cognium-dev 4.9.23 → 4.9.25

package/dist/cli.js

@@ -16846,6 +16846,9 @@ function buildFileIndex(ir) {
   }
   return { callsByLine, defsByLine, usesByLine, callsByMethod, sinksByMethod, defsByMethod };
 }
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 
 class CrossFileResolver {
   fileIndexes = new WeakMap;
@@ -17214,7 +17217,7 @@ class CrossFileResolver {
             candidates.push(arg.variable);
           if (arg.expression) {
             for (const [name2] of paramNameToIndex) {
-              const re = new RegExp(`\\b${name2}\\b`);
+              const re = new RegExp(`\\b${escapeRegExp(name2)}\\b`);
               if (re.test(arg.expression))
                 candidates.push(name2);
             }
@@ -17298,7 +17301,7 @@ class CrossFileResolver {
               }
               if (arg.expression) {
                 for (const v of reachable.names) {
-                  if (new RegExp(`\\b${v}\\b`).test(arg.expression)) {
+                  if (new RegExp(`\\b${escapeRegExp(v)}\\b`).test(arg.expression)) {
                     matchedName = v;
                     break;
                   }
@@ -17729,7 +17732,7 @@ class CrossFileResolver {
     }
     if (arg.expression) {
       for (const [tv, origin] of tainted) {
-        const re = new RegExp(`\\b${tv}\\b`);
+        const re = new RegExp(`\\b${escapeRegExp(tv)}\\b`);
         if (re.test(arg.expression))
           return { var: tv, origin };
       }
@@ -37658,7 +37661,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             for (const other of taintedVars) {
               if (other === varName)
                 continue;
-              const re = new RegExp(`\\b${other}\\b`);
+              const re = new RegExp(`\\b${other.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
               if (!re.test(rhs))
                 continue;
               anyReferenced = true;
@@ -37889,7 +37892,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         }
         const assignMatch = sinkCode.match(/^\s*(?:[A-Za-z_][\w.<>[\]\s,?]*\s+)?[A-Za-z_]\w*\s*=(?!=)\s*/);
         const rhs = assignMatch ? sinkCode.slice(assignMatch[0].length) : sinkCode;
-        if (new RegExp(`\\b${sourceVar}\\b`).test(rhs)) {
+        if (new RegExp(`\\b${sourceVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`).test(rhs)) {
           continue;
         }
       }
@@ -48608,6 +48611,20 @@ function computeProjectProfileSummary(fileAnalyses) {
   }
   return { byShape, byEnv, totalFiles: fileAnalyses.length };
 }
+function longestLineLength(code) {
+  let max = 0, start2 = 0;
+  for (let i2 = 0;i2 < code.length; i2++) {
+    if (code.charCodeAt(i2) === 10) {
+      if (i2 - start2 > max)
+        max = i2 - start2;
+      start2 = i2 + 1;
+    }
+  }
+  if (code.length - start2 > max)
+    max = code.length - start2;
+  return max;
+}
+var MAX_ANALYZABLE_LINE_LENGTH = 1e4;
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -48659,6 +48676,27 @@ async function analyze(code, filePath, language, options = {}) {
       meta.projectProfile = makeProfileResolver2(options.projectProfile)(filePath);
     }
     phaseEnd("extractMeta", tMeta);
+    if (longestLineLength(code) > MAX_ANALYZABLE_LINE_LENGTH) {
+      logger.warn("Skipping analysis of a minified / single-line file", {
+        filePath,
+        language,
+        codeLength: code.length
+      });
+      return {
+        meta,
+        types: [],
+        calls: [],
+        cfg: { blocks: [], edges: [] },
+        dfg: { defs: [], uses: [], chains: [] },
+        taint: { sources: [], sinks: [], sanitizers: [] },
+        imports: [],
+        exports: [],
+        unresolved: [],
+        enriched: {},
+        metrics: { file: filePath, metrics: [] },
+        parse_status: parseStatus
+      };
+    }
     const tTypes = phaseStart();
     const types = extractTypes(tree, nodeCache, language);
     phaseEnd("extractTypes", tTypes);
@@ -50118,19 +50156,30 @@ var YELLOW = "\x1B[93m";
 var BLUE = "\x1B[94m";
 var CYAN = "\x1B[96m";
 var MAGENTA = "\x1B[95m";
+function colorEnabled() {
+  const noColor = process.env.NO_COLOR;
+  if (noColor !== undefined && noColor !== "")
+    return false;
+  if (process.env.TERM === "dumb")
+    return false;
+  return true;
+}
+function paint(code, text) {
+  return colorEnabled() ? `${code}${text}${RESET}` : text;
+}
 var colors = {
-  red: (text) => `${RED}${text}${RESET}`,
-  green: (text) => `${GREEN}${text}${RESET}`,
-  yellow: (text) => `${YELLOW}${text}${RESET}`,
-  blue: (text) => `${BLUE}${text}${RESET}`,
-  cyan: (text) => `${CYAN}${text}${RESET}`,
-  magenta: (text) => `${MAGENTA}${text}${RESET}`,
-  bold: (text) => `${BOLD}${text}${RESET}`,
+  red: (text) => paint(RED, text),
+  green: (text) => paint(GREEN, text),
+  yellow: (text) => paint(YELLOW, text),
+  blue: (text) => paint(BLUE, text),
+  cyan: (text) => paint(CYAN, text),
+  magenta: (text) => paint(MAGENTA, text),
+  bold: (text) => paint(BOLD, text),
   dim: (text) => text
 };
 
 // src/version.ts
-var version = "4.9.23";
+var version = "4.9.25";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -50675,8 +50724,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "e7e65f8",
-  builtAt: "2026-09-22T22:15:34.355Z"
+  gitSha: "2467260",
+  builtAt: "2026-09-24T06:46:18.058Z"
 };
 
 // src/utils/args.ts
@@ -50735,7 +50784,7 @@ COMMANDS:
   version              Display version information
 
 SCAN OPTIONS:
-  -l, --language <lang>      Scan only files for language (bash|go|html|java|javascript|typescript|python|rust)
+  -l, --language <lang>      Scan only files for language (bash|csharp|go|html|java|javascript|typescript|python|rust)
   -f, --format <format>      Output format (text|json|sarif) [default: text]
   --threads <n>              Parallel analysis threads [default: 4]
   --severity <level>         Filter by severity:
@@ -50768,7 +50817,7 @@ SCAN OPTIONS:
                                surfaced in output (text warning / JSON / SARIF field).
 
 METRICS OPTIONS:
-  -l, --language <lang>      Analyze only files for language (bash|go|html|java|javascript|typescript|python|rust)
+  -l, --language <lang>      Analyze only files for language (bash|csharp|go|html|java|javascript|typescript|python|rust)
   -f, --format <format>      Output format (text|json) [default: text]
   --category <cats>          Filter by metric category (comma-separated):
                                - Valid categories: complexity, size, coupling,
@@ -50877,19 +50926,19 @@ class Spinner {
   succeed(text) {
     this.stop();
     const message = text || this._text;
-    console.error(`\x1B[32m${CHECKMARK}\x1B[0m ${message}`);
+    console.error(`${colors.green(CHECKMARK)} ${message}`);
     return this;
   }
   fail(text) {
     this.stop();
     const message = text || this._text;
-    console.error(`\x1B[31m${CROSS}\x1B[0m ${message}`);
+    console.error(`${colors.red(CROSS)} ${message}`);
     return this;
   }
   warn(text) {
     this.stop();
     const message = text || this._text;
-    console.error(`\x1B[33m${WARNING}\x1B[0m ${message}`);
+    console.error(`${colors.yellow(WARNING)} ${message}`);
     return this;
   }
   set text(value) {
@@ -50916,8 +50965,7 @@ function loadConfig(profilePath) {
     const content = readFileSync(configPath, "utf-8");
     return JSON.parse(content);
   } catch (err2) {
-    console.error(colors.yellow(`Warning: Failed to parse ${configPath}: ${err2}`));
-    return null;
+    throw new Error(`Failed to parse ${configPath}: ${err2 instanceof Error ? err2.message : String(err2)}. ` + "Fix the JSON or remove the file.");
   }
 }
 function convertConfigToPassOptions(config) {
@@ -50983,6 +51031,27 @@ function applySuppressionsToResults(results, suppressions, basePath) {
     return { ...result, vulnerabilities: filteredVulns };
   });
 }
+function applySuppressionsToTaintPaths(paths, suppressions, basePath) {
+  if (suppressions.length === 0)
+    return paths;
+  return paths.filter((path) => {
+    for (const supp of suppressions) {
+      const sinkType = path.sink.type;
+      if (supp.pass !== sinkType && supp.pass !== `cross-file-${sinkType}`)
+        continue;
+      if (supp.file) {
+        const suppFile = supp.file.replace(/^\.\//, "");
+        const relativeFile = relative4(basePath, path.sink.file) || path.sink.file;
+        if (suppFile !== relativeFile && suppFile !== path.sink.file)
+          continue;
+      }
+      if (supp.line !== undefined && supp.line !== path.sink.line)
+        continue;
+      return false;
+    }
+    return true;
+  });
+}
 var TEST_PATTERNS = [
   /[\/\\]test[\/\\]/i,
   /[\/\\]tests[\/\\]/i,
@@ -51040,9 +51109,30 @@ function detectLanguage7(filePath) {
   const ext = extname(filePath).toLowerCase();
   return LANG_MAP[ext] || null;
 }
+var SUPPORTED_SCAN_LANGUAGES = [
+  ...new Set(Object.values(LANG_MAP))
+].sort();
 function normalizeLanguage(language) {
   return language.trim().toLowerCase();
 }
+function resolveScanLanguage(raw) {
+  if (raw === undefined || raw === "")
+    return;
+  const normalized = normalizeLanguage(String(raw));
+  if (!SUPPORTED_SCAN_LANGUAGES.includes(normalized)) {
+    throw new Error(`Invalid language: ${normalized}
+Valid options: ${SUPPORTED_SCAN_LANGUAGES.join(", ")}`);
+  }
+  return normalized;
+}
+function languageFromCliOptions(options) {
+  try {
+    return resolveScanLanguage(options.language || options.l);
+  } catch (err2) {
+    console.error(colors.red(`Error: ${err2.message}`));
+    process.exit(1);
+  }
+}
 function fileMatchesLanguage(filePath, language) {
   const detected = detectLanguage7(filePath);
   if (!detected)
@@ -51053,9 +51143,13 @@ function fileMatchesLanguage(filePath, language) {
 }
 function matchesGlob(filePath, pattern) {
   const normalizedPath = filePath.replace(/\\/g, "/");
-  const normalizedPattern = pattern.replace(/\\/g, "/");
+  let normalizedPattern = pattern.replace(/\\/g, "/");
+  normalizedPattern = normalizedPattern.replace(/\*{3,}/g, "**").replace(/(?:\*\*\/)+/g, "**/").replace(/(?:\/\*\*)+/g, "/**");
+  const globstarCount = (normalizedPattern.match(/\*\*/g) ?? []).length;
+  if (globstarCount > 4)
+    return false;
   let regex = normalizedPattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\?/g, ".");
-  regex = regex.replace(/\{\{GLOBSTAR\}\}\//g, "(?:.+/)?").replace(/\/\{\{GLOBSTAR\}\}/g, "(?:/.*)?").replace(/\{\{GLOBSTAR\}\}/g, ".*");
+  regex = regex.replace(/\{\{GLOBSTAR\}\}\//g, "(?:[^/]+/)*").replace(/\/\{\{GLOBSTAR\}\}/g, "(?:/[^/]+)*").replace(/\{\{GLOBSTAR\}\}/g, "[^]*");
   return new RegExp("^" + regex + "$").test(normalizedPath);
 }
 function matchesAnyPattern(filePath, patterns) {
@@ -51446,9 +51540,12 @@ async function runScan(targetPath, options) {
     if (spin)
       spin.succeed(`Scanned ${files.length} file(s)`);
     if (suppressions.length > 0) {
-      const beforeCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0);
+      const beforeCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0) + (crossFileData?.taintPaths.length ?? 0);
       results = applySuppressionsToResults(results, suppressions, process.cwd());
-      const afterCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0);
+      if (crossFileData) {
+        crossFileData.taintPaths = applySuppressionsToTaintPaths(crossFileData.taintPaths, suppressions, process.cwd());
+      }
+      const afterCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0) + (crossFileData?.taintPaths.length ?? 0);
       if (!options.quiet && beforeCount !== afterCount) {
         console.error(colors.dim(`Suppressed ${beforeCount - afterCount} finding(s) via config`));
       }
@@ -51997,7 +52094,7 @@ Usage: cognium-dev metrics <path> [options]`);
       category: options.category,
       output: options.output || options.o,
       quiet: options.quiet === true || options.q === true,
-      language: options.language || options.l ? normalizeLanguage(options.language || options.l) : undefined,
+      language: languageFromCliOptions(options),
       excludeTests: options["exclude-tests"] === true,
       profile: options.profile || options.p
     };
@@ -52035,7 +52132,7 @@ Usage: cognium-dev scan <path> [options]`);
     }
     const targetPath = args2[0];
     const scanOptions = {
-      language: options.language || options.l ? normalizeLanguage(options.language || options.l) : undefined,
+      language: languageFromCliOptions(options),
       format: options.format || options.f || "text",
       threads: parseInt(options.threads || "4", 10),
       severity: options.severity,
@@ -52069,12 +52166,15 @@ main().catch((error) => {
   process.exit(2);
 });
 export {
+  resolveScanLanguage,
   matchesGlob,
   loadConfig,
   isTestFile2 as isTestFile,
   detectLanguage7 as detectLanguage,
   dedupeVulnerabilities,
   convertConfigToPassOptions,
+  applySuppressionsToTaintPaths,
   applySuppressionsToResults,
+  SUPPORTED_SCAN_LANGUAGES,
   PASS_REGISTRY
 };

package/package.json

@@ -1,9 +1,7 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.23",
+  "version": "4.9.25",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
   "bin": {
     "cognium-dev": "dist/cli.js"
   },
@@ -14,7 +12,7 @@
     "test": "bun test",
     "clean": "rm -rf dist cognium-dev cognium-dev-* *.bun-build wasm",
     "typecheck": "tsc --noEmit",
-    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually — use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
+    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually \u2014 use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
     "dogfood": "bun run src/cli.ts scan src/ -q",
     "prepublishOnly": "bun run build",
     "test:coverage": "bun test --coverage"
@@ -67,7 +65,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.1",
-    "circle-ir": "4.9.23"
+    "circle-ir": "4.9.25"
   },
   "devDependencies": {
     "@types/node": "^26.6.1",