cognium-dev 3.93.0 → 3.95.0

package/dist/cli.js

@@ -17897,6 +17897,16 @@ function applyPerFileFindingCap(filePath, findings, cap) {
   return [advisory];
 }
 
+// ../circle-ir/dist/analysis/confidence-filter.js
+function applyConfidenceFilter(findings, includeSpeculative) {
+  if (includeSpeculative)
+    return findings;
+  return findings.filter(isHighConfidence);
+}
+function isHighConfidence(finding) {
+  return finding.confidence === undefined || finding.confidence === "high";
+}
+
 // ../circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
@@ -25205,6 +25215,10 @@ function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingTy
 class InterproceduralPass {
   name = "interprocedural";
   category = "security";
+  enableEntryPointGate;
+  constructor(options) {
+    this.enableEntryPointGate = options?.enableEntryPointGate ?? true;
+  }
   run(ctx) {
     const { graph } = ctx;
     const constProp = ctx.getResult("constant-propagation");
@@ -25263,7 +25277,7 @@ class InterproceduralPass {
                 continue;
               if (source.type === "interprocedural_param" && source.confidence < 0.6)
                 continue;
-              if (source.type === "interprocedural_param" && source.in_method) {
+              if (this.enableEntryPointGate && source.type === "interprocedural_param" && source.in_method) {
                 const enclosing = methodNameIndex.get(source.in_method);
                 if (shouldGateInterproceduralParam(source.type, enclosing?.method, enclosing?.type, { language, types: graph.ir.types })) {
                   continue;
@@ -34253,7 +34267,9 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new LanguageSourcesPass);
     pipeline.add(new SinkFilterPass);
     pipeline.add(new TaintPropagationPass);
-    pipeline.add(new InterproceduralPass);
+    pipeline.add(new InterproceduralPass({
+      enableEntryPointGate: options.enableEntryPointGate ?? true
+    }));
     if (!disabledPasses.has("scan-secrets"))
       pipeline.add(new ScanSecretsPass);
     if (!disabledPasses.has("dead-code"))
@@ -34383,7 +34399,8 @@ async function analyze(code, filePath, language, options = {}) {
       unresolvedItems: unresolved.length
     });
     emitFindingsInstrumentation(filePath, findings, taint);
-    const cappedFindings = applyPerFileFindingCap(filePath, findings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
+    const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
+    const cappedFindings = applyPerFileFindingCap(filePath, verifiedFindings, options.perFileFindingCap ?? DEFAULT_PER_FILE_FINDING_CAP);
     return {
       meta,
       types,
@@ -34562,7 +34579,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.93.0";
+var version = "3.95.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.93.0",
+  "version": "3.95.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.93.0"
+    "circle-ir": "^3.95.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",