cognium-dev 3.85.1 → 3.89.2

package/dist/cli.js

@@ -12112,6 +12112,19 @@ function argIsClassLiteral(call, position) {
     return false;
   return CLASS_LITERAL_RE.test(expr);
 }
+var CWE_78_RECEIVER_ALLOWLIST = new Set([
+  "Runtime",
+  "ProcessBuilder",
+  "Process",
+  "CommandLine",
+  "DefaultExecutor",
+  "Executor",
+  "Exec",
+  "Launcher",
+  "ProcStarter",
+  "ProcessExecutor",
+  "RuntimeUtil"
+]);
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
   const sinkMap = new Map;
   for (const call of calls) {
@@ -12132,6 +12145,18 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (pattern.safe_if_class_literal_at !== undefined && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
+        if (pattern.type === "command_injection") {
+          if (call.is_constructor) {
+            if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {
+              continue;
+            }
+          } else {
+            const receiverClass = call.receiver_type;
+            if (receiverClass && !CWE_78_RECEIVER_ALLOWLIST.has(receiverClass)) {
+              continue;
+            }
+          }
+        }
         const location = formatCallLocation(call);
         const key = `${location}:${call.location.line}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);
@@ -18456,11 +18481,14 @@ var LOG_LEVELS = {
   fatal: 5,
   silent: 6
 };
-var currentLevel = "info";
+var currentLevel = "silent";
 var customLogger = null;
 function shouldLog(level) {
   return LOG_LEVELS[level] >= LOG_LEVELS[currentLevel];
 }
+function setLogLevel(level) {
+  currentLevel = level;
+}
 var logger = {
   trace: (msg, obj) => {
     if (customLogger) {
@@ -18484,7 +18512,7 @@ var logger = {
       return;
     }
     if (shouldLog("info"))
-      console.log(obj ? `[INFO] ${msg} ${JSON.stringify(obj)}` : `[INFO] ${msg}`);
+      console.error(obj ? `[INFO] ${msg} ${JSON.stringify(obj)}` : `[INFO] ${msg}`);
   },
   warn: (msg, obj) => {
     if (customLogger) {
@@ -19352,7 +19380,88 @@ class SymbolTable {
   }
 }
 // ../circle-ir/dist/resolution/cross-file.js
+function buildFileIndex(ir) {
+  const callsByLine = new Map;
+  for (const c of ir.calls) {
+    const ln = c.location.line;
+    let arr = callsByLine.get(ln);
+    if (!arr) {
+      arr = [];
+      callsByLine.set(ln, arr);
+    }
+    arr.push(c);
+  }
+  const defsByLine = new Map;
+  for (const d of ir.dfg.defs) {
+    let arr = defsByLine.get(d.line);
+    if (!arr) {
+      arr = [];
+      defsByLine.set(d.line, arr);
+    }
+    arr.push(d);
+  }
+  const usesByLine = new Map;
+  for (const u of ir.dfg.uses) {
+    let arr = usesByLine.get(u.line);
+    if (!arr) {
+      arr = [];
+      usesByLine.set(u.line, arr);
+    }
+    arr.push(u);
+  }
+  const callsSorted = [...ir.calls].sort((a, b) => a.location.line - b.location.line);
+  const sinksSorted = [...ir.taint.sinks].sort((a, b) => a.line - b.line);
+  const defsSorted = [...ir.dfg.defs].sort((a, b) => a.line - b.line);
+  const callsByMethod = new Map;
+  const sinksByMethod = new Map;
+  const defsByMethod = new Map;
+  for (const type of ir.types) {
+    for (const method of type.methods) {
+      const start2 = method.start_line;
+      const end = method.end_line;
+      const inCalls = [];
+      for (const c of callsSorted) {
+        const ln = c.location.line;
+        if (ln < start2)
+          continue;
+        if (ln > end)
+          break;
+        inCalls.push(c);
+      }
+      callsByMethod.set(method, inCalls);
+      const inSinks = [];
+      for (const s of sinksSorted) {
+        if (s.line < start2)
+          continue;
+        if (s.line > end)
+          break;
+        inSinks.push(s);
+      }
+      sinksByMethod.set(method, inSinks);
+      const inDefs = [];
+      for (const d of defsSorted) {
+        if (d.line < start2)
+          continue;
+        if (d.line > end)
+          break;
+        inDefs.push(d);
+      }
+      defsByMethod.set(method, inDefs);
+    }
+  }
+  return { callsByLine, defsByLine, usesByLine, callsByMethod, sinksByMethod, defsByMethod };
+}
+
 class CrossFileResolver {
+  fileIndexes = new WeakMap;
+  getFileIndex(ir) {
+    let idx = this.fileIndexes.get(ir);
+    if (idx)
+      return idx;
+    idx = buildFileIndex(ir);
+    this.fileIndexes.set(ir, idx);
+    return idx;
+  }
   symbolTable;
   typeHierarchy;
   fileIRs = new Map;
@@ -19807,7 +19916,8 @@ class CrossFileResolver {
           }
           if (!targetMethod)
             continue;
-          const sinksInMethod = targetIR.taint.sinks.filter((s) => s.line >= targetMethod.start_line && s.line <= targetMethod.end_line);
+          const targetIdx = this.getFileIndex(targetIR);
+          const sinksInMethod = targetIdx.sinksByMethod.get(targetMethod) ?? [];
           if (sinksInMethod.length === 0)
             continue;
           for (const sink of sinksInMethod) {
@@ -19836,6 +19946,7 @@ class CrossFileResolver {
     const seen = new Set;
     const methodIndex = this.buildMethodIndex();
     for (const [callerFile, callerIR] of this.fileIRs) {
+      const callerIdx = this.getFileIndex(callerIR);
       for (const type of callerIR.types) {
         for (const method of type.methods) {
           const tainted = new Map;
@@ -19853,7 +19964,7 @@ class CrossFileResolver {
               hopChain: [{ file: callerFile, line: src.line, method: method.name, kind: "source" }]
             });
           }
-          const callsInMethod = callerIR.calls.filter((c) => c.location.line >= method.start_line && c.location.line <= method.end_line).sort((a, b) => a.location.line - b.location.line);
+          const callsInMethod = callerIdx.callsByMethod.get(method) ?? [];
           for (const call of callsInMethod) {
             const resolved = this.resolveCall(call, callerFile);
             if (!resolved)
@@ -19867,7 +19978,7 @@ class CrossFileResolver {
               const sourceLine = calleeSourceLine ?? call.location.line;
               const sourceFile = callee.file;
               const sourceType = callee.sourceType;
-              const defsAtLine = callerIR.dfg.defs.filter((d) => d.line === call.location.line && d.kind === "local");
+              const defsAtLine = (callerIdx.defsByLine.get(call.location.line) ?? []).filter((d) => d.kind === "local");
               for (const def of defsAtLine) {
                 if (!def.variable)
                   continue;
@@ -19895,7 +20006,8 @@ class CrossFileResolver {
               const calleeNode = methodIndex.get(resolved.targetMethod);
               if (!calleeNode)
                 continue;
-              const sinksInCallee = calleeNode.ir.taint.sinks.filter((s) => s.line >= calleeNode.method.start_line && s.line <= calleeNode.method.end_line);
+              const calleeIdx = this.getFileIndex(calleeNode.ir);
+              const sinksInCallee = calleeIdx.sinksByMethod.get(calleeNode.method) ?? [];
               for (const sink of sinksInCallee) {
                 const key = `${matched.origin.file}:${matched.origin.line}→${callee.file}:${sink.line}`;
                 if (seen.has(key))
@@ -19926,9 +20038,9 @@ class CrossFileResolver {
             }
           }
           if (tainted.size > 0) {
-            const sinksInCaller = callerIR.taint.sinks.filter((s) => s.line >= method.start_line && s.line <= method.end_line);
+            const sinksInCaller = callerIdx.sinksByMethod.get(method) ?? [];
             for (const sink of sinksInCaller) {
-              const callsAtSink = callerIR.calls.filter((c) => c.location.line === sink.line);
+              const callsAtSink = callerIdx.callsByLine.get(sink.line) ?? [];
               for (const sinkCall of callsAtSink) {
                 for (const arg of sinkCall.arguments ?? []) {
                   const matched = this.matchTaintedArg(arg, tainted);
@@ -19975,6 +20087,7 @@ class CrossFileResolver {
     const fieldExprRe = /^(\w+)\.(\w+)$/;
     const methodIndex = this.buildMethodIndex();
     for (const [callerFile, callerIR] of this.fileIRs) {
+      const callerIdx = this.getFileIndex(callerIR);
       for (const type of callerIR.types) {
         const callerTypeFqn = callerIR.meta.package ? `${callerIR.meta.package}.${type.name}` : type.name;
         for (const method of type.methods) {
@@ -19993,9 +20106,9 @@ class CrossFileResolver {
               hopChain: [{ file: callerFile, line: src.line, method: method.name, kind: "source" }]
             });
           }
-          const defsInMethod = callerIR.dfg.defs.filter((d) => d.kind === "local" && d.line >= method.start_line && d.line <= method.end_line && !!d.variable);
+          const defsInMethod = (callerIdx.defsByMethod.get(method) ?? []).filter((d) => d.kind === "local" && !!d.variable);
           for (const def of defsInMethod) {
-            const usesAtLine = callerIR.dfg.uses.filter((u) => u.line === def.line);
+            const usesAtLine = callerIdx.usesByLine.get(def.line) ?? [];
             if (usesAtLine.length < 2)
               continue;
             let receiver = null;
@@ -20076,9 +20189,9 @@ class CrossFileResolver {
           }
           if (tainted.size === 0)
             continue;
-          const sinksInCaller = callerIR.taint.sinks.filter((s) => s.line >= method.start_line && s.line <= method.end_line);
+          const sinksInCaller = callerIdx.sinksByMethod.get(method) ?? [];
           for (const sink of sinksInCaller) {
-            const callsAtSink = callerIR.calls.filter((c) => c.location.line === sink.line);
+            const callsAtSink = callerIdx.callsByLine.get(sink.line) ?? [];
             for (const sinkCall of callsAtSink) {
               for (const arg of sinkCall.arguments ?? []) {
                 const matched = this.matchTaintedArg(arg, tainted);
@@ -20111,7 +20224,7 @@ class CrossFileResolver {
               }
             }
           }
-          const callsInMethod = callerIR.calls.filter((c) => c.location.line >= method.start_line && c.location.line <= method.end_line).sort((a, b) => a.location.line - b.location.line);
+          const callsInMethod = callerIdx.callsByMethod.get(method) ?? [];
           for (const call of callsInMethod) {
             const resolved = this.resolveCall(call, callerFile);
             if (!resolved)
@@ -20128,7 +20241,8 @@ class CrossFileResolver {
               const calleeNode = methodIndex.get(resolved.targetMethod);
               if (!calleeNode)
                 continue;
-              const sinksInCallee = calleeNode.ir.taint.sinks.filter((s) => s.line >= calleeNode.method.start_line && s.line <= calleeNode.method.end_line);
+              const calleeIdx = this.getFileIndex(calleeNode.ir);
+              const sinksInCallee = calleeIdx.sinksByMethod.get(calleeNode.method) ?? [];
               for (const sink of sinksInCallee) {
                 const key = `fb:${matched.origin.file}:${matched.origin.line}→${callee.file}:${sink.line}`;
                 if (seen.has(key))
@@ -20370,9 +20484,20 @@ class AnalysisPipeline {
 }
 // ../circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
-  run(projectGraph, sourceLines) {
+  run(projectGraph, sourceLines, options = {}) {
     const resolver = projectGraph.resolver;
+    const budgetMs = options.budgetMs ?? 0;
+    const startMs = Date.now();
+    const budgetExceeded = () => budgetMs > 0 && Date.now() - startMs > budgetMs;
+    const fileCount = projectGraph.filePaths.length;
+    logger.info("cross-file: starting", { files: fileCount, budgetMs });
+    const phase1Start = Date.now();
+    logger.debug("cross-file: phase 1/4 starting (findCrossFileTaintFlows)");
     const flows = resolver.findCrossFileTaintFlows();
+    logger.info("cross-file: phase 1/4 done", {
+      flows: flows.length,
+      elapsedMs: Date.now() - phase1Start
+    });
     const taintPaths = flows.flatMap((flow, idx) => {
       const srcLines = sourceLines.get(flow.sourceFile) ?? [];
       const tgtLines = sourceLines.get(flow.targetFile) ?? [];
@@ -20418,11 +20543,59 @@ class CrossFilePass {
         confidence: 0.7
       }];
     });
-    const ipPaths = [
-      ...resolver.findInterproceduralTaintPaths(),
-      ...resolver.findFieldBindingTaintPaths(),
-      ...findCrossInstanceAliasingPaths(projectGraph, sourceLines)
-    ];
+    let exceeded = false;
+    const ipPaths = [];
+    if (budgetExceeded()) {
+      exceeded = true;
+      logger.warn("cross-file: budget exceeded after phase 1/4, skipping phases 2-4", {
+        budgetMs,
+        elapsedMs: Date.now() - startMs,
+        partialPaths: taintPaths.length
+      });
+    } else {
+      const phase2Start = Date.now();
+      logger.debug("cross-file: phase 2/4 starting (findInterproceduralTaintPaths)");
+      const phase2 = resolver.findInterproceduralTaintPaths();
+      ipPaths.push(...phase2);
+      logger.info("cross-file: phase 2/4 done", {
+        paths: phase2.length,
+        elapsedMs: Date.now() - phase2Start
+      });
+    }
+    if (!exceeded && budgetExceeded()) {
+      exceeded = true;
+      logger.warn("cross-file: budget exceeded after phase 2/4, skipping phases 3-4", {
+        budgetMs,
+        elapsedMs: Date.now() - startMs,
+        partialPaths: taintPaths.length + ipPaths.length
+      });
+    } else if (!exceeded) {
+      const phase3Start = Date.now();
+      logger.debug("cross-file: phase 3/4 starting (findFieldBindingTaintPaths)");
+      const phase3 = resolver.findFieldBindingTaintPaths();
+      ipPaths.push(...phase3);
+      logger.info("cross-file: phase 3/4 done", {
+        paths: phase3.length,
+        elapsedMs: Date.now() - phase3Start
+      });
+    }
+    if (!exceeded && budgetExceeded()) {
+      exceeded = true;
+      logger.warn("cross-file: budget exceeded after phase 3/4, skipping phase 4", {
+        budgetMs,
+        elapsedMs: Date.now() - startMs,
+        partialPaths: taintPaths.length + ipPaths.length
+      });
+    } else if (!exceeded) {
+      const phase4Start = Date.now();
+      logger.debug("cross-file: phase 4/4 starting (findCrossInstanceAliasingPaths)");
+      const phase4 = findCrossInstanceAliasingPaths(projectGraph, sourceLines);
+      ipPaths.push(...phase4);
+      logger.info("cross-file: phase 4/4 done", {
+        paths: phase4.length,
+        elapsedMs: Date.now() - phase4Start
+      });
+    }
     for (let i2 = 0;i2 < ipPaths.length; i2++) {
       const p = ipPaths[i2];
       const sinkIR = projectGraph.getIR(p.sink.file);
@@ -20434,7 +20607,7 @@ class CrossFilePass {
       const srcLines = sourceLines.get(p.source.file) ?? [];
       const tgtLines = sourceLines.get(p.sink.file) ?? [];
       const dupId = `${p.source.file}:${p.source.line}→${p.sink.file}:${p.sink.line}`;
-      if (taintPaths.some((tp) => tp.source.file === p.source.file && tp.source.line === p.source.line && tp.sink.file === p.sink.file && tp.sink.line === p.sink.line)) {
+      if (taintPaths.some((tp) => tp.source.file === p.source.file && tp.source.line === p.source.line && tp.sink.file === p.sink.file && tp.sink.line === p.sink.line && tp.sink.type === matchedSink.type)) {
         continue;
       }
       taintPaths.push({
@@ -20494,7 +20667,16 @@ class CrossFilePass {
       }
     }
     const typeHierarchy = projectGraph.typeHierarchy.toTypeHierarchyData();
-    return { crossFileCalls, taintPaths, typeHierarchy };
+    logger.info("cross-file: complete", {
+      totalMs: Date.now() - startMs,
+      paths: taintPaths.length,
+      crossFileCalls: crossFileCalls.length,
+      budgetExceeded: exceeded
+    });
+    const result = { crossFileCalls, taintPaths, typeHierarchy };
+    if (exceeded)
+      result.budgetExceeded = true;
+    return result;
   }
 }
 function findCrossInstanceAliasingPaths(projectGraph, _sourceLines) {
@@ -24680,6 +24862,194 @@ function findTaintBridges2(result) {
   return bridges;
 }
 
+// ../circle-ir/dist/analysis/entry-point-detection.js
+var TIER_1_METHOD_ANNOTATIONS = new Set([
+  "RequestMapping",
+  "GetMapping",
+  "PostMapping",
+  "PutMapping",
+  "DeleteMapping",
+  "PatchMapping",
+  "MessageMapping",
+  "SubscribeMapping",
+  "KafkaListener",
+  "KafkaHandler",
+  "RabbitListener",
+  "RabbitHandler",
+  "JmsListener",
+  "StreamListener",
+  "SqsListener",
+  "SqsHandler",
+  "EventListener",
+  "Scheduled",
+  "Path",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS"
+]);
+var TIER_1_CLASS_ANNOTATIONS = new Set([
+  "RestController",
+  "Controller",
+  "Path",
+  "WebServlet",
+  "ServerEndpoint",
+  "FeignClient"
+]);
+var TIER_1_BY_SUPERTYPE = new Map([
+  ["HttpServlet", new Set(["doGet", "doPost", "doPut", "doDelete", "doHead", "doOptions", "doTrace", "service"])],
+  ["GenericServlet", new Set(["service"])],
+  ["Filter", new Set(["doFilter"])],
+  ["HandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion"])],
+  ["AsyncHandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion", "afterConcurrentHandlingStarted"])],
+  ["CommandLineRunner", new Set(["run"])],
+  ["ApplicationRunner", new Set(["run"])]
+]);
+var TIER_3_CLASS_SUFFIXES = [
+  "Util",
+  "Utils",
+  "Helper",
+  "Helpers"
+];
+var TIER_3_PACKAGE_FRAGMENTS = [
+  ".template.",
+  ".templates.",
+  ".engine.",
+  ".engines."
+];
+var TIER_3_JDK_FACADE_INTERFACES = new Set([
+  "Collection",
+  "List",
+  "Set",
+  "Map",
+  "Queue",
+  "Deque",
+  "SortedSet",
+  "SortedMap",
+  "NavigableSet",
+  "NavigableMap",
+  "Iterator",
+  "Iterable",
+  "ListIterator",
+  "Comparator",
+  "Comparable",
+  "Serializable",
+  "Externalizable",
+  "Cloneable"
+]);
+function classNameLooksLikeUtility(name2) {
+  if (!name2)
+    return false;
+  for (const suffix of TIER_3_CLASS_SUFFIXES) {
+    if (name2.length > suffix.length && name2.endsWith(suffix))
+      return true;
+  }
+  return false;
+}
+function packageLooksLikeTemplateOrEngine(pkg) {
+  if (!pkg)
+    return false;
+  const padded = `.${pkg}.`;
+  for (const frag of TIER_3_PACKAGE_FRAGMENTS) {
+    if (padded.includes(frag))
+      return true;
+  }
+  return false;
+}
+function implementsJdkFacade(t) {
+  if (!t)
+    return false;
+  for (const impl of t.implements ?? []) {
+    if (TIER_3_JDK_FACADE_INTERFACES.has(simpleTypeName(impl)))
+      return true;
+  }
+  return false;
+}
+function classShapeIsLibraryFacade(enclosingType) {
+  if (!enclosingType)
+    return false;
+  if (classNameLooksLikeUtility(enclosingType.name))
+    return true;
+  if (packageLooksLikeTemplateOrEngine(enclosingType.package))
+    return true;
+  if (implementsJdkFacade(enclosingType))
+    return true;
+  return false;
+}
+function annotationsInclude(annotations, targets) {
+  if (!annotations || annotations.length === 0)
+    return false;
+  for (const raw of annotations) {
+    const simple = raw.replace(/^@/, "").replace(/[<(].*$/, "").trim();
+    if (targets.has(simple))
+      return true;
+  }
+  return false;
+}
+function simpleTypeName(ref) {
+  return ref.replace(/<.*$/, "").trim();
+}
+function looksLikeMainMethod(method) {
+  if (method.name !== "main")
+    return false;
+  const params = method.parameters ?? [];
+  if (params.length !== 1)
+    return false;
+  const t = (params[0].type ?? "").replace(/\s+/g, "");
+  return t === "String[]" || t === "String..." || t === "java.lang.String[]";
+}
+function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
+  if (!method.name)
+    return false;
+  if (!enclosingType)
+    return false;
+  const candidates = [];
+  if (enclosingType.extends)
+    candidates.push(simpleTypeName(enclosingType.extends));
+  for (const i2 of enclosingType.implements ?? [])
+    candidates.push(simpleTypeName(i2));
+  for (const supertype of candidates) {
+    const lifecycleMethods = TIER_1_BY_SUPERTYPE.get(supertype);
+    if (lifecycleMethods?.has(method.name))
+      return true;
+  }
+  return false;
+}
+function classifyEntryPointTier(method, enclosingType, ctx) {
+  const language = (ctx.language ?? "").toLowerCase();
+  if (language !== "java")
+    return "TIER_UNKNOWN";
+  if (!method)
+    return "TIER_UNKNOWN";
+  if (classShapeIsLibraryFacade(enclosingType)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (looksLikeMainMethod(method)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_3_LIBRARY_API";
+}
+function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingType, ctx) {
+  if (sourceType !== "interprocedural_param")
+    return false;
+  if (!enclosingMethod)
+    return false;
+  const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
+  return tier === "TIER_3_LIBRARY_API";
+}
+
 // ../circle-ir/dist/analysis/passes/interprocedural-pass.js
 class InterproceduralPass {
   name = "interprocedural";
@@ -24696,6 +25066,15 @@ class InterproceduralPass {
     const additionalSinks = [];
     const additionalFlows = [...taintProp.flows];
     let interprocedural;
+    const methodNameIndex = new Map;
+    for (const type of graph.ir.types ?? []) {
+      for (const method of type.methods ?? []) {
+        if (method.name && !methodNameIndex.has(method.name)) {
+          methodNameIndex.set(method.name, { method, type });
+        }
+      }
+    }
+    const language = graph.ir.meta.language;
     if (sinks.length > 0) {
       const interProc = analyzeInterprocedural2(graph, sources, sinks, sanitizers, {
         taintedVariables: constProp.tainted
@@ -24733,6 +25112,12 @@ class InterproceduralPass {
                 continue;
               if (source.type === "interprocedural_param" && source.confidence < 0.6)
                 continue;
+              if (source.type === "interprocedural_param" && source.in_method) {
+                const enclosing = methodNameIndex.get(source.in_method);
+                if (shouldGateInterproceduralParam(source.type, enclosing?.method, enclosing?.type, { language, types: graph.ir.types })) {
+                  continue;
+                }
+              }
               if (additionalFlows.some((f) => f.source_line === source.line && f.sink_line === sink.line))
                 continue;
               additionalFlows.push({
@@ -29073,6 +29458,20 @@ var CRED_KEYWORD_RE = /\b([A-Za-z_$][\w$]*?(?:password|passwd|secret|api[_-]?key
 var CRED_DYNAMIC_VALUE_RE = /\$\{|process\.env|os\.environ|os\.Getenv|System\.getenv/;
 var CRED_FUNCTION_DECL_RE = /\b(?:function|func|def|fn)\s+\w+\s*\(/;
 var CRED_COMPARISON_RE = /(?:===?|!==?|>=|<=|<>)\s*["'`]/;
+var PROPERTY_KEY_RE = /^[a-z][a-zA-Z0-9_-]*\.[a-zA-Z][a-zA-Z0-9_.-]*$/;
+var PLAIN_IDENTIFIER_RE = /^[a-z][a-zA-Z_]*$/;
+function charClassDiversity(s) {
+  let n = 0;
+  if (/[a-z]/.test(s))
+    n++;
+  if (/[A-Z]/.test(s))
+    n++;
+  if (/[0-9]/.test(s))
+    n++;
+  if (/[^a-zA-Z0-9]/.test(s))
+    n++;
+  return n;
+}
 function isLikelyCredentialAssignment(line) {
   if (CRED_FUNCTION_DECL_RE.test(line))
     return null;
@@ -29091,6 +29490,18 @@ function isLikelyCredentialAssignment(line) {
     return null;
   if (isAllSameChar(value))
     return null;
+  if (value.length < 12)
+    return null;
+  if (shannonEntropy(value) < 3.5)
+    return null;
+  if (charClassDiversity(value) < 2)
+    return null;
+  if (PROPERTY_KEY_RE.test(value))
+    return null;
+  if (PLAIN_IDENTIFIER_RE.test(value))
+    return null;
+  if (/^[0-9]+$/.test(value) && value.length < 16)
+    return null;
   return { name: name2, value };
 }
 var STRING_LITERAL_RE = /(["'`])((?:\\.|(?!\1).){8,200})\1/g;
@@ -33916,7 +34327,8 @@ async function analyzeProject(files, options = {}) {
     sourceLinesByFile.set(filePath, code.split(`
 `));
   }
-  const crossFileResult = new CrossFilePass().run(projectGraph, sourceLinesByFile);
+  const crossFileBudgetMs = options.crossFileBudgetMs ?? 300000;
+  const crossFileResult = new CrossFilePass().run(projectGraph, sourceLinesByFile, { budgetMs: crossFileBudgetMs });
   const disabledPasses = options.disabledPasses ?? [];
   if (!disabledPasses.includes("security-headers")) {
     const inheritedFindings = checkInheritedCorsHeaders(fileAnalyses, projectGraph.typeHierarchy, sourceLinesByFile);
@@ -33946,7 +34358,7 @@ async function analyzeProject(files, options = {}) {
     total_loc: totalLoc,
     analyzed_at: new Date().toISOString()
   };
-  return {
+  const projectAnalysis = {
     meta,
     files: fileAnalyses,
     type_hierarchy: crossFileResult.typeHierarchy,
@@ -33954,6 +34366,10 @@ async function analyzeProject(files, options = {}) {
     taint_paths: crossFileResult.taintPaths,
     findings: []
   };
+  if (crossFileResult.budgetExceeded) {
+    projectAnalysis.cross_file_budget_exceeded = true;
+  }
+  return projectAnalysis;
 }
 function deriveProjectName(paths) {
   if (paths.length === 0)
@@ -33993,7 +34409,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.85.1";
+var version = "3.89.2";
 
 // src/formatters.ts
 var SINK_SEVERITY = {
@@ -34354,6 +34770,11 @@ function formatResults(results, verbose, crossFileData) {
     lines.push("");
     lines.push(formatCrossFilePaths(crossFileData.taintPaths));
   }
+  if (crossFileData?.budgetExceeded) {
+    lines.push("");
+    lines.push(colors.yellow("⚠ Cross-file budget exceeded — some cross-file taint paths may be missing."));
+    lines.push(colors.yellow("  Raise the limit via the `crossFileBudgetMs` analyzer option (default 300000ms)."));
+  }
   return lines.join(`
 `);
 }
@@ -34368,11 +34789,13 @@ function formatJSON(results, crossFileData) {
     })),
     cross_file_taint_paths: crossFileData?.taintPaths ?? [],
     cross_file_calls: crossFileData?.crossFileCalls ?? [],
+    cross_file_budget_exceeded: crossFileData?.budgetExceeded ?? false,
     summary: {
       filesScanned: results.length,
       filesWithVulnerabilities: results.filter((r) => r.vulnerabilities.length > 0).length,
       totalVulnerabilities: results.reduce((sum, r) => sum + r.vulnerabilities.length, 0),
       crossFileTaintPaths: crossFileData?.taintPaths.length ?? 0,
+      crossFileBudgetExceeded: crossFileData?.budgetExceeded ?? false,
       errors: results.filter((r) => r.error).length
     }
   };
@@ -34568,6 +34991,13 @@ SCAN OPTIONS:
   -o, --output <file>        Write results to file
   -q, --quiet                Suppress progress output
   -v, --verbose              Show detailed output
+  --log-level <level>        circle-ir logger level (silent|trace|debug|info|warn|error|fatal)
+                               [default: silent — also settable via COGNIUM_LOG_LEVEL env var]
+  --cross-file-budget-ms <n> Wall-time budget (ms) for the cross-file phase
+                               [default: 300000 (5 min) — 0 = unlimited]
+                               On exceed: partial taint paths kept, remaining
+                               cross-file phases skipped, cross_file_budget_exceeded
+                               surfaced in output (text warning / JSON / SARIF field).
 
 METRICS OPTIONS:
   -l, --language <lang>      Analyze only files for language (bash|go|html|java|javascript|typescript|python|rust)
@@ -34590,6 +35020,10 @@ EXAMPLES:
   cognium-dev scan . --exclude-cwe CWE-330,CWE-327
   cognium-dev scan . --disable-pass naming-convention,todo-in-prod
   cognium-dev scan . --profile custom-config.json
+  cognium-dev scan . --log-level info        # phase markers to stderr
+  COGNIUM_LOG_LEVEL=debug cognium-dev scan . # verbose via env var
+  cognium-dev scan . --cross-file-budget-ms 60000   # 60s cross-file cap
+  cognium-dev scan . --cross-file-budget-ms 0       # unlimited (pre-3.89.0 behaviour)
   cognium-dev metrics src/
   cognium-dev metrics src/ --category complexity
   cognium-dev metrics src/ --format json --profile custom-config.json
@@ -34619,10 +35053,10 @@ class Spinner {
   enabled;
   constructor(text) {
     this._text = text;
-    this.enabled = Boolean(process.stdout.isTTY);
+    this.enabled = Boolean(process.stderr.isTTY);
   }
   render(frame) {
-    process.stdout.write(`\r\x1B[K${frame} ${this._text}`);
+    process.stderr.write(`\r\x1B[K${frame} ${this._text}`);
   }
   start() {
     if (this.isSpinning)
@@ -34631,7 +35065,7 @@ class Spinner {
       return this;
     this.isSpinning = true;
     this.frameIndex = 0;
-    process.stdout.write("\x1B[?25l");
+    process.stderr.write("\x1B[?25l");
     this.render(SPINNER_FRAMES[this.frameIndex]);
     this.intervalId = setInterval(() => {
       this.frameIndex = (this.frameIndex + 1) % SPINNER_FRAMES.length;
@@ -34648,26 +35082,26 @@ class Spinner {
       this.intervalId = undefined;
     }
     this.isSpinning = false;
-    process.stdout.write("\r\x1B[K");
-    process.stdout.write("\x1B[?25h");
+    process.stderr.write("\r\x1B[K");
+    process.stderr.write("\x1B[?25h");
     return this;
   }
   succeed(text) {
     this.stop();
     const message = text || this._text;
-    console.log(`\x1B[32m${CHECKMARK}\x1B[0m ${message}`);
+    console.error(`\x1B[32m${CHECKMARK}\x1B[0m ${message}`);
     return this;
   }
   fail(text) {
     this.stop();
     const message = text || this._text;
-    console.log(`\x1B[31m${CROSS}\x1B[0m ${message}`);
+    console.error(`\x1B[31m${CROSS}\x1B[0m ${message}`);
     return this;
   }
   warn(text) {
     this.stop();
     const message = text || this._text;
-    console.log(`\x1B[33m${WARNING}\x1B[0m ${message}`);
+    console.error(`\x1B[33m${WARNING}\x1B[0m ${message}`);
     return this;
   }
   set text(value) {
@@ -34897,7 +35331,7 @@ async function scanFile(filePath, language, analyzeOpts) {
     };
   }
 }
-async function scanProject(files, language, analyzeOpts) {
+async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
   const filesWithCode = files.map((f) => ({
     code: readFileSync(f, "utf-8"),
     filePath: f,
@@ -34905,7 +35339,8 @@ async function scanProject(files, language, analyzeOpts) {
   }));
   const projectResult = await analyzeProject(filesWithCode, {
     passOptions: analyzeOpts?.passOptions,
-    disabledPasses: analyzeOpts?.disabledPasses
+    disabledPasses: analyzeOpts?.disabledPasses,
+    ...crossFileBudgetMs !== undefined ? { crossFileBudgetMs } : {}
   });
   const results = projectResult.files.map(({ file, analysis }) => {
     const vulnerabilities = (analysis.taint.flows || []).map((flow) => ({
@@ -34933,7 +35368,8 @@ async function scanProject(files, language, analyzeOpts) {
     results,
     crossFileData: {
       taintPaths: projectResult.taint_paths,
-      crossFileCalls: projectResult.cross_file_calls
+      crossFileCalls: projectResult.cross_file_calls,
+      budgetExceeded: projectResult.cross_file_budget_exceeded === true
     }
   };
 }
@@ -35028,7 +35464,7 @@ async function runScan(targetPath, options) {
     disabledPasses = converted.disabledPasses;
     suppressions = config.suppressions ?? [];
     if (!options.quiet) {
-      console.log(colors.dim(`Loaded config: ${options.profile || "cognium.config.json"}`));
+      console.error(colors.dim(`Loaded config: ${options.profile || "cognium.config.json"}`));
     }
   }
   if (options.disablePass) {
@@ -35073,7 +35509,7 @@ async function runScan(targetPath, options) {
     if ((await stat(absPath)).isDirectory()) {
       if (spin)
         spin.text = `Running project analysis on ${files.length} file(s)...`;
-      const projectScan = await scanProject(files, options.language, analyzeOpts);
+      const projectScan = await scanProject(files, options.language, analyzeOpts, options.crossFileBudgetMs);
       results = projectScan.results;
       crossFileData = projectScan.crossFileData;
     } else {
@@ -35112,7 +35548,7 @@ async function runScan(targetPath, options) {
       results = applySuppressionsToResults(results, suppressions, process.cwd());
       const afterCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0);
       if (!options.quiet && beforeCount !== afterCount) {
-        console.log(colors.dim(`Suppressed ${beforeCount - afterCount} finding(s) via config`));
+        console.error(colors.dim(`Suppressed ${beforeCount - afterCount} finding(s) via config`));
       }
     }
     const severityOrder = ["low", "medium", "high", "critical"];
@@ -35195,7 +35631,7 @@ async function runScan(targetPath, options) {
       if (options.output) {
         const { writeFileSync } = await import("fs");
         writeFileSync(options.output, output);
-        console.log(colors.green(`Results written to ${options.output}`));
+        console.error(colors.green(`Results written to ${options.output}`));
       } else if (output.trim()) {
         console.log(output);
       }
@@ -35241,7 +35677,7 @@ async function runMetrics(targetPath, options) {
     passOptions = converted.passOptions;
     disabledPasses = converted.disabledPasses;
     if (!options.quiet) {
-      console.log(colors.dim(`Loaded config: ${options.profile || "cognium.config.json"}`));
+      console.error(colors.dim(`Loaded config: ${options.profile || "cognium.config.json"}`));
     }
   }
   try {
@@ -35349,7 +35785,7 @@ async function runMetrics(targetPath, options) {
     if (options.output) {
       const { writeFileSync } = await import("fs");
       writeFileSync(options.output, output);
-      console.log(colors.green(`Results written to ${options.output}`));
+      console.error(colors.green(`Results written to ${options.output}`));
     } else {
       console.log(output);
     }
@@ -35460,8 +35896,32 @@ async function handleInit() {
   writeFileSync(configPath, JSON.stringify(config, null, 2));
   console.log(colors.green(`Created ${configPath}`));
 }
+function applyLogLevel(cliValue) {
+  const raw = typeof cliValue === "string" && cliValue.length > 0 ? cliValue : process.env.COGNIUM_LOG_LEVEL;
+  if (!raw)
+    return;
+  const valid = ["trace", "debug", "info", "warn", "error", "fatal", "silent"];
+  const normalized = raw.toLowerCase();
+  if (!valid.includes(normalized)) {
+    console.error(colors.yellow(`Warning: invalid log level "${raw}" (expected one of: ${valid.join(", ")}); ignoring`));
+    return;
+  }
+  setLogLevel(normalized);
+}
+function parseCrossFileBudgetMs(raw) {
+  if (raw === undefined || raw === true || raw === "")
+    return;
+  const s = String(raw);
+  const n = Number.parseInt(s, 10);
+  if (!Number.isFinite(n) || n < 0 || String(n) !== s) {
+    console.error(colors.yellow(`Warning: invalid --cross-file-budget-ms "${s}" (expected non-negative integer in ms, 0 = unlimited); ignoring`));
+    return;
+  }
+  return n;
+}
 async function main() {
   const { command, args: args2, options } = parseArgs(process.argv.slice(2));
+  applyLogLevel(options["log-level"]);
   if (options.help || options.h) {
     showHelp();
     return;
@@ -35481,7 +35941,7 @@ async function main() {
   if (command === "metrics") {
     if (args2.length === 0) {
       console.error(colors.red("Error: metrics command requires a path argument"));
-      console.log(`
+      console.error(`
 Usage: cognium-dev metrics <path> [options]`);
       process.exit(1);
     }
@@ -35501,7 +35961,7 @@ Usage: cognium-dev metrics <path> [options]`);
   if (command === "scan") {
     if (args2.length === 0) {
       console.error(colors.red("Error: scan command requires a path argument"));
-      console.log(`
+      console.error(`
 Usage: cognium-dev scan <path> [options]`);
       process.exit(1);
     }
@@ -35518,7 +35978,8 @@ Usage: cognium-dev scan <path> [options]`);
       excludeTests: options["exclude-tests"] === true,
       excludeCwe: options["exclude-cwe"],
       profile: options.profile || options.p,
-      disablePass: options["disable-pass"]
+      disablePass: options["disable-pass"],
+      crossFileBudgetMs: parseCrossFileBudgetMs(options["cross-file-budget-ms"])
     };
     await runScan(targetPath, scanOptions);
     return;
@@ -35527,7 +35988,7 @@ Usage: cognium-dev scan <path> [options]`);
     showHelp();
   } else {
     console.error(colors.red(`Error: Unknown command '${command}'`));
-    console.log(`
+    console.error(`
 Run 'cognium-dev --help' for usage information`);
     process.exit(1);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.85.1",
+  "version": "3.89.2",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.85.1"
+    "circle-ir": "^3.89.1"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",