cognium-dev 3.192.0 → 3.194.0

package/dist/cli.js

@@ -9350,6 +9350,7 @@ var GO_KEYWORDS = new Set([
 function buildGoDFG(tree) {
   const defs = [];
   const uses = [];
+  const extraChains = [];
   let defIdCounter = 1;
   let useIdCounter = 1;
   const scopeStack = [new Map];
@@ -9371,7 +9372,7 @@ function buildGoDFG(tree) {
     }
     const body2 = func2.childForFieldName("body");
     if (body2) {
-      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter });
+      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter }, extraChains);
       defIdCounter = defs.length + 1;
       useIdCounter = uses.length + 1;
     }
@@ -9387,6 +9388,15 @@ function buildGoDFG(tree) {
     }
   }
   const chains = computeChains(defs, uses);
+  const seen = new Set(chains.map((c) => `${c.from_def}|${c.to_def}|${c.via}`));
+  for (const ch of extraChains) {
+    const key = `${ch.from_def}|${ch.to_def}|${ch.via}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      chains.push(ch);
+    }
+  }
+  chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
   return { defs, uses, chains };
 }
 function extractGoParamDefs(params, defs, _startId, scopeStack) {
@@ -9415,28 +9425,51 @@ function extractGoParamDefs(params, defs, _startId, scopeStack) {
     }
   }
 }
-function processGoBlock(node, defs, uses, scopeStack, counters) {
+function processGoBlock(node, defs, uses, scopeStack, counters, extraChains = []) {
+  const linkMultiLineRhs = (right, useStart, useEnd, defStart, defEnd) => {
+    if (right.endPosition.row <= right.startPosition.row)
+      return;
+    for (let ui = useStart;ui < useEnd; ui++) {
+      const u = uses[ui];
+      if (!u || u.def_id === null)
+        continue;
+      for (let di = defStart;di < defEnd; di++) {
+        const d = defs[di];
+        if (d && d.kind === "local" && d.id !== u.def_id) {
+          extraChains.push({ from_def: u.def_id, to_def: d.id, via: u.variable });
+        }
+      }
+    }
+  };
   walkTree(node, (child) => {
     if (child.type === "short_var_declaration") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right)
+        linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "var_declaration") {
       processGoVarDecl(child, defs, scopeStack, counters);
     } else if (child.type === "assignment_statement") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right)
+        linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {
@@ -15947,22 +15980,36 @@ class CrossFileResolver {
         if (source.type === "interprocedural_param")
           continue;
         const sourceVar = source.variable ?? this.getLocalDefVarAt(ir, source.line);
+        const reachable = sourceVar ? this.collectTaintReachable(ir, sourceVar, source.line, filePath) : undefined;
         for (const call of ir.calls) {
           if (call.location.line < source.line)
             continue;
           const resolved = this.resolveCall(call, filePath);
           if (!resolved || resolved.targetFile === filePath)
             continue;
-          if (sourceVar) {
-            const argMentions = call.arguments.some((arg) => {
-              if (arg.variable === sourceVar)
-                return true;
-              if (arg.expression && new RegExp(`\\b${sourceVar}\\b`).test(arg.expression))
-                return true;
-              return false;
-            });
-            if (!argMentions)
+          if (reachable) {
+            let matchedName;
+            for (const arg of call.arguments) {
+              if (arg.variable && reachable.names.has(arg.variable)) {
+                matchedName = arg.variable;
+                break;
+              }
+              if (arg.expression) {
+                for (const v of reachable.names) {
+                  if (new RegExp(`\\b${v}\\b`).test(arg.expression)) {
+                    matchedName = v;
+                    break;
+                  }
+                }
+                if (matchedName)
+                  break;
+              }
+            }
+            if (!matchedName)
+              continue;
+            if (this.taintClobbered(ir, call.location.line, matchedName, reachable.defIds)) {
               continue;
+            }
           }
           const targetIR = this.fileIRs.get(resolved.targetFile);
           if (!targetIR || targetIR.taint.sinks.length === 0)
@@ -16023,7 +16070,8 @@ class CrossFileResolver {
               file: callerFile,
               line: src.line,
               type: src.type,
-              hopChain: [{ file: callerFile, line: src.line, method: method.name, kind: "source" }]
+              hopChain: [{ file: callerFile, line: src.line, method: method.name, kind: "source" }],
+              defIds: this.collectTaintReachable(callerIR, src.variable, src.line, callerFile).defIds
             });
           }
           const callsInMethod = callerIdx.callsByMethod.get(method) ?? [];
@@ -16052,7 +16100,8 @@ class CrossFileResolver {
                   file: sourceFile,
                   line: sourceLine,
                   type: sourceType,
-                  hopChain: baseChain
+                  hopChain: baseChain,
+                  defIds: this.forwardReachableDefs(callerIR, [def.id], callerFile)
                 });
               }
             }
@@ -16065,6 +16114,9 @@ class CrossFileResolver {
               const matched = this.matchTaintedArg(arg, tainted);
               if (!matched)
                 continue;
+              if (this.taintClobbered(callerIR, call.location.line, matched.var, matched.origin.defIds)) {
+                continue;
+              }
               const calleeNode = methodIndex.get(resolved.targetMethod);
               if (!calleeNode)
                 continue;
@@ -16398,6 +16450,62 @@ class CrossFileResolver {
     }
     return;
   }
+  collectTaintReachable(ir, sourceVar, sourceLine, filePath) {
+    const defs = ir.dfg.defs;
+    let seedDefs = defs.filter((d) => d.variable === sourceVar && d.line === sourceLine);
+    if (seedDefs.length === 0) {
+      const named = defs.filter((d) => d.variable === sourceVar).sort((a, b) => a.line - b.line);
+      if (named.length > 0)
+        seedDefs = [named[0]];
+    }
+    const defIds = this.forwardReachableDefs(ir, seedDefs.map((d) => d.id), filePath);
+    const names = new Set([sourceVar]);
+    for (const d of defs) {
+      if (d.variable && defIds.has(d.id))
+        names.add(d.variable);
+    }
+    return { names, defIds };
+  }
+  forwardReachableDefs(ir, seedDefIds, filePath) {
+    const defIds = new Set(seedDefIds);
+    const chains = ir.dfg.chains;
+    if (!chains || chains.length === 0 || seedDefIds.length === 0)
+      return defIds;
+    const lineByDefId = new Map;
+    for (const d of ir.dfg.defs)
+      lineByDefId.set(d.id, d.line);
+    const crossFileCallLines = new Set;
+    for (const call of ir.calls) {
+      const resolved = this.resolveCall(call, filePath);
+      if (resolved && resolved.targetFile !== filePath) {
+        crossFileCallLines.add(call.location.line);
+      }
+    }
+    const frontier = [...seedDefIds];
+    const visited = new Set(frontier);
+    while (frontier.length > 0) {
+      const cur = frontier.shift();
+      for (const ch of chains) {
+        if (ch.from_def !== cur || visited.has(ch.to_def))
+          continue;
+        visited.add(ch.to_def);
+        const toLine = lineByDefId.get(ch.to_def);
+        if (toLine !== undefined && crossFileCallLines.has(toLine))
+          continue;
+        defIds.add(ch.to_def);
+        frontier.push(ch.to_def);
+      }
+    }
+    return defIds;
+  }
+  taintClobbered(ir, callLine, varName, taintDefIds) {
+    if (!taintDefIds || taintDefIds.size === 0)
+      return false;
+    const use = ir.dfg.uses.find((u) => u.line === callLine && u.variable === varName && u.def_id !== null);
+    if (!use || use.def_id === null)
+      return false;
+    return !taintDefIds.has(use.def_id);
+  }
   findRealSourceLineInMethod(ir, method) {
     for (const src of ir.taint.sources) {
       if (src.type === "interprocedural_param")
@@ -33351,6 +33459,375 @@ class DeserializationSafetyGatePass {
   }
 }
 
+// ../circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
+function isDelimiterLiteral(lit) {
+  const s = lit.trim();
+  if (s.length === 0)
+    return true;
+  return /^<\/?[\w.-]+\s*\/?>$/.test(s) || /^\[\/?[\w.-]+\]$/.test(s) || /^`{1,3}[\w-]*$/.test(s) || /^"""[\w-]*$/.test(s) || /^[#*=_~-]{2,}$/.test(s) || /^<{2,}[\w-]*$/.test(s) || /^[\w-]*>{2,}$/.test(s);
+}
+function scanValue(code, start2) {
+  let depth = 0;
+  let str = null;
+  let out2 = "";
+  for (let i2 = start2;i2 < code.length; i2++) {
+    const c = code[i2];
+    if (str) {
+      out2 += c;
+      if (c === str && code[i2 - 1] !== "\\")
+        str = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      str = c;
+      out2 += c;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      out2 += c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0)
+        break;
+      depth--;
+      out2 += c;
+      continue;
+    }
+    if (c === "," && depth === 0)
+      break;
+    out2 += c;
+  }
+  return out2.trim();
+}
+function stringLiterals(expr) {
+  return [...expr.matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => m[1] ?? m[2] ?? "");
+}
+function hasIdentifier(expr) {
+  return /[A-Za-z_$][\w$]*/.test(expr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, " "));
+}
+function isPureLiteral(valueExpr) {
+  const stripped = valueExpr.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, " ");
+  return !/[A-Za-z_$][\w$]*/.test(stripped);
+}
+function isInstructionConcat(valueExpr) {
+  if (!valueExpr.includes("+"))
+    return false;
+  if (!hasIdentifier(valueExpr))
+    return false;
+  const lits = stringLiterals(valueExpr);
+  if (lits.length === 0)
+    return false;
+  return !lits.every(isDelimiterLiteral);
+}
+function isMixedTemplate(v) {
+  const fstr = v.match(/\bf(["'])((?:\\.|(?!\1).)*)\1/);
+  if (fstr) {
+    const body2 = fstr[2];
+    if (/\{[^}]+\}/.test(body2) && /\w/.test(body2.replace(/\{[^}]*\}/g, "")))
+      return true;
+  }
+  const tmpl = v.match(/`([^`]*)`/);
+  if (tmpl) {
+    const body2 = tmpl[1];
+    if (/\$\{[^}]+\}/.test(body2) && /\w/.test(body2.replace(/\$\{[^}]*\}/g, "")))
+      return true;
+  }
+  return false;
+}
+function assignmentRe(varName, flags2 = "") {
+  return new RegExp(`\\b${varName}\\s*(?::=|(?<![=<>!])=(?!=))\\s*`, flags2);
+}
+function resolveAssignmentRHS(varName, codeLines) {
+  const re = assignmentRe(varName);
+  for (const line of codeLines) {
+    const m = line.match(re);
+    if (m && m.index !== undefined) {
+      return scanValue(line, m.index + m[0].length);
+    }
+  }
+  return;
+}
+function classifyExpr(v) {
+  if (isMixedTemplate(v))
+    return "unsafe";
+  if (v.includes("+")) {
+    if (isInstructionConcat(v))
+      return "unsafe";
+    const lits = stringLiterals(v);
+    if (lits.length > 0 && lits.every(isDelimiterLiteral) && hasIdentifier(v))
+      return "safe";
+    return "unknown";
+  }
+  return "unknown";
+}
+function classifyContentPlacement(val, codeLines) {
+  const v = val.trim();
+  if (/^[A-Za-z_$][\w$]*$/.test(v)) {
+    const rhs = resolveAssignmentRHS(v, codeLines);
+    if (rhs === undefined)
+      return "unknown";
+    return classifyExpr(rhs);
+  }
+  return classifyExpr(v);
+}
+function classifyPromptCall(callCode, codeLines) {
+  const contentRe = /["']?[Cc]ontent["']?\s*[:=]\s*/g;
+  let m;
+  let sawDynamic = false;
+  let allSafe = true;
+  while ((m = contentRe.exec(callCode)) !== null) {
+    const val = scanValue(callCode, m.index + m[0].length);
+    if (val === "" || isPureLiteral(val))
+      continue;
+    sawDynamic = true;
+    const ctx = callCode.slice(Math.max(0, m.index - 80), m.index);
+    const roleM = ctx.match(/["']?[Rr]ole["']?\s*[:=]\s*["'](\w+)["'][^"']*$/);
+    const role = roleM ? roleM[1].toLowerCase() : "user";
+    if (role === "system" || role === "assistant")
+      return "unsafe";
+    const placement = classifyContentPlacement(val, codeLines);
+    if (placement === "unsafe")
+      return "unsafe";
+    if (placement !== "safe")
+      allSafe = false;
+  }
+  if (!sawDynamic)
+    return "unknown";
+  return allSafe ? "safe" : "unknown";
+}
+function scanRhsAcrossLines(text, start2) {
+  let depth = 0;
+  let str = null;
+  let out2 = "";
+  for (let i2 = start2;i2 < text.length; i2++) {
+    const c = text[i2];
+    if (str) {
+      out2 += c;
+      if (c === str && text[i2 - 1] !== "\\")
+        str = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      str = c;
+      out2 += c;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      out2 += c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0)
+        break;
+      depth--;
+      out2 += c;
+      continue;
+    }
+    if (c === `
+` && depth === 0)
+      break;
+    out2 += c;
+  }
+  return out2.trim();
+}
+function resolveBuilderRhs(varName, joined) {
+  const re = assignmentRe(varName, "g");
+  const m = re.exec(joined);
+  if (m)
+    return scanRhsAcrossLines(joined, m.index + m[0].length);
+  return;
+}
+function collectBuilderRegion(callCode, joined) {
+  const parts2 = [];
+  const seen = new Set;
+  const stack = [...callCode.matchAll(/[A-Za-z_$][\w$]*/g)].map((x) => x[0]);
+  let budget = 40;
+  while (stack.length > 0 && budget-- > 0) {
+    const v = stack.pop();
+    if (seen.has(v))
+      continue;
+    seen.add(v);
+    const rhs = resolveBuilderRhs(v, joined);
+    if (rhs) {
+      parts2.push(rhs);
+      for (const mm of rhs.matchAll(/[A-Za-z_$][\w$]*/g))
+        stack.push(mm[0]);
+    }
+  }
+  return parts2.join(`
+`);
+}
+function classifyPromptSink(callCode, codeLines) {
+  const direct = classifyPromptCall(callCode, codeLines);
+  if (direct !== "unknown")
+    return direct;
+  const region = collectBuilderRegion(callCode, codeLines.join(`
+`));
+  if (!region)
+    return "unknown";
+  return classifyPromptCall(region, codeLines);
+}
+
+class PromptInjectionSafetyGatePass {
+  name = "prompt-injection-safety-gate";
+  category = "security";
+  run(ctx) {
+    const { graph, code } = ctx;
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0)
+      return { droppedSafe: 0 };
+    const codeLines = code.split(`
+`);
+    let droppedSafe = 0;
+    const kept = sinks.filter((sink) => {
+      if (sink.type !== "prompt_injection")
+        return true;
+      const callCode = sink.code ?? codeLines[sink.line - 1] ?? "";
+      if (!callCode)
+        return true;
+      if (classifyPromptSink(callCode, codeLines) === "safe") {
+        droppedSafe++;
+        return false;
+      }
+      return true;
+    });
+    if (droppedSafe > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { droppedSafe };
+  }
+}
+
+// ../circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
+function returnOrAssignRhs(text) {
+  const t = text.trim();
+  const ret = t.match(/^return\s+(.+?);?$/);
+  if (ret)
+    return ret[1];
+  const asg = t.match(/^[A-Za-z_$][\w$.]*\s*(?::=|(?<![=<>!])=(?!=))\s*(.+?);?$/);
+  if (asg)
+    return asg[1];
+  return;
+}
+function looksLikePromptText(lit) {
+  const s = lit.trim();
+  if (/\b(you are|you're|assistant|system prompt|follow (the )?(policy|instructions|rules)|act as|your task|instructions?\s*:|ignore (all )?previous|do not reveal|respond (to|with|as)|answer the (question|user)|you (must|should|will)|helpful (ai|assistant))\b/i.test(s)) {
+    return true;
+  }
+  const words = s.split(/\s+/).filter(Boolean);
+  return words.length >= 4 && s.length >= 20;
+}
+function literalsOf(expr) {
+  return [...expr.matchAll(/"([^"]*)"|'([^']*)'|`([^`]*)`/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+}
+function detectPromptConstructionFlows(codeLines, types) {
+  const flows = [];
+  const seen = new Set;
+  for (const type of types) {
+    for (const method of type.methods) {
+      const params = (method.parameters ?? []).map((p) => ({ name: p.name, line: p.line ?? method.start_line })).filter((p) => p.name && p.name !== "_");
+      if (params.length === 0)
+        continue;
+      for (let line = method.start_line;line <= method.end_line; line++) {
+        const text = codeLines[line - 1] ?? "";
+        const rhs = returnOrAssignRhs(text);
+        if (!rhs || !isInstructionConcat(rhs))
+          continue;
+        if (!literalsOf(rhs).some(looksLikePromptText))
+          continue;
+        const param = params.find((p) => new RegExp(`\\b${p.name}\\b`).test(rhs));
+        if (!param)
+          continue;
+        const key = `${param.line}|${line}`;
+        if (seen.has(key))
+          continue;
+        seen.add(key);
+        flows.push({
+          source_line: param.line,
+          sink_line: line,
+          source_type: "http_body",
+          sink_type: "prompt_injection",
+          path: [
+            { variable: param.name, line: param.line, type: "source" },
+            { variable: param.name, line, type: "sink" }
+          ],
+          confidence: 1,
+          sanitized: false
+        });
+      }
+    }
+  }
+  return flows;
+}
+function looksLikeTextParam(type) {
+  if (!type)
+    return true;
+  const t = type.trim();
+  if (t.startsWith("*") || t.startsWith("&"))
+    return false;
+  if (/\b(Client|Context|Writer|Reader|Conn|DB|Logger|Handler|Server|Request|Response|Pool|Session|Engine|Service|Repository|Config)\b/.test(t)) {
+    return false;
+  }
+  return /(?:^|\b)(string|str|String|text|any|object|interface\{\}|\[\]byte|\[\]string|List\[str\]|Optional\[str\])(?:\b|$)/i.test(t) || /^[A-Za-z_$][\w$<>[\], |]*$/.test(t);
+}
+
+class SpeculativePromptParamSourcePass {
+  enabled;
+  name = "speculative-prompt-param-source";
+  category = "security";
+  constructor(enabled) {
+    this.enabled = enabled;
+  }
+  run(ctx) {
+    if (!this.enabled)
+      return { added: 0 };
+    if (!ctx.hasResult("sink-filter"))
+      return { added: 0 };
+    const sinkFilter = ctx.getResult("sink-filter");
+    const { types } = ctx.graph.ir;
+    const promptSinks = sinkFilter.sinks.filter((s) => s.type === "prompt_injection");
+    if (promptSinks.length === 0)
+      return { added: 0 };
+    const existing = new Set(sinkFilter.sources.filter((s) => typeof s.variable === "string").map((s) => `${s.variable}:${s.line}`));
+    const added = [];
+    for (const type of types) {
+      for (const method of type.methods) {
+        const hasPromptSink = promptSinks.some((s) => s.line >= method.start_line && s.line <= method.end_line);
+        if (!hasPromptSink)
+          continue;
+        for (const param of method.parameters) {
+          if (!param.name || param.name === "_")
+            continue;
+          if (!looksLikeTextParam(param.type))
+            continue;
+          const line = param.line ?? method.start_line;
+          const key = `${param.name}:${line}`;
+          if (existing.has(key))
+            continue;
+          existing.add(key);
+          added.push({
+            type: "http_body",
+            location: `speculative untrusted parameter '${param.name}' in ${method.name}`,
+            severity: "high",
+            line,
+            confidence: 1,
+            variable: param.name,
+            in_method: method.name
+          });
+        }
+      }
+    }
+    if (added.length > 0) {
+      sinkFilter.sources.push(...added);
+    }
+    return { added: added.length };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
@@ -45059,6 +45536,9 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new SinkSemanticsPass);
     if (!disabledPasses.has("deserialization-safety-gate"))
       pipeline.add(new DeserializationSafetyGatePass(options.dependencyContext));
+    if (!disabledPasses.has("prompt-injection-safety-gate"))
+      pipeline.add(new PromptInjectionSafetyGatePass);
+    pipeline.add(new SpeculativePromptParamSourcePass(options.speculativeParamSources === true));
     if (!disabledPasses.has("cli-main-reflection-suppress"))
       pipeline.add(new CliMainReflectionSuppressPass);
     if (!disabledPasses.has("library-profile-sink-gate"))
@@ -45193,6 +45673,14 @@ async function analyze(code, filePath, language, options = {}) {
       flows: interProc.additionalFlows,
       interprocedural: interProc.interprocedural
     };
+    if (options.speculativeParamSources === true) {
+      const existingFlowKeys = new Set((taint.flows ?? []).map((f) => `${f.source_line}|${f.sink_line}|${f.sink_type}`));
+      const constructionFlows = detectPromptConstructionFlows(code.split(`
+`), types).filter((f) => !existingFlowKeys.has(`${f.source_line}|${f.sink_line}|${f.sink_type}`));
+      if (constructionFlows.length > 0) {
+        taint.flows = [...taint.flows ?? [], ...constructionFlows];
+      }
+    }
     if (taint.flows && taint.flows.length > 0 && taint.sinks.length > 0) {
       const sinkTagsByKey = new Map;
       for (const s of taint.sinks) {
@@ -46004,7 +46492,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.192.0";
+var version = "3.194.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.192.0",
+  "version": "3.194.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.192.0"
+    "circle-ir": "^3.194.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",