cognium-dev 4.9.11 → 4.9.13

package/dist/cli.js

@@ -5,7 +5,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 // src/cli.ts
 import { readFileSync, existsSync, writeFileSync } from "fs";
 import { stat as stat2, readdir as readdir2 } from "fs/promises";
-import { join as join2, dirname as dirname2, extname, resolve, relative as relative3, basename } from "path";
+import { join as join2, dirname as dirname3, extname, resolve as resolve2, relative as relative4, basename } from "path";
 import { createRequire as createRequire2 } from "module";
 
 // ../../node_modules/web-tree-sitter/web-tree-sitter.js
@@ -13192,6 +13192,22 @@ var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.path_params\b/, sourceType: "http_param" },
   { pattern: /\binput\s*\(/, sourceType: "io_input" }
 ];
+function dropCSharpObjectCarriedWaypoints(sinks, calls) {
+  const zeroArgCtors = new Set;
+  for (const call of calls) {
+    if (call.is_constructor && call.arguments.length === 0) {
+      zeroArgCtors.add(`${call.location.line}:${call.method_name}`);
+    }
+  }
+  return sinks.filter((sink) => {
+    if (sink.type !== "sql_injection")
+      return true;
+    if (sink.method && zeroArgCtors.has(`${sink.line}:${sink.method}`)) {
+      return false;
+    }
+    return true;
+  });
+}
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== undefined ? code.split(`
 `) : undefined;
@@ -13199,8 +13215,9 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
+  const gatedSinks = language === "csharp" ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
-  return { sources, sinks, sanitizers };
+  return { sources, sinks: gatedSinks, sanitizers };
 }
 function sinkPatternAppliesTo(pattern, language) {
   if (language === undefined)
@@ -13485,7 +13502,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   const sourceMap = new Map;
   for (const source of sources) {
-    const key = `${source.line}:${source.type}`;
+    const key = source.type === "interprocedural_param" && source.variable ? `${source.line}:${source.type}:${source.variable}` : `${source.line}:${source.type}`;
     const existing = sourceMap.get(key);
     if (!existing || source.confidence > existing.confidence) {
       sourceMap.set(key, source);
@@ -14163,6 +14180,19 @@ var CWE_78_RECEIVER_ALLOWLIST = new Set([
   "ProcessExecutor",
   "RuntimeUtil"
 ]);
+function isRegexReceiver(receiver, sourceLines) {
+  const r = (receiver ?? "").trim();
+  if (r.length === 0)
+    return false;
+  if (r.startsWith("/") && /\/[a-z]*$/.test(r))
+    return true;
+  if (/^(?:new\s+)?RegExp\s*\(/.test(r))
+    return true;
+  if (!/^[A-Za-z_$][\w$]*$/.test(r) || !sourceLines)
+    return false;
+  const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
+  return sourceLines.some((l) => decl.test(l));
+}
 function isFunctionCallbackArgument(arg) {
   if (arg.literal !== null && arg.literal !== undefined)
     return false;
@@ -14370,6 +14400,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (pattern.type === "command_injection" && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
+          continue;
+        }
+        if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {
+          continue;
+        }
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -17887,6 +17923,9 @@ function findInitialTaint(sources, callsByLine, defsByLine) {
   for (const source of sources) {
     const defsOnLine = defsByLine.get(source.line) ?? [];
     for (const def of defsOnLine) {
+      if (source.type === "interprocedural_param" && source.variable && def.kind === "param" && def.variable !== source.variable) {
+        continue;
+      }
       tainted.push({
         variable: def.variable,
         defId: def.id,
@@ -35817,7 +35856,7 @@ class TaintPropagationPass {
     for (const f of paramFlows) {
       pushIfNew(f);
     }
-    const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, sanitizers, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language) ?? [];
+    const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, sanitizers, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language, types) ?? [];
     for (const f of exprScanFlows) {
       if (flowKeys.has(flowKey(f)))
         continue;
@@ -35981,6 +36020,35 @@ class TaintPropagationPass {
         return bestByKey.get(key) === f;
       });
     }
+    if (ctx.language === "csharp" && finalFlows.length > 1) {
+      const CSHARP_ADO_EXECUTE = /^Execute(?:Reader|NonQuery|Scalar)(?:Async)?$/;
+      const commandTextReceiverByLine = new Map;
+      const execLinesByReceiver = new Map;
+      for (const call of calls) {
+        const receiver = (call.receiver ?? "").trim();
+        if (!receiver)
+          continue;
+        if (call.method_name === "CommandText") {
+          commandTextReceiverByLine.set(call.location.line, receiver);
+        } else if (CSHARP_ADO_EXECUTE.test(call.method_name)) {
+          const lines = execLinesByReceiver.get(receiver) ?? [];
+          lines.push(call.location.line);
+          execLinesByReceiver.set(receiver, lines);
+        }
+      }
+      if (commandTextReceiverByLine.size > 0) {
+        const reportedSqlSinkLines = new Set(finalFlows.filter((f) => f.sink_type === "sql_injection").map((f) => f.sink_line));
+        finalFlows = finalFlows.filter((f) => {
+          if (f.sink_type !== "sql_injection")
+            return true;
+          const receiver = commandTextReceiverByLine.get(f.sink_line);
+          if (receiver === undefined)
+            return true;
+          const execLines = execLinesByReceiver.get(receiver) ?? [];
+          return !execLines.some((line) => line > f.sink_line && reportedSqlSinkLines.has(line));
+        });
+      }
+    }
     return { flows: finalFlows };
   }
 }
@@ -36447,7 +36515,7 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   }
   return false;
 }
-function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language) {
+function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language, types) {
   const flows = [];
   const sourcesWithVar = sources.filter((s) => typeof s.variable === "string" && s.variable.length > 0);
   const aliasSanitizedFor = new Map;
@@ -36730,13 +36798,37 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         if (s.line < anchor.line)
           anchor = s;
       }
+      const methodAt = (line) => {
+        for (const t of types ?? []) {
+          for (const m of t.methods) {
+            if (line >= m.start_line && line <= m.end_line)
+              return m.name;
+          }
+        }
+        return null;
+      };
       const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
-      for (const [varName] of derived) {
+      for (const [varName, derivedLine] of derived) {
         if (!varName || existingVars.has(varName))
           continue;
+        const owner = methodAt(derivedLine);
+        let scopedAnchor = anchor;
+        if (owner) {
+          let best;
+          for (const s of sourcesWithVar) {
+            const sOwner = s.in_method ?? methodAt(s.line);
+            if (sOwner !== owner)
+              continue;
+            if (!best || s.line < best.line)
+              best = s;
+          }
+          if (best)
+            scopedAnchor = best;
+        }
         sourcesWithVar.push({
-          ...anchor,
-          variable: varName
+          ...scopedAnchor,
+          variable: varName,
+          ...owner ? { in_method: owner } : {}
         });
         existingVars.add(varName);
       }
@@ -48298,14 +48390,14 @@ function toSpdx(deps, meta = {}) {
     relationships
   };
 }
-// node_modules/@cognium/project-profile-detect/dist/index.js
-import { relative as relative2 } from "path";
+// ../project-profile-detect/dist/index.js
+import { relative as relative3 } from "path";
 
-// node_modules/@cognium/project-profile-detect/dist/walk.js
+// ../project-profile-detect/dist/walk.js
 import { readdir, readFile, stat } from "fs/promises";
-import { join, relative } from "path";
+import { join, relative as relative2 } from "path";
 
-// node_modules/@cognium/project-profile-detect/dist/maven-parse.js
+// ../project-profile-detect/dist/maven-parse.js
 var TAG = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "i");
 var ALL_TAGS = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "gi");
 function firstTag(xml, name2) {
@@ -48329,7 +48421,12 @@ var MAVEN_PLUGIN_MAP = {
   "exec-maven-plugin": "application",
   "maven-assembly-plugin": "application"
 };
+var MAVEN_PUBLISH_PLUGIN_URLS = {
+  "central-publishing-maven-plugin": "https://central.sonatype.com/",
+  "nexus-staging-maven-plugin": "https://oss.sonatype.org/"
+};
 function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
+  const parentRef = extractParentRef(xml);
   const stripped = xml.replace(/<parent\b[\s\S]*?<\/parent>/i, "");
   const groupId = firstTag(stripped, "groupId");
   const artifactId = firstTag(stripped, "artifactId");
@@ -48338,10 +48435,15 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
   const buildBlock = firstTag(xml, "build") ?? "";
   const pluginBlocks = allTags(buildBlock, "plugin");
   const plugins = new Set;
+  const publishUrls = new Set;
   for (const p of pluginBlocks) {
     const aid = firstTag(p, "artifactId");
-    if (aid && MAVEN_PLUGIN_MAP[aid])
+    if (!aid)
+      continue;
+    if (MAVEN_PLUGIN_MAP[aid])
       plugins.add(MAVEN_PLUGIN_MAP[aid]);
+    if (MAVEN_PUBLISH_PLUGIN_URLS[aid])
+      publishUrls.add(MAVEN_PUBLISH_PLUGIN_URLS[aid]);
   }
   if (/<parent\b[\s\S]*?<artifactId>\s*spring-boot-starter-parent\s*<\/artifactId>/i.test(xml)) {
     plugins.add("spring-boot");
@@ -48354,7 +48456,8 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
     plugins.add("maven-plugin");
   const distBlock = firstTag(xml, "distributionManagement") ?? "";
   const urls = [
-    ...allTags(distBlock, "url")
+    ...allTags(distBlock, "url"),
+    ...publishUrls
   ].map((u) => u.trim()).filter(Boolean);
   const signals = {
     ...directorySignals,
@@ -48369,11 +48472,36 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
     groupId,
     artifactId,
     version,
-    signals
+    signals,
+    parentRef
   };
 }
+function extractParentRef(xml) {
+  const block = TAG("parent").exec(xml);
+  if (!block)
+    return;
+  const inner = block[1];
+  const groupId = firstTag(inner, "groupId");
+  const artifactId = firstTag(inner, "artifactId");
+  const version = firstTag(inner, "version");
+  let relativePath;
+  let emptyRelativePath = false;
+  const selfClosing = /<relativePath\b[^>]*\/\s*>/i.test(inner);
+  if (selfClosing) {
+    emptyRelativePath = true;
+  } else {
+    const rp = firstTag(inner, "relativePath");
+    if (rp !== undefined) {
+      if (rp.length === 0)
+        emptyRelativePath = true;
+      else
+        relativePath = rp;
+    }
+  }
+  return { groupId, artifactId, version, relativePath, emptyRelativePath };
+}
 
-// node_modules/@cognium/project-profile-detect/dist/gradle-parse.js
+// ../project-profile-detect/dist/gradle-parse.js
 var GRADLE_PLUGIN_MAP = {
   "org.springframework.boot": "spring-boot",
   "io.spring.dependency-management": "spring-boot",
@@ -48438,7 +48566,81 @@ function parseGradleBuild(text, moduleRoot, buildFile, buildSystem, directorySig
   };
 }
 
-// node_modules/@cognium/project-profile-detect/dist/walk.js
+// ../project-profile-detect/dist/maven-inherit.js
+import { dirname as dirname2, isAbsolute, normalize, relative, resolve } from "path";
+var MAX_DEPTH = 6;
+var DEFAULT_RELATIVE_PATH = "../pom.xml";
+function mergeMavenInheritance(modules, scanRoot) {
+  const normalizedScanRoot = normalize(scanRoot);
+  const byBuildFile = new Map;
+  for (const m of modules) {
+    if (m.buildSystem === "maven") {
+      byBuildFile.set(normalize(m.buildFile), m);
+    }
+  }
+  const ownSignals = new Map;
+  for (const [buildFile, m] of byBuildFile) {
+    ownSignals.set(buildFile, {
+      urls: [...m.signals.distributionUrls],
+      plugins: [...m.signals.plugins]
+    });
+  }
+  for (const child of modules) {
+    if (child.buildSystem !== "maven")
+      continue;
+    if (!child.parentRef)
+      continue;
+    const inheritedUrls = new Set;
+    const inheritedPlugins = new Set;
+    walkParents(child, byBuildFile, ownSignals, normalizedScanRoot, inheritedUrls, inheritedPlugins);
+    if (inheritedUrls.size === 0 && inheritedPlugins.size === 0)
+      continue;
+    const existingUrls = new Set(child.signals.distributionUrls);
+    for (const u of inheritedUrls) {
+      if (!existingUrls.has(u))
+        child.signals.distributionUrls.push(u);
+    }
+    const existingPlugins = new Set(child.signals.plugins);
+    for (const p of inheritedPlugins) {
+      if (!existingPlugins.has(p))
+        child.signals.plugins.push(p);
+    }
+  }
+}
+function walkParents(start2, byBuildFile, ownSignals, scanRoot, outUrls, outPlugins) {
+  const visited = new Set([normalize(start2.buildFile)]);
+  let current = start2;
+  for (let depth = 0;depth < MAX_DEPTH; depth++) {
+    const ref = current.parentRef;
+    if (!ref)
+      return;
+    if (ref.emptyRelativePath)
+      return;
+    const childDir = dirname2(current.buildFile);
+    const rel = ref.relativePath ?? DEFAULT_RELATIVE_PATH;
+    const candidateAbs = normalize(isAbsolute(rel) ? rel : resolve(childDir, rel));
+    const parentBuildFile = candidateAbs.endsWith("pom.xml") ? candidateAbs : normalize(resolve(candidateAbs, "pom.xml"));
+    const relToRoot = relative(scanRoot, parentBuildFile);
+    if (relToRoot.startsWith("..") || isAbsolute(relToRoot))
+      return;
+    if (visited.has(parentBuildFile))
+      return;
+    visited.add(parentBuildFile);
+    const parent = byBuildFile.get(parentBuildFile);
+    if (!parent)
+      return;
+    const parentOwn = ownSignals.get(parentBuildFile);
+    if (parentOwn) {
+      for (const u of parentOwn.urls)
+        outUrls.add(u);
+      for (const p of parentOwn.plugins)
+        outPlugins.add(p);
+    }
+    current = parent;
+  }
+}
+
+// ../project-profile-detect/dist/walk.js
 var BUILD_FILES = ["pom.xml", "build.gradle", "build.gradle.kts"];
 var SKIP_DIRS = new Set([
   "node_modules",
@@ -48458,6 +48660,7 @@ var SKIP_DIRS = new Set([
 async function discoverBuildModules(scanRoot) {
   const modules = [];
   await walk(scanRoot, modules);
+  mergeMavenInheritance(modules, scanRoot);
   return modules;
 }
 async function walk(dir, out2) {
@@ -48599,7 +48802,7 @@ function ownerOf(file, modules) {
   return best;
 }
 
-// node_modules/@cognium/project-profile-detect/dist/publication-detect.js
+// ../project-profile-detect/dist/publication-detect.js
 var PUBLIC_REGISTRY_HOSTS = new Set([
   "repo.maven.apache.org",
   "repo1.maven.org",
@@ -48624,7 +48827,7 @@ function isPubliclyPublished(urls) {
   return false;
 }
 
-// node_modules/@cognium/project-profile-detect/dist/shape-resolve.js
+// ../project-profile-detect/dist/shape-resolve.js
 function resolveShape(mod) {
   const sig = mod.signals;
   const has = (tag) => sig.plugins.includes(tag);
@@ -48665,11 +48868,15 @@ function resolveShape(mod) {
     reasons.push(...libSignals, "no public-registry distribution (internal helper)");
     return { shape: "application", reasons };
   }
+  if (isPubliclyPublished(sig.distributionUrls)) {
+    reasons.push("public-registry distribution", "no application/server/plugin signals → implicit library");
+    return { shape: "library", reasons };
+  }
   reasons.push("no shape signals");
   return { shape: "unknown", reasons };
 }
 
-// node_modules/@cognium/project-profile-detect/dist/env-resolve.js
+// ../project-profile-detect/dist/env-resolve.js
 var TEST_RE = /(?:^|\/)tests?\//;
 var SAMPLE_RE = /(?:^|\/)(?:samples?|examples?|demos?|fixtures?)\//;
 var BENCHMARK_RE = /(?:^|\/)benchmarks?\//;
@@ -48687,7 +48894,7 @@ function resolveEnv(absoluteFile) {
   return "dev";
 }
 
-// node_modules/@cognium/project-profile-detect/dist/overrides.js
+// ../project-profile-detect/dist/overrides.js
 function compileGlob(glob) {
   let re = "";
   let i2 = 0;
@@ -48734,7 +48941,7 @@ function applyOverrides(relativePath, compiled) {
   return;
 }
 
-// node_modules/@cognium/project-profile-detect/dist/index.js
+// ../project-profile-detect/dist/index.js
 async function detectProjectProfiles(scanRoot, options = {}) {
   const modules = await discoverBuildModules(scanRoot);
   const files = await enumerateScanFiles(scanRoot);
@@ -48752,7 +48959,7 @@ async function detectProjectProfiles(scanRoot, options = {}) {
   const profileByFile = new Map;
   const unknownFiles = [];
   for (const file of files) {
-    const rel = relative2(scanRoot, file);
+    const rel = relative3(scanRoot, file);
     const ov = applyOverrides(rel, compiledOverrides);
     if (ov) {
       profileByFile.set(file, ov.profile);
@@ -48804,7 +49011,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.11";
+var version = "4.9.13";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -49357,8 +49564,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "6c811aa",
-  builtAt: "2026-09-10T06:22:49.258Z"
+  gitSha: "c7e3f20",
+  builtAt: "2026-09-11T05:41:41.484Z"
 };
 
 // src/utils/args.ts
@@ -49646,7 +49853,7 @@ function applySuppressionsToResults(results, suppressions, basePath) {
   if (suppressions.length === 0)
     return results;
   return results.map((result) => {
-    const relativeFile = relative3(basePath, result.file) || result.file;
+    const relativeFile = relative4(basePath, result.file) || result.file;
     const filteredVulns = result.vulnerabilities.filter((vuln) => {
       for (const supp of suppressions) {
         if (supp.pass !== vuln.type)
@@ -49752,7 +49959,7 @@ async function collectFiles(targetPath, options = {}) {
       return files;
     }
     if (fileMatchesLanguage(targetPath, language)) {
-      const relativePath = basePath ? relative3(basePath, targetPath) : targetPath;
+      const relativePath = basePath ? relative4(basePath, targetPath) : targetPath;
       if (includePatterns && includePatterns.length > 0) {
         if (!matchesAnyPattern(relativePath, includePatterns)) {
           return files;
@@ -49771,7 +49978,7 @@ async function collectFiles(targetPath, options = {}) {
       if (excludeTests && /^(test|tests|__tests__|spec|__mocks__)$/i.test(entry.name))
         continue;
       const fullPath = join2(targetPath, entry.name);
-      const relativePath = basePath ? relative3(basePath, fullPath) : fullPath;
+      const relativePath = basePath ? relative4(basePath, fullPath) : fullPath;
       if (excludePatterns && entry.isDirectory()) {
         const dirPattern = relativePath + "/";
         if (excludePatterns.some((p) => matchesGlob(dirPattern, p) || matchesGlob(relativePath, p))) {
@@ -49869,14 +50076,14 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
 async function initWasm(spin) {
   const isStandalone = import.meta.url.includes("/$bunfs/");
   if (isStandalone) {
-    const { dirname: dirname3, join: join3 } = await import("path");
-    const binaryDir = dirname3(process.execPath);
+    const { dirname: dirname4, join: join3 } = await import("path");
+    const binaryDir = dirname4(process.execPath);
     const cwd = process.cwd();
     let scriptDir = null;
     if (!import.meta.url.includes("/$bunfs/")) {
       try {
         const { fileURLToPath } = await import("url");
-        scriptDir = dirname3(fileURLToPath(import.meta.url));
+        scriptDir = dirname4(fileURLToPath(import.meta.url));
       } catch {}
     }
     const wasmLocations = [
@@ -49931,7 +50138,7 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
   } else {
     const require2 = createRequire2(import.meta.url);
     const circleIrPkg = require2.resolve("circle-ir/package.json");
-    const wasmBasePath = join2(dirname2(circleIrPkg), "dist", "wasm") + "/";
+    const wasmBasePath = join2(dirname3(circleIrPkg), "dist", "wasm") + "/";
     await initAnalyzer({
       wasmPath: wasmBasePath + "web-tree-sitter.wasm",
       languagePaths: {
@@ -49962,7 +50169,7 @@ function buildProfileSummary(scanRoot, modules, resolvedProfiles) {
   return {
     scanRoot,
     modules: modules.map((m) => ({
-      root: relative3(scanRoot, m.module.root) || ".",
+      root: relative4(scanRoot, m.module.root) || ".",
       profile: m.profile,
       reasons: m.reasons,
       buildSystem: m.module.buildSystem
@@ -49991,9 +50198,9 @@ function printProfileExplain(scanRoot, detection) {
     out2.push("  (no pom.xml, build.gradle, or build.gradle.kts found)");
   } else {
     for (const r of detection.modules) {
-      const rel = relative3(scanRoot, r.module.root) || ".";
+      const rel = relative4(scanRoot, r.module.root) || ".";
       out2.push(`  ${colors.cyan(rel || ".")}  →  ${colors.bold(r.profile)}`);
-      out2.push(`     build: ${r.module.buildSystem}  (${relative3(scanRoot, r.module.buildFile)})`);
+      out2.push(`     build: ${r.module.buildSystem}  (${relative4(scanRoot, r.module.buildFile)})`);
       if (r.module.artifactId) {
         out2.push(`     coords: ${r.module.groupId ?? "?"}:${r.module.artifactId}:${r.module.version ?? "?"}`);
       }
@@ -50038,7 +50245,7 @@ async function runScan(targetPath, options) {
     await initWasm(spin);
     if (spin)
       spin.text = "Collecting files...";
-    const absPath = resolve(targetPath);
+    const absPath = resolve2(targetPath);
     if (!existsSync(absPath)) {
       if (spin)
         spin.fail(`Path not found: ${absPath}`);
@@ -50102,7 +50309,7 @@ async function runScan(targetPath, options) {
       results = [];
       let processed = 0;
       const formatCurrentFile = (file) => {
-        const rel = relative3(absPath, file) || file;
+        const rel = relative4(absPath, file) || file;
         return rel.length > 80 ? `...${rel.slice(-77)}` : rel;
       };
       const concurrency = options.threads;
@@ -50278,7 +50485,7 @@ async function runMetrics(targetPath, options) {
     await initWasm(spin);
     if (spin)
       spin.text = "Collecting files...";
-    const absPath = resolve(targetPath);
+    const absPath = resolve2(targetPath);
     if (!existsSync(absPath)) {
       if (spin)
         spin.fail(`Path not found: ${absPath}`);
@@ -50306,7 +50513,7 @@ async function runMetrics(targetPath, options) {
         continue;
       }
       if (spin) {
-        const rel = relative3(absPath, file) || file;
+        const rel = relative4(absPath, file) || file;
         const maxLen = 80;
         const label = rel.length > maxLen ? `...${rel.slice(-(maxLen - 3))}` : rel;
         spin.text = `Analyzing ${label}... (${processed}/${totalFiles})`;
@@ -50351,7 +50558,7 @@ async function runMetrics(targetPath, options) {
     } else {
       const lines = [];
       for (const fm of filtered) {
-        const rel = relative3(absPath, fm.file) || fm.file;
+        const rel = relative4(absPath, fm.file) || fm.file;
         lines.push(rel);
         const byCategory = new Map;
         for (const m of fm.metrics) {
@@ -50579,7 +50786,7 @@ async function collectManifestFiles(targetPath) {
   return found;
 }
 async function runSbom(targetPath, options) {
-  const absPath = resolve(targetPath);
+  const absPath = resolve2(targetPath);
   if (!existsSync(absPath)) {
     console.error(colors.red(`Error: path not found: ${targetPath}`));
     process.exit(2);
@@ -50593,9 +50800,9 @@ async function runSbom(targetPath, options) {
   for (const m of manifests) {
     const superseded = SBOM_SUPERSEDES[basename(m)];
     if (superseded)
-      supersededInDir.add(`${dirname2(m)}\x00${superseded}`);
+      supersededInDir.add(`${dirname3(m)}\x00${superseded}`);
   }
-  const effective = manifests.filter((m) => !supersededInDir.has(`${dirname2(m)}\x00${basename(m)}`));
+  const effective = manifests.filter((m) => !supersededInDir.has(`${dirname3(m)}\x00${basename(m)}`));
   let projectName = options.name;
   let projectLicense;
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.11",
+  "version": "4.9.13",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.1",
-    "circle-ir": "4.9.11"
+    "circle-ir": "4.9.13"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",