cognium-dev 3.90.1 → 3.93.0

package/README.md

@@ -213,6 +213,33 @@ Found 2 vulnerability(ies) in 1 file(s)
 
 Use `-v` flag to see all scanned files including clean ones.
 
+### Output streams (stdout vs stderr)
+
+`cognium-dev` follows the standard CLI convention: machine-readable payload on **stdout**, diagnostics on **stderr**.
+
+| Output | Stream | Notes |
+|--------|--------|-------|
+| `--format json` document | **stdout** | Pure JSON starting at character 1. No banner, no preamble. Safe to pipe directly to `jq`, `json_pp`, etc. |
+| `--format sarif` document | **stdout** | Pure SARIF 2.1.0 JSON. Same contract as `--format json`. |
+| `--format text` report | **stdout** | The human-readable report (default). |
+| Status lines (`Loaded config: …`, `Suppressed N finding(s) …`, `Results written to …`) | **stderr** | |
+| Spinner animation and final status (`✔ Scanned N file(s)`) | **stderr** | |
+| Error messages and usage hints | **stderr** | |
+| Library log output (cross-file phase markers, budget warnings, etc.) | **stderr** | Silent by default; enable with `--log-level <level>` or `COGNIUM_LOG_LEVEL`. |
+| Findings instrumentation (`CIRCLE_IR_INSTRUMENT_FINDINGS=1`) | **stderr** | JSONL `[finding] …` / `[findings-summary] …` lines. |
+
+The stdout contract for `--format json` and `--format sarif` is **stable**: pure parseable payload, version included inside the JSON object (not as a stdout preamble). Consumers can safely pipe stdout to a parser without skip-the-first-line idioms.
+
+```bash
+# Safe — stdout is pure JSON
+cognium-dev scan ./src --format json | jq '.summary'
+
+# Status lines and warnings on stderr, JSON on stdout
+cognium-dev scan ./src --format json > results.json 2> scan.log
+```
+
+If you previously relied on a `tail -n +2` or `split("\n",1)[1]` idiom against pre-3.89.2 builds, drop it — there is no longer a stdout banner to skip.
+
 ## Detected Vulnerabilities
 
 | Type | CWE | Severity | Description |

package/dist/cli.js

@@ -17789,6 +17789,114 @@ function normalizeCondition(cond) {
   }
   return normalized;
 }
+// ../circle-ir/dist/utils/logger.js
+var LOG_LEVELS = {
+  trace: 0,
+  debug: 1,
+  info: 2,
+  warn: 3,
+  error: 4,
+  fatal: 5,
+  silent: 6
+};
+var currentLevel = "silent";
+var customLogger = null;
+function shouldLog(level) {
+  return LOG_LEVELS[level] >= LOG_LEVELS[currentLevel];
+}
+function setLogLevel(level) {
+  currentLevel = level;
+}
+var logger = {
+  trace: (msg, obj) => {
+    if (customLogger) {
+      customLogger.trace(msg, obj);
+      return;
+    }
+    if (shouldLog("trace"))
+      console.debug(obj ? `[TRACE] ${msg} ${JSON.stringify(obj)}` : `[TRACE] ${msg}`);
+  },
+  debug: (msg, obj) => {
+    if (customLogger) {
+      customLogger.debug(msg, obj);
+      return;
+    }
+    if (shouldLog("debug"))
+      console.debug(obj ? `[DEBUG] ${msg} ${JSON.stringify(obj)}` : `[DEBUG] ${msg}`);
+  },
+  info: (msg, obj) => {
+    if (customLogger) {
+      customLogger.info(msg, obj);
+      return;
+    }
+    if (shouldLog("info"))
+      console.error(obj ? `[INFO] ${msg} ${JSON.stringify(obj)}` : `[INFO] ${msg}`);
+  },
+  warn: (msg, obj) => {
+    if (customLogger) {
+      customLogger.warn(msg, obj);
+      return;
+    }
+    if (shouldLog("warn"))
+      console.warn(obj ? `[WARN] ${msg} ${JSON.stringify(obj)}` : `[WARN] ${msg}`);
+  },
+  error: (msg, obj) => {
+    if (customLogger) {
+      customLogger.error(msg, obj);
+      return;
+    }
+    if (shouldLog("error"))
+      console.error(obj ? `[ERROR] ${msg} ${JSON.stringify(obj)}` : `[ERROR] ${msg}`);
+  },
+  fatal: (msg, obj) => {
+    if (customLogger) {
+      customLogger.fatal(msg, obj);
+      return;
+    }
+    if (shouldLog("fatal"))
+      console.error(obj ? `[FATAL] ${msg} ${JSON.stringify(obj)}` : `[FATAL] ${msg}`);
+  },
+  isLevelEnabled: (level) => {
+    return shouldLog(level);
+  }
+};
+
+// ../circle-ir/dist/analysis/per-file-finding-cap.js
+var DEFAULT_PER_FILE_FINDING_CAP = 1000;
+var SATURATED_FILE_RULE_ID = "saturated-file";
+function applyPerFileFindingCap(filePath, findings, cap) {
+  if (cap <= 0)
+    return findings;
+  if (findings.length <= cap)
+    return findings;
+  const suppressedCount = findings.length;
+  const byRule = {};
+  const bySeverity = {};
+  for (const f of findings) {
+    byRule[f.rule_id] = (byRule[f.rule_id] ?? 0) + 1;
+    bySeverity[f.severity] = (bySeverity[f.severity] ?? 0) + 1;
+  }
+  logger.warn(`File ${filePath} produced ${suppressedCount} findings (cap=${cap}); ` + "suppressing individual findings and emitting saturated-file advisory.", { file: filePath, suppressedCount, cap, byRule, bySeverity });
+  const advisory = {
+    id: `${SATURATED_FILE_RULE_ID}-${filePath}-1`,
+    pass: SATURATED_FILE_RULE_ID,
+    category: "maintainability",
+    rule_id: SATURATED_FILE_RULE_ID,
+    severity: "low",
+    level: "note",
+    message: `File suppressed: produced ${suppressedCount} findings, exceeding the ` + `per-file cap of ${cap}. This typically indicates cross-product noise, ` + "mislabelled sink class, or pathological generated code rather than a " + "legitimate detection burst. Individual findings dropped; re-run with " + "`perFileFindingCap: 0` to bypass the cap if the volume is intentional.",
+    file: filePath,
+    line: 1,
+    evidence: {
+      suppressed_count: suppressedCount,
+      cap,
+      by_rule: byRule,
+      by_severity: bySeverity
+    }
+  };
+  return [advisory];
+}
+
 // ../circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
@@ -20800,78 +20908,6 @@ function registerBuiltinPlugins() {
   registerLanguage(new HtmlPlugin);
   registerLanguage(new GoPlugin);
 }
-// ../circle-ir/dist/utils/logger.js
-var LOG_LEVELS = {
-  trace: 0,
-  debug: 1,
-  info: 2,
-  warn: 3,
-  error: 4,
-  fatal: 5,
-  silent: 6
-};
-var currentLevel = "silent";
-var customLogger = null;
-function shouldLog(level) {
-  return LOG_LEVELS[level] >= LOG_LEVELS[currentLevel];
-}
-function setLogLevel(level) {
-  currentLevel = level;
-}
-var logger = {
-  trace: (msg, obj) => {
-    if (customLogger) {
-      customLogger.trace(msg, obj);
-      return;
-    }
-    if (shouldLog("trace"))
-      console.debug(obj ? `[TRACE] ${msg} ${JSON.stringify(obj)}` : `[TRACE] ${msg}`);
-  },
-  debug: (msg, obj) => {
-    if (customLogger) {
-      customLogger.debug(msg, obj);
-      return;
-    }
-    if (shouldLog("debug"))
-      console.debug(obj ? `[DEBUG] ${msg} ${JSON.stringify(obj)}` : `[DEBUG] ${msg}`);
-  },
-  info: (msg, obj) => {
-    if (customLogger) {
-      customLogger.info(msg, obj);
-      return;
-    }
-    if (shouldLog("info"))
-      console.error(obj ? `[INFO] ${msg} ${JSON.stringify(obj)}` : `[INFO] ${msg}`);
-  },
-  warn: (msg, obj) => {
-    if (customLogger) {
-      customLogger.warn(msg, obj);
-      return;
-    }
-    if (shouldLog("warn"))
-      console.warn(obj ? `[WARN] ${msg} ${JSON.stringify(obj)}` : `[WARN] ${msg}`);
-  },
-  error: (msg, obj) => {
-    if (customLogger) {
-      customLogger.error(msg, obj);
-      return;
-    }
-    if (shouldLog("error"))
-      console.error(obj ? `[ERROR] ${msg} ${JSON.stringify(obj)}` : `[ERROR] ${msg}`);
-  },
-  fatal: (msg, obj) => {
-    if (customLogger) {
-      customLogger.fatal(msg, obj);
-      return;
-    }
-    if (shouldLog("fatal"))
-      console.error(obj ? `[FATAL] ${msg} ${JSON.stringify(obj)}` : `[FATAL] ${msg}`);
-  },
-  isLevelEnabled: (level) => {
-    return shouldLog(level);
-  }
-};
-
 // ../circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
   run(projectGraph, sourceLines, options = {}) {
@@ -25001,6 +25037,9 @@ var TIER_1_METHOD_ANNOTATIONS = new Set([
 var TIER_1_CLASS_ANNOTATIONS = new Set([
   "RestController",
   "Controller",
+  "Service",
+  "Repository",
+  "Component",
   "Path",
   "WebServlet",
   "ServerEndpoint",
@@ -25013,7 +25052,12 @@ var TIER_1_BY_SUPERTYPE = new Map([
   ["HandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion"])],
   ["AsyncHandlerInterceptor", new Set(["preHandle", "postHandle", "afterCompletion", "afterConcurrentHandlingStarted"])],
   ["CommandLineRunner", new Set(["run"])],
-  ["ApplicationRunner", new Set(["run"])]
+  ["ApplicationRunner", new Set(["run"])],
+  ["SimpleChannelInboundHandler", new Set(["channelRead0", "messageReceived"])],
+  ["ChannelInboundHandler", new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelInboundHandlerAdapter", new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelDuplexHandler", new Set(["channelRead", "channelReadComplete"])],
+  ["NettyRequestProcessor", new Set(["process"])]
 ]);
 var TIER_3_CLASS_SUFFIXES = [
   "Util",
@@ -34339,6 +34383,7 @@ async function analyze(code, filePath, language, options = {}) {
       unresolvedItems: unresolved.length
     });
     emitFindingsInstrumentation(filePath, findings, taint);
+    const cappedFindings = applyPerFileFindingCap(filePath, findings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
       types,
@@ -34350,7 +34395,7 @@ async function analyze(code, filePath, language, options = {}) {
       exports,
       unresolved,
       enriched,
-      findings: findings.length > 0 ? findings : undefined,
+      findings: cappedFindings.length > 0 ? cappedFindings : undefined,
       metrics: { file: filePath, metrics: metricValues },
       runtime_registrations: runtimeRegistrations.length > 0 ? runtimeRegistrations : undefined,
       parse_status: parseStatus
@@ -34517,7 +34562,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.90.1";
+var version = "3.93.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.90.1",
+  "version": "3.93.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.90.1"
+    "circle-ir": "^3.93.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",