circle-ir-ai 2.27.0 → 2.28.2

package/dist/cache/coordinate.js

@@ -0,0 +1,240 @@
+/**
+ * Package coordinate detection for cache path layout.
+ *
+ * The tree-cache backend (R2 / local-fs) uses the coordinate to build a
+ * package-aware key layout:
+ *
+ *   tree/<ecosystem>/<name>@<version>/<4hex>/<sha>.json   (published coords)
+ *   tree/_local/<name>@<version>/<4hex>/<sha>.json        (repo-root manifest)
+ *   tree/_unowned/<4hex>/<sha>.json                       (no coordinate)
+ *
+ * Coordinate is resolved ONCE per scan from the repo root. We deliberately
+ * keep the extractor minimal (only manifest files we can parse with zero
+ * deps) so it can be folded into hot paths without measurable overhead.
+ *
+ * What's intentionally *not* in scope here:
+ * - per-file coordinate from `node_modules/<pkg>/...` paths (deferred until
+ *   we actually scan transitive deps)
+ * - lockfile-derived coordinates
+ * - Maven `<artifactId>` resolution from a multi-module reactor
+ *
+ * For the first-party github sweep use case, every file in a repo shares
+ * the same coordinate (or falls through to `_unowned`), which is exactly
+ * what we want for cross-runner cache sharing.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * The sentinel coordinate emitted when the repo has no detectable manifest.
+ *
+ * Tree-cache content still gets cached, just under `_unowned/<4hex>/<sha>`.
+ * Re-using the singleton means the path layout is constant for un-coord'd
+ * scans and avoids per-file object allocation.
+ */
+export const UNOWNED = Object.freeze({
+    ecosystem: '_unowned',
+    name: '_',
+    version: '_',
+});
+/**
+ * Render the coordinate as a stable path prefix and a stable hash prefix.
+ *
+ * `pathSegment` is what the backend uses to build the R2 / local-fs key.
+ * `hashPrefix` is what cache-key composers fold into the content hash so
+ * the SHA itself encodes the coordinate (no collision across packages).
+ */
+export function coordinateSegments(c) {
+    if (c.ecosystem === '_unowned') {
+        return { pathSegment: '_unowned', hashPrefix: '' };
+    }
+    const slug = `${c.name}@${c.version}`;
+    return {
+        pathSegment: `${c.ecosystem}/${slug}`,
+        hashPrefix: `${c.ecosystem}\0${slug}`,
+    };
+}
+/**
+ * Detect a package coordinate from the repo root manifest files.
+ *
+ * Synchronous because it runs once per scan at scanner entry and the
+ * disk reads are tiny (`package.json` / `pom.xml`).
+ */
+export function detectCoordinate(repoRoot) {
+    // npm — package.json
+    const pkgJsonPath = path.join(repoRoot, 'package.json');
+    if (fs.existsSync(pkgJsonPath)) {
+        try {
+            const raw = fs.readFileSync(pkgJsonPath, 'utf8');
+            const json = JSON.parse(raw);
+            const name = typeof json.name === 'string' ? json.name.trim() : '';
+            const version = typeof json.version === 'string' ? json.version.trim() : '';
+            if (name && version) {
+                // `private: true` packages are by definition not published — use
+                // `_local` so the layout still groups them but doesn't pollute
+                // an ecosystem namespace with unpublishable coords.
+                const isPrivate = json.private === true;
+                return {
+                    ecosystem: isPrivate ? '_local' : 'npm',
+                    name: name.toLowerCase(),
+                    version,
+                };
+            }
+            if (name) {
+                return { ecosystem: '_local', name: name.toLowerCase(), version: 'HEAD' };
+            }
+        }
+        catch {
+            // fallthrough
+        }
+    }
+    // maven — pom.xml (regex-only; no XML parser dep)
+    const pomPath = path.join(repoRoot, 'pom.xml');
+    if (fs.existsSync(pomPath)) {
+        try {
+            const raw = fs.readFileSync(pomPath, 'utf8');
+            const coord = parsePomCoordinate(raw);
+            if (coord)
+                return coord;
+        }
+        catch {
+            // fallthrough
+        }
+    }
+    // pyproject.toml — minimal `[project] name = "...", version = "..."` lift
+    const pyprojectPath = path.join(repoRoot, 'pyproject.toml');
+    if (fs.existsSync(pyprojectPath)) {
+        try {
+            const raw = fs.readFileSync(pyprojectPath, 'utf8');
+            const coord = parsePyprojectCoordinate(raw);
+            if (coord)
+                return coord;
+        }
+        catch {
+            // fallthrough
+        }
+    }
+    // Cargo.toml — `[package] name = "...", version = "..."`
+    const cargoPath = path.join(repoRoot, 'Cargo.toml');
+    if (fs.existsSync(cargoPath)) {
+        try {
+            const raw = fs.readFileSync(cargoPath, 'utf8');
+            const coord = parseCargoCoordinate(raw);
+            if (coord)
+                return coord;
+        }
+        catch {
+            // fallthrough
+        }
+    }
+    // go.mod — `module <path>` (no version in manifest; use HEAD)
+    const goModPath = path.join(repoRoot, 'go.mod');
+    if (fs.existsSync(goModPath)) {
+        try {
+            const raw = fs.readFileSync(goModPath, 'utf8');
+            const match = /^module\s+(\S+)\s*$/m.exec(raw);
+            if (match?.[1]) {
+                return { ecosystem: 'go', name: match[1].toLowerCase(), version: 'HEAD' };
+            }
+        }
+        catch {
+            // fallthrough
+        }
+    }
+    // Fallback: use repo-root basename as a `_local/<dir>@HEAD` coordinate so
+    // re-scans of the same on-disk repo still share cache, even without a
+    // manifest. The 4-hex shard under `_unowned` is reserved for truly
+    // anonymous content (e.g. ad-hoc file inputs from CI).
+    const basename = path.basename(path.resolve(repoRoot));
+    if (basename && basename !== '/' && basename !== '.') {
+        return { ecosystem: '_local', name: basename.toLowerCase(), version: 'HEAD' };
+    }
+    return UNOWNED;
+}
+/**
+ * Parse `<groupId>:<artifactId>:<version>` from the *top-level* of a pom.
+ *
+ * We intentionally read the project's own `<groupId>/<artifactId>/<version>`
+ * and fall through to `<parent>` only when the child block omits them
+ * (standard Maven inheritance). Sub-modules are not recursed; the cache
+ * shares the parent coordinate which is fine for cross-runner sharing.
+ */
+function parsePomCoordinate(xml) {
+    // Strip XML comments to avoid commented-out parent blocks shadowing real ones.
+    const cleaned = xml.replace(/<!--[\s\S]*?-->/g, '');
+    // Find the top-level <project> children only — i.e. tags that appear
+    // before any sub-element opens. Cheap approximation: take the first
+    // occurrence of each tag at depth-1 by finding the first match.
+    const projectMatch = /<project\b[^>]*>([\s\S]*?)<\/project>/.exec(cleaned);
+    if (!projectMatch)
+        return null;
+    const body = projectMatch[1];
+    const direct = readDirectChildren(body);
+    let groupId = direct.groupId;
+    let artifactId = direct.artifactId;
+    let version = direct.version;
+    if (!groupId || !version) {
+        const parentMatch = /<parent\b[^>]*>([\s\S]*?)<\/parent>/.exec(body);
+        if (parentMatch) {
+            const parent = readDirectChildren(parentMatch[1]);
+            groupId ??= parent.groupId;
+            version ??= parent.version;
+        }
+    }
+    if (!groupId || !artifactId || !version)
+        return null;
+    return {
+        ecosystem: 'maven',
+        name: `${groupId.toLowerCase()}:${artifactId.toLowerCase()}`,
+        version,
+    };
+}
+function readDirectChildren(body) {
+    const pick = (tag) => {
+        const re = new RegExp(`<${tag}>\\s*([^<\\s][^<]*?)\\s*</${tag}>`);
+        const m = re.exec(body);
+        return m?.[1]?.trim();
+    };
+    return {
+        groupId: pick('groupId'),
+        artifactId: pick('artifactId'),
+        version: pick('version'),
+    };
+}
+function parsePyprojectCoordinate(toml) {
+    // Look for `[project]` table, then `name = "..."` and `version = "..."`
+    // inside it. Handle `[tool.poetry]` as a fallback for legacy Poetry
+    // layouts.
+    const tryTable = (header) => {
+        const re = new RegExp(`\\[${header}\\]([\\s\\S]*?)(?=\\n\\[|$)`, 'm');
+        const m = re.exec(toml);
+        if (!m)
+            return null;
+        const body = m[1];
+        const nameMatch = /^\s*name\s*=\s*['"]([^'"]+)['"]/m.exec(body);
+        const versionMatch = /^\s*version\s*=\s*['"]([^'"]+)['"]/m.exec(body);
+        if (!nameMatch || !versionMatch)
+            return null;
+        return {
+            ecosystem: 'pypi',
+            name: nameMatch[1].toLowerCase(),
+            version: versionMatch[1],
+        };
+    };
+    return tryTable('project') ?? tryTable('tool\\.poetry');
+}
+function parseCargoCoordinate(toml) {
+    const m = /\[package\]([\s\S]*?)(?=\n\[|$)/m.exec(toml);
+    if (!m)
+        return null;
+    const body = m[1];
+    const nameMatch = /^\s*name\s*=\s*['"]([^'"]+)['"]/m.exec(body);
+    const versionMatch = /^\s*version\s*=\s*['"]([^'"]+)['"]/m.exec(body);
+    if (!nameMatch || !versionMatch)
+        return null;
+    return {
+        ecosystem: 'cargo',
+        name: nameMatch[1].toLowerCase(),
+        version: versionMatch[1],
+    };
+}
+//# sourceMappingURL=coordinate.js.map

package/dist/cache/coordinate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinate.js","sourceRoot":"","sources":["../../src/cache/coordinate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAY7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtD,SAAS,EAAE,UAAU;IACrB,IAAI,EAAE,GAAG;IACT,OAAO,EAAE,GAAG;CACb,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAoB;IACrD,IAAI,CAAC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACtC,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE;QACrC,UAAU,EAAE,GAAG,CAAC,CAAC,SAAS,KAAK,IAAI,EAAE;KACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,qBAAqB;IACrB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6D,CAAC;YACzF,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;gBACpB,iEAAiE;gBACjE,+DAA+D;gBAC/D,oDAAoD;gBACpD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;gBACxC,OAAO;oBACL,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;oBACvC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;oBACxB,OAAO;iBACR,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC5E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC5E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,mEAAmE;IACnE,uDAAuD;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,IAAI,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAChF,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,+EAA+E;IAC/E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAEpD,qEAAqE;IACrE,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,YAAY,GAAG,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAE7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7B,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACnC,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAE7B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;YAC3B,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAErD,OAAO;QACL,SAAS,EAAE,OAAO;QAClB,IAAI,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,WAAW,EAAE,EAAE;QAC5D,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAsB,EAAE;QAC/C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,6BAA6B,GAAG,GAAG,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;QACxB,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC;QAC9B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,wEAAwE;IACxE,oEAAoE;IACpE,WAAW;IACX,MAAM,QAAQ,GAAG,CAAC,MAAc,EAA4B,EAAE;QAC5D,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,MAAM,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,SAAS,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO;YACL,SAAS,EAAE,MAAM;YACjB,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAChC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;SACzB,CAAC;IACJ,CAAC,CAAC;IACF,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,CAAC,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO;QACL,SAAS,EAAE,OAAO;QAClB,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QAChC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;KACzB,CAAC;AACJ,CAAC"}

package/dist/cache/discovery-cache.d.ts

@@ -1,71 +1,147 @@
 /**
  * Discovery Cache
  *
- * Persistent on-disk cache for LLM discovery results per (className,
- * methodName, methodCode, CWE-set) tuple (cognium-ai#134, P2 of epic
- * #155). Sits in front of the in-memory `_discoveryDedupCache` from
- * discovery.ts (#136) so that identical method-level discovery requests
- * survive across processes, CI runs, and developer iterations — not just
- * within one process.
+ * Persistent on-disk cache for LLM discovery results per method
+ * (cognium-ai#134, P2 of epic #155, key reshape #158 Round 2).
  *
- * Built on top of `ClassificationCache<DiscoveryResult>` (which already
- * carries the cognium-ai#151 model-fingerprint key dimension), with
- * discovery-specific key construction:
+ * Sits in front of the in-memory `_discoveryDedupCache` from
+ * discovery.ts (#136) so identical method-level discovery requests
+ * survive across processes, CI runs, and developer iterations.
  *
- *   content    = className + '\\0' + methodName + '\\0' +
- *                SHA-256(methodCode) + '\\0' + sortedCweSet
+ * **Key composition (Round 2 — 2.28.0):**
+ *
+ *   content    = methodSha + '\0' + sortedCweSet + '\0' + language
+ *              + '\0' + PROMPT_VER
  *   classifier = 'discovery-method'
- *   fingerprint = getPhaseModelFingerprint(config)  // includes discovery model
+ *   fingerprint = getDiscoveryModelFingerprint()  // discovery model ONLY
+ *
+ * **D6 fix:** dropped `className` and `methodName` from the key. They
+ * were redundant — if two different method *bodies* hash to the same
+ * SHA-256, they are byte-identical and the LLM's answer would be too.
+ * Including names also broke cache sharing on refactors that renamed
+ * a method without changing its body. (Names are still passed to the
+ * LLM as context inside the prompt; we just don't key the cache on
+ * them.)
+ *
+ * **D6 also adds `language`:** the same byte-identical snippet means
+ * very different things in Java vs Kotlin vs Scala — without language
+ * in the key, a Java result could be reused for a Kotlin call. Likely
+ * benign in practice but a correctness gap worth closing.
  *
- * Cache directory: `.cognium/cache/discovery/` (separate from the
- * verify-phase `.cognium/cache/verify/` so each phase can be cleared
- * independently — `rm -rf .cognium/cache/discovery/` only nukes
- * discovery entries).
+ * **D2 fix:** uses the discovery-only model fingerprint instead of the
+ * joint disc+verify+component fingerprint, so swapping the verify
+ * model doesn't invalidate discovery results.
  *
- * Invalidation matrix (#134 acceptance criteria):
- *   - Edit one method     → only that method's entry invalidates
- *                           (methodCode SHA-256 is part of the key)
- *   - Add a new CWE       → existing entries still hit for old CWE-sets;
- *                           new CWE-set requests miss
- *   - Change disc model   → entire cache invalidates
- *                           (fingerprint is part of the singleton key)
+ * Cache namespace: `discovery` (separate from `tree` and `verify`).
  *
  * Env toggles:
- *   LLM_DISCOVERY_CACHE=0  → disable persistent discovery cache
- *                             (in-memory dedup from #136 still applies)
+ *   LLM_DISCOVERY_CACHE=0  → disable persistent discovery cache.
  */
 import { ClassificationCache } from './classification-cache.js';
 import { type LLMConfig } from '../llm/config.js';
 import type { DiscoveryResult } from '../llm/discovery.js';
+/** Source item shape returned by `discoverSourcesForLanguage`. */
+export interface LangDiscoveredSource {
+    line: number;
+    variable: string;
+    type: string;
+    confidence: number;
+    reasoning: string;
+}
+/** Sink item shape returned by `discoverSinksForLanguage`. */
+export interface LangDiscoveredSink {
+    line: number;
+    method: string;
+    type: string;
+    cwe: string;
+    argPositions: number[];
+    confidence: number;
+    reasoning: string;
+}
 /**
  * Get the discovery-phase persistent cache, keyed by per-phase model
- * fingerprint. When `LLM_DISCOVERY_CACHE=0` returns a disabled cache that
- * no-ops on get/set (callers don't need to branch).
+ * fingerprint. When `LLM_DISCOVERY_CACHE=0` returns a disabled cache.
  */
 export declare function getDiscoveryCache(config?: LLMConfig): ClassificationCache<DiscoveryResult>;
 /** Reset the module-scoped singleton — test-only. */
 export declare function resetDiscoveryCache(): void;
+/**
+ * Get the persistent cache for `discoverSourcesForLanguage` (cognium-ai#161).
+ * Uses the same `'discovery'` namespace and per-phase discovery model
+ * fingerprint as the per-CWE cache, but a different classifier so the two
+ * never collide. Honors `LLM_DISCOVERY_CACHE=0` to disable.
+ */
+export declare function getDiscoverSourcesLanguageCache(config?: LLMConfig): ClassificationCache<LangDiscoveredSource[]>;
+/**
+ * Get the persistent cache for `discoverSinksForLanguage` (cognium-ai#161).
+ * See `getDiscoverSourcesLanguageCache` for the namespace/fingerprint
+ * rationale.
+ */
+export declare function getDiscoverSinksLanguageCache(config?: LLMConfig): ClassificationCache<LangDiscoveredSink[]>;
+/**
+ * Compute the `(content, classifier)` tuple for the source-discoverer
+ * cache. Components (in order):
+ *   - language — Java vs Kotlin etc. (same rationale as D6 above)
+ *   - methodSha — code edit invalidates only that entry
+ *   - functionName — same body called as different methods is a distinct
+ *     prompt (the name is templated into the user prompt)
+ *   - moduleRole — passed verbatim into the prompt
+ *   - existingSourcesSha — the "what we already found" context changes
+ *     the prompt, so it must change the key
+ *   - LANG_DISCOVERER_PROMPT_VER — global invalidator for the language
+ *     discoverer prompt template
+ */
+export declare function computeDiscoverSourcesLanguageCacheKey(input: {
+    language: string;
+    code: string;
+    functionName: string;
+    moduleRole: string;
+    existingSources: string;
+}): {
+    content: string;
+    classifier: string;
+};
+/**
+ * Compute the `(content, classifier)` tuple for the sink-discoverer
+ * cache. Mirrors `computeDiscoverSourcesLanguageCacheKey` but uses the
+ * sink-prompt context (`methodCalls`, `existingSinks`) instead of the
+ * source-prompt context.
+ */
+export declare function computeDiscoverSinksLanguageCacheKey(input: {
+    language: string;
+    code: string;
+    functionName: string;
+    methodCalls: string;
+    existingSinks: string;
+}): {
+    content: string;
+    classifier: string;
+};
+/** Test-only: expose the language-discoverer prompt-version sentinel. */
+export declare function getLangDiscovererCachePromptVersion(): string;
 /**
  * Compute the `(content, classifier)` tuple for the underlying
  * ClassificationCache. The fingerprint dimension is folded in by the
- * cache itself (see classification-cache.ts:computeKey).
+ * cache itself.
  *
  * Components:
- *   - className — disambiguates same-named methods across classes
- *   - methodName — per-method granularity (matches the per-method LLM call)
- *   - methodCode SHA-256 — method edit invalidates only that method's entry
+ *   - methodCode SHA-256 — method edit invalidates only that entry
  *   - sortedCweSet — different CWE-set requests on the same method don't
- *     reuse each other's prompts (different system prompt, different answer)
- *   - classifier 'discovery-method' — namespace for future
- *     'discovery-file' / 'discovery-class' tiers without collision
+ *     reuse each other's prompts
+ *   - language — Java vs Kotlin etc. (D6 fix)
+ *   - PROMPT_VER — global discovery-prompt invalidator
+ *
+ * Note: `className` / `methodName` are intentionally NOT in the key
+ * (D6 fix). They're prompt-context, not identity.
  */
 export declare function computeDiscoveryCacheKey(input: {
-    className: string;
-    methodName: string;
     methodCode: string;
     targetCWEs: ReadonlyArray<string>;
+    language: string;
 }): {
     content: string;
     classifier: string;
 };
+/** Test-only: expose the prompt-version sentinel. */
+export declare function getDiscoveryCachePromptVersion(): string;
 //# sourceMappingURL=discovery-cache.d.ts.map

package/dist/cache/discovery-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery-cache.d.ts","sourceRoot":"","sources":["../../src/cache/discovery-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAiD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAa3D;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,SAAiC,GACxC,mBAAmB,CAAC,eAAe,CAAC,CActC;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACnC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAO1C"}
+{"version":3,"file":"discovery-cache.d.ts","sourceRoot":"","sources":["../../src/cache/discovery-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAqD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAuB3D,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,SAAiC,GACxC,mBAAmB,CAAC,eAAe,CAAC,CAetC;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,IAAI,IAAI,CAO1C;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,GAAE,SAAiC,GACxC,mBAAmB,CAAC,oBAAoB,EAAE,CAAC,CAkB7C;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,GAAE,SAAiC,GACxC,mBAAmB,CAAC,kBAAkB,EAAE,CAAC,CAkB3C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAc1C;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAe1C;AAED,yEAAyE;AACzE,wBAAgB,mCAAmC,IAAI,MAAM,CAE5D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAO1C;AAED,qDAAqD;AACrD,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD"}