circle-ir-ai 4.19.0 → 4.20.0

package/CHANGELOG.md

@@ -116,6 +116,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   Unchanged on 4.9.29: OWASP 1415/1415, Juliet 243/243, SecuriBench 97.2%/6.7%, Go 89.5%,
   NodeJS 92.9%, CWE-Bench-Rust 100%, bash and HTML 100%.
 
+## [4.20.0] - 2026-10-07
+
+### Changed
+- **`circle-ir` 4.10.0 → 4.11.0**, a minor, so this is a minor. The pin is what
+  `src/mcp/index.ts` reads for the tool module's `circleIrRange`, so the module now
+  declares **4.11.0**. Verified on the built module: `circle-ir-ai/mcp 4.20.0 4.11.0`.
+- **What 4.11.0 changes:** cognium-dev#292 drops taint flows whose only source is a bare
+  function parameter (`interprocedural_param`) for every language except Java and C#,
+  unless the enclosing function is a recognised framework handler. Sources are kept; only
+  flows go. Opt back in with `AnalyzerOptions.speculativeParamSources`. Also #516 (a Python
+  `for` target bound from a tainted iterable is a source).
+- **No benchmark moved.** All fifteen static suites were run on 4.10.0 and 4.11.0
+  back to back and score identically: OWASP 1415/1415, Juliet 243/243, NodeJS 92.9%,
+  Rust 92.3% (100% TPR), CWE-Bench-Rust 100%, Bash and HTML 100%, Go 89.5%, Firing Range
+  92.1% TPR, NodeGoat / Juice Shop / DVPWA 100%, PyGoat 90.0%, DVNA 71.4%, C# synthetic
+  75.0%. The gate is not exercised by these corpora; library-API and agent-code scans
+  (the skill scanner's input) are where it can remove flows, and they are not measured here.
+- 2,428 tests pass unchanged against 4.11.0 (196 files, 4 skipped); typecheck clean.
+
 ## [4.19.0] - 2026-10-02
 
 ### Changed

package/dist/coverage/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Coverage map — the Conformis architect-view *receipt* (conformis-layer-
+ * generation-canon.md §9, conformis-execution-plan.md D9 "the subtraction + the
+ * receipt").
+ *
+ * Given a layer-BOM (what's in the repo per layer), declare for each component
+ * whether we can *witness* it today (`settles_now`), can only *signal* it until
+ * a dynamic harness exists (`signal_until_harness`), have declared it
+ * un-checkable (`not_diffable`), or have no capability mapped (`uncovered`).
+ *
+ * HONESTY (canon §11): these states are a **declaration** of intended coverage,
+ * grounded in the canon's per-layer inherited/extracted split — NOT proven
+ * witness yield. The real settled-% comes later from shadow-mode witness runs.
+ * So this emits **counts + per-component verdicts** (the receipt), and a
+ * `declaredCoverablePct` explicitly labelled projected, never a settled-%.
+ */
+import type { BomLayer, RepoBom } from '../bom/types.js';
+export type CoverageState = 'settles_now' | 'signal_until_harness' | 'not_diffable' | 'uncovered';
+export declare const COVERAGE_STATES: CoverageState[];
+export interface ComponentCoverage {
+    name: string;
+    layer: BomLayer;
+    kind: string;
+    state: CoverageState;
+    /** Short why, e.g. "static call-site asserts" / "needs replay harness". */
+    basis: string;
+}
+export interface LayerCoverage {
+    layer: BomLayer;
+    title: string;
+    counts: Record<CoverageState, number>;
+    components: ComponentCoverage[];
+}
+export interface CoverageMap {
+    target: string;
+    layers: Record<BomLayer, LayerCoverage>;
+    summary: {
+        counts: Record<CoverageState, number>;
+        totalComponents: number;
+        /**
+         * PROJECTED — (settles_now + signal_until_harness) / (total − not_diffable).
+         * A declaration of intended coverage, NOT a proven settled-%. Gate any real
+         * % on shadow-mode witness yield (canon §11).
+         */
+        declaredCoverablePct: number;
+    };
+}
+/** Compute the coverage-map (receipt) for a BOM. Pure. */
+export declare function computeCoverage(bom: RepoBom): CoverageMap;
+//# sourceMappingURL=index.d.ts.map

package/dist/coverage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/coverage/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAGvE,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,sBAAsB,GAAG,cAAc,GAAG,WAAW,CAAC;AAElG,eAAO,MAAM,eAAe,EAAE,aAAa,EAAyE,CAAC;AAErH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;IACrB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,QAAQ,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACtC,UAAU,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACxC,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACtC,eAAe,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,oBAAoB,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAuCD,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CA2BzD"}

package/dist/coverage/index.js

@@ -0,0 +1,73 @@
+/**
+ * Coverage map — the Conformis architect-view *receipt* (conformis-layer-
+ * generation-canon.md §9, conformis-execution-plan.md D9 "the subtraction + the
+ * receipt").
+ *
+ * Given a layer-BOM (what's in the repo per layer), declare for each component
+ * whether we can *witness* it today (`settles_now`), can only *signal* it until
+ * a dynamic harness exists (`signal_until_harness`), have declared it
+ * un-checkable (`not_diffable`), or have no capability mapped (`uncovered`).
+ *
+ * HONESTY (canon §11): these states are a **declaration** of intended coverage,
+ * grounded in the canon's per-layer inherited/extracted split — NOT proven
+ * witness yield. The real settled-% comes later from shadow-mode witness runs.
+ * So this emits **counts + per-component verdicts** (the receipt), and a
+ * `declaredCoverablePct` explicitly labelled projected, never a settled-%.
+ */
+import { BOM_LAYER_TITLES } from '../bom/types.js';
+export const COVERAGE_STATES = ['settles_now', 'signal_until_harness', 'not_diffable', 'uncovered'];
+// Per-layer default capability, from the canon §3 verifier-shape / inherited-
+// extracted column. Declarations, extend/override per kind below.
+const LAYER_CAPABILITY = {
+    L2: { state: 'signal_until_harness', basis: 'runtime races/async need a replay harness (Coyote/JPF); presence is static' },
+    L3: { state: 'settles_now', basis: 'static call-site asserts (alg≠none, PKCE-MUST, state-validated); wire seq is dynamic' },
+    L4: { state: 'settles_now', basis: 'reachability × version-diff (Syft/Grype/OSV) — static' },
+    L5: { state: 'signal_until_harness', basis: 'framework idiom conformance is fuzzier; wrap linters as signal until harnessed' },
+    L6: { state: 'settles_now', basis: 'config-conformance (Checkov/OPA/Conftest) — static' },
+    L7: { state: 'signal_until_harness', basis: 'tx-boundary/N+1 static; migration reconciliation needs a differential harness' },
+    L8: { state: 'settles_now', basis: 'contract-diff × usage-witness (oasdiff/buf/graphql-inspector + circle-ir) — static usage' },
+    L9: { state: 'uncovered', basis: 'domain-logic residual — extracted + executed harness, not yet built' },
+};
+// Per-kind overrides where a component is more/less checkable than its layer default.
+const KIND_CAPABILITY = {
+    'runtime:node': { state: 'not_diffable', basis: 'runtime version itself is not a conformance target' },
+    'runtime:python': { state: 'not_diffable', basis: 'runtime version itself is not a conformance target' },
+    'runtime:jvm': { state: 'not_diffable', basis: 'runtime version itself is not a conformance target' },
+    'runtime:go': { state: 'not_diffable', basis: 'runtime version itself is not a conformance target' },
+    'runtime:rust': { state: 'not_diffable', basis: 'runtime version itself is not a conformance target' },
+    // L7 raw drivers: presence only, no ORM idiom to check
+    'db-driver': { state: 'signal_until_harness', basis: 'raw driver — query safety needs taint, no ORM idiom contract' },
+    // L4 dev deps: not a runtime supply-chain surface
+    'dependency:dev': { state: 'not_diffable', basis: 'dev-only dependency — not in the shipped supply-chain surface' },
+};
+function capabilityFor(c) {
+    return KIND_CAPABILITY[c.kind] ?? LAYER_CAPABILITY[c.layer];
+}
+const ALL_LAYERS = ['L2', 'L3', 'L4', 'L5', 'L6', 'L7', 'L8', 'L9'];
+/** Compute the coverage-map (receipt) for a BOM. Pure. */
+export function computeCoverage(bom) {
+    const zero = () => ({ settles_now: 0, signal_until_harness: 0, not_diffable: 0, uncovered: 0 });
+    const total = zero();
+    const layers = {};
+    for (const layer of ALL_LAYERS) {
+        const counts = zero();
+        const components = [];
+        for (const c of bom.layers[layer].components) {
+            const cap = capabilityFor(c);
+            counts[cap.state]++;
+            total[cap.state]++;
+            components.push({ name: c.name, layer, kind: c.kind, state: cap.state, basis: cap.basis });
+        }
+        layers[layer] = { layer, title: BOM_LAYER_TITLES[layer], counts, components };
+    }
+    const totalComponents = COVERAGE_STATES.reduce((n, s) => n + total[s], 0);
+    const diffable = totalComponents - total.not_diffable;
+    const coverable = total.settles_now + total.signal_until_harness;
+    const declaredCoverablePct = diffable > 0 ? Math.round((coverable / diffable) * 1000) / 10 : 0;
+    return {
+        target: bom.target,
+        layers,
+        summary: { counts: total, totalComponents, declaredCoverablePct },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/coverage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/coverage/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAInD,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,aAAa,EAAE,sBAAsB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;AAsCrH,8EAA8E;AAC9E,kEAAkE;AAClE,MAAM,gBAAgB,GAAiC;IACrD,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,4EAA4E,EAAE;IAC1H,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,sFAAsF,EAAE;IAC3H,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,uDAAuD,EAAE;IAC5F,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,gFAAgF,EAAE;IAC9H,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,oDAAoD,EAAE;IACzF,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,+EAA+E,EAAE;IAC7H,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,0FAA0F,EAAE;IAC/H,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,qEAAqE,EAAE;CACzG,CAAC;AAEF,sFAAsF;AACtF,MAAM,eAAe,GAA+B;IAClD,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oDAAoD,EAAE;IACtG,gBAAgB,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oDAAoD,EAAE;IACxG,aAAa,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oDAAoD,EAAE;IACrG,YAAY,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oDAAoD,EAAE;IACpG,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oDAAoD,EAAE;IACtG,uDAAuD;IACvD,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,8DAA8D,EAAE;IACrH,kDAAkD;IAClD,gBAAgB,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,+DAA+D,EAAE;CACpH,CAAC;AAEF,SAAS,aAAa,CAAC,CAAe;IACpC,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,GAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,MAAM,IAAI,GAAG,GAAkC,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/H,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,EAAqC,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;QACtB,MAAM,UAAU,GAAwB,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,eAAe,GAAG,KAAK,CAAC,YAAY,CAAC;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,oBAAoB,CAAC;IACjE,MAAM,oBAAoB,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/F,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM;QACN,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE;KAClE,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "4.19.0",
+  "version": "4.20.0",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -110,7 +110,7 @@
     "@ax-llm/ax": "^20.0.0",
     "@cognium/project-profile-detect": "^1.1.0",
     "@mastra/core": "^1.18.0",
-    "circle-ir": "4.10.0",
+    "circle-ir": "4.11.0",
     "minimatch": "^10.2.5",
     "p-queue": "^9.1.0",
     "zod": "^4.4.3"