circle-ir-ai 2.33.0 → 2.33.2

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.33.1] - 2026-07-02
+
+### Fixed — Restore CWE-078 detection via `circle-ir` upgrade (cognium-ai#184)
+
+Upgrades `circle-ir` dep `3.144.0 → 3.145.0` to close the CWE-078 regression
+surfaced by the Sprint L5c CWE-Bench-Java gate. Baseline `86.7%` (104/120,
+2026-06-23 on `3.90.0`) had dropped to `84.2%` (101/120) on `3.144.0`, with
+the CWE-078 sub-bucket falling `12/13 → 9/13`. Three CVEs regressed to
+`[MISSED]` — all XStream/deserialization or Docker credential-URL shapes:
+
+- **CVE-2020-26217** — `x-stream/xstream_1.4.14-java7`, `XStream.setupSecurity`
+- **CVE-2021-21345** — `x-stream/xstream_1.4.15`, `XStream.setupSecurity`
+- **CVE-2022-20617** — `jenkinsci/docker-commons-plugin_1.17`,
+  `DockerRegistryEndpoint.imageName`
+
+Root cause is in the `circle-ir` engine's static layer — the CWE-Bench-Java
+runner calls `analyze()` directly, so the L5c cluster wiring is off the code
+path (confirmed by attribution work at the end of the L5c ship). Upstream
+hotfix landed in `circle-ir@3.145.0` (published `latest` on 2026-07-02).
+
+### Added — CWE-078 regression fixture
+
+- `tests/regression/cwe-078-xstream.test.ts` — pins expected detection of
+  `command_injection`/`code_injection` sinks on a minimal XStream
+  `setupSecurity` shape. Runs against the pinned npm `circle-ir` so future
+  drift is caught in `npm test`, not in the 30-minute benchmark run.
+
 ## [2.33.0] - 2026-07-02
 
 ### Added — Cluster emission + policy wiring (cognium-ai#154, Sprint L5c; closes epic #155)

package/dist/agents/mastra/agents.d.ts

@@ -53,7 +53,7 @@ export declare const enrichmentAgent: Agent<"enrichment-agent", {
             argPositions: number[];
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
-}, undefined, unknown>;
+}, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 /**
  * Verification Agent
  *
@@ -81,7 +81,7 @@ export declare const verificationAgent: Agent<"verification-agent", {
         sanitizersFound: string[];
         attackVector: string;
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "verify-vulnerability", unknown>;
-}, undefined, unknown>;
+}, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 /**
  * Cross-File Analysis Agent
  *
@@ -108,7 +108,7 @@ export declare const crossFileAgent: Agent<"cross-file-agent", {
             flowType: "direct" | "transitive" | "conditional";
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-}, undefined, unknown>;
+}, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 /**
  * Orchestrator Agent
  *
@@ -196,7 +196,7 @@ export declare const orchestratorAgent: Agent<"orchestrator-agent", {
             flowType: "direct" | "transitive" | "conditional";
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-}, undefined, unknown>;
+}, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 export declare const agents: {
     enrichment: Agent<"enrichment-agent", {
         classifyRole: import("@mastra/core/tools").Tool<{
@@ -240,7 +240,7 @@ export declare const agents: {
                 argPositions: number[];
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
-    }, undefined, unknown>;
+    }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
     verification: Agent<"verification-agent", {
         verifyVulnerability: import("@mastra/core/tools").Tool<{
             cwe: string;
@@ -262,7 +262,7 @@ export declare const agents: {
             sanitizersFound: string[];
             attackVector: string;
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "verify-vulnerability", unknown>;
-    }, undefined, unknown>;
+    }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
     crossFile: Agent<"cross-file-agent", {
         crossFileTaint: import("@mastra/core/tools").Tool<{
             sourceCode: string;
@@ -284,7 +284,7 @@ export declare const agents: {
                 flowType: "direct" | "transitive" | "conditional";
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-    }, undefined, unknown>;
+    }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
     orchestrator: Agent<"orchestrator-agent", {
         classifyRole: import("@mastra/core/tools").Tool<{
             className: string;
@@ -367,7 +367,7 @@ export declare const agents: {
                 flowType: "direct" | "transitive" | "conditional";
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-    }, undefined, unknown>;
+    }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 };
 export default agents;
 //# sourceMappingURL=agents.d.ts.map

package/dist/agents/mastra/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../src/agents/mastra/agents.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA8N3C;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA2B1B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;sBAyB5B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;sBAqBzB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA0B5B,CAAC;AAMH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKlB,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../src/agents/mastra/agents.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA8N3C;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kFA2B1B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;kFAyB5B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;kFAqBzB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kFA0B5B,CAAC;AAMH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKlB,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/agents/mastra/instance.d.ts

@@ -62,7 +62,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                     argPositions: number[];
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
-        }, undefined, unknown>;
+        }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
         verification: import("@mastra/core/agent").Agent<"verification-agent", {
             verifyVulnerability: import("@mastra/core/tools").Tool<{
                 cwe: string;
@@ -84,7 +84,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 sanitizersFound: string[];
                 attackVector: string;
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "verify-vulnerability", unknown>;
-        }, undefined, unknown>;
+        }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
         crossFile: import("@mastra/core/agent").Agent<"cross-file-agent", {
             crossFileTaint: import("@mastra/core/tools").Tool<{
                 sourceCode: string;
@@ -106,7 +106,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                     flowType: "direct" | "transitive" | "conditional";
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-        }, undefined, unknown>;
+        }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
         orchestrator: import("@mastra/core/agent").Agent<"orchestrator-agent", {
             classifyRole: import("@mastra/core/tools").Tool<{
                 className: string;
@@ -189,8 +189,8 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                     flowType: "direct" | "transitive" | "conditional";
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-        }, undefined, unknown>;
-    }, Record<string, import("@mastra/core/workflows").AnyWorkflow>, Record<string, import("@mastra/core/vector").MastraVector<any>>, Record<string, import("@mastra/core/tts").MastraTTS>, import("@mastra/core/logger").IMastraLogger, Record<string, import("@mastra/core/mcp").MCPServerBase<any>>, Record<string, import("@mastra/core/evals").MastraScorer<any, any, any, any>>, Record<string, import("@mastra/core/tools").ToolAction<any, any, any, any, any, any, unknown>>, Record<string, import("@mastra/core/processors").Processor<any, unknown>>, Record<string, import("@mastra/core/memory").MastraMemory>>;
+        }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
+    }, Record<string, import("@mastra/core/workflows").AnyWorkflow>, Record<string, import("@mastra/core/vector").MastraVector<any>>, Record<string, import("@mastra/core/tts").MastraTTS>, import("@mastra/core/logger").IMastraLogger, Record<string, import("@mastra/core/mcp").MCPServerBase<any>>, Record<string, import("@mastra/core/evals").MastraScorer<any, any, any, any>>, Record<string, import("@mastra/core/tools").ToolAction<any, any, any, any, any, any, unknown>>, Record<string, import("@mastra/core/processors").Processor<any, unknown>>, Record<string, import("@mastra/core/memory").MastraMemory>, Record<string, import("@mastra/core/channels").ChannelProvider>>;
     agents: {
         enrichment: import("@mastra/core/agent").Agent<"enrichment-agent", {
             classifyRole: import("@mastra/core/tools").Tool<{
@@ -234,7 +234,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                     argPositions: number[];
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
-        }, undefined, unknown>;
+        }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
         verification: import("@mastra/core/agent").Agent<"verification-agent", {
             verifyVulnerability: import("@mastra/core/tools").Tool<{
                 cwe: string;
@@ -256,7 +256,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 sanitizersFound: string[];
                 attackVector: string;
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "verify-vulnerability", unknown>;
-        }, undefined, unknown>;
+        }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
         crossFile: import("@mastra/core/agent").Agent<"cross-file-agent", {
             crossFileTaint: import("@mastra/core/tools").Tool<{
                 sourceCode: string;
@@ -278,7 +278,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                     flowType: "direct" | "transitive" | "conditional";
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-        }, undefined, unknown>;
+        }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
         orchestrator: import("@mastra/core/agent").Agent<"orchestrator-agent", {
             classifyRole: import("@mastra/core/tools").Tool<{
                 className: string;
@@ -361,7 +361,7 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                     flowType: "direct" | "transitive" | "conditional";
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-        }, undefined, unknown>;
+        }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
     };
     analyzeFile: typeof analyzeFile;
     analyzeFileStream: typeof analyzeFileStream;

package/dist/agents/mastra/steps.d.ts

@@ -7,7 +7,7 @@
 export declare const patternMatchStep: import("@mastra/core/workflows").Step<"pattern-match", unknown, {
     filePath: string;
     sourceCode: string;
-    language?: string | undefined;
+    language: string;
 }, {
     imports: string[];
     patternSources: {
@@ -71,7 +71,7 @@ export declare const enrichStep: import("@mastra/core/workflows").Step<"enrich",
         methods?: any[] | undefined;
         fields?: any[] | undefined;
     }[];
-    enableEnrichment?: boolean | undefined;
+    enableEnrichment: boolean;
 }, {
     processingTimeMs: number;
     enrichmentResult: {
@@ -138,7 +138,7 @@ export declare const mergeStep: import("@mastra/core/workflows").Step<"merge", u
             reasoning: string;
         } | undefined;
     } | null;
-    confidenceThreshold?: number | undefined;
+    confidenceThreshold: number;
 }, {
     mergedSources: {
         type: string;
@@ -190,8 +190,8 @@ export declare const verifyStep: import("@mastra/core/workflows").Step<"verify",
         argPositions?: number[] | undefined;
         location?: string | undefined;
     }[];
-    enableVerification?: boolean | undefined;
-    maxTargets?: number | undefined;
+    enableVerification: boolean;
+    maxTargets: number;
 }, {
     processingTimeMs: number;
     verificationResults: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "2.33.0",
+  "version": "2.33.2",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -97,7 +97,7 @@
     "@ax-llm/ax": "^20.0.0",
     "@cognium/project-profile-detect": "^1.1.0",
     "@mastra/core": "^1.18.0",
-    "circle-ir": "3.144.0",
+    "circle-ir": "3.146.0",
     "minimatch": "^10.2.5",
     "p-queue": "^9.1.0"
   },