circle-ir-ai 4.16.4 → 4.16.5

package/CHANGELOG.md

@@ -8,49 +8,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Changed
-- **`circle-ir` 4.9.26 → 4.9.27.** All four packages re-pinned. Test suites pass unchanged on
-  the new engine (circle-ir-ai 2340, cognium-ai 363, mcp-server 11, circle-pack 182), and every
-  package resolves exactly one copy of `circle-ir`.
+- **`circle-ir` 4.9.27 → 4.9.29.** All four packages re-pinned; suites pass unchanged
+  (circle-ir-ai 2340, cognium-ai 363, mcp-server 11, circle-pack 182) and each resolves exactly
+  one copy. 4.9.28 was pinned briefly on this branch and never published, so this supersedes it.
 
-  **C# measurement moved, in both directions** — the 4.9.26 baselines captured earlier the same
-  day make this visible rather than invisible:
-
-  | Gate | 4.9.26 | 4.9.27 |
-  |---|---|---|
-  | `benchmark:csharp` (engine) | 90.9% TPR / 0.0% FPR | **100.0% / 25.0%** |
-  | `benchmark:csharp-juliet` (injected config) | 13.8% / 8.1% | **21.1% / 16.3%** |
-  | `benchmark:csharp-juliet --default-config` | 2.4% / 2.4% | **10.6% / 10.6%** |
-  | `benchmark:csharp-oracle` (labelled, 808 cases) | 71.2% / 8.7% | **71.2% / 8.7%** (unchanged) |
-
-  The recall gains are real: the ASP.NET Core `Response.WriteAsync` xss sink landed
-  (cognium-dev#503), turning `xss_response_write_concat` from FN to TP, and Juliet CWE-89 sqli
-  went 29.6% → 59.3% with CWE-643 xpath 70% → 80%.
-
-  They arrived with a precision cost. The new xss sink does **not** credit
-  `HtmlEncoder.Default.Encode`, so `xss_htmlencode_safe` flipped TN → FP and the synthetic gate's
-  FPR went 0% → 25% — filed as cognium-dev#520. Juliet CWE-89's false-positive files went 3 → 12
-  and its cross-method leaks 3 → 12 in the same step.
-
-  The labelled oracle did not move at all, which locates 4.9.27's C# changes in the
-  Juliet-shaped source/sink surface rather than the ASP.NET Core surface the oracle covers.
-
-### Fixed
-- **ReDoS in `stripLiterals` wedges the whole process on scanned bundle content (cognium-ai#508).**
-  The regex-literal stripper's inner character class was `[^\]]`, which also matches a backslash —
-  so it overlapped the `\\.` alternative and a run of backslashes inside an unterminated `[…]`
-  could be partitioned exponentially many ways. Measured on `" /[" + "\\"×N + "x"`: 34 chars
-  6.5 ms, 44 chars 794 ms, **48 chars 5,395 ms** (~×2.7 per two characters); a ~56-character line
-  pins one core for **5+ hours**. Because `detectCodeThreatPatterns` runs over the **contents of
-  scanned skill bundles**, that is attacker-controlled input and a whole-process denial of service
-  — the service is single-threaded, so every concurrent job dies with it, and the bundle need not
-  even pass validation. Observed three times in production on 2026-09-24 (5 h 37 m, ~17 min, ~6 min);
-  `/health` is unanswerable throughout while the container stays alive, which reads as "the service
-  is down". Root-caused from a live stack captured via the Node inspector.
-
-  Fix excludes `\\` from the negated class, making the two alternatives disjoint: **5,394.9 ms →
-  0.1 ms**, with byte-identical output on real regex literals, division and string literals.
-  Audited the rest of the file — this was the only ambiguous `\\.` / `[^…]` site.
+  **C# product-path recall is essentially solved, and C# precision got much worse.** Both halves
+  matter and they have the same cause.
 
+  | Gate | 4.9.27 | 4.9.28 | **4.9.29** |
+  |---|---|---|---|
+  | `benchmark:csharp-juliet` (injected config) | 21.1 / 16.3 | 69.9 / 17.1 | **93.5 / 37.4** |
+  | `benchmark:csharp-juliet --default-config` | 10.6 / 10.6 | 34.1 / 13.8 | **93.5 / 37.4** |
+  | `benchmark:csharp-oracle` (808 labelled) | 71.2 / 8.7 | 73.5 / 8.4 | **73.7 / 8.4** |
+  | `benchmark:csharp-product` | 100.0 / 50.0 | 100.0 / 25.0 | 100.0 / 25.0 |
+  | `benchmark:csharp` (engine) | 100.0 / 25.0 | 100.0 / 25.0 | 100.0 / 25.0 |
+  | `benchmark:rust` | 92.3% | **89.6%** | **89.6%** ⚠ |
+
+  **Product-path C# recall on Juliet: 2.4% → 10.6% → 34.1% → 93.5% across 4.9.26 → 4.9.29.**
+
+  **The injected-config and default-config runs now produce identical numbers**, because
+  cognium-dev#502's I/O sources (console/file/socket/env) landed in the *default* model. Verified
+  directly: a Juliet `ReadLine` fixture that previously bound nothing now yields
+  `sources 2, sinks 5, flows 2` under the default config. The "engine ceiling vs product path"
+  gap this runner was built to expose has closed for this corpus — keep quoting both anyway, so
+  the day they diverge again is visible.
+
+  **cognium-dev#503 landed:** CWE-81 went 0.0% → 88.9% and CWE-94 0.0% → 100%, the two families
+  that were at exactly zero and that ticket's two missing sinks.
+
+  **Precision regressed sharply, and only where cognium-dev#508 applies.** CWE-89 sqli and
+  CWE-643 xpath now fire on **100% of their files including every `Good*()` safe control** (27/27
+  and 10/10), and CWE-94 on 90%. The other six families hold **0.0% FPR** at 88.9–90% recall.
+  More bound sources produce proportionally more bogus source×sink pairings: CWE-89 cross-method
+  leaks went 3 → 12 → 27 across the same three releases. #508 is now the top C# precision item,
+  reported there with this evidence.
+
+  **Not fixed in either release:** cognium-dev#520 (`HtmlEncoder` still uncredited, so
+  `xss_htmlencode_safe` remains the sole FP on both C# synthetic gates), #508, #509.
+
+  **Carried-over regression:** `rmp_serde::from_slice` is still not a deserialization sink, so
+  MessagePack over a `TcpStream` is undetected — Rust synthetic 97.3% TPR, down from 100%.
+  cognium-dev#541.
+
+  Unchanged on 4.9.29: OWASP 1415/1415, Juliet 243/243, SecuriBench 97.2%/6.7%, Go 89.5%,
+  NodeJS 92.9%, CWE-Bench-Rust 100%, bash and HTML 100%.
 
 ## [4.16.3] - 2026-09-24
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "4.16.4",
+  "version": "4.16.5",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -105,7 +105,7 @@
     "@ax-llm/ax": "^20.0.0",
     "@cognium/project-profile-detect": "^1.1.0",
     "@mastra/core": "^1.18.0",
-    "circle-ir": "4.9.27",
+    "circle-ir": "4.9.29",
     "minimatch": "^10.2.5",
     "p-queue": "^9.1.0"
   },