cognium-dev 4.9.25 → 4.9.27

package/dist/cli.js

@@ -7,6 +7,7 @@ import { readFileSync, existsSync, writeFileSync } from "fs";
 import { stat as stat2, readdir as readdir2 } from "fs/promises";
 import { join as join2, dirname as dirname3, extname, resolve as resolve2, relative as relative4, basename } from "path";
 import { createRequire as createRequire2 } from "module";
+import { getHeapStatistics } from "v8";
 
 // ../../node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp = Object.defineProperty;
@@ -3349,8 +3350,9 @@ async function initParser(options = {}) {
       });
     }
     parserInitialized = true;
+  })().finally(() => {
     parserInitializing = null;
-  })();
+  });
   return parserInitializing;
 }
 async function loadLanguage(language, wasmPath) {
@@ -12702,6 +12704,7 @@ var DEFAULT_SINKS = [
   { method: "Deserialize", class: "ObjectStateFormatter", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Raw", class: "Html", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "WriteAsync", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Content", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -26727,6 +26730,52 @@ function findGoRequestBodySources(sourceCode, language) {
       continue;
     }
   }
+  const wrapRe = new RegExp(`^\\s*(?:var\\s+)?([A-Za-z_]\\w*)\\s*:?=\\s*bufio\\s*\\.\\s*New(?:Scanner|Reader|ReaderSize)\\s*\\(.*${bodyRef}`);
+  const braceDelta = (s) => {
+    const code = s.replace(/"(?:[^"\\]|\\.)*"|`[^`]*`|'(?:[^'\\]|\\.)*'/g, '""').replace(/\/\/.*$/, "");
+    let d = 0;
+    for (const ch of code) {
+      if (ch === "{")
+        d++;
+      else if (ch === "}")
+        d--;
+    }
+    return d;
+  };
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const w = wrapRe.exec(lines[i2]);
+    if (!w)
+      continue;
+    const wrapper = w[1];
+    if (wrapper === "_")
+      continue;
+    const readRe = new RegExp(`(?<![\\w.])${wrapper}\\s*\\.\\s*(Text|Bytes|ReadString|ReadBytes|ReadLine|ReadSlice)\\s*\\(`);
+    const assignRe = new RegExp(`^\\s*(?:var\\s+)?([A-Za-z_][\\w\\s,]*?)\\s*:?=(?!=)\\s*(?:string\\s*\\(\\s*)?${wrapper}\\s*\\.\\s*(?:Text|Bytes|ReadString|ReadBytes|ReadLine|ReadSlice)\\s*\\(`);
+    const rebindRe = new RegExp(`(?<![\\w.])${wrapper}\\s*:?=(?!=)`);
+    let depth = 0;
+    for (let j = i2 + 1;j < lines.length; j++) {
+      depth += braceDelta(lines[j - 1]);
+      if (depth < 0)
+        break;
+      const line = lines[j];
+      if (/^\s*\/\//.test(line))
+        continue;
+      if (rebindRe.test(line))
+        break;
+      const rd = readRe.exec(line);
+      if (!rd)
+        continue;
+      const as = assignRe.exec(line);
+      let variable = "<inline>";
+      if (as) {
+        const bound = as[1].split(",").map((v) => v.trim()).find((v) => v !== "_" && v !== "err" && /^[A-Za-z_]\w*$/.test(v));
+        if (!bound)
+          continue;
+        variable = bound;
+      }
+      push(variable, j + 1, `bufio ${wrapper}.${rd[1]}() over req.Body`);
+    }
+  }
   return sources;
 }
 function findCSharpRequestSources(sourceCode, language) {
@@ -26736,24 +26785,101 @@ function findCSharpRequestSources(sourceCode, language) {
   const lines = sourceCode.split(`
 `);
   const assignRe = /^\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
-  const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
   const formFileParams = new Set;
   const formFileDeclRe = /\bIFormFile\s+([A-Za-z_]\w*)/g;
+  const httpRequestReceivers = new Set(["Request"]);
+  const httpRequestDeclRe = /\b(?:HttpRequest|HttpRequestBase)\??\s+([A-Za-z_]\w*)/g;
   for (const line of lines) {
-    const re = new RegExp(formFileDeclRe.source, "g");
+    const formRe = new RegExp(formFileDeclRe.source, "g");
     let d;
-    while ((d = re.exec(line)) !== null)
+    while ((d = formRe.exec(line)) !== null)
       formFileParams.add(d[1]);
+    const reqRe = new RegExp(httpRequestDeclRe.source, "g");
+    while ((d = reqRe.exec(line)) !== null)
+      httpRequestReceivers.add(d[1]);
   }
   const formFileReadRe = formFileParams.size > 0 ? new RegExp(`\\b(?:${[...formFileParams].join("|")})\\s*\\.\\s*(?:FileName|ContentType)\\b`) : null;
+  const requestReadRe = new RegExp(`\\b(?:${[...httpRequestReceivers].join("|")})\\s*\\.\\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\\b`);
+  const classify = (text) => requestReadRe.test(text) ? "http_param" : formFileReadRe?.test(text) ? "http_param" : consoleReadRe.test(text) ? "io_input" : envReadRe.test(text) ? "env_input" : null;
+  const inlineReads = [
+    [requestReadRe, "http_param"],
+    [formFileReadRe, "http_param"],
+    [consoleReadRe, "io_input"],
+    [envReadRe, "env_input"]
+  ];
+  const inlineRead = (text) => {
+    const argsStart = text.indexOf("(");
+    for (const [re, type] of inlineReads) {
+      if (!re)
+        continue;
+      const g = new RegExp(re.source, "g");
+      let hit;
+      while ((hit = g.exec(text)) !== null) {
+        if (hit.index > argsStart) {
+          return { type, read: hit[0].replace(/\s+/g, "").replace(/[([]$/, "") };
+        }
+      }
+    }
+    return null;
+  };
+  const exprStmtCallRe = /^\s*(?:await\s+)?[A-Za-z_][\w.]*(?:<[^>]*>)?\s*\(.*\)\s*;\s*$/;
+  const nonCallKeywordRe = /^\s*(?:await\s+)?(?:if|while|for|foreach|switch|using|lock|return|throw|catch|when|nameof|typeof|sizeof|default)\b/;
+  const embeddedAssignRe = /(?:^|[{;])\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*([^;{}]+)/;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
-    if (!m)
+    if (!m) {
+      const stmt = lines[i2];
+      if (stmt.includes("{") && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
+        const emb = new RegExp(embeddedAssignRe.source, "g");
+        let em;
+        let seeded = false;
+        while ((em = emb.exec(stmt)) !== null) {
+          const varName2 = em[1];
+          const rhs2 = em[2];
+          const type3 = classify(rhs2);
+          if (!type3)
+            continue;
+          const lineNumber3 = i2 + 1;
+          if (sources.some((s) => s.line === lineNumber3 && s.variable === varName2))
+            continue;
+          sources.push({
+            type: type3,
+            location: `${varName2} = ${rhs2.trim().substring(0, 50)}${rhs2.length > 50 ? "..." : ""}`,
+            severity: "high",
+            line: lineNumber3,
+            confidence: 1,
+            variable: varName2
+          });
+          seeded = true;
+        }
+        if (seeded)
+          continue;
+      }
+      if (!exprStmtCallRe.test(stmt) || nonCallKeywordRe.test(stmt))
+        continue;
+      const hit = inlineRead(stmt);
+      if (!hit)
+        continue;
+      const { type: type2, read } = hit;
+      const lineNumber2 = i2 + 1;
+      if (sources.some((s) => s.line === lineNumber2))
+        continue;
+      const code = stmt.trim();
+      sources.push({
+        type: type2,
+        location: `${read} in ${code.substring(0, 50)}${code.length > 50 ? "..." : ""}`,
+        severity: "high",
+        line: lineNumber2,
+        confidence: 1,
+        variable: "<inline>",
+        code
+      });
       continue;
+    }
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : formFileReadRe?.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
+    const type = classify(rhs);
     if (!type)
       continue;
     const lineNumber = i2 + 1;
@@ -37425,6 +37551,18 @@ function maskStringLiteralsForTokenScan(expr) {
 }
 function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language, types) {
   const flows = [];
+  const goFnRanges = language === "go" && types ? types.flatMap((t) => t.methods.map((m) => [m.start_line, m.end_line])) : [];
+  const goFnStart = (line) => {
+    let best = -1;
+    let bestSpan = -1;
+    for (const [start2, end] of goFnRanges) {
+      if (line >= start2 && line <= end && end - start2 > bestSpan) {
+        best = start2;
+        bestSpan = end - start2;
+      }
+    }
+    return best;
+  };
   const sourcesWithVar = sources.filter((s) => typeof s.variable === "string" && s.variable.length > 0);
   const aliasSanitizedFor = new Map;
   if (language === "python" && typeof code === "string") {
@@ -37833,6 +37971,12 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
           if (source.in_method && call.in_method && source.in_method !== call.in_method) {
             continue;
           }
+          if (goFnRanges.length > 0) {
+            const srcFn = goFnStart(source.line);
+            const sinkFn = goFnStart(sink.line);
+            if (srcFn !== -1 && sinkFn !== -1 && srcFn !== sinkFn)
+              continue;
+          }
           if (complex) {
             const re = reCache.get(source.variable);
             if (!re || !re.test(expr))
@@ -49025,7 +49169,30 @@ async function analyzeProject(files, options = {}) {
   const perFileBudgetMs = options.perFileBudgetMs ?? 0;
   const perFileStart = Date.now();
   let perFileBudgetExceeded = false;
+  const maxProjectSourceChars = options.maxProjectSourceChars ?? 0;
+  const maxProjectFiles = options.maxProjectFiles ?? 0;
+  let projectSourceChars = 0;
+  let projectSizeBudgetExceeded = false;
   for (const { code, filePath, language } of files) {
+    if (maxProjectFiles > 0 && fileAnalyses.length >= maxProjectFiles) {
+      projectSizeBudgetExceeded = true;
+      logger.warn("analyzeProject: file-count ceiling reached, skipping remaining files", {
+        analysed: fileAnalyses.length,
+        total: files.length,
+        maxProjectFiles
+      });
+      break;
+    }
+    if (maxProjectSourceChars > 0 && projectSourceChars + code.length > maxProjectSourceChars) {
+      projectSizeBudgetExceeded = true;
+      logger.warn("analyzeProject: source-size ceiling reached, skipping remaining files", {
+        analysed: fileAnalyses.length,
+        total: files.length,
+        sourceChars: projectSourceChars,
+        maxProjectSourceChars
+      });
+      break;
+    }
     if (perFileBudgetMs > 0 && Date.now() - perFileStart > perFileBudgetMs) {
       perFileBudgetExceeded = true;
       logger.warn("analyzeProject: per-file budget exceeded, skipping remaining files", {
@@ -49040,6 +49207,7 @@ async function analyzeProject(files, options = {}) {
     projectGraph.addFile(filePath, new CodeGraph(ir));
     sourceLinesByFile.set(filePath, code.split(`
 `));
+    projectSourceChars += code.length;
   }
   const crossFileBudgetMs = options.crossFileBudgetMs ?? 300000;
   const crossFileResult = new CrossFilePass().run(projectGraph, sourceLinesByFile, { budgetMs: crossFileBudgetMs });
@@ -49093,6 +49261,9 @@ async function analyzeProject(files, options = {}) {
   if (perFileBudgetExceeded) {
     projectAnalysis.per_file_budget_exceeded = true;
   }
+  if (projectSizeBudgetExceeded) {
+    projectAnalysis.project_size_budget_exceeded = true;
+  }
   return projectAnalysis;
 }
 function deriveProjectName(paths) {
@@ -49945,18 +50116,24 @@ async function enumerate(dir, out2) {
     }
   }
 }
-function ownerOf(file, modules) {
-  let best;
-  let bestLen = -1;
+function createOwnerIndex(modules) {
+  const byRoot = new Map;
   for (const m of modules) {
-    if (file === m.root || file.startsWith(m.root + "/")) {
-      if (m.root.length > bestLen) {
-        best = m;
-        bestLen = m.root.length;
-      }
+    if (!byRoot.has(m.root))
+      byRoot.set(m.root, m);
+  }
+  return (file) => {
+    let p = file;
+    for (;; ) {
+      const hit = byRoot.get(p);
+      if (hit)
+        return hit;
+      const slash = p.lastIndexOf("/");
+      if (slash <= 0)
+        return;
+      p = p.slice(0, slash);
     }
-  }
-  return best;
+  };
 }
 
 // ../project-profile-detect/dist/publication-detect.js
@@ -50115,6 +50292,7 @@ async function detectProjectProfiles(scanRoot, options = {}) {
   }
   const profileByFile = new Map;
   const unknownFiles = [];
+  const ownerIndex = createOwnerIndex(modules);
   for (const file of files) {
     const rel = relative3(scanRoot, file);
     const ov = applyOverrides(rel, compiledOverrides);
@@ -50128,7 +50306,7 @@ async function detectProjectProfiles(scanRoot, options = {}) {
       profileByFile.set(file, `${shape2}/${env2}`);
       continue;
     }
-    const owner = ownerOf(file, modules);
+    const owner = ownerIndex(file);
     if (!owner) {
       profileByFile.set(file, "unknown");
       unknownFiles.push(file);
@@ -50179,7 +50357,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.25";
+var version = "4.9.27";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -50577,6 +50755,12 @@ function formatResults(results, verbose, crossFileData, profileSummary) {
     lines.push("");
     lines.push(formatCrossFilePaths(crossFileData.taintPaths));
   }
+  if (crossFileData?.projectSizeBudgetExceeded) {
+    lines.push("");
+    lines.push(colors.yellow(`⚠ Project size ceiling reached — analysed ${crossFileData.filesAnalysed ?? "?"} of ${crossFileData.filesTotal ?? "?"} files.`));
+    lines.push(colors.yellow("  Results cover the analysed files only; this is NOT a clean scan of the project."));
+    lines.push(colors.yellow("  Raise or disable the cap with --max-project-source-chars <n> (0 = unlimited)."));
+  }
   if (crossFileData?.budgetExceeded) {
     lines.push("");
     lines.push(colors.yellow("⚠ Cross-file budget exceeded — some cross-file taint paths may be missing."));
@@ -50597,6 +50781,7 @@ function formatJSON(results, crossFileData, profileSummary) {
     cross_file_taint_paths: crossFileData?.taintPaths ?? [],
     cross_file_calls: crossFileData?.crossFileCalls ?? [],
     cross_file_budget_exceeded: crossFileData?.budgetExceeded ?? false,
+    project_size_budget_exceeded: crossFileData?.projectSizeBudgetExceeded ?? false,
     ...profileSummary ? { project_profile: profileSummary } : {},
     summary: {
       filesScanned: results.length,
@@ -50724,8 +50909,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "2467260",
-  builtAt: "2026-09-24T06:46:18.058Z"
+  gitSha: "39d07d9",
+  builtAt: "2026-09-29T23:22:05.194Z"
 };
 
 // src/utils/args.ts
@@ -50815,6 +51000,17 @@ SCAN OPTIONS:
                                On exceed: partial taint paths kept, remaining
                                cross-file phases skipped, cross_file_budget_exceeded
                                surfaced in output (text warning / JSON / SARIF field).
+  --max-project-source-chars <n>
+                             Cap the per-file phase by total source characters
+                               [default: scaled to this process's V8 heap limit
+                               (~7000 chars per MB, so ~29M at Node's default
+                               4 GB heap) — 0 = unlimited. Raise it together
+                               with --max-old-space-size, not on its own.]
+                               A project large enough to exhaust the V8 heap would
+                               otherwise abort the process with no results at all.
+                               On exceed: remaining files skipped, results kept for
+                               the analysed subset, project_size_budget_exceeded
+                               surfaced in output (text warning / JSON field).
 
 METRICS OPTIONS:
   -l, --language <lang>      Analyze only files for language (bash|csharp|go|html|java|javascript|typescript|python|rust)
@@ -51233,12 +51429,35 @@ async function scanFile(filePath, language, analyzeOpts) {
     };
   }
 }
-async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
-  const filesWithCode = files.map((f) => ({
-    code: readFileSync(f, "utf-8"),
-    filePath: f,
-    language: language || detectLanguage7(f)
-  }));
+var CHARS_PER_MB_OF_HEAP = 7000;
+function defaultMaxProjectSourceChars() {
+  try {
+    const heapMb = getHeapStatistics().heap_size_limit / (1024 * 1024);
+    if (!Number.isFinite(heapMb) || heapMb <= 0)
+      return 32000000;
+    return Math.floor(heapMb * CHARS_PER_MB_OF_HEAP);
+  } catch {
+    return 32000000;
+  }
+}
+async function scanProject(files, language, analyzeOpts, crossFileBudgetMs, maxProjectSourceChars) {
+  const sourceCap = maxProjectSourceChars ?? defaultMaxProjectSourceChars();
+  const filesWithCode = [];
+  let sourceChars = 0;
+  let readTruncated = false;
+  for (const f of files) {
+    const code = readFileSync(f, "utf-8");
+    if (sourceCap > 0 && sourceChars + code.length > sourceCap && filesWithCode.length > 0) {
+      readTruncated = true;
+      break;
+    }
+    sourceChars += code.length;
+    filesWithCode.push({
+      code,
+      filePath: f,
+      language: language || detectLanguage7(f)
+    });
+  }
   const projectResult = await analyzeProject(filesWithCode, {
     passOptions: analyzeOpts?.passOptions,
     disabledPasses: analyzeOpts?.disabledPasses,
@@ -51274,7 +51493,10 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
     crossFileData: {
       taintPaths: projectResult.taint_paths,
       crossFileCalls: projectResult.cross_file_calls,
-      budgetExceeded: projectResult.cross_file_budget_exceeded === true
+      budgetExceeded: projectResult.cross_file_budget_exceeded === true,
+      projectSizeBudgetExceeded: readTruncated || projectResult.project_size_budget_exceeded === true,
+      filesAnalysed: projectResult.files.length,
+      filesTotal: files.length
     }
   };
 }
@@ -51505,7 +51727,7 @@ async function runScan(targetPath, options) {
     if ((await stat2(absPath)).isDirectory()) {
       if (spin)
         spin.text = `Running project analysis on ${files.length} file(s)...`;
-      const projectScan = await scanProject(files, options.language, analyzeOpts, options.crossFileBudgetMs);
+      const projectScan = await scanProject(files, options.language, analyzeOpts, options.crossFileBudgetMs, options.maxProjectSourceChars);
       results = projectScan.results;
       crossFileData = projectScan.crossFileData;
     } else {
@@ -51537,8 +51759,10 @@ async function runScan(targetPath, options) {
           spin.text = `Scanning... (${processed}/${files.length})`;
       }
     }
-    if (spin)
-      spin.succeed(`Scanned ${files.length} file(s)`);
+    if (spin) {
+      const analysed = crossFileData?.projectSizeBudgetExceeded ? crossFileData.filesAnalysed ?? files.length : files.length;
+      spin.succeed(analysed === files.length ? `Scanned ${files.length} file(s)` : `Scanned ${analysed} of ${files.length} file(s) — stopped at the project size ceiling`);
+    }
     if (suppressions.length > 0) {
       const beforeCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0) + (crossFileData?.taintPaths.length ?? 0);
       results = applySuppressionsToResults(results, suppressions, process.cwd());
@@ -51614,7 +51838,8 @@ async function runScan(targetPath, options) {
     const qualityCount = allVulns.filter((v) => v.category !== "security").length;
     const errors = results.filter((r) => r.error).length;
     const crossFilePaths = crossFileData?.taintPaths.length ?? 0;
-    const shouldOutput = totalVulns > 0 || crossFilePaths > 0 || errors > 0 || options.verbose || options.output || options.format !== "text";
+    const truncated = crossFileData?.projectSizeBudgetExceeded === true;
+    const shouldOutput = totalVulns > 0 || crossFilePaths > 0 || errors > 0 || options.verbose || options.output || options.format !== "text" || truncated;
     const profileSummary = buildProfileSummary(absPath, detectedModules, resolvedProfiles);
     if (resolvedProfiles) {
       for (const r of results) {
@@ -51646,15 +51871,17 @@ async function runScan(targetPath, options) {
       }
       if (!options.quiet && options.format === "text") {
         console.log();
+        const scanned = crossFileData?.projectSizeBudgetExceeded ? crossFileData.filesAnalysed ?? files.length : files.length;
+        const scannedLabel = crossFileData?.projectSizeBudgetExceeded ? `${scanned} of ${crossFileData.filesTotal ?? files.length} file(s) analysed` : `${scanned} file(s)`;
         if (securityCount > 0) {
-          console.log(colors.red(`Found ${securityCount} security finding(s) in ${files.length} file(s)`));
+          console.log(colors.red(`Found ${securityCount} security finding(s) in ${scannedLabel}`));
         }
         if (qualityCount > 0) {
           const label = securityCount > 0 ? "Also found" : "Found";
-          console.log(colors.yellow(`${label} ${qualityCount} code quality finding(s) in ${files.length} file(s)`));
+          console.log(colors.yellow(`${label} ${qualityCount} code quality finding(s) in ${scannedLabel}`));
         }
         if (securityCount === 0 && qualityCount === 0 && options.verbose) {
-          console.log(colors.green(`No findings in ${files.length} file(s)`));
+          console.log(colors.green(`No findings in ${scannedLabel}`));
         }
         if (errors > 0) {
           console.log(colors.yellow(`${errors} file(s) had errors during analysis`));
@@ -51948,6 +52175,17 @@ function parseCrossFileBudgetMs(raw) {
   }
   return n;
 }
+function parseMaxProjectSourceChars(raw) {
+  if (raw === undefined || raw === true || raw === "")
+    return;
+  const s = String(raw);
+  const n = Number.parseInt(s, 10);
+  if (!Number.isFinite(n) || n < 0 || String(n) !== s) {
+    console.error(colors.yellow(`Warning: invalid --max-project-source-chars "${s}" (expected non-negative integer, 0 = unlimited); ignoring`));
+    return;
+  }
+  return n;
+}
 var SBOM_MANIFESTS = {
   "package.json": parseNpmDependencies,
   "package-lock.json": parseNpmLockDependencies,
@@ -52145,6 +52383,7 @@ Usage: cognium-dev scan <path> [options]`);
       profile: options.profile || options.p,
       disablePass: options["disable-pass"],
       crossFileBudgetMs: parseCrossFileBudgetMs(options["cross-file-budget-ms"]),
+      maxProjectSourceChars: parseMaxProjectSourceChars(options["max-project-source-chars"]),
       projectProfile: parseProjectProfileArg(options["project-profile"]),
       noProjectProfile: options["no-project-profile"] === true,
       projectProfileExplain: options["project-profile-explain"] === true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.25",
+  "version": "4.9.27",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -64,11 +64,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@cognium/project-profile-detect": "1.1.1",
-    "circle-ir": "4.9.25"
+    "@cognium/project-profile-detect": "1.1.2",
+    "circle-ir": "4.9.27"
   },
   "devDependencies": {
-    "@types/node": "^26.6.1",
+    "@types/node": "^26.6.2",
     "ajv": "^8.17.1",
     "ajv-draft-04": "^1.0.0",
     "bun-types": "^1.4.2",