circle-ir-ai 2.81.0 → 2.82.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +61 -0
- package/dist/trust/passes/input-validation.d.ts +1 -1
- package/dist/trust/passes/input-validation.d.ts.map +1 -1
- package/dist/trust/passes/input-validation.js +37 -0
- package/dist/trust/passes/input-validation.js.map +1 -1
- package/dist/utils/analyze-pool.d.ts.map +1 -1
- package/dist/utils/analyze-pool.js +24 -16
- package/dist/utils/analyze-pool.js.map +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,67 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.82.1] - 2026-08-02
|
|
9
|
+
|
|
10
|
+
### Fixed — parse-isolation worker failed to launch from source outside the package dir (#252 follow-up)
|
|
11
|
+
|
|
12
|
+
`analyze-pool.ts` handed the worker `execArgv: ['--import', 'tsx']` when running
|
|
13
|
+
from source (tsx/vitest). `tsx` is a **bare specifier resolved against
|
|
14
|
+
`process.cwd()`**, so parse isolation broke whenever a scan ran from any
|
|
15
|
+
directory other than `circle-ir-ai/` — `Cannot find package 'tsx'` — and on some
|
|
16
|
+
Node versions the `--import`-registered loader hooks were not applied to the
|
|
17
|
+
worker's own entry file, yielding `Unknown file extension ".ts"` (the reported
|
|
18
|
+
`tests/analyze-pool.test.ts` failure).
|
|
19
|
+
|
|
20
|
+
The source path now launches an `eval` bootstrap that registers tsx's ESM loader
|
|
21
|
+
from an **absolute** path (CWD-independent) and then **dynamically imports** the
|
|
22
|
+
worker — a dynamic import after `register()` always goes through the hooks on
|
|
23
|
+
every Node version, sidestepping both failure modes. Verified launching from the
|
|
24
|
+
repo root and from `/tmp`.
|
|
25
|
+
|
|
26
|
+
**No runtime change for consumers:** published builds still take the plain
|
|
27
|
+
`analyze-worker.js` sibling path (`kind: 'file'`), byte-identical to before; the
|
|
28
|
+
`eval` branch only runs when executing from TypeScript source.
|
|
29
|
+
|
|
30
|
+
## [2.82.0] - 2026-08-02
|
|
31
|
+
|
|
32
|
+
### Fixed — trust pass rated 19 of 29 sink types as a flat `medium` (#204 adjacent)
|
|
33
|
+
|
|
34
|
+
`sinkSeverity` in `trust/passes/input-validation.ts` classified sinks from two
|
|
35
|
+
hardcoded sets and returned `'medium'` for anything else. Those sets cover **10
|
|
36
|
+
of circle-ir 3.198.0's 29 sink types**; the other 19 were all reported medium
|
|
37
|
+
regardless of what they are — wrong in both directions:
|
|
38
|
+
|
|
39
|
+
| sink type | registry | was reported |
|
|
40
|
+
|---|---|---|
|
|
41
|
+
| `nosql_injection` | **critical** | medium |
|
|
42
|
+
| `prompt_injection`, `mass_assignment`, `format_string`, `redos`, `prototype_pollution`, `regex_dos`, `unsafe_memory` | high | medium |
|
|
43
|
+
| `log_injection`, `insecure_cookie` | low | medium |
|
|
44
|
+
|
|
45
|
+
The registry is now consulted before falling back to `'medium'`, which fixes all
|
|
46
|
+
19 at once and needs no list maintenance as circle-ir adds types.
|
|
47
|
+
|
|
48
|
+
**Precedence is deliberate: the local sets win, the registry fills gaps.** The
|
|
49
|
+
first attempt derived severity wholesale from the registry and
|
|
50
|
+
`trust-passes.test.ts` failed it — circle-ir rates `xss` as `medium`, while this
|
|
51
|
+
pass rates an unsanitized *flow* into xss as `high`. Those answer different
|
|
52
|
+
questions: the registry gives a baseline for the rule *type*, this pass scores a
|
|
53
|
+
**proven unsanitized flow**, which is strictly worse. Deriving wholesale would
|
|
54
|
+
have silently erased a judgement the pass owns, and quietly demoted every XSS
|
|
55
|
+
flow finding. The existing test caught it; the ordering was inverted rather than
|
|
56
|
+
the test changed.
|
|
57
|
+
|
|
58
|
+
CWE-20 — the registry's "unknown type" placeholder — is never anchored on. LLM
|
|
59
|
+
discovery emits free-form sink types, and treating the placeholder as a
|
|
60
|
+
classification would read as medium-by-fiat, which is the bug this fixes.
|
|
61
|
+
|
|
62
|
+
Also verified against 3.198.0, since 2.79.1's do-not-remove comment asserts it
|
|
63
|
+
as current fact: `user_input` **is** still emitted, by the JavaScript plugin
|
|
64
|
+
only; `env_var` by the go, python, rust and javascript plugins. The comment
|
|
65
|
+
stands.
|
|
66
|
+
|
|
67
|
+
5 tests. Suite 1650 pass + 3 skipped.
|
|
68
|
+
|
|
8
69
|
## [2.81.0] - 2026-08-02
|
|
9
70
|
|
|
10
71
|
### Added — exhaustive source-type classification (circle-ir 3.198.0)
|
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
*
|
|
10
10
|
* Falls back gracefully (score 100 + info) when no CircleIR data is available.
|
|
11
11
|
*/
|
|
12
|
-
import type
|
|
12
|
+
import { type CircleIR } from 'circle-ir';
|
|
13
13
|
import { type TrustPassResult } from '../types.js';
|
|
14
14
|
/** Source types that represent user/external input needing validation */
|
|
15
15
|
declare const INPUT_SOURCES: Set<string>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAC;AAOrB,yEAAyE;AACzE,QAAA,MAAM,aAAa,EAAE,GAAG,CAAC,MAAM,CA0B7B,CAAC;AAEH,8DAA8D;AAC9D,QAAA,MAAM,cAAc,EAAE,GAAG,CAAC,MAAM,CAE9B,CAAC;AACH,QAAA,MAAM,UAAU,EAAE,GAAG,CAAC,MAAM,CAE1B,CAAC;AAMH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAoDD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CA4G1B;AAGD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}
|
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
*
|
|
10
10
|
* Falls back gracefully (score 100 + info) when no CircleIR data is available.
|
|
11
11
|
*/
|
|
12
|
+
import { getRuleInfo } from 'circle-ir';
|
|
12
13
|
import { isBrowserQueryApi } from '../../security-scan/sink-filters.js';
|
|
13
14
|
// ---------------------------------------------------------------------------
|
|
14
15
|
// Constants
|
|
@@ -51,11 +52,47 @@ const HIGH_SINKS = new Set([
|
|
|
51
52
|
// ---------------------------------------------------------------------------
|
|
52
53
|
// Helpers
|
|
53
54
|
// ---------------------------------------------------------------------------
|
|
55
|
+
/** Registry severities we accept verbatim. */
|
|
56
|
+
const TRUST_SEVERITIES = new Set(['critical', 'high', 'medium', 'low']);
|
|
57
|
+
/**
|
|
58
|
+
* Severity for an unsanitized flow into `sinkType`.
|
|
59
|
+
*
|
|
60
|
+
* Precedence is deliberate: **the local sets win, the registry fills gaps.**
|
|
61
|
+
*
|
|
62
|
+
* The two are answering different questions. circle-ir's `severityLevel` is a
|
|
63
|
+
* baseline for the rule *type*; this pass is scoring a **proven unsanitized
|
|
64
|
+
* flow** into that sink, which is strictly worse than the baseline. `xss` is
|
|
65
|
+
* the clearest case — `medium` in the registry, but an unsanitized flow
|
|
66
|
+
* reaching it is `high` here, and that is a judgement this pass owns.
|
|
67
|
+
* Deriving severity wholesale from the registry would silently erase it
|
|
68
|
+
* (caught by `trust-passes.test.ts` when it was tried).
|
|
69
|
+
*
|
|
70
|
+
* What the registry *does* fix is the gap: the two sets classify 10 of
|
|
71
|
+
* circle-ir 3.198.0's 29 sink types, and the other 19 previously fell to a flat
|
|
72
|
+
* `'medium'` — wrong in both directions. `nosql_injection` is `critical`
|
|
73
|
+
* upstream and was reported medium; `log_injection` and `insecure_cookie` are
|
|
74
|
+
* `low` and were also reported medium. Consulting the registry before giving up
|
|
75
|
+
* fixes all 19 without touching the 10 the sets speak for.
|
|
76
|
+
*
|
|
77
|
+
* CWE-20 is the registry's "unknown type" placeholder and is never anchored on
|
|
78
|
+
* — LLM discovery emits free-form sink types, and treating the placeholder as a
|
|
79
|
+
* classification would read as medium-by-fiat.
|
|
80
|
+
*/
|
|
54
81
|
function sinkSeverity(sinkType) {
|
|
55
82
|
if (CRITICAL_SINKS.has(sinkType))
|
|
56
83
|
return 'critical';
|
|
57
84
|
if (HIGH_SINKS.has(sinkType))
|
|
58
85
|
return 'high';
|
|
86
|
+
try {
|
|
87
|
+
const info = getRuleInfo(sinkType);
|
|
88
|
+
if (info && info.cwe !== 'CWE-20' && info.severityLevel
|
|
89
|
+
&& TRUST_SEVERITIES.has(info.severityLevel)) {
|
|
90
|
+
return info.severityLevel;
|
|
91
|
+
}
|
|
92
|
+
}
|
|
93
|
+
catch {
|
|
94
|
+
/* registry unavailable — fall through */
|
|
95
|
+
}
|
|
59
96
|
return 'medium';
|
|
60
97
|
}
|
|
61
98
|
// ---------------------------------------------------------------------------
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;
|
|
1
|
+
{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAMvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC;IACzC,YAAY;IACZ,cAAc;IACd,aAAa;IACb,aAAa;IACb,WAAW;IACX,uEAAuE;IACvE,wCAAwC;IACxC,YAAY;IACZ,yCAAyC;IACzC,UAAU;IACV,aAAa;IACb,YAAY;IACZ,WAAW;IACX,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,SAAS;IACT,YAAY;IACZ,+DAA+D;IAC/D,WAAW;IACX,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,SAAS;IACT,eAAe;CAChB,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,cAAc,GAAgB,IAAI,GAAG,CAAC;IAC1C,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB;CAC1E,CAAC,CAAC;AACH,MAAM,UAAU,GAAgB,IAAI,GAAG,CAAC;IACtC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB;CAC5E,CAAC,CAAC;AAWH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,8CAA8C;AAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa;eAChD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,aAA8B,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,MAAM,WAAW,GACf,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,0EAA0E;oBACnF,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBACrC,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,eAAgB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;QAExC,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEnD,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAEhE,UAAU,EAAE,CAAC;YAEb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,cAAc,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,eAAe,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,SAAS,EAAE;oBAC9D,QAAQ;oBACR,OAAO,EAAE,eAAe,IAAI,CAAC,WAAW,YAAY,IAAI,CAAC,SAAS,OAAO,IAAI,UAAU,IAAI,CAAC,WAAW,WAAW,IAAI,CAAC,SAAS,GAAG;oBACnI,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC1C,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;wBACxB,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;qBACzB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,gBAAgB;oBACxB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;iBACxB,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAE9D,uBAAuB;IACvB,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,8BAA8B,cAAc,IAAI,UAAU,qBAAqB,KAAK,IAAI;QACjG,IAAI,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,GAAG,UAAU,EAAE;KACjF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-pool.d.ts","sourceRoot":"","sources":["../../src/utils/analyze-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;
|
|
1
|
+
{"version":3,"file":"analyze-pool.d.ts","sourceRoot":"","sources":["../../src/utils/analyze-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AASH,4DAA4D;AAC5D,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAiMD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,CAAC,CAAC,CASb;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7B,GAAG,OAAO,CAAC,CAAC,CAAC,CAKb;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CASzD;AAED,yCAAyC;AACzC,wBAAgB,gBAAgB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAEtE"}
|
|
@@ -52,7 +52,8 @@
|
|
|
52
52
|
*/
|
|
53
53
|
import * as fs from 'fs';
|
|
54
54
|
import * as os from 'os';
|
|
55
|
-
import {
|
|
55
|
+
import { createRequire } from 'module';
|
|
56
|
+
import { fileURLToPath, pathToFileURL } from 'url';
|
|
56
57
|
import { Worker } from 'worker_threads';
|
|
57
58
|
import { withTimeout } from './with-timeout.js';
|
|
58
59
|
/** True when worker-thread parse isolation is requested. */
|
|
@@ -66,32 +67,39 @@ function poolSize() {
|
|
|
66
67
|
return parsed;
|
|
67
68
|
return Math.max(1, Math.min(os.cpus().length || 1, 8));
|
|
68
69
|
}
|
|
69
|
-
/**
|
|
70
|
-
* Resolve the worker entry next to this module.
|
|
71
|
-
*
|
|
72
|
-
* Published builds sit in `dist/utils/` and load `analyze-worker.js` with
|
|
73
|
-
* plain Node. Running from source (tsx, vitest) there is no sibling `.js`,
|
|
74
|
-
* so we hand the worker the `.ts` and register tsx inside it: a worker
|
|
75
|
-
* inherits `process.execArgv`, but vitest transforms modules itself rather
|
|
76
|
-
* than through a Node loader, so the worker thread would otherwise get raw
|
|
77
|
-
* TypeScript it cannot parse.
|
|
78
|
-
*/
|
|
79
70
|
function resolveWorkerEntry() {
|
|
80
71
|
const here = fileURLToPath(import.meta.url);
|
|
81
72
|
const js = here.replace(/analyze-pool\.(?:ts|js)$/, 'analyze-worker.js');
|
|
82
73
|
if (fs.existsSync(js))
|
|
83
|
-
return { entry: js };
|
|
74
|
+
return { kind: 'file', entry: js };
|
|
84
75
|
const ts = here.replace(/analyze-pool\.(?:ts|js)$/, 'analyze-worker.ts');
|
|
85
|
-
if (fs.existsSync(ts))
|
|
86
|
-
|
|
76
|
+
if (fs.existsSync(ts)) {
|
|
77
|
+
const require = createRequire(import.meta.url);
|
|
78
|
+
let apiUrl;
|
|
79
|
+
try {
|
|
80
|
+
apiUrl = pathToFileURL(require.resolve('tsx/esm/api')).href;
|
|
81
|
+
}
|
|
82
|
+
catch {
|
|
83
|
+
throw new Error(`analyze-pool: running from source (${ts}) but 'tsx' is not resolvable ` +
|
|
84
|
+
`for the worker transpiler. Install dev dependencies or run the built ` +
|
|
85
|
+
`dist/ worker.`);
|
|
86
|
+
}
|
|
87
|
+
const workerUrl = pathToFileURL(ts).href;
|
|
88
|
+
const bootstrap = `import { register } from ${JSON.stringify(apiUrl)};\n` +
|
|
89
|
+
`register();\n` +
|
|
90
|
+
`await import(${JSON.stringify(workerUrl)});\n`;
|
|
91
|
+
return { kind: 'eval', bootstrap };
|
|
92
|
+
}
|
|
87
93
|
throw new Error(`analyze-worker entry not found next to ${here}`);
|
|
88
94
|
}
|
|
89
95
|
const workers = [];
|
|
90
96
|
const queue = [];
|
|
91
97
|
let nextRequestId = 1;
|
|
92
98
|
function spawnWorker() {
|
|
93
|
-
const
|
|
94
|
-
const worker =
|
|
99
|
+
const spec = resolveWorkerEntry();
|
|
100
|
+
const worker = spec.kind === 'file'
|
|
101
|
+
? new Worker(spec.entry)
|
|
102
|
+
: new Worker(spec.bootstrap, { eval: true });
|
|
95
103
|
const pw = { worker, busy: null, ready: Promise.resolve() };
|
|
96
104
|
pw.ready = new Promise((resolve, reject) => {
|
|
97
105
|
const onReady = (msg) => {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-pool.js","sourceRoot":"","sources":["../../src/utils/analyze-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"analyze-pool.js","sourceRoot":"","sources":["../../src/utils/analyze-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,4DAA4D;AAC5D,MAAM,UAAU,uBAAuB;IACrC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;AAClD,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AA4BD,SAAS,kBAAkB;IACzB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,sCAAsC,EAAE,gCAAgC;gBACtE,uEAAuE;gBACvE,eAAe,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QACzC,MAAM,SAAS,GACb,4BAA4B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK;YACvD,eAAe;YACf,gBAAgB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AA2BD,MAAM,OAAO,GAAiB,EAAE,CAAC;AACjC,MAAM,KAAK,GAAgB,EAAE,CAAC;AAC9B,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,MAAM;QAClB,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACxB,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,EAAE,GAAe,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IAExE,EAAE,CAAC,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,CAAC,GAAmB,EAAQ,EAAE;YAC5C,IAAI,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC/B,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAgE,EAAE,EAAE;QACxF,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,KAAK,OAAO,CAAC,EAAE;YAAE,OAAO;QAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC;QACf,IAAI,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,EAAE,CAAC;IACV,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;QACxB,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,EAAE,CAAC;IACV,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,EAAc;IAChC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,EAAc,EAAE,IAAe;IAC/C,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;IAE3B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,KAAK,EAAE,CAAC;IACV,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEnB,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAEpE,EAAE,CAAC,KAAK;SACL,IAAI,CAAC,GAAG,EAAE;QACT,oEAAoE;QACpE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE;YAAE,OAAO;QAC/B,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACpB,CAAC,EAAE,KAAK;YACR,EAAE;YACF,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE;YAAE,OAAO;QAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,EAAE,CAAC;IACV,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,EAAE,EAAE,CAAC;YAC3C,MAAM,GAAG,WAAW,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAG,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAc,IAO5C;IACC,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,KAAK,CAAC,IAAI,CAAC;YACT,GAAG,IAAI;YACP,OAAO,EAAE,OAAgC;YACzC,MAAM;SACP,CAAC,CAAC;QACH,KAAK,EAAE,CAAC;IACV,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAI,IASpC;IACC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/B,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,eAAe,CAAI,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACjB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,IAAI;YAAE,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.82.1",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
"@ax-llm/ax": "^20.0.0",
|
|
99
99
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
100
100
|
"@mastra/core": "^1.18.0",
|
|
101
|
-
"circle-ir": "3.
|
|
101
|
+
"circle-ir": "3.200.0",
|
|
102
102
|
"minimatch": "^10.2.5",
|
|
103
103
|
"p-queue": "^9.1.0"
|
|
104
104
|
},
|