cognium-dev 3.104.0 → 3.106.0

package/dist/cli.js

@@ -4,8 +4,8 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/cli.ts
 import { readFileSync, existsSync } from "fs";
-import { stat, readdir } from "fs/promises";
-import { join, dirname as dirname2, extname, resolve, relative } from "path";
+import { stat as stat2, readdir as readdir2 } from "fs/promises";
+import { join as join2, dirname as dirname2, extname, resolve, relative as relative3 } from "path";
 import { createRequire as createRequire2 } from "module";
 
 // ../../node_modules/web-tree-sitter/web-tree-sitter.js
@@ -18060,6 +18060,85 @@ function isHighConfidence(finding) {
   return finding.confidence === undefined || finding.confidence === "high";
 }
 
+// ../circle-ir/dist/analysis/library-api-surface-downgrade.js
+var LIBRARY_API_SURFACE_TAG = "library-api-surface:caller-responsibility";
+function applyLibraryApiSurfaceDowngrade(findings) {
+  return findings.map((f) => {
+    if (!f.tags?.includes(LIBRARY_API_SURFACE_TAG))
+      return f;
+    if (f.severity === "medium" || f.severity === "low")
+      return f;
+    return {
+      ...f,
+      original_severity: f.severity,
+      severity: "medium",
+      level: "warning"
+    };
+  });
+}
+
+// ../circle-ir/dist/analysis/project-profile-transform.js
+var DOWNGRADE_ELIGIBLE_RULE_IDS = new Set([
+  "code_injection",
+  "template_injection",
+  "xpath_injection",
+  "sql_injection"
+]);
+function libraryDowngrade(severity) {
+  switch (severity) {
+    case "critical":
+      return { severity: "medium", level: "warning" };
+    case "high":
+      return { severity: "low", level: "note" };
+    case "medium":
+      return { severity: "low", level: "note" };
+    case "low":
+      return { severity: "low", level: "note" };
+  }
+}
+function levelForSeverity(severity) {
+  switch (severity) {
+    case "critical":
+      return "error";
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    case "low":
+      return "note";
+  }
+}
+function applyProjectProfileTransform(findings, resolveProfile) {
+  return findings.map((f) => {
+    if (!f.tags?.includes(LIBRARY_API_SURFACE_TAG))
+      return f;
+    const profile = resolveProfile(f.file);
+    if (profile === "unknown")
+      return f;
+    const shape = profile.split("/")[0];
+    if (shape === "library") {
+      if (!DOWNGRADE_ELIGIBLE_RULE_IDS.has(f.rule_id))
+        return f;
+      const { severity, level } = libraryDowngrade(f.severity);
+      if (severity === f.severity && level === f.level)
+        return f;
+      return { ...f, severity, level };
+    }
+    if (shape === "application") {
+      if (!f.original_severity)
+        return f;
+      if (f.original_severity === f.severity)
+        return f;
+      return {
+        ...f,
+        severity: f.original_severity,
+        level: levelForSeverity(f.original_severity)
+      };
+    }
+    return f;
+  });
+}
+
 // ../circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
@@ -23545,6 +23624,39 @@ var PROTOCOL_CLIENT_PACKAGES = [
 var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
 var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
 var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b/;
+var JEXL_ENGINE_TYPES = new Set(["JexlEngine", "Jexl", "JxltEngine"]);
+var JEXL_EXPRESSION_TYPE_RE = /(?:Jexl)?(?:Expression|Script|Template)(?:Script)?$/;
+var TEMPLATE_COMPILE_RECEIVER_TYPES = new Set([
+  "Handlebars",
+  "Mustache",
+  "MustacheFactory",
+  "DefaultMustacheFactory",
+  "Pebble",
+  "PebbleEngine",
+  "PebbleEngineBuilder",
+  "VelocityEngine",
+  "Velocity",
+  "Configuration",
+  "Freemarker",
+  "FreeMarker",
+  "TemplateEngine",
+  "SpringTemplateEngine",
+  "Thymeleaf"
+]);
+var SPI_GET_RESOURCES_RE = /\.getResources\s*\(\s*["'][^"']*META-INF\/services\/[^"']*["']\s*\)/;
+var CLASSLOADER_PARENT_TYPES = new Set([
+  "ClassLoader",
+  "URLClassLoader",
+  "SecureClassLoader"
+]);
+var CLASSLOADER_NAME_RE = /(?:CachingProvider|ClassLoader|SpiLoader)$/;
+var LOADCLASS_OVERRIDE_METHOD_RE = /\b(?:public|protected)\s+(?:[\w<>?,\s]+\s+)?(?:loadClass|findClass)\s*\(\s*String\b/;
+var JAVA_CLASS_DECL_RE = /\bclass\s+([A-Z]\w*)\b(?:\s+extends\s+([A-Z][\w.]*))?(?:\s+implements\s+([A-Z][\w.,<>\s?]*))?/;
+var SQL_BUILDER_CLASS_RE = /(?:Dialect|SqlBuilder|Quoter|Wrapper|SqlGenerator|QueryBuilder)$/;
+var SQL_BUILDER_WRAPPER_CALL_RE = /\.(?:wrap|quote|escape|identifier)\s*\(/;
+var SQL_EXTRACTION_RETURN_RE = /^(?:String|CharSequence|Optional\s*<\s*String\s*>)$/;
+var SQL_EXTRACTION_NAME_RE = /^(?:get|extract|build).*(?:[Ss]ql|[Qq]uery)|^toSql|.*Statement.*ToString$|.*Query.*String$/;
+var SQL_EXTRACTION_PRIMITIVE_INPUT_RE = /^(?:String|CharSequence)$/;
 function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
     return null;
@@ -23561,6 +23673,48 @@ function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
   }
   return null;
 }
+function findEnclosingClassDecl(sinkLine, sourceLines) {
+  const end = Math.min(sourceLines.length, sinkLine);
+  for (let i2 = end - 1;i2 >= 0; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(JAVA_CLASS_DECL_RE);
+    if (!m)
+      continue;
+    const implementsTypes = m[3] ? m[3].split(",").map((s) => s.replace(/<[^>]*>/g, "").trim()).filter(Boolean).map((s) => {
+      const parts2 = s.split(".");
+      return parts2[parts2.length - 1] ?? s;
+    }) : [];
+    const extendsRaw = m[2] ?? null;
+    const extendsType = extendsRaw ? (() => {
+      const p = extendsRaw.split(".");
+      return p[p.length - 1] ?? extendsRaw;
+    })() : null;
+    return { name: m[1], extendsType, implementsTypes };
+  }
+  return null;
+}
+function isInsideLoadClassOverride(sinkLine, sourceLines) {
+  const limit = Math.max(0, sinkLine - 200);
+  for (let i2 = sinkLine - 2;i2 >= limit; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    if (LOADCLASS_OVERRIDE_METHOD_RE.test(ln))
+      return true;
+    if (/\bclass\s+[A-Z]\w*\b/.test(ln))
+      return false;
+  }
+  return false;
+}
+function findEnclosingMethodFromIr(types, sinkLine) {
+  for (const t of types) {
+    if (sinkLine < t.start_line || sinkLine > t.end_line)
+      continue;
+    for (const m of t.methods) {
+      if (sinkLine >= m.start_line && sinkLine <= m.end_line)
+        return m;
+    }
+  }
+  return null;
+}
 function isJavaLiteralOrAnnotationAccessor(expr) {
   const e = expr.trim();
   if (e === "")
@@ -23842,6 +23996,168 @@ class SinkFilterPass {
         return true;
       });
     }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      for (const sink of filtered) {
+        if (sink.type !== "code_injection")
+          continue;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
+        const receiver = receiverMatch?.[1];
+        const method = sink.method ?? receiverMatch?.[2];
+        let shouldTag = false;
+        if (method === "createExpression" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && JEXL_ENGINE_TYPES.has(recvType))
+            shouldTag = true;
+        }
+        if (!shouldTag && method === "evaluate" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && JEXL_EXPRESSION_TYPE_RE.test(recvType))
+            shouldTag = true;
+        }
+        if (!shouldTag && method === "compile" && receiver) {
+          const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
+          if (recvType && TEMPLATE_COMPILE_RECEIVER_TYPES.has(recvType))
+            shouldTag = true;
+        }
+        if (!shouldTag && method === "forName") {
+          const start2 = Math.max(0, sink.line - 31);
+          const end = Math.min(sourceLines.length, sink.line + 30);
+          for (let i2 = start2;i2 < end; i2++) {
+            if (SPI_GET_RESOURCES_RE.test(sourceLines[i2] ?? "")) {
+              shouldTag = true;
+              break;
+            }
+          }
+        }
+        if (!shouldTag && method && (method === "loadClass" || method === "findClass" || method === "forName")) {
+          const enclosing = findEnclosingClassDecl(sink.line, sourceLines);
+          if (enclosing) {
+            const extendsClassLoader = enclosing.extendsType !== null && CLASSLOADER_PARENT_TYPES.has(enclosing.extendsType);
+            const implementsSpi = enclosing.implementsTypes.some((t) => /CachingProvider$/.test(t));
+            const nameLooksLikeLoader = CLASSLOADER_NAME_RE.test(enclosing.name);
+            if (extendsClassLoader || implementsSpi || nameLooksLikeLoader)
+              shouldTag = true;
+          }
+          if (!shouldTag && isInsideLoadClassOverride(sink.line, sourceLines)) {
+            shouldTag = true;
+          }
+        }
+        if (shouldTag) {
+          const existing = sink.tags ?? [];
+          if (!existing.includes(LIBRARY_API_SURFACE_TAG)) {
+            sink.tags = [...existing, LIBRARY_API_SURFACE_TAG];
+          }
+        }
+      }
+    }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "code_injection")
+          return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
+        const receiver = receiverMatch?.[1];
+        if (!receiver)
+          return true;
+        const start2 = Math.max(0, sink.line - 200);
+        let arrayName = null;
+        const foreachRe = new RegExp(`\\bfor\\s*\\(\\s*\\w[\\w<>?]*\\s+${receiver}\\s*:\\s*(\\w+)\\b`);
+        for (let i2 = sink.line - 1;i2 >= start2; i2--) {
+          const ln = sourceLines[i2] ?? "";
+          const fm = ln.match(foreachRe);
+          if (fm) {
+            arrayName = fm[1];
+            break;
+          }
+        }
+        if (!arrayName) {
+          const methodNameMatch = sinkLineText.match(/\.(\w+)\s*\(/);
+          const methodNameRe = methodNameMatch ? methodNameMatch[1] : "\\w+";
+          const idxRe = new RegExp(`\\b(\\w+)\\s*\\[[^\\]]+\\]\\s*\\.\\s*${methodNameRe}\\s*\\(`);
+          const im = sinkLineText.match(idxRe);
+          if (im)
+            arrayName = im[1];
+        }
+        if (!arrayName)
+          return true;
+        const declRe = new RegExp(`\\bprivate\\s+static\\s+final\\s+(?:[\\w<>?,\\s]+)\\[\\s*\\]\\s+${arrayName}\\s*=`);
+        let declStart = -1;
+        for (let i2 = 0;i2 < sink.line; i2++) {
+          if (declRe.test(sourceLines[i2] ?? "")) {
+            declStart = i2;
+            break;
+          }
+        }
+        if (declStart < 0)
+          return true;
+        let body2 = "";
+        for (let i2 = declStart;i2 < Math.min(sourceLines.length, declStart + 40); i2++) {
+          body2 += (sourceLines[i2] ?? "") + `
+`;
+          if (/\}\s*;/.test(sourceLines[i2] ?? ""))
+            break;
+        }
+        const initMatch = body2.match(/=\s*(?:new\s+[\w<>?,\s]+\[\s*\]\s*)?\{([\s\S]*?)\}\s*;/);
+        if (!initMatch)
+          return true;
+        const elements = initMatch[1].split(",").map((s) => s.trim()).filter(Boolean);
+        if (elements.length === 0)
+          return true;
+        const allNewLiterals = elements.every((e) => /^new\s+[A-Z]\w*\s*\([^)]*\)$/.test(e));
+        if (allNewLiterals)
+          return false;
+        return true;
+      });
+    }
+    if (language === "java") {
+      const sourceLines = ctx.code.split(`
+`);
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection")
+          return true;
+        const enclosing = findEnclosingClassDecl(sink.line, sourceLines);
+        if (!enclosing)
+          return true;
+        if (!SQL_BUILDER_CLASS_RE.test(enclosing.name))
+          return true;
+        const lo = Math.max(0, sink.line - 11);
+        const hi = Math.min(sourceLines.length, sink.line + 10);
+        for (let i2 = lo;i2 < hi; i2++) {
+          if (SQL_BUILDER_WRAPPER_CALL_RE.test(sourceLines[i2] ?? ""))
+            return false;
+        }
+        return true;
+      });
+    }
+    if (language === "java") {
+      const types = graph.ir.types ?? [];
+      if (types.length > 0) {
+        filtered = filtered.filter((sink) => {
+          if (sink.type !== "sql_injection")
+            return true;
+          const enclosing = findEnclosingMethodFromIr(types, sink.line);
+          if (!enclosing)
+            return true;
+          const ret = (enclosing.return_type ?? "").replace(/\s+/g, " ").trim();
+          if (!SQL_EXTRACTION_RETURN_RE.test(ret))
+            return true;
+          if (!SQL_EXTRACTION_NAME_RE.test(enclosing.name))
+            return true;
+          const firstParamType = enclosing.parameters[0]?.type ?? null;
+          if (firstParamType === null)
+            return true;
+          const simpleType = firstParamType.replace(/<[^>]*>/g, "").trim();
+          if (SQL_EXTRACTION_PRIMITIVE_INPUT_RE.test(simpleType))
+            return true;
+          return false;
+        });
+      }
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 }
@@ -34684,6 +35000,13 @@ function getNodeTypesForLanguage(language) {
       ]);
   }
 }
+function makeProfileResolver(p) {
+  if (p === undefined)
+    return () => "unknown";
+  if (typeof p === "string")
+    return () => p;
+  return (file) => p.get(file) ?? "unknown";
+}
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -34862,6 +35185,21 @@ async function analyze(code, filePath, language, options = {}) {
       flows: interProc.additionalFlows,
       interprocedural: interProc.interprocedural
     };
+    if (taint.flows && taint.flows.length > 0 && taint.sinks.length > 0) {
+      const sinkTagsByKey = new Map;
+      for (const s of taint.sinks) {
+        if (!s.tags || s.tags.length === 0)
+          continue;
+        sinkTagsByKey.set(`${s.line}:${s.type}`, s.tags);
+      }
+      if (sinkTagsByKey.size > 0) {
+        for (const f of taint.flows) {
+          const tags = sinkTagsByKey.get(`${f.sink_line}:${f.sink_type}`);
+          if (tags && !f.tags)
+            f.tags = [...tags];
+        }
+      }
+    }
     const unresolved = detectUnresolved(calls, types, dfg);
     const enriched = buildEnriched(types, calls, taint.sources, taint.sinks);
     const metricValues = new MetricRunner().run({ meta, types, calls, cfg, dfg, taint, imports, exports, unresolved, enriched }, code, language);
@@ -34874,7 +35212,9 @@ async function analyze(code, filePath, language, options = {}) {
     });
     emitFindingsInstrumentation(filePath, findings, taint);
     const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
-    const cappedFindings = applyPerFileFindingCap(filePath, verifiedFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
+    const downgradedFindings = applyLibraryApiSurfaceDowngrade(verifiedFindings);
+    const profiledFindings = applyProjectProfileTransform(downgradedFindings, makeProfileResolver(options.projectProfile));
+    const cappedFindings = applyPerFileFindingCap(filePath, profiledFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
       types,
@@ -35032,6 +35372,491 @@ function deriveProjectRoot(paths) {
   }
   return common.join("/") || "/";
 }
+// src/project-profile-detect/index.ts
+import { relative as relative2 } from "path";
+
+// src/project-profile-detect/walk.ts
+import { readdir, readFile, stat } from "fs/promises";
+import { join, relative } from "path";
+
+// src/project-profile-detect/maven-parse.ts
+var TAG = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "i");
+var ALL_TAGS = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "gi");
+function firstTag(xml, name2) {
+  const m = TAG(name2).exec(xml);
+  return m?.[1].trim();
+}
+function allTags(xml, name2) {
+  const out2 = [];
+  let m;
+  const re = ALL_TAGS(name2);
+  while ((m = re.exec(xml)) !== null)
+    out2.push(m[1].trim());
+  return out2;
+}
+var MAVEN_PLUGIN_MAP = {
+  "spring-boot-maven-plugin": "spring-boot",
+  "maven-plugin-plugin": "maven-plugin",
+  "maven-war-plugin": "war",
+  "maven-ear-plugin": "ear",
+  "maven-shade-plugin": "application",
+  "exec-maven-plugin": "application",
+  "maven-assembly-plugin": "application"
+};
+function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
+  const stripped = xml.replace(/<parent\b[\s\S]*?<\/parent>/i, "");
+  const groupId = firstTag(stripped, "groupId");
+  const artifactId = firstTag(stripped, "artifactId");
+  const version = firstTag(stripped, "version");
+  const packaging = firstTag(stripped, "packaging");
+  const buildBlock = firstTag(xml, "build") ?? "";
+  const pluginBlocks = allTags(buildBlock, "plugin");
+  const plugins = new Set;
+  for (const p of pluginBlocks) {
+    const aid = firstTag(p, "artifactId");
+    if (aid && MAVEN_PLUGIN_MAP[aid])
+      plugins.add(MAVEN_PLUGIN_MAP[aid]);
+  }
+  if (/<parent\b[\s\S]*?<artifactId>\s*spring-boot-starter-parent\s*<\/artifactId>/i.test(xml)) {
+    plugins.add("spring-boot");
+  }
+  if (packaging === "war")
+    plugins.add("war");
+  if (packaging === "ear")
+    plugins.add("ear");
+  if (packaging === "maven-plugin")
+    plugins.add("maven-plugin");
+  const distBlock = firstTag(xml, "distributionManagement") ?? "";
+  const urls = [
+    ...allTags(distBlock, "url")
+  ].map((u) => u.trim()).filter(Boolean);
+  const signals = {
+    ...directorySignals,
+    plugins: [...directorySignals.plugins, ...plugins],
+    packaging,
+    distributionUrls: [...directorySignals.distributionUrls, ...urls]
+  };
+  return {
+    root: moduleRoot,
+    buildSystem: "maven",
+    buildFile,
+    groupId,
+    artifactId,
+    version,
+    signals
+  };
+}
+
+// src/project-profile-detect/gradle-parse.ts
+var GRADLE_PLUGIN_MAP = {
+  "org.springframework.boot": "spring-boot",
+  "io.spring.dependency-management": "spring-boot",
+  "java-library": "java-library",
+  application: "application",
+  war: "war",
+  ear: "ear",
+  "maven-publish": "maven-publish",
+  "java-gradle-plugin": "gradle-plugin",
+  "com.gradle.plugin-publish": "gradle-plugin"
+};
+var PLUGIN_ID_RE = /\bid\s*[(\s]\s*['"]([^'"]+)['"]/g;
+var APPLY_PLUGIN_RE = /\bapply\s+plugin\s*:\s*['"]([^'"]+)['"]/g;
+var GROUP_RE = /\bgroup\s*[=(]\s*['"]([^'"]+)['"]/;
+var VERSION_RE = /\bversion\s*[=(]\s*['"]([^'"]+)['"]/;
+var URL_RE = /\burl\s*[=(]?\s*(?:uri\s*\(\s*)?['"]([^'"]+)['"]/g;
+function parsePlugins(text) {
+  const ids = new Set;
+  let m;
+  PLUGIN_ID_RE.lastIndex = 0;
+  while ((m = PLUGIN_ID_RE.exec(text)) !== null)
+    ids.add(m[1]);
+  APPLY_PLUGIN_RE.lastIndex = 0;
+  while ((m = APPLY_PLUGIN_RE.exec(text)) !== null)
+    ids.add(m[1]);
+  const out2 = new Set;
+  for (const id of ids) {
+    const tag = GRADLE_PLUGIN_MAP[id];
+    if (tag)
+      out2.add(tag);
+  }
+  return out2;
+}
+function parseUrls(text) {
+  const out2 = [];
+  let m;
+  URL_RE.lastIndex = 0;
+  while ((m = URL_RE.exec(text)) !== null)
+    out2.push(m[1]);
+  return out2;
+}
+function parseGradleBuild(text, moduleRoot, buildFile, buildSystem, directorySignals) {
+  const cleaned = text.replace(/\/\*[\s\S]*?\*\//g, "");
+  const pluginsSet = parsePlugins(cleaned);
+  const urls = parseUrls(cleaned);
+  const groupId = GROUP_RE.exec(cleaned)?.[1];
+  const version = VERSION_RE.exec(cleaned)?.[1];
+  const artifactId = moduleRoot.split(/[\\/]/).filter(Boolean).pop();
+  const signals = {
+    ...directorySignals,
+    plugins: [...directorySignals.plugins, ...pluginsSet],
+    distributionUrls: [...directorySignals.distributionUrls, ...urls]
+  };
+  return {
+    root: moduleRoot,
+    buildSystem,
+    buildFile,
+    groupId,
+    artifactId,
+    version,
+    signals
+  };
+}
+
+// src/project-profile-detect/walk.ts
+var BUILD_FILES = ["pom.xml", "build.gradle", "build.gradle.kts"];
+var SKIP_DIRS = new Set([
+  "node_modules",
+  ".git",
+  ".svn",
+  ".hg",
+  "target",
+  "build",
+  "out",
+  "dist",
+  ".gradle",
+  ".idea",
+  ".vscode",
+  "bin",
+  "obj"
+]);
+async function discoverBuildModules(scanRoot) {
+  const modules = [];
+  await walk(scanRoot, modules);
+  return modules;
+}
+async function walk(dir, out2) {
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return;
+  }
+  const buildFile = entries.find((e) => BUILD_FILES.includes(e));
+  if (buildFile) {
+    const buildFilePath = join(dir, buildFile);
+    const buildSystem = buildFile === "pom.xml" ? "maven" : buildFile === "build.gradle.kts" ? "gradle-kts" : "gradle";
+    const signals = await collectDirectorySignals(dir);
+    let mod;
+    try {
+      const raw = await readFile(buildFilePath, "utf-8");
+      mod = buildSystem === "maven" ? parseMavenPom(raw, dir, buildFilePath, signals) : parseGradleBuild(raw, dir, buildFilePath, buildSystem, signals);
+    } catch {
+      mod = { root: dir, buildSystem, buildFile: buildFilePath, signals };
+    }
+    out2.push(mod);
+  }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry) || entry.startsWith("."))
+      continue;
+    const full = join(dir, entry);
+    let s;
+    try {
+      s = await stat(full);
+    } catch {
+      continue;
+    }
+    if (s.isDirectory()) {
+      await walk(full, out2);
+    }
+  }
+}
+async function collectDirectorySignals(moduleRoot) {
+  const signals = {
+    plugins: [],
+    distributionUrls: [],
+    hasJpmsModuleInfo: false,
+    hasSpiServices: false,
+    hasMainMethod: false
+  };
+  const javaRoot = join(moduleRoot, "src", "main", "java");
+  const resourcesRoot = join(moduleRoot, "src", "main", "resources");
+  try {
+    await stat(join(javaRoot, "module-info.java"));
+    signals.hasJpmsModuleInfo = true;
+  } catch {}
+  try {
+    const s = await stat(join(resourcesRoot, "META-INF", "services"));
+    if (s.isDirectory())
+      signals.hasSpiServices = true;
+  } catch {}
+  try {
+    signals.hasMainMethod = await scanForMainMethod(javaRoot, 200);
+  } catch {}
+  return signals;
+}
+var MAIN_METHOD_RE = /\bpublic\s+static\s+void\s+main\s*\(\s*(?:final\s+)?String\s*(?:\[\s*\]|\.{3})/;
+async function scanForMainMethod(root, maxFiles) {
+  let visited = 0;
+  const stack = [root];
+  while (stack.length > 0 && visited < maxFiles) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = await readdir(dir);
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      const full = join(dir, e);
+      let s;
+      try {
+        s = await stat(full);
+      } catch {
+        continue;
+      }
+      if (s.isDirectory()) {
+        stack.push(full);
+      } else if (s.isFile() && e.endsWith(".java")) {
+        visited++;
+        try {
+          const text = await readFile(full, "utf-8");
+          if (MAIN_METHOD_RE.test(text))
+            return true;
+        } catch {}
+        if (visited >= maxFiles)
+          break;
+      }
+    }
+  }
+  return false;
+}
+async function enumerateScanFiles(scanRoot) {
+  const out2 = [];
+  await enumerate(scanRoot, out2);
+  return out2;
+}
+async function enumerate(dir, out2) {
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (SKIP_DIRS.has(e) || e.startsWith("."))
+      continue;
+    const full = join(dir, e);
+    let s;
+    try {
+      s = await stat(full);
+    } catch {
+      continue;
+    }
+    if (s.isDirectory()) {
+      await enumerate(full, out2);
+    } else if (s.isFile()) {
+      out2.push(full);
+    }
+  }
+}
+function ownerOf(file, modules) {
+  let best;
+  let bestLen = -1;
+  for (const m of modules) {
+    if (file === m.root || file.startsWith(m.root + "/")) {
+      if (m.root.length > bestLen) {
+        best = m;
+        bestLen = m.root.length;
+      }
+    }
+  }
+  return best;
+}
+
+// src/project-profile-detect/publication-detect.ts
+var PUBLIC_REGISTRY_HOSTS = new Set([
+  "repo.maven.apache.org",
+  "repo1.maven.org",
+  "oss.sonatype.org",
+  "s01.oss.sonatype.org",
+  "central.sonatype.com",
+  "central.sonatype.org",
+  "plugins.gradle.org",
+  "jcenter.bintray.com"
+]);
+function isPubliclyPublished(urls) {
+  for (const u of urls) {
+    let host;
+    try {
+      host = new URL(u).hostname.toLowerCase();
+    } catch {
+      continue;
+    }
+    if (PUBLIC_REGISTRY_HOSTS.has(host))
+      return true;
+  }
+  return false;
+}
+
+// src/project-profile-detect/shape-resolve.ts
+function resolveShape(mod) {
+  const sig = mod.signals;
+  const has = (tag) => sig.plugins.includes(tag);
+  const reasons = [];
+  if (has("spring-boot")) {
+    reasons.push("spring-boot plugin");
+    return { shape: "server", reasons };
+  }
+  if (has("war") || has("ear")) {
+    reasons.push(has("war") ? "war packaging" : "ear packaging");
+    return { shape: "server", reasons };
+  }
+  if (has("maven-plugin") || has("gradle-plugin")) {
+    reasons.push(has("maven-plugin") ? "maven-plugin packaging" : "gradle-plugin id");
+    return { shape: "plugin", reasons };
+  }
+  if (has("application")) {
+    reasons.push("application plugin");
+    return { shape: "cli", reasons };
+  }
+  if (sig.hasMainMethod) {
+    reasons.push("main(String[]) found");
+    return { shape: "application", reasons };
+  }
+  const libSignals = [];
+  if (has("java-library"))
+    libSignals.push("java-library plugin");
+  if (sig.hasJpmsModuleInfo)
+    libSignals.push("JPMS module-info.java");
+  if (sig.hasSpiServices)
+    libSignals.push("META-INF/services SPI");
+  if (libSignals.length > 0) {
+    const published = isPubliclyPublished(sig.distributionUrls);
+    if (published) {
+      reasons.push(...libSignals, "public-registry distribution");
+      return { shape: "library", reasons };
+    }
+    reasons.push(...libSignals, "no public-registry distribution (internal helper)");
+    return { shape: "application", reasons };
+  }
+  reasons.push("no shape signals");
+  return { shape: "unknown", reasons };
+}
+
+// src/project-profile-detect/env-resolve.ts
+var TEST_RE = /(?:^|\/)tests?\//;
+var SAMPLE_RE = /(?:^|\/)(?:samples?|examples?|demos?|fixtures?)\//;
+var BENCHMARK_RE = /(?:^|\/)benchmarks?\//;
+var PROD_RE = /(?:^|\/)src\/main\//;
+function resolveEnv(absoluteFile) {
+  const f = absoluteFile.replace(/\\/g, "/").toLowerCase();
+  if (TEST_RE.test(f))
+    return "test";
+  if (BENCHMARK_RE.test(f))
+    return "benchmark";
+  if (SAMPLE_RE.test(f))
+    return "sample";
+  if (PROD_RE.test(f))
+    return "production";
+  return "dev";
+}
+
+// src/project-profile-detect/overrides.ts
+function compileGlob(glob) {
+  let re = "";
+  let i2 = 0;
+  while (i2 < glob.length) {
+    const c = glob[i2];
+    if (c === "*") {
+      if (glob[i2 + 1] === "*") {
+        re += ".*";
+        i2 += 2;
+        if (glob[i2] === "/")
+          i2++;
+      } else {
+        re += "[^/]*";
+        i2++;
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+      i2++;
+    } else if (/[.+^${}()|[\]\\]/.test(c)) {
+      re += "\\" + c;
+      i2++;
+    } else {
+      re += c;
+      i2++;
+    }
+  }
+  return new RegExp("^" + re + "$");
+}
+function compileOverrides(overrides) {
+  if (!overrides)
+    return [];
+  return Object.entries(overrides).map(([glob, profile]) => ({
+    re: compileGlob(glob),
+    profile,
+    glob
+  }));
+}
+function applyOverrides(relativePath, compiled) {
+  const p = relativePath.replace(/\\/g, "/");
+  for (const { re, profile, glob } of compiled) {
+    if (re.test(p))
+      return { profile, glob };
+  }
+  return;
+}
+
+// src/project-profile-detect/index.ts
+async function detectProjectProfiles(scanRoot, options = {}) {
+  const modules = await discoverBuildModules(scanRoot);
+  const files = await enumerateScanFiles(scanRoot);
+  const compiledOverrides = compileOverrides(options.overrides);
+  const resolvedByRoot = new Map;
+  const resolvedModules = [];
+  for (const m of modules) {
+    const sr = resolveShape(m);
+    const moduleEnv = resolveEnv(m.root);
+    const profile = sr.shape === "unknown" ? "unknown" : `${sr.shape}/${moduleEnv}`;
+    const r = { module: m, profile, reasons: sr.reasons };
+    resolvedByRoot.set(m.root, r);
+    resolvedModules.push(r);
+  }
+  const profileByFile = new Map;
+  const unknownFiles = [];
+  for (const file of files) {
+    const rel = relative2(scanRoot, file);
+    const ov = applyOverrides(rel, compiledOverrides);
+    if (ov) {
+      profileByFile.set(file, ov.profile);
+      continue;
+    }
+    if (options.forcedProfile && options.forcedProfile !== "unknown") {
+      const [shape2] = options.forcedProfile.split("/");
+      const env2 = resolveEnv(file);
+      profileByFile.set(file, `${shape2}/${env2}`);
+      continue;
+    }
+    const owner = ownerOf(file, modules);
+    if (!owner) {
+      profileByFile.set(file, "unknown");
+      unknownFiles.push(file);
+      continue;
+    }
+    const ownerResolution = resolvedByRoot.get(owner.root);
+    if (!ownerResolution || ownerResolution.profile === "unknown") {
+      profileByFile.set(file, "unknown");
+      unknownFiles.push(file);
+      continue;
+    }
+    const [shape] = ownerResolution.profile.split("/");
+    const env = resolveEnv(file);
+    profileByFile.set(file, `${shape}/${env}`);
+  }
+  return { profileByFile, modules: resolvedModules, unknownFiles };
+}
+
 // src/utils/colors.ts
 var RESET = "\x1B[0m";
 var BOLD = "\x1B[1m";
@@ -35053,9 +35878,17 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.104.0";
+var version = "3.106.0";
 
 // src/formatters.ts
+var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
+function applyTagSeverityDowngrade(severity, tags) {
+  if (!tags || !tags.includes(LIBRARY_API_SURFACE_TAG2))
+    return severity;
+  if (severity === "critical" || severity === "high")
+    return "medium";
+  return severity;
+}
 var SINK_SEVERITY = {
   sql_injection: "critical",
   nosql_injection: "high",
@@ -35377,8 +36210,22 @@ function formatCrossFilePaths(taintPaths) {
   return lines.join(`
 `);
 }
-function formatResults(results, verbose, crossFileData) {
+function formatResults(results, verbose, crossFileData, profileSummary) {
   const lines = [];
+  if (profileSummary && profileSummary.modules.length > 0) {
+    lines.push(colors.bold("Project profile"));
+    for (const m of profileSummary.modules) {
+      const tag = m.root === "" || m.root === "." ? "." : m.root;
+      lines.push(`  ${colors.cyan(tag)}  →  ${colors.bold(m.profile)}`);
+      if (verbose) {
+        lines.push(`     reasons: ${m.reasons.join(" → ")}`);
+      }
+    }
+    if (profileSummary.unknownFileCount > 0) {
+      lines.push(colors.dim(`  ${profileSummary.unknownFileCount} file(s) outside any module → unknown`));
+    }
+    lines.push("");
+  }
   for (const result of results) {
     if (result.error) {
       lines.push(colors.red(`[ERROR] ${result.file}: ${result.error}`));
@@ -35397,7 +36244,8 @@ function formatResults(results, verbose, crossFileData) {
       const cweTag = vuln.cwe ? ` [${vuln.cwe}]` : "";
       const severityUpper = vuln.severity.charAt(0).toUpperCase() + vuln.severity.slice(1);
       const categoryTag = vuln.category && vuln.category !== "security" ? ` [${vuln.category}]` : "";
-      lines.push(`  ${colorFn(`[${icon}]`)} ${colorFn(vuln.type)} (${severityUpper})${cweTag}${categoryTag}`);
+      const libraryApiTag = vuln.tags?.includes(LIBRARY_API_SURFACE_TAG2) ? ` ${colors.cyan("[library-api-surface]")}` : "";
+      lines.push(`  ${colorFn(`[${icon}]`)} ${colorFn(vuln.type)} (${severityUpper})${cweTag}${categoryTag}${libraryApiTag}`);
       lines.push(`      Line ${vuln.line}: ${vuln.message}`);
       const help = VULNERABILITY_HELP[vuln.type];
       const fixText = vuln.fix ?? help?.fix;
@@ -35422,7 +36270,7 @@ function formatResults(results, verbose, crossFileData) {
   return lines.join(`
 `);
 }
-function formatJSON(results, crossFileData) {
+function formatJSON(results, crossFileData, profileSummary) {
   const output = {
     version,
     timestamp: new Date().toISOString(),
@@ -35434,6 +36282,7 @@ function formatJSON(results, crossFileData) {
     cross_file_taint_paths: crossFileData?.taintPaths ?? [],
     cross_file_calls: crossFileData?.crossFileCalls ?? [],
     cross_file_budget_exceeded: crossFileData?.budgetExceeded ?? false,
+    ...profileSummary ? { project_profile: profileSummary } : {},
     summary: {
       filesScanned: results.length,
       filesWithVulnerabilities: results.filter((r) => r.vulnerabilities.length > 0).length,
@@ -35445,7 +36294,7 @@ function formatJSON(results, crossFileData) {
   };
   return JSON.stringify(output, null, 2);
 }
-function formatSARIF(results, crossFileData) {
+function formatSARIF(results, crossFileData, profileSummary) {
   const sarif = {
     $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
     version: "2.1.0",
@@ -35459,7 +36308,8 @@ function formatSARIF(results, crossFileData) {
             rules: generateRules(results, crossFileData)
           }
         },
-        results: generateSarifResults(results, crossFileData)
+        results: generateSarifResults(results, crossFileData),
+        ...profileSummary ? { properties: { projectProfile: profileSummary } } : {}
       }
     ]
   };
@@ -35522,7 +36372,9 @@ function generateSarifResults(results, crossFileData) {
         properties: {
           cwe: vuln.cwe,
           severity: vuln.severity,
-          ...vuln.fix ? { fix: vuln.fix } : {}
+          ...vuln.fix ? { fix: vuln.fix } : {},
+          ...vuln.tags && vuln.tags.length > 0 ? { tags: vuln.tags } : {},
+          ...vuln.profile ? { profile: vuln.profile } : {}
         }
       });
     }
@@ -35632,6 +36484,13 @@ SCAN OPTIONS:
   --disable-pass <passes>    Disable specific passes (comma-separated, e.g., "naming-convention,todo-in-prod")
   --exclude-tests            Exclude test files and directories
   --profile <file>           Load config from file [default: cognium.config.json]
+  --project-profile <p>      Force project profile (shape/env). Disables auto-detection.
+                               - shape: library|application|cli|server|plugin
+                               - env:   production|dev|sample|benchmark|test
+                               - Example: --project-profile library/production
+                               - Default: auto-detect from build files (pom.xml, build.gradle)
+  --no-project-profile       Disable project-profile auto-detection (every file → unknown).
+  --project-profile-explain  Print detected per-module profiles + reason chain, then exit.
   -o, --output <file>        Write results to file
   -q, --quiet                Suppress progress output
   -v, --verbose              Show detailed output
@@ -35820,7 +36679,7 @@ function applySuppressionsToResults(results, suppressions, basePath) {
   if (suppressions.length === 0)
     return results;
   return results.map((result) => {
-    const relativeFile = relative(basePath, result.file) || result.file;
+    const relativeFile = relative3(basePath, result.file) || result.file;
     const filteredVulns = result.vulnerabilities.filter((vuln) => {
       for (const supp of suppressions) {
         if (supp.pass !== vuln.type)
@@ -35903,13 +36762,13 @@ function matchesAnyPattern(filePath, patterns) {
 async function collectFiles(targetPath, options = {}) {
   const { language, excludeTests = false, includePatterns, excludePatterns, basePath } = options;
   const files = [];
-  const pathStat = await stat(targetPath);
+  const pathStat = await stat2(targetPath);
   if (pathStat.isFile()) {
     if (excludeTests && isTestFile2(targetPath)) {
       return files;
     }
     if (fileMatchesLanguage(targetPath, language)) {
-      const relativePath = basePath ? relative(basePath, targetPath) : targetPath;
+      const relativePath = basePath ? relative3(basePath, targetPath) : targetPath;
       if (includePatterns && includePatterns.length > 0) {
         if (!matchesAnyPattern(relativePath, includePatterns)) {
           return files;
@@ -35921,14 +36780,14 @@ async function collectFiles(targetPath, options = {}) {
       files.push(targetPath);
     }
   } else if (pathStat.isDirectory()) {
-    const entries = await readdir(targetPath, { withFileTypes: true });
+    const entries = await readdir2(targetPath, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.name.startsWith(".") || entry.name === "node_modules")
         continue;
       if (excludeTests && /^(test|tests|__tests__|spec|__mocks__)$/i.test(entry.name))
         continue;
-      const fullPath = join(targetPath, entry.name);
-      const relativePath = basePath ? relative(basePath, fullPath) : fullPath;
+      const fullPath = join2(targetPath, entry.name);
+      const relativePath = basePath ? relative3(basePath, fullPath) : fullPath;
       if (excludePatterns && entry.isDirectory()) {
         const dirPattern = relativePath + "/";
         if (excludePatterns.some((p) => matchesGlob(dirPattern, p) || matchesGlob(relativePath, p))) {
@@ -35945,15 +36804,17 @@ async function scanFile(filePath, language, analyzeOpts) {
     const code = readFileSync(filePath, "utf-8");
     const result = await analyze(code, filePath, language, {
       passOptions: analyzeOpts?.passOptions,
-      disabledPasses: analyzeOpts?.disabledPasses
+      disabledPasses: analyzeOpts?.disabledPasses,
+      ...analyzeOpts?.projectProfile !== undefined ? { projectProfile: analyzeOpts.projectProfile } : {}
     });
     const vulnerabilities = (result.taint.flows || []).map((flow) => ({
       type: flow.sink_type,
-      severity: SINK_SEVERITY[flow.sink_type] ?? "high",
+      severity: applyTagSeverityDowngrade(SINK_SEVERITY[flow.sink_type] ?? "high", flow.tags),
       message: `${flow.sink_type} vulnerability: tainted data flows from line ${flow.source_line} to line ${flow.sink_line}`,
       line: flow.sink_line,
       cwe: SINK_CWE[flow.sink_type],
-      category: "security"
+      category: "security",
+      ...flow.tags && flow.tags.length > 0 ? { tags: [...flow.tags] } : {}
     }));
     for (const finding of result.findings ?? []) {
       vulnerabilities.push({
@@ -35963,7 +36824,8 @@ async function scanFile(filePath, language, analyzeOpts) {
         line: finding.line,
         cwe: finding.cwe,
         fix: finding.fix,
-        category: finding.category ?? "reliability"
+        category: finding.category ?? "reliability",
+        ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
     return { file: filePath, vulnerabilities };
@@ -35984,16 +36846,18 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
   const projectResult = await analyzeProject(filesWithCode, {
     passOptions: analyzeOpts?.passOptions,
     disabledPasses: analyzeOpts?.disabledPasses,
-    ...crossFileBudgetMs !== undefined ? { crossFileBudgetMs } : {}
+    ...crossFileBudgetMs !== undefined ? { crossFileBudgetMs } : {},
+    ...analyzeOpts?.projectProfile !== undefined ? { projectProfile: analyzeOpts.projectProfile } : {}
   });
   const results = projectResult.files.map(({ file, analysis }) => {
     const vulnerabilities = (analysis.taint.flows || []).map((flow) => ({
       type: flow.sink_type,
-      severity: SINK_SEVERITY[flow.sink_type] ?? "high",
+      severity: applyTagSeverityDowngrade(SINK_SEVERITY[flow.sink_type] ?? "high", flow.tags),
       message: `${flow.sink_type} vulnerability: tainted data flows from line ${flow.source_line} to line ${flow.sink_line}`,
       line: flow.sink_line,
       cwe: SINK_CWE[flow.sink_type],
-      category: "security"
+      category: "security",
+      ...flow.tags && flow.tags.length > 0 ? { tags: [...flow.tags] } : {}
     }));
     for (const finding of analysis.findings ?? []) {
       vulnerabilities.push({
@@ -36003,7 +36867,8 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
         line: finding.line,
         cwe: finding.cwe,
         fix: finding.fix,
-        category: finding.category ?? "reliability"
+        category: finding.category ?? "reliability",
+        ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
     return { file, vulnerabilities };
@@ -36020,7 +36885,7 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
 async function initWasm(spin) {
   const isStandalone = import.meta.url.includes("/$bunfs/");
   if (isStandalone) {
-    const { dirname: dirname3, join: join2 } = await import("path");
+    const { dirname: dirname3, join: join3 } = await import("path");
     const binaryDir = dirname3(process.execPath);
     const cwd = process.cwd();
     let scriptDir = null;
@@ -36031,34 +36896,34 @@ async function initWasm(spin) {
       } catch {}
     }
     const wasmLocations = [
-      join2(binaryDir, "wasm"),
-      join2(cwd, "wasm"),
-      join2(binaryDir, "..", "wasm"),
+      join3(binaryDir, "wasm"),
+      join3(cwd, "wasm"),
+      join3(binaryDir, "..", "wasm"),
       ...scriptDir ? [
-        join2(scriptDir, "wasm"),
-        join2(scriptDir, "..", "wasm"),
-        join2(scriptDir, "..", "node_modules", "circle-ir", "dist", "wasm")
+        join3(scriptDir, "wasm"),
+        join3(scriptDir, "..", "wasm"),
+        join3(scriptDir, "..", "node_modules", "circle-ir", "dist", "wasm")
       ] : []
     ];
     let wasmDir = null;
     for (const location of wasmLocations) {
-      if (existsSync(location) && existsSync(join2(location, "web-tree-sitter.wasm"))) {
+      if (existsSync(location) && existsSync(join3(location, "web-tree-sitter.wasm"))) {
         wasmDir = location;
         break;
       }
     }
     if (wasmDir) {
       await initAnalyzer({
-        wasmPath: join2(wasmDir, "web-tree-sitter.wasm"),
+        wasmPath: join3(wasmDir, "web-tree-sitter.wasm"),
         languagePaths: {
-          bash: join2(wasmDir, "tree-sitter-bash.wasm"),
-          go: join2(wasmDir, "tree-sitter-go.wasm"),
-          java: join2(wasmDir, "tree-sitter-java.wasm"),
-          javascript: join2(wasmDir, "tree-sitter-javascript.wasm"),
-          typescript: join2(wasmDir, "tree-sitter-javascript.wasm"),
-          python: join2(wasmDir, "tree-sitter-python.wasm"),
-          rust: join2(wasmDir, "tree-sitter-rust.wasm"),
-          html: join2(wasmDir, "tree-sitter-html.wasm")
+          bash: join3(wasmDir, "tree-sitter-bash.wasm"),
+          go: join3(wasmDir, "tree-sitter-go.wasm"),
+          java: join3(wasmDir, "tree-sitter-java.wasm"),
+          javascript: join3(wasmDir, "tree-sitter-javascript.wasm"),
+          typescript: join3(wasmDir, "tree-sitter-javascript.wasm"),
+          python: join3(wasmDir, "tree-sitter-python.wasm"),
+          rust: join3(wasmDir, "tree-sitter-rust.wasm"),
+          html: join3(wasmDir, "tree-sitter-html.wasm")
         }
       });
     } else {
@@ -36080,7 +36945,7 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
   } else {
     const require2 = createRequire2(import.meta.url);
     const circleIrPkg = require2.resolve("circle-ir/package.json");
-    const wasmBasePath = join(dirname2(circleIrPkg), "dist", "wasm") + "/";
+    const wasmBasePath = join2(dirname2(circleIrPkg), "dist", "wasm") + "/";
     await initAnalyzer({
       wasmPath: wasmBasePath + "web-tree-sitter.wasm",
       languagePaths: {
@@ -36096,6 +36961,62 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
     });
   }
 }
+function buildProfileSummary(scanRoot, modules, resolvedProfiles) {
+  if (!resolvedProfiles)
+    return;
+  if (modules.length === 0 && resolvedProfiles.size === 0)
+    return;
+  let unknownFileCount = 0;
+  for (const p of resolvedProfiles.values()) {
+    if (p === "unknown")
+      unknownFileCount++;
+  }
+  return {
+    scanRoot,
+    modules: modules.map((m) => ({
+      root: relative3(scanRoot, m.module.root) || ".",
+      profile: m.profile,
+      reasons: m.reasons,
+      buildSystem: m.module.buildSystem
+    })),
+    unknownFileCount
+  };
+}
+function summarizeModules(modules) {
+  if (modules.length === 0)
+    return "no build files detected";
+  const counts = new Map;
+  for (const m of modules) {
+    counts.set(m.profile, (counts.get(m.profile) ?? 0) + 1);
+  }
+  const parts2 = [...counts.entries()].map(([profile, count]) => `${profile}×${count}`).sort();
+  return `${modules.length} module(s): ${parts2.join(", ")}`;
+}
+function printProfileExplain(scanRoot, detection) {
+  const out2 = [];
+  out2.push(colors.bold("Project profile detection"));
+  out2.push(`  Scan root: ${scanRoot}`);
+  out2.push(`  Modules:   ${detection.modules.length}`);
+  out2.push(`  Unknown files (no enclosing module): ${detection.unknownFiles.length}`);
+  out2.push("");
+  if (detection.modules.length === 0) {
+    out2.push("  (no pom.xml, build.gradle, or build.gradle.kts found)");
+  } else {
+    for (const r of detection.modules) {
+      const rel = relative3(scanRoot, r.module.root) || ".";
+      out2.push(`  ${colors.cyan(rel || ".")}  →  ${colors.bold(r.profile)}`);
+      out2.push(`     build: ${r.module.buildSystem}  (${relative3(scanRoot, r.module.buildFile)})`);
+      if (r.module.artifactId) {
+        out2.push(`     coords: ${r.module.groupId ?? "?"}:${r.module.artifactId}:${r.module.version ?? "?"}`);
+      }
+      out2.push(`     reasons: ${r.reasons.join(" → ")}`);
+      out2.push("");
+    }
+  }
+  process.stderr.write(out2.join(`
+`) + `
+`);
+}
 async function runScan(targetPath, options) {
   const spin = options.quiet ? null : spinner("Initializing analyzer...").start();
   const config = loadConfig(options.profile);
@@ -36149,8 +37070,39 @@ async function runScan(targetPath, options) {
     }
     let results;
     let crossFileData;
-    const analyzeOpts = { passOptions, disabledPasses };
-    if ((await stat(absPath)).isDirectory()) {
+    const forcedProfile = options.projectProfile ?? config?.profile;
+    const profileOverrides = config?.profileOverrides;
+    const detectionEnabled = !options.noProjectProfile && (await stat2(absPath)).isDirectory();
+    let resolvedProfiles;
+    let detectedModules = [];
+    if (detectionEnabled) {
+      if (spin)
+        spin.text = "Detecting project profile...";
+      const detection = await detectProjectProfiles(absPath, {
+        forcedProfile,
+        overrides: profileOverrides
+      });
+      resolvedProfiles = detection.profileByFile;
+      detectedModules = detection.modules;
+      if (options.projectProfileExplain) {
+        if (spin)
+          spin.stop();
+        printProfileExplain(absPath, detection);
+        return;
+      }
+      if (!options.quiet && detectedModules.length > 0) {
+        const summary = summarizeModules(detectedModules);
+        console.error(colors.dim(`Project profile: ${summary}`));
+      }
+    } else if (forcedProfile && !options.noProjectProfile) {
+      resolvedProfiles = undefined;
+    }
+    const analyzeOpts = {
+      passOptions,
+      disabledPasses,
+      ...resolvedProfiles ? { projectProfile: resolvedProfiles } : forcedProfile && !options.noProjectProfile ? { projectProfile: forcedProfile } : {}
+    };
+    if ((await stat2(absPath)).isDirectory()) {
       if (spin)
         spin.text = `Running project analysis on ${files.length} file(s)...`;
       const projectScan = await scanProject(files, options.language, analyzeOpts, options.crossFileBudgetMs);
@@ -36162,7 +37114,7 @@ async function runScan(targetPath, options) {
       results = [];
       let processed = 0;
       const formatCurrentFile = (file) => {
-        const rel = relative(absPath, file) || file;
+        const rel = relative3(absPath, file) || file;
         return rel.length > 80 ? `...${rel.slice(-77)}` : rel;
       };
       const concurrency = options.threads;
@@ -36260,17 +37212,27 @@ async function runScan(targetPath, options) {
     const errors = results.filter((r) => r.error).length;
     const crossFilePaths = crossFileData?.taintPaths.length ?? 0;
     const shouldOutput = totalVulns > 0 || crossFilePaths > 0 || errors > 0 || options.verbose || options.output || options.format !== "text";
+    const profileSummary = buildProfileSummary(absPath, detectedModules, resolvedProfiles);
+    if (resolvedProfiles) {
+      for (const r of results) {
+        const p = resolvedProfiles.get(r.file);
+        if (!p || p === "unknown")
+          continue;
+        for (const v of r.vulnerabilities)
+          v.profile = p;
+      }
+    }
     if (shouldOutput) {
       let output;
       switch (options.format) {
         case "json":
-          output = formatJSON(results, crossFileData);
+          output = formatJSON(results, crossFileData, profileSummary);
           break;
         case "sarif":
-          output = formatSARIF(results, crossFileData);
+          output = formatSARIF(results, crossFileData, profileSummary);
           break;
         default:
-          output = formatResults(results, options.verbose, crossFileData);
+          output = formatResults(results, options.verbose, crossFileData, profileSummary);
       }
       if (options.output) {
         const { writeFileSync } = await import("fs");
@@ -36356,7 +37318,7 @@ async function runMetrics(targetPath, options) {
         continue;
       }
       if (spin) {
-        const rel = relative(absPath, file) || file;
+        const rel = relative3(absPath, file) || file;
         const maxLen = 80;
         const label = rel.length > maxLen ? `...${rel.slice(-(maxLen - 3))}` : rel;
         spin.text = `Analyzing ${label}... (${processed}/${totalFiles})`;
@@ -36401,7 +37363,7 @@ async function runMetrics(targetPath, options) {
     } else {
       const lines = [];
       for (const fm of filtered) {
-        const rel = relative(absPath, fm.file) || fm.file;
+        const rel = relative3(absPath, fm.file) || fm.file;
         lines.push(rel);
         const byCategory = new Map;
         for (const m of fm.metrics) {
@@ -36557,6 +37519,21 @@ function applyFindingsInstrumentation() {
     setFindingsInstrumentation(true);
   }
 }
+function parseProjectProfileArg(raw) {
+  if (raw === undefined || raw === true || raw === "")
+    return;
+  const s = String(raw).toLowerCase();
+  if (s === "unknown")
+    return "unknown";
+  const m = /^(library|application|cli|server|plugin)\/(production|dev|sample|benchmark|test)$/.exec(s);
+  if (!m) {
+    console.error(colors.yellow(`Warning: invalid --project-profile "${s}" — expected one of:
+` + `  {library,application,cli,server,plugin}/{production,dev,sample,benchmark,test}
+  or "unknown". Falling back to auto-detection.`));
+    return;
+  }
+  return s;
+}
 function parseCrossFileBudgetMs(raw) {
   if (raw === undefined || raw === true || raw === "")
     return;
@@ -36629,7 +37606,10 @@ Usage: cognium-dev scan <path> [options]`);
       excludeCwe: options["exclude-cwe"],
       profile: options.profile || options.p,
       disablePass: options["disable-pass"],
-      crossFileBudgetMs: parseCrossFileBudgetMs(options["cross-file-budget-ms"])
+      crossFileBudgetMs: parseCrossFileBudgetMs(options["cross-file-budget-ms"]),
+      projectProfile: parseProjectProfileArg(options["project-profile"]),
+      noProjectProfile: options["no-project-profile"] === true,
+      projectProfileExplain: options["project-profile-explain"] === true
     };
     await runScan(targetPath, scanOptions);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.104.0",
+  "version": "3.106.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.104.0"
+    "circle-ir": "^3.106.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",