circle-ir-ai 2.27.0 → 2.28.2

package/dist/cache/discovery-cache.js

@@ -1,62 +1,77 @@
 /**
  * Discovery Cache
  *
- * Persistent on-disk cache for LLM discovery results per (className,
- * methodName, methodCode, CWE-set) tuple (cognium-ai#134, P2 of epic
- * #155). Sits in front of the in-memory `_discoveryDedupCache` from
- * discovery.ts (#136) so that identical method-level discovery requests
- * survive across processes, CI runs, and developer iterations — not just
- * within one process.
+ * Persistent on-disk cache for LLM discovery results per method
+ * (cognium-ai#134, P2 of epic #155, key reshape #158 Round 2).
  *
- * Built on top of `ClassificationCache<DiscoveryResult>` (which already
- * carries the cognium-ai#151 model-fingerprint key dimension), with
- * discovery-specific key construction:
+ * Sits in front of the in-memory `_discoveryDedupCache` from
+ * discovery.ts (#136) so identical method-level discovery requests
+ * survive across processes, CI runs, and developer iterations.
  *
- *   content    = className + '\\0' + methodName + '\\0' +
- *                SHA-256(methodCode) + '\\0' + sortedCweSet
+ * **Key composition (Round 2 — 2.28.0):**
+ *
+ *   content    = methodSha + '\0' + sortedCweSet + '\0' + language
+ *              + '\0' + PROMPT_VER
  *   classifier = 'discovery-method'
- *   fingerprint = getPhaseModelFingerprint(config)  // includes discovery model
+ *   fingerprint = getDiscoveryModelFingerprint()  // discovery model ONLY
+ *
+ * **D6 fix:** dropped `className` and `methodName` from the key. They
+ * were redundant — if two different method *bodies* hash to the same
+ * SHA-256, they are byte-identical and the LLM's answer would be too.
+ * Including names also broke cache sharing on refactors that renamed
+ * a method without changing its body. (Names are still passed to the
+ * LLM as context inside the prompt; we just don't key the cache on
+ * them.)
+ *
+ * **D6 also adds `language`:** the same byte-identical snippet means
+ * very different things in Java vs Kotlin vs Scala — without language
+ * in the key, a Java result could be reused for a Kotlin call. Likely
+ * benign in practice but a correctness gap worth closing.
  *
- * Cache directory: `.cognium/cache/discovery/` (separate from the
- * verify-phase `.cognium/cache/verify/` so each phase can be cleared
- * independently — `rm -rf .cognium/cache/discovery/` only nukes
- * discovery entries).
+ * **D2 fix:** uses the discovery-only model fingerprint instead of the
+ * joint disc+verify+component fingerprint, so swapping the verify
+ * model doesn't invalidate discovery results.
  *
- * Invalidation matrix (#134 acceptance criteria):
- *   - Edit one method     → only that method's entry invalidates
- *                           (methodCode SHA-256 is part of the key)
- *   - Add a new CWE       → existing entries still hit for old CWE-sets;
- *                           new CWE-set requests miss
- *   - Change disc model   → entire cache invalidates
- *                           (fingerprint is part of the singleton key)
+ * Cache namespace: `discovery` (separate from `tree` and `verify`).
  *
  * Env toggles:
- *   LLM_DISCOVERY_CACHE=0  → disable persistent discovery cache
- *                             (in-memory dedup from #136 still applies)
+ *   LLM_DISCOVERY_CACHE=0  → disable persistent discovery cache.
  */
 import * as crypto from 'crypto';
 import * as path from 'path';
 import { ClassificationCache } from './classification-cache.js';
-import { getDefaultLLMConfig, getPhaseModelFingerprint } from '../llm/config.js';
-const DISCOVERY_CACHE_SUBDIR = path.join('.cognium', 'cache', 'discovery');
+import { getDefaultLLMConfig, getDiscoveryModelFingerprint } from '../llm/config.js';
+const DISCOVERY_CACHE_SUBDIR = path.join('.cognium', 'cache');
+/**
+ * Prompt-version sentinel for discovery. Bump when the discovery prompt
+ * template materially changes (e.g. new few-shot examples, different
+ * instructions for `exploitable`, new output schema).
+ */
+const PROMPT_VER = 'disc-v1';
 /**
- * Module-scoped singleton — distinct from the discovery-phase singleton
- * in `classification-cache.ts` and the verify-phase singleton in
- * `verify-cache.ts` so each phase can carry its own model fingerprint
- * (e.g. cheap discovery + strong verifier) without thrashing.
+ * Separate prompt-version sentinel for the language-specific discoverers
+ * (`discoverSourcesForLanguage` / `discoverSinksForLanguage`). These use
+ * a different prompt template (`getPrompt(language, 'discoverSources' |
+ * 'discoverSinks')`) than the per-CWE `discoverInMethod` flow, so they
+ * need an independent version dimension. cognium-ai#161.
  */
+const LANG_DISCOVERER_PROMPT_VER = 'lang-disc-v1';
 let _instance = null;
 let _instanceFingerprint = '';
+let _sourcesLangInstance = null;
+let _sourcesLangFingerprint = '';
+let _sinksLangInstance = null;
+let _sinksLangFingerprint = '';
 /**
  * Get the discovery-phase persistent cache, keyed by per-phase model
- * fingerprint. When `LLM_DISCOVERY_CACHE=0` returns a disabled cache that
- * no-ops on get/set (callers don't need to branch).
+ * fingerprint. When `LLM_DISCOVERY_CACHE=0` returns a disabled cache.
  */
 export function getDiscoveryCache(config = getDefaultLLMConfig()) {
     const enabled = process.env.LLM_DISCOVERY_CACHE !== '0';
-    const fingerprint = getPhaseModelFingerprint(config);
+    const fingerprint = getDiscoveryModelFingerprint(config);
     if (!_instance || _instanceFingerprint !== fingerprint || _instance.getModelFingerprint() !== fingerprint) {
         _instance = new ClassificationCache({
+            namespace: 'discovery',
             cacheDir: path.join(process.cwd(), DISCOVERY_CACHE_SUBDIR),
             modelFingerprint: fingerprint,
             enabled,
@@ -69,27 +84,133 @@ export function getDiscoveryCache(config = getDefaultLLMConfig()) {
 export function resetDiscoveryCache() {
     _instance = null;
     _instanceFingerprint = '';
+    _sourcesLangInstance = null;
+    _sourcesLangFingerprint = '';
+    _sinksLangInstance = null;
+    _sinksLangFingerprint = '';
+}
+/**
+ * Get the persistent cache for `discoverSourcesForLanguage` (cognium-ai#161).
+ * Uses the same `'discovery'` namespace and per-phase discovery model
+ * fingerprint as the per-CWE cache, but a different classifier so the two
+ * never collide. Honors `LLM_DISCOVERY_CACHE=0` to disable.
+ */
+export function getDiscoverSourcesLanguageCache(config = getDefaultLLMConfig()) {
+    const enabled = process.env.LLM_DISCOVERY_CACHE !== '0';
+    const fingerprint = getDiscoveryModelFingerprint(config);
+    if (!_sourcesLangInstance
+        || _sourcesLangFingerprint !== fingerprint
+        || _sourcesLangInstance.getModelFingerprint() !== fingerprint) {
+        _sourcesLangInstance = new ClassificationCache({
+            namespace: 'discovery',
+            cacheDir: path.join(process.cwd(), DISCOVERY_CACHE_SUBDIR),
+            modelFingerprint: fingerprint,
+            enabled,
+        });
+        _sourcesLangFingerprint = fingerprint;
+    }
+    return _sourcesLangInstance;
+}
+/**
+ * Get the persistent cache for `discoverSinksForLanguage` (cognium-ai#161).
+ * See `getDiscoverSourcesLanguageCache` for the namespace/fingerprint
+ * rationale.
+ */
+export function getDiscoverSinksLanguageCache(config = getDefaultLLMConfig()) {
+    const enabled = process.env.LLM_DISCOVERY_CACHE !== '0';
+    const fingerprint = getDiscoveryModelFingerprint(config);
+    if (!_sinksLangInstance
+        || _sinksLangFingerprint !== fingerprint
+        || _sinksLangInstance.getModelFingerprint() !== fingerprint) {
+        _sinksLangInstance = new ClassificationCache({
+            namespace: 'discovery',
+            cacheDir: path.join(process.cwd(), DISCOVERY_CACHE_SUBDIR),
+            modelFingerprint: fingerprint,
+            enabled,
+        });
+        _sinksLangFingerprint = fingerprint;
+    }
+    return _sinksLangInstance;
+}
+/**
+ * Compute the `(content, classifier)` tuple for the source-discoverer
+ * cache. Components (in order):
+ *   - language — Java vs Kotlin etc. (same rationale as D6 above)
+ *   - methodSha — code edit invalidates only that entry
+ *   - functionName — same body called as different methods is a distinct
+ *     prompt (the name is templated into the user prompt)
+ *   - moduleRole — passed verbatim into the prompt
+ *   - existingSourcesSha — the "what we already found" context changes
+ *     the prompt, so it must change the key
+ *   - LANG_DISCOVERER_PROMPT_VER — global invalidator for the language
+ *     discoverer prompt template
+ */
+export function computeDiscoverSourcesLanguageCacheKey(input) {
+    const methodSha = crypto.createHash('sha256').update(input.code).digest('hex');
+    const existingSha = crypto.createHash('sha256').update(input.existingSources).digest('hex');
+    return {
+        content: [
+            input.language,
+            methodSha,
+            input.functionName,
+            input.moduleRole,
+            existingSha,
+            LANG_DISCOVERER_PROMPT_VER,
+        ].join('\0'),
+        classifier: 'discover-sources-lang',
+    };
+}
+/**
+ * Compute the `(content, classifier)` tuple for the sink-discoverer
+ * cache. Mirrors `computeDiscoverSourcesLanguageCacheKey` but uses the
+ * sink-prompt context (`methodCalls`, `existingSinks`) instead of the
+ * source-prompt context.
+ */
+export function computeDiscoverSinksLanguageCacheKey(input) {
+    const methodSha = crypto.createHash('sha256').update(input.code).digest('hex');
+    const methodCallsSha = crypto.createHash('sha256').update(input.methodCalls).digest('hex');
+    const existingSha = crypto.createHash('sha256').update(input.existingSinks).digest('hex');
+    return {
+        content: [
+            input.language,
+            methodSha,
+            input.functionName,
+            methodCallsSha,
+            existingSha,
+            LANG_DISCOVERER_PROMPT_VER,
+        ].join('\0'),
+        classifier: 'discover-sinks-lang',
+    };
+}
+/** Test-only: expose the language-discoverer prompt-version sentinel. */
+export function getLangDiscovererCachePromptVersion() {
+    return LANG_DISCOVERER_PROMPT_VER;
 }
 /**
  * Compute the `(content, classifier)` tuple for the underlying
  * ClassificationCache. The fingerprint dimension is folded in by the
- * cache itself (see classification-cache.ts:computeKey).
+ * cache itself.
  *
  * Components:
- *   - className — disambiguates same-named methods across classes
- *   - methodName — per-method granularity (matches the per-method LLM call)
- *   - methodCode SHA-256 — method edit invalidates only that method's entry
+ *   - methodCode SHA-256 — method edit invalidates only that entry
  *   - sortedCweSet — different CWE-set requests on the same method don't
- *     reuse each other's prompts (different system prompt, different answer)
- *   - classifier 'discovery-method' — namespace for future
- *     'discovery-file' / 'discovery-class' tiers without collision
+ *     reuse each other's prompts
+ *   - language — Java vs Kotlin etc. (D6 fix)
+ *   - PROMPT_VER — global discovery-prompt invalidator
+ *
+ * Note: `className` / `methodName` are intentionally NOT in the key
+ * (D6 fix). They're prompt-context, not identity.
  */
 export function computeDiscoveryCacheKey(input) {
     const methodSha = crypto.createHash('sha256').update(input.methodCode).digest('hex');
     const sortedCweSet = [...input.targetCWEs].sort().join(',');
     return {
-        content: `${input.className}\0${input.methodName}\0${methodSha}\0${sortedCweSet}`,
+        content: [methodSha, sortedCweSet, input.language, PROMPT_VER].join('\0'),
         classifier: 'discovery-method',
     };
 }
+/** Test-only: expose the prompt-version sentinel. */
+export function getDiscoveryCachePromptVersion() {
+    return PROMPT_VER;
+}
 //# sourceMappingURL=discovery-cache.js.map

package/dist/cache/discovery-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery-cache.js","sourceRoot":"","sources":["../../src/cache/discovery-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAkB,MAAM,kBAAkB,CAAC;AAGjG,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,IAAI,SAAS,GAAgD,IAAI,CAAC;AAClE,IAAI,oBAAoB,GAAG,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAoB,mBAAmB,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;IACxD,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,SAAS,IAAI,oBAAoB,KAAK,WAAW,IAAI,SAAS,CAAC,mBAAmB,EAAE,KAAK,WAAW,EAAE,CAAC;QAC1G,SAAS,GAAG,IAAI,mBAAmB,CAAkB;YACnD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;YAC1D,gBAAgB,EAAE,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,oBAAoB,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB;IACjC,SAAS,GAAG,IAAI,CAAC;IACjB,oBAAoB,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAKxC;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,KAAK,SAAS,KAAK,YAAY,EAAE;QACjF,UAAU,EAAE,kBAAkB;KAC/B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"discovery-cache.js","sourceRoot":"","sources":["../../src/cache/discovery-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAkB,MAAM,kBAAkB,CAAC;AAGrG,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,cAAc,CAAC;AAElD,IAAI,SAAS,GAAgD,IAAI,CAAC;AAClE,IAAI,oBAAoB,GAAG,EAAE,CAAC;AAsB9B,IAAI,oBAAoB,GAAuD,IAAI,CAAC;AACpF,IAAI,uBAAuB,GAAG,EAAE,CAAC;AACjC,IAAI,kBAAkB,GAAqD,IAAI,CAAC;AAChF,IAAI,qBAAqB,GAAG,EAAE,CAAC;AAE/B;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAoB,mBAAmB,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;IACxD,MAAM,WAAW,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,CAAC,SAAS,IAAI,oBAAoB,KAAK,WAAW,IAAI,SAAS,CAAC,mBAAmB,EAAE,KAAK,WAAW,EAAE,CAAC;QAC1G,SAAS,GAAG,IAAI,mBAAmB,CAAkB;YACnD,SAAS,EAAE,WAAW;YACtB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;YAC1D,gBAAgB,EAAE,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,oBAAoB,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB;IACjC,SAAS,GAAG,IAAI,CAAC;IACjB,oBAAoB,GAAG,EAAE,CAAC;IAC1B,oBAAoB,GAAG,IAAI,CAAC;IAC5B,uBAAuB,GAAG,EAAE,CAAC;IAC7B,kBAAkB,GAAG,IAAI,CAAC;IAC1B,qBAAqB,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,SAAoB,mBAAmB,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;IACxD,MAAM,WAAW,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAEzD,IACE,CAAC,oBAAoB;WAClB,uBAAuB,KAAK,WAAW;WACvC,oBAAoB,CAAC,mBAAmB,EAAE,KAAK,WAAW,EAC7D,CAAC;QACD,oBAAoB,GAAG,IAAI,mBAAmB,CAAyB;YACrE,SAAS,EAAE,WAAW;YACtB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;YAC1D,gBAAgB,EAAE,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,uBAAuB,GAAG,WAAW,CAAC;IACxC,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAoB,mBAAmB,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;IACxD,MAAM,WAAW,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAEzD,IACE,CAAC,kBAAkB;WAChB,qBAAqB,KAAK,WAAW;WACrC,kBAAkB,CAAC,mBAAmB,EAAE,KAAK,WAAW,EAC3D,CAAC;QACD,kBAAkB,GAAG,IAAI,mBAAmB,CAAuB;YACjE,SAAS,EAAE,WAAW;YACtB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;YAC1D,gBAAgB,EAAE,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,qBAAqB,GAAG,WAAW,CAAC;IACtC,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5F,OAAO;QACL,OAAO,EAAE;YACP,KAAK,CAAC,QAAQ;YACd,SAAS;YACT,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,UAAU;YAChB,WAAW;YACX,0BAA0B;SAC3B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,UAAU,EAAE,uBAAuB;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAMpD;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO;QACL,OAAO,EAAE;YACP,KAAK,CAAC,QAAQ;YACd,SAAS;YACT,KAAK,CAAC,YAAY;YAClB,cAAc;YACd,WAAW;YACX,0BAA0B;SAC3B,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,UAAU,EAAE,qBAAqB;KAClC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mCAAmC;IACjD,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACzE,UAAU,EAAE,kBAAkB;KAC/B,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,8BAA8B;IAC5C,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/cache/tree-cache.d.ts

@@ -2,56 +2,45 @@
  * Tree Cache
  *
  * Persistent on-disk cache for `runPatternMatch` output (cognium-ai#153,
- * P3 of epic #155). Pattern-match output is a pure function of file
- * content + engine version, so caching it eliminates the parse +
- * AST-walk + SAST-rule firing on warm runs.
+ * P3 of epic #155, key reshape #158 Round 2).
  *
- * Empirically (v2.20.6 gson re-verify, 2026-06-29) the scan stage ate
- * 179s of 358s end-to-end — ~half the wall-clock is re-discovering
- * structure circle-ir already knows. Caching the pattern-match seam
- * is the smallest empirical win in the cache stack (no LLM-token
- * reduction, only CPU + wall-clock), but it stacks cleanly on the
- * #145 static pre-filter — a cached tree means the pre-filter has
- * more to chew on, which reduces enrichment calls downstream.
+ * Pattern-match output is a pure function of file content + engine
+ * version + active rule set, so caching it eliminates the parse +
+ * AST-walk + SAST-rule firing on warm runs.
  *
  * **Scope:** caches `PatternMatchResult` only, NOT full `CircleIR`.
- * The full graph (cross-file CFG, project-level type hierarchy) is
- * too entangled with project context to cache safely without a full
- * `CircleIR.serialize()` upstream — that's a separate D3 design
- * question, file separately if pursued.
  *
- * **Key composition:**
- *   content = SHA-256(sourceCode) + '\0' +
- *             circleIrVersion + '\0' +
- *             circleIrAiVersion + '\0' +
- *             language + '\0' +
- *             ruleSetFingerprint
+ * **Key composition (Round 2 — 2.28.0):**
+ *
+ *   content    = sourceSha + '\0' + circleIrVersion + '\0' +
+ *                circleIrAiVersion + '\0' + language + '\0' +
+ *                ruleSetFingerprint + '\0' + PROMPT_VER
  *   classifier = 'tree-pattern-match'
  *
- * Any of: file edit, circle-ir bump, circle-ir-ai bump, language
- * change, or rule-set change → cache miss.
+ * The composed (content, classifier) is then fed into ClassificationCache,
+ * which folds in `SCHEMA_VER`, the model fingerprint (`''` for tree since
+ * the static path doesn't call any LLM), and the coordinate hash-prefix.
  *
- * **Storage:** `ClassificationCache<PatternMatchResult>` under
- * `.cognium/cache/tree/`, 7-day TTL (longer than discovery cache
- * because the input is structural and stable — pattern-match output
- * doesn't drift between scans the way an LLM call would).
+ * Any of: file edit, circle-ir bump, circle-ir-ai bump, language change,
+ * rule-set change, prompt-version bump, schema bump → cache miss.
+ *
+ * **D1 fix (Round 2):** `computeRuleSetFingerprint` now accepts an
+ * optional `repoRoot` and, when the projectProfile is a Map, normalizes
+ * its keys to repo-relative paths before sorting. This eliminates the
+ * absolute-path leak that caused cross-runner tree-cache misses in the
+ * 2-repo R2 validation: runner-A wrote keys hashing
+ * `/tmp/r2-validation/repos/A/...`, runner-B wrote keys hashing
+ * `/tmp/r2-validation/repos/B/...`, and the bucket doubled instead of
+ * sharing.
  *
  * **Env toggles:**
  *   LLM_TREE_CACHE=0  → disable persistent tree cache.
- *
- * **Versioning note:** unlike discovery-cache / verify-cache, this
- * cache is NOT keyed on the LLM model fingerprint (pattern-match is
- * static — circle-ir doesn't call any LLM). It IS keyed on the
- * circle-ir and circle-ir-ai package versions because either bump
- * can change the workflow-level transforms applied to the result.
  */
 import { ClassificationCache } from './classification-cache.js';
 import type { TaintSource, TaintSink, TypeInfo, DFG, SastFinding } from 'circle-ir';
 /**
  * Shape persisted to disk. Mirrors the return of `runPatternMatch` in
- * `src/agents/mastra/workflow.ts`. All fields are plain JSON-serializable
- * (no class instances, no cycles) so the underlying ClassificationCache
- * round-trip is safe.
+ * `src/agents/mastra/workflow.ts`. All fields are plain JSON-serializable.
  */
 export interface PatternMatchResult {
     patternSources: TaintSource[];
@@ -63,7 +52,7 @@ export interface PatternMatchResult {
 }
 /**
  * Get the tree-cache singleton. When `LLM_TREE_CACHE=0` returns a
- * disabled cache that no-ops on get/set (callers don't need to branch).
+ * disabled cache that no-ops on get/set.
  */
 export declare function getTreeCache(): ClassificationCache<PatternMatchResult>;
 /** Reset the module-scoped singleton — test-only. */
@@ -71,18 +60,6 @@ export declare function resetTreeCache(): void;
 /**
  * Compute the `(content, classifier)` tuple for the underlying
  * ClassificationCache.
- *
- * Components:
- *   - source code SHA-256 — file edit invalidates only that file's entry
- *   - circleIrVersion — bumping circle-ir invalidates all entries
- *   - circleIrAiVersion — bumping circle-ir-ai (which may change
- *     workflow-level transforms applied to pattern-match output)
- *     invalidates all entries
- *   - language — same source, different language tag must miss (the
- *     analyzer's behavior depends on the language argument)
- *   - ruleSetFingerprint — caller-supplied digest of the active rule
- *     set (disabledPasses + projectProfile). Empty string is fine for
- *     the default rule set.
  */
 export declare function computeTreeCacheKey(input: {
     sourceCode: string;
@@ -93,19 +70,37 @@ export declare function computeTreeCacheKey(input: {
     classifier: string;
 };
 /**
- * Compute a stable fingerprint over an arbitrary rule-set descriptor
- * (disabledPasses array + projectProfile object). Result is suitable to
- * pass as `ruleSetFingerprint` to `computeTreeCacheKey`. Order-stable
- * for arrays so re-ordering `--disable a,b` vs `--disable b,a` still
- * hits the cache.
+ * Compute a stable fingerprint over an arbitrary rule-set descriptor.
+ *
+ * Order-stable for `disabledPasses` so re-ordering `--disable a,b` vs
+ * `--disable b,a` still hits the cache.
+ *
+ * D1 (Round 2): when `projectProfile` is a `Map<string, ProjectProfile>`
+ * keyed by absolute file paths, the keys are relativized to `repoRoot`
+ * and sorted. Without this, two runners that check out the same repo to
+ * different absolute paths produce different fingerprints and the
+ * cross-runner R2 cache never shares.
+ *
+ * When `repoRoot` is omitted and `projectProfile` is a Map, we fall back
+ * to dropping the keys entirely and hashing only the sorted *values*
+ * (still order-stable, still cross-runner-safe; loses the per-file
+ * granularity but no caller currently needs it for fingerprinting).
  */
 export declare function computeRuleSetFingerprint(input: {
     disabledPasses?: string[];
     projectProfile?: unknown;
+    repoRoot?: string;
 }): string;
+/**
+ * Render a project-profile descriptor as a stable, cross-runner-safe
+ * string. Exported for the test suite to assert on the D1 fix.
+ */
+export declare function normalizeProjectProfile(profile: unknown, repoRoot?: string): string;
 /** Test-only: expose the captured engine versions for assertions. */
 export declare function getTreeCacheVersions(): {
     circleIrVersion: string;
     circleIrAiVersion: string;
 };
+/** Test-only: expose the prompt-version sentinel. */
+export declare function getTreeCachePromptVersion(): string;
 //# sourceMappingURL=tree-cache.d.ts.map

package/dist/cache/tree-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tree-cache.d.ts","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAMH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAKpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9B,YAAY,EAAE,SAAS,EAAE,CAAC;IAC1B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,GAAG,EAAE,GAAG,CAAC;CACV;AAiDD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAUtE;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAO1C;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,MAAM,CAWT;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,IAAI;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAKA"}
+{"version":3,"file":"tree-cache.d.ts","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAMH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAcpF;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9B,YAAY,EAAE,SAAS,EAAE,CAAC;IAC1B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,GAAG,EAAE,GAAG,CAAC;CACV;AAkCD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAYtE;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAc1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAKT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAsBnF;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,IAAI;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAKA;AAED,qDAAqD;AACrD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD"}