circle-ir-ai 2.37.4 → 2.37.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,73 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.37.6] - 2026-07-06
|
|
9
|
+
|
|
10
|
+
Bump `circle-ir` `3.152.0` → `3.153.0`. Zero-code refresh — pulls in
|
|
11
|
+
upstream engine improvements published in `circle-ir@3.153.0`.
|
|
12
|
+
|
|
13
|
+
### What changed
|
|
14
|
+
|
|
15
|
+
- **`package.json`**:
|
|
16
|
+
- Version `2.37.5` → `2.37.6`.
|
|
17
|
+
- `circle-ir` pinned to `3.153.0`.
|
|
18
|
+
- Lockfile refreshed against the registry.
|
|
19
|
+
|
|
20
|
+
### Tests
|
|
21
|
+
|
|
22
|
+
- 90 files, 1350 passed / 3 skipped.
|
|
23
|
+
- Typecheck + build clean.
|
|
24
|
+
|
|
25
|
+
## [2.37.5] - 2026-07-06
|
|
26
|
+
|
|
27
|
+
Hotfix on top of 2.37.4: the verify-cache key didn't include
|
|
28
|
+
`contextProfile` and the `PROMPT_VER` sentinel wasn't bumped when the
|
|
29
|
+
verifier prompt template gained the `## PROJECT CONTEXT` block. That
|
|
30
|
+
meant any repo scanned with an on-disk `.cognium/cache/verify` populated
|
|
31
|
+
by 2.37.3-or-earlier would keep serving the stale
|
|
32
|
+
"attacker-controls-HTTP-request" verdicts — the 2.31.4 golden-sweep
|
|
33
|
+
validation on 2026-07-06 hit this: hutool showed 260 verifier cache
|
|
34
|
+
hits and 0 new calls, so the 108/60 CWE-22 counts were byte-identical
|
|
35
|
+
to the 2.31.3 baseline. The contextProfile prompt change never
|
|
36
|
+
executed.
|
|
37
|
+
|
|
38
|
+
### What changed
|
|
39
|
+
|
|
40
|
+
- **`src/cache/verify-cache.ts`**:
|
|
41
|
+
- `PROMPT_VER` bumped `'verify-v1'` → `'verify-v2'`. Force-invalidates
|
|
42
|
+
every on-disk verify entry created before 2.37.5 so the new
|
|
43
|
+
contextProfile-aware prompt runs fresh.
|
|
44
|
+
- `computeVerifyCacheKey()` now folds `input.contextProfile ??
|
|
45
|
+
'unspecified'` into the key. A repo re-classified from
|
|
46
|
+
`application` → `library` (e.g. via updated profile heuristics)
|
|
47
|
+
now gets fresh verdicts instead of the old attacker-reachable
|
|
48
|
+
verdicts.
|
|
49
|
+
- **`tests/cache-key-shape.test.ts`**:
|
|
50
|
+
- Updated the D3 prompt-version assertion to expect `'verify-v2'`
|
|
51
|
+
and documented why (cognium-ai#200).
|
|
52
|
+
|
|
53
|
+
### Motivation
|
|
54
|
+
|
|
55
|
+
Cache correctness. `computeVerifyCacheKey` is meant to encode
|
|
56
|
+
"everything that can change the verdict" — the repo-level trust
|
|
57
|
+
boundary is now one of those things, and the prompt itself changed,
|
|
58
|
+
so both the key and the version sentinel had to move. Without this
|
|
59
|
+
fix cognium-ai#200 ships as a NO-OP on any user with a warm cache.
|
|
60
|
+
|
|
61
|
+
### Tests
|
|
62
|
+
|
|
63
|
+
- 90 files, 1350 passed / 3 skipped.
|
|
64
|
+
- Typecheck clean.
|
|
65
|
+
|
|
66
|
+
### Verification plan
|
|
67
|
+
|
|
68
|
+
Clear `.cognium/cache/verify` in the 12 Tier-2 repos, rerun the
|
|
69
|
+
2.31.4 golden sweep with 2.37.5, and confirm hutool's 60 CWE-22 H+C
|
|
70
|
+
verdicts flip from `TRUE_POSITIVE` (with "user-controlled HTTP
|
|
71
|
+
request" reasoning) to `FALSE_POSITIVE` (with "library API —
|
|
72
|
+
caller-controlled" reasoning). Non-library repos (AndroidAsync,
|
|
73
|
+
Sentinel) should keep their genuine sources.
|
|
74
|
+
|
|
8
75
|
## [2.37.4] - 2026-07-06
|
|
9
76
|
|
|
10
77
|
Thread the repo-level `contextProfile` down into the LLM batch verifier
|
|
@@ -54,6 +54,11 @@ export declare function resetVerifyCache(): void;
|
|
|
54
54
|
* - file SHA-256 — file edit invalidates only that file's entry
|
|
55
55
|
* - pairs fingerprint — sort-invariant over the source/sink set
|
|
56
56
|
* - language — Java vs Kotlin etc.
|
|
57
|
+
* - contextProfile — repo-level trust-boundary profile
|
|
58
|
+
* (`application` / `library` / `framework` / `tool`); added in
|
|
59
|
+
* 2.37.5 for cognium-ai#200 so a repo re-classified from
|
|
60
|
+
* `application` → `library` gets fresh verdicts instead of the
|
|
61
|
+
* old "attacker-controlled HTTP request" verdicts.
|
|
57
62
|
* - PROMPT_VER — global verifier-prompt invalidator
|
|
58
63
|
*/
|
|
59
64
|
export declare function computeVerifyCacheKey(input: BatchVerificationInput, language: string): {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-cache.d.ts","sourceRoot":"","sources":["../../src/cache/verify-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAkD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"verify-cache.d.ts","sourceRoot":"","sources":["../../src/cache/verify-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAkD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAwB9F;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,GAAE,SAAiC,GACxC,mBAAmB,CAAC,uBAAuB,CAAC,CAe9C;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,sBAAsB,EAC7B,QAAQ,EAAE,MAAM,GACf;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAQzC;AAED,qDAAqD;AACrD,wBAAgB,2BAA2B,IAAI,MAAM,CAEpD"}
|
|
@@ -43,8 +43,18 @@ const VERIFY_CACHE_SUBDIR = path.join('.cognium', 'cache');
|
|
|
43
43
|
* Prompt-version sentinel for verification. Bump when the verifier
|
|
44
44
|
* prompt template materially changes (new few-shot examples, different
|
|
45
45
|
* exploitability rubric, new output schema).
|
|
46
|
+
*
|
|
47
|
+
* History:
|
|
48
|
+
* - `verify-v1` — initial 2.28.0 verifier prompt.
|
|
49
|
+
* - `verify-v2` — 2.37.5 / cognium-ai#200 — verifier prompt now
|
|
50
|
+
* includes a `## PROJECT CONTEXT` block driven by the repo-level
|
|
51
|
+
* `contextProfile`, so library/tool repos suppress the "attacker
|
|
52
|
+
* controls HTTP request" rubric that hallucinated 60+ CWE-22
|
|
53
|
+
* verdicts in hutool on the 2026-07-05 Tier-2 sweep. Warm caches
|
|
54
|
+
* from 2.37.3 and earlier would keep serving the stale verdicts;
|
|
55
|
+
* bumping the sentinel force-invalidates them.
|
|
46
56
|
*/
|
|
47
|
-
const PROMPT_VER = 'verify-
|
|
57
|
+
const PROMPT_VER = 'verify-v2';
|
|
48
58
|
let _instance = null;
|
|
49
59
|
let _instanceFingerprint = '';
|
|
50
60
|
/**
|
|
@@ -94,13 +104,19 @@ function serializeVerifyPairs(input) {
|
|
|
94
104
|
* - file SHA-256 — file edit invalidates only that file's entry
|
|
95
105
|
* - pairs fingerprint — sort-invariant over the source/sink set
|
|
96
106
|
* - language — Java vs Kotlin etc.
|
|
107
|
+
* - contextProfile — repo-level trust-boundary profile
|
|
108
|
+
* (`application` / `library` / `framework` / `tool`); added in
|
|
109
|
+
* 2.37.5 for cognium-ai#200 so a repo re-classified from
|
|
110
|
+
* `application` → `library` gets fresh verdicts instead of the
|
|
111
|
+
* old "attacker-controlled HTTP request" verdicts.
|
|
97
112
|
* - PROMPT_VER — global verifier-prompt invalidator
|
|
98
113
|
*/
|
|
99
114
|
export function computeVerifyCacheKey(input, language) {
|
|
100
115
|
const fileSha = crypto.createHash('sha256').update(input.code).digest('hex');
|
|
101
116
|
const pairsFp = crypto.createHash('sha256').update(serializeVerifyPairs(input)).digest('hex');
|
|
117
|
+
const profile = input.contextProfile ?? 'unspecified';
|
|
102
118
|
return {
|
|
103
|
-
content: [fileSha, pairsFp, language, PROMPT_VER].join('\0'),
|
|
119
|
+
content: [fileSha, pairsFp, language, profile, PROMPT_VER].join('\0'),
|
|
104
120
|
classifier: 'verify-batch',
|
|
105
121
|
};
|
|
106
122
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-cache.js","sourceRoot":"","sources":["../../src/cache/verify-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAkB,MAAM,kBAAkB,CAAC;AAGlG,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAE3D
|
|
1
|
+
{"version":3,"file":"verify-cache.js","sourceRoot":"","sources":["../../src/cache/verify-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAkB,MAAM,kBAAkB,CAAC;AAGlG,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,GAAG,WAAW,CAAC;AAE/B,IAAI,SAAS,GAAwD,IAAI,CAAC;AAC1E,IAAI,oBAAoB,GAAG,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAoB,mBAAmB,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,GAAG,CAAC;IACrD,MAAM,WAAW,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAEtD,IAAI,CAAC,SAAS,IAAI,oBAAoB,KAAK,WAAW,IAAI,SAAS,CAAC,mBAAmB,EAAE,KAAK,WAAW,EAAE,CAAC;QAC1G,SAAS,GAAG,IAAI,mBAAmB,CAA0B;YAC3D,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mBAAmB,CAAC;YACvD,gBAAgB,EAAE,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,oBAAoB,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB;IAC9B,SAAS,GAAG,IAAI,CAAC;IACjB,oBAAoB,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAA6B;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;SACrD,IAAI,EAAE,CAAC;IACV,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;SAC5D,IAAI,EAAE,CAAC;IACV,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA6B,EAC7B,QAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,IAAI,aAAa,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACrE,UAAU,EAAE,cAAc;KAC3B,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,2BAA2B;IACzC,OAAO,UAAU,CAAC;AACpB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.37.
|
|
3
|
+
"version": "2.37.6",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -97,7 +97,7 @@
|
|
|
97
97
|
"@ax-llm/ax": "^20.0.0",
|
|
98
98
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
99
99
|
"@mastra/core": "^1.18.0",
|
|
100
|
-
"circle-ir": "3.
|
|
100
|
+
"circle-ir": "3.153.0",
|
|
101
101
|
"minimatch": "^10.2.5",
|
|
102
102
|
"p-queue": "^9.1.0"
|
|
103
103
|
},
|