**
+ * Get the verify-phase persistent cache, keyed by per-phase model
+ * fingerprint. When `LLM_VERIFY_CACHE=0` returns a disabled cache that
+ * no-ops on get/set (callers don't need to branch).
+ */
+export declare function getVerifyCache(config?: LLMConfig): ClassificationCache<BatchVerificationResult>;
+/** Reset the module-scoped singleton — test-only. */
+export declare function resetVerifyCache(): void;
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache. The fingerprint dimension is folded in by the
+ * cache itself (see classification-cache.ts:computeKey).
+ *
+ * Components:
+ *   - file SHA-256 — file edit invalidates only that file's entry
+ *   - pairs fingerprint — sort-invariant over the source/sink set
+ *   - classifier 'verify-batch' — namespace for future
+ *     'verify-pair' / 'verify-flow' tiers without collision
+ */
+export declare function computeVerifyCacheKey(input: BatchVerificationInput): {
+    content: string;
+    classifier: string;
+};
+//# sourceMappingURL=verify-cache.d.ts.map

package/dist/cache/verify-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-cache.d.ts","sourceRoot":"","sources":["../../src/cache/verify-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAiD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAa9F;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,GAAE,SAAiC,GACxC,mBAAmB,CAAC,uBAAuB,CAAC,CAc9C;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,sBAAsB,GAC5B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAOzC"}

package/dist/cache/verify-cache.js

@@ -0,0 +1,103 @@
+/**
+ * Verify Cache
+ *
+ * Persistent on-disk cache for LLM verification batch results
+ * (cognium-ai#152, P1 of epic #155). Sits in front of the in-memory
+ * `_verifierDedupCache` from verification.ts (#138 step 3) so that
+ * identical `(file SHA, pair-set)` requests survive across processes,
+ * CI runs, and developer iterations — not just within one process.
+ *
+ * Built on top of `ClassificationCache<BatchVerificationResult>` (which
+ * already carries the cognium-ai#151 model-fingerprint key dimension),
+ * with verify-specific key construction:
+ *
+ *   content    = SHA-256(code) + '\\0' + pairsFingerprint
+ *   classifier = 'verify-batch'
+ *   fingerprint = getPhaseModelFingerprint(config)  // includes verify model
+ *
+ * Cache directory: `.cognium/cache/verify/` (separate from the
+ * discovery-phase `.cognium/cache/` so a `rm -rf .cognium/cache/verify/`
+ * only nukes verifier entries).
+ *
+ * Invalidation matrix (acceptance criteria #152):
+ *   - Edit one file in a project   → only that file's entries invalidate
+ *     (file SHA-256 is part of the cache content key)
+ *   - Add a new sink to the engine → existing entries still hit if the
+ *     new sink doesn't change the pair-set for that file
+ *   - Change verification model    → entire cache invalidates
+ *     (model fingerprint is part of the singleton key)
+ *
+ * Env toggles:
+ *   LLM_VERIFY_CACHE=0  → disable persistent verify cache (in-memory
+ *                         dedup from #138 still applies)
+ */
+import * as crypto from 'crypto';
+import * as path from 'path';
+import { ClassificationCache } from './classification-cache.js';
+import { getDefaultLLMConfig, getPhaseModelFingerprint } from '../llm/config.js';
+const VERIFY_CACHE_SUBDIR = path.join('.cognium', 'cache', 'verify');
+/**
+ * Module-scoped singleton — distinct from the discovery-phase singleton
+ * in `classification-cache.ts` so the two phases can carry different
+ * model fingerprints (e.g. cheap discovery + strong verifier) without
+ * thrashing each other's cache instance.
+ */
+let _instance = null;
+let _instanceFingerprint = '';
+/**
+ * Get the verify-phase persistent cache, keyed by per-phase model
+ * fingerprint. When `LLM_VERIFY_CACHE=0` returns a disabled cache that
+ * no-ops on get/set (callers don't need to branch).
+ */
+export function getVerifyCache(config = getDefaultLLMConfig()) {
+    const enabled = process.env.LLM_VERIFY_CACHE !== '0';
+    const fingerprint = getPhaseModelFingerprint(config);
+    if (!_instance || _instanceFingerprint !== fingerprint || _instance.getModelFingerprint() !== fingerprint) {
+        _instance = new ClassificationCache({
+            cacheDir: path.join(process.cwd(), VERIFY_CACHE_SUBDIR),
+            modelFingerprint: fingerprint,
+            enabled,
+        });
+        _instanceFingerprint = fingerprint;
+    }
+    return _instance;
+}
+/** Reset the module-scoped singleton — test-only. */
+export function resetVerifyCache() {
+    _instance = null;
+    _instanceFingerprint = '';
+}
+/**
+ * Stable sort over the source/sink pair-set; never mutates the caller's
+ * arrays. Mirrors `_serializeVerifierPairs` in verification.ts so
+ * persistent + in-memory dedup agree on what counts as "the same call".
+ */
+function serializeVerifyPairs(input) {
+    const sources = [...input.sources]
+        .map((s) => `${s.line}|${s.type}|${s.variable ?? ''}`)
+        .sort();
+    const sinks = [...input.sinks]
+        .map((s) => `${s.line}|${s.type}|${s.cwe}|${s.method ?? ''}`)
+        .sort();
+    return JSON.stringify({ sources, sinks });
+}
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache. The fingerprint dimension is folded in by the
+ * cache itself (see classification-cache.ts:computeKey).
+ *
+ * Components:
+ *   - file SHA-256 — file edit invalidates only that file's entry
+ *   - pairs fingerprint — sort-invariant over the source/sink set
+ *   - classifier 'verify-batch' — namespace for future
+ *     'verify-pair' / 'verify-flow' tiers without collision
+ */
+export function computeVerifyCacheKey(input) {
+    const fileSha = crypto.createHash('sha256').update(input.code).digest('hex');
+    const pairsFp = crypto.createHash('sha256').update(serializeVerifyPairs(input)).digest('hex');
+    return {
+        content: `${fileSha}\0${pairsFp}`,
+        classifier: 'verify-batch',
+    };
+}
+//# sourceMappingURL=verify-cache.js.map

package/dist/cache/verify-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-cache.js","sourceRoot":"","sources":["../../src/cache/verify-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAkB,MAAM,kBAAkB,CAAC;AAGjG,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAErE;;;;;GAKG;AACH,IAAI,SAAS,GAAwD,IAAI,CAAC;AAC1E,IAAI,oBAAoB,GAAG,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAoB,mBAAmB,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,GAAG,CAAC;IACrD,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,SAAS,IAAI,oBAAoB,KAAK,WAAW,IAAI,SAAS,CAAC,mBAAmB,EAAE,KAAK,WAAW,EAAE,CAAC;QAC1G,SAAS,GAAG,IAAI,mBAAmB,CAA0B;YAC3D,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mBAAmB,CAAC;YACvD,gBAAgB,EAAE,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,oBAAoB,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB;IAC9B,SAAS,GAAG,IAAI,CAAC;IACjB,oBAAoB,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAA6B;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;SACrD,IAAI,EAAE,CAAC;IACV,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;SAC5D,IAAI,EAAE,CAAC;IACV,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA6B;IAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9F,OAAO;QACL,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,EAAE;QACjC,UAAU,EAAE,cAAc;KAC3B,CAAC;AACJ,CAAC"}