circle-ir-ai 2.90.0 → 2.92.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +46 -0
- package/dist/agents/mastra/steps.d.ts +4 -4
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -1
- package/dist/index.js.map +1 -1
- package/dist/llm/ax-client.d.ts.map +1 -1
- package/dist/llm/ax-client.js +4 -0
- package/dist/llm/ax-client.js.map +1 -1
- package/dist/llm/config.d.ts.map +1 -1
- package/dist/llm/config.js +4 -2
- package/dist/llm/config.js.map +1 -1
- package/dist/llm/index.d.ts +1 -0
- package/dist/llm/index.d.ts.map +1 -1
- package/dist/llm/index.js +1 -0
- package/dist/llm/index.js.map +1 -1
- package/dist/llm/token-meter.d.ts +38 -0
- package/dist/llm/token-meter.d.ts.map +1 -0
- package/dist/llm/token-meter.js +47 -0
- package/dist/llm/token-meter.js.map +1 -0
- package/dist/trust/hardened-artifacts.d.ts +47 -0
- package/dist/trust/hardened-artifacts.d.ts.map +1 -0
- package/dist/trust/hardened-artifacts.js +106 -0
- package/dist/trust/hardened-artifacts.js.map +1 -0
- package/dist/trust/index.d.ts +2 -0
- package/dist/trust/index.d.ts.map +1 -1
- package/dist/trust/index.js +3 -0
- package/dist/trust/index.js.map +1 -1
- package/dist/trust/passes/dependency-hardening.d.ts +21 -0
- package/dist/trust/passes/dependency-hardening.d.ts.map +1 -0
- package/dist/trust/passes/dependency-hardening.js +56 -0
- package/dist/trust/passes/dependency-hardening.js.map +1 -0
- package/dist/trust/scoring.d.ts.map +1 -1
- package/dist/trust/scoring.js +1 -0
- package/dist/trust/scoring.js.map +1 -1
- package/package.json +2 -2
package/dist/llm/config.js
CHANGED
|
@@ -9,8 +9,9 @@
|
|
|
9
9
|
* placeholder and to bypass `validateLLMConfig`'s key-required check.
|
|
10
10
|
*
|
|
11
11
|
* Currently:
|
|
12
|
-
* - Cognium proxies (port 4000 / llmproxy.xus.one) — handle
|
|
13
|
-
* internally via their own credentials store.
|
|
12
|
+
* - Cognium proxies (port 4000 / llmproxy.xus.one / llm.c0g.io) — handle
|
|
13
|
+
* auth internally via their own credentials store. `llm.c0g.io` is the
|
|
14
|
+
* current address; `llmproxy.xus.one` is kept for backward compat.
|
|
14
15
|
* - Ollama (port 11434) — no auth at all. The placeholder string is
|
|
15
16
|
* sent as a bearer token and ignored by the server. Pre-#63, this
|
|
16
17
|
* made `cognium-ai scan --llm-base-url http://localhost:11434/v1`
|
|
@@ -21,6 +22,7 @@ function isNoAuthEndpoint(baseUrl) {
|
|
|
21
22
|
return (baseUrl.includes('localhost:4000') ||
|
|
22
23
|
baseUrl.includes('127.0.0.1:4000') ||
|
|
23
24
|
baseUrl.includes('llmproxy.xus.one') ||
|
|
25
|
+
baseUrl.includes('llm.c0g.io') ||
|
|
24
26
|
baseUrl.includes('localhost:11434') ||
|
|
25
27
|
baseUrl.includes('127.0.0.1:11434'));
|
|
26
28
|
}
|
package/dist/llm/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/llm/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0CH
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/llm/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0CH;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IACtD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,0BAA0B,CAAC;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAExD,sEAAsE;IACtE,qEAAqE;IACrE,oDAAoD;IACpD,EAAE;IACF,iEAAiE;IACjE,kEAAkE;IAClE,+DAA+D;IAC/D,8BAA8B;IAC9B,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,EAAE;IACF,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,0EAA0E;IAC1E,oEAAoE;IACpE,SAAS,YAAY,CAAC,GAAuB;QAC3C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC;IAC9E,MAAM,kBAAkB,GACtB,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,kBAAkB,CAAC;IAC3E,MAAM,qBAAqB,GACzB,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,kBAAkB,CAAC;IAC9E,MAAM,kBAAkB,GACtB,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,kBAAkB,CAAC;IAE3E,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,yBAAyB;IACzB,8CAA8C;IAC9C,mDAAmD;IACnD,gEAAgE;IAChE,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,sBAAsB,CAAC;IAEzB,OAAO;QACL,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,aAAa;QAEhD,MAAM,EAAE;YACN,mEAAmE;YACnE,UAAU,EAAE;gBACV,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,kBAAkB;gBAC3B,OAAO,EAAE,CAAC,EAAO,kDAAkD;aACpE;YAED,0FAA0F;YAC1F,YAAY,EAAE;gBACZ,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,eAAe;gBAC5D,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EAAE,CAAC;aACX;YAED,8DAA8D;YAC9D,mBAAmB,EAAE;gBACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,eAAe;gBACzD,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,IAAI,EAAG,qCAAqC;gBACvD,OAAO,EAAE,kBAAkB;gBAC3B,OAAO,EAAE,CAAC,EAAQ,8DAA8D;aACjF;SACF;QAED,UAAU,EAAE;YACV,wBAAwB,EAAE,IAAI;YAC9B,qBAAqB,EAAE,IAAI;YAC3B,wBAAwB,EAAE,IAAI;YAC9B,oBAAoB,EAAE,CAAC;YACvB,mBAAmB,EAAE,GAAG;SACzB;QAED,YAAY,EAAE;YACZ,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,IAAI;SAC5B;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc,mBAAmB,EAAE,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAkD,EAClD,OAAoD;IAEpD,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC1D,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC;QAC/C,gEAAgE;IAClE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAoB,mBAAmB,EAAE;IAChF,OAAO;QACL,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;QAC1D,UAAU,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE;QAC9D,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE;KACpE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAoB,mBAAmB,EAAE;IACpF,OAAO,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAoB,mBAAmB,EAAE;IACjF,OAAO,UAAU,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAoB,mBAAmB,EAAE;IACpF,OAAO,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,mEAAmE;IACnE,iEAAiE;IACjE,+DAA+D;IAC/D,mEAAmE;IACnE,2BAA2B;IAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,kEAAkE;YAClE,qDAAqD;YACrD,2CAA2C,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,SAA8B;IAC5D,MAAM,MAAM,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,SAAS,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAC1D,IAAI,SAAS,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAEvD,IAAI,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7F,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACnG,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxH,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACzB,MAAM,CAAC,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,CAAC,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/dist/llm/index.d.ts
CHANGED
|
@@ -11,5 +11,6 @@ export { DiscoveryEngine, getDiscoveryEngine, discoverVulnerabilities, discovery
|
|
|
11
11
|
export { getLanguageContext, generateSourceDiscoveryPrompt, generateSinkDiscoveryPrompt, generateRoleClassificationPrompt, getCWEGuidance, type LanguageContext, type SourcePattern, type SinkPattern, } from './language-context.js';
|
|
12
12
|
export { llmErrorCounter, type DiscoveryErrorKind, } from './llm-error-counter.js';
|
|
13
13
|
export { checkAndCountCall, resetLLMCallLimiter, markSwarmStart, markSwarmEnd, clearSwarmFlagForTesting, getLLMCallStats, LLM_CONCURRENCY, LLM_MAX_CALLS_PER_SCAN, LLM_MAX_CALLS_PER_FILE, } from './call-limiter.js';
|
|
14
|
+
export { runWithTokenMeter, getContextTokenUsage, recordTokenUsage, type TokenTally, } from './token-meter.js';
|
|
14
15
|
export { sanitizeCodeForPrompt, sanitizeListForPrompt, sanitizeObjectForPrompt, wrapUserCode, formatSystemPrompt, formatCodeBlock, getModelPromptConfig, detectModelFamily, isInputSafe, logInjectionAttempt, type ModelFamily, type ModelPromptConfig, } from './prompt-security.js';
|
|
15
16
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/llm/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/llm/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,WAAW,EACX,cAAc,EAEd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,gCAAgC,EAChC,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/llm/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,WAAW,EACX,cAAc,EAEd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,gCAAgC,EAChC,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC"}
|
package/dist/llm/index.js
CHANGED
|
@@ -21,6 +21,7 @@ export { getLanguageContext, generateSourceDiscoveryPrompt, generateSinkDiscover
|
|
|
21
21
|
export { llmErrorCounter, } from './llm-error-counter.js';
|
|
22
22
|
// Call limiter (cognium-ai#159 + #160)
|
|
23
23
|
export { checkAndCountCall, resetLLMCallLimiter, markSwarmStart, markSwarmEnd, clearSwarmFlagForTesting, getLLMCallStats, LLM_CONCURRENCY, LLM_MAX_CALLS_PER_SCAN, LLM_MAX_CALLS_PER_FILE, } from './call-limiter.js';
|
|
24
|
+
export { runWithTokenMeter, getContextTokenUsage, recordTokenUsage, } from './token-meter.js';
|
|
24
25
|
// Prompt Security (for robustness against prompt injection)
|
|
25
26
|
export { sanitizeCodeForPrompt, sanitizeListForPrompt, sanitizeObjectForPrompt, wrapUserCode, formatSystemPrompt, formatCodeBlock, getModelPromptConfig, detectModelFamily, isInputSafe, logInjectionAttempt, } from './prompt-security.js';
|
|
26
27
|
//# sourceMappingURL=index.js.map
|
package/dist/llm/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/llm/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,GAGzB,MAAM,aAAa,CAAC;AAErB,uDAAuD;AACvD,OAAO,EACL,WAAW,EACX,cAAc;AACd,aAAa;AACb,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAExB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,GAMX,MAAM,iBAAiB,CAAC;AAEzB,yBAAyB;AACzB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,GAO3B,MAAM,mBAAmB,CAAC;AAE3B,uDAAuD;AACvD,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAI3B,MAAM,gBAAgB,CAAC;AAExB,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,gCAAgC,EAChC,cAAc,GAIf,MAAM,uBAAuB,CAAC;AAE/B,qCAAqC;AACrC,OAAO,EACL,eAAe,GAEhB,MAAM,wBAAwB,CAAC;AAEhC,uCAAuC;AACvC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,4DAA4D;AAC5D,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/llm/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,GAGzB,MAAM,aAAa,CAAC;AAErB,uDAAuD;AACvD,OAAO,EACL,WAAW,EACX,cAAc;AACd,aAAa;AACb,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAExB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,GAMX,MAAM,iBAAiB,CAAC;AAEzB,yBAAyB;AACzB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,GAO3B,MAAM,mBAAmB,CAAC;AAE3B,uDAAuD;AACvD,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAI3B,MAAM,gBAAgB,CAAC;AAExB,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,gCAAgC,EAChC,cAAc,GAIf,MAAM,uBAAuB,CAAC;AAE/B,qCAAqC;AACrC,OAAO,EACL,eAAe,GAEhB,MAAM,wBAAwB,CAAC;AAEhC,uCAAuC;AACvC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,kBAAkB,CAAC;AAE1B,4DAA4D;AAC5D,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC"}
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Per-context LLM token meter (sr-client token-accounting fix).
|
|
3
|
+
*
|
|
4
|
+
* The functions that make LLM calls (`classifyInstructionSafety`,
|
|
5
|
+
* `detectCapabilityMismatches`, the mastra swarm, verification, …) do not
|
|
6
|
+
* return token usage in their signatures, so callers that need per-job token
|
|
7
|
+
* totals (circle-pack's REST job metrics: `llm_tokens_used`) had nothing to
|
|
8
|
+
* record — they were passing `0`. `ax-client.chatJSON` already reads the
|
|
9
|
+
* OpenAI-compatible `data.usage` block on every call; this meter lets it feed
|
|
10
|
+
* those numbers into an **AsyncLocalStorage** tally so the total can be read
|
|
11
|
+
* back after the work completes.
|
|
12
|
+
*
|
|
13
|
+
* AsyncLocalStorage (not a module global) is required because the REST server
|
|
14
|
+
* runs many jobs concurrently (MAX_INFLIGHT_JOBS) — a process-global counter
|
|
15
|
+
* would attribute one job's tokens to another. When no meter context is
|
|
16
|
+
* active, `recordTokenUsage` is a silent no-op (e.g. the CLI path, which reads
|
|
17
|
+
* tokens from the JSONL logger instead).
|
|
18
|
+
*/
|
|
19
|
+
export interface TokenTally {
|
|
20
|
+
inputTokens: number;
|
|
21
|
+
outputTokens: number;
|
|
22
|
+
/** LLM calls that reported a usage block. */
|
|
23
|
+
calls: number;
|
|
24
|
+
}
|
|
25
|
+
/**
|
|
26
|
+
* Run `fn` inside a fresh token-metering context and return both its result
|
|
27
|
+
* and the tokens accumulated by every LLM call made within it (including
|
|
28
|
+
* nested async work). Safe to nest and to run concurrently.
|
|
29
|
+
*/
|
|
30
|
+
export declare function runWithTokenMeter<T>(fn: () => Promise<T>): Promise<{
|
|
31
|
+
result: T;
|
|
32
|
+
usage: TokenTally;
|
|
33
|
+
}>;
|
|
34
|
+
/** Fed by ax-client on every call that returns an OpenAI-compatible usage block. */
|
|
35
|
+
export declare function recordTokenUsage(inputTokens?: number, outputTokens?: number): void;
|
|
36
|
+
/** Current context's tally (snapshot), or undefined when no meter is active. */
|
|
37
|
+
export declare function getContextTokenUsage(): TokenTally | undefined;
|
|
38
|
+
//# sourceMappingURL=token-meter.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"token-meter.d.ts","sourceRoot":"","sources":["../../src/llm/token-meter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC,CAI3C;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAMlF;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,IAAI,UAAU,GAAG,SAAS,CAG7D"}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Per-context LLM token meter (sr-client token-accounting fix).
|
|
3
|
+
*
|
|
4
|
+
* The functions that make LLM calls (`classifyInstructionSafety`,
|
|
5
|
+
* `detectCapabilityMismatches`, the mastra swarm, verification, …) do not
|
|
6
|
+
* return token usage in their signatures, so callers that need per-job token
|
|
7
|
+
* totals (circle-pack's REST job metrics: `llm_tokens_used`) had nothing to
|
|
8
|
+
* record — they were passing `0`. `ax-client.chatJSON` already reads the
|
|
9
|
+
* OpenAI-compatible `data.usage` block on every call; this meter lets it feed
|
|
10
|
+
* those numbers into an **AsyncLocalStorage** tally so the total can be read
|
|
11
|
+
* back after the work completes.
|
|
12
|
+
*
|
|
13
|
+
* AsyncLocalStorage (not a module global) is required because the REST server
|
|
14
|
+
* runs many jobs concurrently (MAX_INFLIGHT_JOBS) — a process-global counter
|
|
15
|
+
* would attribute one job's tokens to another. When no meter context is
|
|
16
|
+
* active, `recordTokenUsage` is a silent no-op (e.g. the CLI path, which reads
|
|
17
|
+
* tokens from the JSONL logger instead).
|
|
18
|
+
*/
|
|
19
|
+
import { AsyncLocalStorage } from 'node:async_hooks';
|
|
20
|
+
const store = new AsyncLocalStorage();
|
|
21
|
+
/**
|
|
22
|
+
* Run `fn` inside a fresh token-metering context and return both its result
|
|
23
|
+
* and the tokens accumulated by every LLM call made within it (including
|
|
24
|
+
* nested async work). Safe to nest and to run concurrently.
|
|
25
|
+
*/
|
|
26
|
+
export async function runWithTokenMeter(fn) {
|
|
27
|
+
const tally = { inputTokens: 0, outputTokens: 0, calls: 0 };
|
|
28
|
+
const result = await store.run(tally, fn);
|
|
29
|
+
return { result, usage: { ...tally } };
|
|
30
|
+
}
|
|
31
|
+
/** Fed by ax-client on every call that returns an OpenAI-compatible usage block. */
|
|
32
|
+
export function recordTokenUsage(inputTokens, outputTokens) {
|
|
33
|
+
const tally = store.getStore();
|
|
34
|
+
if (!tally)
|
|
35
|
+
return; // no active meter (e.g. CLI path) — no-op
|
|
36
|
+
if (typeof inputTokens === 'number')
|
|
37
|
+
tally.inputTokens += inputTokens;
|
|
38
|
+
if (typeof outputTokens === 'number')
|
|
39
|
+
tally.outputTokens += outputTokens;
|
|
40
|
+
tally.calls += 1;
|
|
41
|
+
}
|
|
42
|
+
/** Current context's tally (snapshot), or undefined when no meter is active. */
|
|
43
|
+
export function getContextTokenUsage() {
|
|
44
|
+
const tally = store.getStore();
|
|
45
|
+
return tally ? { ...tally } : undefined;
|
|
46
|
+
}
|
|
47
|
+
//# sourceMappingURL=token-meter.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"token-meter.js","sourceRoot":"","sources":["../../src/llm/token-meter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AASrD,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAoB;IAEpB,MAAM,KAAK,GAAe,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,WAAoB,EAAE,YAAqB;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,0CAA0C;IAC9D,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,KAAK,CAAC,WAAW,IAAI,WAAW,CAAC;IACtE,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,KAAK,CAAC,YAAY,IAAI,YAAY,CAAC;IACzE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC"}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Hardened-artifact registry (cognium-ai#123)
|
|
3
|
+
*
|
|
4
|
+
* A static, data-driven table of dependency versions that *compile out* or
|
|
5
|
+
* patch a known-dangerous sink — e.g. fastjson `_noneautotype` builds remove
|
|
6
|
+
* the autoType gadget codepath, so a `JSON.parseObject` deserialization
|
|
7
|
+
* finding on such a repo is very likely a false positive.
|
|
8
|
+
*
|
|
9
|
+
* This lives in the AI layer (trust), NOT in circle-ir: the engine stays
|
|
10
|
+
* correct about *sinks*; dependency-version-gated hardening is context the
|
|
11
|
+
* engine shouldn't carry (it would rot as new hardened variants ship). The
|
|
12
|
+
* `dependency-hardening-detected` trust pass reads the dependency manifest and
|
|
13
|
+
* emits an **advisory** (never touches severity — Option C in #123) so a
|
|
14
|
+
* reviewer can correlate it against circle-ir's raw finding.
|
|
15
|
+
*
|
|
16
|
+
* Adding a new hardened variant is a table edit here — no engine change.
|
|
17
|
+
*/
|
|
18
|
+
import type { Ecosystem } from './passes/dep-manifests.js';
|
|
19
|
+
export interface HardenedArtifact {
|
|
20
|
+
/** Manifest ecosystem this row applies to. v1: Maven (the Java deser family). */
|
|
21
|
+
ecosystem: Ecosystem;
|
|
22
|
+
/** `groupId:artifactId` (Maven) — matched against `EcosystemDep.name`. */
|
|
23
|
+
ga: string;
|
|
24
|
+
/** True when this resolved version is the hardened one. */
|
|
25
|
+
predicate: (version: string) => boolean;
|
|
26
|
+
/** Sink categories this hardening neutralizes (matches finding.type). */
|
|
27
|
+
hardens: string[];
|
|
28
|
+
/**
|
|
29
|
+
* Canonical sink method a consumer can correlate against a raw finding's
|
|
30
|
+
* sink (`groupId.Class#method`). Used to render a `hardened-by:` badge.
|
|
31
|
+
*/
|
|
32
|
+
sinkHint: string;
|
|
33
|
+
/** CWE(s) the hardened sink would otherwise carry. */
|
|
34
|
+
cwe: string[];
|
|
35
|
+
/** One-line human explanation (interpolated with the resolved version). */
|
|
36
|
+
note: (version: string) => string;
|
|
37
|
+
}
|
|
38
|
+
/** `a >= b` on dotted numeric versions (qualifier-insensitive). */
|
|
39
|
+
export declare function atLeast(version: string, min: string): boolean;
|
|
40
|
+
export declare const HARDENED_ARTIFACTS: HardenedArtifact[];
|
|
41
|
+
/** Match a resolved dependency against the registry. */
|
|
42
|
+
export declare function matchHardened(dep: {
|
|
43
|
+
ecosystem: string;
|
|
44
|
+
name: string;
|
|
45
|
+
version: string;
|
|
46
|
+
}): HardenedArtifact | undefined;
|
|
47
|
+
//# sourceMappingURL=hardened-artifacts.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"hardened-artifacts.d.ts","sourceRoot":"","sources":["../../src/trust/hardened-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,SAAS,EAAE,SAAS,CAAC;IACrB,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,yEAAyE;IACzE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,2EAA2E;IAC3E,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;CACnC;AAcD,mEAAmE;AACnE,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAU7D;AAWD,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAuDhD,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,GAAG,EAAE;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,gBAAgB,GAAG,SAAS,CAI/B"}
|
|
@@ -0,0 +1,106 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Hardened-artifact registry (cognium-ai#123)
|
|
3
|
+
*
|
|
4
|
+
* A static, data-driven table of dependency versions that *compile out* or
|
|
5
|
+
* patch a known-dangerous sink — e.g. fastjson `_noneautotype` builds remove
|
|
6
|
+
* the autoType gadget codepath, so a `JSON.parseObject` deserialization
|
|
7
|
+
* finding on such a repo is very likely a false positive.
|
|
8
|
+
*
|
|
9
|
+
* This lives in the AI layer (trust), NOT in circle-ir: the engine stays
|
|
10
|
+
* correct about *sinks*; dependency-version-gated hardening is context the
|
|
11
|
+
* engine shouldn't carry (it would rot as new hardened variants ship). The
|
|
12
|
+
* `dependency-hardening-detected` trust pass reads the dependency manifest and
|
|
13
|
+
* emits an **advisory** (never touches severity — Option C in #123) so a
|
|
14
|
+
* reviewer can correlate it against circle-ir's raw finding.
|
|
15
|
+
*
|
|
16
|
+
* Adding a new hardened variant is a table edit here — no engine change.
|
|
17
|
+
*/
|
|
18
|
+
// ---------------------------------------------------------------------------
|
|
19
|
+
// Version helpers
|
|
20
|
+
// ---------------------------------------------------------------------------
|
|
21
|
+
/** Split a Maven version into leading numeric segments (ignores qualifiers). */
|
|
22
|
+
function numericParts(v) {
|
|
23
|
+
return v
|
|
24
|
+
.split(/[^0-9]+/)
|
|
25
|
+
.filter((s) => s.length > 0)
|
|
26
|
+
.map((s) => parseInt(s, 10));
|
|
27
|
+
}
|
|
28
|
+
/** `a >= b` on dotted numeric versions (qualifier-insensitive). */
|
|
29
|
+
export function atLeast(version, min) {
|
|
30
|
+
const a = numericParts(version);
|
|
31
|
+
const b = numericParts(min);
|
|
32
|
+
const n = Math.max(a.length, b.length);
|
|
33
|
+
for (let i = 0; i < n; i++) {
|
|
34
|
+
const x = a[i] ?? 0;
|
|
35
|
+
const y = b[i] ?? 0;
|
|
36
|
+
if (x !== y)
|
|
37
|
+
return x > y;
|
|
38
|
+
}
|
|
39
|
+
return true; // equal
|
|
40
|
+
}
|
|
41
|
+
/** `min <= version < maxExclusive` — for backport bands (e.g. 2.12.4 <= v < 2.13). */
|
|
42
|
+
function inBand(version, min, maxExclusive) {
|
|
43
|
+
return atLeast(version, min) && !atLeast(version, maxExclusive);
|
|
44
|
+
}
|
|
45
|
+
// ---------------------------------------------------------------------------
|
|
46
|
+
// Registry
|
|
47
|
+
// ---------------------------------------------------------------------------
|
|
48
|
+
export const HARDENED_ARTIFACTS = [
|
|
49
|
+
// #123 seed — fastjson _noneautotype build removes the autoType gadget.
|
|
50
|
+
{
|
|
51
|
+
ecosystem: 'Maven',
|
|
52
|
+
ga: 'com.alibaba:fastjson',
|
|
53
|
+
predicate: (v) => /_noneautotype$/i.test(v),
|
|
54
|
+
hardens: ['deserialization'],
|
|
55
|
+
sinkHint: 'com.alibaba.fastjson.JSON#parseObject',
|
|
56
|
+
cwe: ['CWE-502'],
|
|
57
|
+
note: (v) => `fastjson pinned to a _noneautotype build (${v}) — the autoType gadget codepath is removed at compile time; deserialization findings on JSON.parseObject/JSON.parse in this repo are likely hardened.`,
|
|
58
|
+
},
|
|
59
|
+
// Log4Shell — 2.17.0+ (or the 2.12.4 / 2.3.2 branch backports) disable JNDI lookup.
|
|
60
|
+
{
|
|
61
|
+
ecosystem: 'Maven',
|
|
62
|
+
ga: 'org.apache.logging.log4j:log4j-core',
|
|
63
|
+
predicate: (v) => atLeast(v, '2.17.0') || inBand(v, '2.12.4', '2.13.0') || inBand(v, '2.3.2', '2.4.0'),
|
|
64
|
+
hardens: ['deserialization', 'code_injection'],
|
|
65
|
+
sinkHint: 'org.apache.logging.log4j.Logger#error',
|
|
66
|
+
cwe: ['CWE-917', 'CWE-502'],
|
|
67
|
+
note: (v) => `log4j-core ${v} — JNDI message-lookup disabled (Log4Shell CVE-2021-44228 class hardened).`,
|
|
68
|
+
},
|
|
69
|
+
// Spring4Shell — spring-beans 5.3.18+ / 5.2.20+ patch CVE-2022-22965.
|
|
70
|
+
{
|
|
71
|
+
ecosystem: 'Maven',
|
|
72
|
+
ga: 'org.springframework:spring-beans',
|
|
73
|
+
predicate: (v) => atLeast(v, '5.3.18') || inBand(v, '5.2.20', '5.3.0'),
|
|
74
|
+
hardens: ['code_injection'],
|
|
75
|
+
sinkHint: 'org.springframework.beans.CachedIntrospectionResults',
|
|
76
|
+
cwe: ['CWE-94'],
|
|
77
|
+
note: (v) => `spring-beans ${v} — Spring4Shell (CVE-2022-22965) class-loader access patched.`,
|
|
78
|
+
},
|
|
79
|
+
// commons-collections InvokerTransformer gadget hardened in 3.2.2 / 4.1.
|
|
80
|
+
{
|
|
81
|
+
ecosystem: 'Maven',
|
|
82
|
+
ga: 'commons-collections:commons-collections',
|
|
83
|
+
predicate: (v) => atLeast(v, '3.2.2'),
|
|
84
|
+
hardens: ['deserialization'],
|
|
85
|
+
sinkHint: 'org.apache.commons.collections.functors.InvokerTransformer',
|
|
86
|
+
cwe: ['CWE-502'],
|
|
87
|
+
note: (v) => `commons-collections ${v} — InvokerTransformer deserialization gadget disabled by default.`,
|
|
88
|
+
},
|
|
89
|
+
{
|
|
90
|
+
ecosystem: 'Maven',
|
|
91
|
+
ga: 'org.apache.commons:commons-collections4',
|
|
92
|
+
predicate: (v) => atLeast(v, '4.1'),
|
|
93
|
+
hardens: ['deserialization'],
|
|
94
|
+
sinkHint: 'org.apache.commons.collections4.functors.InvokerTransformer',
|
|
95
|
+
cwe: ['CWE-502'],
|
|
96
|
+
note: (v) => `commons-collections4 ${v} — InvokerTransformer deserialization gadget disabled by default.`,
|
|
97
|
+
},
|
|
98
|
+
// NOTE: jackson-databind is intentionally omitted — version alone is
|
|
99
|
+
// insufficient (hardening depends on whether `enableDefaultTyping` is
|
|
100
|
+
// enabled in code). Deferred to a config-gated follow-up per #123.
|
|
101
|
+
];
|
|
102
|
+
/** Match a resolved dependency against the registry. */
|
|
103
|
+
export function matchHardened(dep) {
|
|
104
|
+
return HARDENED_ARTIFACTS.find((h) => h.ecosystem === dep.ecosystem && h.ga === dep.name && h.predicate(dep.version));
|
|
105
|
+
}
|
|
106
|
+
//# sourceMappingURL=hardened-artifacts.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"hardened-artifacts.js","sourceRoot":"","sources":["../../src/trust/hardened-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAwBH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,gFAAgF;AAChF,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC;SACL,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,QAAQ;AACvB,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,OAAe,EAAE,GAAW,EAAE,YAAoB;IAChE,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAuB;IACpD,wEAAwE;IACxE;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,uCAAuC;QACjD,GAAG,EAAE,CAAC,SAAS,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACV,6CAA6C,CAAC,wJAAwJ;KACzM;IACD,oFAAoF;IACpF;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,qCAAqC;QACzC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CACf,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;QACtF,OAAO,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;QAC9C,QAAQ,EAAE,uCAAuC;QACjD,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,4EAA4E;KACzG;IACD,sEAAsE;IACtE;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,kCAAkC;QACtC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC;QACtE,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,QAAQ,EAAE,sDAAsD;QAChE,GAAG,EAAE,CAAC,QAAQ,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,+DAA+D;KAC9F;IACD,yEAAyE;IACzE;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,yCAAyC;QAC7C,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC;QACrC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,4DAA4D;QACtE,GAAG,EAAE,CAAC,SAAS,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,mEAAmE;KACzG;IACD;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,yCAAyC;QAC7C,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC;QACnC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,6DAA6D;QACvE,GAAG,EAAE,CAAC,SAAS,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,mEAAmE;KAC1G;IACD,qEAAqE;IACrE,sEAAsE;IACtE,mEAAmE;CACpE,CAAC;AAEF,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAAC,GAI7B;IACC,OAAO,kBAAkB,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CACtF,CAAC;AACJ,CAAC"}
|
package/dist/trust/index.d.ts
CHANGED
|
@@ -33,6 +33,8 @@ export { discriminatingSecurityScore, securityLoad, SECURITY_SEVERITY_PENALTY, S
|
|
|
33
33
|
export { missingGuardDomPass, type MissingGuardDomOptions, } from './passes/missing-guard-dom.js';
|
|
34
34
|
export { featureEnvyPass, type FeatureEnvyOptions, } from './passes/feature-envy.js';
|
|
35
35
|
export { specGapReportPass, type SpecGapReportOptions, } from './passes/spec-gap-report.js';
|
|
36
|
+
export { dependencyHardeningPass, type DependencyHardeningOptions, } from './passes/dependency-hardening.js';
|
|
37
|
+
export { HARDENED_ARTIFACTS, matchHardened, atLeast, type HardenedArtifact, } from './hardened-artifacts.js';
|
|
36
38
|
export { computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, type TrustCategory, type TrustScoringConfig, type TrustScoringContext, } from './scoring.js';
|
|
37
39
|
export { compareTrustResults, formatComparisonReport, type TrustComparisonResult, type PassDelta, } from './compare.js';
|
|
38
40
|
export { generateTrustSARIF } from './sarif.js';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,qBAAqB,EACrB,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,qBAAqB,EACrB,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}
|
package/dist/trust/index.js
CHANGED
|
@@ -47,6 +47,9 @@ export { missingGuardDomPass, } from './passes/missing-guard-dom.js';
|
|
|
47
47
|
export { featureEnvyPass, } from './passes/feature-envy.js';
|
|
48
48
|
// Sprint 10 — Spec-gap report
|
|
49
49
|
export { specGapReportPass, } from './passes/spec-gap-report.js';
|
|
50
|
+
// cognium-ai#123 — dependency-hardening advisory (artifacts, informational)
|
|
51
|
+
export { dependencyHardeningPass, } from './passes/dependency-hardening.js';
|
|
52
|
+
export { HARDENED_ARTIFACTS, matchHardened, atLeast, } from './hardened-artifacts.js';
|
|
50
53
|
// Scoring engine (v2)
|
|
51
54
|
export { computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, } from './scoring.js';
|
|
52
55
|
// Compare
|
package/dist/trust/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAUL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,oEAAoE;AACpE,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAE1C,2EAA2E;AAC3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,GAIf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,kBAAkB;AAClB,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,sEAAsE;AACtE,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AAExC,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAEtB,MAAM,sCAAsC,CAAC;AAE9C,yEAAyE;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,wEAAwE;AACxE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,QAAQ;AACR,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,QAAQ;AACR,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,YAAY,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAUL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,oEAAoE;AACpE,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAE1C,2EAA2E;AAC3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,GAIf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,kBAAkB;AAClB,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,sEAAsE;AACtE,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AAExC,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAEtB,MAAM,sCAAsC,CAAC;AAE9C,yEAAyE;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,wEAAwE;AACxE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,4EAA4E;AAC5E,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,OAAO,GAER,MAAM,yBAAyB,CAAC;AAEjC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,QAAQ;AACR,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,QAAQ;AACR,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,YAAY,CAAC"}
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Dependency-Hardening Advisory Trust Pass (cognium-ai#123, Option C)
|
|
3
|
+
*
|
|
4
|
+
* Reads the dependency manifest and emits an **advisory** (`info`) finding for
|
|
5
|
+
* each dependency pinned to a version that compiles out / patches a known
|
|
6
|
+
* dangerous sink (e.g. fastjson `_noneautotype`, log4j ≥2.17, Spring4Shell
|
|
7
|
+
* patch). It does NOT change any severity — circle-ir's raw deserialization /
|
|
8
|
+
* code-injection finding stays exactly as emitted; this sits *next to* it so a
|
|
9
|
+
* reviewer (or a future scan↔trust merge, the "B later" step) can correlate
|
|
10
|
+
* via `meta.sink_hint` and render a `hardened-by:` badge.
|
|
11
|
+
*
|
|
12
|
+
* Category: `artifacts` (weight 0, informational) — never moves the score.
|
|
13
|
+
* Cost: deterministic, zero-LLM (manifest parse + static registry match).
|
|
14
|
+
*/
|
|
15
|
+
import type { TrustPassResult } from '../types.js';
|
|
16
|
+
export interface DependencyHardeningOptions {
|
|
17
|
+
/** Max manifest files to scan (passed through to parseAllManifests). */
|
|
18
|
+
maxFiles?: number;
|
|
19
|
+
}
|
|
20
|
+
export declare function dependencyHardeningPass(projectPath: string, options?: DependencyHardeningOptions): Promise<TrustPassResult>;
|
|
21
|
+
//# sourceMappingURL=dependency-hardening.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"dependency-hardening.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/dependency-hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,aAAa,CAAC;AAIjE,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,eAAe,CAAC,CAuC1B"}
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Dependency-Hardening Advisory Trust Pass (cognium-ai#123, Option C)
|
|
3
|
+
*
|
|
4
|
+
* Reads the dependency manifest and emits an **advisory** (`info`) finding for
|
|
5
|
+
* each dependency pinned to a version that compiles out / patches a known
|
|
6
|
+
* dangerous sink (e.g. fastjson `_noneautotype`, log4j ≥2.17, Spring4Shell
|
|
7
|
+
* patch). It does NOT change any severity — circle-ir's raw deserialization /
|
|
8
|
+
* code-injection finding stays exactly as emitted; this sits *next to* it so a
|
|
9
|
+
* reviewer (or a future scan↔trust merge, the "B later" step) can correlate
|
|
10
|
+
* via `meta.sink_hint` and render a `hardened-by:` badge.
|
|
11
|
+
*
|
|
12
|
+
* Category: `artifacts` (weight 0, informational) — never moves the score.
|
|
13
|
+
* Cost: deterministic, zero-LLM (manifest parse + static registry match).
|
|
14
|
+
*/
|
|
15
|
+
import { parseAllManifests } from './dep-manifests.js';
|
|
16
|
+
import { HARDENED_ARTIFACTS } from '../hardened-artifacts.js';
|
|
17
|
+
export async function dependencyHardeningPass(projectPath, options = {}) {
|
|
18
|
+
const start = Date.now();
|
|
19
|
+
const pass = 'dependency-hardening-detected';
|
|
20
|
+
const { deps } = parseAllManifests(projectPath, options.maxFiles ?? 400);
|
|
21
|
+
const findings = [];
|
|
22
|
+
for (const dep of deps) {
|
|
23
|
+
for (const h of HARDENED_ARTIFACTS) {
|
|
24
|
+
if (dep.ecosystem !== h.ecosystem || dep.name !== h.ga)
|
|
25
|
+
continue;
|
|
26
|
+
if (!h.predicate(dep.version))
|
|
27
|
+
continue;
|
|
28
|
+
findings.push({
|
|
29
|
+
pass,
|
|
30
|
+
ruleId: `hardened-${h.ga}`,
|
|
31
|
+
severity: 'info',
|
|
32
|
+
message: h.note(dep.version),
|
|
33
|
+
location: { file: dep.file },
|
|
34
|
+
meta: {
|
|
35
|
+
artifact: h.ga,
|
|
36
|
+
version: dep.version,
|
|
37
|
+
hardens: h.hardens,
|
|
38
|
+
hardened_cwe: h.cwe,
|
|
39
|
+
// Correlate against a raw finding whose sink matches this method.
|
|
40
|
+
sink_hint: h.sinkHint,
|
|
41
|
+
advisory: true,
|
|
42
|
+
},
|
|
43
|
+
});
|
|
44
|
+
}
|
|
45
|
+
}
|
|
46
|
+
return {
|
|
47
|
+
pass,
|
|
48
|
+
score: 100, // advisory-only; artifacts category has weight 0
|
|
49
|
+
findings,
|
|
50
|
+
durationMs: Date.now() - start,
|
|
51
|
+
// #234 — only "applicable" when there was a manifest to read. A repo with
|
|
52
|
+
// no resolvable deps didn't get a real look, so don't count its clean 100.
|
|
53
|
+
applicable: deps.length > 0,
|
|
54
|
+
};
|
|
55
|
+
}
|
|
56
|
+
//# sourceMappingURL=dependency-hardening.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"dependency-hardening.js","sourceRoot":"","sources":["../../../src/trust/passes/dependency-hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAO9D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,UAAsC,EAAE;IAExC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,+BAA+B,CAAC;IAE7C,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE;gBAAE,SAAS;YACjE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,MAAM,EAAE,YAAY,CAAC,CAAC,EAAE,EAAE;gBAC1B,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;gBAC5B,IAAI,EAAE;oBACJ,QAAQ,EAAE,CAAC,CAAC,EAAE;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY,EAAE,CAAC,CAAC,GAAG;oBACnB,kEAAkE;oBAClE,SAAS,EAAE,CAAC,CAAC,QAAQ;oBACrB,QAAQ,EAAE,IAAI;iBACf;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,iDAAiD;QAC7D,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAC9B,0EAA0E;QAC1E,2EAA2E;QAC3E,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC;KAC5B,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAKtB,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAMD,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,
|
|
1
|
+
{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAKtB,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAMD,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA6E3D,CAAC;AAMF,iEAAiE;AACjE,KAAK,cAAc,GACf,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAuC7D,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAUtE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAAE,EAC9B,MAAM,GAAE,kBAA2C,EACnD,OAAO,GAAE,mBAAwB,GAChC,gBAAgB,CAgMlB"}
|
package/dist/trust/scoring.js
CHANGED
|
@@ -102,6 +102,7 @@ export const PASS_CATEGORY_MAP = {
|
|
|
102
102
|
'vex-generation': 'artifacts',
|
|
103
103
|
'audit-trail': 'artifacts',
|
|
104
104
|
'ai-generated-fingerprint': 'artifacts', // #234 L6 — provenance, not a threat
|
|
105
|
+
'dependency-hardening-detected': 'artifacts', // cognium-ai#123 — advisory, never scores
|
|
105
106
|
};
|
|
106
107
|
export const PASS_COMPONENT_MAP = {
|
|
107
108
|
'input-validation': 'vulnerability_score',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAML,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB,EAAE,cAAc;IACtC,2EAA2E;IAC3E,yBAAyB,EAAE,cAAc;IAEzC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IACpC,4EAA4E;IAC5E,oDAAoD;IACpD,iBAAiB,EAAE,eAAe;IAElC,0EAA0E;IAC1E,uEAAuE;IACvE,mDAAmD;IACnD,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,0CAA0C;IAE1C,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,sCAAsC;IACtC,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;IAC1B,0BAA0B,EAAE,WAAW,EAAE,qCAAqC;
|
|
1
|
+
{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAML,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB,EAAE,cAAc;IACtC,2EAA2E;IAC3E,yBAAyB,EAAE,cAAc;IAEzC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IACpC,4EAA4E;IAC5E,oDAAoD;IACpD,iBAAiB,EAAE,eAAe;IAElC,0EAA0E;IAC1E,uEAAuE;IACvE,mDAAmD;IACnD,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,0CAA0C;IAE1C,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,sCAAsC;IACtC,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;IAC1B,0BAA0B,EAAE,WAAW,EAAE,qCAAqC;IAC9E,+BAA+B,EAAE,WAAW,EAAE,0CAA0C;CACzF,CAAC;AAsBF,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,oBAAoB;IAC3C,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,sBAAsB,EAAE,oBAAoB;IAC5C,yBAAyB,EAAE,oBAAoB;IAC/C,mBAAmB,EAAE,oBAAoB;IACzC,kBAAkB,EAAE,mBAAmB;IACvC,uBAAuB,EAAE,kBAAkB;IAC3C,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,kBAAkB;IACvC,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,0BAA0B,EAAE,kBAAkB;IAC9C,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,sBAAsB,EAAE,mBAAmB;IAC3C,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,0EAA0E;IAC1E,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,eAAe;IAC/B,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,4EAA4E;IAC5E,kDAAkD;IAClD,iBAAiB,EAAE,cAAc;CAClC,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA8B,EAC9B,SAA6B,sBAAsB,EACnD,UAA+B,EAAE;IAEjC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAE7E,mEAAmE;IACnE,0CAA0C;IAC1C,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC5F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAElE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;;gBACxB,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/D,IAAI,SAAS,GAAG,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAE1C,MAAM,gBAAgB,GAAoB;QACxC,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;KACb,CAAC,CAAC,iEAAiE;IAEpE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,yCAAyC;QAC1E,WAAW,IAAI,GAAG,GAAG,MAAM,CAAC;QAC5B,eAAe,IAAI,MAAM,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,cAAc,GAChB,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpF,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EACvC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjE,qCAAqC;IACrC,MAAM,gBAAgB,GAAuB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,KAAK,SAAS;YAC5B,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;YAC7D,kBAAkB,EAAE,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;YACzD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjE,4EAA4E;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAU,EAAE;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,8BAA8B;QAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,CAAC,CAAC;IAEF,4EAA4E;IAE5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,uEAAuE;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAe,WAAW;QACxC,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAE5E,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,IAAI;QAEJ,qCAAqC;QACrC,UAAU;QACV,QAAQ;QACR,gBAAgB;QAEhB,8CAA8C;QAC9C,gBAAgB;QAChB,cAAc;QAEd,sBAAsB;QACtB,mBAAmB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QACxD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,iCAAiC;QAC7E,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QAEpD,oEAAoE;QACpE,wDAAwD;QACxD,mBAAmB,EAAE,YAAY,CAAC,MAAM;QACxC,YAAY,EAAE,GAAG;QACjB,gBAAgB,EAAE,GAAG;QACrB,kBAAkB,EAAE,YAAY;QAEhC,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.92.0",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
"@ax-llm/ax": "^20.0.0",
|
|
99
99
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
100
100
|
"@mastra/core": "^1.18.0",
|
|
101
|
-
"circle-ir": "3.
|
|
101
|
+
"circle-ir": "3.212.0",
|
|
102
102
|
"minimatch": "^10.2.5",
|
|
103
103
|
"p-queue": "^9.1.0"
|
|
104
104
|
},
|