cognium-dev 3.90.0 → 3.91.0

package/README.md

@@ -213,6 +213,33 @@ Found 2 vulnerability(ies) in 1 file(s)
 
 Use `-v` flag to see all scanned files including clean ones.
 
+### Output streams (stdout vs stderr)
+
+`cognium-dev` follows the standard CLI convention: machine-readable payload on **stdout**, diagnostics on **stderr**.
+
+| Output | Stream | Notes |
+|--------|--------|-------|
+| `--format json` document | **stdout** | Pure JSON starting at character 1. No banner, no preamble. Safe to pipe directly to `jq`, `json_pp`, etc. |
+| `--format sarif` document | **stdout** | Pure SARIF 2.1.0 JSON. Same contract as `--format json`. |
+| `--format text` report | **stdout** | The human-readable report (default). |
+| Status lines (`Loaded config: …`, `Suppressed N finding(s) …`, `Results written to …`) | **stderr** | |
+| Spinner animation and final status (`✔ Scanned N file(s)`) | **stderr** | |
+| Error messages and usage hints | **stderr** | |
+| Library log output (cross-file phase markers, budget warnings, etc.) | **stderr** | Silent by default; enable with `--log-level <level>` or `COGNIUM_LOG_LEVEL`. |
+| Findings instrumentation (`CIRCLE_IR_INSTRUMENT_FINDINGS=1`) | **stderr** | JSONL `[finding] …` / `[findings-summary] …` lines. |
+
+The stdout contract for `--format json` and `--format sarif` is **stable**: pure parseable payload, version included inside the JSON object (not as a stdout preamble). Consumers can safely pipe stdout to a parser without skip-the-first-line idioms.
+
+```bash
+# Safe — stdout is pure JSON
+cognium-dev scan ./src --format json | jq '.summary'
+
+# Status lines and warnings on stderr, JSON on stdout
+cognium-dev scan ./src --format json > results.json 2> scan.log
+```
+
+If you previously relied on a `tail -n +2` or `split("\n",1)[1]` idiom against pre-3.89.2 builds, drop it — there is no longer a stdout banner to skip.
+
 ## Detected Vulnerabilities
 
 | Type | CWE | Severity | Description |

package/dist/cli.js

@@ -15075,8 +15075,17 @@ class AnalysisPipeline {
         return findings;
       }
     };
+    const timingEnabled = globalThis.__circleIrPassTiming === true;
     for (const pass of this.passes) {
+      if (timingEnabled) {
+        console.error(`[pass-start] ${pass.name} file=${graph.ir.meta.file}`);
+      }
+      const t0 = timingEnabled ? Date.now() : 0;
       const result = pass.run(context);
+      if (timingEnabled) {
+        const dt = Date.now() - t0;
+        console.error(`[pass-timing] ${pass.name} ${dt}ms file=${graph.ir.meta.file}`);
+      }
       results.set(pass.name, result);
     }
     return { results, findings };
@@ -15857,6 +15866,7 @@ class ConstantPropagator {
   inConstructor = false;
   constructorParamPositions = new Map;
   safePatternFieldsCache = null;
+  isTaintedExpressionCache = null;
   analyze(tree, sourceCode, additionalTaintPatterns = [], sanitizerMethods = [], taintedParameters = []) {
     this.source = sourceCode;
     this.additionalTaintPatterns = additionalTaintPatterns;
@@ -15888,6 +15898,7 @@ class ConstantPropagator {
     this.inConstructor = false;
     this.constructorParamPositions.clear();
     this.safePatternFieldsCache = null;
+    this.isTaintedExpressionCache = null;
     this.collectClassFields(tree.rootNode);
     for (const methodName of sanitizerMethods) {
       this.methodReturnsSanitized.add(methodName);
@@ -17237,18 +17248,52 @@ class ConstantPropagator {
     return null;
   }
   isTaintedExpression(node) {
+    const isTopLevel = this.isTaintedExpressionCache === null;
+    if (isTopLevel) {
+      this.isTaintedExpressionCache = new Map;
+    }
+    try {
+      return this.isTaintedExpressionImpl(node);
+    } finally {
+      if (isTopLevel) {
+        this.isTaintedExpressionCache = null;
+      }
+    }
+  }
+  isTaintedExpressionImpl(node) {
+    const cache = this.isTaintedExpressionCache;
+    const rootId = node.id;
+    const cachedRoot = cache.get(rootId);
+    if (cachedRoot !== undefined) {
+      return cachedRoot;
+    }
     const stack = [node];
     while (stack.length > 0) {
       const current = stack.pop();
+      const currentId = current.id;
+      const cached = cache.get(currentId);
+      if (cached !== undefined) {
+        if (cached) {
+          cache.set(rootId, true);
+          return true;
+        }
+        continue;
+      }
       const result = this.isTaintedExpressionStep(current);
-      if (result === true)
+      if (result === true) {
+        cache.set(currentId, true);
+        cache.set(rootId, true);
         return true;
-      if (result === false)
+      }
+      if (result === false) {
+        cache.set(currentId, false);
         continue;
+      }
       for (let i2 = current.children.length - 1;i2 >= 0; i2--) {
         stack.push(current.children[i2]);
       }
     }
+    cache.set(rootId, false);
     return false;
   }
   isTaintedExpressionStep(node) {
@@ -24956,6 +25001,9 @@ var TIER_1_METHOD_ANNOTATIONS = new Set([
 var TIER_1_CLASS_ANNOTATIONS = new Set([
   "RestController",
   "Controller",
+  "Service",
+  "Repository",
+  "Component",
   "Path",
   "WebServlet",
   "ServerEndpoint",
@@ -34472,7 +34520,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.90.0";
+var version = "3.91.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.90.0",
+  "version": "3.91.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.90.0"
+    "circle-ir": "^3.91.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",