@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/llm_security/engine.py

@@ -1,125 +0,0 @@
-"""AI & Large Language Model (LLM) Agent Security Engine.
-
-100% Custom In-House Developed Engine for Orion Engine Platform (OWASP Top 10 for LLMs).
-Detects prompt injection vectors, unsafe output execution, system prompt leaks, and excessive agent autonomy.
-"""
-import re
-from pathlib import Path
-from typing import List, Dict, Any
-
-from orion.engine.config import EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-LLM_RULES = [
-    {
-        "id": "LLM-001",
-        "pattern": r"(?i)\b(eval|exec|subprocess\.run|os\.system|child_process\.exec)\s*\([^)]*(response|output|completion|llm_out|generation|text)\b",
-        "title": "Unsafe execution of LLM output (LLM02: Insecure Output Handling)",
-        "description": "Directly evaluating or executing untrusted LLM-generated code or commands can lead to remote code execution",
-        "severity": "critical",
-        "cwe": "CWE-94",
-        "confidence": 0.9,
-    },
-    {
-        "id": "LLM-002",
-        "pattern": r'(?i)(f["\'].*\{.*(user_input|prompt|query|input_text|req\.body|message).*\}.*|format\s*\([^)]*(user_input|prompt|query|input_text)\)|template\s*\+\s*(user_input|query|prompt))',
-        "title": "Unsanitized direct string interpolation into system prompt (LLM01: Prompt Injection)",
-        "description": "User input is directly concatenated into prompt templates without boundary tags or guardrail filtering",
-        "severity": "high",
-        "cwe": "CWE-20",
-        "confidence": 0.8,
-    },
-    {
-        "id": "LLM-003",
-        "pattern": r'(?i)(system_prompt|system_instruction)\s*[:=]\s*["\'][^"\']*(ignore previous instructions|you are a|classified|secret|internal only)',
-        "title": "Hardcoded sensitive system prompt with confidential constraints",
-        "description": "Hardcoded system prompts often leak via direct user query or jailbreak techniques (LLM06: Sensitive Information Disclosure)",
-        "severity": "medium",
-        "cwe": "CWE-200",
-        "confidence": 0.85,
-    },
-    {
-        "id": "LLM-004",
-        "pattern": r'(?i)(auto_approve\s*=\s*True|allow_all_tools\s*=\s*True|autonomous_execution\s*=\s*True|dangerously_allow_execution\s*=\s*True)',
-        "title": "Excessive agent tool autonomy enabled without human-in-the-loop (LLM08: Excessive Agency)",
-        "description": "AI Agent configured to execute destructive tools or modifications without confirmation gates",
-        "severity": "high",
-        "cwe": "CWE-863",
-        "confidence": 0.9,
-    },
-    {
-        "id": "LLM-005",
-        "pattern": r'(?i)(openai\.api_key|anthropic_api_key|gemini_api_key|groq_api_key)\s*=\s*["\'][a-zA-Z0-9_\-]{20,}["\']',
-        "title": "Hardcoded LLM provider API credentials",
-        "description": "Hardcoded AI model API key detected in source code. Store credentials in secure secret managers",
-        "severity": "critical",
-        "cwe": "CWE-798",
-        "confidence": 0.95,
-    },
-]
-
-
-class LlmSecurityEngine:
-    """100% custom, in-house developed AI & LLM Agent Security Engine."""
-
-    name = "llm_security"
-    version = "1.0.0"
-
-    def __init__(self):
-        self._compiled_rules = []
-        for r in LLM_RULES:
-            self._compiled_rules.append({
-                **r,
-                "regex": re.compile(r["pattern"])
-            })
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self) -> ResourceLimits:
-        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=256)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        path = ir.metadata.get("path", "unknown")
-        try:
-            content = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        lines = content.splitlines()
-        findings = []
-
-        for rule in self._compiled_rules:
-            for match in rule["regex"].finditer(content):
-                line_no = content[:match.start()].count('\n') + 1
-                start_line = max(0, line_no - 2)
-                end_line = min(len(lines), line_no + 2)
-                snippet = '\n'.join(lines[start_line:end_line])
-
-                findings.append(Finding(
-                    engine=self.name,
-                    severity=rule["severity"],
-                    title=f"{rule['id']}: {rule['title']}",
-                    description=rule["description"],
-                    location=f"{path}:{line_no}",
-                    metadata={
-                        "rule_id": rule["id"],
-                        "cwe": rule["cwe"],
-                        "confidence": rule["confidence"],
-                        "snippet": snippet,
-                        "file": path,
-                        "line": line_no,
-                    }
-                ))
-
-        return EngineResult(
-            engine=self.name,
-            findings=findings,
-            ok=True,
-            metrics={"findings_count": len(findings)}
-        )
-
-
-Engine = LlmSecurityEngine

package/src/orion/engine/logging_c/engine.py

@@ -1,164 +0,0 @@
-"""Logging issues detection engine."""
-import ast
-import re
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class Engine:
-    name = "logging_c"
-    version = "1.0.0"
-
-    PII_PATTERNS = [
-        "password", "passwd", "pwd", "secret", "token", "api_key", "apikey",
-        "access_token", "refresh_token", "private_key", "secret_key",
-        "credit_card", "creditcard", "cc_number", "cvv", "ssn",
-        "social_security", "email", "mail", "phone", "mobile"
-    ]
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        try:
-            text = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        path = ir.metadata.get("path", "unknown")
-        is_test = self._is_test_file(path)
-        is_main = self._is_main_file(text)
-
-        if is_test and not self._is_test_logging_utility(text):
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        try:
-            tree = ast.parse(text, filename=path)
-        except SyntaxError:
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        findings = []
-        visitor = LoggingVisitor(path, is_test, is_main, text.splitlines(), self.PII_PATTERNS)
-        visitor.visit(tree)
-        findings.extend(visitor.findings)
-
-        if not is_test:
-            findings.extend(self._check_print_statements(text, path))
-
-        return EngineResult(engine=self.name, findings=findings, ok=True)
-
-    def _is_test_file(self, path: str) -> bool:
-        test_patterns = ["test_", "_test.py", "/tests/", "/test/", "conftest.py", "pytest", "unittest"]
-        return any(p in path for p in test_patterns)
-
-    def _is_main_file(self, text: str) -> bool:
-        return 'if __name__ == "__main__"' in text or "if __name__ == '__main__'" in text
-
-    def _is_test_logging_utility(self, text: str) -> bool:
-        return "logging" in text and ("test" in text.lower() or "fixture" in text.lower())
-
-    def _check_print_statements(self, text: str, path: str) -> list[Finding]:
-        findings = []
-        lines = text.splitlines()
-        for i, line in enumerate(lines):
-            if re.search(r"\bprint\s*\(", line) and not re.search(r"#.*print\s*\(", line):
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="low",
-                    title="Print statement in non-main/non-test file",
-                    description="Use logging module instead of print for production code",
-                    location=f"{path}:{i + 1}",
-                    metadata={
-                        "confidence": 0.8,
-                        "snippet": line.strip()[:200],
-                        "cwe": "CWE-532",
-                    },
-                ))
-        return findings
-
-
-class LoggingVisitor(ast.NodeVisitor):
-    def __init__(self, filepath: str, is_test: bool, is_main: bool, lines: list[str], pii_patterns: list[str]):
-        self.filepath = filepath
-        self.is_test = is_test
-        self.is_main = is_main
-        self.lines = lines
-        self.pii_patterns = [p.lower() for p in pii_patterns]
-        self.findings = []
-        self.has_getlogger = False
-        self.basicconfig_count = 0
-        self.log_level_debug = False
-        self.in_production = not (is_test or is_main)
-
-    def visit_Call(self, node: ast.Call):
-        if isinstance(node.func, ast.Attribute):
-            if node.func.attr == "getLogger" and isinstance(node.func.value, ast.Name) and node.func.value.id == "logging":
-                self.has_getlogger = True
-                if node.args:
-                    arg = node.args[0]
-                    if isinstance(arg, ast.Constant) and arg.value == "__name__":
-                        pass
-                    elif isinstance(arg, ast.Name) and arg.id == "__name__":
-                        pass
-                    else:
-                        self._add_finding(node, "Logger name not __name__", "Use logging.getLogger(__name__) for proper hierarchy", 0.75)
-            elif node.func.attr == "basicConfig" and isinstance(node.func.value, ast.Name) and node.func.value.id == "logging":
-                self.basicconfig_count += 1
-                if self.basicconfig_count > 1:
-                    self._add_finding(node, "Multiple logging.basicConfig calls", "basicConfig should be called once at application startup", 0.8)
-                for kw in node.keywords:
-                    if kw.arg == "level" and isinstance(kw.value, ast.Constant) and kw.value.value == "DEBUG":
-                        if self.in_production:
-                            self._add_finding(node, "Debug log level in production config", "DEBUG level should not be used in production", 0.85)
-
-        if isinstance(node.func, ast.Attribute) and isinstance(node.func.value, ast.Name):
-            if node.func.value.id == "logging" and node.func.attr in ("info", "warning", "error", "critical", "debug", "exception", "log"):
-                self._check_log_call(node)
-
-        self.generic_visit(node)
-
-    def _check_log_call(self, node: ast.Call):
-        for arg in node.args:
-            if isinstance(arg, ast.JoinedStr):
-                self._check_fstring_for_pii(arg, node)
-            elif isinstance(arg, ast.Call) and isinstance(arg.func, ast.Name) and arg.func.id == "format":
-                for farg in arg.args:
-                    if isinstance(farg, ast.JoinedStr):
-                        self._check_fstring_for_pii(farg, node)
-            elif isinstance(arg, ast.BinOp) and isinstance(arg.op, ast.Mod):
-                pass
-
-        has_extra = any(kw.arg == "extra" for kw in node.keywords)
-        has_dict_arg = any(isinstance(kw.value, ast.Dict) for kw in node.keywords)
-        if not has_extra and not has_dict_arg and self.in_production:
-            self._add_finding(node, "Structured logging missing (no extra= or dict args)", "Consider using structured logging with extra={} for better observability", 0.75)
-
-    def _check_fstring_for_pii(self, fstring: ast.JoinedStr, call_node: ast.Call):
-        for part in fstring.values:
-            if isinstance(part, ast.FormattedValue):
-                if isinstance(part.value, ast.Name):
-                    var_name = part.value.id.lower()
-                    for pii in self.pii_patterns:
-                        if pii in var_name:
-                            self._add_finding(call_node, f"PII in log f-string: {pii}", f"Logging potential PII ({pii}) in f-string violates privacy", 0.85, "CWE-532")
-
-    def _add_finding(self, node: ast.AST, title: str, description: str, confidence: float, cwe: str = "CWE-532"):
-        line_no = getattr(node, "lineno", 0)
-        snippet = self.lines[line_no - 1].strip() if 0 < line_no <= len(self.lines) else ""
-        self.findings.append(Finding(
-            engine="logging_c",
-            severity="high" if confidence >= 0.85 else "medium",
-            title=title,
-            description=description,
-            location=f"{self.filepath}:{line_no}",
-            metadata={
-                "confidence": confidence,
-                "snippet": snippet[:200],
-                "cwe": cwe,
-            },
-        ))

package/src/orion/engine/noise/engine.py

@@ -1,140 +0,0 @@
-"""Finding noise suppression engine - filters false positives from prior findings."""
-import subprocess
-import os
-from pathlib import Path
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class Engine:
-    name = "noise"
-    version = "1.0.0"
-
-    GENERATED_FILE_PATTERNS = [
-        "_pb2.py", "_grpc.py", "_pb2_grpc.py",
-        "migrations/", "alembic/versions/",
-        "vendor/", "node_modules/", ".venv/", "venv/",
-        "dist/", "build/", "__pycache__/", ".pytest_cache/",
-        "generated/", "auto_generated/", "thrift_gen/",
-        ".proto.py", "_proto.py",
-    ]
-
-    HIGH_CHURN_THRESHOLD = 5
-    RECENT_DAYS = 30
-    LOW_CONFIDENCE_THRESHOLD = 0.6
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        prior_findings = self._extract_prior_findings(ir, config)
-        if not prior_findings:
-            return EngineResult(engine=self.name, findings=[], ok=True, metrics={"filtered": 0, "total": 0})
-
-        path = ir.metadata.get("path", "unknown")
-        project_root = ir.metadata.get("project_root", ".")
-
-        filtered = []
-        noise_count = 0
-
-        for finding in prior_findings:
-            is_noise = False
-            reasons = []
-
-            if finding.metadata.get("confidence", 1.0) < self.LOW_CONFIDENCE_THRESHOLD:
-                if self._is_recently_modified(finding.location, project_root):
-                    if self._has_high_churn(finding.location, project_root):
-                        is_noise = True
-                        reasons.append("low_confidence + recent_modification + high_churn")
-
-            if self._is_duplicate_finding(finding, prior_findings):
-                is_noise = True
-                reasons.append("duplicate_across_runs")
-
-            if self._is_generated_file(finding.location):
-                is_noise = True
-                reasons.append("generated_file")
-
-            if is_noise:
-                noise_count += 1
-                finding.metadata["noise_reasons"] = reasons
-                finding.metadata["suppressed_by"] = "noise_engine"
-            else:
-                filtered.append(finding)
-
-        return EngineResult(
-            engine=self.name,
-            findings=filtered,
-            ok=True,
-            metrics={
-                "filtered": noise_count,
-                "total": len(prior_findings),
-                "remaining": len(filtered),
-            },
-        )
-
-    def _extract_prior_findings(self, ir: OrionIR, config: EngineConfig) -> list[Finding]:
-        if hasattr(ir, "prior_findings") and ir.prior_findings:
-            return ir.prior_findings
-
-        if config.toggles and "prior_findings" in config.toggles:
-            return config.toggles["prior_findings"]
-
-        if ir.metadata.get("prior_findings"):
-            return ir.metadata["prior_findings"]
-
-        return []
-
-    def _is_recently_modified(self, location: str, project_root: str) -> bool:
-        try:
-            filepath = location.split(":")[0] if ":" in location else location
-            full_path = Path(project_root) / filepath
-            if not full_path.exists():
-                return False
-
-            result = subprocess.run(
-                ["git", "log", "--since", f"{self.RECENT_DAYS} days ago", "--oneline", str(full_path)],
-                capture_output=True, text=True, cwd=project_root, timeout=10
-            )
-            return result.returncode == 0 and len(result.stdout.strip().splitlines()) > 0
-        except Exception:
-            return False
-
-    def _has_high_churn(self, location: str, project_root: str) -> bool:
-        try:
-            filepath = location.split(":")[0] if ":" in location else location
-            full_path = Path(project_root) / filepath
-            if not full_path.exists():
-                return False
-
-            result = subprocess.run(
-                ["git", "log", "--oneline", str(full_path)],
-                capture_output=True, text=True, cwd=project_root, timeout=10
-            )
-            if result.returncode == 0:
-                commit_count = len(result.stdout.strip().splitlines())
-                return commit_count > self.HIGH_CHURN_THRESHOLD
-        except Exception:
-            pass
-        return False
-
-    def _is_duplicate_finding(self, finding: Finding, all_findings: list[Finding]) -> bool:
-        count = 0
-        for other in all_findings:
-            if (other.engine == finding.engine and
-                other.title == finding.title and
-                other.location == finding.location):
-                count += 1
-        return count > 1
-
-    def _is_generated_file(self, location: str) -> bool:
-        filepath = location.split(":")[0] if ":" in location else location
-        for pattern in self.GENERATED_FILE_PATTERNS:
-            if pattern in filepath:
-                return True
-        return False

package/src/orion/engine/orphan/engine.py

@@ -1,244 +0,0 @@
-"""Orphan file detection engine - finds files with zero incoming imports."""
-import ast
-import re
-from pathlib import Path
-from typing import Dict, List, Set, Optional
-from collections import defaultdict
-
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class OrphanEngine:
-    name = "orphan"
-    version = "1.0.0"
-
-    EXCLUDED_PATTERNS = {
-        "__init__.py",
-        "__main__.py",
-        "conftest.py",
-        "manage.py",
-        "wsgi.py",
-        "asgi.py",
-        "celery.py",
-        "gunicorn.conf.py",
-        "pytest.ini",
-    }
-
-    EXCLUDED_DIRS = {
-        "migrations",
-        "tests",
-        "test",
-        "scripts",
-        "__pycache__",
-        ".git",
-        ".venv",
-        "venv",
-        "env",
-        "node_modules",
-        "dist",
-        "build",
-    }
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
-
-    def _should_exclude(self, filepath: str, config: EngineConfig) -> bool:
-        path = Path(filepath)
-        # Check excluded filenames
-        if path.name in self.EXCLUDED_PATTERNS:
-            return True
-        # Check excluded directories
-        for part in path.parts:
-            if part in self.EXCLUDED_DIRS:
-                return True
-        # Check config exclude patterns
-        if config.toggles.get("exclude"):
-            for pattern in config.toggles["exclude"]:
-                if path.match(pattern) or any(p.match(pattern) for p in path.parents):
-                    return True
-        return False
-
-    def _is_python_file(self, filepath: str) -> bool:
-        return Path(filepath).suffix == ".py"
-
-    def _extract_imports(self, content: str, filepath: str) -> List[str]:
-        """Extract all imported module names from a Python file."""
-        imports = []
-        try:
-            tree = ast.parse(content)
-            for node in ast.walk(tree):
-                if isinstance(node, ast.Import):
-                    for alias in node.names:
-                        imports.append(alias.name)  # Keep full module path
-                elif isinstance(node, ast.ImportFrom):
-                    if node.module:
-                        imports.append(node.module)  # Keep full module path
-        except SyntaxError:
-            # Fallback to regex for files with syntax errors
-            import_pattern = re.compile(r'^\s*(?:from\s+(\S+)\s+import|import\s+(\S+))', re.MULTILINE)
-            for match in import_pattern.finditer(content):
-                mod = match.group(1) or match.group(2)
-                if mod:
-                    imports.append(mod)
-        return imports
-
-    def _get_module_name(self, filepath: str, project_root: str) -> Optional[str]:
-        """Convert filepath to module name relative to project root."""
-        try:
-            path = Path(filepath).relative_to(Path(project_root))
-        except ValueError:
-            # File is outside project root
-            return Path(filepath).stem
-
-        # Remove .py extension
-        if path.suffix == ".py":
-            path = path.with_suffix("")
-
-        # Convert path to module notation
-        parts = list(path.parts)
-        if parts and parts[-1] == "__init__":
-            parts = parts[:-1]
-
-        return ".".join(parts) if parts else path.stem
-
-    def _resolve_import(self, import_name: str, importer_module: str, project_root: str, module_to_file: Dict[str, str]) -> Optional[str]:
-        """Resolve an import name to a module in the project."""
-        # Try exact match first
-        if import_name in module_to_file:
-            return import_name
-
-        # Try relative to importer's package (for relative imports)
-        if import_name.startswith('.'):
-            importer_parts = importer_module.split('.') if importer_module else []
-            level = len(import_name) - len(import_name.lstrip('.'))
-            base_parts = importer_parts[:-level] if level <= len(importer_parts) else []
-            relative_name = import_name.lstrip('.')
-            if relative_name:
-                candidate = '.'.join(base_parts + [relative_name])
-            else:
-                candidate = '.'.join(base_parts)
-            if candidate in module_to_file:
-                return candidate
-
-        # Try as absolute import
-        if import_name in module_to_file:
-            return import_name
-
-        # Try with importer's package prefix
-        importer_parts = importer_module.split('.') if importer_module else []
-        for i in range(len(importer_parts), -1, -1):
-            prefix = '.'.join(importer_parts[:i])
-            candidate = f"{prefix}.{import_name}" if prefix else import_name
-            if candidate in module_to_file:
-                return candidate
-
-        return None
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        # This engine needs project-wide context, so we need to access all files
-        # The IR metadata should contain project information
-        project_root = ir.metadata.get("project_root", ".")
-        all_files = ir.metadata.get("all_files", {})
-
-        if not all_files:
-            # Single file mode - can't do orphan detection
-            return EngineResult(engine=self.name, ok=True, metrics={"mode": "single_file"})
-
-        # Build import graph
-        module_to_file = {}
-        file_to_module = {}
-        imports_map = defaultdict(set)  # module -> set of imported modules
-        reverse_deps = defaultdict(set)  # module -> set of modules that import it
-
-        # First pass: map files to modules
-        for filepath, file_ir in all_files.items():
-            if not self._is_python_file(filepath):
-                continue
-            if self._should_exclude(filepath, config):
-                continue
-
-            module_name = self._get_module_name(filepath, project_root)
-            if module_name:
-                module_to_file[module_name] = filepath
-                file_to_module[filepath] = module_name
-
-        # Second pass: extract imports
-        for filepath, file_ir in all_files.items():
-            if not self._is_python_file(filepath):
-                continue
-            if self._should_exclude(filepath, config):
-                continue
-
-            module_name = file_to_module.get(filepath)
-            if not module_name:
-                continue
-
-            try:
-                content = file_ir.content.decode("utf-8", errors="replace")
-            except Exception:
-                continue
-
-            imports = self._extract_imports(content, filepath)
-            for imp in imports:
-                resolved = self._resolve_import(imp, module_name, project_root, module_to_file)
-                if resolved:
-                    imports_map[module_name].add(resolved)
-                    reverse_deps[resolved].add(module_name)
-
-        # Find orphans: modules with zero incoming imports
-        orphans = []
-        for module_name, filepath in module_to_file.items():
-            if module_name not in reverse_deps or not reverse_deps[module_name]:
-                # Check if it's a legitimate entry point
-                path = Path(filepath)
-                is_entry_point = any(
-                    pattern in str(path) for pattern in [
-                        "main.py", "app.py", "cli.py", "run.py", "start.py",
-                        "entrypoint.py", "bootstrap.py", "__main__.py",
-                    ]
-                )
-                is_test = "test" in str(path).lower()
-                is_script = "script" in str(path).lower()
-
-                if not is_entry_point and not is_test and not is_script:
-                    orphans.append({
-                        "module": module_name,
-                        "file": filepath,
-                        "reason": "no_incoming_imports",
-                    })
-
-        # Create findings
-        findings = []
-        for orphan in orphans:
-            findings.append(Finding(
-                engine=self.name,
-                severity="medium",
-                title=f"Orphan file: {orphan['file']}",
-                description=f"File has no incoming imports - may be dead code",
-                location=orphan["file"],
-                metadata={
-                    "file": orphan["file"],
-                    "module": orphan["module"],
-                    "reason": orphan["reason"],
-                },
-            ))
-
-        return EngineResult(
-            engine=self.name,
-            findings=findings,
-            ok=True,
-            metrics={
-                "total_modules": len(module_to_file),
-                "orphans_found": len(orphans),
-                "import_edges": sum(len(v) for v in imports_map.values()),
-            },
-        )
-
-
-Engine = OrphanEngine