cognium-dev 3.105.0 → 3.106.0

package/dist/cli.js

@@ -4,8 +4,8 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/cli.ts
 import { readFileSync, existsSync } from "fs";
-import { stat, readdir } from "fs/promises";
-import { join, dirname as dirname2, extname, resolve, relative } from "path";
+import { stat as stat2, readdir as readdir2 } from "fs/promises";
+import { join as join2, dirname as dirname2, extname, resolve, relative as relative3 } from "path";
 import { createRequire as createRequire2 } from "module";
 
 // ../../node_modules/web-tree-sitter/web-tree-sitter.js
@@ -18068,7 +18068,74 @@ function applyLibraryApiSurfaceDowngrade(findings) {
       return f;
     if (f.severity === "medium" || f.severity === "low")
       return f;
-    return { ...f, severity: "medium", level: "warning" };
+    return {
+      ...f,
+      original_severity: f.severity,
+      severity: "medium",
+      level: "warning"
+    };
+  });
+}
+
+// ../circle-ir/dist/analysis/project-profile-transform.js
+var DOWNGRADE_ELIGIBLE_RULE_IDS = new Set([
+  "code_injection",
+  "template_injection",
+  "xpath_injection",
+  "sql_injection"
+]);
+function libraryDowngrade(severity) {
+  switch (severity) {
+    case "critical":
+      return { severity: "medium", level: "warning" };
+    case "high":
+      return { severity: "low", level: "note" };
+    case "medium":
+      return { severity: "low", level: "note" };
+    case "low":
+      return { severity: "low", level: "note" };
+  }
+}
+function levelForSeverity(severity) {
+  switch (severity) {
+    case "critical":
+      return "error";
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    case "low":
+      return "note";
+  }
+}
+function applyProjectProfileTransform(findings, resolveProfile) {
+  return findings.map((f) => {
+    if (!f.tags?.includes(LIBRARY_API_SURFACE_TAG))
+      return f;
+    const profile = resolveProfile(f.file);
+    if (profile === "unknown")
+      return f;
+    const shape = profile.split("/")[0];
+    if (shape === "library") {
+      if (!DOWNGRADE_ELIGIBLE_RULE_IDS.has(f.rule_id))
+        return f;
+      const { severity, level } = libraryDowngrade(f.severity);
+      if (severity === f.severity && level === f.level)
+        return f;
+      return { ...f, severity, level };
+    }
+    if (shape === "application") {
+      if (!f.original_severity)
+        return f;
+      if (f.original_severity === f.severity)
+        return f;
+      return {
+        ...f,
+        severity: f.original_severity,
+        level: levelForSeverity(f.original_severity)
+      };
+    }
+    return f;
   });
 }
 
@@ -34933,6 +35000,13 @@ function getNodeTypesForLanguage(language) {
       ]);
   }
 }
+function makeProfileResolver(p) {
+  if (p === undefined)
+    return () => "unknown";
+  if (typeof p === "string")
+    return () => p;
+  return (file) => p.get(file) ?? "unknown";
+}
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -35139,7 +35213,8 @@ async function analyze(code, filePath, language, options = {}) {
     emitFindingsInstrumentation(filePath, findings, taint);
     const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
     const downgradedFindings = applyLibraryApiSurfaceDowngrade(verifiedFindings);
-    const cappedFindings = applyPerFileFindingCap(filePath, downgradedFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
+    const profiledFindings = applyProjectProfileTransform(downgradedFindings, makeProfileResolver(options.projectProfile));
+    const cappedFindings = applyPerFileFindingCap(filePath, profiledFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
       types,
@@ -35297,6 +35372,491 @@ function deriveProjectRoot(paths) {
   }
   return common.join("/") || "/";
 }
+// src/project-profile-detect/index.ts
+import { relative as relative2 } from "path";
+
+// src/project-profile-detect/walk.ts
+import { readdir, readFile, stat } from "fs/promises";
+import { join, relative } from "path";
+
+// src/project-profile-detect/maven-parse.ts
+var TAG = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "i");
+var ALL_TAGS = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "gi");
+function firstTag(xml, name2) {
+  const m = TAG(name2).exec(xml);
+  return m?.[1].trim();
+}
+function allTags(xml, name2) {
+  const out2 = [];
+  let m;
+  const re = ALL_TAGS(name2);
+  while ((m = re.exec(xml)) !== null)
+    out2.push(m[1].trim());
+  return out2;
+}
+var MAVEN_PLUGIN_MAP = {
+  "spring-boot-maven-plugin": "spring-boot",
+  "maven-plugin-plugin": "maven-plugin",
+  "maven-war-plugin": "war",
+  "maven-ear-plugin": "ear",
+  "maven-shade-plugin": "application",
+  "exec-maven-plugin": "application",
+  "maven-assembly-plugin": "application"
+};
+function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
+  const stripped = xml.replace(/<parent\b[\s\S]*?<\/parent>/i, "");
+  const groupId = firstTag(stripped, "groupId");
+  const artifactId = firstTag(stripped, "artifactId");
+  const version = firstTag(stripped, "version");
+  const packaging = firstTag(stripped, "packaging");
+  const buildBlock = firstTag(xml, "build") ?? "";
+  const pluginBlocks = allTags(buildBlock, "plugin");
+  const plugins = new Set;
+  for (const p of pluginBlocks) {
+    const aid = firstTag(p, "artifactId");
+    if (aid && MAVEN_PLUGIN_MAP[aid])
+      plugins.add(MAVEN_PLUGIN_MAP[aid]);
+  }
+  if (/<parent\b[\s\S]*?<artifactId>\s*spring-boot-starter-parent\s*<\/artifactId>/i.test(xml)) {
+    plugins.add("spring-boot");
+  }
+  if (packaging === "war")
+    plugins.add("war");
+  if (packaging === "ear")
+    plugins.add("ear");
+  if (packaging === "maven-plugin")
+    plugins.add("maven-plugin");
+  const distBlock = firstTag(xml, "distributionManagement") ?? "";
+  const urls = [
+    ...allTags(distBlock, "url")
+  ].map((u) => u.trim()).filter(Boolean);
+  const signals = {
+    ...directorySignals,
+    plugins: [...directorySignals.plugins, ...plugins],
+    packaging,
+    distributionUrls: [...directorySignals.distributionUrls, ...urls]
+  };
+  return {
+    root: moduleRoot,
+    buildSystem: "maven",
+    buildFile,
+    groupId,
+    artifactId,
+    version,
+    signals
+  };
+}
+
+// src/project-profile-detect/gradle-parse.ts
+var GRADLE_PLUGIN_MAP = {
+  "org.springframework.boot": "spring-boot",
+  "io.spring.dependency-management": "spring-boot",
+  "java-library": "java-library",
+  application: "application",
+  war: "war",
+  ear: "ear",
+  "maven-publish": "maven-publish",
+  "java-gradle-plugin": "gradle-plugin",
+  "com.gradle.plugin-publish": "gradle-plugin"
+};
+var PLUGIN_ID_RE = /\bid\s*[(\s]\s*['"]([^'"]+)['"]/g;
+var APPLY_PLUGIN_RE = /\bapply\s+plugin\s*:\s*['"]([^'"]+)['"]/g;
+var GROUP_RE = /\bgroup\s*[=(]\s*['"]([^'"]+)['"]/;
+var VERSION_RE = /\bversion\s*[=(]\s*['"]([^'"]+)['"]/;
+var URL_RE = /\burl\s*[=(]?\s*(?:uri\s*\(\s*)?['"]([^'"]+)['"]/g;
+function parsePlugins(text) {
+  const ids = new Set;
+  let m;
+  PLUGIN_ID_RE.lastIndex = 0;
+  while ((m = PLUGIN_ID_RE.exec(text)) !== null)
+    ids.add(m[1]);
+  APPLY_PLUGIN_RE.lastIndex = 0;
+  while ((m = APPLY_PLUGIN_RE.exec(text)) !== null)
+    ids.add(m[1]);
+  const out2 = new Set;
+  for (const id of ids) {
+    const tag = GRADLE_PLUGIN_MAP[id];
+    if (tag)
+      out2.add(tag);
+  }
+  return out2;
+}
+function parseUrls(text) {
+  const out2 = [];
+  let m;
+  URL_RE.lastIndex = 0;
+  while ((m = URL_RE.exec(text)) !== null)
+    out2.push(m[1]);
+  return out2;
+}
+function parseGradleBuild(text, moduleRoot, buildFile, buildSystem, directorySignals) {
+  const cleaned = text.replace(/\/\*[\s\S]*?\*\//g, "");
+  const pluginsSet = parsePlugins(cleaned);
+  const urls = parseUrls(cleaned);
+  const groupId = GROUP_RE.exec(cleaned)?.[1];
+  const version = VERSION_RE.exec(cleaned)?.[1];
+  const artifactId = moduleRoot.split(/[\\/]/).filter(Boolean).pop();
+  const signals = {
+    ...directorySignals,
+    plugins: [...directorySignals.plugins, ...pluginsSet],
+    distributionUrls: [...directorySignals.distributionUrls, ...urls]
+  };
+  return {
+    root: moduleRoot,
+    buildSystem,
+    buildFile,
+    groupId,
+    artifactId,
+    version,
+    signals
+  };
+}
+
+// src/project-profile-detect/walk.ts
+var BUILD_FILES = ["pom.xml", "build.gradle", "build.gradle.kts"];
+var SKIP_DIRS = new Set([
+  "node_modules",
+  ".git",
+  ".svn",
+  ".hg",
+  "target",
+  "build",
+  "out",
+  "dist",
+  ".gradle",
+  ".idea",
+  ".vscode",
+  "bin",
+  "obj"
+]);
+async function discoverBuildModules(scanRoot) {
+  const modules = [];
+  await walk(scanRoot, modules);
+  return modules;
+}
+async function walk(dir, out2) {
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return;
+  }
+  const buildFile = entries.find((e) => BUILD_FILES.includes(e));
+  if (buildFile) {
+    const buildFilePath = join(dir, buildFile);
+    const buildSystem = buildFile === "pom.xml" ? "maven" : buildFile === "build.gradle.kts" ? "gradle-kts" : "gradle";
+    const signals = await collectDirectorySignals(dir);
+    let mod;
+    try {
+      const raw = await readFile(buildFilePath, "utf-8");
+      mod = buildSystem === "maven" ? parseMavenPom(raw, dir, buildFilePath, signals) : parseGradleBuild(raw, dir, buildFilePath, buildSystem, signals);
+    } catch {
+      mod = { root: dir, buildSystem, buildFile: buildFilePath, signals };
+    }
+    out2.push(mod);
+  }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry) || entry.startsWith("."))
+      continue;
+    const full = join(dir, entry);
+    let s;
+    try {
+      s = await stat(full);
+    } catch {
+      continue;
+    }
+    if (s.isDirectory()) {
+      await walk(full, out2);
+    }
+  }
+}
+async function collectDirectorySignals(moduleRoot) {
+  const signals = {
+    plugins: [],
+    distributionUrls: [],
+    hasJpmsModuleInfo: false,
+    hasSpiServices: false,
+    hasMainMethod: false
+  };
+  const javaRoot = join(moduleRoot, "src", "main", "java");
+  const resourcesRoot = join(moduleRoot, "src", "main", "resources");
+  try {
+    await stat(join(javaRoot, "module-info.java"));
+    signals.hasJpmsModuleInfo = true;
+  } catch {}
+  try {
+    const s = await stat(join(resourcesRoot, "META-INF", "services"));
+    if (s.isDirectory())
+      signals.hasSpiServices = true;
+  } catch {}
+  try {
+    signals.hasMainMethod = await scanForMainMethod(javaRoot, 200);
+  } catch {}
+  return signals;
+}
+var MAIN_METHOD_RE = /\bpublic\s+static\s+void\s+main\s*\(\s*(?:final\s+)?String\s*(?:\[\s*\]|\.{3})/;
+async function scanForMainMethod(root, maxFiles) {
+  let visited = 0;
+  const stack = [root];
+  while (stack.length > 0 && visited < maxFiles) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = await readdir(dir);
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      const full = join(dir, e);
+      let s;
+      try {
+        s = await stat(full);
+      } catch {
+        continue;
+      }
+      if (s.isDirectory()) {
+        stack.push(full);
+      } else if (s.isFile() && e.endsWith(".java")) {
+        visited++;
+        try {
+          const text = await readFile(full, "utf-8");
+          if (MAIN_METHOD_RE.test(text))
+            return true;
+        } catch {}
+        if (visited >= maxFiles)
+          break;
+      }
+    }
+  }
+  return false;
+}
+async function enumerateScanFiles(scanRoot) {
+  const out2 = [];
+  await enumerate(scanRoot, out2);
+  return out2;
+}
+async function enumerate(dir, out2) {
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (SKIP_DIRS.has(e) || e.startsWith("."))
+      continue;
+    const full = join(dir, e);
+    let s;
+    try {
+      s = await stat(full);
+    } catch {
+      continue;
+    }
+    if (s.isDirectory()) {
+      await enumerate(full, out2);
+    } else if (s.isFile()) {
+      out2.push(full);
+    }
+  }
+}
+function ownerOf(file, modules) {
+  let best;
+  let bestLen = -1;
+  for (const m of modules) {
+    if (file === m.root || file.startsWith(m.root + "/")) {
+      if (m.root.length > bestLen) {
+        best = m;
+        bestLen = m.root.length;
+      }
+    }
+  }
+  return best;
+}
+
+// src/project-profile-detect/publication-detect.ts
+var PUBLIC_REGISTRY_HOSTS = new Set([
+  "repo.maven.apache.org",
+  "repo1.maven.org",
+  "oss.sonatype.org",
+  "s01.oss.sonatype.org",
+  "central.sonatype.com",
+  "central.sonatype.org",
+  "plugins.gradle.org",
+  "jcenter.bintray.com"
+]);
+function isPubliclyPublished(urls) {
+  for (const u of urls) {
+    let host;
+    try {
+      host = new URL(u).hostname.toLowerCase();
+    } catch {
+      continue;
+    }
+    if (PUBLIC_REGISTRY_HOSTS.has(host))
+      return true;
+  }
+  return false;
+}
+
+// src/project-profile-detect/shape-resolve.ts
+function resolveShape(mod) {
+  const sig = mod.signals;
+  const has = (tag) => sig.plugins.includes(tag);
+  const reasons = [];
+  if (has("spring-boot")) {
+    reasons.push("spring-boot plugin");
+    return { shape: "server", reasons };
+  }
+  if (has("war") || has("ear")) {
+    reasons.push(has("war") ? "war packaging" : "ear packaging");
+    return { shape: "server", reasons };
+  }
+  if (has("maven-plugin") || has("gradle-plugin")) {
+    reasons.push(has("maven-plugin") ? "maven-plugin packaging" : "gradle-plugin id");
+    return { shape: "plugin", reasons };
+  }
+  if (has("application")) {
+    reasons.push("application plugin");
+    return { shape: "cli", reasons };
+  }
+  if (sig.hasMainMethod) {
+    reasons.push("main(String[]) found");
+    return { shape: "application", reasons };
+  }
+  const libSignals = [];
+  if (has("java-library"))
+    libSignals.push("java-library plugin");
+  if (sig.hasJpmsModuleInfo)
+    libSignals.push("JPMS module-info.java");
+  if (sig.hasSpiServices)
+    libSignals.push("META-INF/services SPI");
+  if (libSignals.length > 0) {
+    const published = isPubliclyPublished(sig.distributionUrls);
+    if (published) {
+      reasons.push(...libSignals, "public-registry distribution");
+      return { shape: "library", reasons };
+    }
+    reasons.push(...libSignals, "no public-registry distribution (internal helper)");
+    return { shape: "application", reasons };
+  }
+  reasons.push("no shape signals");
+  return { shape: "unknown", reasons };
+}
+
+// src/project-profile-detect/env-resolve.ts
+var TEST_RE = /(?:^|\/)tests?\//;
+var SAMPLE_RE = /(?:^|\/)(?:samples?|examples?|demos?|fixtures?)\//;
+var BENCHMARK_RE = /(?:^|\/)benchmarks?\//;
+var PROD_RE = /(?:^|\/)src\/main\//;
+function resolveEnv(absoluteFile) {
+  const f = absoluteFile.replace(/\\/g, "/").toLowerCase();
+  if (TEST_RE.test(f))
+    return "test";
+  if (BENCHMARK_RE.test(f))
+    return "benchmark";
+  if (SAMPLE_RE.test(f))
+    return "sample";
+  if (PROD_RE.test(f))
+    return "production";
+  return "dev";
+}
+
+// src/project-profile-detect/overrides.ts
+function compileGlob(glob) {
+  let re = "";
+  let i2 = 0;
+  while (i2 < glob.length) {
+    const c = glob[i2];
+    if (c === "*") {
+      if (glob[i2 + 1] === "*") {
+        re += ".*";
+        i2 += 2;
+        if (glob[i2] === "/")
+          i2++;
+      } else {
+        re += "[^/]*";
+        i2++;
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+      i2++;
+    } else if (/[.+^${}()|[\]\\]/.test(c)) {
+      re += "\\" + c;
+      i2++;
+    } else {
+      re += c;
+      i2++;
+    }
+  }
+  return new RegExp("^" + re + "$");
+}
+function compileOverrides(overrides) {
+  if (!overrides)
+    return [];
+  return Object.entries(overrides).map(([glob, profile]) => ({
+    re: compileGlob(glob),
+    profile,
+    glob
+  }));
+}
+function applyOverrides(relativePath, compiled) {
+  const p = relativePath.replace(/\\/g, "/");
+  for (const { re, profile, glob } of compiled) {
+    if (re.test(p))
+      return { profile, glob };
+  }
+  return;
+}
+
+// src/project-profile-detect/index.ts
+async function detectProjectProfiles(scanRoot, options = {}) {
+  const modules = await discoverBuildModules(scanRoot);
+  const files = await enumerateScanFiles(scanRoot);
+  const compiledOverrides = compileOverrides(options.overrides);
+  const resolvedByRoot = new Map;
+  const resolvedModules = [];
+  for (const m of modules) {
+    const sr = resolveShape(m);
+    const moduleEnv = resolveEnv(m.root);
+    const profile = sr.shape === "unknown" ? "unknown" : `${sr.shape}/${moduleEnv}`;
+    const r = { module: m, profile, reasons: sr.reasons };
+    resolvedByRoot.set(m.root, r);
+    resolvedModules.push(r);
+  }
+  const profileByFile = new Map;
+  const unknownFiles = [];
+  for (const file of files) {
+    const rel = relative2(scanRoot, file);
+    const ov = applyOverrides(rel, compiledOverrides);
+    if (ov) {
+      profileByFile.set(file, ov.profile);
+      continue;
+    }
+    if (options.forcedProfile && options.forcedProfile !== "unknown") {
+      const [shape2] = options.forcedProfile.split("/");
+      const env2 = resolveEnv(file);
+      profileByFile.set(file, `${shape2}/${env2}`);
+      continue;
+    }
+    const owner = ownerOf(file, modules);
+    if (!owner) {
+      profileByFile.set(file, "unknown");
+      unknownFiles.push(file);
+      continue;
+    }
+    const ownerResolution = resolvedByRoot.get(owner.root);
+    if (!ownerResolution || ownerResolution.profile === "unknown") {
+      profileByFile.set(file, "unknown");
+      unknownFiles.push(file);
+      continue;
+    }
+    const [shape] = ownerResolution.profile.split("/");
+    const env = resolveEnv(file);
+    profileByFile.set(file, `${shape}/${env}`);
+  }
+  return { profileByFile, modules: resolvedModules, unknownFiles };
+}
+
 // src/utils/colors.ts
 var RESET = "\x1B[0m";
 var BOLD = "\x1B[1m";
@@ -35318,7 +35878,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.105.0";
+var version = "3.106.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -35650,8 +36210,22 @@ function formatCrossFilePaths(taintPaths) {
   return lines.join(`
 `);
 }
-function formatResults(results, verbose, crossFileData) {
+function formatResults(results, verbose, crossFileData, profileSummary) {
   const lines = [];
+  if (profileSummary && profileSummary.modules.length > 0) {
+    lines.push(colors.bold("Project profile"));
+    for (const m of profileSummary.modules) {
+      const tag = m.root === "" || m.root === "." ? "." : m.root;
+      lines.push(`  ${colors.cyan(tag)}  →  ${colors.bold(m.profile)}`);
+      if (verbose) {
+        lines.push(`     reasons: ${m.reasons.join(" → ")}`);
+      }
+    }
+    if (profileSummary.unknownFileCount > 0) {
+      lines.push(colors.dim(`  ${profileSummary.unknownFileCount} file(s) outside any module → unknown`));
+    }
+    lines.push("");
+  }
   for (const result of results) {
     if (result.error) {
       lines.push(colors.red(`[ERROR] ${result.file}: ${result.error}`));
@@ -35696,7 +36270,7 @@ function formatResults(results, verbose, crossFileData) {
   return lines.join(`
 `);
 }
-function formatJSON(results, crossFileData) {
+function formatJSON(results, crossFileData, profileSummary) {
   const output = {
     version,
     timestamp: new Date().toISOString(),
@@ -35708,6 +36282,7 @@ function formatJSON(results, crossFileData) {
     cross_file_taint_paths: crossFileData?.taintPaths ?? [],
     cross_file_calls: crossFileData?.crossFileCalls ?? [],
     cross_file_budget_exceeded: crossFileData?.budgetExceeded ?? false,
+    ...profileSummary ? { project_profile: profileSummary } : {},
     summary: {
       filesScanned: results.length,
       filesWithVulnerabilities: results.filter((r) => r.vulnerabilities.length > 0).length,
@@ -35719,7 +36294,7 @@ function formatJSON(results, crossFileData) {
   };
   return JSON.stringify(output, null, 2);
 }
-function formatSARIF(results, crossFileData) {
+function formatSARIF(results, crossFileData, profileSummary) {
   const sarif = {
     $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
     version: "2.1.0",
@@ -35733,7 +36308,8 @@ function formatSARIF(results, crossFileData) {
             rules: generateRules(results, crossFileData)
           }
         },
-        results: generateSarifResults(results, crossFileData)
+        results: generateSarifResults(results, crossFileData),
+        ...profileSummary ? { properties: { projectProfile: profileSummary } } : {}
       }
     ]
   };
@@ -35797,7 +36373,8 @@ function generateSarifResults(results, crossFileData) {
           cwe: vuln.cwe,
           severity: vuln.severity,
           ...vuln.fix ? { fix: vuln.fix } : {},
-          ...vuln.tags && vuln.tags.length > 0 ? { tags: vuln.tags } : {}
+          ...vuln.tags && vuln.tags.length > 0 ? { tags: vuln.tags } : {},
+          ...vuln.profile ? { profile: vuln.profile } : {}
         }
       });
     }
@@ -35907,6 +36484,13 @@ SCAN OPTIONS:
   --disable-pass <passes>    Disable specific passes (comma-separated, e.g., "naming-convention,todo-in-prod")
   --exclude-tests            Exclude test files and directories
   --profile <file>           Load config from file [default: cognium.config.json]
+  --project-profile <p>      Force project profile (shape/env). Disables auto-detection.
+                               - shape: library|application|cli|server|plugin
+                               - env:   production|dev|sample|benchmark|test
+                               - Example: --project-profile library/production
+                               - Default: auto-detect from build files (pom.xml, build.gradle)
+  --no-project-profile       Disable project-profile auto-detection (every file → unknown).
+  --project-profile-explain  Print detected per-module profiles + reason chain, then exit.
   -o, --output <file>        Write results to file
   -q, --quiet                Suppress progress output
   -v, --verbose              Show detailed output
@@ -36095,7 +36679,7 @@ function applySuppressionsToResults(results, suppressions, basePath) {
   if (suppressions.length === 0)
     return results;
   return results.map((result) => {
-    const relativeFile = relative(basePath, result.file) || result.file;
+    const relativeFile = relative3(basePath, result.file) || result.file;
     const filteredVulns = result.vulnerabilities.filter((vuln) => {
       for (const supp of suppressions) {
         if (supp.pass !== vuln.type)
@@ -36178,13 +36762,13 @@ function matchesAnyPattern(filePath, patterns) {
 async function collectFiles(targetPath, options = {}) {
   const { language, excludeTests = false, includePatterns, excludePatterns, basePath } = options;
   const files = [];
-  const pathStat = await stat(targetPath);
+  const pathStat = await stat2(targetPath);
   if (pathStat.isFile()) {
     if (excludeTests && isTestFile2(targetPath)) {
       return files;
     }
     if (fileMatchesLanguage(targetPath, language)) {
-      const relativePath = basePath ? relative(basePath, targetPath) : targetPath;
+      const relativePath = basePath ? relative3(basePath, targetPath) : targetPath;
       if (includePatterns && includePatterns.length > 0) {
         if (!matchesAnyPattern(relativePath, includePatterns)) {
           return files;
@@ -36196,14 +36780,14 @@ async function collectFiles(targetPath, options = {}) {
       files.push(targetPath);
     }
   } else if (pathStat.isDirectory()) {
-    const entries = await readdir(targetPath, { withFileTypes: true });
+    const entries = await readdir2(targetPath, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.name.startsWith(".") || entry.name === "node_modules")
         continue;
       if (excludeTests && /^(test|tests|__tests__|spec|__mocks__)$/i.test(entry.name))
         continue;
-      const fullPath = join(targetPath, entry.name);
-      const relativePath = basePath ? relative(basePath, fullPath) : fullPath;
+      const fullPath = join2(targetPath, entry.name);
+      const relativePath = basePath ? relative3(basePath, fullPath) : fullPath;
       if (excludePatterns && entry.isDirectory()) {
         const dirPattern = relativePath + "/";
         if (excludePatterns.some((p) => matchesGlob(dirPattern, p) || matchesGlob(relativePath, p))) {
@@ -36220,7 +36804,8 @@ async function scanFile(filePath, language, analyzeOpts) {
     const code = readFileSync(filePath, "utf-8");
     const result = await analyze(code, filePath, language, {
       passOptions: analyzeOpts?.passOptions,
-      disabledPasses: analyzeOpts?.disabledPasses
+      disabledPasses: analyzeOpts?.disabledPasses,
+      ...analyzeOpts?.projectProfile !== undefined ? { projectProfile: analyzeOpts.projectProfile } : {}
     });
     const vulnerabilities = (result.taint.flows || []).map((flow) => ({
       type: flow.sink_type,
@@ -36261,7 +36846,8 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
   const projectResult = await analyzeProject(filesWithCode, {
     passOptions: analyzeOpts?.passOptions,
     disabledPasses: analyzeOpts?.disabledPasses,
-    ...crossFileBudgetMs !== undefined ? { crossFileBudgetMs } : {}
+    ...crossFileBudgetMs !== undefined ? { crossFileBudgetMs } : {},
+    ...analyzeOpts?.projectProfile !== undefined ? { projectProfile: analyzeOpts.projectProfile } : {}
   });
   const results = projectResult.files.map(({ file, analysis }) => {
     const vulnerabilities = (analysis.taint.flows || []).map((flow) => ({
@@ -36299,7 +36885,7 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
 async function initWasm(spin) {
   const isStandalone = import.meta.url.includes("/$bunfs/");
   if (isStandalone) {
-    const { dirname: dirname3, join: join2 } = await import("path");
+    const { dirname: dirname3, join: join3 } = await import("path");
     const binaryDir = dirname3(process.execPath);
     const cwd = process.cwd();
     let scriptDir = null;
@@ -36310,34 +36896,34 @@ async function initWasm(spin) {
       } catch {}
     }
     const wasmLocations = [
-      join2(binaryDir, "wasm"),
-      join2(cwd, "wasm"),
-      join2(binaryDir, "..", "wasm"),
+      join3(binaryDir, "wasm"),
+      join3(cwd, "wasm"),
+      join3(binaryDir, "..", "wasm"),
       ...scriptDir ? [
-        join2(scriptDir, "wasm"),
-        join2(scriptDir, "..", "wasm"),
-        join2(scriptDir, "..", "node_modules", "circle-ir", "dist", "wasm")
+        join3(scriptDir, "wasm"),
+        join3(scriptDir, "..", "wasm"),
+        join3(scriptDir, "..", "node_modules", "circle-ir", "dist", "wasm")
       ] : []
     ];
     let wasmDir = null;
     for (const location of wasmLocations) {
-      if (existsSync(location) && existsSync(join2(location, "web-tree-sitter.wasm"))) {
+      if (existsSync(location) && existsSync(join3(location, "web-tree-sitter.wasm"))) {
         wasmDir = location;
         break;
       }
     }
     if (wasmDir) {
       await initAnalyzer({
-        wasmPath: join2(wasmDir, "web-tree-sitter.wasm"),
+        wasmPath: join3(wasmDir, "web-tree-sitter.wasm"),
         languagePaths: {
-          bash: join2(wasmDir, "tree-sitter-bash.wasm"),
-          go: join2(wasmDir, "tree-sitter-go.wasm"),
-          java: join2(wasmDir, "tree-sitter-java.wasm"),
-          javascript: join2(wasmDir, "tree-sitter-javascript.wasm"),
-          typescript: join2(wasmDir, "tree-sitter-javascript.wasm"),
-          python: join2(wasmDir, "tree-sitter-python.wasm"),
-          rust: join2(wasmDir, "tree-sitter-rust.wasm"),
-          html: join2(wasmDir, "tree-sitter-html.wasm")
+          bash: join3(wasmDir, "tree-sitter-bash.wasm"),
+          go: join3(wasmDir, "tree-sitter-go.wasm"),
+          java: join3(wasmDir, "tree-sitter-java.wasm"),
+          javascript: join3(wasmDir, "tree-sitter-javascript.wasm"),
+          typescript: join3(wasmDir, "tree-sitter-javascript.wasm"),
+          python: join3(wasmDir, "tree-sitter-python.wasm"),
+          rust: join3(wasmDir, "tree-sitter-rust.wasm"),
+          html: join3(wasmDir, "tree-sitter-html.wasm")
         }
       });
     } else {
@@ -36359,7 +36945,7 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
   } else {
     const require2 = createRequire2(import.meta.url);
     const circleIrPkg = require2.resolve("circle-ir/package.json");
-    const wasmBasePath = join(dirname2(circleIrPkg), "dist", "wasm") + "/";
+    const wasmBasePath = join2(dirname2(circleIrPkg), "dist", "wasm") + "/";
     await initAnalyzer({
       wasmPath: wasmBasePath + "web-tree-sitter.wasm",
       languagePaths: {
@@ -36375,6 +36961,62 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
     });
   }
 }
+function buildProfileSummary(scanRoot, modules, resolvedProfiles) {
+  if (!resolvedProfiles)
+    return;
+  if (modules.length === 0 && resolvedProfiles.size === 0)
+    return;
+  let unknownFileCount = 0;
+  for (const p of resolvedProfiles.values()) {
+    if (p === "unknown")
+      unknownFileCount++;
+  }
+  return {
+    scanRoot,
+    modules: modules.map((m) => ({
+      root: relative3(scanRoot, m.module.root) || ".",
+      profile: m.profile,
+      reasons: m.reasons,
+      buildSystem: m.module.buildSystem
+    })),
+    unknownFileCount
+  };
+}
+function summarizeModules(modules) {
+  if (modules.length === 0)
+    return "no build files detected";
+  const counts = new Map;
+  for (const m of modules) {
+    counts.set(m.profile, (counts.get(m.profile) ?? 0) + 1);
+  }
+  const parts2 = [...counts.entries()].map(([profile, count]) => `${profile}×${count}`).sort();
+  return `${modules.length} module(s): ${parts2.join(", ")}`;
+}
+function printProfileExplain(scanRoot, detection) {
+  const out2 = [];
+  out2.push(colors.bold("Project profile detection"));
+  out2.push(`  Scan root: ${scanRoot}`);
+  out2.push(`  Modules:   ${detection.modules.length}`);
+  out2.push(`  Unknown files (no enclosing module): ${detection.unknownFiles.length}`);
+  out2.push("");
+  if (detection.modules.length === 0) {
+    out2.push("  (no pom.xml, build.gradle, or build.gradle.kts found)");
+  } else {
+    for (const r of detection.modules) {
+      const rel = relative3(scanRoot, r.module.root) || ".";
+      out2.push(`  ${colors.cyan(rel || ".")}  →  ${colors.bold(r.profile)}`);
+      out2.push(`     build: ${r.module.buildSystem}  (${relative3(scanRoot, r.module.buildFile)})`);
+      if (r.module.artifactId) {
+        out2.push(`     coords: ${r.module.groupId ?? "?"}:${r.module.artifactId}:${r.module.version ?? "?"}`);
+      }
+      out2.push(`     reasons: ${r.reasons.join(" → ")}`);
+      out2.push("");
+    }
+  }
+  process.stderr.write(out2.join(`
+`) + `
+`);
+}
 async function runScan(targetPath, options) {
   const spin = options.quiet ? null : spinner("Initializing analyzer...").start();
   const config = loadConfig(options.profile);
@@ -36428,8 +37070,39 @@ async function runScan(targetPath, options) {
     }
     let results;
     let crossFileData;
-    const analyzeOpts = { passOptions, disabledPasses };
-    if ((await stat(absPath)).isDirectory()) {
+    const forcedProfile = options.projectProfile ?? config?.profile;
+    const profileOverrides = config?.profileOverrides;
+    const detectionEnabled = !options.noProjectProfile && (await stat2(absPath)).isDirectory();
+    let resolvedProfiles;
+    let detectedModules = [];
+    if (detectionEnabled) {
+      if (spin)
+        spin.text = "Detecting project profile...";
+      const detection = await detectProjectProfiles(absPath, {
+        forcedProfile,
+        overrides: profileOverrides
+      });
+      resolvedProfiles = detection.profileByFile;
+      detectedModules = detection.modules;
+      if (options.projectProfileExplain) {
+        if (spin)
+          spin.stop();
+        printProfileExplain(absPath, detection);
+        return;
+      }
+      if (!options.quiet && detectedModules.length > 0) {
+        const summary = summarizeModules(detectedModules);
+        console.error(colors.dim(`Project profile: ${summary}`));
+      }
+    } else if (forcedProfile && !options.noProjectProfile) {
+      resolvedProfiles = undefined;
+    }
+    const analyzeOpts = {
+      passOptions,
+      disabledPasses,
+      ...resolvedProfiles ? { projectProfile: resolvedProfiles } : forcedProfile && !options.noProjectProfile ? { projectProfile: forcedProfile } : {}
+    };
+    if ((await stat2(absPath)).isDirectory()) {
       if (spin)
         spin.text = `Running project analysis on ${files.length} file(s)...`;
       const projectScan = await scanProject(files, options.language, analyzeOpts, options.crossFileBudgetMs);
@@ -36441,7 +37114,7 @@ async function runScan(targetPath, options) {
       results = [];
       let processed = 0;
       const formatCurrentFile = (file) => {
-        const rel = relative(absPath, file) || file;
+        const rel = relative3(absPath, file) || file;
         return rel.length > 80 ? `...${rel.slice(-77)}` : rel;
       };
       const concurrency = options.threads;
@@ -36539,17 +37212,27 @@ async function runScan(targetPath, options) {
     const errors = results.filter((r) => r.error).length;
     const crossFilePaths = crossFileData?.taintPaths.length ?? 0;
     const shouldOutput = totalVulns > 0 || crossFilePaths > 0 || errors > 0 || options.verbose || options.output || options.format !== "text";
+    const profileSummary = buildProfileSummary(absPath, detectedModules, resolvedProfiles);
+    if (resolvedProfiles) {
+      for (const r of results) {
+        const p = resolvedProfiles.get(r.file);
+        if (!p || p === "unknown")
+          continue;
+        for (const v of r.vulnerabilities)
+          v.profile = p;
+      }
+    }
     if (shouldOutput) {
       let output;
       switch (options.format) {
         case "json":
-          output = formatJSON(results, crossFileData);
+          output = formatJSON(results, crossFileData, profileSummary);
           break;
         case "sarif":
-          output = formatSARIF(results, crossFileData);
+          output = formatSARIF(results, crossFileData, profileSummary);
           break;
         default:
-          output = formatResults(results, options.verbose, crossFileData);
+          output = formatResults(results, options.verbose, crossFileData, profileSummary);
       }
       if (options.output) {
         const { writeFileSync } = await import("fs");
@@ -36635,7 +37318,7 @@ async function runMetrics(targetPath, options) {
         continue;
       }
       if (spin) {
-        const rel = relative(absPath, file) || file;
+        const rel = relative3(absPath, file) || file;
         const maxLen = 80;
         const label = rel.length > maxLen ? `...${rel.slice(-(maxLen - 3))}` : rel;
         spin.text = `Analyzing ${label}... (${processed}/${totalFiles})`;
@@ -36680,7 +37363,7 @@ async function runMetrics(targetPath, options) {
     } else {
       const lines = [];
       for (const fm of filtered) {
-        const rel = relative(absPath, fm.file) || fm.file;
+        const rel = relative3(absPath, fm.file) || fm.file;
         lines.push(rel);
         const byCategory = new Map;
         for (const m of fm.metrics) {
@@ -36836,6 +37519,21 @@ function applyFindingsInstrumentation() {
     setFindingsInstrumentation(true);
   }
 }
+function parseProjectProfileArg(raw) {
+  if (raw === undefined || raw === true || raw === "")
+    return;
+  const s = String(raw).toLowerCase();
+  if (s === "unknown")
+    return "unknown";
+  const m = /^(library|application|cli|server|plugin)\/(production|dev|sample|benchmark|test)$/.exec(s);
+  if (!m) {
+    console.error(colors.yellow(`Warning: invalid --project-profile "${s}" — expected one of:
+` + `  {library,application,cli,server,plugin}/{production,dev,sample,benchmark,test}
+  or "unknown". Falling back to auto-detection.`));
+    return;
+  }
+  return s;
+}
 function parseCrossFileBudgetMs(raw) {
   if (raw === undefined || raw === true || raw === "")
     return;
@@ -36908,7 +37606,10 @@ Usage: cognium-dev scan <path> [options]`);
       excludeCwe: options["exclude-cwe"],
       profile: options.profile || options.p,
       disablePass: options["disable-pass"],
-      crossFileBudgetMs: parseCrossFileBudgetMs(options["cross-file-budget-ms"])
+      crossFileBudgetMs: parseCrossFileBudgetMs(options["cross-file-budget-ms"]),
+      projectProfile: parseProjectProfileArg(options["project-profile"]),
+      noProjectProfile: options["no-project-profile"] === true,
+      projectProfileExplain: options["project-profile-explain"] === true
     };
     await runScan(targetPath, scanOptions);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.105.0",
+  "version": "3.106.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.105.0"
+    "circle-ir": "^3.106.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",