circle-ir-ai 4.7.0 → 4.8.0

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.8.0] - 2026-08-26
+
+### Added — cognium-ai#117: Specifica-driven per-repo sink-class allowlist
+
+Repo owners can declare, in the Specifica `principles.md`, that a specific method
+is not a real sink for a given finding class (a "Sink semantics" block). The
+scanner reads `.specifica/principles.md` and moves matching findings out of the
+main set into `ScanResult.suppressedBySpecifica[]` — auditable, NOT dropped; each
+carries `suppressed_by_specifica`. Matching is conservative (type + declared
+method invoked in the sink + declared class present). New pure module
+`specifica/sink-suppression.ts` (`parseSinkSuppressions` / `applySinkSuppressions`,
+exported). Zero overhead + no behavior change when no declarations exist.
+
+### Fixed — skillsregistry#65: api_base_url_hijack must not fire on non-public hosts (CWE-494 FP)
+
+A non-public host cannot be a public MITM relay. New `isNonPublicHost()` guard on
+the `api_base_url_hijack` detector excludes `.local` (RFC 6762), reserved TLDs
+(RFC 2606/6761), private/loopback/link-local IPv4, and single-label hosts. FP
+(`baseUrl = 'https://tenant.creatio.local'`) → CLEAN; genuine public relay still
+fires (recall preserved); the sr#65 configurable-exclusion unchanged.
+
+### Changed — circle-ir 4.9.8 → 4.9.9 (performance, cognium-ai#305)
+
+Large C#/Java single-file taint analysis was superlinear (~16k-line C# file ~37s;
+very large generated files could appear to hang). circle-ir 4.9.9 removes six hot
+paths in the taint/sink text-scan layer → ~11× faster, sub-quadratic scaling,
+with **0 change in `taint.flows`** across OWASP-Java/SecuriBench/BenchmarkPython
+(4101 files) — behavior-preserving. Directly addresses the #305 large-repo hangs.
+OWASP 100% preserved.
+
 ## [4.7.0] - 2026-08-25
 
 ### Added — cognium-ai#336: graph-path gate for library/tool context (verifier over-affirmation FP fix)

package/dist/agents/mastra/agents.d.ts

@@ -24,36 +24,36 @@ export declare const enrichmentAgent: Agent<"enrichment-agent", {
         indicators: string[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "classify-role", unknown>;
     discoverSources: import("@mastra/core/tools").Tool<{
+        methodCode: string;
         methodName: string;
         classRole: string;
         existingSources: string;
-        methodCode: string;
     }, {
         sources: {
-            confidence: number;
-            reasoning: string;
-            type: string;
             line: number;
             variable: string;
+            type: string;
+            confidence: number;
+            reasoning: string;
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
     discoverSinks: import("@mastra/core/tools").Tool<{
+        methodCode: string;
         methodName: string;
         methodCalls: string;
         existingSinks: string;
-        methodCode: string;
     }, {
         sinks: {
-            confidence: number;
-            reasoning: string;
-            type: string;
             line: number;
             method: string;
+            type: string;
             cwe: string;
             argPositions: number[];
+            confidence: number;
+            reasoning: string;
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
-}, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
+}, undefined, any, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 /**
  * Verification Agent
  *
@@ -62,26 +62,26 @@ export declare const enrichmentAgent: Agent<"enrichment-agent", {
  */
 export declare const verificationAgent: Agent<"verification-agent", {
     verifyVulnerability: import("@mastra/core/tools").Tool<{
-        cwe: string;
-        sourceType: string;
-        className: string;
-        methodName: string;
-        methodCode: string;
-        sourceLine: number;
         sourceCode: string;
-        sinkLine: number;
+        sourceLine: number;
+        sourceType: string;
         sinkCode: string;
+        sinkLine: number;
         sinkType: string;
+        cwe: string;
+        methodCode: string;
+        methodName: string;
+        className: string;
         sanitizersInPath: string[];
     }, {
+        verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
         confidence: number;
         reasoning: string;
-        verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
         exploitability: "high" | "medium" | "low" | "none";
         sanitizersFound: string[];
         attackVector: string;
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "verify-vulnerability", unknown>;
-}, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
+}, undefined, any, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 /**
  * Cross-File Analysis Agent
  *
@@ -89,26 +89,26 @@ export declare const verificationAgent: Agent<"verification-agent", {
  */
 export declare const crossFileAgent: Agent<"cross-file-agent", {
     crossFileTaint: import("@mastra/core/tools").Tool<{
+        sourceFile: string;
         sourceCode: string;
         targetFile: string;
+        targetCode: string;
         exportedTaint: {
             symbol: string;
             type: string;
             line: number;
         }[];
-        sourceFile: string;
-        targetCode: string;
         importedSymbols: string[];
     }, {
-        reasoning: string;
         taintFlows: {
-            confidence: number;
             sourceSymbol: string;
             targetSymbol: string;
             flowType: "direct" | "transitive" | "conditional";
+            confidence: number;
         }[];
+        reasoning: string;
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-}, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
+}, undefined, any, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 /**
  * Orchestrator Agent
  *
@@ -127,76 +127,76 @@ export declare const orchestratorAgent: Agent<"orchestrator-agent", {
         indicators: string[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "classify-role", unknown>;
     discoverSources: import("@mastra/core/tools").Tool<{
+        methodCode: string;
         methodName: string;
         classRole: string;
         existingSources: string;
-        methodCode: string;
     }, {
         sources: {
-            confidence: number;
-            reasoning: string;
-            type: string;
             line: number;
             variable: string;
+            type: string;
+            confidence: number;
+            reasoning: string;
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
     discoverSinks: import("@mastra/core/tools").Tool<{
+        methodCode: string;
         methodName: string;
         methodCalls: string;
         existingSinks: string;
-        methodCode: string;
     }, {
         sinks: {
-            confidence: number;
-            reasoning: string;
-            type: string;
             line: number;
             method: string;
+            type: string;
             cwe: string;
             argPositions: number[];
+            confidence: number;
+            reasoning: string;
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
     verifyVulnerability: import("@mastra/core/tools").Tool<{
-        cwe: string;
-        sourceType: string;
-        className: string;
-        methodName: string;
-        methodCode: string;
-        sourceLine: number;
         sourceCode: string;
-        sinkLine: number;
+        sourceLine: number;
+        sourceType: string;
         sinkCode: string;
+        sinkLine: number;
         sinkType: string;
+        cwe: string;
+        methodCode: string;
+        methodName: string;
+        className: string;
         sanitizersInPath: string[];
     }, {
+        verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
         confidence: number;
         reasoning: string;
-        verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
         exploitability: "high" | "medium" | "low" | "none";
         sanitizersFound: string[];
         attackVector: string;
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "verify-vulnerability", unknown>;
     crossFileTaint: import("@mastra/core/tools").Tool<{
+        sourceFile: string;
         sourceCode: string;
         targetFile: string;
+        targetCode: string;
         exportedTaint: {
             symbol: string;
             type: string;
             line: number;
         }[];
-        sourceFile: string;
-        targetCode: string;
         importedSymbols: string[];
     }, {
-        reasoning: string;
         taintFlows: {
-            confidence: number;
             sourceSymbol: string;
             targetSymbol: string;
             flowType: "direct" | "transitive" | "conditional";
+            confidence: number;
         }[];
+        reasoning: string;
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-}, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
+}, undefined, any, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 export declare const agents: {
     enrichment: Agent<"enrichment-agent", {
         classifyRole: import("@mastra/core/tools").Tool<{
@@ -211,80 +211,80 @@ export declare const agents: {
             indicators: string[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "classify-role", unknown>;
         discoverSources: import("@mastra/core/tools").Tool<{
+            methodCode: string;
             methodName: string;
             classRole: string;
             existingSources: string;
-            methodCode: string;
         }, {
             sources: {
-                confidence: number;
-                reasoning: string;
-                type: string;
                 line: number;
                 variable: string;
+                type: string;
+                confidence: number;
+                reasoning: string;
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
         discoverSinks: import("@mastra/core/tools").Tool<{
+            methodCode: string;
             methodName: string;
             methodCalls: string;
             existingSinks: string;
-            methodCode: string;
         }, {
             sinks: {
-                confidence: number;
-                reasoning: string;
-                type: string;
                 line: number;
                 method: string;
+                type: string;
                 cwe: string;
                 argPositions: number[];
+                confidence: number;
+                reasoning: string;
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
-    }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
+    }, undefined, any, import("@mastra/core/agent").AgentEditorConfig | undefined>;
     verification: Agent<"verification-agent", {
         verifyVulnerability: import("@mastra/core/tools").Tool<{
-            cwe: string;
-            sourceType: string;
-            className: string;
-            methodName: string;
-            methodCode: string;
-            sourceLine: number;
             sourceCode: string;
-            sinkLine: number;
+            sourceLine: number;
+            sourceType: string;
             sinkCode: string;
+            sinkLine: number;
             sinkType: string;
+            cwe: string;
+            methodCode: string;
+            methodName: string;
+            className: string;
             sanitizersInPath: string[];
         }, {
+            verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
             confidence: number;
             reasoning: string;
-            verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
             exploitability: "high" | "medium" | "low" | "none";
             sanitizersFound: string[];
             attackVector: string;
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "verify-vulnerability", unknown>;
-    }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
+    }, undefined, any, import("@mastra/core/agent").AgentEditorConfig | undefined>;
     crossFile: Agent<"cross-file-agent", {
         crossFileTaint: import("@mastra/core/tools").Tool<{
+            sourceFile: string;
             sourceCode: string;
             targetFile: string;
+            targetCode: string;
             exportedTaint: {
                 symbol: string;
                 type: string;
                 line: number;
             }[];
-            sourceFile: string;
-            targetCode: string;
             importedSymbols: string[];
         }, {
-            reasoning: string;
             taintFlows: {
-                confidence: number;
                 sourceSymbol: string;
                 targetSymbol: string;
                 flowType: "direct" | "transitive" | "conditional";
+                confidence: number;
             }[];
+            reasoning: string;
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-    }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
+    }, undefined, any, import("@mastra/core/agent").AgentEditorConfig | undefined>;
     orchestrator: Agent<"orchestrator-agent", {
         classifyRole: import("@mastra/core/tools").Tool<{
             className: string;
@@ -298,76 +298,76 @@ export declare const agents: {
             indicators: string[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "classify-role", unknown>;
         discoverSources: import("@mastra/core/tools").Tool<{
+            methodCode: string;
             methodName: string;
             classRole: string;
             existingSources: string;
-            methodCode: string;
         }, {
             sources: {
-                confidence: number;
-                reasoning: string;
-                type: string;
                 line: number;
                 variable: string;
+                type: string;
+                confidence: number;
+                reasoning: string;
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
         discoverSinks: import("@mastra/core/tools").Tool<{
+            methodCode: string;
             methodName: string;
             methodCalls: string;
             existingSinks: string;
-            methodCode: string;
         }, {
             sinks: {
-                confidence: number;
-                reasoning: string;
-                type: string;
                 line: number;
                 method: string;
+                type: string;
                 cwe: string;
                 argPositions: number[];
+                confidence: number;
+                reasoning: string;
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
         verifyVulnerability: import("@mastra/core/tools").Tool<{
-            cwe: string;
-            sourceType: string;
-            className: string;
-            methodName: string;
-            methodCode: string;
-            sourceLine: number;
             sourceCode: string;
-            sinkLine: number;
+            sourceLine: number;
+            sourceType: string;
             sinkCode: string;
+            sinkLine: number;
             sinkType: string;
+            cwe: string;
+            methodCode: string;
+            methodName: string;
+            className: string;
             sanitizersInPath: string[];
         }, {
+            verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
             confidence: number;
             reasoning: string;
-            verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
             exploitability: "high" | "medium" | "low" | "none";
             sanitizersFound: string[];
             attackVector: string;
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "verify-vulnerability", unknown>;
         crossFileTaint: import("@mastra/core/tools").Tool<{
+            sourceFile: string;
             sourceCode: string;
             targetFile: string;
+            targetCode: string;
             exportedTaint: {
                 symbol: string;
                 type: string;
                 line: number;
             }[];
-            sourceFile: string;
-            targetCode: string;
             importedSymbols: string[];
         }, {
-            reasoning: string;
             taintFlows: {
-                confidence: number;
                 sourceSymbol: string;
                 targetSymbol: string;
                 flowType: "direct" | "transitive" | "conditional";
+                confidence: number;
             }[];
+            reasoning: string;
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
-    }, undefined, unknown, import("@mastra/core/agent").AgentEditorConfig | undefined>;
+    }, undefined, any, import("@mastra/core/agent").AgentEditorConfig | undefined>;
 };
 export default agents;
 //# sourceMappingURL=agents.d.ts.map

package/dist/agents/mastra/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../src/agents/mastra/agents.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA8N3C;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kFA2B1B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;kFAyB5B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;kFAqBzB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kFA0B5B,CAAC;AAMH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKlB,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../src/agents/mastra/agents.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA8N3C;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8EA2B1B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;8EAyB5B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;8EAqBzB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8EA0B5B,CAAC;AAMH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKlB,CAAC;AAEF,eAAe,MAAM,CAAC"}