kirograph 0.19.0 → 0.20.1

package/dist/memory/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/memory/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,MAAM,CAAC;AACrG,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;CACpE;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAID,MAAM,WAAW,OAAO;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,cAAc,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,WAAW,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B"}

package/dist/memory/types.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/memory/types.ts"],
-  "sourcesContent": ["/**\n * KiroGraph Memory \u2014 Type definitions\n */\n\n// \u2500\u2500 Session \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface MemSession {\n  id: string;\n  ide?: string;\n  cwd?: string;\n  startedAt: number;\n  endedAt?: number;\n}\n\n// \u2500\u2500 Observation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport type ObservationKind = 'decision' | 'error' | 'pattern' | 'architecture' | 'summary' | 'note';\nexport type ObservationSource = 'hook' | 'manual' | 'agent';\n\nexport interface MemObservation {\n  id: string;\n  sessionId?: string;\n  content: string;\n  contentRaw?: string;\n  contentHash: string;\n  kind: ObservationKind;\n  source: ObservationSource;\n  tags?: string[];\n  createdAt: number;\n  /** Temporal validity: when this fact became valid (epoch ms). */\n  validFrom?: number;\n  /** Temporal validity: when this fact expires (epoch ms). Null = no expiry. */\n  validUntil?: number;\n  /** ID of the observation that supersedes this one. */\n  supersededBy?: string;\n  /** Fact type for temporal classification. */\n  factType?: 'observation' | 'decision' | 'procedure' | 'constraint';\n}\n\nexport interface MemObservationInput {\n  content: string;\n  kind?: ObservationKind;\n  source?: ObservationSource;\n  tags?: string[];\n}\n\n// \u2500\u2500 Links \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface MemLink {\n  observationId: string;\n  qualifiedName: string;\n  relevance: number;\n}\n\n// \u2500\u2500 Search \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface ScoredObservation {\n  observation: MemObservation;\n  score: number;\n  /** Source of the score: 'fts', 'vector', or 'hybrid' */\n  scoreSource: 'fts' | 'vector' | 'hybrid';\n}\n\nexport interface MemSearchOptions {\n  limit?: number;\n  kind?: ObservationKind;\n  sessionId?: string;\n  /** FTS/vector blend: 0 = FTS only, 1 = vector only, 0.5 = equal blend */\n  alpha?: number;\n  /** Query facts valid at this timestamp (epoch ms). Filters out expired/superseded observations. */\n  asOf?: number;\n}\n\nexport interface MemTimelineOptions {\n  limit?: number;\n  sessionId?: string;\n}\n\n// \u2500\u2500 Stats \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface MemStats {\n  sessions: number;\n  activeSessions: number;\n  observations: number;\n  links: number;\n  vectors: number;\n  embeddableCount: number;\n  modelMismatch: boolean;\n  currentModel?: string;\n}\n\n// \u2500\u2500 Compress \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface CompressResult {\n  compressed: string;\n  originalLength: number;\n  compressedLength: number;\n  detectedSymbols: string[];\n}\n"],
+  "sourcesContent": ["/**\n * KiroGraph Memory \u2014 Type definitions\n */\n\n// \u2500\u2500 Session \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface MemSession {\n  id: string;\n  ide?: string;\n  cwd?: string;\n  startedAt: number;\n  endedAt?: number;\n}\n\n// \u2500\u2500 Observation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport type ObservationKind = 'decision' | 'error' | 'pattern' | 'architecture' | 'summary' | 'note';\nexport type ObservationSource = 'hook' | 'manual' | 'agent';\n\nexport interface MemObservation {\n  id: string;\n  sessionId?: string;\n  content: string;\n  contentRaw?: string;\n  contentHash: string;\n  kind: ObservationKind;\n  source: ObservationSource;\n  tags?: string[];\n  createdAt: number;\n  /** Temporal validity: when this fact became valid (epoch ms). */\n  validFrom?: number;\n  /** Temporal validity: when this fact expires (epoch ms). Null = no expiry. */\n  validUntil?: number;\n  /** ID of the observation that supersedes this one. */\n  supersededBy?: string;\n  /** Fact type for temporal classification. */\n  factType?: 'observation' | 'decision' | 'procedure' | 'constraint';\n}\n\nexport interface MemObservationInput {\n  content: string;\n  kind?: ObservationKind;\n  source?: ObservationSource;\n  tags?: string[];\n}\n\n// \u2500\u2500 Links \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface MemLink {\n  observationId: string;\n  qualifiedName: string;\n  relevance: number;\n}\n\n// \u2500\u2500 Search \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface ScoredObservation {\n  observation: MemObservation;\n  score: number;\n  /** Source of the score: 'fts', 'vector', or 'hybrid' */\n  scoreSource: 'fts' | 'vector' | 'hybrid';\n}\n\nexport interface MemSearchOptions {\n  limit?: number;\n  kind?: ObservationKind;\n  sessionId?: string;\n  /** FTS/vector blend: 0 = FTS only, 1 = vector only, 0.5 = equal blend */\n  alpha?: number;\n  /** Query facts valid at this timestamp (epoch ms). Filters out expired/superseded observations. */\n  asOf?: number;\n}\n\nexport interface MemTimelineOptions {\n  limit?: number;\n  sessionId?: string;\n}\n\n// \u2500\u2500 Stats \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface MemStats {\n  sessions: number;\n  activeSessions: number;\n  observations: number;\n  links: number;\n  vectors: number;\n  embeddableCount: number;\n  modelMismatch: boolean;\n  currentModel?: string;\n}\n\n// \u2500\u2500 Watchmen \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface WatchmenReadyResult {\n  id: string;\n  watchmenReady: true;\n  pendingCount: number;\n  /** Synthesis instructions for the active agent. */\n  message: string;\n  /** Project-relative paths to write the workspace brief to. */\n  targetFiles: string[];\n  /**\n   * Present when Kiro is detected (.kiro/ exists). Path to the steering\n   * directory where individual skill files should be written as separate\n   * `inclusion: manual` files (e.g. `.kiro/steering/watchmen-<slug>.md`).\n   * Absent for all other tools \u2014 embed procedures in the brief instead.\n   */\n  skillTargetDir?: string;\n}\n\n// \u2500\u2500 Compress \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface CompressResult {\n  compressed: string;\n  originalLength: number;\n  compressedLength: number;\n  detectedSymbols: string[];\n}\n"],
   "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/memory/vectors.d.ts

@@ -0,0 +1,43 @@
+/**
+ * KiroGraph Memory — Vector embedding and search
+ *
+ * Reuses the same embedding model and semantic engine as the code graph,
+ * but operates on mem_vectors table independently.
+ */
+import type { KiroGraphConfig } from '../config';
+import type { MemObservation, ScoredObservation } from './types';
+import type { MemoryDatabase } from './database';
+export declare class MemoryVectorManager {
+    private config;
+    private memDb;
+    private modelName;
+    private cacheDir;
+    constructor(config: KiroGraphConfig, memDb: MemoryDatabase);
+    /**
+     * Check if embeddings are enabled in config.
+     */
+    isEnabled(): boolean;
+    /**
+     * Embed a single observation and store in mem_vectors.
+     */
+    embedObservation(obs: MemObservation): Promise<void>;
+    /**
+     * Embed multiple observations in batch.
+     */
+    embedBatch(observations: MemObservation[]): Promise<number>;
+    /**
+     * Vector search over memory observations.
+     * Falls back to empty results if embeddings are disabled or model mismatches.
+     */
+    search(query: string, limit?: number): Promise<ScoredObservation[]>;
+    /**
+     * Check if there are vectors with a mismatched model.
+     */
+    hasModelMismatch(): boolean;
+    /**
+     * Re-embed all observations with the current model.
+     */
+    reembed(batchSize?: number): Promise<number>;
+    private embed;
+}
+//# sourceMappingURL=vectors.d.ts.map

package/dist/memory/vectors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vectors.d.ts","sourceRoot":"","sources":["../../src/memory/vectors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAyDjD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAS;gBAEb,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc;IAU1D;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACG,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAe1D;;OAEG;IACG,UAAU,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAejE;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAuCrE;;OAEG;IACH,gBAAgB,IAAI,OAAO;IAI3B;;OAEG;IACG,OAAO,CAAC,SAAS,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC;YA8BhC,KAAK;CAUpB"}

package/dist/patterns/graph.d.ts

@@ -0,0 +1,16 @@
+/**
+ * KiroGraph Patterns — graph-level helpers for pattern match analysis.
+ */
+/**
+ * Find all symbol node IDs that have pattern matches, along with caller nodes.
+ * Useful for "who calls code with SQL injection patterns?"
+ */
+export declare function findCallersOfPatternMatches(rawDb: any, patternIdFilter?: string): Array<{
+    symbolNodeId: string;
+    symbolName: string;
+    filePath: string;
+    patternId: string;
+    callerNodeId: string;
+    callerName: string;
+}>;
+//# sourceMappingURL=graph.d.ts.map

package/dist/patterns/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/patterns/graph.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,GAAG,EACV,eAAe,CAAC,EAAE,MAAM,GACvB,KAAK,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBpI"}

package/dist/patterns/graph.js

@@ -0,0 +1,45 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var graph_exports = {};
+__export(graph_exports, {
+  findCallersOfPatternMatches: () => findCallersOfPatternMatches
+});
+module.exports = __toCommonJS(graph_exports);
+function findCallersOfPatternMatches(rawDb, patternIdFilter) {
+  const patternClause = patternIdFilter ? `AND pm.pattern_id LIKE ?` : "";
+  const params = patternIdFilter ? [`${patternIdFilter}%`] : [];
+  return rawDb.all(`
+    SELECT DISTINCT
+      pm.symbol_node_id, n.name as symbol_name, n.file_path,
+      pm.pattern_id,
+      e.source as caller_node_id, nc.name as caller_name
+    FROM pattern_matches pm
+    JOIN nodes n ON n.id = pm.symbol_node_id
+    JOIN edges e ON e.target = pm.symbol_node_id AND e.kind = 'calls'
+    JOIN nodes nc ON nc.id = e.source
+    WHERE pm.symbol_node_id IS NOT NULL
+    ${patternClause}
+    LIMIT 100
+  `, params);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  findCallersOfPatternMatches
+});
+//# sourceMappingURL=graph.js.map

package/dist/patterns/graph.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/patterns/graph.ts"],
+  "sourcesContent": ["/**\n * KiroGraph Patterns \u2014 graph-level helpers for pattern match analysis.\n */\n\n/**\n * Find all symbol node IDs that have pattern matches, along with caller nodes.\n * Useful for \"who calls code with SQL injection patterns?\"\n */\nexport function findCallersOfPatternMatches(\n  rawDb: any,\n  patternIdFilter?: string  // e.g. 'sql-injection' prefix match\n): Array<{ symbolNodeId: string; symbolName: string; filePath: string; patternId: string; callerNodeId: string; callerName: string }> {\n  const patternClause = patternIdFilter ? `AND pm.pattern_id LIKE ?` : '';\n  const params: any[] = patternIdFilter ? [`${patternIdFilter}%`] : [];\n\n  return rawDb.all(`\n    SELECT DISTINCT\n      pm.symbol_node_id, n.name as symbol_name, n.file_path,\n      pm.pattern_id,\n      e.source as caller_node_id, nc.name as caller_name\n    FROM pattern_matches pm\n    JOIN nodes n ON n.id = pm.symbol_node_id\n    JOIN edges e ON e.target = pm.symbol_node_id AND e.kind = 'calls'\n    JOIN nodes nc ON nc.id = e.source\n    WHERE pm.symbol_node_id IS NOT NULL\n    ${patternClause}\n    LIMIT 100\n  `, params);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQO,SAAS,4BACd,OACA,iBACoI;AACpI,QAAM,gBAAgB,kBAAkB,6BAA6B;AACrE,QAAM,SAAgB,kBAAkB,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAEnE,SAAO,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAUb,aAAa;AAAA;AAAA,KAEd,MAAM;AACX;",
+  "names": []
+}

package/dist/patterns/index.d.ts

@@ -0,0 +1,4 @@
+export { PatternRule, PatternMatch, SEVERITY_ORDER } from './types';
+export { PatternRunner } from './runner';
+export { PatternLibraryLoader } from './loader';
+//# sourceMappingURL=index.d.ts.map

package/dist/patterns/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/patterns/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC"}

package/dist/patterns/index.js

@@ -0,0 +1,39 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var patterns_exports = {};
+__export(patterns_exports, {
+  PatternLibraryLoader: () => import_loader.PatternLibraryLoader,
+  PatternMatch: () => import_types.PatternMatch,
+  PatternRule: () => import_types.PatternRule,
+  PatternRunner: () => import_runner.PatternRunner,
+  SEVERITY_ORDER: () => import_types.SEVERITY_ORDER
+});
+module.exports = __toCommonJS(patterns_exports);
+var import_types = require("./types");
+var import_runner = require("./runner");
+var import_loader = require("./loader");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PatternLibraryLoader,
+  PatternMatch,
+  PatternRule,
+  PatternRunner,
+  SEVERITY_ORDER
+});
+//# sourceMappingURL=index.js.map

package/dist/patterns/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/patterns/index.ts"],
+  "sourcesContent": ["export { PatternRule, PatternMatch, SEVERITY_ORDER } from './types';\nexport { PatternRunner } from './runner';\nexport { PatternLibraryLoader } from './loader';\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA0D;AAC1D,oBAA8B;AAC9B,oBAAqC;",
+  "names": []
+}

package/dist/patterns/indexer.d.ts

@@ -0,0 +1,15 @@
+/**
+ * KiroGraph PatternIndexer — indexes pattern matches into the patterns_matches table.
+ */
+import type { KiroGraphConfig } from '../config';
+import { PatternRunner } from './runner';
+import type { PatternRule } from './types';
+export declare class PatternIndexer {
+    private readonly rawDb;
+    private readonly config;
+    private readonly projectRoot;
+    constructor(rawDb: any, config: KiroGraphConfig, projectRoot: string);
+    indexAll(onProgress?: (phase: string, current: number, total: number) => void): Promise<void>;
+    indexFile(filePath: string, language: string, rules: PatternRule[], runner: PatternRunner, threshold: string, now: number): Promise<void>;
+}
+//# sourceMappingURL=indexer.d.ts.map

package/dist/patterns/indexer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexer.d.ts","sourceRoot":"","sources":["../../src/patterns/indexer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAG3C,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM;IAM9D,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B7F,SAAS,CACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,EAAE,EACpB,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC;CA8BjB"}

package/dist/patterns/indexer.js

@@ -0,0 +1,97 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var indexer_exports = {};
+__export(indexer_exports, {
+  PatternIndexer: () => PatternIndexer
+});
+module.exports = __toCommonJS(indexer_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_loader = require("./loader");
+var import_runner = require("./runner");
+var import_errors = require("../errors");
+class PatternIndexer {
+  constructor(rawDb, config, projectRoot) {
+    this.rawDb = rawDb;
+    this.config = config;
+    this.projectRoot = projectRoot;
+  }
+  async indexAll(onProgress) {
+    const runner = new import_runner.PatternRunner();
+    if (!runner.isAvailable()) {
+      (0, import_errors.logWarn)("[patterns] @ast-grep/napi not installed \u2014 skipping pattern indexing. Run: npm install @ast-grep/napi");
+      return;
+    }
+    const loader = new import_loader.PatternLibraryLoader();
+    const builtinPath = path.join(__dirname, "../patterns/library");
+    const customPath = this.config.patternLibraryPath;
+    const rules = loader.load(builtinPath, customPath);
+    const threshold = this.config.patternSeverityThreshold ?? "low";
+    const files = this.rawDb.all(
+      "SELECT path, language FROM files WHERE language != ? AND language != ?",
+      ["unknown", "jupyter"]
+    );
+    const now = Date.now();
+    let processed = 0;
+    for (const file of files) {
+      onProgress?.("patterns", processed, files.length);
+      await this.indexFile(file.path, file.language, rules, runner, threshold, now);
+      processed++;
+    }
+    onProgress?.("patterns", files.length, files.length);
+  }
+  async indexFile(filePath, language, rules, runner, threshold, now) {
+    let content;
+    const absPath = path.isAbsolute(filePath) ? filePath : path.join(this.projectRoot, filePath);
+    try {
+      content = fs.readFileSync(absPath, "utf8");
+    } catch {
+      return;
+    }
+    this.rawDb.run("DELETE FROM pattern_matches WHERE file_path = ?", [filePath]);
+    const matches = await runner.runAllRules(rules, content, language, threshold);
+    for (const m of matches) {
+      const symbolRow = this.rawDb.get(
+        `SELECT id FROM nodes WHERE file_path = ? AND start_line <= ? AND end_line >= ? AND kind IN ('function','method','class') ORDER BY (end_line - start_line) ASC LIMIT 1`,
+        [m.filePath || filePath, m.line, m.line]
+      );
+      const symbolNodeId = symbolRow?.id ?? null;
+      this.rawDb.run(
+        `INSERT INTO pattern_matches (file_path, pattern_id, line, col, match_text, severity, owasp_category, language, indexed_at, symbol_node_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        [filePath, m.patternId, m.line, m.col, m.matchText.slice(0, 500), m.severity, m.owaspCategory, language, now, symbolNodeId]
+      );
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PatternIndexer
+});
+//# sourceMappingURL=indexer.js.map

package/dist/patterns/indexer.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/patterns/indexer.ts"],
+  "sourcesContent": ["/**\n * KiroGraph PatternIndexer \u2014 indexes pattern matches into the patterns_matches table.\n */\n\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { KiroGraphConfig } from '../config';\nimport { PatternLibraryLoader } from './loader';\nimport { PatternRunner } from './runner';\nimport type { PatternRule } from './types';\nimport { logWarn } from '../errors';\n\nexport class PatternIndexer {\n  private readonly rawDb: any;\n  private readonly config: KiroGraphConfig;\n  private readonly projectRoot: string;\n\n  constructor(rawDb: any, config: KiroGraphConfig, projectRoot: string) {\n    this.rawDb = rawDb;\n    this.config = config;\n    this.projectRoot = projectRoot;\n  }\n\n  async indexAll(onProgress?: (phase: string, current: number, total: number) => void): Promise<void> {\n    const runner = new PatternRunner();\n    if (!runner.isAvailable()) {\n      logWarn('[patterns] @ast-grep/napi not installed \u2014 skipping pattern indexing. Run: npm install @ast-grep/napi');\n      return;\n    }\n\n    const loader = new PatternLibraryLoader();\n    const builtinPath = path.join(__dirname, '../patterns/library');\n    const customPath = (this.config as any).patternLibraryPath;\n    const rules = loader.load(builtinPath, customPath);\n    const threshold = (this.config as any).patternSeverityThreshold ?? 'low';\n\n    const files: Array<{ path: string; language: string }> = this.rawDb.all(\n      'SELECT path, language FROM files WHERE language != ? AND language != ?',\n      ['unknown', 'jupyter']\n    );\n\n    const now = Date.now();\n    let processed = 0;\n\n    for (const file of files) {\n      onProgress?.('patterns', processed, files.length);\n      await this.indexFile(file.path, file.language, rules, runner, threshold, now);\n      processed++;\n    }\n    onProgress?.('patterns', files.length, files.length);\n  }\n\n  async indexFile(\n    filePath: string,\n    language: string,\n    rules: PatternRule[],\n    runner: PatternRunner,\n    threshold: string,\n    now: number,\n  ): Promise<void> {\n    let content: string;\n    const absPath = path.isAbsolute(filePath)\n      ? filePath\n      : path.join(this.projectRoot, filePath);\n    try {\n      content = fs.readFileSync(absPath, 'utf8');\n    } catch {\n      return; // file deleted between index and now\n    }\n\n    // Delete existing matches for this file\n    this.rawDb.run('DELETE FROM pattern_matches WHERE file_path = ?', [filePath]);\n\n    const matches = await runner.runAllRules(rules, content, language, threshold as any);\n\n    for (const m of matches) {\n      const symbolRow = this.rawDb.get(\n        `SELECT id FROM nodes WHERE file_path = ? AND start_line <= ? AND end_line >= ? AND kind IN ('function','method','class') ORDER BY (end_line - start_line) ASC LIMIT 1`,\n        [m.filePath || filePath, m.line, m.line]\n      ) as { id: string } | undefined;\n      const symbolNodeId = symbolRow?.id ?? null;\n\n      this.rawDb.run(\n        `INSERT INTO pattern_matches (file_path, pattern_id, line, col, match_text, severity, owasp_category, language, indexed_at, symbol_node_id)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n        [filePath, m.patternId, m.line, m.col, m.matchText.slice(0, 500), m.severity, m.owaspCategory, language, now, symbolNodeId]\n      );\n    }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,SAAoB;AACpB,WAAsB;AAEtB,oBAAqC;AACrC,oBAA8B;AAE9B,oBAAwB;AAEjB,MAAM,eAAe;AAAA,EAK1B,YAAY,OAAY,QAAyB,aAAqB;AACpE,SAAK,QAAQ;AACb,SAAK,SAAS;AACd,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,SAAS,YAAqF;AAClG,UAAM,SAAS,IAAI,4BAAc;AACjC,QAAI,CAAC,OAAO,YAAY,GAAG;AACzB,iCAAQ,2GAAsG;AAC9G;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,mCAAqB;AACxC,UAAM,cAAc,KAAK,KAAK,WAAW,qBAAqB;AAC9D,UAAM,aAAc,KAAK,OAAe;AACxC,UAAM,QAAQ,OAAO,KAAK,aAAa,UAAU;AACjD,UAAM,YAAa,KAAK,OAAe,4BAA4B;AAEnE,UAAM,QAAmD,KAAK,MAAM;AAAA,MAClE;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,YAAY;AAEhB,eAAW,QAAQ,OAAO;AACxB,mBAAa,YAAY,WAAW,MAAM,MAAM;AAChD,YAAM,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,OAAO,QAAQ,WAAW,GAAG;AAC5E;AAAA,IACF;AACA,iBAAa,YAAY,MAAM,QAAQ,MAAM,MAAM;AAAA,EACrD;AAAA,EAEA,MAAM,UACJ,UACA,UACA,OACA,QACA,WACA,KACe;AACf,QAAI;AACJ,UAAM,UAAU,KAAK,WAAW,QAAQ,IACpC,WACA,KAAK,KAAK,KAAK,aAAa,QAAQ;AACxC,QAAI;AACF,gBAAU,GAAG,aAAa,SAAS,MAAM;AAAA,IAC3C,QAAQ;AACN;AAAA,IACF;AAGA,SAAK,MAAM,IAAI,mDAAmD,CAAC,QAAQ,CAAC;AAE5E,UAAM,UAAU,MAAM,OAAO,YAAY,OAAO,SAAS,UAAU,SAAgB;AAEnF,eAAW,KAAK,SAAS;AACvB,YAAM,YAAY,KAAK,MAAM;AAAA,QAC3B;AAAA,QACA,CAAC,EAAE,YAAY,UAAU,EAAE,MAAM,EAAE,IAAI;AAAA,MACzC;AACA,YAAM,eAAe,WAAW,MAAM;AAEtC,WAAK,MAAM;AAAA,QACT;AAAA;AAAA,QAEA,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,MAAM,GAAG,GAAG,GAAG,EAAE,UAAU,EAAE,eAAe,UAAU,KAAK,YAAY;AAAA,MAC5H;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/patterns/library/code-eval-elixir.yaml

@@ -0,0 +1,11 @@
+id: code-eval-elixir
+language: elixir
+severity: critical
+owaspCategory: A03
+description: Code.eval_string() executes arbitrary Elixir code — code injection vector
+fixHint: Remove Code.eval_string/eval_quoted; use pattern matching or a restricted DSL instead. Never evaluate user-controlled strings.
+rule:
+  kind: call
+  has:
+    kind: dot
+    regex: '^Code\.eval_string'

package/dist/patterns/library/command-injection-c.yaml

@@ -0,0 +1,11 @@
+id: command-injection-c
+language: [c, cpp]
+severity: critical
+owaspCategory: A03
+description: system() or popen() with a variable argument — command injection vector
+fixHint: Avoid system()/popen(); use execv/execvp with an array of fixed arguments. Validate all inputs.
+rule:
+  kind: call_expression
+  has:
+    kind: identifier
+    regex: '^(system|popen)$'

package/dist/patterns/library/command-injection-go.yaml

@@ -0,0 +1,29 @@
+id: command-injection-go
+language: go
+severity: critical
+owaspCategory: A03
+description: exec.Command() with string concatenation — command injection vector
+fixHint: Use exec.Command() with separate arguments (never shell=true). Validate all inputs.
+rule:
+  any:
+    - kind: call_expression
+      all:
+        - has:
+            kind: selector_expression
+            regex: '^exec\.Command$'
+        - has:
+            kind: argument_list
+            has:
+              kind: binary_expression
+    - kind: call_expression
+      all:
+        - has:
+            kind: selector_expression
+            regex: '^exec\.Command$'
+        - has:
+            kind: argument_list
+            has:
+              kind: call_expression
+              has:
+                kind: selector_expression
+                regex: '^fmt\.Sprintf$'

package/dist/patterns/library/command-injection-kotlin.yaml

@@ -0,0 +1,10 @@
+id: command-injection-kotlin
+language: kotlin
+severity: critical
+owaspCategory: A03
+description: Runtime.exec() or ProcessBuilder — command injection vector if arguments are user-controlled
+fixHint: Pass a fixed executable and a validated argument array. Never build command strings from user input.
+rule:
+  any:
+    - pattern: Runtime.getRuntime().exec($CMD)
+    - pattern: ProcessBuilder($CMD).start()

package/dist/patterns/library/command-injection-php.yaml

@@ -0,0 +1,11 @@
+id: command-injection-php
+language: php
+severity: critical
+owaspCategory: A03
+description: system()/exec()/shell_exec()/passthru() — command injection vector
+fixHint: Use escapeshellarg() on every argument, or replace with a native PHP library that avoids shell invocation entirely.
+rule:
+  kind: function_call_expression
+  has:
+    kind: name
+    regex: '^(system|exec|shell_exec|passthru|popen|proc_open)$'

package/dist/patterns/library/command-injection-ruby.yaml

@@ -0,0 +1,11 @@
+id: command-injection-ruby
+language: ruby
+severity: critical
+owaspCategory: A03
+description: system()/exec()/spawn() with variable argument — command injection vector
+fixHint: Pass an array of fixed arguments to system/exec to disable shell interpretation. Validate all user input.
+rule:
+  kind: call
+  has:
+    kind: identifier
+    regex: '^(system|exec|spawn)$'

package/dist/patterns/library/command-injection-rust.yaml

@@ -0,0 +1,11 @@
+id: command-injection-rust
+language: rust
+severity: critical
+owaspCategory: A03
+description: std::process::Command built with a variable argument — command injection vector
+fixHint: Pass a fixed executable path and validate each argument individually. Never construct commands from user input.
+rule:
+  kind: call_expression
+  has:
+    kind: scoped_identifier
+    regex: 'Command::new'

package/dist/patterns/library/dangerous-eval-bash.yaml

@@ -0,0 +1,11 @@
+id: dangerous-eval-bash
+language: bash
+severity: critical
+owaspCategory: A03
+description: eval command executes arbitrary shell code — command injection vector
+fixHint: Remove eval; use explicit variable assignments and function calls. Never evaluate user-controlled strings.
+rule:
+  kind: command
+  has:
+    kind: command_name
+    regex: '^eval$'

package/dist/patterns/library/dangerous-eval-js.yaml

@@ -0,0 +1,14 @@
+id: dangerous-eval-js
+language: [javascript, typescript]
+severity: critical
+owaspCategory: A03
+description: eval() with a non-literal argument enables arbitrary code execution
+fixHint: Remove eval(). Use JSON.parse() for data, structured dispatch for dynamic behavior.
+# Only safe if $ARG is JSON data; for dynamic dispatch use a lookup table instead
+fix: "JSON.parse($ARG)"
+rule:
+  pattern: eval($ARG)
+  not:
+    has:
+      kind: string
+      nthChild: 1

package/dist/patterns/library/dangerous-eval-php.yaml

@@ -0,0 +1,11 @@
+id: dangerous-eval-php
+language: php
+severity: critical
+owaspCategory: A03
+description: eval() executes arbitrary PHP code — code injection vector
+fixHint: Remove eval(); parse data with json_decode() or use explicit logic. Never evaluate user-supplied strings.
+rule:
+  kind: function_call_expression
+  has:
+    kind: name
+    regex: '^eval$'

package/dist/patterns/library/dangerous-eval-ruby.yaml

@@ -0,0 +1,11 @@
+id: dangerous-eval-ruby
+language: ruby
+severity: critical
+owaspCategory: A03
+description: eval() executes arbitrary Ruby code — code injection vector
+fixHint: Remove eval(); use a safe parser (e.g. JSON.parse, Integer()) or explicit case/when logic instead.
+rule:
+  kind: call
+  has:
+    kind: identifier
+    regex: '^eval$'

package/dist/patterns/library/dangerous-exec-py.yaml

@@ -0,0 +1,13 @@
+id: dangerous-exec-py
+language: python
+severity: critical
+owaspCategory: A03
+description: os.system() or subprocess with shell=True enables command injection
+fixHint: Use subprocess.run() with a list of arguments and shell=False. Validate all inputs.
+fix: "subprocess.run([$CMD], shell=False, check=True)"
+rule:
+  any:
+    - pattern: os.system($CMD)
+    - pattern: subprocess.call($CMD, shell=True)
+    - pattern: subprocess.run($CMD, shell=True)
+    - pattern: subprocess.Popen($CMD, shell=True)

package/dist/patterns/library/dangerous-reflection-java.yaml

@@ -0,0 +1,8 @@
+id: dangerous-reflection-java
+language: java
+severity: high
+owaspCategory: A03
+description: Class.forName() with user-controlled input enables arbitrary class loading
+fixHint: Validate the class name against an allowlist before using reflection. Never use user input directly.
+rule:
+  pattern: Class.forName($CLASS)

package/dist/patterns/library/dynamic-load-lua.yaml

@@ -0,0 +1,10 @@
+id: dynamic-load-lua
+language: lua
+severity: critical
+owaspCategory: A03
+description: load()/loadstring() executes arbitrary Lua code — code injection vector
+fixHint: Remove dynamic code loading; use explicit functions or a restricted sandbox. Never evaluate user-controlled strings.
+rule:
+  any:
+    - pattern: load($CODE)()
+    - pattern: loadstring($CODE)()

package/dist/patterns/library/os-cmd-elixir.yaml

@@ -0,0 +1,16 @@
+id: os-cmd-elixir
+language: elixir
+severity: critical
+owaspCategory: A03
+description: ':os.cmd() or System.cmd() with a variable argument — command injection vector'
+fixHint: "Use System.cmd/2 with a fixed executable and a list of validated arguments. Never interpolate user input into shell strings."
+rule:
+  any:
+    - kind: call
+      has:
+        kind: dot
+        regex: '^:os\.cmd'
+    - kind: call
+      has:
+        kind: dot
+        regex: '^System\.cmd'

package/dist/patterns/library/os-execute-lua.yaml

@@ -0,0 +1,10 @@
+id: os-execute-lua
+language: lua
+severity: critical
+owaspCategory: A03
+description: os.execute() or io.popen() with a variable argument — command injection vector
+fixHint: Avoid shell execution; use Lua native I/O functions. If unavoidable, validate and escape all arguments.
+rule:
+  any:
+    - pattern: os.execute($CMD)
+    - pattern: io.popen($CMD)

package/dist/patterns/library/path-traversal-go.yaml

@@ -0,0 +1,11 @@
+id: path-traversal-go
+language: go
+severity: high
+owaspCategory: A01
+description: os.Open() or ioutil.ReadFile() with user-controlled path — path traversal vector
+fixHint: Use filepath.Clean() and verify the result is within an allowed base directory.
+rule:
+  kind: call_expression
+  has:
+    kind: selector_expression
+    regex: '^(os\.Open|ioutil\.ReadFile|os\.ReadFile)$'

package/dist/patterns/library/path-traversal-py.yaml

@@ -0,0 +1,12 @@
+id: path-traversal-py
+language: python
+severity: high
+owaspCategory: A01
+description: File open with path from request or user input — path traversal vector
+fixHint: Use os.path.realpath() and verify the result is under an allowed base directory.
+fix: "open(os.path.join(allowed_base, os.path.basename(request.$PROP)))"
+rule:
+  any:
+    - pattern: open(request.$PROP)
+    - pattern: open(request.args[$KEY])
+    - pattern: open(request.form[$KEY])

package/dist/patterns/library/path-traversal-readfile-js.yaml

@@ -0,0 +1,14 @@
+id: path-traversal-readfile-js
+language: [javascript, typescript]
+severity: high
+owaspCategory: A01
+description: File operation with path from request parameter — path traversal vector
+fixHint: Use path.resolve() and verify the result starts with an allowed base directory. Reject paths containing '..'.
+fix: "/* validate path: use path.resolve() and check it starts with allowedBase */"
+rule:
+  any:
+    - pattern: fs.readFile(req.$PROP, $$$)
+    - pattern: fs.readFileSync(req.$PROP, $$$)
+    - pattern: fs.createReadStream(req.$PROP, $$$)
+    - pattern: fs.open(req.$PROP, $$$)
+    - pattern: fs.openSync(req.$PROP, $$$)

package/dist/patterns/library/process-launch-swift.yaml

@@ -0,0 +1,11 @@
+id: process-launch-swift
+language: swift
+severity: critical
+owaspCategory: A03
+description: Process.launch() — command injection vector if launchPath or arguments are user-controlled
+fixHint: Validate executableURL and all arguments against an allowlist before calling run(). Never set launchPath from user input.
+rule:
+  kind: call_expression
+  has:
+    kind: navigation_expression
+    regex: '\.launch$'