Reduce retained AST nodes during Java analysis

csharp/src/main/java/com/ibm/plugin/CSharpAggregator.java

@@ -30,6 +30,7 @@
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.stream.Stream;
 import javax.annotation.Nonnull;
 
 /** Static accumulator for C# cryptographic detection results. Mirrors {@code GoAggregator}. */
@@ -64,4 +65,9 @@ public static void reset() {
         csharpLanguageSupport = LanguageSupporter.csharpLanguageSupporter();
         detectedNodes = new ArrayList<>();
     }
+
+    @Nonnull
+    public static Stream<INode> streamDetectedNodes() {
+        return detectedNodes.stream();
+    }
 }

go/src/main/java/com/ibm/plugin/GoAggregator.java

@@ -27,6 +27,7 @@
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.stream.Stream;
 import javax.annotation.Nonnull;
 import org.sonar.go.symbols.Symbol;
 import org.sonar.plugins.go.api.Tree;
@@ -61,4 +62,9 @@ public static void reset() {
         goLanguageSupport = LanguageSupporter.goLanguageSupporter();
         detectedNodes = new ArrayList<>();
     }
+
+    @Nonnull
+    public static Stream<INode> streamDetectedNodes() {
+        return detectedNodes.stream();
+    }
 }

java/src/main/java/com/ibm/plugin/JavaAggregator.java

@@ -23,9 +23,10 @@
 import com.ibm.engine.language.LanguageSupporter;
 import com.ibm.mapper.model.INode;
 import com.ibm.output.IAggregator;
-import java.util.ArrayList;
-import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
+import java.util.function.Consumer;
 import javax.annotation.Nonnull;
 import org.sonar.plugins.java.api.JavaCheck;
 import org.sonar.plugins.java.api.JavaFileScannerContext;
@@ -36,20 +37,36 @@ public final class JavaAggregator implements IAggregator {
 
     private static ILanguageSupport<JavaCheck, Tree, Symbol, JavaFileScannerContext>
             javaLanguageSupport = LanguageSupporter.javaLanguageSupporter();
-    private static List<INode> detectedNodes = new ArrayList<>();
+
+    private static volatile Consumer<INode> liveConsumer = null;
+    private static int totalNodeCount = 0;
+    private static final Map<Class<? extends INode>, Long> kindDistribution = new HashMap<>();
 
     private JavaAggregator() {
         // nothing
     }
 
-    public static void addNodes(@Nonnull List<INode> newNodes) {
-        detectedNodes.addAll(newNodes);
+    public static void registerConsumer(Consumer<INode> consumer) {
+        liveConsumer = consumer;
+    }
+
+    public static synchronized void addNodes(List<INode> newNodes) {
+        for (INode node : newNodes) {
+            totalNodeCount++;
+            kindDistribution.merge(node.getKind(), 1L, Long::sum);
+            if (liveConsumer != null) {
+                liveConsumer.accept(node);
+            }
+        }
         IAggregator.log(newNodes);
     }
 
-    @Nonnull
-    public static List<INode> getDetectedNodes() {
-        return Collections.unmodifiableList(detectedNodes);
+    public static synchronized int getTotalNodeCount() {
+        return totalNodeCount;
+    }
+
+    public static synchronized Map<Class<? extends INode>, Long> getKindDistribution() {
+        return new HashMap<>(kindDistribution);
     }
 
     @Nonnull
@@ -58,8 +75,10 @@ public static List<INode> getDetectedNodes() {
         return javaLanguageSupport;
     }
 
-    public static void reset() {
+    public static synchronized void reset() {
         javaLanguageSupport = LanguageSupporter.javaLanguageSupporter();
-        detectedNodes = new ArrayList<>();
+        liveConsumer = null;
+        totalNodeCount = 0;
+        kindDistribution.clear();
     }
 }

java/src/main/java/com/ibm/plugin/rules/detection/JavaBaseDetectionRule.java

@@ -80,13 +80,14 @@ public List<Tree.Kind> nodesToVisit() {
      */
     @Override
     public void visitNode(@Nonnull Tree tree) {
+        final JavaScanContext scanContext = new JavaScanContext(this.context);
+
         detectionRules.forEach(
                 rule -> {
                     DetectionExecutive<JavaCheck, Tree, Symbol, JavaFileScannerContext>
                             detectionExecutive =
                                     JavaAggregator.getLanguageSupport()
-                                            .createDetectionExecutive(
-                                                    tree, rule, new JavaScanContext(this.context));
+                                            .createDetectionExecutive(tree, rule, scanContext);
                     detectionExecutive.subscribe(this);
                     detectionExecutive.start();
                 });

java/src/test/java/com/ibm/plugin/JavaAggregatorTest.java

@@ -0,0 +1,187 @@
+/*
+ * Sonar Cryptography Plugin
+ * Copyright (C) 2026 PQCA
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.ibm.plugin;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+
+import com.ibm.mapper.model.INode;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+class JavaAggregatorTest {
+
+    @BeforeEach
+    void setUp() {
+        JavaAggregator.reset();
+    }
+
+    @Test
+    void reset_clearsNodeCount() {
+        INode node = mockNode(INode.class);
+        JavaAggregator.addNodes(List.of(node, node));
+
+        JavaAggregator.reset();
+
+        assertThat(JavaAggregator.getTotalNodeCount()).isZero();
+    }
+
+    @Test
+    void reset_clearsKindDistribution() {
+        INode node = mockNode(INode.class);
+        JavaAggregator.addNodes(List.of(node));
+
+        JavaAggregator.reset();
+
+        assertThat(JavaAggregator.getKindDistribution()).isEmpty();
+    }
+
+    @Test
+    void reset_deregistersConsumer() {
+        List<INode> received = new ArrayList<>();
+        JavaAggregator.registerConsumer(received::add);
+
+        JavaAggregator.reset();
+
+        INode node = mockNode(INode.class);
+        JavaAggregator.addNodes(List.of(node));
+
+        assertThat(received).isEmpty();
+    }
+
+    @Test
+    void reset_isIdempotent() {
+        JavaAggregator.reset();
+        JavaAggregator.reset();
+
+        assertThat(JavaAggregator.getTotalNodeCount()).isZero();
+    }
+
+    @Test
+    void addNodes_incrementsCountByListSize() {
+        INode a = mockNode(INode.class);
+        INode b = mockNode(INode.class);
+
+        JavaAggregator.addNodes(List.of(a, b));
+
+        assertThat(JavaAggregator.getTotalNodeCount()).isEqualTo(2);
+    }
+
+    @Test
+    void addNodes_accumulatesAcrossMultipleCalls() {
+        INode node = mockNode(INode.class);
+
+        JavaAggregator.addNodes(List.of(node));
+        JavaAggregator.addNodes(List.of(node, node));
+
+        assertThat(JavaAggregator.getTotalNodeCount()).isEqualTo(3);
+    }
+
+    @Test
+    void addNodes_emptyList_doesNotChangeCount() {
+        JavaAggregator.addNodes(List.of());
+
+        assertThat(JavaAggregator.getTotalNodeCount()).isZero();
+    }
+
+    @Test
+    void addNodes_tracksKindDistribution_singleKind() {
+        INode a = mockNode(AlgorithmStub.class);
+        INode b = mockNode(AlgorithmStub.class);
+
+        JavaAggregator.addNodes(List.of(a, b));
+
+        Map<Class<? extends INode>, Long> dist = JavaAggregator.getKindDistribution();
+        assertThat(dist).containsEntry(AlgorithmStub.class, 2L);
+    }
+
+    @Test
+    void addNodes_tracksKindDistribution_multipleKinds() {
+        INode algo = mockNode(AlgorithmStub.class);
+        INode key = mockNode(KeyStub.class);
+
+        JavaAggregator.addNodes(List.of(algo, key, algo));
+
+        Map<Class<? extends INode>, Long> dist = JavaAggregator.getKindDistribution();
+        assertThat(dist).containsEntry(AlgorithmStub.class, 2L).containsEntry(KeyStub.class, 1L);
+    }
+
+    @Test
+    void getKindDistribution_returnsSnapshot_notLiveReference() {
+        INode node = mockNode(AlgorithmStub.class);
+        JavaAggregator.addNodes(List.of(node));
+
+        Map<Class<? extends INode>, Long> snapshot = JavaAggregator.getKindDistribution();
+
+        JavaAggregator.addNodes(List.of(node));
+
+        assertThat(snapshot).containsEntry(AlgorithmStub.class, 1L);
+    }
+
+    @Test
+    void addNodes_forwardsToRegisteredConsumer() {
+        List<INode> received = new ArrayList<>();
+        JavaAggregator.registerConsumer(received::add);
+
+        INode a = mockNode(INode.class);
+        INode b = mockNode(INode.class);
+        JavaAggregator.addNodes(List.of(a, b));
+
+        assertThat(received).containsExactly(a, b);
+    }
+
+    @Test
+    void addNodes_withNoConsumer_doesNotThrow() {
+        INode node = mockNode(INode.class);
+
+        JavaAggregator.addNodes(List.of(node));
+
+        assertThat(JavaAggregator.getTotalNodeCount()).isEqualTo(1);
+    }
+
+    @Test
+    void registerConsumer_replacesExistingConsumer() {
+        List<INode> first = new ArrayList<>();
+        List<INode> second = new ArrayList<>();
+
+        JavaAggregator.registerConsumer(first::add);
+        JavaAggregator.registerConsumer(second::add);
+
+        INode node = mockNode(INode.class);
+        JavaAggregator.addNodes(List.of(node));
+
+        assertThat(first).isEmpty();
+        assertThat(second).containsExactly(node);
+    }
+
+    private <T extends INode> T mockNode(Class<T> kind) {
+        T mock = mock(kind);
+        doReturn(kind).when(mock).getKind();
+        return mock;
+    }
+
+    interface AlgorithmStub extends INode {}
+
+    interface KeyStub extends INode {}
+}

output/src/main/java/com/ibm/output/IOutputFile.java

@@ -21,11 +21,11 @@
 
 import com.ibm.mapper.model.INode;
 import java.io.File;
-import java.util.List;
+import java.util.stream.Stream;
 import javax.annotation.Nonnull;
 
 public interface IOutputFile {
-    void add(@Nonnull List<INode> nodes);
+    void add(Stream<INode> nodes);
 
     void saveTo(@Nonnull File file);
 }

output/src/main/java/com/ibm/output/IOutputFileFactory.java

@@ -21,12 +21,12 @@
 
 import com.ibm.mapper.model.INode;
 import com.ibm.output.cyclondx.CBOMOutputFileFactory;
-import java.util.List;
+import java.util.stream.Stream;
 import javax.annotation.Nonnull;
 
 public interface IOutputFileFactory {
     public static IOutputFileFactory DEFAULT = new CBOMOutputFileFactory();
 
     @Nonnull
-    IOutputFile createOutputFormat(@Nonnull List<INode> nodes);
+    IOutputFile createOutputFormat(Stream<INode> nodes);
 }