cognium-dev 4.9.20 → 4.9.22

package/dist/cli.js

@@ -113,44 +113,65 @@ function setModule(module2) {
 }
 __name(setModule, "setModule");
 var C;
+function newFinalizer(handler) {
+  try {
+    return new FinalizationRegistry(handler);
+  } catch (e) {
+    console.error("Unsupported FinalizationRegistry:", e);
+    return;
+  }
+}
+__name(newFinalizer, "newFinalizer");
+var finalizer = newFinalizer((address) => {
+  C._ts_lookahead_iterator_delete(address);
+});
 var LookaheadIterator = class {
   static {
     __name(this, "LookaheadIterator");
   }
   [0] = 0;
   language;
+  positioned = false;
   constructor(internal, address, language) {
     assertInternal(internal);
     this[0] = address;
     this.language = language;
+    finalizer?.register(this, address, this);
   }
   get currentTypeId() {
-    return C._ts_lookahead_iterator_current_symbol(this[0]);
+    return this.positioned ? C._ts_lookahead_iterator_current_symbol(this[0]) : null;
   }
   get currentType() {
-    return this.language.types[this.currentTypeId] || "ERROR";
+    const id = this.currentTypeId;
+    if (id === null)
+      return null;
+    return this.language.types[id] ?? C.UTF8ToString(C._ts_language_symbol_name(this.language[0], id));
   }
   delete() {
+    finalizer?.unregister(this);
     C._ts_lookahead_iterator_delete(this[0]);
     this[0] = 0;
   }
   reset(language, stateId) {
     if (C._ts_lookahead_iterator_reset(this[0], language[0], stateId)) {
       this.language = language;
+      this.positioned = false;
       return true;
     }
     return false;
   }
   resetState(stateId) {
-    return Boolean(C._ts_lookahead_iterator_reset_state(this[0], stateId));
+    if (!C._ts_lookahead_iterator_reset_state(this[0], stateId))
+      return false;
+    this.positioned = false;
+    return true;
   }
   [Symbol.iterator]() {
     return {
       next: /* @__PURE__ */ __name(() => {
-        if (C._ts_lookahead_iterator_next(this[0])) {
-          return { done: false, value: this.currentType };
-        }
-        return { done: true, value: "" };
+        this.positioned = Boolean(C._ts_lookahead_iterator_next(this[0]));
+        const value = this.currentType;
+        return value === null ? { done: true, value: "" } : { done: false, value };
       }, "next")
     };
   }
@@ -176,6 +197,9 @@ function getText(tree, startIndex, endIndex, startPosition) {
   return result ?? "";
 }
 __name(getText, "getText");
+var finalizer2 = newFinalizer((address) => {
+  C._ts_tree_delete(address);
+});
 var Tree = class _Tree {
   static {
     __name(this, "Tree");
@@ -188,12 +212,14 @@ var Tree = class _Tree {
     this[0] = address;
     this.language = language;
     this.textCallback = textCallback;
+    finalizer2?.register(this, address, this);
   }
   copy() {
     const address = C._ts_tree_copy(this[0]);
     return new _Tree(INTERNAL, address, this.language, this.textCallback);
   }
   delete() {
+    finalizer2?.unregister(this);
     C._ts_tree_delete(this[0]);
     this[0] = 0;
   }
@@ -249,6 +275,9 @@ var Tree = class _Tree {
     return result;
   }
 };
+var finalizer3 = newFinalizer((address) => {
+  C._ts_tree_cursor_delete_wasm(address);
+});
 var TreeCursor = class _TreeCursor {
   static {
     __name(this, "TreeCursor");
@@ -262,6 +291,7 @@ var TreeCursor = class _TreeCursor {
     assertInternal(internal);
     this.tree = tree;
     unmarshalTreeCursor(this);
+    finalizer3?.register(this, this.tree[0], this);
   }
   copy() {
     const copy = new _TreeCursor(INTERNAL, this.tree);
@@ -270,6 +300,7 @@ var TreeCursor = class _TreeCursor {
     return copy;
   }
   delete() {
+    finalizer3?.unregister(this);
     marshalTreeCursor(this);
     C._ts_tree_cursor_delete_wasm(this.tree[0]);
     this[0] = this[1] = this[2] = 0;
@@ -1029,16 +1060,23 @@ ${body2}`);
       }
     }
     const mod = await C.loadWebAssemblyModule(binary2, { loadAsync: true });
+    return _Language.loadFromWasmExports(mod, { sync: false });
+  }
+  static loadFromWasmExports(mod, { sync }) {
     const symbolNames = Object.keys(mod);
     const functionName = symbolNames.find((key) => LANGUAGE_FUNCTION_REGEX.test(key) && !key.includes("external_scanner_"));
     if (!functionName) {
       console.log(`Couldn't find language function in Wasm file. Symbols:
 ${JSON.stringify(symbolNames, null, 2)}`);
-      throw new Error("Language.load failed: no language function found in Wasm file");
+      throw new Error(`Language.${sync ? "loadSync" : "load"} failed: no language function found in Wasm file`);
     }
     const languageAddress = mod[functionName]();
     return new _Language(INTERNAL, languageAddress);
   }
+  static loadSync(wasmModule) {
+    const mod = C.loadWebAssemblyModule(wasmModule, { loadAsync: false });
+    return _Language.loadFromWasmExports(mod, { sync: true });
+  }
 };
 async function Module2(moduleArg = {}) {
   var moduleRtn;
@@ -1558,7 +1596,7 @@ async function Module2(moduleArg = {}) {
       newDSO("__main__", 0, wasmImports);
     }
   };
-  var ___heap_base = 78240;
+  var ___heap_base = 82240;
   var alignMemory = /* @__PURE__ */ __name((size, alignment) => Math.ceil(size / alignment) * alignment, "alignMemory");
   var getMemory = /* @__PURE__ */ __name((size) => {
     if (runtimeInitialized) {
@@ -2084,12 +2122,12 @@ async function Module2(moduleArg = {}) {
     value: "i32",
     mutable: false
   }, 1024);
-  var ___stack_high = 78240;
-  var ___stack_low = 12704;
+  var ___stack_high = 82240;
+  var ___stack_low = 16704;
   var ___stack_pointer = new WebAssembly.Global({
     value: "i32",
     mutable: true
-  }, 78240);
+  }, 82240);
   var ___table_base = new WebAssembly.Global({
     value: "i32",
     mutable: false
@@ -2356,7 +2394,7 @@ async function Module2(moduleArg = {}) {
   Module["loadWebAssemblyModule"] = loadWebAssemblyModule;
   Module["LE_HEAP_STORE_I64"] = LE_HEAP_STORE_I64;
   var ASM_CONSTS = {};
-  var _malloc, _calloc, _realloc, _free, _ts_range_edit, _memcmp, _ts_language_symbol_count, _ts_language_state_count, _ts_language_abi_version, _ts_language_name, _ts_language_field_count, _ts_language_next_state, _ts_language_symbol_name, _ts_language_symbol_for_name, _strncmp, _ts_language_symbol_type, _ts_language_field_name_for_id, _ts_lookahead_iterator_new, _ts_lookahead_iterator_delete, _ts_lookahead_iterator_reset_state, _ts_lookahead_iterator_reset, _ts_lookahead_iterator_next, _ts_lookahead_iterator_current_symbol, _ts_point_edit, _ts_parser_delete, _ts_parser_reset, _ts_parser_set_language, _ts_parser_set_included_ranges, _ts_query_new, _ts_query_delete, _iswspace, _iswalnum, _ts_query_pattern_count, _ts_query_capture_count, _ts_query_string_count, _ts_query_capture_name_for_id, _ts_query_capture_quantifier_for_id, _ts_query_string_value_for_id, _ts_query_predicates_for_pattern, _ts_query_start_byte_for_pattern, _ts_query_end_byte_for_pattern, _ts_query_is_pattern_rooted, _ts_query_is_pattern_non_local, _ts_query_is_pattern_guaranteed_at_step, _ts_query_disable_capture, _ts_query_disable_pattern, _ts_tree_copy, _ts_tree_delete, _ts_init, _ts_parser_new_wasm, _ts_parser_enable_logger_wasm, _ts_parser_parse_wasm, _ts_parser_included_ranges_wasm, _ts_language_type_is_named_wasm, _ts_language_type_is_visible_wasm, _ts_language_metadata_wasm, _ts_language_supertypes_wasm, _ts_language_subtypes_wasm, _ts_tree_root_node_wasm, _ts_tree_root_node_with_offset_wasm, _ts_tree_edit_wasm, _ts_tree_included_ranges_wasm, _ts_tree_get_changed_ranges_wasm, _ts_tree_cursor_new_wasm, _ts_tree_cursor_copy_wasm, _ts_tree_cursor_delete_wasm, _ts_tree_cursor_reset_wasm, _ts_tree_cursor_reset_to_wasm, _ts_tree_cursor_goto_first_child_wasm, _ts_tree_cursor_goto_last_child_wasm, _ts_tree_cursor_goto_first_child_for_index_wasm, _ts_tree_cursor_goto_first_child_for_position_wasm, _ts_tree_cursor_goto_next_sibling_wasm, _ts_tree_cursor_goto_previous_sibling_wasm, _ts_tree_cursor_goto_descendant_wasm, _ts_tree_cursor_goto_parent_wasm, _ts_tree_cursor_current_node_type_id_wasm, _ts_tree_cursor_current_node_state_id_wasm, _ts_tree_cursor_current_node_is_named_wasm, _ts_tree_cursor_current_node_is_missing_wasm, _ts_tree_cursor_current_node_id_wasm, _ts_tree_cursor_start_position_wasm, _ts_tree_cursor_end_position_wasm, _ts_tree_cursor_start_index_wasm, _ts_tree_cursor_end_index_wasm, _ts_tree_cursor_current_field_id_wasm, _ts_tree_cursor_current_depth_wasm, _ts_tree_cursor_current_descendant_index_wasm, _ts_tree_cursor_current_node_wasm, _ts_node_symbol_wasm, _ts_node_field_name_for_child_wasm, _ts_node_field_name_for_named_child_wasm, _ts_node_children_by_field_id_wasm, _ts_node_first_child_for_byte_wasm, _ts_node_first_named_child_for_byte_wasm, _ts_node_grammar_symbol_wasm, _ts_node_child_count_wasm, _ts_node_named_child_count_wasm, _ts_node_child_wasm, _ts_node_named_child_wasm, _ts_node_child_by_field_id_wasm, _ts_node_next_sibling_wasm, _ts_node_prev_sibling_wasm, _ts_node_next_named_sibling_wasm, _ts_node_prev_named_sibling_wasm, _ts_node_descendant_count_wasm, _ts_node_parent_wasm, _ts_node_child_with_descendant_wasm, _ts_node_descendant_for_index_wasm, _ts_node_named_descendant_for_index_wasm, _ts_node_descendant_for_position_wasm, _ts_node_named_descendant_for_position_wasm, _ts_node_start_point_wasm, _ts_node_end_point_wasm, _ts_node_start_index_wasm, _ts_node_end_index_wasm, _ts_node_to_string_wasm, _ts_node_children_wasm, _ts_node_named_children_wasm, _ts_node_descendants_of_type_wasm, _ts_node_is_named_wasm, _ts_node_has_changes_wasm, _ts_node_has_error_wasm, _ts_node_is_error_wasm, _ts_node_is_missing_wasm, _ts_node_is_extra_wasm, _ts_node_parse_state_wasm, _ts_node_next_parse_state_wasm, _ts_query_matches_wasm, _ts_query_captures_wasm, _memset, _memcpy, _memmove, _iswalpha, _iswblank, _iswdigit, _iswlower, _iswupper, _iswxdigit, _memchr, _strlen, _strcmp, _strncat, _strncpy, _towlower, _towupper, _setThrew, __emscripten_stack_restore, __emscripten_stack_alloc, _emscripten_stack_get_current, ___wasm_apply_data_relocs;
+  var _malloc, _calloc, _realloc, _free, _ts_range_edit, _memcmp, _ts_language_symbol_count, _ts_language_state_count, _ts_language_abi_version, _ts_language_name, _ts_language_field_count, _ts_language_next_state, _ts_language_symbol_name, _ts_language_symbol_for_name, _strncmp, _ts_language_symbol_type, _ts_language_field_name_for_id, _ts_lookahead_iterator_new, _ts_lookahead_iterator_delete, _ts_lookahead_iterator_reset_state, _ts_lookahead_iterator_reset, _ts_lookahead_iterator_next, _ts_lookahead_iterator_current_symbol, _ts_point_edit, _ts_parser_delete, _ts_parser_reset, _ts_parser_set_language, _ts_parser_set_included_ranges, _ts_query_new, _ts_query_delete, _iswspace, _iswalnum, _ts_query_copy, _ts_query_pattern_count, _ts_query_capture_count, _ts_query_string_count, _ts_query_capture_name_for_id, _ts_query_capture_quantifier_for_id, _ts_query_string_value_for_id, _ts_query_predicates_for_pattern, _ts_query_start_byte_for_pattern, _ts_query_end_byte_for_pattern, _ts_query_is_pattern_rooted, _ts_query_is_pattern_non_local, _ts_query_is_pattern_guaranteed_at_step, _ts_query_disable_capture, _ts_query_disable_pattern, _ts_tree_copy, _ts_tree_delete, _ts_init, _ts_parser_new_wasm, _ts_parser_enable_logger_wasm, _ts_parser_parse_wasm, _ts_parser_included_ranges_wasm, _ts_language_type_is_named_wasm, _ts_language_type_is_visible_wasm, _ts_language_metadata_wasm, _ts_language_supertypes_wasm, _ts_language_subtypes_wasm, _ts_tree_root_node_wasm, _ts_tree_root_node_with_offset_wasm, _ts_tree_edit_wasm, _ts_tree_included_ranges_wasm, _ts_tree_get_changed_ranges_wasm, _ts_tree_cursor_new_wasm, _ts_tree_cursor_copy_wasm, _ts_tree_cursor_delete_wasm, _ts_tree_cursor_reset_wasm, _ts_tree_cursor_reset_to_wasm, _ts_tree_cursor_goto_first_child_wasm, _ts_tree_cursor_goto_last_child_wasm, _ts_tree_cursor_goto_first_child_for_index_wasm, _ts_tree_cursor_goto_first_child_for_position_wasm, _ts_tree_cursor_goto_next_sibling_wasm, _ts_tree_cursor_goto_previous_sibling_wasm, _ts_tree_cursor_goto_descendant_wasm, _ts_tree_cursor_goto_parent_wasm, _ts_tree_cursor_current_node_type_id_wasm, _ts_tree_cursor_current_node_state_id_wasm, _ts_tree_cursor_current_node_is_named_wasm, _ts_tree_cursor_current_node_is_missing_wasm, _ts_tree_cursor_current_node_id_wasm, _ts_tree_cursor_start_position_wasm, _ts_tree_cursor_end_position_wasm, _ts_tree_cursor_start_index_wasm, _ts_tree_cursor_end_index_wasm, _ts_tree_cursor_current_field_id_wasm, _ts_tree_cursor_current_depth_wasm, _ts_tree_cursor_current_descendant_index_wasm, _ts_tree_cursor_current_node_wasm, _ts_node_symbol_wasm, _ts_node_field_name_for_child_wasm, _ts_node_field_name_for_named_child_wasm, _ts_node_children_by_field_id_wasm, _ts_node_first_child_for_byte_wasm, _ts_node_first_named_child_for_byte_wasm, _ts_node_grammar_symbol_wasm, _ts_node_child_count_wasm, _ts_node_named_child_count_wasm, _ts_node_child_wasm, _ts_node_named_child_wasm, _ts_node_child_by_field_id_wasm, _ts_node_next_sibling_wasm, _ts_node_prev_sibling_wasm, _ts_node_next_named_sibling_wasm, _ts_node_prev_named_sibling_wasm, _ts_node_descendant_count_wasm, _ts_node_parent_wasm, _ts_node_child_with_descendant_wasm, _ts_node_descendant_for_index_wasm, _ts_node_named_descendant_for_index_wasm, _ts_node_descendant_for_position_wasm, _ts_node_named_descendant_for_position_wasm, _ts_node_start_point_wasm, _ts_node_end_point_wasm, _ts_node_start_index_wasm, _ts_node_end_index_wasm, _ts_node_to_string_wasm, _ts_node_children_wasm, _ts_node_named_children_wasm, _ts_node_descendants_of_type_wasm, _ts_node_is_named_wasm, _ts_node_has_changes_wasm, _ts_node_has_error_wasm, _ts_node_is_error_wasm, _ts_node_is_missing_wasm, _ts_node_is_extra_wasm, _ts_node_parse_state_wasm, _ts_node_next_parse_state_wasm, _ts_query_matches_wasm, _ts_query_captures_wasm, _memset, _memcpy, _memmove, _iswalpha, _iswblank, _iswdigit, _iswlower, _iswpunct, _iswupper, _iswxdigit, _memchr, _strlen, _strcmp, _strncat, _strncpy, _towlower, _towupper, _setThrew, __emscripten_stack_restore, __emscripten_stack_alloc, _emscripten_stack_get_current, ___wasm_apply_data_relocs;
   function assignWasmExports(wasmExports2) {
     Module["_malloc"] = _malloc = wasmExports2["malloc"];
     Module["_calloc"] = _calloc = wasmExports2["calloc"];
@@ -2390,6 +2428,7 @@ async function Module2(moduleArg = {}) {
     Module["_ts_query_delete"] = _ts_query_delete = wasmExports2["ts_query_delete"];
     Module["_iswspace"] = _iswspace = wasmExports2["iswspace"];
     Module["_iswalnum"] = _iswalnum = wasmExports2["iswalnum"];
+    Module["_ts_query_copy"] = _ts_query_copy = wasmExports2["ts_query_copy"];
     Module["_ts_query_pattern_count"] = _ts_query_pattern_count = wasmExports2["ts_query_pattern_count"];
     Module["_ts_query_capture_count"] = _ts_query_capture_count = wasmExports2["ts_query_capture_count"];
     Module["_ts_query_string_count"] = _ts_query_string_count = wasmExports2["ts_query_string_count"];
@@ -2495,6 +2534,7 @@ async function Module2(moduleArg = {}) {
     Module["_iswblank"] = _iswblank = wasmExports2["iswblank"];
     Module["_iswdigit"] = _iswdigit = wasmExports2["iswdigit"];
     Module["_iswlower"] = _iswlower = wasmExports2["iswlower"];
+    Module["_iswpunct"] = _iswpunct = wasmExports2["iswpunct"];
     Module["_iswupper"] = _iswupper = wasmExports2["iswupper"];
     Module["_iswxdigit"] = _iswxdigit = wasmExports2["iswxdigit"];
     Module["_memchr"] = _memchr = wasmExports2["memchr"];
@@ -2614,6 +2654,10 @@ __name(checkModule, "checkModule");
 var TRANSFER_BUFFER;
 var LANGUAGE_VERSION;
 var MIN_COMPATIBLE_VERSION;
+var finalizer4 = newFinalizer((addresses) => {
+  C._ts_parser_delete(addresses[0]);
+  C._free(addresses[1]);
+});
 var Parser = class {
   static {
     __name(this, "Parser");
@@ -2630,6 +2674,7 @@ var Parser = class {
   }
   constructor() {
     this.initialize();
+    finalizer4?.register(this, [this[0], this[1]], this);
   }
   initialize() {
     if (!checkModule()) {
@@ -2640,6 +2685,7 @@ var Parser = class {
     this[1] = C.getValue(TRANSFER_BUFFER + SIZE_OF_INT, "i32");
   }
   delete() {
+    finalizer4?.unregister(this);
     C._ts_parser_delete(this[0]);
     C._free(this[1]);
     this[0] = 0;
@@ -2770,6 +2816,10 @@ var QueryError = class _QueryError extends Error {
     this.length = length;
     this.name = "QueryError";
   }
+  kind;
+  info;
+  index;
+  length;
   static {
     __name(this, "QueryError");
   }
@@ -2953,6 +3003,9 @@ function parsePattern(index, stepType, stepValueId, captureNames, stringValues,
   }
 }
 __name(parsePattern, "parsePattern");
+var finalizer5 = newFinalizer((address) => {
+  C._ts_query_delete(address);
+});
 var Query = class {
   static {
     __name(this, "Query");
@@ -3052,8 +3105,10 @@ var Query = class {
     this.assertedProperties = assertedProperties;
     this.refutedProperties = refutedProperties;
     this.exceededMatchLimit = false;
+    finalizer5?.register(this, address, this);
   }
   delete() {
+    finalizer5?.unregister(this);
     C._ts_query_delete(this[0]);
     this[0] = 0;
   }
@@ -8583,7 +8638,7 @@ function buildBashCFG(tree, startId, cache) {
       allEdges.push({ from: entryBlock.id, to: firstBlockId, type: "sequential" });
     }
     const exitBlock = {
-      id: blockIdCounter++,
+      id: blockIdCounter,
       type: "exit",
       start_line: topLevelStatements[topLevelStatements.length - 1].endPosition.row + 1,
       end_line: topLevelStatements[topLevelStatements.length - 1].endPosition.row + 1
@@ -8701,7 +8756,7 @@ function buildGoCFG(tree, blockIdCounter, cache) {
   const hasTopLevelDecls = tree.rootNode.children.some((c) => c !== null && isGoStatement(c));
   if (hasTopLevelDecls) {
     const block = {
-      id: blockIdCounter++,
+      id: blockIdCounter,
       type: "normal",
       start_line: 1,
       end_line: tree.rootNode.endPosition.row + 1
@@ -9746,7 +9801,7 @@ function buildRustDFG(tree, cache) {
   const defs = [];
   const uses = [];
   let defIdCounter = 1;
-  let useIdCounter = 1;
+  const useIdCounter = 1;
   const scopeStack = [new Map];
   const functions = findNodes(tree.rootNode, "function_item");
   for (const func2 of functions) {
@@ -10663,7 +10718,7 @@ function parsePythonDecorator(dec) {
     if (!fnNode)
       return null;
     let receiver = "";
-    let method = "";
+    let method;
     if (fnNode.type === "identifier") {
       method = getNodeText(fnNode);
     } else if (fnNode.type === "attribute") {
@@ -10733,7 +10788,7 @@ function classifyPythonDecorator(receiver, method, imp) {
   if (receiver && PY_HTTP_ROUTE_METHODS.has(method)) {
     const isRoutey = isPyRouterReceiver(receiver);
     if (isRoutey) {
-      let framework = "unknown";
+      let framework;
       if (imp.hasFlask)
         framework = "flask";
       else if (imp.hasFastApi)
@@ -19859,7 +19914,7 @@ class ConstantPropagator {
         }
       }
       const startIdx = matchingIdx >= 0 ? matchingIdx : defaultIdx;
-      for (let i2 = 0;i2 < startIdx && startIdx >= 0; i2++) {
+      for (let i2 = 0;i2 < startIdx; i2++) {
         this.markUnreachable(caseGroups[i2]);
       }
       if (startIdx >= 0) {
@@ -24549,16 +24604,22 @@ class CSharpPlugin extends BaseLanguagePlugin {
 }
 
 // ../circle-ir/dist/languages/plugins/index.js
+function createBuiltinPlugins() {
+  return [
+    new JavaPlugin,
+    new JavaScriptPlugin,
+    new PythonPlugin,
+    new RustPlugin,
+    new BashPlugin,
+    new HtmlPlugin,
+    new VuePlugin,
+    new GoPlugin,
+    new CSharpPlugin
+  ];
+}
 function registerBuiltinPlugins() {
-  registerLanguage(new JavaPlugin);
-  registerLanguage(new JavaScriptPlugin);
-  registerLanguage(new PythonPlugin);
-  registerLanguage(new RustPlugin);
-  registerLanguage(new BashPlugin);
-  registerLanguage(new HtmlPlugin);
-  registerLanguage(new VuePlugin);
-  registerLanguage(new GoPlugin);
-  registerLanguage(new CSharpPlugin);
+  for (const plugin of createBuiltinPlugins())
+    registerLanguage(plugin);
 }
 // ../circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
@@ -24572,7 +24633,7 @@ class CrossFilePass {
     const phase1Start = Date.now();
     logger.debug("cross-file: phase 1/4 starting (findCrossFileTaintFlows)");
     const flows = resolver.findCrossFileTaintFlows(budgetExceeded);
-    let phase1Truncated = budgetExceeded();
+    const phase1Truncated = budgetExceeded();
     logger.info("cross-file: phase 1/4 done", {
       flows: flows.length,
       elapsedMs: Date.now() - phase1Start
@@ -28180,17 +28241,14 @@ function findPythonRegexAllowlistWrapperSanitizers(code) {
     const argName = m[3];
     let foundGuard = false;
     let returnsArg = false;
-    let blockEnd = -1;
     const maxScan = Math.min(lines.length, i2 + 40);
     for (let j = i2 + 1;j < maxScan; j++) {
       const line = lines[j];
       if (line.trim() === "")
         continue;
       const indent = line.length - line.trimStart().length;
-      if (indent <= defIndent) {
-        blockEnd = j - 1;
+      if (indent <= defIndent)
         break;
-      }
       if (!foundGuard) {
         const guard = new RegExp(`if\\s+not\\s+re\\.(?:fullmatch|match)\\s*\\(\\s*(${tightRegex.source})\\s*,\\s*${argName}\\s*\\)\\s*:`);
         if (guard.test(line)) {
@@ -28211,8 +28269,6 @@ function findPythonRegexAllowlistWrapperSanitizers(code) {
         returnsArg = true;
       }
     }
-    if (blockEnd === -1)
-      blockEnd = Math.min(lines.length - 1, i2 + 39);
     if (!foundGuard || !returnsArg)
       continue;
     wrappers.push({ name: wrapperName, defLine: i2, defIndent });
@@ -31261,7 +31317,7 @@ function findRustEvalCrateCodeInjectionFindings(code, file) {
         continue;
       if (arg.length === 0)
         continue;
-      let unwrapped = arg.replace(/^&\s*/, "").trim();
+      const unwrapped = arg.replace(/^&\s*/, "").trim();
       if (/^"[^"]*"$/.test(unwrapped))
         continue;
       let tainted = false;
@@ -31948,7 +32004,7 @@ function findJsLdapInjectionFindings(code, file) {
   for (let i2 = 0;i2 < lines.length; i2++) {
     const line = lines[i2];
     const fm = line.match(filterPropRe);
-    let expr = null;
+    let expr;
     if (fm) {
       expr = fm[1].trim();
     } else if (filterShorthandRe.test(line)) {
@@ -34714,7 +34770,7 @@ class SinkFilterPass {
           if (/^-?\d+$/.test(t) || /^"(?:[^"\\]|\\.)*"$/.test(t) || /^'(?:[^'\\]|\\.)*'$/.test(t)) {
             continue;
           }
-          let helperName = null;
+          let helperName;
           const directCall = t.match(/^([A-Za-z_]\w*)\s*\(/);
           if (directCall) {
             helperName = directCall[1] ?? null;
@@ -40847,7 +40903,7 @@ function buildSourceCoveredRanges(codeLines, language) {
 function buildJsCoveredRanges(codeLines) {
   const ranges = [];
   const tryStack = [];
-  let braceDepthAtTry = [];
+  const braceDepthAtTry = [];
   let braceDepth = 0;
   for (let i2 = 0;i2 < codeLines.length; i2++) {
     const line = codeLines[i2];
@@ -40921,10 +40977,6 @@ class UnhandledExceptionPass {
         coveredRanges.push(range);
       }
     }
-    const catchStarts = new Set(exGraph.pairs.map((p) => p.catchBlock.start_line));
-    for (const range of coveredRanges) {
-      catchStarts.add(range.end + 1);
-    }
     const throwRe = language === "python" ? PYTHON_RAISE_RE : JS_THROW_RE;
     const unhandled = [];
     const reportedMethods = new Set;
@@ -40933,13 +40985,6 @@ class UnhandledExceptionPass {
       if (!throwRe.test(lineText))
         continue;
       let inCatch = false;
-      for (const cs of catchStarts) {
-        if (ln >= cs) {
-          inCatch = true;
-          break;
-        }
-      }
-      inCatch = false;
       for (const pair of exGraph.pairs) {
         if (ln >= pair.catchBlock.start_line) {
           const mThrow = graph.methodAtLine(ln);
@@ -46952,6 +46997,8 @@ var JAVA_XML_OUTPUT_ONLY_RE = /\bnew\s+(?:DOMSource|StreamResult)\s*\(/;
 var JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\s*\(/;
 var JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
 var JAVA_DOC_BUILDER_PARSE_RE = /(?:DocumentBuilder|builder)\s*\.\s*parse\s*\(/;
+var JAVA_HARDENING_SETTER_RE = /\.\s*(?:setFeature|setAttribute|setProperty|setXIncludeAware|setExpandEntityReferences)\s*\(/;
+var JAVA_FACTORY_CHAINED_RE = /\bnewInstance\s*\([^()]*\)\s*\.\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\s*\(/;
 var PY_LXML_PARSER_INSECURE_DEFAULT_RE = /\bresolve_entities\s*=\s*False\b/;
 
 class XmlEntityExpansionPass {
@@ -46964,8 +47011,10 @@ class XmlEntityExpansionPass {
     const code = ctx.code ?? "";
     if (language === "java") {
       const safeInFile = JAVA_SAFE_EVIDENCE_RE.test(code);
-      if (safeInFile)
-        return { findings };
+      const processWide = safeInFile && /jdk\.xml\./.test(code);
+      const lines = safeInFile ? code.split(`
+`) : [];
+      const methodRanges = safeInFile ? this.methodRanges(graph.ir.types) : [];
       const isXmlOutputOnly = JAVA_XML_OUTPUT_ONLY_RE.test(code) && !JAVA_XML_PARSE_INPUT_RE.test(code);
       const isDocumentBuilderEmptyOnly = JAVA_DOC_BUILDER_NEW_DOCUMENT_RE.test(code) && !JAVA_DOC_BUILDER_PARSE_RE.test(code);
       for (const call of graph.ir.calls) {
@@ -46977,6 +47026,8 @@ class XmlEntityExpansionPass {
         if (det.api === "DocumentBuilderFactory" && isDocumentBuilderEmptyOnly)
           continue;
         const line = call.location.line;
+        if (safeInFile && (processWide || !this.isProvablyUnhardened(lines, line, methodRanges, det.api)))
+          continue;
         findings.push({ line, language, ...det });
         ctx.addFinding({
           id: `${this.name}-${file}-${line}-${det.api}`,
@@ -46986,11 +47037,11 @@ class XmlEntityExpansionPass {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} created without disabling DTD / external-entity ` + "processing. Vulnerable to billion-laughs / quadratic " + "blow-up DoS (CWE-776) and external-entity disclosure " + '(CWE-611). Add `setFeature("http://apache.org/xml/features/' + 'disallow-doctype-decl", true)` (or the equivalent) before ' + "parsing.",
+          message: `${det.api} created without disabling DTD / external-entity ` + "processing. Vulnerable to external-entity disclosure " + "(CWE-611) and billion-laughs / quadratic blow-up DoS " + '(CWE-776). Add `setFeature("http://apache.org/xml/features/' + 'disallow-doctype-decl", true)` (or the equivalent) before ' + "parsing.",
           file,
           line,
           fix: this.fixForJava(det.api),
-          evidence: { ...det, language, safeFeatureInFile: false }
+          evidence: { ...det, language, safeFeatureInFile: safeInFile }
         });
       }
       return { findings };
@@ -47013,7 +47064,7 @@ class XmlEntityExpansionPass {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} called without an entity-safe parser. Vulnerable ` + "to billion-laughs / quadratic blow-up DoS (CWE-776) and " + "external-entity disclosure (CWE-611). Use `defusedxml` or pass " + "an `XMLParser(resolve_entities=False)` to lxml.",
+          message: `${det.api} called without an entity-safe parser. Vulnerable ` + (det.cwe === "CWE-611" ? "to external-entity disclosure (CWE-611) and billion-laughs / " + "quadratic blow-up DoS (CWE-776). " : "to billion-laughs / quadratic blow-up DoS (CWE-776). ") + "Use `defusedxml` or pass " + "an `XMLParser(resolve_entities=False)` to lxml.",
           file,
           line,
           fix: this.fixForPython(det.api),
@@ -47024,6 +47075,63 @@ class XmlEntityExpansionPass {
     }
     return { findings };
   }
+  methodRanges(types) {
+    const out2 = [];
+    for (const t of types ?? []) {
+      for (const m of t.methods ?? []) {
+        if (typeof m.start_line === "number" && typeof m.end_line === "number")
+          out2.push([m.start_line, m.end_line]);
+      }
+    }
+    return out2;
+  }
+  isProvablyUnhardened(lines, line, methodRanges, api) {
+    let range = null;
+    for (const r of methodRanges) {
+      if (line < r[0] || line > r[1])
+        continue;
+      if (!range || r[1] - r[0] < range[1] - range[0])
+        range = r;
+    }
+    if (!range)
+      return false;
+    let decl = "";
+    let declEnd = line;
+    for (;declEnd <= Math.min(line + 3, range[1]); declEnd++) {
+      decl += " " + (lines[declEnd - 1] ?? "").trim();
+      if (decl.includes(";"))
+        break;
+    }
+    const body2 = lines.slice(line - 1, range[1]).join(`
+`);
+    if (api === "TransformerFactory" && !/\bnew\s+StreamSource\s*\(/.test(body2))
+      return false;
+    if (JAVA_HARDENING_SETTER_RE.test(body2))
+      return false;
+    const chained = JAVA_FACTORY_CHAINED_RE.exec(decl);
+    if (chained) {
+      const prod = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=/.exec(decl);
+      if (!prod)
+        return true;
+      const pn = prod[1].replace(/\$/g, "\\$");
+      const after = lines.slice(declEnd, range[1]).join(`
+`);
+      return !new RegExp(`[(,]\\s*${pn}\\s*[,)]|\\breturn\\s+${pn}\\s*;`).test(after);
+    }
+    const m = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.]*\bnewInstance\s*\([^()]*\)\s*;/.exec(decl);
+    if (!m)
+      return false;
+    const name2 = m[1].replace(/\$/g, "\\$");
+    const rest = lines.slice(declEnd, range[1]).join(`
+`);
+    const builds = new RegExp(`\\b${name2}\\s*\\.\\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\\s*\\(`);
+    if (!builds.test(rest))
+      return false;
+    const escapes = new RegExp(`[(,]\\s*${name2}\\s*[,)]|\\breturn\\s+${name2}\\s*;`);
+    if (escapes.test(rest))
+      return false;
+    return true;
+  }
   detectJavaCall(call) {
     if (call.method_name !== "newInstance")
       return null;
@@ -47034,7 +47142,7 @@ class XmlEntityExpansionPass {
         return {
           pattern: `${factory}.newInstance()`,
           api: factory,
-          cwe: "CWE-776"
+          cwe: "CWE-611"
         };
       }
     }
@@ -47047,7 +47155,7 @@ class XmlEntityExpansionPass {
       return {
         pattern: `etree.${method}`,
         api: `lxml.etree.${method}`,
-        cwe: "CWE-776"
+        cwe: "CWE-611"
       };
     }
     if ((method === "parse" || method === "fromstring") && (recv === "ET" || recv === "ElementTree" || recv.endsWith(".ElementTree"))) {
@@ -49738,7 +49846,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.20";
+var version = "4.9.22";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -50168,9 +50276,18 @@ function formatJSON(results, crossFileData, profileSummary) {
   };
   return JSON.stringify(output, null, 2);
 }
+function physicalLocation(file, line) {
+  const hasLine = Number.isInteger(line) && line >= 1;
+  return {
+    physicalLocation: {
+      artifactLocation: { uri: file },
+      ...hasLine ? { region: { startLine: line } } : {}
+    }
+  };
+}
 function formatSARIF(results, crossFileData, profileSummary) {
   const sarif = {
-    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
     version: "2.1.0",
     runs: [
       {
@@ -50235,14 +50352,7 @@ function generateSarifResults(results, crossFileData) {
         ruleId: vuln.type.replace(/\s+/g, "-").toLowerCase(),
         level: vuln.severity === "critical" || vuln.severity === "high" ? "error" : "warning",
         message: { text: vuln.message },
-        locations: [
-          {
-            physicalLocation: {
-              artifactLocation: { uri: result.file },
-              region: { startLine: vuln.line }
-            }
-          }
-        ],
+        locations: [physicalLocation(result.file, vuln.line)],
         properties: {
           cwe: vuln.cwe,
           severity: vuln.severity,
@@ -50261,22 +50371,12 @@ function generateSarifResults(results, crossFileData) {
       message: {
         text: `Cross-file taint flow from ${p.source.file}:${p.source.line} to ${p.sink.file}:${p.sink.line}`
       },
-      locations: [
-        {
-          physicalLocation: {
-            artifactLocation: { uri: p.sink.file },
-            region: { startLine: p.sink.line }
-          }
-        }
-      ],
+      locations: [physicalLocation(p.sink.file, p.sink.line)],
       relatedLocations: [
         {
           id: 0,
           message: { text: "taint source" },
-          physicalLocation: {
-            artifactLocation: { uri: p.source.file },
-            region: { startLine: p.source.line }
-          }
+          ...physicalLocation(p.source.file, p.source.line)
         }
       ],
       properties: {
@@ -50291,8 +50391,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "eb03cc5",
-  builtAt: "2026-09-19T19:54:44.551Z"
+  gitSha: "54a142d",
+  builtAt: "2026-09-22T01:39:02.544Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.20",
+  "version": "4.9.22",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,9 +14,10 @@
     "test": "bun test",
     "clean": "rm -rf dist cognium-dev cognium-dev-* *.bun-build wasm",
     "typecheck": "tsc --noEmit",
-    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually \u2014 use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
+    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually — use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
     "dogfood": "bun run src/cli.ts scan src/ -q",
-    "prepublishOnly": "bun run build"
+    "prepublishOnly": "bun run build",
+    "test:coverage": "bun test --coverage"
   },
   "keywords": [
     "security",
@@ -66,11 +67,13 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.1",
-    "circle-ir": "4.9.20"
+    "circle-ir": "4.9.22"
   },
   "devDependencies": {
-    "@types/node": "^25.5.0",
-    "bun-types": "^1.3.11",
-    "typescript": "^6.0.2"
+    "@types/node": "^26.6.1",
+    "ajv": "^8.17.1",
+    "ajv-draft-04": "^1.0.0",
+    "bun-types": "^1.4.2",
+    "typescript": "^7.0.2"
   }
 }