kirograph 0.19.0 → 0.20.1

package/dist/bin/commands/pattern.js

@@ -0,0 +1,592 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pattern_exports = {};
+__export(pattern_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(pattern_exports);
+var path = __toESM(require("path"));
+var fs = __toESM(require("fs"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+const OWASP_CATEGORIES = {
+  A01: "Broken Access Control",
+  A02: "Cryptographic Failures",
+  A03: "Injection",
+  A04: "Insecure Design",
+  A05: "Security Misconfiguration",
+  A06: "Vulnerable Components",
+  A07: "Auth Failures",
+  A08: "Integrity Failures",
+  A09: "Logging Failures",
+  A10: "SSRF"
+};
+const SEVERITY_LEVELS = ["critical", "high", "medium", "low"];
+const SEVERITY_ORDER = {
+  critical: 3,
+  high: 2,
+  medium: 1,
+  low: 0
+};
+function severityColor(severity) {
+  if (severity === "critical") return "\x1B[31m";
+  if (severity === "high") return "\x1B[31m";
+  if (severity === "medium") return "\x1B[33m";
+  return import_ui.dim;
+}
+function resolveLibraryPath() {
+  const devPath = path.join(__dirname, "../../patterns/library");
+  if (fs.existsSync(devPath)) return devPath;
+  const distPath = path.join(__dirname, "../patterns/library");
+  if (fs.existsSync(distPath)) return distPath;
+  return devPath;
+}
+function register(program) {
+  program.command("pattern [pattern] [projectPath]").description("AST structural search: live pattern search or library rule runner").option("--lang <language>", "Filter to a specific language (js, ts, python, go, rust, java, ...)").option("--severity <level>", "Filter: critical, high, medium, low").option("--format <fmt>", "Output format: text|json (default: text)", "text").option("--list", "Show all library rules (no @ast-grep/napi required)").option("--library <id>", "Run a specific library rule by ID").option("--fix", "Apply the rule's fix template to matched files (requires --library <id>)").option("--coverage", "Show OWASP Top 10 coverage report").option("--save-baseline [label]", "Save current pattern_matches as a baseline for diffing").option("--diff [label]", "Diff current pattern_matches against a saved baseline").action(async (patternArg, projectPathArg, opts) => {
+    const target = path.resolve(projectPathArg ?? process.cwd());
+    if (opts.list) {
+      const { PatternLibraryLoader } = await Promise.resolve().then(() => require("../../patterns/loader.js"));
+      const loader = new PatternLibraryLoader();
+      const config2 = await (0, import_config.loadConfig)(target).catch(() => null);
+      const libraryPath = resolveLibraryPath();
+      const customPath = config2?.patternLibraryPath;
+      const rules = loader.load(libraryPath, customPath);
+      if (opts.format === "json") {
+        process.stdout.write(JSON.stringify(rules, null, 2) + "\n");
+        return;
+      }
+      if (rules.length === 0) {
+        console.log(`
+  ${import_ui.dim}No pattern rules found.${import_ui.reset}
+`);
+        return;
+      }
+      console.log(`
+  ${(0, import_ui.section)("Pattern Library")} (${rules.length} rules)
+`);
+      const maxSev = Math.max(...rules.map((r) => r.severity.length), 8);
+      const maxOWASP = Math.max(...rules.map((r) => r.owaspCategory.length), 5);
+      const maxId = Math.max(...rules.map((r) => r.id.length), 10);
+      for (const rule of rules) {
+        const sc = severityColor(rule.severity);
+        const sev = rule.severity.padEnd(maxSev);
+        const owasp = rule.owaspCategory.padEnd(maxOWASP);
+        const id = rule.id.padEnd(maxId);
+        console.log(`  ${sc}${sev}${import_ui.reset}  ${import_ui.dim}${owasp}${import_ui.reset}  ${import_ui.violet}${import_ui.bold}${id}${import_ui.reset}  ${import_ui.dim}${rule.description}${import_ui.reset}`);
+      }
+      console.log();
+      return;
+    }
+    if (opts.coverage) {
+      const { PatternLibraryLoader } = await Promise.resolve().then(() => require("../../patterns/loader.js"));
+      const loader = new PatternLibraryLoader();
+      const cfgCov = await (0, import_config.loadConfig)(target).catch(() => null);
+      const libraryPath = resolveLibraryPath();
+      const customPath = cfgCov?.patternLibraryPath;
+      const rules = loader.load(libraryPath, customPath);
+      const ruleCounts = {};
+      for (const cat of Object.keys(OWASP_CATEGORIES)) ruleCounts[cat] = 0;
+      for (const rule of rules) {
+        const cat = rule.owaspCategory.trim().split(/[\s-]/)[0].toUpperCase();
+        if (cat in ruleCounts) ruleCounts[cat]++;
+      }
+      let dbData = null;
+      const KiroGraphCov = (await Promise.resolve().then(() => require("../../index.js"))).default;
+      if (cfgCov?.enablePatterns && KiroGraphCov.isInitialized(target)) {
+        try {
+          const cg2 = await KiroGraphCov.open(target);
+          const rawDb2 = cg2.getDatabase().getRawDb();
+          const tableExists = rawDb2.get(
+            "SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'"
+          );
+          if (tableExists) {
+            const rows = rawDb2.all(
+              `SELECT owasp_category, COUNT(*) as matches, COUNT(DISTINCT file_path) as files
+                 FROM pattern_matches
+                 GROUP BY owasp_category`
+            );
+            dbData = {};
+            for (const row of rows) {
+              const cat = row.owasp_category.trim().split(/[\s-]/)[0].toUpperCase();
+              if (cat) dbData[cat] = { matches: row.matches, files: row.files };
+            }
+          }
+          cg2.close();
+        } catch {
+        }
+      }
+      if (opts.format === "json") {
+        const categories = {};
+        for (const cat of Object.keys(OWASP_CATEGORIES)) {
+          categories[cat] = {
+            rules: ruleCounts[cat] ?? 0,
+            matches: dbData ? dbData[cat]?.matches ?? 0 : null,
+            files: dbData ? dbData[cat]?.files ?? 0 : null
+          };
+        }
+        const covered2 = Object.values(categories).filter((c) => c.rules > 0).length;
+        process.stdout.write(JSON.stringify({ categories, covered: covered2, total: 10 }, null, 2) + "\n");
+        return;
+      }
+      const BAR_WIDTH = 10;
+      const sorted = Object.keys(OWASP_CATEGORIES).sort((a, b) => (ruleCounts[b] ?? 0) - (ruleCounts[a] ?? 0));
+      const maxNameLen = Math.max(...Object.values(OWASP_CATEGORIES).map((n) => n.length));
+      const isInitialized = KiroGraphCov.isInitialized(target);
+      const hasEnablePatterns = !!cfgCov?.enablePatterns;
+      let coverageSubtitle;
+      if (!isInitialized || !hasEnablePatterns) {
+        coverageSubtitle = `  ${import_ui.dim}(rules only \u2014 no match data)${import_ui.reset}`;
+      } else if (!dbData) {
+        coverageSubtitle = `  ${import_ui.dim}(no match data yet \u2014 run kirograph index)${import_ui.reset}`;
+      } else {
+        coverageSubtitle = "";
+      }
+      console.log(`
+  ${(0, import_ui.section)("OWASP Top 10 Coverage")}${coverageSubtitle}`);
+      if (!isInitialized || !hasEnablePatterns) {
+        console.log(`  ${import_ui.dim}Run kirograph index with enablePatterns: true to see actual findings.${import_ui.reset}`);
+      }
+      console.log();
+      for (const cat of sorted) {
+        const name = OWASP_CATEGORIES[cat];
+        const count = ruleCounts[cat] ?? 0;
+        const filledBars = Math.min(count, BAR_WIDTH);
+        const bar = count > 0 ? `${import_ui.violet}${"\u2588".repeat(filledBars)}${import_ui.dim}${"\u2591".repeat(BAR_WIDTH - filledBars)}${import_ui.reset}` : `${import_ui.dim}${"\u2591".repeat(BAR_WIDTH)}${import_ui.reset}`;
+        const catLabel = count > 0 ? `${import_ui.violet}${import_ui.bold}${cat}${import_ui.reset}` : `\x1B[31m${cat}${import_ui.reset}`;
+        const nameStr = name.padEnd(maxNameLen);
+        const ruleStr = count === 1 ? "1 rule " : `${count} rules`;
+        const ruleLabel = count > 0 ? `${import_ui.violet}${import_ui.bold}${ruleStr}${import_ui.reset}` : `${import_ui.dim}${ruleStr}${import_ui.reset}`;
+        if (count === 0) {
+          console.log(`  ${catLabel}  ${import_ui.dim}${nameStr}${import_ui.reset}  ${bar}  ${import_ui.dim}${ruleStr}  \xB7   \u2014 no coverage${import_ui.reset}`);
+        } else if (dbData) {
+          const m = dbData[cat]?.matches ?? 0;
+          const f = dbData[cat]?.files ?? 0;
+          console.log(`  ${catLabel}  ${import_ui.dim}${nameStr}${import_ui.reset}  ${bar}  ${ruleLabel}  \xB7  ${import_ui.violet}${m} match${m !== 1 ? "es" : ""}${import_ui.reset}  ${import_ui.dim}\xB7  ${f} file${f !== 1 ? "s" : ""}${import_ui.reset}`);
+        } else {
+          console.log(`  ${catLabel}  ${import_ui.dim}${nameStr}${import_ui.reset}  ${bar}  ${ruleLabel}`);
+        }
+      }
+      const covered = Object.values(ruleCounts).filter((n) => n > 0).length;
+      console.log();
+      console.log(`  ${import_ui.dim}Coverage: ${import_ui.reset}${import_ui.violet}${import_ui.bold}${covered}/10${import_ui.reset}${import_ui.dim} OWASP categories have at least one rule.${import_ui.reset}`);
+      if (covered < 10) {
+        console.log(`  ${import_ui.dim}Add custom rules via patternLibraryPath to improve coverage.${import_ui.reset}`);
+      }
+      console.log();
+      return;
+    }
+    if (opts.saveBaseline !== void 0) {
+      const KiroGraphSB = (await Promise.resolve().then(() => require("../../index.js"))).default;
+      if (!KiroGraphSB.isInitialized(target)) {
+        console.error(`
+  \x1B[31m\u2716 KiroGraph not initialized. Run: kirograph init${import_ui.reset}
+`);
+        process.exit(1);
+      }
+      const configSB = await (0, import_config.loadConfig)(target).catch(() => null);
+      if (!configSB?.enablePatterns) {
+        console.error(`
+  \x1B[33m\u26A0 kirograph pattern --save-baseline requires enablePatterns: true.${import_ui.reset}`);
+        console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enablePatterns": true${import_ui.reset}`);
+        console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+        process.exit(1);
+      }
+      const sbLabel = typeof opts.saveBaseline === "string" && opts.saveBaseline ? opts.saveBaseline : "default";
+      const cg2 = await KiroGraphSB.open(target);
+      const rawDb2 = cg2.getDatabase().getRawDb();
+      const tableExists = rawDb2.get(
+        "SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'"
+      );
+      if (!tableExists) {
+        cg2.close();
+        console.error(`
+  \x1B[31m\u2716 pattern_matches table not found. Run: kirograph index with enablePatterns: true${import_ui.reset}
+`);
+        process.exit(1);
+      }
+      const rows = rawDb2.all(
+        "SELECT pattern_id, COUNT(*) as cnt FROM pattern_matches GROUP BY pattern_id"
+      );
+      const counts = {};
+      let totalMatches = 0;
+      for (const row of rows) {
+        counts[row.pattern_id] = row.cnt;
+        totalMatches += row.cnt;
+      }
+      cg2.close();
+      const kirographDir = path.join(target, ".kirograph");
+      const baselineFile = path.join(kirographDir, `pattern-baseline-${sbLabel}.json`);
+      const data = { savedAt: (/* @__PURE__ */ new Date()).toISOString(), counts, totalMatches };
+      fs.writeFileSync(baselineFile, JSON.stringify(data, null, 2), "utf8");
+      console.log(`
+  \x1B[32m\u2713${import_ui.reset} Baseline saved: ${import_ui.violet}${import_ui.bold}${sbLabel}${import_ui.reset}`);
+      console.log(`  ${import_ui.dim}${totalMatches} total matches across ${Object.keys(counts).length} patterns${import_ui.reset}`);
+      console.log(`  ${import_ui.dim}Saved to: ${baselineFile}${import_ui.reset}
+`);
+      return;
+    }
+    if (opts.diff !== void 0) {
+      const KiroGraphDiff = (await Promise.resolve().then(() => require("../../index.js"))).default;
+      if (!KiroGraphDiff.isInitialized(target)) {
+        console.error(`
+  \x1B[31m\u2716 KiroGraph not initialized. Run: kirograph init${import_ui.reset}
+`);
+        process.exit(1);
+      }
+      const configDiff = await (0, import_config.loadConfig)(target).catch(() => null);
+      if (!configDiff?.enablePatterns) {
+        console.error(`
+  \x1B[33m\u26A0 kirograph pattern --diff requires enablePatterns: true.${import_ui.reset}`);
+        console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enablePatterns": true${import_ui.reset}`);
+        console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+        process.exit(1);
+      }
+      const diffLabel = typeof opts.diff === "string" && opts.diff ? opts.diff : "default";
+      const kirographDir = path.join(target, ".kirograph");
+      const baselineFile = path.join(kirographDir, `pattern-baseline-${diffLabel}.json`);
+      if (!fs.existsSync(baselineFile)) {
+        const saveCmd = diffLabel !== "default" ? `kirograph pattern --save-baseline ${diffLabel}` : "kirograph pattern --save-baseline";
+        console.log(`
+  ${import_ui.dim}No baseline found. Run: ${import_ui.reset}${import_ui.violet}${import_ui.bold}${saveCmd}${import_ui.reset}
+`);
+        process.exit(0);
+      }
+      const baseline = JSON.parse(fs.readFileSync(baselineFile, "utf8"));
+      const cg2 = await KiroGraphDiff.open(target);
+      const rawDb2 = cg2.getDatabase().getRawDb();
+      const tableExists = rawDb2.get(
+        "SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'"
+      );
+      const currentRows = tableExists ? rawDb2.all("SELECT pattern_id, COUNT(*) as cnt FROM pattern_matches GROUP BY pattern_id") : [];
+      cg2.close();
+      const current = {};
+      for (const row of currentRows) current[row.pattern_id] = row.cnt;
+      const allKeys = /* @__PURE__ */ new Set([...Object.keys(baseline.counts), ...Object.keys(current)]);
+      const newFindings = [];
+      const resolved = [];
+      const unchanged = [];
+      for (const id of allKeys) {
+        const base = baseline.counts[id] ?? 0;
+        const curr = current[id] ?? 0;
+        const delta = curr - base;
+        if (delta > 0) newFindings.push({ id, baseCount: base, currCount: curr, delta });
+        else if (delta < 0) resolved.push({ id, baseCount: base, currCount: curr, delta });
+        else if (curr > 0) unchanged.push({ id, baseCount: base, currCount: curr, delta });
+      }
+      newFindings.sort((a, b) => b.delta - a.delta);
+      resolved.sort((a, b) => a.delta - b.delta);
+      const savedDate = baseline.savedAt.slice(0, 10);
+      const netDelta = newFindings.reduce((s, e) => s + e.delta, 0) + resolved.reduce((s, e) => s + e.delta, 0);
+      if (opts.format === "json") {
+        process.stdout.write(JSON.stringify({
+          baseline: { label: diffLabel, savedAt: baseline.savedAt, totalMatches: baseline.totalMatches },
+          new: newFindings.map((e) => ({ id: e.id, delta: e.delta, current: e.currCount })),
+          resolved: resolved.map((e) => ({ id: e.id, delta: e.delta, current: e.currCount })),
+          unchanged: unchanged.map((e) => ({ id: e.id, count: e.currCount })),
+          netDelta
+        }, null, 2) + "\n");
+        return;
+      }
+      const allEntries = [...newFindings, ...resolved, ...unchanged];
+      const maxIdLen = allEntries.length > 0 ? Math.max(...allEntries.map((e) => e.id.length), 20) : 20;
+      console.log(`
+  ${(0, import_ui.section)("Pattern Diff")} ${import_ui.dim}vs ${diffLabel} baseline (saved ${savedDate})${import_ui.reset}
+`);
+      if (newFindings.length > 0) {
+        console.log(`  \x1B[31m\u2716 NEW${import_ui.reset} ${import_ui.dim}(${newFindings.length} new finding${newFindings.length !== 1 ? "s" : ""})${import_ui.reset}`);
+        for (const e of newFindings) {
+          const idPad = e.id.padEnd(maxIdLen);
+          console.log(`    ${import_ui.violet}${import_ui.bold}${idPad}${import_ui.reset}  \x1B[31m+${e.delta} new match${e.delta !== 1 ? "es" : ""}${import_ui.reset}`);
+        }
+        console.log();
+      }
+      if (resolved.length > 0) {
+        console.log(`  \x1B[32m\u2713 RESOLVED${import_ui.reset} ${import_ui.dim}(${resolved.length} resolved)${import_ui.reset}`);
+        for (const e of resolved) {
+          const idPad = e.id.padEnd(maxIdLen);
+          console.log(`    ${import_ui.dim}${idPad}${import_ui.reset}  \x1B[32m${e.delta} match${Math.abs(e.delta) !== 1 ? "es" : ""}${import_ui.reset}`);
+        }
+        console.log();
+      }
+      if (unchanged.length > 0) {
+        console.log(`  ${import_ui.dim}= UNCHANGED${import_ui.reset}`);
+        for (const e of unchanged) {
+          const idPad = e.id.padEnd(maxIdLen);
+          console.log(`    ${import_ui.dim}${idPad}  ${e.currCount} match${e.currCount !== 1 ? "es" : ""} (no change)${import_ui.reset}`);
+        }
+        console.log();
+      }
+      if (allEntries.length === 0) {
+        console.log(`  ${import_ui.dim}No pattern matches found in either baseline or current index.${import_ui.reset}
+`);
+        return;
+      }
+      const netLabel = netDelta > 0 ? `\x1B[31m+${netDelta}${import_ui.reset}` : netDelta < 0 ? `\x1B[32m${netDelta}${import_ui.reset}` : `${import_ui.dim}0${import_ui.reset}`;
+      console.log(`  ${import_ui.dim}Net:${import_ui.reset} ${netLabel}${import_ui.dim} findings since baseline${import_ui.reset}
+`);
+      return;
+    }
+    if (opts.fix && !opts.library) {
+      console.error(`  ${"\x1B[31m"}\u2716 --fix requires --library <id>. Inline patterns do not support automatic fixes.${import_ui.reset}`);
+      process.exit(1);
+    }
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enablePatterns) {
+      console.error(`
+  ${"\x1B[31m"}\u2716 kirograph pattern requires enablePatterns: true in .kirograph/config.json${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it:${import_ui.reset}  ${import_ui.violet}${import_ui.bold}"enablePatterns": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then install:${import_ui.reset} ${import_ui.violet}${import_ui.bold}npm install @ast-grep/napi${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-index:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(2);
+    }
+    const { PatternRunner } = await Promise.resolve().then(() => require("../../patterns/runner.js"));
+    const runner = new PatternRunner();
+    if (!runner.isAvailable()) {
+      console.error(`
+  ${"\x1B[31m"}\u2716 kirograph pattern requires @ast-grep/napi${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Install it with:${import_ui.reset} ${import_ui.violet}${import_ui.bold}npm install @ast-grep/napi${import_ui.reset}
+`);
+      process.exit(2);
+    }
+    if (!opts.library && patternArg) {
+      const { PatternLibraryLoader: AutoLoader } = await Promise.resolve().then(() => require("../../patterns/loader.js"));
+      const autoRules = new AutoLoader().load(resolveLibraryPath(), config.patternLibraryPath);
+      if (autoRules.some((r) => r.id === patternArg)) {
+        console.log(`  ${import_ui.dim}Tip: '${patternArg}' is a library rule. Running as --library ${patternArg}${import_ui.reset}`);
+        opts.library = patternArg;
+        patternArg = void 0;
+      }
+    }
+    if (opts.library) {
+      if (!require("../../index").default.isInitialized(target)) {
+        console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+        process.exit(1);
+      }
+      const KiroGraph2 = (await Promise.resolve().then(() => require("../../index.js"))).default;
+      const cg2 = await KiroGraph2.open(target);
+      const db2 = cg2.getDatabase();
+      const rawDb2 = db2.getRawDb();
+      const { PatternLibraryLoader } = await Promise.resolve().then(() => require("../../patterns/loader.js"));
+      const loader = new PatternLibraryLoader();
+      const libraryPath = resolveLibraryPath();
+      const customPath = config.patternLibraryPath;
+      const rules = loader.load(libraryPath, customPath);
+      const rule = rules.find((r) => r.id === opts.library);
+      if (!rule) {
+        console.error(`  \u2716 Rule "${opts.library}" not found. Run: kirograph pattern --list`);
+        cg2.close();
+        process.exitCode = 1;
+        return;
+      }
+      const langs = Array.isArray(rule.language) ? rule.language : [rule.language];
+      const placeholders = langs.map(() => "?").join(", ");
+      const files2 = rawDb2.all(
+        `SELECT path, language FROM files WHERE language IN (${placeholders}) LIMIT 5000`,
+        langs
+      );
+      const allMatches2 = [];
+      if (opts.fix) {
+        const { PatternRunner: FixPatternRunner } = await Promise.resolve().then(() => require("../../patterns/runner.js"));
+        const fixRunner = new FixPatternRunner();
+        if (!fixRunner.isAvailable()) {
+          console.error(`  \x1B[31m\u2716 --fix requires @ast-grep/napi. Run: npm install @ast-grep/napi${import_ui.reset}`);
+          cg2.close?.();
+          process.exitCode = 2;
+          return;
+        }
+        if (!rule.fix) {
+          console.error(`  ${"\x1B[31m"}\u2716 Rule "${rule.id}" does not have a fix: template defined.${import_ui.reset}`);
+          cg2.close();
+          process.exitCode = 1;
+          return;
+        }
+        let fixedFiles = 0;
+        let totalChanges = 0;
+        for (const file of files2) {
+          let content;
+          const fullPath = path.isAbsolute(file.path) ? file.path : path.join(target, file.path);
+          try {
+            content = fs.readFileSync(fullPath, "utf8");
+          } catch {
+            continue;
+          }
+          const matchesBefore = await fixRunner.runRule(rule, content, file.language);
+          if (matchesBefore.length === 0) continue;
+          const fixed = await fixRunner.applyFix(fullPath, content, file.language, rule);
+          if (fixed !== null && fixed !== content) {
+            fs.writeFileSync(fullPath, fixed, "utf8");
+            const relPath = path.relative(target, fullPath);
+            console.log(`  \x1B[32m\u2713 Fixed\x1B[0m ${relPath} (${matchesBefore.length} change${matchesBefore.length !== 1 ? "s" : ""})`);
+            fixedFiles++;
+            totalChanges += matchesBefore.length;
+          }
+        }
+        cg2.close();
+        console.log(`
+  Fixed ${fixedFiles} file${fixedFiles !== 1 ? "s" : ""}, ${totalChanges} total change${totalChanges !== 1 ? "s" : ""}
+`);
+        process.exitCode = 0;
+        return;
+      }
+      for (const file of files2) {
+        let content;
+        try {
+          const fullPath = path.isAbsolute(file.path) ? file.path : path.join(target, file.path);
+          content = fs.readFileSync(fullPath, "utf8");
+        } catch {
+          continue;
+        }
+        const matches = await runner.runRule(rule, content, file.language);
+        for (const m of matches) {
+          allMatches2.push({ filePath: file.path, line: m.line, matchText: m.matchText, context: m.context });
+        }
+      }
+      cg2.close();
+      const sev = opts.severity;
+      if (sev && SEVERITY_LEVELS.includes(sev)) {
+        if (SEVERITY_ORDER[rule.severity] < SEVERITY_ORDER[sev]) {
+          if (opts.format === "json") {
+            process.stdout.write(JSON.stringify([], null, 2) + "\n");
+          } else {
+            console.log(`
+  ${import_ui.dim}No matches (rule severity "${rule.severity}" is below filter "${sev}").${import_ui.reset}
+`);
+          }
+          process.exitCode = 0;
+          return;
+        }
+      }
+      if (opts.format === "json") {
+        process.stdout.write(JSON.stringify(allMatches2.map((m) => ({
+          filePath: m.filePath,
+          line: m.line,
+          matchText: m.matchText,
+          rule: { id: rule.id, severity: rule.severity, owaspCategory: rule.owaspCategory, description: rule.description, fixHint: rule.fixHint }
+        })), null, 2) + "\n");
+        process.exitCode = allMatches2.length > 0 ? 1 : 0;
+        return;
+      }
+      if (allMatches2.length === 0) {
+        console.log(`
+  ${import_ui.dim}No matches for library rule '${rule.id}'.${import_ui.reset}
+`);
+        process.exitCode = 0;
+        return;
+      }
+      const sc = severityColor(rule.severity);
+      console.log(`
+  ${(0, import_ui.section)(rule.description)}`);
+      console.log(`  ${import_ui.dim}Rule:${import_ui.reset} ${import_ui.violet}${import_ui.bold}${rule.id}${import_ui.reset}  ${sc}${rule.severity}${import_ui.reset}  ${import_ui.dim}[${rule.owaspCategory}]${import_ui.reset}`);
+      console.log(`  ${import_ui.dim}Fix:${import_ui.reset} ${rule.fixHint}`);
+      console.log(`
+  ${allMatches2.length} match${allMatches2.length !== 1 ? "es" : ""}
+`);
+      for (const m of allMatches2) {
+        const relPath = path.relative(target, path.isAbsolute(m.filePath) ? m.filePath : path.join(target, m.filePath));
+        console.log(`  ${import_ui.violet}${import_ui.bold}${relPath}:${m.line}${import_ui.reset}`);
+        console.log(`    ${import_ui.dim}${m.matchText}${import_ui.reset}`);
+        console.log(`    ${"\u2500".repeat(17)}`);
+      }
+      console.log();
+      process.exitCode = 1;
+      return;
+    }
+    if (!patternArg) {
+      console.error("  \u2716 Provide a pattern to search, or use --list / --library <id>");
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    const rawDb = db.getRawDb();
+    let files;
+    if (opts.lang) {
+      files = rawDb.all(
+        "SELECT path, language FROM files WHERE language = ? LIMIT 5000",
+        [opts.lang]
+      );
+    } else {
+      files = rawDb.all("SELECT path, language FROM files LIMIT 5000");
+    }
+    const allMatches = [];
+    for (const file of files) {
+      let content;
+      try {
+        const fullPath = path.isAbsolute(file.path) ? file.path : path.join(target, file.path);
+        content = fs.readFileSync(fullPath, "utf8");
+      } catch {
+        continue;
+      }
+      const matches = await runner.runInline(patternArg, file.language, content);
+      for (const m of matches) {
+        allMatches.push({ filePath: file.path, line: m.line, matchText: m.matchText, context: m.context, language: file.language });
+      }
+    }
+    cg.close();
+    if (opts.format === "json") {
+      process.stdout.write(JSON.stringify(allMatches.map((m) => ({
+        filePath: m.filePath,
+        line: m.line,
+        matchText: m.matchText,
+        language: m.language
+      })), null, 2) + "\n");
+      process.exitCode = allMatches.length > 0 ? 1 : 0;
+      return;
+    }
+    const langLabel = opts.lang ? ` in ${opts.lang} files` : "";
+    console.log(`
+  ${allMatches.length} match${allMatches.length !== 1 ? "es" : ""} for ${import_ui.violet}${import_ui.bold}'${patternArg}'${import_ui.reset}${langLabel}
+`);
+    if (allMatches.length === 0) {
+      process.exitCode = 0;
+      return;
+    }
+    for (const m of allMatches) {
+      const relPath = path.relative(target, path.isAbsolute(m.filePath) ? m.filePath : path.join(target, m.filePath));
+      console.log(`  ${import_ui.violet}${import_ui.bold}${relPath}:${m.line}${import_ui.reset}`);
+      console.log(`    ${import_ui.dim}${m.matchText}${import_ui.reset}`);
+      console.log(`    ${"\u2500".repeat(17)}`);
+    }
+    console.log();
+    process.exitCode = 1;
+    return;
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=pattern.js.map