cognium-ai 2.36.1 → 2.38.0

package/dist/cli/commands/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQ1C;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA0OhE"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAS1C;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAsPhE"}

package/dist/cli/commands/scan.js

@@ -10,6 +10,7 @@ resetTruncationCount, snapshotTruncationCount, } from 'circle-ir-ai';
 import { contextProfileFromProjectProfile, resolveContextProfile } from '../cluster-policies.js';
 import { getEffectiveOptions, warnIfSilentExclusion } from '../effective-options.js';
 import { applyFindingsCap } from '../findings-cap.js';
+import { capSeverityByExploitability } from '../severity-policy.js';
 import { enrichScanSarif } from '../formatters/scan-sarif-enrich.js';
 import { resolveProjectProfileForEngine } from '../project-profile.js';
 /**
@@ -124,6 +125,15 @@ export async function executeScan(args) {
         resetTruncationCount();
         const rawResult = await scanDirectory(targetPath, options);
         const truncationCount = snapshotTruncationCount();
+        // cognium-ai#214 — cap severity by exploitability. Findings the
+        // engine's verifier marked `exploitable: false` are advisories, not
+        // Critical/High gate-blockers; downgrade them to medium (preserving
+        // `originalSeverity`) before the findings-cap so the cap sees the
+        // corrected severities. No-op when verification is off.
+        const { cappedCount: exploitCapCount } = capSeverityByExploitability(rawResult);
+        if (exploitCapCount > 0 && !args.quiet) {
+            console.error(`[info] cognium-ai#214: capped ${exploitCapCount} finding(s) marked exploitable:false from critical/high to medium (originalSeverity preserved).`);
+        }
         // cognium-ai#203 defense-in-depth — probe on-disk supported-file count
         // when the engine reports 0 files scanned. Fires only on the failure
         // path (probe walk is skipped when totalFiles > 0), so happy-path cost

package/dist/cli/commands/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB;AACjB,uEAAuE;AACvE,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IAC7B,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;gBACxE,OAAO,CAAC,KAAK,CAAC,gBAAgB,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,qCAAqC,CAAC,CAAC;gBAC1H,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAElD,mEAAmE;IACnE,qEAAqE;IACrE,iEAAiE;IACjE,EAAE;IACF,gEAAgE;IAChE,8DAA8D;IAC9D,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,oCAAoC;IACpC,MAAM,gBAAgB,GAAG;QACvB,GAAG,GAAG,CAAC,OAAO;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB;KAC9B,CAAC;IAEF,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAClE,mEAAmE;IACnE,+BAA+B;IAC/B,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAErF,2DAA2D;IAC3D,oEAAoE;IACpE,iEAAiE;IACjE,6DAA6D;IAC7D,qEAAqE;IACrE,6DAA6D;IAC7D,gEAAgE;IAChE,oEAAoE;IACpE,iCAAiC;IACjC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,cAAc,GAClB,sBAAsB,IAAI,gCAAgC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxF,MAAM,oBAAoB,GACxB,sBAAsB,KAAK,SAAS;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,cAAc,KAAK,SAAS;YAC5B,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,SAAS,CAAC;IAElB,MAAM,OAAO,GAAyB;QACpC,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAwB;QACrK,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,UAAU;QACrB,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;QACpB,aAAa,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACpC,WAAW,EAAE,GAAG,CAAC,QAAQ;QACzB,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACjE,eAAe,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QAC3E,kEAAkE;QAClE,6DAA6D;QAC7D,iEAAiE;QACjE,cAAc,EAAE,cAA+C;QAC/D,6DAA6D;QAC7D,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,gEAAgE;QAChE,cAAc,EAAE,cAA+C;QAC/D,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;KACF,CAAC;IAEF,IAAI,CAAC;QACH,kEAAkE;QAClE,sDAAsD;QACtD,oBAAoB,EAAE,CAAC;QAEvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,uBAAuB,EAAE,CAAC;QAElD,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,0BAA0B;QAC1B,qBAAqB,CACnB,UAAU,EACV;YACE,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAoC,CAAC,CAAC,CAAC,CAAC,SAAS;SACnF,EACD,SAAS,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,EAClC,IAAI,CACL,CAAC;QAEF,qEAAqE;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,iEAAiE;QACjE,8DAA8D;QAC9D,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CACX,0BAA0B,eAAe,uIAAuI,CACjL,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,kEAAkE;QAClE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAClD,SAAS,EACT,GAAG,CAAC,IAAI,CAAC,yBAAyB,CACnC,CAAC;QACF,mDAAmD;QACnD,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,wDAAwD;QACxD,IAAI,QAAQ,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CACX,8BAA8B,QAAQ,CAAC,GAAG,eAAe,QAAQ,CAAC,eAAe,oBAAoB,QAAQ,CAAC,iBAAiB,gDAAgD,QAAQ,CAAC,uBAAuB,wDAAwD,CACxQ,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,cAAc,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,eAAe,+BAA+B,QAAQ,CAAC,iBAAiB,kCAAkC,QAAQ,CAAC,uBAAuB,IAAI,CACvL,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,oEAAoE;YACpE,oEAAoE;YACpE,qCAAqC;YACrC,kEAAkE;YAClE,qDAAqD;YACrD,MAAM,UAAU,GAAG;gBACjB,GAAG,MAAM;gBACT,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;gBAC3C,YAAY,EAAE,QAAQ;gBACtB,8DAA8D;gBAC9D,+DAA+D;gBAC/D,eAAe;gBACf,8DAA8D;gBAC9D,6DAA6D;gBAC7D,8DAA8D;gBAC9D,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,4DAA4D;YAC5D,6DAA6D;YAC7D,yDAAyD;YACzD,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB;AACjB,uEAAuE;AACvE,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IAC7B,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;gBACxE,OAAO,CAAC,KAAK,CAAC,gBAAgB,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,qCAAqC,CAAC,CAAC;gBAC1H,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAElD,mEAAmE;IACnE,qEAAqE;IACrE,iEAAiE;IACjE,EAAE;IACF,gEAAgE;IAChE,8DAA8D;IAC9D,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,oCAAoC;IACpC,MAAM,gBAAgB,GAAG;QACvB,GAAG,GAAG,CAAC,OAAO;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB;KAC9B,CAAC;IAEF,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAClE,mEAAmE;IACnE,+BAA+B;IAC/B,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAErF,2DAA2D;IAC3D,oEAAoE;IACpE,iEAAiE;IACjE,6DAA6D;IAC7D,qEAAqE;IACrE,6DAA6D;IAC7D,gEAAgE;IAChE,oEAAoE;IACpE,iCAAiC;IACjC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,cAAc,GAClB,sBAAsB,IAAI,gCAAgC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxF,MAAM,oBAAoB,GACxB,sBAAsB,KAAK,SAAS;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,cAAc,KAAK,SAAS;YAC5B,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,SAAS,CAAC;IAElB,MAAM,OAAO,GAAyB;QACpC,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAwB;QACrK,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,UAAU;QACrB,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;QACpB,aAAa,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACpC,WAAW,EAAE,GAAG,CAAC,QAAQ;QACzB,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACjE,eAAe,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QAC3E,kEAAkE;QAClE,6DAA6D;QAC7D,iEAAiE;QACjE,cAAc,EAAE,cAA+C;QAC/D,6DAA6D;QAC7D,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,gEAAgE;QAChE,cAAc,EAAE,cAA+C;QAC/D,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;KACF,CAAC;IAEF,IAAI,CAAC;QACH,kEAAkE;QAClE,sDAAsD;QACtD,oBAAoB,EAAE,CAAC;QAEvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,uBAAuB,EAAE,CAAC;QAElD,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,eAAe,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CACX,iCAAiC,eAAe,iGAAiG,CAClJ,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,0BAA0B;QAC1B,qBAAqB,CACnB,UAAU,EACV;YACE,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAoC,CAAC,CAAC,CAAC,CAAC,SAAS;SACnF,EACD,SAAS,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,EAClC,IAAI,CACL,CAAC;QAEF,qEAAqE;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,iEAAiE;QACjE,8DAA8D;QAC9D,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CACX,0BAA0B,eAAe,uIAAuI,CACjL,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,kEAAkE;QAClE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAClD,SAAS,EACT,GAAG,CAAC,IAAI,CAAC,yBAAyB,CACnC,CAAC;QACF,mDAAmD;QACnD,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,wDAAwD;QACxD,IAAI,QAAQ,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CACX,8BAA8B,QAAQ,CAAC,GAAG,eAAe,QAAQ,CAAC,eAAe,oBAAoB,QAAQ,CAAC,iBAAiB,gDAAgD,QAAQ,CAAC,uBAAuB,wDAAwD,CACxQ,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,cAAc,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,eAAe,+BAA+B,QAAQ,CAAC,iBAAiB,kCAAkC,QAAQ,CAAC,uBAAuB,IAAI,CACvL,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,oEAAoE;YACpE,oEAAoE;YACpE,qCAAqC;YACrC,kEAAkE;YAClE,qDAAqD;YACrD,MAAM,UAAU,GAAG;gBACjB,GAAG,MAAM;gBACT,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;gBAC3C,YAAY,EAAE,QAAQ;gBACtB,8DAA8D;gBAC9D,+DAA+D;gBAC/D,eAAe;gBACf,8DAA8D;gBAC9D,6DAA6D;gBAC7D,8DAA8D;gBAC9D,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,4DAA4D;YAC5D,6DAA6D;YAC7D,yDAAyD;YACzD,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/cli/severity-policy.d.ts

@@ -0,0 +1,48 @@
+/**
+ * cognium-ai#214 — cap severity by exploitability.
+ *
+ * The engine's LLM verifier sets `exploitable: false` on findings it
+ * judges non-exploitable (un-hardened XXE factories with no proven
+ * untrusted parse, resource leaks, config-key-name "credentials", …).
+ * Left at their rule severity, these sit in the Critical/High tier and
+ * inflate the C+H count with the engine's own known-non-exploitable set
+ * (77 of 596 on the 2026-07 tier-2 sweep).
+ *
+ * A finding the engine calls non-exploitable is an advisory, not a
+ * gate-blocker: cap it at `medium` so it stays visible (and reachable
+ * via `--severity medium`) but out of Critical/High. The original rule
+ * severity is preserved in `originalSeverity` (additive) so consumers
+ * that want the raw value can restore it — mirrors the ADR-008
+ * `original_severity` pattern.
+ *
+ * Applied at the CLI/output layer (severity is presentation), before the
+ * findings-cap, so the cap operates on corrected severities.
+ */
+/** Minimal structural shape we touch — kept loose so the engine's
+ *  `ScanFinding` / `ScanResult` types satisfy it without an index sig. */
+interface CappableFinding {
+    severity?: string;
+    exploitable?: boolean;
+    originalSeverity?: string;
+}
+interface CappableResult {
+    findings?: CappableFinding[];
+    summary?: {
+        bySeverity?: Record<string, number>;
+    };
+}
+/**
+ * Downgrade `exploitable: false` findings that are ranked critical/high
+ * to `medium`, stamping `originalSeverity`. Recomputes
+ * `summary.bySeverity` so counts stay consistent. Returns the (mutated)
+ * result and the number of findings capped.
+ *
+ * No-op for findings that are already ≤ medium, exploitable, or have no
+ * `exploitable` flag — so a scan with verification off (no exploitable
+ * field) is byte-identical.
+ */
+export declare function capSeverityByExploitability(result: CappableResult): {
+    cappedCount: number;
+};
+export {};
+//# sourceMappingURL=severity-policy.d.ts.map

package/dist/cli/severity-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-policy.d.ts","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;0EAC0E;AAC1E,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AACD,UAAU,cAAc;IACtB,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACnD;AAID;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,GACrB;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAkCzB"}

package/dist/cli/severity-policy.js

@@ -0,0 +1,63 @@
+/**
+ * cognium-ai#214 — cap severity by exploitability.
+ *
+ * The engine's LLM verifier sets `exploitable: false` on findings it
+ * judges non-exploitable (un-hardened XXE factories with no proven
+ * untrusted parse, resource leaks, config-key-name "credentials", …).
+ * Left at their rule severity, these sit in the Critical/High tier and
+ * inflate the C+H count with the engine's own known-non-exploitable set
+ * (77 of 596 on the 2026-07 tier-2 sweep).
+ *
+ * A finding the engine calls non-exploitable is an advisory, not a
+ * gate-blocker: cap it at `medium` so it stays visible (and reachable
+ * via `--severity medium`) but out of Critical/High. The original rule
+ * severity is preserved in `originalSeverity` (additive) so consumers
+ * that want the raw value can restore it — mirrors the ADR-008
+ * `original_severity` pattern.
+ *
+ * Applied at the CLI/output layer (severity is presentation), before the
+ * findings-cap, so the cap operates on corrected severities.
+ */
+const CAP_TO = 'medium';
+/**
+ * Downgrade `exploitable: false` findings that are ranked critical/high
+ * to `medium`, stamping `originalSeverity`. Recomputes
+ * `summary.bySeverity` so counts stay consistent. Returns the (mutated)
+ * result and the number of findings capped.
+ *
+ * No-op for findings that are already ≤ medium, exploitable, or have no
+ * `exploitable` flag — so a scan with verification off (no exploitable
+ * field) is byte-identical.
+ */
+export function capSeverityByExploitability(result) {
+    const findings = result.findings;
+    if (!Array.isArray(findings) || findings.length === 0) {
+        return { cappedCount: 0 };
+    }
+    let cappedCount = 0;
+    for (const f of findings) {
+        if (f.exploitable === false &&
+            (f.severity === 'critical' || f.severity === 'high') &&
+            f.originalSeverity === undefined) {
+            f.originalSeverity = f.severity;
+            f.severity = CAP_TO;
+            cappedCount++;
+        }
+    }
+    if (cappedCount > 0 && result.summary) {
+        const bySeverity = {
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0,
+        };
+        for (const f of findings) {
+            const s = f.severity;
+            if (s && s in bySeverity)
+                bySeverity[s]++;
+        }
+        result.summary.bySeverity = bySeverity;
+    }
+    return { cappedCount };
+}
+//# sourceMappingURL=severity-policy.js.map

package/dist/cli/severity-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-policy.js","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAcH,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IACE,CAAC,CAAC,WAAW,KAAK,KAAK;YACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;YACpD,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAChC,CAAC;YACD,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC;YACpB,WAAW,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,UAAU,GAA2B;YACzC,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,GAAG,EAAE,CAAC;SACP,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU;gBAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IACzC,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-ai",
-  "version": "2.36.1",
+  "version": "2.38.0",
   "description": "AI-powered static analysis CLI with LLM-enhanced vulnerability detection",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -42,8 +42,8 @@
   ],
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "3.166.0",
-    "circle-ir-ai": "^2.40.1",
+    "circle-ir": "3.168.0",
+    "circle-ir-ai": "^2.41.0",
     "commander": "^14.0.3",
     "minimatch": "^10.2.5"
   },