@orionscanner/cli 0.1.0

package/src/orion/engine/runner.py

@@ -0,0 +1,1310 @@
+#!/usr/bin/env python3
+"""Orion Engine - Enterprise Code Audit & Security Platform.
+
+Proprietary In-House Engines for Security Auditing, Architecture & Governance.
+"""
+
+import asyncio
+import base64
+import json
+import sys
+import html
+import itertools
+import os
+import re
+import threading
+import time
+from datetime import datetime
+from pathlib import Path
+
+from orion.engine import OrionEngine, EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.languages import detect_language, is_binary_file, Language
+
+
+# Ensure UTF-8 stdout on Windows console
+if sys.platform == "win32":
+    try:
+        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+        sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+
+def clear_screen():
+    """Clear terminal screen cross-platform safely without shell execution."""
+    sys.stdout.write("\033[H\033[2J")
+    sys.stdout.flush()
+
+
+# --- CLI Terminal Professional Styling Tokens ---
+RESET = "\033[0m"
+BOLD = "\033[1m"
+DIM = "\033[2m"
+ITALIC = "\033[3m"
+UNDERLINE = "\033[4m"
+
+RED = "\033[91m"
+GREEN = "\033[92m"
+YELLOW = "\033[93m"
+BLUE = "\033[94m"
+MAGENTA = "\033[95m"
+CYAN = "\033[96m"
+WHITE = "\033[97m"
+
+
+BANNER = f"""{CYAN}{BOLD}
+  ┌───────────────────────────────────────────────────────────────────────────────────┐
+  │   ___  ____  _____ ____  _   __      {WHITE}{BOLD}ORION SECURITY SUITE{CYAN}                         │
+  │  / __ \\/ __ \\/  _/ __ \\/ | / /      {DIM}Code Intelligence & Governance{CYAN}                │
+  │ / / / / /_/ // // / / /  |/ /       {CYAN}─── {WHITE}{BOLD}SEE. ANALYZE. IMPROVE.{RESET}{CYAN} ────────────────   │
+  │/ /_/ / _, _// // /_/ / /|  /                                                      │
+  │\\____/_/ |_/___/\\____/_/ |_/          {DIM}SAST & Threat Modeling{CYAN}                       │
+  └───────────────────────────────────────────────────────────────────────────────────┘{RESET}
+"""
+
+MENU = f"""
+  {WHITE}{BOLD}AUDIT WORKSPACE EXECUTION{RESET}
+  {CYAN}─────────────────────────────────────────────────────────────────────────────────────{RESET}
+  {GREEN}{BOLD}[1]{RESET}  {WHITE}{BOLD}Quick Workspace Audit{RESET}       {DIM}Fast multi-engine scan on current workspace{RESET}
+  {GREEN}{BOLD}[2]{RESET}  {WHITE}{BOLD}Full Deep Security Audit{RESET}    {DIM}Comprehensive SAST, Secrets, Cloud, AI & Quality sweep{RESET}
+
+  {WHITE}{BOLD}SPECIALIZED SECURITY & COMPLIANCE SWEEPS{RESET}
+  {CYAN}─────────────────────────────────────────────────────────────────────────────────────{RESET}
+  {CYAN}{BOLD}[3]{RESET}  {WHITE}Application Security & SAST{RESET} {DIM}DeepSAST™, SecretShield™, TaintStream™, AuthMatrix™{RESET}
+  {CYAN}{BOLD}[4]{RESET}  {WHITE}Cloud, Container & IaC{RESET}      {DIM}CloudPulse™, DockerAudit™, PolicyForge™, CloudConfig™{RESET}
+  {CYAN}{BOLD}[5]{RESET}  {WHITE}AI & LLM Agent Security{RESET}     {DIM}PromptArmor™, AgentShield™ (OWASP LLM Top 10){RESET}
+  {CYAN}{BOLD}[6]{RESET}  {WHITE}Cryptography & Key Vault{RESET}    {DIM}CryptoFortress™, SecretShield™ (Weak Ciphers & Keys){RESET}
+  {CYAN}{BOLD}[7]{RESET}  {WHITE}Code Quality & Standards{RESET}    {DIM}CognitivePulse™, CloneMatrix™, CleanSweep™, CodeStandard™{RESET}
+  {CYAN}{BOLD}[8]{RESET}  {WHITE}Supply Chain & SBOM{RESET}         {DIM}SupplyGuard™, VulnPulse™, LicenseAudit™, ReguGuard™{RESET}
+  {CYAN}{BOLD}[9]{RESET}  {WHITE}Threat Model & Data Privacy{RESET} {DIM}ThreatPulse™ (STRIDE), PrivacyShield™ (PII / PCI-DSS){RESET}
+
+  {WHITE}{BOLD}REPORTING & SYSTEM STATUS{RESET}
+  {CYAN}─────────────────────────────────────────────────────────────────────────────────────{RESET}
+  {YELLOW}{BOLD}[R]{RESET}  {WHITE}View Latest Report{RESET}          {DIM}Open latest executive report with PDF export{RESET}
+  {YELLOW}{BOLD}[S]{RESET}  {WHITE}Engine Health Matrix{RESET}        {DIM}Inspect status and specifications of in-house engines{RESET}
+  {RED}{BOLD}[0]{RESET}  {WHITE}Exit Orion Suite{RESET}            {DIM}Terminate CLI session{RESET}
+  {CYAN}─────────────────────────────────────────────────────────────────────────────────────{RESET}
+"""
+
+
+ENGINE_MARKETING_METADATA = {
+    # 1. Advanced Application Security & SAST
+    "sast": {"name": "DeepSAST™", "title": "Core Semantic Vulnerability Analyzer", "cat": "Application Security", "desc": "Next-Gen AST Code & Injection Defense"},
+    "taint": {"name": "TaintStream™", "title": "Source-to-Sink Dataflow Tracer", "cat": "Application Security", "desc": "Unsanitized Input & Injection Vector Tracker"},
+    "secrets": {"name": "SecretShield™", "title": "Credential & Token Vault", "cat": "Application Security", "desc": "Zero-Entropy Secret & Key Leak Detection"},
+    "authorization": {"name": "AuthMatrix™", "title": "Access Control & Privilege Guard", "cat": "Application Security", "desc": "RBAC / ABAC Broken Authorization Defense"},
+    "sandbox_escape": {"name": "ContainerBreak™", "title": "Sandbox & Isolation Auditor", "cat": "Application Security", "desc": "Subprocess & Jailbreak Prevention"},
+    "hunter": {"name": "ThreatHunter™", "title": "Zero-Day Vulnerability Hunter", "cat": "Application Security", "desc": "Proactive Exploit & Risk Vector Discovery"},
+
+    # 2. AI, LLM & Emerging Threat Defense
+    "prompt_security": {"name": "PromptArmor™", "title": "AI Guardrails & Jailbreak Shield", "cat": "AI & Emerging Threats", "desc": "Indirect Injection & Context Hijack Protection"},
+    "llm_security": {"name": "AgentShield™", "title": "OWASP LLM Top 10 Sentinel", "cat": "AI & Emerging Threats", "desc": "Autonomous Agency & Unsafe Execution Defense"},
+    "crypto_guard": {"name": "CryptoFortress™", "title": "Quantum-Ready Cipher Auditor", "cat": "AI & Emerging Threats", "desc": "Weak Cryptography & Broken Hash Detector"},
+    "api_security": {"name": "APIGuard™", "title": "Microservice & REST Security Sentry", "cat": "AI & Emerging Threats", "desc": "OWASP API Top 10 & BOLA/IDOR Defense"},
+
+    # 3. Cloud, Infrastructure & Container Governance
+    "iac_security": {"name": "CloudPulse™", "title": "Infrastructure-as-Code Sentinel", "cat": "Cloud & Infrastructure", "desc": "Terraform, Kubernetes & CI/CD Hardener"},
+    "container": {"name": "DockerAudit™", "title": "Image & Namespace Security Engine", "cat": "Cloud & Infrastructure", "desc": "Privilege Escalation & Manifest Scanner"},
+    "config_engine": {"name": "CloudConfig™", "title": "Environment & Secrets Validator", "cat": "Cloud & Infrastructure", "desc": "Production Settings & Env Hygiene"},
+    "config_validation": {"name": "PolicyForge™", "title": "Configuration Governance Engine", "cat": "Cloud & Infrastructure", "desc": "Schema & Setting Integrity Assurance"},
+    "chaos": {"name": "ChaosEngine™", "title": "Resilience & Fault Prober", "cat": "Cloud & Infrastructure", "desc": "Runtime Failure & Latency Simulation"},
+    "chaos_config": {"name": "ConfigChaos™", "title": "Stress & Edge-Case Validator", "cat": "Cloud & Infrastructure", "desc": "Configuration Fault Tolerance Testing"},
+
+    # 4. Supply Chain, Compliance & Legal Protection
+    "supply_chain_sbom": {"name": "SupplyGuard™", "title": "Enterprise SBOM Matrix Generator", "cat": "Supply Chain & Compliance", "desc": "CycloneDX/SPDX Inventory Assurance"},
+    "deps": {"name": "VulnPulse™", "title": "Real-Time Dependency CVE Scanner", "cat": "Supply Chain & Compliance", "desc": "Outdated & Compromised Package Detection"},
+    "license": {"name": "LicenseAudit™", "title": "Open-Source IP & Legal Compliance", "cat": "Supply Chain & Compliance", "desc": "GPL/Copyleft Risk Mitigation"},
+    "provenance": {"name": "ChainOfCustody™", "title": "Artifact Provenance Tracker", "cat": "Supply Chain & Compliance", "desc": "Build Integrity & Tamper Proofing"},
+    "compliance": {"name": "ReguGuard™", "title": "Multi-Standard Compliance Auditor", "cat": "Supply Chain & Compliance", "desc": "SOC 2, ISO 27001, HIPAA & PCI-DSS Audit"},
+    "data_residency": {"name": "GeoFence™", "title": "Data Sovereignty & Privacy Guard", "cat": "Supply Chain & Compliance", "desc": "GDPR, CCPA & Cross-Border Residency"},
+    "threat_model": {"name": "ThreatPulse™", "title": "Automated STRIDE & Boundary Model", "cat": "Supply Chain & Compliance", "desc": "Trust-Boundary Crossing & Entrypoint Risk Mapper"},
+    "sensitive_data": {"name": "PrivacyShield™", "title": "PII, GDPR, HIPAA & PCI-DSS Shield", "cat": "Supply Chain & Compliance", "desc": "Credit Card PAN, SSN & Cleartext PII Leak Sentry"},
+
+    # 5. Architectural Intelligence & Deep Flow Analysis
+    "callgraph": {"name": "GraphTrace™", "title": "Inter-Procedural Call Topology", "cat": "Architecture & Dataflow", "desc": "Deep Function Call & Callpath Mapper"},
+    "cfg": {"name": "ControlFlow™", "title": "Path Traversal & Reachability Engine", "cat": "Architecture & Dataflow", "desc": "Deadlock & Branch Reachability Analyzer"},
+    "dataflow": {"name": "DataFlow™", "title": "Global State & Variable Propagation", "cat": "Architecture & Dataflow", "desc": "Data Mutation & Side-Effect Engine"},
+    "symbol": {"name": "SymbolMatrix™", "title": "Cross-Module Symbol Table Engine", "cat": "Architecture & Dataflow", "desc": "Identifier Scope & Type Hierarchy"},
+    "architecture": {"name": "ArchPulse™", "title": "Structural Boundary & Layering Auditor", "cat": "Architecture & Dataflow", "desc": "Spaghetti Code & Circular Coupling Detector"},
+    "wiring_trace": {"name": "WiringTrace™", "title": "Service Bus & Pipeline Wire Tracer", "cat": "Architecture & Dataflow", "desc": "Component Interconnection Tracker"},
+    "state": {"name": "StateGuard™", "title": "Finite State & Race-Condition Detector", "cat": "Architecture & Dataflow", "desc": "Concurrency & Mutex Auditor"},
+    "contract_probe": {"name": "ContractProbe™", "title": "Microservice SLA & Interface Auditor", "cat": "Architecture & Dataflow", "desc": "HTTP Resiliency & Circuit Breaker Check"},
+    "orphan": {"name": "GhostCode™", "title": "Orphaned Endpoint & Asset Finder", "cat": "Architecture & Dataflow", "desc": "Zombie Routes & Unreachable Assets"},
+
+    # 6. Code Quality, Performance & Engineering Excellence
+    "complexity": {"name": "CognitivePulse™", "title": "Cyclomatic & Complexity Optimizer", "cat": "Quality & Performance", "desc": "Maintainability Index & Tech Debt Score"},
+    "duplication": {"name": "CloneMatrix™", "title": "Semantic Duplication Detector", "cat": "Quality & Performance", "desc": "Anti-Copy-Paste Refactoring Engine"},
+    "dead_import": {"name": "CleanSweep™", "title": "Dead Import & Dead Code Eliminator", "cat": "Quality & Performance", "desc": "Tree-Shaking & Bundle Optimizer"},
+    "error_handling": {"name": "ResilienceGuard™", "title": "Exception & Fault-Tolerance Auditor", "cat": "Quality & Performance", "desc": "Silent Error & Crash Prevention"},
+    "logging_c": {"name": "AuditLog™", "title": "Enterprise Telemetry & Audit Verifier", "cat": "Quality & Performance", "desc": "Compliance Logging & Redaction Engine"},
+    "lint": {"name": "CodeStandard™", "title": "Multi-Language Style Guardian", "cat": "Quality & Performance", "desc": "PEP8, Google & Enterprise Clean Code Enforcer"},
+    "test_coverage": {"name": "CoverageLens™", "title": "Test Gap & QA Inspector", "cat": "Quality & Performance", "desc": "Untested Path & Mutation Discovery"},
+    "perf_guard": {"name": "SpeedGuard™", "title": "Algorithmic & I/O Optimizer", "cat": "Quality & Performance", "desc": "Big-O & Memory Overhead Detector"},
+    "regression": {"name": "RegressionShield™", "title": "Semantic Differential Analyzer", "cat": "Quality & Performance", "desc": "Behavioral Drift & Regression Radar"},
+    "noise": {"name": "SignalFilter™", "title": "False-Positive Signal Amplifier", "cat": "Quality & Performance", "desc": "High-Fidelity Signal Processing"},
+    "fp_learn": {"name": "SmartLearn™", "title": "Adaptive Heuristics Feedback Loop", "cat": "Quality & Performance", "desc": "Continuous Learning False-Positive Reducer"},
+}
+
+SUPPORTED_EXTENSIONS = {
+    ".py", ".pyw", ".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx",
+    ".go", ".rs", ".java", ".c", ".cpp", ".cc", ".cxx", ".h", ".hpp",
+    ".cs", ".php", ".phtml", ".rb", ".swift", ".kt", ".kts", ".scala",
+    ".sql", ".html", ".htm", ".css", ".scss", ".json", ".yaml", ".yml",
+    ".toml", ".xml", ".ini", ".cfg", ".conf", ".properties", ".env",
+    ".tf", ".hcl", ".sh", ".bash", ".zsh", ".ps1", ".psm1", ".md"
+}
+
+SPECIAL_FILENAMES = {
+    "dockerfile", "docker-compose.yml", "docker-compose.yaml", "makefile",
+    "cmakelists.txt", "package.json", "go.mod", "cargo.toml", "pom.xml",
+    "requirements.txt", "pyproject.toml", "gemfile", "composer.json"
+}
+
+
+REPORTS_DIR = Path("ORION SCANNER REPORTS")
+REPORTS_DIR.mkdir(exist_ok=True)
+
+
+def get_logo_base64() -> str:
+    """Read assets/logo.png and return base64 data URI for self-contained report header."""
+    candidates = [
+        Path("assets/logo.png"),
+        Path(__file__).resolve().parent.parent.parent.parent / "assets" / "logo.png",
+        Path("D:/Homeworks/Orion_Engine/assets/logo.png")
+    ]
+    for p in candidates:
+        if p.exists():
+            try:
+                b64 = base64.b64encode(p.read_bytes()).decode("utf-8")
+                return f"data:image/png;base64,{b64}"
+            except Exception:
+                pass
+    return ""
+
+
+def purge_old_reports():
+    """Remove previous reports and any nested subdirectories so only latest files exist."""
+    import shutil
+    try:
+        for item in REPORTS_DIR.iterdir():
+            try:
+                if item.is_dir():
+                    shutil.rmtree(item, ignore_errors=True)
+                else:
+                    item.unlink()
+            except Exception:
+                pass
+    except Exception:
+        pass
+
+
+def deduplicate_and_filter_findings(findings):
+    """Intelligent cross-engine deduplication and false-positive suppression."""
+    seen = {}
+    normalized = []
+
+    for f in findings:
+        loc = f.location or ""
+        sev = f.severity.lower()
+        title_lower = f.title.lower()
+
+        cat = "general"
+        if "eval" in title_lower or "code injection" in title_lower:
+            cat = "code_injection"
+        elif "password" in title_lower or "secret" in title_lower or "token" in title_lower or "key" in title_lower:
+            cat = "secrets"
+        elif "sandbox" in title_lower or "escape" in title_lower or "subprocess" in title_lower:
+            cat = "sandbox_escape"
+        elif "jwt" in title_lower:
+            cat = "jwt"
+        elif "license" in title_lower or "gpl" in title_lower:
+            cat = "license"
+        elif "undefined name" in title_lower:
+            cat = "undefined_symbol"
+        elif "dead store" in title_lower:
+            cat = "dead_store"
+        elif "mutable" in title_lower:
+            cat = "mutable"
+
+        key = f"{loc}:{cat}"
+
+        if key in seen:
+            existing = seen[key]
+            contribs = existing.metadata.get("contributing_engines", [existing.engine])
+            if f.engine not in contribs:
+                contribs.append(f.engine)
+                existing.metadata["contributing_engines"] = contribs
+            continue
+
+        if "dead store" in title_lower and loc.startswith("src"):
+            continue
+        if "module-level mutable variable" in title_lower and any(k in loc for k in ["engine.py", "config.py", "registry.py"]):
+            continue
+
+        f.metadata["contributing_engines"] = [f.engine]
+        seen[key] = f
+        normalized.append(f)
+
+    return normalized
+
+
+async def scan_path(target_path: str, config: EngineConfig, engine_filter: list = None):
+    """Scan a file or directory across all supported languages with clean steady terminal feedback."""
+    target = Path(target_path)
+
+    if not target.exists():
+        print(f"\n  {RED}✖ Error: Target workspace path '{target_path}' does not exist.{RESET}\n")
+        return None
+
+    files = []
+    if target.is_file():
+        files = [target]
+    else:
+        exclude_dirs = {
+            "__pycache__", ".git", ".venv", "venv", "env", "node_modules",
+            "dist", "build", ".pytest_cache", ".mypy_cache", ".tox",
+            "vendor", ".github", ".idea", ".vscode", "target", "bin", "obj",
+            "orion scanner reports", "reports", "brain", ".system_generated"
+        }
+        for root, dirs, filenames in os.walk(target):
+            dirs[:] = [d for d in dirs if d.lower() not in exclude_dirs and not d.startswith(".")]
+            for filename in filenames:
+                file_path = Path(root) / filename
+                ext = file_path.suffix.lower()
+                name_lower = filename.lower()
+                if ext in SUPPORTED_EXTENSIONS or name_lower in SPECIAL_FILENAMES or name_lower.startswith(".env"):
+                    if not is_binary_file(str(file_path)):
+                        files.append(file_path)
+
+    total_files = len(files)
+    print(f"\n  {CYAN}{BOLD}▶ Orion Engine Suite initialized{RESET}")
+    print(f"    {DIM}Target Workspace:{RESET} {WHITE}{Path(target_path).resolve()}{RESET}")
+    print(f"    {DIM}Identified Files:{RESET} {WHITE}{total_files} source files across supported languages{RESET}\n")
+
+    print(f"  {CYAN}ℹ [Phase 1/3] Indexing workspace ASTs and generating IR models...{RESET}")
+    irs = []
+    for f in files:
+        try:
+            content = f.read_bytes()
+            rel_path = f.relative_to(target) if target.is_dir() else f.name
+            detected_lang = detect_language(str(f))
+            irs.append(OrionIR(
+                content=content,
+                metadata={
+                    "path": str(rel_path),
+                    "language": detected_lang.value if hasattr(detected_lang, "value") else str(detected_lang),
+                    "project_root": str(target)
+                }
+            ))
+        except Exception:
+            pass
+
+    engine = OrionEngine()
+    if engine_filter:
+        original_engines = dict(engine._engines)
+        engine._engines = {k: v for k, v in engine._engines.items() if k in engine_filter}
+
+    print(f"  {CYAN}ℹ [Phase 2/3] Executing in-house proprietary analysis engines across IR graph...{RESET}")
+    raw_result = await engine.run(irs, config or EngineConfig())
+
+    if engine_filter:
+        engine._engines = original_engines
+
+    print(f"  {CYAN}ℹ [Phase 3/3] Deduplicating findings and generating executive intelligence report...{RESET}")
+    clean_findings = deduplicate_and_filter_findings(raw_result.findings)
+    raw_result.findings = clean_findings
+
+    print(f"  {GREEN}{BOLD}✔ Engine Analysis Complete:{RESET} {len(clean_findings)} validated findings across {total_files} files ({raw_result.metrics.get('elapsed_s', 0):.2f}s)\n")
+
+    return raw_result
+
+
+def generate_reports(scan_type: str, target_path: str, result):
+    """Generate state-of-the-art Executive HTML report, JSON, and TXT outputs."""
+    purge_old_reports()
+
+    base_name = "orion_executive_security_report"
+    html_path = REPORTS_DIR / f"{base_name}.html"
+    json_path = REPORTS_DIR / f"{base_name}.json"
+    txt_path = REPORTS_DIR / f"{base_name}.txt"
+
+    logo_data_uri = get_logo_base64()
+
+    total = len(result.findings)
+    critical = sum(1 for f in result.findings if f.severity == "critical")
+    high = sum(1 for f in result.findings if f.severity == "high")
+    medium = sum(1 for f in result.findings if f.severity == "medium")
+    low = sum(1 for f in result.findings if f.severity == "low")
+    info = sum(1 for f in result.findings if f.severity == "info")
+    
+    score = 100
+    score -= critical * 15
+    score -= high * 8
+    score -= medium * 3
+    score -= low * 1
+    score = max(0, score)
+    
+    if score >= 90: grade = "A"
+    elif score >= 75: grade = "B"
+    elif score >= 60: grade = "C"
+    else: grade = "F"
+    
+    grade_colors = {"A": "#10b981", "B": "#84cc16", "C": "#eab308", "F": "#ef4444"}
+    grade_color = grade_colors[grade]
+
+    # JSON Report
+    json_report = {
+        "engine": "Orion Security Suite",
+        "version": "0.1.0",
+        "scan_type": scan_type,
+        "target_path": str(Path(target_path).resolve()),
+        "timestamp": datetime.now().isoformat(),
+        "security_score": score,
+        "security_grade": grade,
+        "summary": {
+            "files_scanned": result.metrics.get('files_scanned', 0),
+            "engines_executed": result.metrics.get('engines_run', 0),
+            "elapsed_seconds": result.metrics.get('elapsed_s', 0),
+            "total_findings": total,
+            "critical_count": critical,
+            "high_count": high,
+            "medium_count": medium,
+            "low_count": low,
+            "info_count": info,
+        },
+        "findings": [
+            {
+                "engine_code": f.engine,
+                "engine_product": ENGINE_MARKETING_METADATA.get(f.engine, {}).get("name", f.engine),
+                "contributing_engines": f.metadata.get("contributing_engines", [f.engine]),
+                "severity": f.severity,
+                "title": f.title,
+                "description": f.description,
+                "location": f.location,
+                "metadata": f.metadata
+            }
+            for f in result.findings
+        ]
+    }
+    with open(json_path, 'w', encoding='utf-8') as f:
+        json.dump(json_report, f, indent=2, default=str)
+
+    # TXT Report
+    with open(txt_path, 'w', encoding='utf-8') as fh:
+        fh.write(f"================================================================================\n")
+        fh.write(f"           ORION ENGINE SECURITY AUDIT REPORT\n")
+        fh.write(f"================================================================================\n")
+        fh.write(f"Scan Type:       {scan_type}\n")
+        fh.write(f"Target Path:     {Path(target_path).resolve()}\n")
+        fh.write(f"Generated At:    {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
+        fh.write(f"Security Grade:  {grade} (Score: {score}/100)\n")
+        fh.write(f"Files Scanned:   {result.metrics.get('files_scanned', 0)}\n")
+        fh.write(f"Engines Run:     {result.metrics.get('engines_run', 0)} passes\n")
+        fh.write(f"Time Elapsed:    {result.metrics.get('elapsed_s', 0):.2f}s\n")
+        fh.write(f"Total Findings:  {total} (Critical: {critical}, High: {high}, Medium: {medium}, Low: {low})\n")
+        fh.write(f"================================================================================\n\n")
+
+        severity_order = {"critical": 0, "high": 1, "medium": 2, "low": 3, "info": 4}
+        sorted_findings = sorted(result.findings, key=lambda f: severity_order.get(f.severity, 5))
+
+        from collections import defaultdict
+        by_severity = defaultdict(list)
+        for finding in sorted_findings:
+            by_severity[finding.severity].append(finding)
+
+        for sev in ["critical", "high", "medium", "low", "info"]:
+            if sev not in by_severity:
+                continue
+            fh.write(f"\n[{sev.upper()}] ({len(by_severity[sev])} issues)\n")
+            fh.write(f"{'-'*60}\n")
+            for finding in by_severity[sev]:
+                cwe = finding.metadata.get("cwe", "")
+                cwe_str = f" [{cwe}]" if cwe else ""
+                conf = finding.metadata.get("confidence", "N/A")
+                m_meta = ENGINE_MARKETING_METADATA.get(finding.engine, {})
+                eng_label = f"{m_meta.get('name', finding.engine)} ({finding.engine})"
+                fh.write(f"  * {finding.title}{cwe_str}\n")
+                fh.write(f"    Engine:   {eng_label}\n")
+                fh.write(f"    Location: {finding.location} (Confidence: {conf})\n")
+                if finding.description:
+                    fh.write(f"    Details:  {finding.description}\n")
+                fh.write("\n")
+
+    # Executive HTML Report
+    with open(html_path, 'w', encoding='utf-8') as f:
+        f.write(f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Orion Executive Security Report - {html.escape(Path(target_path).name or 'Workspace')}</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600;700&display=swap" rel="stylesheet">
+    <style>
+        :root {{
+            --bg-base: #06090e;
+            --bg-surface: #0c121e;
+            --bg-card: rgba(18, 26, 43, 0.85);
+            --border: rgba(255, 255, 255, 0.08);
+            --border-hover: rgba(99, 102, 241, 0.4);
+            --text-primary: #f8fafc;
+            --text-secondary: #94a3b8;
+            --text-tertiary: #64748b;
+            --critical: #ef4444;
+            --high: #f97316;
+            --medium: #eab308;
+            --low: #10b981;
+            --info: #38bdf8;
+            --accent: #6366f1;
+            --accent-gradient: linear-gradient(135deg, #6366f1, #8b5cf6, #d946ef);
+        }}
+        * {{ box-sizing: border-box; margin: 0; padding: 0; }}
+        body {{
+            font-family: 'Plus Jakarta Sans', -apple-system, BlinkMacSystemFont, sans-serif;
+            background: var(--bg-base);
+            color: var(--text-primary);
+            line-height: 1.6;
+            min-height: 100vh;
+            position: relative;
+        }}
+
+        @media print {{
+            body {{
+                background: #ffffff !important;
+                color: #0f172a !important;
+                font-size: 9.5pt;
+            }}
+            .no-print, .action-toolbar, .search-bar, .filter-pills, .footer-bar {{
+                display: none !important;
+            }}
+            .container {{
+                max-width: 100% !important;
+                padding: 0 !important;
+                position: relative;
+                z-index: 1;
+            }}
+            .executive-banner {{
+                background: #f8fafc !important;
+                border: 2px solid #cbd5e1 !important;
+                color: #0f172a !important;
+                box-shadow: none !important;
+                page-break-after: avoid;
+            }}
+            .executive-banner h1, .executive-banner p {{ color: #0f172a !important; }}
+            .grade-card {{
+                background: #ffffff !important;
+                border: 1px solid #cbd5e1 !important;
+            }}
+            .kpi-card {{
+                background: #f8fafc !important;
+                border: 1px solid #cbd5e1 !important;
+                color: #0f172a !important;
+            }}
+            .kpi-value {{ color: #0f172a !important; }}
+            .finding-card {{
+                background: #ffffff !important;
+                border: 1px solid #cbd5e1 !important;
+                color: #0f172a !important;
+                page-break-inside: avoid !important;
+                break-inside: avoid !important;
+                margin-bottom: 12pt !important;
+            }}
+            .finding-card-title {{ color: #0f172a !important; }}
+            .finding-body {{ display: block !important; }}
+            .code-snippet {{
+                background: #f1f5f9 !important;
+                color: #0f172a !important;
+                border: 1px solid #cbd5e1 !important;
+            }}
+        }}
+
+        .container {{
+            max-width: 1380px;
+            margin: 0 auto;
+            padding: 36px 32px 80px;
+            position: relative;
+            z-index: 1;
+        }}
+
+        .action-toolbar {{
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            margin-bottom: 24px;
+            padding-bottom: 16px;
+            border-bottom: 1px solid var(--border);
+        }}
+        .brand-heading {{
+            display: flex; align-items: center; gap: 14px;
+        }}
+        .brand-logo-img {{
+            height: 48px;
+            width: auto;
+            object-fit: contain;
+            border-radius: 8px;
+        }}
+        .brand-title {{ font-size: 1.2rem; font-weight: 800; color: #fff; letter-spacing: -0.01em; }}
+        .brand-sub {{ font-size: 0.76rem; color: var(--text-secondary); font-weight: 500; }}
+
+        .print-btn {{
+            background: var(--accent-gradient);
+            color: #ffffff;
+            border: none;
+            padding: 10px 22px;
+            border-radius: 12px;
+            font-family: inherit;
+            font-weight: 700;
+            font-size: 0.88rem;
+            cursor: pointer;
+            display: inline-flex; align-items: center; gap: 10px;
+            box-shadow: 0 4px 16px rgba(99, 102, 241, 0.35);
+            transition: all 0.2s cubic-bezier(0.4, 0, 0.2, 1);
+        }}
+        .print-btn:hover {{ transform: translateY(-2px); box-shadow: 0 8px 24px rgba(99, 102, 241, 0.55); }}
+
+        .executive-banner {{
+            background: linear-gradient(135deg, rgba(24, 30, 58, 0.9) 0%, rgba(12, 18, 30, 0.95) 100%);
+            border: 1px solid var(--border);
+            border-radius: 24px;
+            padding: 36px 44px;
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            margin-bottom: 32px;
+            box-shadow: 0 24px 48px rgba(0, 0, 0, 0.4);
+            position: relative;
+            overflow: hidden;
+        }}
+        .banner-info h1 {{ font-size: 2.1rem; font-weight: 800; letter-spacing: -0.03em; margin-bottom: 8px; }}
+        .banner-meta {{
+            display: flex; gap: 20px; flex-wrap: wrap;
+            font-size: 0.85rem; color: var(--text-secondary);
+            font-family: 'JetBrains Mono', monospace;
+        }}
+
+        .grade-card {{
+            display: flex; align-items: center; gap: 20px;
+            background: rgba(0, 0, 0, 0.45);
+            border: 1px solid var(--border);
+            border-radius: 20px;
+            padding: 16px 32px;
+            backdrop-filter: blur(12px);
+        }}
+        .grade-circle {{
+            font-size: 3.6rem; font-weight: 900; line-height: 1;
+            color: {grade_color};
+            text-shadow: 0 0 30px {grade_color}80;
+        }}
+        .grade-text-box h4 {{ font-size: 0.74rem; text-transform: uppercase; letter-spacing: 0.1em; color: var(--text-secondary); }}
+        .grade-text-box .score-val {{ font-size: 1.1rem; font-weight: 800; color: #fff; }}
+
+        .kpi-grid {{
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+            gap: 16px;
+            margin-bottom: 36px;
+        }}
+        .kpi-card {{
+            background: var(--bg-card);
+            border: 1px solid var(--border);
+            border-radius: 18px;
+            padding: 22px;
+            text-align: center;
+            transition: all 0.2s;
+            backdrop-filter: blur(16px);
+        }}
+        .kpi-card:hover {{ transform: translateY(-3px); border-color: var(--border-hover); }}
+        .kpi-value {{ font-size: 2.6rem; font-weight: 800; line-height: 1; margin-bottom: 6px; }}
+        .kpi-label {{ font-size: 0.76rem; text-transform: uppercase; font-weight: 700; color: var(--text-secondary); letter-spacing: 0.08em; }}
+
+        .filter-section {{
+            background: var(--bg-surface);
+            border: 1px solid var(--border);
+            border-radius: 18px;
+            padding: 18px 24px;
+            margin-bottom: 32px;
+            display: flex; flex-wrap: wrap; gap: 16px;
+            align-items: center; justify-content: space-between;
+        }}
+        .search-box {{
+            background: rgba(0, 0, 0, 0.4);
+            border: 1px solid var(--border);
+            border-radius: 12px;
+            padding: 12px 20px;
+            color: #fff;
+            font-family: inherit;
+            font-size: 0.9rem;
+            width: 360px;
+            outline: none;
+            transition: border-color 0.2s;
+        }}
+        .search-box:focus {{ border-color: var(--accent); }}
+        .filter-pills {{ display: flex; gap: 8px; flex-wrap: wrap; }}
+        .pill-btn {{
+            background: transparent;
+            border: 1px solid var(--border);
+            color: var(--text-secondary);
+            padding: 8px 18px;
+            border-radius: 12px;
+            font-size: 0.84rem; font-weight: 700;
+            cursor: pointer; transition: all 0.2s;
+        }}
+        .pill-btn:hover, .pill-btn.active {{
+            background: rgba(99, 102, 241, 0.2);
+            color: #fff;
+            border-color: var(--accent);
+        }}
+
+        .findings-panel {{
+            background: var(--bg-surface);
+            border: 1px solid var(--border);
+            border-radius: 22px;
+            padding: 32px;
+            margin-bottom: 36px;
+        }}
+        .findings-panel h2 {{
+            font-size: 1.35rem; font-weight: 800; margin-bottom: 24px;
+            display: flex; align-items: center; justify-content: space-between;
+        }}
+
+        .finding-card {{
+            background: var(--bg-card);
+            border: 1px solid var(--border);
+            border-radius: 16px;
+            margin-bottom: 16px;
+            overflow: hidden;
+            transition: all 0.2s;
+            backdrop-filter: blur(12px);
+        }}
+        .finding-card:hover {{ border-color: var(--border-hover); }}
+        .finding-card.critical {{ border-left: 6px solid var(--critical); }}
+        .finding-card.high {{ border-left: 6px solid var(--high); }}
+        .finding-card.medium {{ border-left: 6px solid var(--medium); }}
+        .finding-card.low {{ border-left: 6px solid var(--low); }}
+        .finding-card.info {{ border-left: 6px solid var(--info); }}
+
+        .finding-header {{
+            padding: 20px 26px;
+            display: flex; justify-content: space-between; align-items: center;
+            gap: 18px; cursor: pointer; user-select: none;
+        }}
+        .finding-title-line {{ display: flex; align-items: center; gap: 12px; flex-wrap: wrap; margin-bottom: 6px; }}
+        .finding-card-title {{ font-size: 1.02rem; font-weight: 700; color: #fff; }}
+        .badge {{
+            padding: 4px 12px; border-radius: 20px;
+            font-size: 0.72rem; font-weight: 800; text-transform: uppercase;
+            letter-spacing: 0.08em;
+        }}
+        .badge.critical {{ background: rgba(239,68,68,0.2); color: #f87171; border: 1px solid rgba(239,68,68,0.4); }}
+        .badge.high {{ background: rgba(249,115,22,0.2); color: #fb923c; border: 1px solid rgba(249,115,22,0.4); }}
+        .badge.medium {{ background: rgba(234,179,8,0.2); color: #facc15; border: 1px solid rgba(234,179,8,0.4); }}
+        .badge.low {{ background: rgba(16,185,129,0.2); color: #34d399; border: 1px solid rgba(16,185,129,0.4); }}
+        .badge.info {{ background: rgba(56,189,248,0.2); color: #38bdf8; border: 1px solid rgba(56,189,248,0.4); }}
+        .badge.engine {{ background: rgba(99,102,241,0.2); color: #a5b4fc; border: 1px solid rgba(99,102,241,0.4); }}
+
+        .finding-meta-row {{
+            display: flex; gap: 20px; font-size: 0.84rem; color: var(--text-secondary);
+            font-family: 'JetBrains Mono', monospace;
+        }}
+        .finding-body {{
+            display: none;
+            padding: 0 26px 24px;
+            border-top: 1px solid rgba(255,255,255,0.06);
+            margin-top: 12px;
+            padding-top: 18px;
+        }}
+        .finding-body.open {{ display: block; }}
+        .code-snippet {{
+            background: #040711;
+            border: 1px solid var(--border);
+            border-radius: 12px;
+            padding: 16px 20px;
+            font-family: 'JetBrains Mono', monospace;
+            font-size: 0.84rem;
+            color: #38bdf8;
+            overflow-x: auto;
+            margin: 16px 0;
+            white-space: pre-wrap;
+        }}
+        .attributes-grid {{
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+            gap: 12px;
+            background: rgba(0,0,0,0.35);
+            padding: 16px 20px;
+            border-radius: 12px;
+            font-size: 0.84rem;
+        }}
+
+        .engines-panel {{
+            background: var(--bg-surface);
+            border: 1px solid var(--border);
+            border-radius: 22px;
+            padding: 32px;
+            margin-bottom: 36px;
+        }}
+        .engines-grid {{
+            display: grid;
+            grid-template-columns: repeat(auto-fill, minmax(300px, 1fr));
+            gap: 16px;
+            margin-top: 20px;
+        }}
+        .engine-card {{
+            background: rgba(0,0,0,0.35);
+            border: 1px solid var(--border);
+            border-radius: 14px;
+            padding: 18px 22px;
+            transition: all 0.2s;
+        }}
+        .engine-card:hover {{ border-color: var(--border-hover); transform: translateY(-2px); }}
+        .engine-header {{ display: flex; justify-content: space-between; align-items: center; margin-bottom: 8px; }}
+        .engine-prod-name {{ font-size: 1.02rem; font-weight: 800; color: #fff; }}
+        .engine-category {{ font-size: 0.72rem; font-weight: 700; color: var(--accent); background: rgba(99,102,241,0.18); padding: 3px 10px; border-radius: 8px; }}
+        .engine-title {{ font-size: 0.84rem; font-weight: 600; color: var(--text-secondary); margin-bottom: 6px; }}
+        .engine-desc {{ font-size: 0.76rem; color: var(--text-tertiary); line-height: 1.4; }}
+
+        .footer-bar {{
+            text-align: center;
+            font-size: 0.84rem;
+            color: var(--text-tertiary);
+            padding-top: 32px;
+            border-top: 1px solid var(--border);
+        }}
+    </style>
+</head>
+<body>
+    <div class="container">
+        <header class="action-toolbar">
+            <div class="brand-heading">
+                {f'<img src="{logo_data_uri}" class="brand-logo-img" alt="Orion Logo">' if logo_data_uri else '<div style="background:var(--accent-gradient);width:38px;height:38px;border-radius:10px;display:flex;align-items:center;justify-content:center;font-weight:800;color:#fff;">O</div>'}
+                <div>
+                    <div class="brand-title">Orion Security Suite</div>
+                    <div class="brand-sub">Proprietary In-House Security & Code Intelligence Suite</div>
+                </div>
+            </div>
+            <button class="print-btn" onclick="window.print()">
+                🖨️ Export PDF / Print Report
+            </button>
+        </header>
+
+        <section class="executive-banner">
+            <div class="banner-info">
+                <h1>Executive Security Audit Report</h1>
+                <div class="banner-meta">
+                    <span>Target: {html.escape(target_path)}</span>
+                    <span>•</span>
+                    <span>Audit Type: {html.escape(scan_type)}</span>
+                    <span>•</span>
+                    <span>Generated: {datetime.now().strftime('%B %d, %Y - %H:%M:%S')}</span>
+                </div>
+            </div>
+            <div class="grade-card">
+                <div class="grade-circle">{grade}</div>
+                <div class="grade-text-box">
+                    <h4>Security Posture</h4>
+                    <div class="score-val">{score}/100 Index</div>
+                </div>
+            </div>
+        </section>
+
+        <section class="kpi-grid">
+            <div class="kpi-card" style="border-top: 4px solid var(--critical);">
+                <div class="kpi-value" style="color: var(--critical);">{critical}</div>
+                <div class="kpi-label">Critical Risks</div>
+            </div>
+            <div class="kpi-card" style="border-top: 4px solid var(--high);">
+                <div class="kpi-value" style="color: var(--high);">{high}</div>
+                <div class="kpi-label">High Severity</div>
+            </div>
+            <div class="kpi-card" style="border-top: 4px solid var(--medium);">
+                <div class="kpi-value" style="color: var(--medium);">{medium}</div>
+                <div class="kpi-label">Medium Priority</div>
+            </div>
+            <div class="kpi-card" style="border-top: 4px solid var(--low);">
+                <div class="kpi-value" style="color: var(--low);">{low}</div>
+                <div class="kpi-label">Low / Standards</div>
+            </div>
+            <div class="kpi-card" style="border-top: 4px solid var(--info);">
+                <div class="kpi-value" style="color: var(--info);">{total}</div>
+                <div class="kpi-label">Total Findings</div>
+            </div>
+            <div class="kpi-card">
+                <div class="kpi-value" style="color: var(--accent);">{result.metrics.get('files_scanned', 0)}</div>
+                <div class="kpi-label">Files Audited</div>
+            </div>
+        </section>
+
+        <div class="filter-section no-print">
+            <input type="text" class="search-box" id="searchBox" placeholder="Search findings by title, CWE, path, or engine..." onkeyup="applyFilter()">
+            <div class="filter-pills">
+                <button class="pill-btn active" onclick="setSeverity('all', this)">All Severities</button>
+                <button class="pill-btn" onclick="setSeverity('critical', this)">Critical ({critical})</button>
+                <button class="pill-btn" onclick="setSeverity('high', this)">High ({high})</button>
+                <button class="pill-btn" onclick="setSeverity('medium', this)">Medium ({medium})</button>
+                <button class="pill-btn" onclick="setSeverity('low', this)">Low ({low})</button>
+            </div>
+        </div>
+        <div class="filter-section no-print" style="margin-top: -16px; padding: 12px 24px; background: rgba(12, 18, 30, 0.65);">
+            <span style="font-size: 0.8rem; font-weight: 700; color: var(--text-secondary); text-transform: uppercase;">Category:</span>
+            <div class="filter-pills">
+                <button class="pill-btn cat-btn active" onclick="setCategory('all', this)">All Categories</button>
+                <button class="pill-btn cat-btn" onclick="setCategory('security', this)">🛡️ Security & Vulnerabilities</button>
+                <button class="pill-btn cat-btn" onclick="setCategory('quality', this)">⚡ Code Quality & Standards</button>
+                <button class="pill-btn cat-btn" onclick="setCategory('architecture', this)">🏛️ Architecture & Dataflow</button>
+                <button class="pill-btn cat-btn" onclick="setCategory('supply', this)">📦 Supply Chain & Privacy</button>
+            </div>
+        </div>
+
+        <section class="findings-panel">
+            <h2>Findings Catalog ({total})</h2>
+            <div id="findingsContainer">
+""")
+
+        sorted_findings = sorted(result.findings, key=lambda f: severity_order.get(f.severity, 5))
+        for finding in sorted_findings:
+            sev = finding.severity.lower()
+            title = html.escape(finding.title)
+            loc = html.escape(finding.location)
+            desc = html.escape(finding.description or "")
+            engine_code = finding.engine
+            m_meta = ENGINE_MARKETING_METADATA.get(engine_code, {})
+            engine_prod_name = html.escape(m_meta.get("name", engine_code))
+            raw_cat = m_meta.get("cat", "General")
+            engine_cat = html.escape(raw_cat)
+            
+            # Slugify category
+            cat_slug = "quality"
+            if "Security" in raw_cat or "Threat" in raw_cat or "Cloud" in raw_cat:
+                cat_slug = "security"
+            elif "Architecture" in raw_cat or "Dataflow" in raw_cat:
+                cat_slug = "architecture"
+            elif "Supply" in raw_cat or "Compliance" in raw_cat or "Privacy" in raw_cat:
+                cat_slug = "supply"
+
+            cwe = html.escape(str(finding.metadata.get("cwe", "")))
+            cwe_badge = f'<span class="badge {sev}">{cwe}</span>' if cwe else ""
+            snippet = html.escape(str(finding.metadata.get("snippet", "")).strip())
+            conf = html.escape(str(finding.metadata.get("confidence", "N/A")))
+            contribs = finding.metadata.get("contributing_engines", [engine_code])
+            contrib_str = ", ".join(ENGINE_MARKETING_METADATA.get(e, {}).get("name", e) for e in contribs)
+
+            f.write(f"""
+                <div class="finding-card {sev}" data-severity="{sev}" data-category="{cat_slug}" data-search="{title.lower()} {loc.lower()} {engine_prod_name.lower()} {engine_code.lower()} {cwe.lower()} {engine_cat.lower()}">
+                    <div class="finding-header" onclick="toggleDetails(this)">
+                        <div style="flex: 1;">
+                            <div class="finding-title-line">
+                                <span class="badge {sev}">{sev.upper()}</span>
+                                <span class="badge engine">{engine_prod_name}</span>
+                                <span class="badge" style="background: rgba(255,255,255,0.08); color: var(--text-secondary);">{engine_cat}</span>
+                                {cwe_badge}
+                                <span class="finding-card-title">{title}</span>
+                            </div>
+                            <div class="finding-meta-row">
+                                <span>Engine: {engine_prod_name} ({engine_code})</span>
+                                <span>•</span>
+                                <span>Location: {loc}</span>
+                                <span>•</span>
+                                <span>Confidence: {conf}</span>
+                            </div>
+                        </div>
+                    </div>
+                    <div class="finding-body">
+                        {f'<p style="font-size: 0.9rem; color: var(--text-secondary); margin-bottom: 12px;">{desc}</p>' if desc else ''}
+                        {f'<div class="code-snippet">{snippet}</div>' if snippet else ''}
+                        <div class="attributes-grid">
+                            <div><strong>Engine:</strong> {engine_prod_name} ({engine_code})</div>
+                            <div><strong>Category:</strong> {engine_cat}</div>
+                            <div><strong>Contributing Scanners:</strong> {contrib_str}</div>
+                            <div><strong>Location:</strong> {loc}</div>
+                            <div><strong>Severity:</strong> {sev.upper()}</div>
+                            <div><strong>Confidence:</strong> {conf}</div>
+                        </div>
+                    </div>
+                </div>
+""")
+
+        f.write(f"""
+            </div>
+        </section>
+
+        <section class="engines-panel">
+            <h2>Proprietary In-House Auditing Engines</h2>
+            <p style="font-size: 0.88rem; color: var(--text-secondary);">Every scanner is 100% custom-built, running AST semantic analysis, Inter-Procedural Control Flow Graphs, Taint Propagation, and Cloud/IaC/AI Security Analyzers locally.</p>
+            <div class="engines-grid">
+""")
+        for eng_key, meta in ENGINE_MARKETING_METADATA.items():
+            f.write(f"""
+                <div class="engine-card">
+                    <div class="engine-header">
+                        <span class="engine-prod-name">{meta['name']}</span>
+                        <span class="engine-category">{meta['cat']}</span>
+                    </div>
+                    <div class="engine-title">{meta['title']}</div>
+                    <div class="engine-desc">{meta['desc']}</div>
+                </div>
+""")
+
+        f.write(f"""
+            </div>
+        </section>
+
+        <footer class="footer-bar no-print">
+            Generated by <strong>Orion Security Suite v0.1.0</strong> • Proprietary Code Intelligence & Security Suite
+        </footer>
+    </div>
+
+    <script>
+        let activeSeverity = 'all';
+        let activeCategory = 'all';
+
+        function toggleDetails(header) {{
+            const body = header.nextElementSibling;
+            body.classList.toggle('open');
+        }}
+
+        function setSeverity(sev, btn) {{
+            activeSeverity = sev;
+            document.querySelectorAll('.filter-pills button:not(.cat-btn)').forEach(b => b.classList.remove('active'));
+            btn.classList.add('active');
+            applyFilter();
+        }}
+
+        function setCategory(cat, btn) {{
+            activeCategory = cat;
+            document.querySelectorAll('.cat-btn').forEach(b => b.classList.remove('active'));
+            btn.classList.add('active');
+            applyFilter();
+        }}
+
+        function applyFilter() {{
+            const query = document.getElementById('searchBox').value.toLowerCase();
+            const cards = document.querySelectorAll('.finding-card');
+
+            cards.forEach(card => {{
+                const cardSev = card.getAttribute('data-severity');
+                const cardCat = card.getAttribute('data-category');
+                const cardSearch = card.getAttribute('data-search');
+                const matchesSev = (activeSeverity === 'all' || cardSev === activeSeverity);
+                const matchesCat = (activeCategory === 'all' || cardCat === activeCategory);
+                const matchesQuery = !query || cardSearch.includes(query);
+
+                if (matchesSev && matchesCat && matchesQuery) {{
+                    card.style.display = 'block';
+                }} else {{
+                    card.style.display = 'none';
+                }}
+            }});
+        }}
+    </script>
+</body>
+</html>""")
+
+    print(f"\n  {GREEN}{BOLD}✔ Latest Reports Generated in {REPORTS_DIR}/{RESET}")
+    print(f"    {CYAN}• Executive HTML (Print & PDF):{RESET} {WHITE}{html_path.name}{RESET}")
+    print(f"    {CYAN}• Validated JSON Findings:{RESET}      {WHITE}{json_path.name}{RESET}")
+    print(f"    {CYAN}• Summary Text Report:{RESET}          {WHITE}{txt_path.name}{RESET}\n")
+
+    return json_path, txt_path, html_path
+
+
+def print_results(result):
+    """Print scan results in a beautifully styled, high-clarity CLI dashboard."""
+    if not result:
+        return 0
+
+    elapsed = result.metrics.get('elapsed_s', 0)
+    files_count = result.metrics.get('files_scanned', 0)
+    engines_count = result.metrics.get('engines_run', 0)
+    total_findings = len(result.findings)
+
+    critical_count = sum(1 for f in result.findings if f.severity == "critical")
+    high_count = sum(1 for f in result.findings if f.severity == "high")
+    medium_count = sum(1 for f in result.findings if f.severity == "medium")
+    low_count = sum(1 for f in result.findings if f.severity == "low")
+    info_count = sum(1 for f in result.findings if f.severity == "info")
+
+    score = 100 - (critical_count * 15) - (high_count * 8) - (medium_count * 3) - (low_count * 1)
+    score = max(0, score)
+    if score >= 90: grade = "A"
+    elif score >= 75: grade = "B"
+    elif score >= 60: grade = "C"
+    else: grade = "F"
+
+    grade_color = GREEN if grade in ("A", "B") else (YELLOW if grade == "C" else RED)
+
+    print(f"""
+  {CYAN}┌───────────────────────────────────────────────────────────────────────────────────┐{RESET}
+  {CYAN}│{RESET}  {WHITE}{BOLD}AUDIT SUMMARY • ORION SECURITY SUITE{RESET}                                            {CYAN}│{RESET}
+  {CYAN}├─────────────────────┬─────────────────────┬───────────────────┬───────────────────┤{RESET}
+  {CYAN}│{RESET} {DIM}Audited Workspace{RESET}   {CYAN}│{RESET} {DIM}Files Scanned{RESET}       {CYAN}│{RESET} {DIM}Engines Executed{RESET}  {CYAN}│{RESET} {DIM}Analysis Time{RESET}       {CYAN}│{RESET}
+  {CYAN}│{RESET} {WHITE}{BOLD}{Path('.').resolve().name:<19}{RESET} {CYAN}│{RESET} {WHITE}{BOLD}{files_count:<3} files{RESET}          {CYAN}│{RESET} {WHITE}{BOLD}{engines_count:<5} passes{RESET}    {CYAN}│{RESET} {WHITE}{BOLD}{elapsed:.2f}s{RESET}              {CYAN}│{RESET}
+  {CYAN}├─────────────────────┴─────────────────────┴───────────────────┴───────────────────┤{RESET}
+  {CYAN}│{RESET}  {WHITE}{BOLD}SECURITY POSTURE:{RESET} {grade_color}{BOLD}GRADE {grade}{RESET} {DIM}({score}/100 Security Index){RESET}                                  {CYAN}│{RESET}
+  {CYAN}│{RESET}  {RED}{BOLD}[ CRITICAL: {critical_count:<3} ]{RESET}  {YELLOW}{BOLD}[ HIGH: {high_count:<3} ]{RESET}  {YELLOW}[ MEDIUM: {medium_count:<3} ]{RESET}  {GREEN}[ LOW: {low_count:<4} ]{RESET}         {CYAN}│{RESET}
+  {CYAN}└───────────────────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+    if result.findings:
+        severity_order = {"critical": 0, "high": 1, "medium": 2, "low": 3, "info": 4}
+        sorted_findings = sorted(result.findings, key=lambda f: severity_order.get(f.severity, 5))
+
+        security_cats = {"Application Security", "Cloud & Infrastructure", "AI & Emerging Threats"}
+        sec_findings = [f for f in sorted_findings if ENGINE_MARKETING_METADATA.get(f.engine, {}).get("cat") in security_cats]
+        code_findings = [f for f in sorted_findings if ENGINE_MARKETING_METADATA.get(f.engine, {}).get("cat") not in security_cats]
+
+        # 1. Security & Vulnerability Highlights
+        print(f"  {WHITE}{BOLD}1. SECURITY & VULNERABILITY HIGHLIGHTS ({len(sec_findings)} issues):{RESET}")
+        if sec_findings:
+            for f in sec_findings[:6]:
+                sev = f.severity.lower()
+                color = RED if sev == "critical" else (YELLOW if sev == "high" else CYAN)
+                cwe = f.metadata.get("cwe", "")
+                cwe_str = f" {CYAN}[{cwe}]{RESET}" if cwe else ""
+                conf = f.metadata.get("confidence", "N/A")
+                m_meta = ENGINE_MARKETING_METADATA.get(f.engine, {})
+                eng_name = m_meta.get("name", f.engine)
+                print(f"    {color}• [{sev.upper()}]{RESET} {WHITE}{BOLD}{f.title}{RESET}{cwe_str}")
+                print(f"      {DIM}Location:{RESET} {WHITE}{f.location}{RESET}  {DIM}|  Engine:{RESET} {CYAN}{eng_name}{RESET}  {DIM}|  Confidence:{RESET} {conf}")
+            if len(sec_findings) > 6:
+                print(f"      {DIM}... and {len(sec_findings) - 6} more security findings in executive report{RESET}")
+        else:
+            print(f"    {GREEN}✔ Zero critical or high security vulnerabilities detected.{RESET}")
+
+        # 2. Code Quality, Standards & Architecture Highlights
+        print(f"\n  {WHITE}{BOLD}2. CODE QUALITY, STANDARDS & ARCHITECTURE HIGHLIGHTS ({len(code_findings)} issues):{RESET}")
+        if code_findings:
+            for f in code_findings[:6]:
+                sev = f.severity.lower()
+                color = YELLOW if sev in ("medium", "high") else GREEN
+                cwe = f.metadata.get("cwe", "")
+                cwe_str = f" {CYAN}[{cwe}]{RESET}" if cwe else ""
+                conf = f.metadata.get("confidence", "N/A")
+                m_meta = ENGINE_MARKETING_METADATA.get(f.engine, {})
+                eng_name = m_meta.get("name", f.engine)
+                print(f"    {color}• [{sev.upper()}]{RESET} {WHITE}{BOLD}{f.title}{RESET}{cwe_str}")
+                print(f"      {DIM}Location:{RESET} {WHITE}{f.location}{RESET}  {DIM}|  Engine:{RESET} {CYAN}{eng_name}{RESET}  {DIM}|  Confidence:{RESET} {conf}")
+            if len(code_findings) > 6:
+                print(f"      {DIM}... and {len(code_findings) - 6} more code quality / architecture findings in report{RESET}")
+        else:
+            print(f"    {GREEN}✔ Codebase adheres to all clean code and structural standards.{RESET}")
+
+    print(f"\n  {CYAN}─────────────────────────────────────────────────────────────────────────────────────{RESET}")
+    return critical_count + high_count
+
+
+def interactive_menu():
+    """Run interactive menu loop."""
+    config = EngineConfig()
+    report_history = []
+
+    while True:
+        clear_screen()
+        print(BANNER)
+        print(MENU)
+        choice = input(f"  {CYAN}{BOLD}Orion >> {RESET}").strip().upper()
+
+        if choice == "0":
+            print(f"\n  {CYAN}Session closed. Thank you for using Orion Security Suite!{RESET}\n")
+            break
+
+        elif choice == "1":
+            clear_screen()
+            path = "."
+            result = asyncio.run(scan_path(path, config))
+            if result:
+                report_history.append(("Quick Scan", path, result))
+                print_results(result)
+                generate_reports("Quick Scan", path, result)
+
+        elif choice == "2":
+            clear_screen()
+            path = "."
+            result = asyncio.run(scan_path(path, config))
+            if result:
+                report_history.append(("Full Audit", path, result))
+                print_results(result)
+                generate_reports("Full Audit", path, result)
+
+        elif choice == "3":
+            clear_screen()
+            path = "."
+            security_engines = ["sast", "secrets", "deps", "taint", "authorization", "sandbox_escape", "prompt_security"]
+            result = asyncio.run(scan_path(path, config, security_engines))
+            if result:
+                report_history.append(("Security Scan", path, result))
+                print_results(result)
+                generate_reports("Security Scan", path, result)
+
+        elif choice == "4":
+            clear_screen()
+            path = "."
+            iac_engines = ["iac_security", "container", "config_engine", "config_validation"]
+            result = asyncio.run(scan_path(path, config, iac_engines))
+            if result:
+                report_history.append(("IaC Scan", path, result))
+                print_results(result)
+                generate_reports("IaC Scan", path, result)
+
+        elif choice == "5":
+            clear_screen()
+            path = "."
+            ai_engines = ["llm_security", "prompt_security"]
+            result = asyncio.run(scan_path(path, config, ai_engines))
+            if result:
+                report_history.append(("AI Security Scan", path, result))
+                print_results(result)
+                generate_reports("AI Security Scan", path, result)
+
+        elif choice == "6":
+            clear_screen()
+            path = "."
+            crypto_engines = ["crypto_guard", "secrets"]
+            result = asyncio.run(scan_path(path, config, crypto_engines))
+            if result:
+                report_history.append(("Crypto Scan", path, result))
+                print_results(result)
+                generate_reports("Crypto Scan", path, result)
+
+        elif choice == "7":
+            clear_screen()
+            path = "."
+            quality_engines = ["complexity", "duplication", "error_handling", "logging_c", "lint", "test_coverage", "dead_import"]
+            result = asyncio.run(scan_path(path, config, quality_engines))
+            if result:
+                report_history.append(("Quality Scan", path, result))
+                print_results(result)
+                generate_reports("Quality Scan", path, result)
+
+        elif choice == "8":
+            clear_screen()
+            path = "."
+            sc_engines = ["supply_chain_sbom", "provenance", "compliance", "license", "deps"]
+            result = asyncio.run(scan_path(path, config, sc_engines))
+            if result:
+                report_history.append(("Supply Chain Scan", path, result))
+                print_results(result)
+                generate_reports("Supply Chain Scan", path, result)
+
+        elif choice == "9":
+            clear_screen()
+            path = "."
+            threat_engines = ["threat_model", "sensitive_data"]
+            result = asyncio.run(scan_path(path, config, threat_engines))
+            if result:
+                report_history.append(("Threat & Privacy Scan", path, result))
+                print_results(result)
+                generate_reports("Threat & Privacy Scan", path, result)
+
+        elif choice in ("R", "REPORT"):
+            clear_screen()
+            html_rep = REPORTS_DIR / "orion_executive_security_report.html"
+            print(f"\n  {CYAN}{BOLD}Latest Executive Report Location:{RESET}")
+            if html_rep.exists():
+                print(f"    {GREEN}✔{RESET} {WHITE}{html_rep.resolve()}{RESET}")
+                print(f"\n    {DIM}Tip: Open this file in your browser to inspect interactive graphs or export executive PDF.{RESET}")
+            else:
+                print(f"    {DIM}No reports generated yet. Run option [1] or [2] first.{RESET}")
+
+        elif choice in ("S", "STATUS"):
+            clear_screen()
+            engine = OrionEngine()
+            print(f"""
+  {CYAN}┌─────────────────────────────────────────────────────────────────────────────────────────────┐{RESET}
+  {CYAN}│{RESET}  {WHITE}{BOLD}IN-HOUSE PROPRIETARY ENGINES ({engine.registered_count} ACTIVE){RESET}                                           {CYAN}│{RESET}
+  {CYAN}│{RESET}  {DIM}100% Custom-Engineered Local Intellectual Property (Zero External Dependencies){RESET}             {CYAN}│{RESET}
+  {CYAN}├────┬──────────┬──────────────────────┬────────────────────────────┬───────────────────────────┤{RESET}
+  {CYAN}│{RESET} {DIM}#  {RESET} {CYAN}│{RESET} {DIM}STATUS  {RESET} {CYAN}│{RESET} {DIM}PROPRIETARY ENGINE   {RESET} {CYAN}│{RESET} {DIM}CATEGORY                   {RESET} {CYAN}│{RESET} {DIM}INTERNAL IDENTIFIER         {RESET}{CYAN}│{RESET}
+  {CYAN}├────┼──────────┼──────────────────────┼────────────────────────────┼───────────────────────────┤{RESET}""")
+            for idx, name in enumerate(sorted(engine._engines.keys()), 1):
+                try:
+                    cls = engine._engines[name]
+                    inst = cls()
+                    avail = asyncio.run(inst.check_availability())
+                    meta = ENGINE_MARKETING_METADATA.get(name, {"name": name, "title": name, "cat": "General"})
+                    m_name = meta["name"]
+                    m_cat = meta["cat"]
+                    status = f"{GREEN}ACTIVE{RESET}" if avail else f"{RED}OFFLINE{RESET}"
+                    print(f"  {CYAN}│{RESET} {idx:02d} {CYAN}│{RESET} {status}   {CYAN}│{RESET} {WHITE}{BOLD}{m_name:<20}{RESET} {CYAN}│{RESET} {DIM}{m_cat:<26}{RESET} {CYAN}│{RESET} {CYAN}{name:<25}{RESET} {CYAN}│{RESET}")
+                except Exception as e:
+                    print(f"  {CYAN}│{RESET} {idx:02d} {CYAN}│{RESET} {RED}ERROR   {RESET} {CYAN}│{RESET} {WHITE}{name:<20}{RESET} {CYAN}│{RESET} {DIM}Error: {str(e)[:20]:<20}{RESET} {CYAN}│{RESET} {name:<25} {CYAN}│{RESET}")
+            print(f"  {CYAN}└────┴──────────┴──────────────────────┴────────────────────────────┴───────────────────────────┘{RESET}")
+
+        else:
+            print(f"\n  {RED}✖ Invalid selection. Please select an option from the menu.{RESET}")
+
+        input(f"\n  {DIM}Press Enter to return to main menu...{RESET}")
+
+
+def main():
+    if len(sys.argv) > 1:
+        if "--version" in sys.argv or "-v" in sys.argv:
+            print("Orion Engine Suite v0.1.0 (Security & Code Intelligence Platform)")
+            sys.exit(0)
+        if "--help" in sys.argv or "-h" in sys.argv:
+            print("""Orion Engine Suite v0.1.0 - Enterprise Code Audit Platform
+
+Usage:
+  orion                    # Launch interactive terminal UI
+  orion <path>             # Scan file or directory
+  orion . --security       # Security, SAST & vulnerability engines
+  orion . --iac            # Infrastructure-as-Code & Cloud engines
+  orion . --ai             # LLM & AI Agent security engines
+  orion . --crypto         # Cryptographic flaw & key auditor
+  orion . --quality        # Code quality & standard engines
+  orion . --arch           # Architecture & dataflow engines
+  orion . --threat         # Threat modeling & privacy engines
+  orion --version          # Show version
+  orion --help             # Show help
+""")
+            sys.exit(0)
+
+        target = sys.argv[1]
+        config = None
+
+        if "--config-json" in sys.argv:
+            idx = sys.argv.index("--config-json")
+            if idx + 1 < len(sys.argv):
+                config_data = json.loads(sys.argv[idx + 1])
+                config = EngineConfig(**config_data)
+
+        engine_filter = None
+        scan_type = "Full Audit"
+        if "--security" in sys.argv:
+            engine_filter = ["sast", "secrets", "deps", "taint", "authorization", "sandbox_escape", "prompt_security"]
+            scan_type = "Security Scan"
+        elif "--iac" in sys.argv:
+            engine_filter = ["iac_security", "container", "config_engine", "config_validation"]
+            scan_type = "IaC Scan"
+        elif "--ai" in sys.argv:
+            engine_filter = ["llm_security", "prompt_security"]
+            scan_type = "AI Security Scan"
+        elif "--crypto" in sys.argv:
+            engine_filter = ["crypto_guard", "secrets"]
+            scan_type = "Crypto Scan"
+        elif "--quality" in sys.argv:
+            engine_filter = ["complexity", "duplication", "error_handling", "logging_c", "lint", "test_coverage", "dead_import"]
+            scan_type = "Quality Scan"
+        elif "--arch" in sys.argv:
+            engine_filter = ["callgraph", "cfg", "symbol", "dataflow", "architecture", "orphan", "wiring_trace"]
+            scan_type = "Architecture Scan"
+        elif "--threat" in sys.argv:
+            engine_filter = ["threat_model", "sensitive_data"]
+            scan_type = "Threat & Privacy Scan"
+
+        result = asyncio.run(scan_path(target, config or EngineConfig(), engine_filter))
+        if result:
+            critical_high = print_results(result)
+            generate_reports(scan_type, target, result)
+            sys.exit(1 if critical_high > 0 else 0)
+        sys.exit(0)
+
+    try:
+        interactive_menu()
+    except KeyboardInterrupt:
+        print("\n\n  Session terminated by user. Goodbye!\n")
+
+
+if __name__ == "__main__":
+    main()