kirograph 0.16.1 → 0.19.0

package/dist/bin/commands/reachability.js

@@ -0,0 +1,160 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var reachability_exports = {};
+__export(reachability_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(reachability_exports);
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+const red = "\x1B[31m";
+const yellow = "\x1B[33m";
+function register(program) {
+  program.command("reachability <target> [projectPath]").description("Check reachability for a dependency or CVE: verdict, call paths, impact summary").action(async (target, projectPath) => {
+    const projectRoot = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(projectRoot);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${yellow}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(projectRoot)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(projectRoot);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const rawDb = db.getRawDb();
+    let vulnerabilityNodeId = null;
+    let targetLabel = target;
+    const vulnRow = rawDb.get(
+      `SELECT node_id FROM sec_vulnerabilities WHERE cve_id = ?`,
+      [target]
+    );
+    if (vulnRow) {
+      vulnerabilityNodeId = vulnRow.node_id;
+    } else {
+      const depRow = rawDb.get(
+        `SELECT node_id, package_name FROM sec_dependencies WHERE package_name = ?`,
+        [target]
+      );
+      if (depRow) {
+        targetLabel = depRow.package_name;
+        const vulnEdge = rawDb.get(
+          `SELECT target FROM edges WHERE source = ? AND kind = 'has_vulnerability' LIMIT 1`,
+          [depRow.node_id]
+        );
+        if (vulnEdge) {
+          vulnerabilityNodeId = vulnEdge.target;
+        } else {
+          console.error(`
+  ${import_ui.dim}No vulnerabilities found for dependency "${target}". The dependency exists but has no known CVEs.${import_ui.reset}
+`);
+          cg.close();
+          process.exit(0);
+        }
+      } else {
+        console.error(`
+  \u2716 Target "${target}" not found. Provide a valid CVE ID or dependency package name.
+`);
+        cg.close();
+        process.exit(1);
+      }
+    }
+    const { ReachabilityAnalyzer } = await Promise.resolve().then(() => require("../../security/reachability.js"));
+    const analyzer = new ReachabilityAnalyzer(db, config);
+    const result = await analyzer.analyze(vulnerabilityNodeId);
+    let verdictColor;
+    let verdictLabel;
+    if (result.verdict === "affected") {
+      verdictColor = red;
+      verdictLabel = "affected";
+    } else if (result.verdict === "not_affected") {
+      verdictColor = import_ui.green;
+      verdictLabel = "not affected";
+    } else {
+      verdictColor = yellow;
+      verdictLabel = "under investigation";
+    }
+    console.log(`
+  ${import_ui.violet}${import_ui.bold}Reachability:${import_ui.reset} ${targetLabel}`);
+    console.log(`  ${import_ui.dim}Verdict:${import_ui.reset}                ${verdictColor}${import_ui.bold}${verdictLabel}${import_ui.reset}`);
+    console.log(`  ${import_ui.dim}Reaching entry points:${import_ui.reset}  ${import_ui.bold}${result.reachingEntryPointCount}${import_ui.reset}`);
+    if (result.paths.length > 0) {
+      console.log(`
+  ${import_ui.violet}${import_ui.bold}Call Paths${import_ui.reset}  ${import_ui.dim}(showing up to 5)${import_ui.reset}
+`);
+      for (const p of result.paths.slice(0, 5)) {
+        console.log(`  ${import_ui.dim}from${import_ui.reset} ${import_ui.violet}${p.entryPoint}${import_ui.reset}`);
+        console.log(`    ${p.path.join(` ${import_ui.dim}\u2192${import_ui.reset} `)}`);
+      }
+      if (result.paths.length > 5) {
+        console.log(`
+  ${import_ui.dim}\u2026and ${result.paths.length - 5} more paths${import_ui.reset}`);
+      }
+    }
+    if (result.unresolvedSymbols.length > 0) {
+      console.log(`
+  ${yellow}Unresolved Symbols${import_ui.reset}  ${import_ui.dim}(${result.unresolvedSymbols.length} total, showing up to 10)${import_ui.reset}
+`);
+      for (const sym of result.unresolvedSymbols.slice(0, 10)) {
+        console.log(`  ${import_ui.dim}\xB7${import_ui.reset} ${sym}`);
+      }
+      if (result.unresolvedSymbols.length > 10) {
+        console.log(`  ${import_ui.dim}\u2026and ${result.unresolvedSymbols.length - 10} more${import_ui.reset}`);
+      }
+    }
+    if (result.verdict === "affected") {
+      const impact = await analyzer.getImpactSummary(vulnerabilityNodeId);
+      if (impact) {
+        console.log(`
+  ${import_ui.violet}${import_ui.bold}Impact Summary${import_ui.reset}
+`);
+        if (impact.affectedLayers.length > 0) {
+          console.log(`  ${import_ui.dim}Affected layers:${import_ui.reset}       ${impact.affectedLayers.join(", ")}`);
+        }
+        console.log(`  ${import_ui.dim}Affected entry points:${import_ui.reset} ${import_ui.bold}${impact.affectedEntryPoints.length}${import_ui.reset}`);
+        console.log(`  ${import_ui.dim}Distinct paths:${import_ui.reset}        ${import_ui.bold}${impact.distinctPathCount}${import_ui.reset}`);
+      }
+    }
+    console.log();
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=reachability.js.map

package/dist/bin/commands/reachability.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/reachability.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\n\nconst red    = '\\x1b[31m';\nconst yellow = '\\x1b[33m';\n\nexport function register(program: Command): void {\n  program\n    .command('reachability <target> [projectPath]')\n    .description('Check reachability for a dependency or CVE: verdict, call paths, impact summary')\n    .action(async (target: string, projectPath: string | undefined) => {\n      const projectRoot = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(projectRoot);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${yellow}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(projectRoot)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(projectRoot);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n      const rawDb = db.getRawDb();\n\n      // Resolve target to a vulnerability node ID (CVE ID or package name)\n      let vulnerabilityNodeId: string | null = null;\n      let targetLabel = target;\n\n      const vulnRow: { node_id: string } | undefined = rawDb.get(\n        `SELECT node_id FROM sec_vulnerabilities WHERE cve_id = ?`,\n        [target],\n      );\n\n      if (vulnRow) {\n        vulnerabilityNodeId = vulnRow.node_id;\n      } else {\n        const depRow: { node_id: string; package_name: string } | undefined = rawDb.get(\n          `SELECT node_id, package_name FROM sec_dependencies WHERE package_name = ?`,\n          [target],\n        );\n\n        if (depRow) {\n          targetLabel = depRow.package_name;\n          const vulnEdge: { target: string } | undefined = rawDb.get(\n            `SELECT target FROM edges WHERE source = ? AND kind = 'has_vulnerability' LIMIT 1`,\n            [depRow.node_id],\n          );\n\n          if (vulnEdge) {\n            vulnerabilityNodeId = vulnEdge.target;\n          } else {\n            console.error(`\\n  ${dim}No vulnerabilities found for dependency \"${target}\". The dependency exists but has no known CVEs.${reset}\\n`);\n            cg.close();\n            process.exit(0);\n          }\n        } else {\n          console.error(`\\n  \u2716 Target \"${target}\" not found. Provide a valid CVE ID or dependency package name.\\n`);\n          cg.close();\n          process.exit(1);\n        }\n      }\n\n      const { ReachabilityAnalyzer } = await Promise.resolve().then(() => require('../../security/reachability.js'));\n      const analyzer = new ReachabilityAnalyzer(db, config);\n      const result = await analyzer.analyze(vulnerabilityNodeId);\n\n      // Verdict line\n      let verdictColor: string;\n      let verdictLabel: string;\n      if (result.verdict === 'affected') {\n        verdictColor = red; verdictLabel = 'affected';\n      } else if (result.verdict === 'not_affected') {\n        verdictColor = green; verdictLabel = 'not affected';\n      } else {\n        verdictColor = yellow; verdictLabel = 'under investigation';\n      }\n\n      console.log(`\\n  ${violet}${bold}Reachability:${reset} ${targetLabel}`);\n      console.log(`  ${dim}Verdict:${reset}                ${verdictColor}${bold}${verdictLabel}${reset}`);\n      console.log(`  ${dim}Reaching entry points:${reset}  ${bold}${result.reachingEntryPointCount}${reset}`);\n\n      // Call paths\n      if (result.paths.length > 0) {\n        console.log(`\\n  ${violet}${bold}Call Paths${reset}  ${dim}(showing up to 5)${reset}\\n`);\n        for (const p of result.paths.slice(0, 5)) {\n          console.log(`  ${dim}from${reset} ${violet}${p.entryPoint}${reset}`);\n          console.log(`    ${p.path.join(` ${dim}\u2192${reset} `)}`);\n        }\n        if (result.paths.length > 5) {\n          console.log(`\\n  ${dim}\u2026and ${result.paths.length - 5} more paths${reset}`);\n        }\n      }\n\n      // Unresolved symbols\n      if (result.unresolvedSymbols.length > 0) {\n        console.log(`\\n  ${yellow}Unresolved Symbols${reset}  ${dim}(${result.unresolvedSymbols.length} total, showing up to 10)${reset}\\n`);\n        for (const sym of result.unresolvedSymbols.slice(0, 10)) {\n          console.log(`  ${dim}\u00B7${reset} ${sym}`);\n        }\n        if (result.unresolvedSymbols.length > 10) {\n          console.log(`  ${dim}\u2026and ${result.unresolvedSymbols.length - 10} more${reset}`);\n        }\n      }\n\n      // Impact summary (only when affected)\n      if (result.verdict === 'affected') {\n        const impact = await analyzer.getImpactSummary(vulnerabilityNodeId);\n        if (impact) {\n          console.log(`\\n  ${violet}${bold}Impact Summary${reset}\\n`);\n          if (impact.affectedLayers.length > 0) {\n            console.log(`  ${dim}Affected layers:${reset}       ${impact.affectedLayers.join(', ')}`);\n          }\n          console.log(`  ${dim}Affected entry points:${reset} ${bold}${impact.affectedEntryPoints.length}${reset}`);\n          console.log(`  ${dim}Distinct paths:${reset}        ${bold}${impact.distinctPathCount}${reset}`);\n        }\n      }\n\n      console.log();\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAEhD,MAAM,MAAS;AACf,MAAM,SAAS;AAER,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,qCAAqC,EAC7C,YAAY,iFAAiF,EAC7F,OAAO,OAAO,QAAgB,gBAAoC;AACjE,UAAM,cAAc,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AAC7D,UAAM,SAAS,UAAM,0BAAW,WAAW;AAE3C,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,MAAM,wCAAmC,eAAK,EAAE;AACrE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,WAAW,GAAG;AACzC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,WAAW;AAC3C,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AACvB,UAAM,QAAQ,GAAG,SAAS;AAG1B,QAAI,sBAAqC;AACzC,QAAI,cAAc;AAElB,UAAM,UAA2C,MAAM;AAAA,MACrD;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAEA,QAAI,SAAS;AACX,4BAAsB,QAAQ;AAAA,IAChC,OAAO;AACL,YAAM,SAAgE,MAAM;AAAA,QAC1E;AAAA,QACA,CAAC,MAAM;AAAA,MACT;AAEA,UAAI,QAAQ;AACV,sBAAc,OAAO;AACrB,cAAM,WAA2C,MAAM;AAAA,UACrD;AAAA,UACA,CAAC,OAAO,OAAO;AAAA,QACjB;AAEA,YAAI,UAAU;AACZ,gCAAsB,SAAS;AAAA,QACjC,OAAO;AACL,kBAAQ,MAAM;AAAA,IAAO,aAAG,4CAA4C,MAAM,kDAAkD,eAAK;AAAA,CAAI;AACrI,aAAG,MAAM;AACT,kBAAQ,KAAK,CAAC;AAAA,QAChB;AAAA,MACF,OAAO;AACL,gBAAQ,MAAM;AAAA,mBAAiB,MAAM;AAAA,CAAmE;AACxG,WAAG,MAAM;AACT,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,qBAAqB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gCAAgC,CAAC;AAC7G,UAAM,WAAW,IAAI,qBAAqB,IAAI,MAAM;AACpD,UAAM,SAAS,MAAM,SAAS,QAAQ,mBAAmB;AAGzD,QAAI;AACJ,QAAI;AACJ,QAAI,OAAO,YAAY,YAAY;AACjC,qBAAe;AAAK,qBAAe;AAAA,IACrC,WAAW,OAAO,YAAY,gBAAgB;AAC5C,qBAAe;AAAO,qBAAe;AAAA,IACvC,OAAO;AACL,qBAAe;AAAQ,qBAAe;AAAA,IACxC;AAEA,YAAQ,IAAI;AAAA,IAAO,gBAAM,GAAG,cAAI,gBAAgB,eAAK,IAAI,WAAW,EAAE;AACtE,YAAQ,IAAI,KAAK,aAAG,WAAW,eAAK,mBAAmB,YAAY,GAAG,cAAI,GAAG,YAAY,GAAG,eAAK,EAAE;AACnG,YAAQ,IAAI,KAAK,aAAG,yBAAyB,eAAK,KAAK,cAAI,GAAG,OAAO,uBAAuB,GAAG,eAAK,EAAE;AAGtG,QAAI,OAAO,MAAM,SAAS,GAAG;AAC3B,cAAQ,IAAI;AAAA,IAAO,gBAAM,GAAG,cAAI,aAAa,eAAK,KAAK,aAAG,oBAAoB,eAAK;AAAA,CAAI;AACvF,iBAAW,KAAK,OAAO,MAAM,MAAM,GAAG,CAAC,GAAG;AACxC,gBAAQ,IAAI,KAAK,aAAG,OAAO,eAAK,IAAI,gBAAM,GAAG,EAAE,UAAU,GAAG,eAAK,EAAE;AACnE,gBAAQ,IAAI,OAAO,EAAE,KAAK,KAAK,IAAI,aAAG,SAAI,eAAK,GAAG,CAAC,EAAE;AAAA,MACvD;AACA,UAAI,OAAO,MAAM,SAAS,GAAG;AAC3B,gBAAQ,IAAI;AAAA,IAAO,aAAG,aAAQ,OAAO,MAAM,SAAS,CAAC,cAAc,eAAK,EAAE;AAAA,MAC5E;AAAA,IACF;AAGA,QAAI,OAAO,kBAAkB,SAAS,GAAG;AACvC,cAAQ,IAAI;AAAA,IAAO,MAAM,qBAAqB,eAAK,KAAK,aAAG,IAAI,OAAO,kBAAkB,MAAM,4BAA4B,eAAK;AAAA,CAAI;AACnI,iBAAW,OAAO,OAAO,kBAAkB,MAAM,GAAG,EAAE,GAAG;AACvD,gBAAQ,IAAI,KAAK,aAAG,OAAI,eAAK,IAAI,GAAG,EAAE;AAAA,MACxC;AACA,UAAI,OAAO,kBAAkB,SAAS,IAAI;AACxC,gBAAQ,IAAI,KAAK,aAAG,aAAQ,OAAO,kBAAkB,SAAS,EAAE,QAAQ,eAAK,EAAE;AAAA,MACjF;AAAA,IACF;AAGA,QAAI,OAAO,YAAY,YAAY;AACjC,YAAM,SAAS,MAAM,SAAS,iBAAiB,mBAAmB;AAClE,UAAI,QAAQ;AACV,gBAAQ,IAAI;AAAA,IAAO,gBAAM,GAAG,cAAI,iBAAiB,eAAK;AAAA,CAAI;AAC1D,YAAI,OAAO,eAAe,SAAS,GAAG;AACpC,kBAAQ,IAAI,KAAK,aAAG,mBAAmB,eAAK,UAAU,OAAO,eAAe,KAAK,IAAI,CAAC,EAAE;AAAA,QAC1F;AACA,gBAAQ,IAAI,KAAK,aAAG,yBAAyB,eAAK,IAAI,cAAI,GAAG,OAAO,oBAAoB,MAAM,GAAG,eAAK,EAAE;AACxG,gBAAQ,IAAI,KAAK,aAAG,kBAAkB,eAAK,WAAW,cAAI,GAAG,OAAO,iBAAiB,GAAG,eAAK,EAAE;AAAA,MACjG;AAAA,IACF;AAEA,YAAQ,IAAI;AACZ,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/read.js

@@ -0,0 +1,100 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var read_exports = {};
+__export(read_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(read_exports);
+var path = __toESM(require("path"));
+var fs = __toESM(require("fs"));
+function register(program) {
+  program.command("read <path>").description("Read a file with caching and multiple modes").option("--no-cache", "Force fresh read, bypass cache").option("--mode <mode>", "Read mode: full, map, signatures, diff, lines, imports, exports", "full").option("--start <n>", "Start line (for lines mode)", parseInt).option("--end <n>", "End line (for lines mode)", parseInt).option("--json", "Output as JSON").action(async (filePath, opts) => {
+    const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(process.cwd(), filePath);
+    if (!fs.existsSync(resolvedPath)) {
+      console.error(`  Error: File not found: ${resolvedPath}`);
+      process.exit(1);
+    }
+    const { getFileReadCache } = await Promise.resolve().then(() => require("../../mcp/cache.js"));
+    const { executeReadMode } = await Promise.resolve().then(() => require("../../mcp/read-modes.js"));
+    const cache = getFileReadCache();
+    const mode = opts.mode;
+    const noCache = !opts.cache;
+    if (mode !== "full") {
+      let cg = null;
+      try {
+        const { findNearestKiroGraphRoot } = await Promise.resolve().then(() => require("../../index.js"));
+        const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+        const root = findNearestKiroGraphRoot(process.cwd());
+        if (root) {
+          cg = await KiroGraph.open(root);
+        }
+      } catch {
+      }
+      const result2 = executeReadMode({
+        mode,
+        filePath: resolvedPath,
+        start: opts.start,
+        end: opts.end,
+        cg
+      });
+      cache.read(resolvedPath, true);
+      if (opts.json) {
+        console.log(JSON.stringify({ mode: result2.mode, tokenEstimate: result2.tokenEstimate, content: result2.content }, null, 2));
+      } else {
+        console.log(result2.content);
+      }
+      if (cg) {
+        try {
+          cg.close();
+        } catch {
+        }
+      }
+      return;
+    }
+    const result = cache.read(resolvedPath, noCache);
+    if (opts.json) {
+      console.log(JSON.stringify({ cached: result.cached, changed: result.changed, content: result.content }, null, 2));
+      return;
+    }
+    if (result.cached) {
+      console.log(result.content);
+    } else if (result.changed) {
+      console.log(`[file changed since last read]
+`);
+      console.log(result.content);
+    } else {
+      console.log(result.content);
+    }
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=read.js.map

package/dist/bin/commands/read.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/read.ts"],
+  "sourcesContent": ["/**\n * kirograph read \u2014 File read with caching and multiple modes\n */\n\nimport { Command } from 'commander';\nimport * as path from 'path';\nimport * as fs from 'fs';\n\nexport function register(program: Command): void {\n  program\n    .command('read <path>')\n    .description('Read a file with caching and multiple modes')\n    .option('--no-cache', 'Force fresh read, bypass cache')\n    .option('--mode <mode>', 'Read mode: full, map, signatures, diff, lines, imports, exports', 'full')\n    .option('--start <n>', 'Start line (for lines mode)', parseInt)\n    .option('--end <n>', 'End line (for lines mode)', parseInt)\n    .option('--json', 'Output as JSON')\n    .action(async (filePath: string, opts: { cache: boolean; mode: string; start?: number; end?: number; json?: boolean }) => {\n      const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(process.cwd(), filePath);\n\n      if (!fs.existsSync(resolvedPath)) {\n        console.error(`  Error: File not found: ${resolvedPath}`);\n        process.exit(1);\n      }\n\n      const { getFileReadCache } = await Promise.resolve().then(() => require('../../mcp/cache.js'));\n      const { executeReadMode } = await Promise.resolve().then(() => require('../../mcp/read-modes.js'));\n      const cache = getFileReadCache();\n\n      const mode = opts.mode as any;\n      const noCache = !opts.cache;\n\n      if (mode !== 'full') {\n        // For non-full modes, try to get graph connection\n        let cg = null;\n        try {\n          const { findNearestKiroGraphRoot } = await Promise.resolve().then(() => require('../../index.js'));\n          const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n          const root = findNearestKiroGraphRoot(process.cwd());\n          if (root) {\n            cg = await KiroGraph.open(root);\n          }\n        } catch { /* no graph available */ }\n\n        const result = executeReadMode({\n          mode,\n          filePath: resolvedPath,\n          start: opts.start,\n          end: opts.end,\n          cg,\n        });\n\n        // Update cache for future diff mode\n        cache.read(resolvedPath, true);\n\n        if (opts.json) {\n          console.log(JSON.stringify({ mode: result.mode, tokenEstimate: result.tokenEstimate, content: result.content }, null, 2));\n        } else {\n          console.log(result.content);\n        }\n\n        if (cg) {\n          try { (cg as any).close(); } catch { /* ignore */ }\n        }\n        return;\n      }\n\n      // Full mode with caching\n      const result = cache.read(resolvedPath, noCache);\n\n      if (opts.json) {\n        console.log(JSON.stringify({ cached: result.cached, changed: result.changed, content: result.content }, null, 2));\n        return;\n      }\n\n      if (result.cached) {\n        console.log(result.content);\n      } else if (result.changed) {\n        console.log(`[file changed since last read]\\n`);\n        console.log(result.content);\n      } else {\n        console.log(result.content);\n      }\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,WAAsB;AACtB,SAAoB;AAEb,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,aAAa,EACrB,YAAY,6CAA6C,EACzD,OAAO,cAAc,gCAAgC,EACrD,OAAO,iBAAiB,mEAAmE,MAAM,EACjG,OAAO,eAAe,+BAA+B,QAAQ,EAC7D,OAAO,aAAa,6BAA6B,QAAQ,EACzD,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,UAAkB,SAAyF;AACxH,UAAM,eAAe,KAAK,WAAW,QAAQ,IAAI,WAAW,KAAK,QAAQ,QAAQ,IAAI,GAAG,QAAQ;AAEhG,QAAI,CAAC,GAAG,WAAW,YAAY,GAAG;AAChC,cAAQ,MAAM,4BAA4B,YAAY,EAAE;AACxD,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,EAAE,iBAAiB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,oBAAoB,CAAC;AAC7F,UAAM,EAAE,gBAAgB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,yBAAyB,CAAC;AACjG,UAAM,QAAQ,iBAAiB;AAE/B,UAAM,OAAO,KAAK;AAClB,UAAM,UAAU,CAAC,KAAK;AAEtB,QAAI,SAAS,QAAQ;AAEnB,UAAI,KAAK;AACT,UAAI;AACF,cAAM,EAAE,yBAAyB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC;AACjG,cAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,cAAM,OAAO,yBAAyB,QAAQ,IAAI,CAAC;AACnD,YAAI,MAAM;AACR,eAAK,MAAM,UAAU,KAAK,IAAI;AAAA,QAChC;AAAA,MACF,QAAQ;AAAA,MAA2B;AAEnC,YAAMA,UAAS,gBAAgB;AAAA,QAC7B;AAAA,QACA,UAAU;AAAA,QACV,OAAO,KAAK;AAAA,QACZ,KAAK,KAAK;AAAA,QACV;AAAA,MACF,CAAC;AAGD,YAAM,KAAK,cAAc,IAAI;AAE7B,UAAI,KAAK,MAAM;AACb,gBAAQ,IAAI,KAAK,UAAU,EAAE,MAAMA,QAAO,MAAM,eAAeA,QAAO,eAAe,SAASA,QAAO,QAAQ,GAAG,MAAM,CAAC,CAAC;AAAA,MAC1H,OAAO;AACL,gBAAQ,IAAIA,QAAO,OAAO;AAAA,MAC5B;AAEA,UAAI,IAAI;AACN,YAAI;AAAE,UAAC,GAAW,MAAM;AAAA,QAAG,QAAQ;AAAA,QAAe;AAAA,MACpD;AACA;AAAA,IACF;AAGA,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO;AAE/C,QAAI,KAAK,MAAM;AACb,cAAQ,IAAI,KAAK,UAAU,EAAE,QAAQ,OAAO,QAAQ,SAAS,OAAO,SAAS,SAAS,OAAO,QAAQ,GAAG,MAAM,CAAC,CAAC;AAChH;AAAA,IACF;AAEA,QAAI,OAAO,QAAQ;AACjB,cAAQ,IAAI,OAAO,OAAO;AAAA,IAC5B,WAAW,OAAO,SAAS;AACzB,cAAQ,IAAI;AAAA,CAAkC;AAC9C,cAAQ,IAAI,OAAO,OAAO;AAAA,IAC5B,OAAO;AACL,cAAQ,IAAI,OAAO,OAAO;AAAA,IAC5B;AAAA,EACF,CAAC;AACL;",
+  "names": ["result"]
+}

package/dist/bin/commands/refactor.js

@@ -0,0 +1,116 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var refactor_exports = {};
+__export(refactor_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(refactor_exports);
+var path = __toESM(require("path"));
+var import_ui = require("../ui");
+function register(program) {
+  const refactorCmd = program.command("refactor").description("Refactoring tools: rename preview and suggestions");
+  refactorCmd.command("rename <symbol> [projectPath]").description("Preview all locations that reference a symbol (rename preview)").option("--json", "Output as JSON").action(async (symbol, projectPath, opts) => {
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    const target = path.resolve(projectPath ?? process.cwd());
+    const cg = await KiroGraph.open(target);
+    const { renamePreview } = await Promise.resolve().then(() => require("../../graph/refactor.js"));
+    const db = cg.getDatabase();
+    const preview = renamePreview(db, symbol);
+    if (!preview) {
+      console.error(`  Symbol "${symbol}" not found in index.`);
+      cg.close();
+      process.exit(1);
+    }
+    if (opts.json) {
+      console.log(JSON.stringify(preview, null, 2));
+      cg.close();
+      return;
+    }
+    console.log(`
+  ${import_ui.bold}Rename Preview:${import_ui.reset} ${import_ui.violet}${preview.symbol}${import_ui.reset} (${preview.kind})`);
+    console.log(`  ${import_ui.dim}Defined at: ${preview.filePath}:${preview.line}${import_ui.reset}`);
+    console.log(`  ${import_ui.dim}Total references: ${preview.totalReferences}${import_ui.reset}
+`);
+    if (preview.references.length === 0) {
+      console.log(`  ${import_ui.green}\u2713${import_ui.reset} No references found \u2014 safe to rename without affecting other code.
+`);
+    } else {
+      const byFile = /* @__PURE__ */ new Map();
+      for (const ref of preview.references) {
+        if (!byFile.has(ref.filePath)) byFile.set(ref.filePath, []);
+        byFile.get(ref.filePath).push(ref);
+      }
+      for (const [file, refs] of byFile) {
+        console.log(`  ${import_ui.bold}${file}${import_ui.reset} (${refs.length})`);
+        for (const ref of refs.slice(0, 10)) {
+          console.log(`    ${import_ui.dim}line ${ref.line}:${import_ui.reset} ${ref.context} ${import_ui.dim}(${ref.edgeKind})${import_ui.reset}`);
+        }
+        if (refs.length > 10) console.log(`    ${import_ui.dim}\u2026and ${refs.length - 10} more${import_ui.reset}`);
+        console.log();
+      }
+    }
+    cg.close();
+  });
+  refactorCmd.command("suggest [projectPath]").description("Get community-driven refactoring suggestions").option("--limit <n>", "Max suggestions", "10").option("--json", "Output as JSON").action(async (projectPath, opts) => {
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    const target = path.resolve(projectPath ?? process.cwd());
+    const cg = await KiroGraph.open(target);
+    const { suggestRefactorings } = await Promise.resolve().then(() => require("../../graph/refactor.js"));
+    const db = cg.getDatabase();
+    const suggestions = suggestRefactorings(db, parseInt(opts.limit));
+    if (opts.json) {
+      console.log(JSON.stringify(suggestions, null, 2));
+      cg.close();
+      return;
+    }
+    if (suggestions.length === 0) {
+      console.log(`
+  ${import_ui.green}\u2713${import_ui.reset} No refactoring suggestions \u2014 the codebase structure looks clean.
+`);
+      cg.close();
+      return;
+    }
+    console.log(`
+  ${import_ui.bold}Refactoring Suggestions${import_ui.reset} (${suggestions.length})
+`);
+    for (const s of suggestions) {
+      const icon = s.priority === "high" ? "\u{1F534}" : s.priority === "medium" ? "\u{1F7E1}" : "\u{1F7E2}";
+      console.log(`  ${icon} ${import_ui.bold}${s.type}${import_ui.reset} [${s.priority}]`);
+      console.log(`     ${s.description}`);
+      console.log(`     ${import_ui.dim}${s.rationale}${import_ui.reset}`);
+      console.log();
+    }
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=refactor.js.map

package/dist/bin/commands/refactor.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/refactor.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { dim, reset, violet, bold, green } from '../ui';\n\nexport function register(program: Command): void {\n  const refactorCmd = program\n    .command('refactor')\n    .description('Refactoring tools: rename preview and suggestions');\n\n  refactorCmd\n    .command('rename <symbol> [projectPath]')\n    .description('Preview all locations that reference a symbol (rename preview)')\n    .option('--json', 'Output as JSON')\n    .action(async (symbol: string, projectPath: string | undefined, opts: { json?: boolean }) => {\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      const target = path.resolve(projectPath ?? process.cwd());\n      const cg = await KiroGraph.open(target);\n      const { renamePreview } = await Promise.resolve().then(() => require('../../graph/refactor.js'));\n      const db = cg.getDatabase();\n\n      const preview = renamePreview(db, symbol);\n\n      if (!preview) {\n        console.error(`  Symbol \"${symbol}\" not found in index.`);\n        cg.close();\n        process.exit(1);\n      }\n\n      if (opts.json) {\n        console.log(JSON.stringify(preview, null, 2));\n        cg.close();\n        return;\n      }\n\n      console.log(`\\n  ${bold}Rename Preview:${reset} ${violet}${preview.symbol}${reset} (${preview.kind})`);\n      console.log(`  ${dim}Defined at: ${preview.filePath}:${preview.line}${reset}`);\n      console.log(`  ${dim}Total references: ${preview.totalReferences}${reset}\\n`);\n\n      if (preview.references.length === 0) {\n        console.log(`  ${green}\u2713${reset} No references found \u2014 safe to rename without affecting other code.\\n`);\n      } else {\n        // Group by file\n        const byFile = new Map<string, typeof preview.references>();\n        for (const ref of preview.references) {\n          if (!byFile.has(ref.filePath)) byFile.set(ref.filePath, []);\n          byFile.get(ref.filePath)!.push(ref);\n        }\n\n        for (const [file, refs] of byFile) {\n          console.log(`  ${bold}${file}${reset} (${refs.length})`);\n          for (const ref of refs.slice(0, 10)) {\n            console.log(`    ${dim}line ${ref.line}:${reset} ${ref.context} ${dim}(${ref.edgeKind})${reset}`);\n          }\n          if (refs.length > 10) console.log(`    ${dim}\u2026and ${refs.length - 10} more${reset}`);\n          console.log();\n        }\n      }\n\n      cg.close();\n    });\n\n  refactorCmd\n    .command('suggest [projectPath]')\n    .description('Get community-driven refactoring suggestions')\n    .option('--limit <n>', 'Max suggestions', '10')\n    .option('--json', 'Output as JSON')\n    .action(async (projectPath: string | undefined, opts: { limit: string; json?: boolean }) => {\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      const target = path.resolve(projectPath ?? process.cwd());\n      const cg = await KiroGraph.open(target);\n      const { suggestRefactorings } = await Promise.resolve().then(() => require('../../graph/refactor.js'));\n      const db = cg.getDatabase();\n\n      const suggestions = suggestRefactorings(db, parseInt(opts.limit));\n\n      if (opts.json) {\n        console.log(JSON.stringify(suggestions, null, 2));\n        cg.close();\n        return;\n      }\n\n      if (suggestions.length === 0) {\n        console.log(`\\n  ${green}\u2713${reset} No refactoring suggestions \u2014 the codebase structure looks clean.\\n`);\n        cg.close();\n        return;\n      }\n\n      console.log(`\\n  ${bold}Refactoring Suggestions${reset} (${suggestions.length})\\n`);\n\n      for (const s of suggestions) {\n        const icon = s.priority === 'high' ? '\uD83D\uDD34' : s.priority === 'medium' ? '\uD83D\uDFE1' : '\uD83D\uDFE2';\n        console.log(`  ${icon} ${bold}${s.type}${reset} [${s.priority}]`);\n        console.log(`     ${s.description}`);\n        console.log(`     ${dim}${s.rationale}${reset}`);\n        console.log();\n      }\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,gBAAgD;AAEzC,SAAS,SAAS,SAAwB;AAC/C,QAAM,cAAc,QACjB,QAAQ,UAAU,EAClB,YAAY,mDAAmD;AAElE,cACG,QAAQ,+BAA+B,EACvC,YAAY,gEAAgE,EAC5E,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,QAAgB,aAAiC,SAA6B;AAC3F,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,EAAE,cAAc,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,yBAAyB,CAAC;AAC/F,UAAM,KAAK,GAAG,YAAY;AAE1B,UAAM,UAAU,cAAc,IAAI,MAAM;AAExC,QAAI,CAAC,SAAS;AACZ,cAAQ,MAAM,aAAa,MAAM,uBAAuB;AACxD,SAAG,MAAM;AACT,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,KAAK,MAAM;AACb,cAAQ,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAC5C,SAAG,MAAM;AACT;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,IAAI,gBAAM,GAAG,QAAQ,MAAM,GAAG,eAAK,KAAK,QAAQ,IAAI,GAAG;AACrG,YAAQ,IAAI,KAAK,aAAG,eAAe,QAAQ,QAAQ,IAAI,QAAQ,IAAI,GAAG,eAAK,EAAE;AAC7E,YAAQ,IAAI,KAAK,aAAG,qBAAqB,QAAQ,eAAe,GAAG,eAAK;AAAA,CAAI;AAE5E,QAAI,QAAQ,WAAW,WAAW,GAAG;AACnC,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK;AAAA,CAAuE;AAAA,IACxG,OAAO;AAEL,YAAM,SAAS,oBAAI,IAAuC;AAC1D,iBAAW,OAAO,QAAQ,YAAY;AACpC,YAAI,CAAC,OAAO,IAAI,IAAI,QAAQ,EAAG,QAAO,IAAI,IAAI,UAAU,CAAC,CAAC;AAC1D,eAAO,IAAI,IAAI,QAAQ,EAAG,KAAK,GAAG;AAAA,MACpC;AAEA,iBAAW,CAAC,MAAM,IAAI,KAAK,QAAQ;AACjC,gBAAQ,IAAI,KAAK,cAAI,GAAG,IAAI,GAAG,eAAK,KAAK,KAAK,MAAM,GAAG;AACvD,mBAAW,OAAO,KAAK,MAAM,GAAG,EAAE,GAAG;AACnC,kBAAQ,IAAI,OAAO,aAAG,QAAQ,IAAI,IAAI,IAAI,eAAK,IAAI,IAAI,OAAO,IAAI,aAAG,IAAI,IAAI,QAAQ,IAAI,eAAK,EAAE;AAAA,QAClG;AACA,YAAI,KAAK,SAAS,GAAI,SAAQ,IAAI,OAAO,aAAG,aAAQ,KAAK,SAAS,EAAE,QAAQ,eAAK,EAAE;AACnF,gBAAQ,IAAI;AAAA,MACd;AAAA,IACF;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AAEH,cACG,QAAQ,uBAAuB,EAC/B,YAAY,8CAA8C,EAC1D,OAAO,eAAe,mBAAmB,IAAI,EAC7C,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,aAAiC,SAA4C;AAC1F,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,EAAE,oBAAoB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,yBAAyB,CAAC;AACrG,UAAM,KAAK,GAAG,YAAY;AAE1B,UAAM,cAAc,oBAAoB,IAAI,SAAS,KAAK,KAAK,CAAC;AAEhE,QAAI,KAAK,MAAM;AACb,cAAQ,IAAI,KAAK,UAAU,aAAa,MAAM,CAAC,CAAC;AAChD,SAAG,MAAM;AACT;AAAA,IACF;AAEA,QAAI,YAAY,WAAW,GAAG;AAC5B,cAAQ,IAAI;AAAA,IAAO,eAAK,SAAI,eAAK;AAAA,CAAqE;AACtG,SAAG,MAAM;AACT;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,IAAO,cAAI,0BAA0B,eAAK,KAAK,YAAY,MAAM;AAAA,CAAK;AAElF,eAAW,KAAK,aAAa;AAC3B,YAAM,OAAO,EAAE,aAAa,SAAS,cAAO,EAAE,aAAa,WAAW,cAAO;AAC7E,cAAQ,IAAI,KAAK,IAAI,IAAI,cAAI,GAAG,EAAE,IAAI,GAAG,eAAK,KAAK,EAAE,QAAQ,GAAG;AAChE,cAAQ,IAAI,QAAQ,EAAE,WAAW,EAAE;AACnC,cAAQ,IAAI,QAAQ,aAAG,GAAG,EAAE,SAAS,GAAG,eAAK,EAAE;AAC/C,cAAQ,IAAI;AAAA,IACd;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/remediation.js

@@ -0,0 +1,133 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var remediation_exports = {};
+__export(remediation_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(remediation_exports);
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+const red = "\x1B[31m";
+const yellow = "\x1B[33m";
+function slaColor(status) {
+  switch (status) {
+    case "ok":
+      return import_ui.green;
+    case "warning":
+      return yellow;
+    case "overdue":
+      return red;
+    case "no_fix":
+      return import_ui.dim;
+    default:
+      return import_ui.dim;
+  }
+}
+function formatDate(epochMs) {
+  if (epochMs === null) return "n/a";
+  return new Date(epochMs).toISOString().slice(0, 10);
+}
+function register(program) {
+  program.command("remediation [projectPath]").description("Track remediation SLA: how long vulnerabilities have been open and whether fixes are overdue").option("--overdue-only", "Show only overdue items").option("--format <fmt>", "Output format: table | json (default: table)", "table").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${yellow}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const { RemediationTracker } = await Promise.resolve().then(() => require("../../security/remediation.js"));
+    const tracker = new RemediationTracker(db);
+    let statuses = tracker.getStatus();
+    const ORDER = { overdue: 3, warning: 2, no_fix: 1, ok: 0 };
+    statuses.sort((a, b) => {
+      const diff = (ORDER[b.slaStatus] ?? 0) - (ORDER[a.slaStatus] ?? 0);
+      if (diff !== 0) return diff;
+      return (b.daysOpen ?? 0) - (a.daysOpen ?? 0);
+    });
+    if (opts.overdueOnly) {
+      statuses = statuses.filter((s) => s.isOverdue);
+    }
+    if (opts.format === "json") {
+      console.log(JSON.stringify(statuses, null, 2));
+      cg.close();
+      return;
+    }
+    if (statuses.length === 0) {
+      const msg = opts.overdueOnly ? "No overdue vulnerabilities found." : "No tracked vulnerabilities with detection timestamps found.";
+      console.log(`
+  ${import_ui.dim}${msg}${import_ui.reset}`);
+      console.log(`  ${import_ui.dim}Detection timestamps are recorded when vulnerabilities are first inserted via${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph vulns --refresh${import_ui.reset}
+`);
+      cg.close();
+      return;
+    }
+    console.log(`
+  ${import_ui.violet}${import_ui.bold}Remediation SLA Tracking${import_ui.reset}
+`);
+    for (const s of statuses) {
+      const sevStr = s.severity !== null ? s.severity.toFixed(1) : "n/a";
+      const daysOpen = s.daysOpen !== null ? `${s.daysOpen}d` : "n/a";
+      const fixSince = s.fixAvailableSince !== null ? `${s.daysWithFixAvailable}d ago (${formatDate(s.fixAvailableSince)})` : "no fix";
+      const deadline = s.slaDeadline !== null ? formatDate(s.slaDeadline) : "n/a";
+      const color = slaColor(s.slaStatus);
+      console.log(`  ${import_ui.violet}${import_ui.bold}${s.cveId}${import_ui.reset}  ${import_ui.dim}${s.packageName}${import_ui.reset}`);
+      console.log(`    CVSS: ${import_ui.dim}${sevStr}${import_ui.reset}   Open: ${import_ui.dim}${daysOpen}${import_ui.reset}   Fix available: ${import_ui.dim}${fixSince}${import_ui.reset}`);
+      console.log(`    SLA status: ${color}${import_ui.bold}${s.slaStatus.toUpperCase()}${import_ui.reset}   Deadline: ${import_ui.dim}${deadline}${import_ui.reset}`);
+      console.log();
+    }
+    const overdueCount = statuses.filter((s) => s.slaStatus === "overdue").length;
+    const warningCount = statuses.filter((s) => s.slaStatus === "warning").length;
+    const noFixCount = statuses.filter((s) => s.slaStatus === "no_fix").length;
+    const parts = [];
+    if (overdueCount > 0) parts.push(`${red}${import_ui.bold}${overdueCount} overdue${import_ui.reset}`);
+    if (warningCount > 0) parts.push(`${yellow}${import_ui.bold}${warningCount} warning${import_ui.reset}`);
+    if (noFixCount > 0) parts.push(`${import_ui.dim}${noFixCount} no fix available${import_ui.reset}`);
+    console.log(`  ${import_ui.bold}${statuses.length}${import_ui.reset} open vulnerabilit${statuses.length === 1 ? "y" : "ies"}${parts.length > 0 ? `: ${parts.join(", ")}` : ""}
+`);
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=remediation.js.map

package/dist/bin/commands/remediation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/remediation.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\n\nconst red    = '\\x1b[31m';\nconst yellow = '\\x1b[33m';\n\nfunction slaColor(status: string): string {\n  switch (status) {\n    case 'ok':      return green;\n    case 'warning': return yellow;\n    case 'overdue': return red;\n    case 'no_fix':  return dim;\n    default:        return dim;\n  }\n}\n\nfunction formatDate(epochMs: number | null): string {\n  if (epochMs === null) return 'n/a';\n  return new Date(epochMs).toISOString().slice(0, 10);\n}\n\nexport function register(program: Command): void {\n  program\n    .command('remediation [projectPath]')\n    .description('Track remediation SLA: how long vulnerabilities have been open and whether fixes are overdue')\n    .option('--overdue-only', 'Show only overdue items')\n    .option('--format <fmt>', 'Output format: table | json (default: table)', 'table')\n    .action(async (projectPath: string | undefined, opts: {\n      overdueOnly?: boolean;\n      format: string;\n    }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${yellow}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { RemediationTracker } = await Promise.resolve().then(() => require('../../security/remediation.js'));\n      const tracker = new RemediationTracker(db);\n\n      let statuses = tracker.getStatus();\n\n      // Sort: overdue first, then warning, then by daysOpen desc\n      const ORDER: Record<string, number> = { overdue: 3, warning: 2, no_fix: 1, ok: 0 };\n      statuses.sort((a, b) => {\n        const diff = (ORDER[b.slaStatus] ?? 0) - (ORDER[a.slaStatus] ?? 0);\n        if (diff !== 0) return diff;\n        return (b.daysOpen ?? 0) - (a.daysOpen ?? 0);\n      });\n\n      if (opts.overdueOnly) {\n        statuses = statuses.filter(s => s.isOverdue);\n      }\n\n      if (opts.format === 'json') {\n        console.log(JSON.stringify(statuses, null, 2));\n        cg.close();\n        return;\n      }\n\n      if (statuses.length === 0) {\n        const msg = opts.overdueOnly\n          ? 'No overdue vulnerabilities found.'\n          : 'No tracked vulnerabilities with detection timestamps found.';\n        console.log(`\\n  ${dim}${msg}${reset}`);\n        console.log(`  ${dim}Detection timestamps are recorded when vulnerabilities are first inserted via${reset} ${violet}${bold}kirograph vulns --refresh${reset}\\n`);\n        cg.close();\n        return;\n      }\n\n      console.log(`\\n  ${violet}${bold}Remediation SLA Tracking${reset}\\n`);\n\n      for (const s of statuses) {\n        const sevStr   = s.severity !== null ? s.severity.toFixed(1) : 'n/a';\n        const daysOpen = s.daysOpen !== null ? `${s.daysOpen}d` : 'n/a';\n        const fixSince = s.fixAvailableSince !== null ? `${s.daysWithFixAvailable}d ago (${formatDate(s.fixAvailableSince)})` : 'no fix';\n        const deadline = s.slaDeadline !== null ? formatDate(s.slaDeadline) : 'n/a';\n        const color    = slaColor(s.slaStatus);\n\n        console.log(`  ${violet}${bold}${s.cveId}${reset}  ${dim}${s.packageName}${reset}`);\n        console.log(`    CVSS: ${dim}${sevStr}${reset}   Open: ${dim}${daysOpen}${reset}   Fix available: ${dim}${fixSince}${reset}`);\n        console.log(`    SLA status: ${color}${bold}${s.slaStatus.toUpperCase()}${reset}   Deadline: ${dim}${deadline}${reset}`);\n        console.log();\n      }\n\n      const overdueCount = statuses.filter(s => s.slaStatus === 'overdue').length;\n      const warningCount = statuses.filter(s => s.slaStatus === 'warning').length;\n      const noFixCount   = statuses.filter(s => s.slaStatus === 'no_fix').length;\n\n      const parts: string[] = [];\n      if (overdueCount > 0) parts.push(`${red}${bold}${overdueCount} overdue${reset}`);\n      if (warningCount > 0) parts.push(`${yellow}${bold}${warningCount} warning${reset}`);\n      if (noFixCount > 0)   parts.push(`${dim}${noFixCount} no fix available${reset}`);\n\n      console.log(`  ${bold}${statuses.length}${reset} open vulnerabilit${statuses.length === 1 ? 'y' : 'ies'}${parts.length > 0 ? `: ${parts.join(', ')}` : ''}\\n`);\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAEhD,MAAM,MAAS;AACf,MAAM,SAAS;AAEf,SAAS,SAAS,QAAwB;AACxC,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAW,aAAO;AAAA,IACvB;AAAgB,aAAO;AAAA,EACzB;AACF;AAEA,SAAS,WAAW,SAAgC;AAClD,MAAI,YAAY,KAAM,QAAO;AAC7B,SAAO,IAAI,KAAK,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpD;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,2BAA2B,EACnC,YAAY,8FAA8F,EAC1G,OAAO,kBAAkB,yBAAyB,EAClD,OAAO,kBAAkB,gDAAgD,OAAO,EAChF,OAAO,OAAO,aAAiC,SAG1C;AACJ,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,MAAM,wCAAmC,eAAK,EAAE;AACrE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,mBAAmB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,+BAA+B,CAAC;AAC1G,UAAM,UAAU,IAAI,mBAAmB,EAAE;AAEzC,QAAI,WAAW,QAAQ,UAAU;AAGjC,UAAM,QAAgC,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,IAAI,EAAE;AACjF,aAAS,KAAK,CAAC,GAAG,MAAM;AACtB,YAAM,QAAQ,MAAM,EAAE,SAAS,KAAK,MAAM,MAAM,EAAE,SAAS,KAAK;AAChE,UAAI,SAAS,EAAG,QAAO;AACvB,cAAQ,EAAE,YAAY,MAAM,EAAE,YAAY;AAAA,IAC5C,CAAC;AAED,QAAI,KAAK,aAAa;AACpB,iBAAW,SAAS,OAAO,OAAK,EAAE,SAAS;AAAA,IAC7C;AAEA,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,IAAI,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC7C,SAAG,MAAM;AACT;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,MAAM,KAAK,cACb,sCACA;AACJ,cAAQ,IAAI;AAAA,IAAO,aAAG,GAAG,GAAG,GAAG,eAAK,EAAE;AACtC,cAAQ,IAAI,KAAK,aAAG,gFAAgF,eAAK,IAAI,gBAAM,GAAG,cAAI,4BAA4B,eAAK;AAAA,CAAI;AAC/J,SAAG,MAAM;AACT;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,IAAO,gBAAM,GAAG,cAAI,2BAA2B,eAAK;AAAA,CAAI;AAEpE,eAAW,KAAK,UAAU;AACxB,YAAM,SAAW,EAAE,aAAa,OAAO,EAAE,SAAS,QAAQ,CAAC,IAAI;AAC/D,YAAM,WAAW,EAAE,aAAa,OAAO,GAAG,EAAE,QAAQ,MAAM;AAC1D,YAAM,WAAW,EAAE,sBAAsB,OAAO,GAAG,EAAE,oBAAoB,UAAU,WAAW,EAAE,iBAAiB,CAAC,MAAM;AACxH,YAAM,WAAW,EAAE,gBAAgB,OAAO,WAAW,EAAE,WAAW,IAAI;AACtE,YAAM,QAAW,SAAS,EAAE,SAAS;AAErC,cAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,GAAG,EAAE,KAAK,GAAG,eAAK,KAAK,aAAG,GAAG,EAAE,WAAW,GAAG,eAAK,EAAE;AAClF,cAAQ,IAAI,aAAa,aAAG,GAAG,MAAM,GAAG,eAAK,YAAY,aAAG,GAAG,QAAQ,GAAG,eAAK,qBAAqB,aAAG,GAAG,QAAQ,GAAG,eAAK,EAAE;AAC5H,cAAQ,IAAI,mBAAmB,KAAK,GAAG,cAAI,GAAG,EAAE,UAAU,YAAY,CAAC,GAAG,eAAK,gBAAgB,aAAG,GAAG,QAAQ,GAAG,eAAK,EAAE;AACvH,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,eAAe,SAAS,OAAO,OAAK,EAAE,cAAc,SAAS,EAAE;AACrE,UAAM,eAAe,SAAS,OAAO,OAAK,EAAE,cAAc,SAAS,EAAE;AACrE,UAAM,aAAe,SAAS,OAAO,OAAK,EAAE,cAAc,QAAQ,EAAE;AAEpE,UAAM,QAAkB,CAAC;AACzB,QAAI,eAAe,EAAG,OAAM,KAAK,GAAG,GAAG,GAAG,cAAI,GAAG,YAAY,WAAW,eAAK,EAAE;AAC/E,QAAI,eAAe,EAAG,OAAM,KAAK,GAAG,MAAM,GAAG,cAAI,GAAG,YAAY,WAAW,eAAK,EAAE;AAClF,QAAI,aAAa,EAAK,OAAM,KAAK,GAAG,aAAG,GAAG,UAAU,oBAAoB,eAAK,EAAE;AAE/E,YAAQ,IAAI,KAAK,cAAI,GAAG,SAAS,MAAM,GAAG,eAAK,qBAAqB,SAAS,WAAW,IAAI,MAAM,KAAK,GAAG,MAAM,SAAS,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE;AAAA,CAAI;AAE7J,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}