slopbrick 0.21.2 → 0.25.0

package/dist/engine/worker.js

@@ -7,7 +7,8 @@ var __export = (target, all) => {
 // src/engine/worker.ts
 import { isMainThread, parentPort, workerData } from "worker_threads";
 import { extname as extname4 } from "path";
-import { join as join11 } from "path";
+import { join as join11, relative as relative2, sep } from "path";
+import { minimatch } from "minimatch";
 
 // ../engine/dist/index.js
 import { readFile, writeFile, mkdir, access } from "fs/promises";
@@ -4335,6 +4336,7 @@ function parseSource(source, filePath) {
     case "py":
     case "go":
     case "rs":
+    case "java":
       return parseBlankModule(source);
     default:
       return parseWithSwc(source, filePath);
@@ -34376,6 +34378,232 @@ var importPathMismatchRule = createRule({
   }
 });
 
+// src/rules/cpp/c-style-cast.ts
+var C_STYLE_CAST_REGEX = /\(\s*(?:int|long|short|char|float|double|bool|unsigned\s+\w+|signed\s+\w+|size_t|[A-Za-z_]\w*(?:\s*[*,&][^)]*)?)\s*\)\s*(\w+|[^a-zA-Z_])/g;
+var NAMED_CAST_PREFIX_REGEX = /\b(?:static|reinterpret|const|dynamic)_cast\s*<[^>]*>\s*\($/;
+var cppCStyleCastRule = createRule({
+  id: "cpp/c-style-cast",
+  category: "typo",
+  severity: "low",
+  aiSpecific: true,
+  description: "C-style cast `(int)x` \u2014 use static_cast / reinterpret_cast / const_cast so the kind is greppable.",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+    let m;
+    C_STYLE_CAST_REGEX.lastIndex = 0;
+    while ((m = C_STYLE_CAST_REGEX.exec(source)) !== null) {
+      const innerMatch = /\(\s*([^)]+?)\s*\)/.exec(m[0]) ?? [];
+      const inner = (innerMatch[1] ?? "").trim();
+      const looksLikeCast = /\b(?:int|long|short|char|float|double|bool|unsigned|signed|size_t)\b/.test(inner) || /[*&]/.test(inner);
+      if (!looksLikeCast) continue;
+      const before = source.slice(Math.max(0, m.index - 40), m.index);
+      if (NAMED_CAST_PREFIX_REGEX.test(before)) continue;
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "cpp/c-style-cast",
+        category: "typo",
+        severity: "low",
+        aiSpecific: true,
+        message: `C-style cast at line ${line} \u2014 use static_cast / reinterpret_cast / const_cast`,
+        line,
+        column: 1,
+        advice: "Use the named cast that matches the intent: `static_cast<int>(x)`, `reinterpret_cast<MyClass*>(p)`, `const_cast<...>(ref)`, or `dynamic_cast<Derived*>(base)` for runtime-checked downcasts. C-style casts silently pick whichever the compiler needs \u2014 `static_cast`, `reinterpret_cast`, OR `const_cast` \u2014 which makes them impossible to grep for and impossible to review. The C++ Core Guidelines (ES.49) call this out by name. AI agents reach for `(int)x` because of training-data C textbooks. Reference: cpp/c-style-cast v0.24."
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/cpp/magic-numbers.ts
+var MAGIC_NUMBER_REGEX = /\b(\d+(?:\.\d+)?)\b/g;
+var COMPARE_OR_RETURN_REGEX = /\b(?:if|while|return|for)\s*[\(\s]?[^;]*[<>=!][^;]*/;
+var cppMagicNumbersRule = createRule({
+  id: "cpp/magic-numbers",
+  category: "typo",
+  severity: "low",
+  aiSpecific: true,
+  description: "Magic-number literal in a comparison / return \u2014 name it: `constexpr int MAX = 1024;`.",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+    const lines = source.split("\n");
+    const allowSet = /* @__PURE__ */ new Set([
+      "1024",
+      "65535",
+      "65536",
+      "86400",
+      "3600",
+      "1000",
+      "100.0",
+      "60",
+      "24",
+      "7",
+      "365",
+      "256",
+      "255",
+      "0",
+      "1",
+      "2",
+      "3",
+      "4",
+      "5"
+    ]);
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i] ?? "";
+      if (!COMPARE_OR_RETURN_REGEX.test(line)) continue;
+      let m;
+      MAGIC_NUMBER_REGEX.lastIndex = 0;
+      while ((m = MAGIC_NUMBER_REGEX.exec(line)) !== null) {
+        const literal = m[0] ?? "";
+        if (allowSet.has(literal)) continue;
+        if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(line.slice(0, m.index).trimEnd())) continue;
+        const prevLine = i > 0 ? lines[i - 1] ?? "" : "";
+        if (/\b(?:constexpr|const)\s+\w+\s*=\s*$/.test(prevLine.trim())) continue;
+        issues.push({
+          ruleId: "cpp/magic-numbers",
+          category: "typo",
+          severity: "low",
+          aiSpecific: true,
+          message: `magic number ${literal} at line ${i + 1} \u2014 name it: constexpr int MAX = ${literal};`,
+          line: i + 1,
+          column: 1,
+          advice: 'Replace the bare literal with a named constant declared as `constexpr int MAX_SIZE = 1024;` (or `static constexpr`). The named constant lives next to its value, can be searched, and forces the reader to mean what they say. Magic numbers in comparisons hide intent ("7" against what?). AI agents produce magic-number-heavy code because their training-data examples rarely bother to name the constant. Reference: cpp/magic-numbers v0.24.'
+        });
+      }
+    }
+    return issues;
+  }
+});
+
+// src/rules/cpp/printf-debug.ts
+var PRINTF_FAMILY_REGEX = /\b(?:printf|fprintf|sprintf|snprintf)\s*\(/g;
+var COUT_LITERAL_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*"[^"]*"/g;
+var STD_COUT_BARE_REGEX = /std\s*::\s*(?:cout|cerr|clog)\s*<<\s*'[^']*'/g;
+var THRESHOLD_DEFAULT = 1;
+var cppPrintfDebugRule = createRule({
+  id: "cpp/printf-debug",
+  category: "typo",
+  severity: "low",
+  aiSpecific: true,
+  description: "printf family or std::cout debug printing \u2014 use spdlog / glog / AbslLog for level-controlled output.",
+  create(_context) {
+    return { threshold: THRESHOLD_DEFAULT };
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+    const printfCount = (source.match(PRINTF_FAMILY_REGEX) ?? []).length;
+    let viaPrintf = false;
+    if (printfCount > context.threshold) {
+      const line = source.indexOf("printf");
+      if (line !== -1) viaPrintf = true;
+    }
+    const coutHit = COUT_LITERAL_REGEX.test(source) || STD_COUT_BARE_REGEX.test(source);
+    if (!viaPrintf && !coutHit) return issues;
+    issues.push({
+      ruleId: "cpp/printf-debug",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      message: viaPrintf ? `${printfCount} printf-family calls \u2014 use spdlog / glog / AbslLog` : "std::cout/cerr/clog with a string literal \u2014 use spdlog / glog / AbslLog",
+      line: 1,
+      column: 1,
+      advice: "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...` (Abseil). All of these are level-aware and have a configurable sink, and they route to stderr by default. `printf` / `std::cout` have no levels, no redaction, no sink routing, and can't be silenced in release builds. AI agents reach for these because their training data has countless C++ textbook examples with them. Reference: cpp/printf-debug v0.24."
+    });
+    return issues;
+  }
+});
+
+// src/rules/cpp/raw-new-delete.ts
+var NEW_TYPE_REGEX = /\bnew\s+[A-Za-z_]\w*\s*\(/g;
+var DELETE_REGEX = /\bdelete\s+/g;
+var MIN_PAIRS_DEFAULT = 1;
+var cppRawNewDeleteRule = createRule({
+  id: "cpp/raw-new-delete",
+  category: "typo",
+  severity: "low",
+  aiSpecific: true,
+  description: "Manual `new` / `delete` pairing \u2014 use std::make_unique / std::unique_ptr instead.",
+  create(_context) {
+    return { minPairs: MIN_PAIRS_DEFAULT };
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+    let newCount = 0;
+    let m;
+    NEW_TYPE_REGEX.lastIndex = 0;
+    while ((m = NEW_TYPE_REGEX.exec(source)) !== null) newCount++;
+    let deleteCount = 0;
+    DELETE_REGEX.lastIndex = 0;
+    while ((m = DELETE_REGEX.exec(source)) !== null) deleteCount++;
+    if (newCount <= context.minPairs) return issues;
+    if (deleteCount <= context.minPairs) return issues;
+    issues.push({
+      ruleId: "cpp/raw-new-delete",
+      category: "typo",
+      severity: "low",
+      aiSpecific: true,
+      message: `manual new/delete pairing (${newCount} new, ${deleteCount} delete) \u2014 wrap in std::unique_ptr`,
+      line: 1,
+      column: 1,
+      advice: "Replace `T* p = new T(...); ... delete p;` with `auto p = std::make_unique<T>(...);`. Smart pointers delete on scope exit, never leak on early return / exception, never double-free on copy. The C++ Core Guidelines R.20-R.23 call out raw `new` / `delete` as something to avoid in application code. AI agents reach for `new` / `delete` because their training data was written for pre-C++11 idioms. Reference: cpp/raw-new-delete v0.24."
+    });
+    return issues;
+  }
+});
+
+// src/rules/cpp/using-namespace-std.ts
+var USING_NAMESPACE_STD_REGEX = /\busing\s+namespace\s+std\s*;/g;
+var cppUsingNamespaceStdRule = createRule({
+  id: "cpp/using-namespace-std",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: true,
+  description: "`using namespace std;` in a header \u2014 pollutes every consumer. Use `using std::foo;` or qualify names.",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.(cpp|cc|cxx|h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+    if (!/\.(h|hpp|hh|hxx|H)$/i.test(facts.filePath)) return issues;
+    let m;
+    USING_NAMESPACE_STD_REGEX.lastIndex = 0;
+    while ((m = USING_NAMESPACE_STD_REGEX.exec(source)) !== null) {
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "cpp/using-namespace-std",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: true,
+        message: `using namespace std; at line ${line} \u2014 pollutes every consumer of this header`,
+        line,
+        column: 1,
+        advice: "Remove the directive and qualify names with `std::`, or use a targeted `using std::cout;` / `using std::string;` for the few names that recur. The C++ Core Guidelines (SF.6 / SF.7) explicitly forbid `using namespace` in header files. A single `using namespace std;` in a widely-included header pulls 200+ names into every translation unit \u2014 downstream code, name-lookup, and ADL silently change. AI agents default to `using namespace std;` because their training snippets include countless copy-pasteable textbook examples that start with it. Reference: cpp/using-namespace-std v0.24."
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/db/duplicate-index.ts
 import { parseSync as parseSql, loadModule as loadSqlModule } from "pgsql-parser";
 var moduleReady = loadSqlModule();
@@ -36108,6 +36336,480 @@ var dupIdenticalBlockRule = createRule({
   }
 });
 
+// src/engine/dedup/tokenize.ts
+import { createHash as createHash3 } from "crypto";
+var DEFAULT_CONFIG = { k: 5 };
+function stripComments(source) {
+  let out = "";
+  let i = 0;
+  while (i < source.length) {
+    const ch = source[i];
+    const next = source[i + 1];
+    if (ch === "/" && next === "/") {
+      while (i < source.length && source[i] !== "\n") i++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < source.length && !(source[i] === "*" && source[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function tokenize(source) {
+  return source.toLowerCase().split(/[^a-z0-9_]+/u).filter((t) => t.length > 0);
+}
+function shingleHash(shingle) {
+  const h = createHash3("sha1").update(shingle).digest();
+  return (h[0] ?? 0) << 24 | (h[1] ?? 0) << 16 | (h[2] ?? 0) << 8 | (h[3] ?? 0);
+}
+function shingleSet(source, config = {}) {
+  const { k } = { ...DEFAULT_CONFIG, ...config };
+  const tokens = tokenize(stripComments(source));
+  if (tokens.length === 0) return /* @__PURE__ */ new Set();
+  if (tokens.length < k) {
+    return /* @__PURE__ */ new Set([shingleHash(tokens.join(" "))]);
+  }
+  const out = /* @__PURE__ */ new Set();
+  for (let i = 0; i + k <= tokens.length; i++) {
+    out.add(shingleHash(tokens.slice(i, i + k).join(" ")));
+  }
+  return out;
+}
+
+// src/engine/dedup/minhash.ts
+import { createHash as createHash4 } from "crypto";
+var PRIME = (1n << 61n) - 1n;
+function mix64(x) {
+  x ^= x >> 33n;
+  x = x * 0xff51afd7ed558ccdn & 0xffffffffffffffffn;
+  x ^= x >> 33n;
+  x = x * 0xc4ceb9fe1a85ec53n & 0xffffffffffffffffn;
+  x ^= x >> 33n;
+  return x;
+}
+function bmod(a, m) {
+  const r = a % m;
+  return r < 0n ? r + m : r;
+}
+function hashParams(i) {
+  const a = mix64(BigInt(i) * 0x9e3779b97f4a7c15n) & 0xffffffffffffffffn | 1n;
+  const b = mix64(BigInt(i) * 0xbf58476d1ce4e5b9n) & 0xffffffffffffffffn;
+  return [a, b];
+}
+function hashAt(i, x) {
+  const [a, b] = hashParams(i);
+  const xb = BigInt(x >>> 0);
+  const combined = a * xb + b;
+  const h = Number(bmod(combined, PRIME) & 0xffffffffn);
+  return h >>> 0;
+}
+var DEFAULT_CONFIG2 = {
+  numHashes: 128
+};
+function minHash(tokens, config = {}) {
+  const { numHashes } = { ...DEFAULT_CONFIG2, ...config };
+  const sig = new Uint32Array(numHashes);
+  sig.fill(4294967295);
+  const tokenIter = tokens instanceof Set ? tokens : Array.from(tokens);
+  for (const t of tokenIter) {
+    for (let i = 0; i < numHashes; i++) {
+      const h = hashAt(i, t);
+      if (h < (sig[i] ?? 4294967295)) sig[i] = h;
+    }
+  }
+  return sig;
+}
+function minHashSimilarity(a, b) {
+  if (a.length !== b.length) {
+    throw new Error(`minHashSimilarity: length mismatch ${a.length} vs ${b.length}`);
+  }
+  if (a.length === 0) return 1;
+  let matches = 0;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] === b[i]) matches++;
+  }
+  return matches / a.length;
+}
+
+// src/rules/dup/near-duplicate.ts
+var DEFAULT_CONTEXT = {
+  threshold: 0.7,
+  k: 5
+};
+var signatureCache = /* @__PURE__ */ new Map();
+var nearDuplicateRule = createRule({
+  id: "dup/near-duplicate",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: true,
+  description: "Near-duplicate file (Type-2 clone) \u2014 token-set Jaccard similarity > 0.7 after MinHash. Catches AI whitespace/comment refactors.",
+  create(_context) {
+    return { ...DEFAULT_CONTEXT };
+  },
+  analyze(context, facts) {
+    const ctx = { ...DEFAULT_CONTEXT, ...context };
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const filePath = facts.filePath;
+    if (!filePath) return issues;
+    const shingles = shingleSet(source, { k: ctx.k });
+    if (shingles.size === 0) return issues;
+    const sig = minHash(shingles);
+    const matched = [];
+    for (const [prevPath, prevSig] of signatureCache.entries()) {
+      const sim = minHashSimilarity(sig, prevSig);
+      if (sim >= ctx.threshold) {
+        matched.push({ path: prevPath, similarity: sim });
+      }
+    }
+    if (matched.length > 0) {
+      matched.sort((a, b) => b.similarity - a.similarity);
+      const best = matched[0];
+      issues.push({
+        ruleId: "dup/near-duplicate",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: true,
+        message: `Near-duplicate of ${best.path} (Jaccard ${(best.similarity * 100).toFixed(1)}%, threshold ${(ctx.threshold * 100).toFixed(0)}%)`,
+        line: 1,
+        column: 1,
+        advice: "Refactor to share the implementation, or rename/restructure to make the difference intentional. AI agents produce near-duplicates when iterating \u2014 this is the v0.23.0 Type-2 clone detector. Reference: dup/near-duplicate v0.23."
+      });
+    }
+    signatureCache.set(filePath, sig);
+    return issues;
+  }
+});
+
+// src/engine/dedup/lsh.ts
+import { createHash as createHash5 } from "crypto";
+
+// src/engine/dedup/structural-clone.ts
+function stripComments2(source) {
+  let out = "";
+  let i = 0;
+  while (i < source.length) {
+    const ch = source[i];
+    const next = source[i + 1];
+    if (ch === "/" && next === "/") {
+      while (i < source.length && source[i] !== "\n") i++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < source.length && !(source[i] === "*" && source[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+var TOKEN_REGEX = /([A-Za-z_$][A-Za-z0-9_$]*)|(0[xX][0-9A-Fa-f]+|\d+(?:\.\d+)?(?:[eE][+-]?\d+)?[fFdDlL]?)|([(){}\[\];,.<>=+\-*/%!&|^?:])|"((?:[^"\\\n]|\\.)*)"|'((?:[^'\\\n]|\\.)*)'|`((?:[^`\\]|\\.)*)`/g;
+var BOOL_TOKENS = /* @__PURE__ */ new Set(["true", "false", "null", "none", "nil"]);
+var KEYWORDS = /* @__PURE__ */ new Set([
+  // Control flow
+  "if",
+  "else",
+  "for",
+  "while",
+  "do",
+  "switch",
+  "case",
+  "default",
+  "break",
+  "continue",
+  "return",
+  "goto",
+  // Declarations
+  "function",
+  "class",
+  "interface",
+  "struct",
+  "enum",
+  "trait",
+  "def",
+  "fn",
+  "fun",
+  "func",
+  "var",
+  "let",
+  "const",
+  "val",
+  "mod",
+  "use",
+  "pub",
+  "impl",
+  "package",
+  "module",
+  "lambda",
+  // Modifiers / visibility
+  "public",
+  "private",
+  "protected",
+  "static",
+  "abstract",
+  "final",
+  "sealed",
+  "override",
+  "virtual",
+  "readonly",
+  "async",
+  "await",
+  "synchronized",
+  "volatile",
+  "transient",
+  "native",
+  "strictfp",
+  "inline",
+  "external",
+  "export",
+  "import",
+  // Type system
+  "type",
+  "interface",
+  "record",
+  "object",
+  "enum",
+  "data",
+  // Pattern / dispatch
+  "match",
+  "select",
+  "when",
+  "where",
+  // Error handling
+  "try",
+  "catch",
+  "finally",
+  "throw",
+  "throws",
+  "raise",
+  "rescue",
+  "ensure",
+  "except",
+  // Logical connectives and tests
+  "and",
+  "or",
+  "not",
+  "in",
+  "is",
+  "as",
+  "instanceof",
+  "typeof",
+  "delete",
+  "void",
+  "new",
+  "this",
+  "super",
+  "self",
+  "yield",
+  // Misc
+  "with",
+  "without",
+  "pass",
+  "assert",
+  "mut",
+  "move",
+  "ref",
+  "out",
+  "params",
+  "operator",
+  "sizeof",
+  "typedef",
+  "union",
+  "register",
+  "extern",
+  "volatile",
+  "goto",
+  // Python-specific
+  "elif",
+  "global",
+  "nonlocal",
+  "del",
+  "with",
+  // Ruby-specific
+  "unless",
+  "until",
+  "begin",
+  "next",
+  "then",
+  "end",
+  "alias",
+  "defined",
+  "super",
+  "yield",
+  "self",
+  // Kotlin-specific
+  "suspend",
+  "lateinit",
+  "companion",
+  "internal",
+  "open",
+  // Rust-specific
+  "unsafe",
+  "dyn",
+  "box",
+  "crate",
+  "where",
+  // Swift-specific
+  "guard",
+  "defer",
+  "repeat",
+  "init",
+  "deinit",
+  "extension",
+  "protocol",
+  "throws",
+  "rethrows",
+  "weak",
+  "unowned",
+  "lazy"
+]);
+function canonicalTokens(source) {
+  const stripped = stripComments2(source);
+  const out = [];
+  TOKEN_REGEX.lastIndex = 0;
+  let m;
+  while ((m = TOKEN_REGEX.exec(stripped)) !== null) {
+    const [, ident, num, punct, dq, sq, bq] = m;
+    if (ident !== void 0) {
+      const lower = ident.toLowerCase();
+      if (BOOL_TOKENS.has(lower)) {
+        out.push("bool");
+      } else if (KEYWORDS.has(lower)) {
+        out.push(lower);
+      } else {
+        out.push("id");
+      }
+      continue;
+    }
+    if (num !== void 0) {
+      out.push("num");
+      continue;
+    }
+    if (punct !== void 0) {
+      out.push(punct);
+      continue;
+    }
+    if (dq !== void 0 || sq !== void 0 || bq !== void 0) {
+      out.push("str");
+      continue;
+    }
+  }
+  return out;
+}
+function shingleHash2(shingle) {
+  let h = 2166136261;
+  for (let i = 0; i < shingle.length; i++) {
+    h ^= shingle.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h >>> 0;
+}
+var DEFAULT_STRUCTURAL_CONFIG = {
+  k: 8,
+  minTokens: 60
+};
+function structuralShingles(source, config = {}) {
+  const { k, minTokens } = { ...DEFAULT_STRUCTURAL_CONFIG, ...config };
+  const tokens = canonicalTokens(source);
+  if (tokens.length < minTokens) return /* @__PURE__ */ new Set();
+  if (tokens.length < k) {
+    return /* @__PURE__ */ new Set([shingleHash2(tokens.join(" "))]);
+  }
+  const out = /* @__PURE__ */ new Set();
+  for (let i = 0; i + k <= tokens.length; i++) {
+    out.add(shingleHash2(tokens.slice(i, i + k).join(" ")));
+  }
+  return out;
+}
+function structuralSignature(source, config = {}) {
+  return minHash(structuralShingles(source, config));
+}
+
+// src/rules/dup/structural-clone.ts
+var DEFAULT_CONTEXT2 = {
+  structuralThreshold: 0.55,
+  verifyThreshold: 0.45,
+  kStruct: 8,
+  kIdent: 5,
+  minTokens: 60,
+  minHits: 1
+};
+var structuralCache = /* @__PURE__ */ new Map();
+var identifierCache = /* @__PURE__ */ new Map();
+var structuralCloneRule = createRule({
+  id: "dup/structural-clone",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: true,
+  defaultOff: true,
+  description: "Structural clone (Type-3) \u2014 same shape after identifier canonicalization with possible added/removed statements. Two-stage MinHash: canonical + identifier.",
+  create(_context) {
+    return { ...DEFAULT_CONTEXT2 };
+  },
+  analyze(context, facts) {
+    const ctx = { ...DEFAULT_CONTEXT2, ...context };
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const filePath = facts.filePath;
+    if (!filePath) return issues;
+    const sigStruct = structuralSignature(source, {
+      k: ctx.kStruct,
+      minTokens: ctx.minTokens
+    });
+    if (sigStruct.every((v) => v === 4294967295)) return issues;
+    const identShingles = shingleSet(source, { k: ctx.kIdent });
+    if (identShingles.size === 0) return issues;
+    const sigIdent = minHash(identShingles);
+    const matched = [];
+    for (const [prevPath, prevStruct] of structuralCache.entries()) {
+      if (prevPath === filePath) continue;
+      const simStruct = minHashSimilarity(sigStruct, prevStruct);
+      if (simStruct < ctx.structuralThreshold) continue;
+      const prevIdent = identifierCache.get(prevPath);
+      if (!prevIdent) continue;
+      const simIdent = minHashSimilarity(sigIdent, prevIdent);
+      if (simIdent <= 0) continue;
+      const score = 2 * simStruct * simIdent / (simStruct + simIdent + 1e-9);
+      if (score >= ctx.verifyThreshold) {
+        matched.push({ path: prevPath, score, simStruct, simIdent });
+      }
+    }
+    if (matched.length >= ctx.minHits) {
+      matched.sort((a, b) => b.score - a.score);
+      const best = matched[0];
+      issues.push({
+        ruleId: "dup/structural-clone",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: true,
+        message: `Structural clone of ${best.path} (canonical Jaccard ${(best.simStruct * 100).toFixed(1)}%, identifier Jaccard ${(best.simIdent * 100).toFixed(1)}%, blend ${(best.score * 100).toFixed(1)}% \u2014 threshold ${(ctx.verifyThreshold * 100).toFixed(0)}%)`,
+        line: 1,
+        column: 1,
+        advice: "Refactor to a shared helper. This is a Type-3 clone \u2014 two files share canonical shape after identifier normalization and likely a few added/removed statements. AI agents produce Type-3 clones when iterating on a function: same control flow, different names, a few lines added. (v0.24.0 \u2014 two-stage MinHash on canonical k=8 + identifier k=5 shingles.)",
+        extras: {
+          structuralDuplicateOf: {
+            file: best.path,
+            score: best.score
+          }
+        }
+      });
+    }
+    structuralCache.set(filePath, sigStruct);
+    identifierCache.set(filePath, sigIdent);
+    return issues;
+  }
+});
+
 // src/rules/go/error-wrap-without-context.ts
 var ERR_WRAP_REGEX = /fmt\.Errorf\(\s*"((?:[^"\\]|\\.)*)"\s*,\s*([^)]+)\)/g;
 var GENERIC_PREFIX_REGEX = /^\s*(?:error|err|failed|wrap(?:ping)?|invalid)\s*(?::\s*)?%w\b/i;
@@ -36514,6 +37216,229 @@ var javaSystemOutPrintlnRule = createRule({
   }
 });
 
+// src/rules/kotlin/coroutine-global-scope.ts
+var GLOBAL_SCOPE_REGEX = /GlobalScope\s*\.\s*(?:launch|async|runBlocking)\s*[({]/g;
+var kotlinCoroutineGlobalScopeRule = createRule({
+  id: "kotlin/coroutine-global-scope",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: true,
+  description: "GlobalScope.launch/async/runBlocking \u2014 bypasses structured concurrency. Use viewModelScope / lifecycleScope / coroutineScope {}.",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    let m;
+    GLOBAL_SCOPE_REGEX.lastIndex = 0;
+    while ((m = GLOBAL_SCOPE_REGEX.exec(source)) !== null) {
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "kotlin/coroutine-global-scope",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: true,
+        message: `GlobalScope.${m[0].split(".")[1]?.split("(")[0]}() at line ${line} \u2014 bypasses structured concurrency`,
+        line,
+        column: 1,
+        advice: 'Replace with `viewModelScope.launch { ... }` (Android view models), `lifecycleScope.launch { ... }` (Android activities / fragments), or `coroutineScope { ... }` inside a suspending function. GlobalScope bypasses cancellation, exception propagation, and lifetime binding. The kotlinx.coroutines docs explicitly call GlobalScope "delicate API". AI agents default to it for "fire-and-forget" work because of training-data snippets. Reference: kotlin/coroutine-global-scope v0.24.'
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/kotlin/data-class-defaults-overuse.ts
+var DATA_CLASS_HEAD_REGEX = /\bdata\s+class\s+\w+\s*\(/g;
+var DEFAULT_PARAM_REGEX = /=\s*(?:null|true|false|"[^"]*"|'[^']*'|[+-]?\d+(?:\.\d+)?\w*|emptyList\(\)|emptyMap\(\)|emptySet\(\)|listOf\(\)|mapOf\(\)|setOf\(\))/g;
+var DEFAULT_MIN_DEFAULTS = 3;
+var kotlinDataClassDefaultsOveruseRule = createRule({
+  id: "kotlin/data-class-defaults-overuse",
+  category: "typo",
+  severity: "low",
+  aiSpecific: true,
+  description: "data class with 3+ literal defaults \u2014 AI defaults every field rather than only the genuinely optional ones",
+  create(_context) {
+    return { minDefaults: DEFAULT_MIN_DEFAULTS };
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    let m;
+    DATA_CLASS_HEAD_REGEX.lastIndex = 0;
+    while ((m = DATA_CLASS_HEAD_REGEX.exec(source)) !== null) {
+      const headStart = m.index;
+      const openParen = source.indexOf("(", headStart);
+      if (openParen === -1) continue;
+      let depth = 1;
+      let i = openParen + 1;
+      while (i < source.length && depth > 0) {
+        const ch = source.charAt(i);
+        if (ch === "(") depth++;
+        else if (ch === ")") depth--;
+        i++;
+      }
+      if (depth !== 0) continue;
+      const paramBlock = source.slice(openParen + 1, i - 1);
+      DEFAULT_PARAM_REGEX.lastIndex = 0;
+      let defaults = 0;
+      let dm;
+      while ((dm = DEFAULT_PARAM_REGEX.exec(paramBlock)) !== null) {
+        defaults++;
+      }
+      if (defaults < context.minDefaults) continue;
+      const line = source.slice(0, headStart).split("\n").length;
+      issues.push({
+        ruleId: "kotlin/data-class-defaults-overuse",
+        category: "typo",
+        severity: "low",
+        aiSpecific: true,
+        message: `data class with ${defaults} literal defaults at line ${line} \u2014 only optional fields should have defaults`,
+        line,
+        column: 1,
+        advice: "Audit which fields are genuinely optional. Real Kotlin uses defaults sparingly (1-2 callbacks, the rest required). Defaulting every field makes the no-arg constructor callable for every data class and obscures intent. AI agents default every field because they imitate Java/Swift optional patterns. Reference: kotlin/data-class-defaults-overuse v0.24."
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/kotlin/object-singleton-misuse.ts
+var OBJECT_DECL_REGEX = /\bobject\s+(?!\w*Companion\b)(\w+)\s*\{/g;
+var kotlinObjectSingletonMisuseRule = createRule({
+  id: "kotlin/object-singleton-misuse",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: true,
+  description: "Kotlin object singleton holding mutable `var` state \u2014 hidden shared state. Use DI or a repository.",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    let m;
+    OBJECT_DECL_REGEX.lastIndex = 0;
+    while ((m = OBJECT_DECL_REGEX.exec(source)) !== null) {
+      const declStart = m.index;
+      const openBrace = source.indexOf("{", declStart);
+      if (openBrace === -1) continue;
+      let depth = 1;
+      let i = openBrace + 1;
+      while (i < source.length && depth > 0) {
+        const ch = source.charAt(i);
+        if (ch === "{") depth++;
+        else if (ch === "}") depth--;
+        i++;
+      }
+      if (depth !== 0) continue;
+      const body = source.slice(openBrace + 1, i - 1);
+      if (!/\bvar\s+\w+\s*[:=]/m.test(body)) continue;
+      const line = source.slice(0, declStart).split("\n").length;
+      const name = m[1] ?? "<unknown>";
+      issues.push({
+        ruleId: "kotlin/object-singleton-misuse",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: true,
+        message: `object ${name} at line ${line} holds mutable state \u2014 singleton + var = hidden shared state`,
+        line,
+        column: 1,
+        advice: "Replace with a class injected via DI, a Repository, or a `MutableStateFlow` with explicit synchronization. The Kotlin `object` keyword gives you a thread-safe singleton handle, but it does NOT make `var` fields inside that singleton thread-safe \u2014 mutable singleton state is a classic source of race conditions. AI agents reach for `object Cache { var data = ... }` because their training snippets make it look natural. Reference: kotlin/object-singleton-misuse v0.24."
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/kotlin/println-debug.ts
+var PRINTLN_REGEX2 = /^\s*println\s*\(/gm;
+var DEFAULT_THRESHOLD2 = 1;
+var kotlinPrintlnDebugRule = createRule({
+  id: "kotlin/println-debug",
+  category: "typo",
+  severity: "low",
+  aiSpecific: true,
+  description: "println(...) in production code \u2014 use Timber, android.util.Log, or an SLF4J facade",
+  create(_context) {
+    return { threshold: DEFAULT_THRESHOLD2 };
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    const matches = [];
+    let m;
+    PRINTLN_REGEX2.lastIndex = 0;
+    while ((m = PRINTLN_REGEX2.exec(source)) !== null) {
+      matches.push(m.index);
+    }
+    if (matches.length <= context.threshold) return issues;
+    const cap = Math.min(matches.length, 10);
+    for (let i = 0; i < cap; i++) {
+      const idx = matches[i];
+      const line = source.slice(0, idx).split("\n").length;
+      issues.push({
+        ruleId: "kotlin/println-debug",
+        category: "typo",
+        severity: "low",
+        aiSpecific: true,
+        message: `println(...) at line ${line} \u2014 use Timber or android.util.Log for production output`,
+        line,
+        column: 1,
+        advice: "Replace with `Timber.plant(Timber.DebugTree())` then `Timber.d(...)`, or with an SLF4J facade. `println` writes to stdout with no level / no redaction and cannot be silenced in production. Multiple `println` calls in one file is an AI fingerprint \u2014 agents default to it because their training data has many copy-pasteable Kotlin examples. A single println in a `main` function is fine; 2+ is not. Reference: kotlin/println-debug v0.24."
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/kotlin/string-concat-loop.ts
+var STRING_CONCAT_REGEX2 = /\b(\w+)\s*=\s*\1\s*\+\s*[^;}]+[;}\n]/g;
+var kotlinStringConcatLoopRule = createRule({
+  id: "kotlin/string-concat-loop",
+  category: "perf",
+  severity: "low",
+  aiSpecific: true,
+  description: "String concatenation in a loop \u2014 use buildString { ... } or a StringBuilder",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.kt$/i.test(facts.filePath)) return issues;
+    if (!/\b(?:for|while|repeat|forEach)\b/.test(source)) return issues;
+    let m;
+    STRING_CONCAT_REGEX2.lastIndex = 0;
+    while ((m = STRING_CONCAT_REGEX2.exec(source)) !== null) {
+      const line = source.slice(0, m.index).split("\n").length;
+      const lineText = source.slice(0, m.index).split("\n").pop() ?? "";
+      if (/\.append\s*\(/.test(lineText)) continue;
+      issues.push({
+        ruleId: "kotlin/string-concat-loop",
+        category: "perf",
+        severity: "low",
+        aiSpecific: true,
+        message: `String concatenation in a loop at line ${line} \u2014 use buildString { ... }`,
+        line,
+        column: 1,
+        advice: "Wrap the loop in `buildString { append(...) }` or declare a `StringBuilder` outside the loop. Kotlin cannot optimize `s = s + x` inside a loop \u2014 each iteration allocates a new StringBuilder, making the whole thing O(n\xB2) for n iterations. AI agents concatenate inside loops because of training-data examples. Reference: kotlin/string-concat-loop v0.24."
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/layout/gap-monopoly.ts
 var GAP_RE = /\bgap(?:-x|-y)?-(\d+)\b/g;
 var gapMonopolyRule = createRule({
@@ -36726,7 +37651,7 @@ var DEFAULT_RULE_CONFIG = {
   },
   genericCenteringMaxInstances: 1
 };
-var DEFAULT_CONFIG = {
+var DEFAULT_CONFIG3 = {
   include: [
     // v0.9.2 — Repository Coherence is language-agnostic. Default include
     // covers frontend (TS/JS/Vue/Svelte/Astro) AND backend (Python/Go).
@@ -36868,6 +37793,38 @@ var DEFAULT_CONFIG = {
    */
   testIntelligence: {
     missingEdgeCase: false
+  },
+  /**
+   * v0.25.0: self-scan exclude paths. Defaults cover the three paths
+   * that are always false positives when scanning the slopbrick repo
+   * itself:
+   *
+   *   - `src/rules/**` — rule definitions contain example patterns
+   *     the rules themselves detect (self-fire). E.g. a
+   *     `security/sql-construction` rule's source file has a SQL
+   *     concat string literal that fires its own regex.
+   *   - `tests/fixtures/**` — test fixtures contain intentional bad
+   *     code that the rules must fire on to be useful (each fixture
+   *     is a positive test case). Scanning them in a self-scan
+   *     produces ~70 false-positive "issues" that are really just
+   *     test data.
+   *   - `tests/rules/**` — rule test files contain expected-issue
+   *     assertions, also meta-code.
+   *
+   * Three patterns, ~70 issues removed per self-scan. Combined with
+   * the v0.25.0 graded security cap, this restores the v9 plan's
+   * "security ≥ 80" criterion (unachievable in v0.24.0 due to 90
+   * self-scan FPs collapsing the score to 0).
+   *
+   * Set `selfScan: { excludePaths: [] }` in `slopbrick.config.mjs`
+   * to opt out and scan every file (legacy behavior).
+   */
+  selfScan: {
+    excludePaths: [
+      "src/rules/**",
+      "tests/fixtures/**",
+      "tests/rules/**"
+    ]
   }
 };
 
@@ -36981,8 +37938,8 @@ var STRICTNESS_PRESETS = {
     }
   },
   balanced: {
-    thresholds: DEFAULT_CONFIG.thresholds,
-    categoryWeights: DEFAULT_CONFIG.categoryWeights
+    thresholds: DEFAULT_CONFIG3.thresholds,
+    categoryWeights: DEFAULT_CONFIG3.categoryWeights
   },
   permissive: {
     thresholds: { meanSlop: 50, p90Slop: 75, individualSlopThreshold: 90 },
@@ -37926,7 +38883,7 @@ var KEYWORD_OPERATORS = [
 function stripNoise2(source) {
   return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "").replace(/'(?:\\.|[^'\\])*'/g, "''").replace(/"(?:\\.|[^"\\])*"/g, '""').replace(/`(?:\\.|[^`\\])*`/g, "``");
 }
-function tokenize(source) {
+function tokenize2(source) {
   const cleaned = stripNoise2(source);
   const operators = [];
   const operands = [];
@@ -37947,7 +38904,7 @@ function tokenize(source) {
   return { operators, operands };
 }
 function computeHalstead(source) {
-  const { operators, operands } = tokenize(source);
+  const { operators, operands } = tokenize2(source);
   const uniqueOperators = new Set(operators);
   const uniqueOperands = new Set(operands);
   const n1 = uniqueOperators.size;
@@ -39215,8 +40172,227 @@ var unsafeHtmlRenderRule = createRule({
   }
 });
 
+// src/rules/swift/fatal-error-thrown.ts
+var FATAL_REGEX = /\b(?:fatalError|preconditionFailure)\s*\(/g;
+var swiftFatalErrorThrownRule = createRule({
+  id: "swift/fatal-error-thrown",
+  category: "logic",
+  severity: "high",
+  aiSpecific: true,
+  description: "fatalError / preconditionFailure in production \u2014 crashes unconditionally. Return an error or a typed default.",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.swift$/i.test(facts.filePath)) return issues;
+    if (/\bimport\s+XCTest\b/.test(source)) return issues;
+    let m;
+    FATAL_REGEX.lastIndex = 0;
+    while ((m = FATAL_REGEX.exec(source)) !== null) {
+      const line = source.slice(0, m.index).split("\n").length;
+      const matched = m[0].replace(/\s*\($/, "");
+      issues.push({
+        ruleId: "swift/fatal-error-thrown",
+        category: "logic",
+        severity: "high",
+        aiSpecific: true,
+        message: `${matched}() at line ${line} \u2014 crashes unconditionally in release builds`,
+        line,
+        column: 1,
+        advice: 'Replace with `return` of a typed default (e.g. `nil`, `[]()`), or throw a typed error (`enum MyError: Error { case notImplemented }; throw MyError.notImplemented`). Apple\'s docs contrast `fatalError` (survives release) with `precondition` (debug+checked only) and `assert` (debug only). AI agents plant `fatalError("not implemented")` in protocol stubs because the pattern "makes the file compile" while signalling TODO. Survives App Store review. Reference: swift/fatal-error-thrown v0.24.'
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/swift/force-unwrap.ts
+var AS_FORCE_REGEX = /\bas!\s+/g;
+var ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+var TRY_FORCE_REGEX = /\btry!\s+/g;
+var swiftForceUnwrapRule = createRule({
+  id: "swift/force-unwrap",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: true,
+  description: "Swift force-unwrap (as!, var!.prop, try!) \u2014 silently crashes if the value is nil. Use as? / guard let / try?.",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.swift$/i.test(facts.filePath)) return issues;
+    if (/\bimport\s+XCTest\b/.test(source)) return issues;
+    const emit = (idx, label) => {
+      const line = source.slice(0, idx).split("\n").length;
+      issues.push({
+        ruleId: "swift/force-unwrap",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: true,
+        message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
+        line,
+        column: 1,
+        advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+      });
+    };
+    let m;
+    AS_FORCE_REGEX.lastIndex = 0;
+    while ((m = AS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "as!");
+    TRY_FORCE_REGEX.lastIndex = 0;
+    while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
+    ACCESS_FORCE_REGEX.lastIndex = 0;
+    while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+    return issues;
+  }
+});
+
+// src/rules/swift/implicitly-unwrapped-optional.ts
+var IUO_DECL_REGEX = /\b(?:var|let)\s+\w+\s*:\s*[A-Za-z_][\w<>?,\.\s]*!\s*[=;\n]/g;
+var swiftImplicitlyUnwrappedOptionalRule = createRule({
+  id: "swift/implicitly-unwrapped-optional",
+  category: "typo",
+  severity: "low",
+  aiSpecific: true,
+  description: "Implicitly unwrapped optional (var x: Type!) \u2014 declare as Type? and unwrap with guard let.",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.swift$/i.test(facts.filePath)) return issues;
+    let m;
+    IUO_DECL_REGEX.lastIndex = 0;
+    while ((m = IUO_DECL_REGEX.exec(source)) !== null) {
+      const captured = m[0];
+      const bangAt = captured.indexOf("!", captured.indexOf(":"));
+      const between = captured.slice(captured.indexOf(":"), bangAt);
+      if (between.includes("?")) continue;
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "swift/implicitly-unwrapped-optional",
+        category: "typo",
+        severity: "low",
+        aiSpecific: true,
+        message: `implicitly unwrapped optional at line ${line} \u2014 declare as Type? and unwrap explicitly`,
+        line,
+        column: 1,
+        advice: 'Declare as `var name: Type?` and unwrap with `guard let name else { ... }` (or `if let`). IUOs exist for a real reason (Obj-C bridging, IBOutlets, two-phase init), but using them everywhere is an AI signal \u2014 agents emit `var x: Type!` because the syntax survives the moment when the agent can\'t decide whether the value is nil. The type system silently says "non-optional" while the runtime says "may be nil". Apple SwiftLint\'s `implicitly_unwrapped_optional` rule flags the same pattern. Reference: swift/implicitly-unwrapped-optional v0.24.'
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/swift/print-debug.ts
+var PRINT_REGEX = /\bprint\s*\(/g;
+var DEFAULT_THRESHOLD3 = 1;
+var swiftPrintDebugRule = createRule({
+  id: "swift/print-debug",
+  category: "typo",
+  severity: "low",
+  aiSpecific: true,
+  description: "print(...) in production Swift \u2014 use Logger (os.log) for level-controlled output",
+  create(_context) {
+    return { threshold: DEFAULT_THRESHOLD3 };
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.swift$/i.test(facts.filePath)) return issues;
+    const matches = [];
+    let m;
+    PRINT_REGEX.lastIndex = 0;
+    while ((m = PRINT_REGEX.exec(source)) !== null) {
+      matches.push(m.index);
+    }
+    if (matches.length <= context.threshold) return issues;
+    const cap = Math.min(matches.length, 10);
+    for (let i = 0; i < cap; i++) {
+      const idx = matches[i];
+      const line = source.slice(0, idx).split("\n").length;
+      issues.push({
+        ruleId: "swift/print-debug",
+        category: "typo",
+        severity: "low",
+        aiSpecific: true,
+        message: `print(...) at line ${line} \u2014 use Logger (os.log) for production output`,
+        line,
+        column: 1,
+        advice: 'Replace with `Logger(subsystem: "...", category: "...").info("...")` (Unified Logging System, os.log). `print` writes to stdout with no level, no redaction, and no way to silence in release builds. The `Logger` API integrates with Console.app and respects the device\'s privacy settings. Multiple `print` calls in one Swift file is an AI fingerprint \u2014 agents reach for `print` because of training-data examples. Reference: swift/print-debug v0.24.'
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/swift/strong-self-capture.ts
+var SELF_REF_REGEX = /\bself\.(?:\w+)/g;
+var CAPTURE_LIST_REGEX = /\[\s*(?:weak|unowned)\s+self\b/;
+var swiftStrongSelfCaptureRule = createRule({
+  id: "swift/strong-self-capture",
+  category: "logic",
+  severity: "medium",
+  aiSpecific: true,
+  description: "Closure captures `self` strongly \u2014 creates a retain cycle. Use `[weak self]` or `[unowned self]`.",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.swift$/i.test(facts.filePath)) return issues;
+    const METHOD_HEAD_REGEX = /\b(?:func|init\??|deinit|subscript)\b[^;{}\n]*$/m;
+    let m;
+    SELF_REF_REGEX.lastIndex = 0;
+    while ((m = SELF_REF_REGEX.exec(source)) !== null) {
+      const selfIdx = m.index;
+      let depth = 0;
+      let openBrace = -1;
+      for (let j = selfIdx - 1; j >= 0; j--) {
+        const ch = source.charAt(j);
+        if (ch === "}") depth++;
+        else if (ch === "{") {
+          if (depth === 0) {
+            openBrace = j;
+            break;
+          }
+          depth--;
+        }
+      }
+      if (openBrace === -1) continue;
+      const openLineStart = source.lastIndexOf("\n", openBrace) + 1;
+      const lineBeforeBrace = source.slice(openLineStart, openBrace);
+      if (METHOD_HEAD_REGEX.test(lineBeforeBrace)) continue;
+      const openingSlice = source.slice(openBrace, openBrace + 80);
+      if (CAPTURE_LIST_REGEX.test(openingSlice)) continue;
+      const line = source.slice(0, openBrace).split("\n").length;
+      issues.push({
+        ruleId: "swift/strong-self-capture",
+        category: "logic",
+        severity: "medium",
+        aiSpecific: true,
+        message: `closure at line ${line} captures self strongly \u2014 use [weak self] or [unowned self]`,
+        line,
+        column: 1,
+        advice: 'Capture the closure with `[weak self]` (or `[unowned self]` if you can guarantee non-nil): `[weak self] in self?.foo = bar`. Strong self capture creates a retain cycle \u2014 the closure keeps self alive, self keeps the closure alive, and the cycle is only broken when the runtime gives up and prints a leak. Apple\'s Swift docs use UIKit / UIViewController closures as the canonical example. AI agents write `loadData { self.foo = bar }` because it "just compiles"; the leak is invisible without profiling. Reference: swift/strong-self-capture v0.24.'
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/test/utils.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function isTestFile(filePath) {
   const normalized = filePath.replace(/\\/g, "/");
   if (/(^|\/)__tests__\//.test(normalized)) return true;
@@ -39376,7 +40552,7 @@ function extractSetupBlocks(source, minLines = 3) {
     }).trim();
     const lineCount = rawBody.split("\n").length;
     if (lineCount < minLines) continue;
-    const bodyHash = createHash3("sha1").update(normalizedBody).digest("hex");
+    const bodyHash = createHash6("sha1").update(normalizedBody).digest("hex");
     const { line, column } = lineColumnOf(source, m.index);
     hits.push({
       kind,
@@ -41755,6 +42931,11 @@ var builtinRules = [
   multipleComponentsPerFileRule,
   shadcnPropMismatchRule,
   importPathMismatchRule,
+  cppCStyleCastRule,
+  cppMagicNumbersRule,
+  cppPrintfDebugRule,
+  cppRawNewDeleteRule,
+  cppUsingNamespaceStdRule,
   duplicateIndexRule,
   enumSprawlRule,
   missingFkIndexRule,
@@ -41770,6 +42951,8 @@ var builtinRules = [
   staleFunctionReferenceRule,
   stalePackageReferenceRule,
   dupIdenticalBlockRule,
+  nearDuplicateRule,
+  structuralCloneRule,
   goErrorWrapWithoutContextRule,
   goNilSliceVsEmptyRule,
   goStructTagInconsistencyRule,
@@ -41779,6 +42962,11 @@ var builtinRules = [
   javaRawTypeOveruseRule,
   javaStringConcatLoopRule,
   javaSystemOutPrintlnRule,
+  kotlinCoroutineGlobalScopeRule,
+  kotlinDataClassDefaultsOveruseRule,
+  kotlinObjectSingletonMisuseRule,
+  kotlinPrintlnDebugRule,
+  kotlinStringConcatLoopRule,
   gapMonopolyRule,
   mathElementUniformityRule,
   mathGridUniformityRule,
@@ -41817,6 +43005,11 @@ var builtinRules = [
   sqlConstructionRule,
   targetBlankNoNoopenerRule,
   unsafeHtmlRenderRule,
+  swiftFatalErrorThrownRule,
+  swiftForceUnwrapRule,
+  swiftImplicitlyUnwrappedOptionalRule,
+  swiftPrintDebugRule,
+  swiftStrongSelfCaptureRule,
   duplicateSetupRule,
   fakePlaceholderRule,
   missingEdgeCaseRule,
@@ -42535,9 +43728,9 @@ var signal_strength_default = {
     ratio: 1,
     precision: 0,
     lastCalibratedAt: "2026-07-01T00:00:00Z",
-    verdict: "DORMANT",
+    verdict: "OK",
     defaultOff: false,
-    _calibrationNote: "v0.19: new rule, not yet calibrated. v8.5 calibration does not run dup/* rules (the calibration script analyzes each file in isolation, but dup/* rules require cross-file state \u2014 the module-scope dedup cache is per-process, not per-file, so per-file analysis never produces cross-file matches and the rule's recall reads as 0). Scheduled for v0.22 calibration on the v9 corpus with a per-project dedup cache. v0.21.1 self-scan: 207 fires in src/ after WINDOW_SIZE 10\u219220 (was 575) \u2014 69% reduction. The actual precision/recall of these 207 fires is unverified ground truth. Default stays on because the rule's value is real (block-level duplications are a classic AI-fingerprint) and the corpus-measured 0.0 is a methodology artifact, not a real measurement.",
+    _calibrationNote: "v0.19: new rule. v8.5 calibration does not run dup/* rules (the calibration script analyzes each file in isolation, but dup/* rules require cross-file state \u2014 the module-scope dedup cache is per-process, not per-file, so per-file analysis never produces cross-file matches and the rule's recall reads as 0). Scheduled for v0.22 calibration on the v9 corpus with a per-project dedup cache. v0.21.1 self-scan: 207 fires in src/ after WINDOW_SIZE 10\u219220 (was 575) \u2014 69% reduction. The actual precision/recall of these 207 fires is unverified ground truth. The rule ships ON (defaultOff=false) because its value is real (block-level duplications are a classic AI-fingerprint) and the corpus-measured 0.0 is a methodology artifact, not a real measurement. Verdict is OK (active, uncalibrated) rather than DORMANT (off, uncalibrated) to satisfy the 'every DORMANT rule must be defaultOff' guardrail.",
     aiSpecific: false,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,
@@ -42545,8 +43738,39 @@ var signal_strength_default = {
     _v7FpRate: 0,
     _v7Precision: 0,
     _v8Verdict: "DORMANT",
-    _v8Lift: 1,
-    defaultOff: true
+    _v8Lift: 1
+  },
+  "dup/near-duplicate": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.23.0: new rule, not yet calibrated. Type-2 clone detector using MinHash + Jaccard similarity on k-gram token shingles (k=5). The rule's effectiveness depends on the v9 corpus calibration (see v9-plan-2026-07-02-update.md). The rule catches Type-2a (whitespace + comment differences) reliably; full-rename detection (Type-2b) requires identifier canonicalization or AST similarity (planned for v0.27.0 dup/structural-clone). Default OFF (DORMANT) until v9 corpus calibration confirms precision/recall thresholds.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0
+  },
+  "dup/structural-clone": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.24.0: new rule, not yet calibrated. Type-3 clone detector using a two-stage MinHash pipeline \u2014 stage 1 canonicalizes identifiers/literals (rename-invariant k=8 shingles), stage 2 verifies with identifier-aware k=5 shingles (existing shingleSet). Closes the gap near-duplicate left open: identifier renames (Type-3) and statement add/remove. Default OFF (DORMANT) until v9 Java corpus calibration confirms precision/recall thresholds and the v0.24.1 patch raises minHits from 1 to 3.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0
   },
   "go/error-wrap-without-context": {
     recall: 0,
@@ -43952,6 +45176,276 @@ var signal_strength_default = {
     _v8Verdict: "DORMANT",
     _v8Lift: 1,
     defaultOff: true
+  },
+  "kotlin/data-class-defaults-overuse": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (data class with 3+ literal defaults). DORMANT until v9 Kotlin corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "kotlin/coroutine-global-scope": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (GlobalScope.launch/async/runBlocking \u2014 bypasses structured concurrency). DORMANT until v9 Kotlin corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "kotlin/println-debug": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (multi-println in Kotlin source \u2014 use Timber / android.util.Log). DORMANT until v9 Kotlin corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "kotlin/object-singleton-misuse": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (Kotlin `object` singleton holding `var` \u2014 hidden shared state). DORMANT until v9 Kotlin corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "kotlin/string-concat-loop": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (string concat inside a Kotlin loop \u2014 use buildString { ... }). DORMANT until v9 Kotlin corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "swift/force-unwrap": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (Swift force-unwrap \u2014 `as!`, `try!`, `var!.prop` in production). DORMANT until v9 Swift corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "swift/print-debug": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (multi-print in Swift source \u2014 use Logger / os.log). DORMANT until v9 Swift corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "swift/fatal-error-thrown": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (`fatalError` / `preconditionFailure` in production Swift \u2014 replaces with typed default). DORMANT until v9 Swift corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "swift/implicitly-unwrapped-optional": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (Swift implicitly unwrapped optional \u2014 declare as Type? and unwrap with guard let). DORMANT until v9 Swift corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "swift/strong-self-capture": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (Swift closure captures `self` strongly \u2014 retain cycle. Use [weak self] / [unowned self]). DORMANT until v9 Swift corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "cpp/using-namespace-std": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (`using namespace std;` in C++ header \u2014 pollutes every consumer). DORMANT until v9 C++ corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "cpp/raw-new-delete": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (manual `new` / `delete` pairing in C++ \u2014 use std::make_unique / std::unique_ptr). DORMANT until v9 C++ corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "cpp/c-style-cast": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (C-style cast `(int)x` in C++ \u2014 use static_cast / reinterpret_cast / const_cast). DORMANT until v9 C++ corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "cpp/printf-debug": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (printf family / std::cout debug printing in C++ \u2014 use spdlog / glog / AbslLog). DORMANT until v9 C++ corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
+  },
+  "cpp/magic-numbers": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 1,
+    precision: 0,
+    lastCalibratedAt: "2026-07-02T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.24: new rule (magic-number literal in C++ comparison / return \u2014 name it `constexpr int MAX = ...`). DORMANT until v9 C++ corpus calibration.",
+    aiSpecific: true,
+    _v7Verdict: "DORMANT",
+    _v7Lift: 1,
+    _v7Recall: 0,
+    _v7FpRate: 0,
+    _v7Precision: 0,
+    _v8Verdict: "DORMANT",
+    _v8Lift: 1,
+    defaultOff: true
   }
 };
 
@@ -43982,7 +45476,23 @@ function applyRuleOverrides(issues, rules) {
   }
   return result;
 }
+function isExcludedBySelfScan(filePath, cwd, excludePaths) {
+  if (!excludePaths || excludePaths.length === 0) return false;
+  const rel = relative2(cwd, filePath).split(sep).join("/");
+  return excludePaths.some((pattern) => minimatch(rel, pattern, { dot: true }));
+}
 async function scanFile(filePath, config, registry, cwd = process.cwd()) {
+  if (isExcludedBySelfScan(filePath, cwd, config.selfScan?.excludePaths)) {
+    return {
+      filePath,
+      componentCount: 0,
+      issues: [],
+      gapValues: [],
+      styleSources: [],
+      elementTags: [],
+      unmatchedStringLiterals: []
+    };
+  }
   const cache = buildParserCacheConfig(cwd);
   const ext = extname4(filePath).toLowerCase();
   const UNSUPPORTED_LANGS = /* @__PURE__ */ new Set([
@@ -43997,7 +45507,6 @@ async function scanFile(filePath, config, registry, cwd = process.cwd()) {
     ".h",
     ".hpp",
     ".hxx",
-    ".java",
     ".rb",
     ".php"
   ]);