@orionscanner/cli 0.1.0 → 0.1.1

package/docs/API_REFERENCE.md

@@ -1,211 +0,0 @@
-# API Reference
-
-## Core Classes
-
-### OrionEngine
-Main orchestrator — single entry point for all 38 engines.
-
-```python
-from orion.engine import OrionEngine, EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from pathlib import Path
-
-engine = OrionEngine()
-ir = OrionIR(content=code.encode(), metadata={"path": "app.py", "language": "python"})
-config = EngineConfig(resource_limits=ResourceLimits(max_cpu_seconds=60))
-
-result = await engine.run([ir], config)
-```
-
-**Methods:**
-- `register_engine(name: str, engine_cls: type)` — Register custom engine
-- `run(irs: List[OrionIR], config: EngineConfig) -> EngineResult` — Run all engines
-- `registered_count: int` — Number of registered engines
-
-### EngineConfig
-Configuration for scan execution.
-
-```python
-config = EngineConfig(
-    toggles={
-        "exclude": ["tests/", "vendor/", "*.min.js"],
-        "only_engines": ["sast", "secrets", "deps"],
-        "severity_threshold": "medium",
-    },
-    resource_limits=ResourceLimits(
-        max_cpu_seconds=120,
-        max_memory_mb=1024,
-        max_file_size_mb=10,
-        max_files=50000
-    ),
-    network_policy=NetworkPolicy(
-        allow_outbound=False,
-        allowed_hosts=[]
-    )
-)
-```
-
-### ResourceLimits
-Per-engine resource constraints.
-
-```python
-ResourceLimits(
-    max_cpu_seconds=60,      # Timeout per engine
-    max_memory_mb=512,       # Memory limit
-    max_file_size_mb=10,     # Max file size to scan
-    max_files=50000          # Max files per scan
-)
-```
-
-### NetworkPolicy
-Network access control.
-
-```python
-NetworkPolicy(
-    allow_outbound=False,    # Block external calls
-    allowed_hosts=[]         # Allowlist (if outbound enabled)
-)
-```
-
-### OrionIR
-Intermediate Representation — content-addressed, immutable.
-
-```python
-ir = OrionIR(
-    content=b"source code bytes",
-    metadata={
-        "path": "relative/path.py",
-        "language": "python",
-        "project_root": "/absolute/project/root"
-    }
-)
-
-# Properties
-ir.address  # SHA-256 hash (first 16 chars)
-ir.content  # Raw bytes
-ir.metadata # Dict with path, language, project_root
-```
-
-### EngineResult
-Aggregated scan results.
-
-```python
-result = EngineResult(
-    engine="orion",           # Orchestrator name
-    findings=[Finding, ...],  # List of findings
-    errors=["engine: error"], # Engine errors (silent to user)
-    metrics={                 # Scan metadata
-        "elapsed_s": 1.23,
-        "engines_run": 38,
-        "files_scanned": 150
-    },
-    ok=True                   # False if any engine errored
-)
-```
-
-### Finding
-Individual security/quality issue.
-
-```python
-finding = Finding(
-    engine="sast",                    # Source engine
-    severity="critical",              # critical|high|medium|low|info
-    title="SQL Injection",            # Short title
-    description="User input in SQL",  # Detailed description
-    location="app.py:42",             # file:line
-    metadata={                        # Evidence
-        "confidence": 0.95,           # 0.0-1.0
-        "snippet": "query = f\"...\"", # Code context
-        "cwe": "CWE-89",              # CWE ID
-        "cvss": 8.9,                  # CVSS score
-        "pattern": "sql_injection",   # Pattern name
-        "file": "app.py",             # File path
-        "line": 42                    # Line number
-    }
-)
-```
-
-## Engine Interface
-
-All engines implement this interface:
-
-```python
-class Engine:
-    name = "engine_name"
-    version = "1.0.0"
-    
-    async def check_availability(self) -> bool:
-        """Return True if engine can run."""
-        return True
-    
-    def resource_limits(self) -> ResourceLimits:
-        """Return resource limits for this engine."""
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512)
-    
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        """Analyze a single IR."""
-        # Language detection
-        language = ir.metadata.get("language")
-        if isinstance(language, str):
-            language = Language(language.lower())
-        
-        # Route to language-specific analyzer
-        if language == Language.PYTHON:
-            return await self._run_python_ast(ir, config)
-        
-        # Universal regex fallback
-        return self.universal.run(ir, config)
-```
-
-## CLI Usage
-
-```bash
-# Interactive menu
-orion
-
-# Direct scan
-orion . --security      # Security engines only
-orion . --quality       # Quality engines only
-orion . --arch          # Architecture engines only
-orion .                 # Full audit (all 38 engines)
-orion path/to/file.py   # Single file
-orion ./my_project      # Directory scan
-
-# Config
-orion . --config-json '{"resource_limits":{"max_cpu_seconds":30}}'
-```
-
-## Reports
-
-Generated in `ORION SCANNER REPORTS/`:
-- `ScanType_target_timestamp.html` — Dark theme, sidebar, expandable findings, score/grade
-- `ScanType_target_timestamp.json` — Machine-readable
-- `ScanType_target_timestamp.txt` — Human-readable summary
-
-## Language Detection
-
-Automatic from file extension/filename:
-
-| Extension | Language |
-|-----------|----------|
-| `.py` | python |
-| `.js`, `.jsx`, `.mjs` | javascript |
-| `.ts`, `.tsx` | typescript |
-| `.java` | java |
-| `.go` | go |
-| `.rs` | rust |
-| `.php` | php |
-| `.rb` | ruby |
-| `.cs` | csharp |
-| `.html`, `.htm` | html |
-| `.css`, `.scss` | css |
-| `.yml`, `.yaml` | yaml |
-| `.json` | json |
-| `.toml` | toml |
-| `.xml` | xml |
-| `Dockerfile` | dockerfile |
-| `.sh` | shell |
-| `.ps1` | powershell |
-| `.md` | markdown |
-
-Special filenames: `Dockerfile`, `Makefile`, `package.json`, `requirements.txt`, `Cargo.toml`, `pom.xml`, `go.mod`, `composer.json`, `Gemfile`, `pyproject.toml`, `poetry.lock`, `yarn.lock`, `pnpm-lock.yaml`

package/docs/ARCHITECTURE.md

@@ -1,183 +0,0 @@
-# Orion Engine Architecture
-
-## Overview
-
-Orion Engine is a **polyglot code audit platform** with 38 native analysis engines, built as a single MIT-licensed Python package. No external tool dependencies (Semgrep, TruffleHog, Safety, Bandit, etc.).
-
-## Core Design Principles
-
-| Principle | Implementation |
-|-----------|----------------|
-| **Total Coverage** | 38 engines covering security, quality, architecture, supply chain, compliance |
-| **Hardened** | No silent failures, secret zeroization, resource limits, per-engine timeouts |
-| **Atomic** | Per-engine isolation - one failure doesn't cascade |
-| **Native** | Pure Python, zero subprocess calls, zero external tool dependencies |
-| **Orchestrated** | Single `OrionEngine().run()` entry point for all 38 engines |
-| **Scalable** | Async/await, connection pooling, stateless engines, polyglot dispatch |
-
-## Architecture Overview
-
-```
-��─────────────────────────────────────────────────────────────��
-│                    OrionEngine                              │
-│  (Orchestrator - single run() entry point)                  │
-��──────────────────────────��──────────────────────────────────��
-                           │
-         ��─────────────────��─────────────────��
-         ��                 ��                 ��
-��────────────────�� ��────────────────�� ��────────────────��
-│ Polyglot       │ │ Engine         │ │ Registry       │
-│ Dispatcher     │ │ Registry       │ │ (38 engines)   │
-��──────��─────────�� └────────────────�� └────────────────��
-       │
-       ��
-��─────────────────────────────────────────────────────────────��
-│                 Language Detection                           │
-│  .py → Python    .js/.ts → JS/TS    .html → HTML             │
-│  .java → Java    .go → Go         .rs → Rust                 │
-│  Dockerfile      docker-compose    .yaml/.json/.toml        │
-��──────────────────────────��────────────────────────────────────��
-                           │
-         ��─────────────────��─────────────────��
-         ��                 ��                 ��
-��────────────────�� ��────────────────�� ��────────────────��
-│ Python AST     │ Universal Regex  │ Language-Specific│
-│ Analyzers      │ (Fallback)       │ Analyzers        │
-��────────────────�� └────────────────�� └────────────────��
-```
-
-## Core Components
-
-### 1. OrionEngine (Orchestrator)
-- Single entry point: `OrionEngine().run(irs, config)`
-- Manages 38 engines concurrently with timeouts
-- Aggregates findings, handles errors silently
-
-### 2. Polyglot Dispatcher
-- Detects language from file extension/filename
-- Routes to language-specific analyzer or universal fallback
-- Supports 20+ languages out of the box
-
-### 3. Engine Registry
-- Auto-discovers 38 engines on first use
-- Maps engine name → engine class
-- Provides health checks and resource limits
-
-### 4. IR (Intermediate Representation)
-- Content-addressed (SHA-256)
-- Carries: content, path, language, project_root, metadata
-- Immutable, serializable
-
-## 38 Engines by Category
-
-### Security (7)
-| Engine | Purpose | Languages |
-|--------|---------|-----------|
-| `sast` | SQLi, XSS, CMDi, SSRF, path traversal, secrets, weak crypto | Python (AST), JS/TS (regex), Universal |
-| `secrets` | API keys, tokens, passwords (regex + entropy) | All text files |
-| `deps` | Vulnerable deps (requirements.txt, package.json, Cargo.toml, etc.) | Python, JS/TS, Go, Rust, Java, PHP, Ruby |
-| `taint` | User input → dangerous sink tracking | Python (AST), JS/TS (planned) |
-| `authorization` | Missing auth on routes | Python (Flask/FastAPI/Django), JS/TS (Express) |
-| `sandbox_escape` | `__import__('os')`, `eval(compile())`, etc. | Python |
-| `prompt_security` | Prompt injection detection | All text files |
-
-### AST/IR Analysis (8)
-`callgraph`, `cfg`, `symbol`, `dataflow`, `orphan`, `dead_import`, `wiring_trace`, `state`
-
-### Quality (7)
-`complexity`, `duplication`, `error_handling`, `logging_c`, `license`, `lint`, `test_coverage`
-
-### Config/Infra (7)
-`config_engine`, `config_validation`, `contract_probe`, `perf_guard`, `data_residency`, `regression`, `container`
-
-### Meta/Supply Chain (9)
-`chaos`, `chaos_config`, `noise`, `hunter`, `supply_chain_sbom`, `compliance`, `provenance`, `fp_learn`, `architecture`
-
-## Data Flow
-
-```
-User Code → Files → IR List → OrionEngine.run()
-                                    │
-                                    ��
-                         ��──────────────────────��
-                         │ For each IR:         │
-                         │ 1. Detect language   │
-                         │ 2. Route to analyzer │
-                         │ 3. Collect findings  │
-                         └──────────────────────��
-                                    │
-                                    ��
-                         ��──────────────────────��
-                         │ Aggregate & Dedupe   │
-                         │ Score & Grade        │
-                         │ Generate Reports     │
-                         └──────────────────────��
-```
-
-## Configuration
-
-```python
-config = EngineConfig(
-    toggles={
-        "exclude": ["tests/", "vendor/", "*.min.js"],
-        "only_engines": ["sast", "secrets", "deps"],
-        "severity_threshold": "medium",
-    },
-    resource_limits=ResourceLimits(
-        max_cpu_seconds=120,
-        max_memory_mb=1024,
-        max_files=50000
-    ),
-    network_policy=NetworkPolicy(allow_outbound=False)
-)
-```
-
-## Reports
-
-Three formats generated in `ORION SCANNER REPORTS/`:
-- **HTML** - Dark theme, sidebar nav, expandable findings, score/grade
-- **JSON** - Machine-readable, CI/CD integration
-- **TXT** - Human-readable summary
-
-## Extending Engines
-
-```python
-class MyEngine:
-    name = "my_engine"
-    version = "1.0.0"
-    
-    async def check_availability(self) -> bool: return True
-    
-    def resource_limits(self):
-        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=256)
-    
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        # Language-aware analysis
-        language = ir.metadata.get("language")
-        # ... analysis logic
-        return EngineResult(engine=self.name, findings=[...], ok=True)
-
-# Register
-EngineRegistry().register("my_engine", MyEngine)
-```
-
-## Polyglot Support Matrix
-
-| Language | SAST | Secrets | Deps | Taint | Callgraph | Config |
-|----------|------|---------|------|-------|-----------|--------|
-| Python | �� AST | �� | �� | �� AST | �� | �� |
-| JavaScript | �� Regex | �� | �� | ��� Planned | ��� | �� |
-| TypeScript | �� Regex | �� | �� | ��� Planned | ��� | �� |
-| Java | ��� Regex | �� | �� | ��� | ��� | �� |
-| Go | ��� Regex | �� | �� | ��� | ��� | �� |
-| Rust | ��� Regex | �� | �� | ��� | ��� | �� |
-| PHP | ��� Regex | �� | �� | ��� | ��� | �� |
-| Ruby | ��� Regex | �� | �� | ��� | ��� | �� |
-| C/C++ | ��� Regex | �� | ��� | ��� | ��� | �� |
-| C# | ��� Regex | �� | �� | ��� | ��� | �� |
-| Go/Rust/JS/TS | Universal | �� | �� | Universal | ��� | �� |
-| HTML/CSS | ��� Regex | �� | ��� | Universal | ��� | ��� |
-| Dockerfile | ��� Regex | �� | �� | Universal | ��� | �� |
-| YAML/JSON/TOML | ��� | �� | �� | ��� | ��� | �� |
-
-��� = Full support | ��� = Regex/Universal fallback | ��� = Not applicable

package/docs/CHANGELOG.md

@@ -1,112 +0,0 @@
-# Changelog
-
-All notable changes to Orion Engine.
-
-## [0.1.0] - 2026-08-14
-
-### Added
-- **38 Native Engines** — SAST, Secrets, Deps, Taint, Callgraph, CFG, Symbol, Dataflow, Authorization, Orphan, Prompt Security, Contract Probe, Wiring Trace, State, License, Complexity, Duplication, Dead Import, Error Handling, Logging, Config Engine, Chaos, Chaos Config, Regression, Perf Guard, Data Residency, Noise, Supply Chain SBOM, Hunter, Lint, Architecture, Test Coverage, Container, Compliance, Provenance, FP Learn, Sandbox Escape, Config Validation
-- **Polyglot Support** — 20+ languages via automatic detection and universal regex fallback
-- **Polyglot Dispatcher** — Routes files to language-specific analyzers or universal regex
-- **Language Infrastructure** — 20+ languages, capabilities registry, extension mapping
-- **Professional HTML Reports** — Dark theme, sidebar nav, expandable findings, score/grade (A-F), responsive design
-- **Interactive CLI** — Menu system (9 options), multi-colored spinner, auto clear-screen
-- **Three Report Formats** — HTML (dark theme), JSON (CI/CD), TXT (human-readable)
-- **False Positive Learning** — Reads `.orion-feedback.json`, reduces confidence on matches
-- **Compliance Mapping** — GDPR, PCI-DSS, SOC2, HIPAA
-- **SBOM Generation** — CycloneDX format with purl, hashes, licenses
-- **Provenance Attestation** — SLSA-like: git commit, file hashes, builder identity
-- **FP Learning** — Reads feedback, reduces confidence on similar patterns
-- **Config Validation** — Self-validates OrionEngine config
-
-### Core Platform
-- `OrionEngine` — Single orchestrator, async, 38 engines concurrent
-- `EngineConfig` — Toggles, resource limits, network policy
-- `ResourceLimits` — CPU, memory, file size, file count limits
-- `NetworkPolicy` — Outbound control with allowlist
-- `OrionIR` — Content-addressed (SHA-256), immutable
-- `EngineResult` / `Finding` — Structured results with evidence
-- `EngineRegistry` — Auto-discovery of 38 engines
-
-### Language Support (20+)
-Python, JavaScript, TypeScript, Java, Go, Rust, PHP, Ruby, C/C++, C#, HTML, CSS, YAML, JSON, TOML, XML, Dockerfile, Shell, PowerShell, Markdown
-
-### Security Engines
-- **sast** — SQLi, XSS, CMDi, SSRF, path traversal, hardcoded creds, weak crypto, deserialization
-- **secrets** — API keys, tokens, passwords (regex + entropy), test pattern filtering
-- **deps** — Vulnerable deps (requirements.txt, package.json, Cargo.toml, go.mod, pom.xml, composer.json, Gemfile, Pipfile, poetry.lock, yarn.lock, pnpm-lock.yaml)
-- **taint** — User input → dangerous sinks (SQL, shell, code exec, template, deserialization)
-- **authorization** — Missing auth on Flask/FastAPI/Django/Express/Spring/Gin/Laravel/Rails/ASP.NET routes
-- **sandbox_escape** — `__import__('os')`, `eval(compile())`, `ctypes`, `__subclasses__()`, `Function` constructor, `Runtime.exec`, `Process.Start`
-- **prompt_security** — Prompt injection, jailbreak, base64 payloads, special tokens
-
-### AST/IR Analysis Engines
-- **callgraph** — Function calls, recursion, undefined functions, deep chains
-- **cfg** — Control flow: unreachable code, infinite loops, missing returns, cyclomatic complexity
-- **symbol** — Symbol table: shadowed builtins, undefined names, unused imports, late-binding closures
-- **dataflow** — Variable def/use: use-before-def, dead stores, mutable defaults, global mutations
-- **orphan** — Zero incoming imports (excludes entry points)
-- **dead_import** — Unused imports across scopes
-- **wiring_trace** — Config → usage tracing
-- **state** — Mutable globals, class attrs, function defaults, `global`/`nonlocal`
-
-### Quality Engines
-- **complexity** — Cyclomatic & cognitive complexity (>10/20/50)
-- **duplication** — Sliding window token normalization, SHA256 clustering
-- **error_handling** — Bare except, swallowed errors, lost causes, assert in prod, sys.exit in libs
-- **logging_c** — print() in prod, PII in logs, missing getLogger, DEBUG in prod, no structured logging
-- **license** — SPDX headers, GPL/AGPL detection, root LICENSE, dep conflicts
-- **lint** — Unused vars, undefined names, import order, line length, docstrings, wildcards, ==None, bare except
-- **test_coverage** — Untested public functions, test-only-mocks, no assertions, long tests, missing conftest
-
-### Config/Infra Engines
-- **config_engine** — Required keys, types, placeholders, secrets, duplicates, URLs, emails
-- **chaos** — No retry/circuit-breaker/timeout/idempotency, global locks, direct instantiation
-- **chaos_config** — Empty/null/negative/huge values, invalid enums, circular refs, long strings
-- **regression** — Monkey patching, dynamic imports, sys.modules mutation, builtins/env mutation
-- **perf_guard** — N+1 queries, O(n²) loops, string concat, large in-memory, missing pagination, sync I/O in async
-- **data_residency** — PII: emails, phones, SSN, credit cards (Luhn), IPs, UUIDs, API keys
-- **container** — Dockerfile, docker-compose, K8s YAML, Helm: root, latest tag, secrets, privileged, host namespaces, healthcheck, limits
-
-### Meta/Supply Chain Engines
-- **noise** — Low confidence + recent changes + high churn, duplicates, generated files
-- **hunter** — Cross-engine correlation: SQLi+auth=CRITICAL, XSS+CSP=HIGH, secret+public=CRITICAL
-- **supply_chain_sbom** — CycloneDX: purl, hashes, licenses, external refs
-- **compliance** — GDPR (Art 25/32/33), PCI-DSS (Req 3/4/6/8), SOC2 (CC6.1/6.7/7.2), HIPAA (164.312)
-- **provenance** — Git commit/tag/branch, SHA256 file hashes, builder identity, dep hashes
-- **fp_learn** — Reads `.orion-feedback.json`, reduces confidence by 0.3 on feature match
-- **config_validation** — Validates paths, globs, limits, network policy, parallelism, timeout
-- **architecture** — Cyclic imports, layer violations (domain→app→infra→pres), god classes/modules, feature envy
-
-### Reports
-- **HTML** — Dark theme, fixed sidebar, expandable findings, score/grade (A-F), responsive, print-ready
-- **JSON** — Machine-readable, CI/CD ready
-- **TXT** — Human-readable summary
-
-### CLI
-- `orion` — Interactive menu (9 options)
-- `orion .` — Full audit
-- `orion . --security` — Security engines only
-- `orion . --quality` — Quality engines only
-- `orion . --arch` — Architecture engines only
-- `orion path` — Scan file or directory
-- `orion . --config-json '{}'` — Custom config
-
-### Removed
-- All GPL/AGPL dependencies (Semgrep, TruffleHog, Safety, Bandit)
-- External tool subprocess calls
-- Old adapter/check/intelligence/reporting architecture
-- Benchmarks, fixtures, test suites (legacy)
-- Docker, npm, GUI, serve, sandbox modules
-
-## Upgrade Guide
-
-### From 0.x (Legacy)
-- Complete rewrite — no migration path
-- Install fresh: `pip install -e .`
-- Config format changed — use new `EngineConfig`
-- API changed — use `OrionEngine().run(irs, config)`
-
----
-
-**Orion Engine v0.1.0** — 38 native MIT engines, polyglot, zero external deps, professional reports.

package/docs/CONTRIBUTING.md

@@ -1,157 +0,0 @@
-# Contributing
-
-## Development Setup
-
-```bash
-git clone https://github.com/chandrahotha/OrionEngine
-cd OrionEngine
-pip install -e .[dev]
-pre-commit install
-```
-
-## Code Style
-
-- **Python 3.10+** — type hints required
-- **Black** — formatting (`black src/`)
-- **Ruff** — linting (`ruff check src/`)
-- **MyPy** — type checking (`mypy src/`)
-- **Async first** — all engines async
-
-## Adding a New Engine
-
-1. Create directory: `src/orion/engine/my_engine/`
-2. Create `engine.py`:
-
-```python
-from orion.engine.languages import detect_language, Language, get_capabilities
-from orion.engine.dispatcher import UniversalRegexAnalyzer, PolyglotEngine
-from orion.engine.config import EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-class Engine:
-    name = "my_engine"
-    version = "1.0.0"
-    
-    def __init__(self):
-        self.universal = UniversalRegexAnalyzer(
-            categories=["secrets", "sql_injection", "xss", "command_injection"]
-        )
-    
-    async def check_availability(self) -> bool:
-        return True
-    
-    def resource_limits(self) -> ResourceLimits:
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512)
-    
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        language = ir.metadata.get("language")
-        if isinstance(language, str):
-            try:
-                language = Language(language.lower())
-            except ValueError:
-                from orion.engine.languages import detect_language
-                language = detect_language(ir.metadata.get("path", ""))
-        
-        if language == Language.PYTHON:
-            return await self._run_python(ir, config)
-        
-        return self.universal.run(ir, config)
-    
-    async def _run_python(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        # Python-specific AST analysis
-        findings = []
-        # ... your analysis
-        return EngineResult(engine=self.name, findings=findings, ok=True)
-
-# Backward compatibility
-Engine = Engine
-```
-
-3. Register in `src/orion/engine/registry.py` (auto-discovery works automatically)
-
-## Testing
-
-```bash
-# Run all tests
-pytest tests/
-
-# Run specific engine tests
-pytest tests/test_sast.py -v
-
-# Type check
-mypy src/
-
-# Lint
-ruff check src/
-
-# Format
-black src/
-```
-
-## Engine Guidelines
-
-1. **No silent failures** — wrap in try/except, return errors in `EngineResult.errors`
-2. **Confidence scoring** — every finding needs `metadata["confidence"]` (0.0-1.0)
-3. **Evidence** — include `snippet`, `cwe`, `cvss`, `line`, `file` in metadata
-4. **Language support** — use `detect_language()`, `get_capabilities()`, `UniversalRegexAnalyzer`
-5. **Resource limits** — respect `config.get_limits().max_cpu_seconds`
-5. **No silent failures** — engine errors go to `EngineResult.errors`, not stdout
-6. **Async** — `run()` must be async, use `asyncio.wait_for` for timeouts
-
-## Polyglot Support
-
-Add language support to your engine:
-
-```python
-async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-    language = ir.metadata.get("language")
-    if isinstance(language, str):
-        try:
-            language = Language(language.lower())
-        except ValueError:
-            from orion.engine.languages import detect_language
-            language = detect_language(ir.metadata.get("path", ""))
-    
-    caps = get_capabilities(language)
-    
-    if language == Language.PYTHON:
-        return await self._run_python_ast(ir, config)
-    elif language in (Language.JAVASCRIPT, Language.TYPESCRIPT):
-        return await self._run_js_regex(ir, config)
-    elif language in (Language.JAVA, Language.GO, Language.RUST, Language.PHP, Language.RUBY):
-        return await self._run_universal(ir, config)
-    
-    return self.universal.run(ir, config)
-```
-
-## Adding Language Support
-
-1. Add to `Language` enum in `languages.py`
-2. Add extension mapping in `EXTENSION_MAP`
-3. Add `LanguageCapabilities` in `LANGUAGE_CAPABILITIES`
-4. Add patterns to `UNIVERSAL_PATTERNS` in `dispatcher.py`
-5. Test with sample files
-
-## Reporting Bugs
-
-Use GitHub Issues with:
-- Orion version (`orion --version` or check `pyproject.toml`)
-- Python version
-- OS
-- Minimal reproduction code
-- Expected vs actual behavior
-- Engine(s) involved
-
-## Pull Request Process
-
-1. Fork & create feature branch
-2. Write tests for new functionality
-3. Ensure all tests pass
-4. Run `black`, `ruff`, `mypy`
-5. Update docs if needed
-6. Submit PR with clear description
-
-## License
-
-MIT — all contributions must be MIT-compatible.