slopbrick 0.28.0 → 0.30.0

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.28.0";
+    VERSION = "0.30.0";
   }
 });
 
@@ -30643,6 +30643,246 @@ var init_struct_tag_inconsistency = __esm({
   }
 });
 
+// src/rules/java/command-injection.ts
+var COMMAND_INVOCATION_REGEX, STRING_CONCAT_REGEX, javaCommandInjectionRule;
+var init_command_injection = __esm({
+  "src/rules/java/command-injection.ts"() {
+    "use strict";
+    init_rule();
+    COMMAND_INVOCATION_REGEX = /\b(?:Runtime\.exec|Runtime\.getRuntime\(\)\.exec|ProcessBuilder)\s*\(/;
+    STRING_CONCAT_REGEX = /["'][^"']*["']\s*\+/;
+    javaCommandInjectionRule = createRule({
+      id: "java/command-injection",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "Runtime.exec() or ProcessBuilder with string concat \u2014 use List<String> args + validation",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        const lines = source.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i];
+          if (!COMMAND_INVOCATION_REGEX.test(line)) continue;
+          if (!STRING_CONCAT_REGEX.test(line)) continue;
+          issues.push({
+            ruleId: "java/command-injection",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `Command invocation with string concat at line ${i + 1}`,
+            line: i + 1,
+            column: 1,
+            advice: "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg against a whitelist. For shell commands, use bash -c only with a fixed string (no concatenation). String concat into Runtime.exec() is the canonical command-injection pattern \u2014 attackers can break out with `; rm -rf /` or `$(...)`. Reference: java/command-injection v0.30 (OWASP A03:2021)."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/java/hardcoded-credential.ts
+var KEY_REGEX, VALUE_REGEX, FALSE_POSITIVES, javaHardcodedCredentialRule;
+var init_hardcoded_credential = __esm({
+  "src/rules/java/hardcoded-credential.ts"() {
+    "use strict";
+    init_rule();
+    KEY_REGEX = /\b(api[_-]?key|apikey|secret|token|password|auth|access[_-]?key|client[_-]?secret|private[_-]?key)\b\s*[=:]/i;
+    VALUE_REGEX = /["']([A-Za-z0-9_\-+/=.@*!]{16,})["']/;
+    FALSE_POSITIVES = /* @__PURE__ */ new Set([
+      "passwordless",
+      "tokenize",
+      "tokenizer",
+      "authorizationrequired",
+      "authenticated",
+      "authenticatortoken",
+      "authtoken",
+      "placeholder",
+      "changeme"
+    ]);
+    javaHardcodedCredentialRule = createRule({
+      id: "java/hardcoded-credential",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "Hardcoded credential literal \u2014 use env vars or a secrets manager",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        const lines = source.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i];
+          if (!KEY_REGEX.test(line)) continue;
+          const valueMatch = VALUE_REGEX.exec(line);
+          if (!valueMatch) continue;
+          const value = valueMatch[1];
+          if (FALSE_POSITIVES.has(value.toLowerCase())) continue;
+          if (!/[a-zA-Z]/.test(value) || !/[0-9]/.test(value)) continue;
+          if (value.startsWith("$")) continue;
+          issues.push({
+            ruleId: "java/hardcoded-credential",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `Hardcoded credential at line ${i + 1}`,
+            line: i + 1,
+            column: 1,
+            advice: "Move the credential to an environment variable, a .env file that is .gitignore'd, or a secrets manager (Vault, AWS Secrets Manager, GCP Secret Manager). Hardcoded credentials are the #1 source of secret leaks on GitHub. Reference: java/hardcoded-credential v0.30 (OWASP A07:2021 \u2014 Identification and Authentication Failures)."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/java/sql-string-concat.ts
+var SQL_KEYWORD_REGEX, UNSAFE_REGEX, SAFE_REGEX, javaSqlStringConcatRule;
+var init_sql_string_concat = __esm({
+  "src/rules/java/sql-string-concat.ts"() {
+    "use strict";
+    init_rule();
+    SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
+    UNSAFE_REGEX = /\+/;
+    SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?\s*,)/;
+    javaSqlStringConcatRule = createRule({
+      id: "java/sql-string-concat",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "SQL query built via string concat \u2014 use PreparedStatement or setParameter()",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        const lines = source.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i];
+          if (!SQL_KEYWORD_REGEX.test(line)) continue;
+          if (!UNSAFE_REGEX.test(line)) continue;
+          if (SAFE_REGEX.test(line)) continue;
+          issues.push({
+            ruleId: "java/sql-string-concat",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `SQL query built via string concat at line ${i + 1}`,
+            line: i + 1,
+            column: 1,
+            advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.30 (OWASP A03:2021).'
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/java/system-out-println.ts
+var SYSTEM_OUT_REGEX, REAL_LOGGING_IMPORT_REGEX, javaSystemOutPrintlnRule;
+var init_system_out_println = __esm({
+  "src/rules/java/system-out-println.ts"() {
+    "use strict";
+    init_rule();
+    SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
+    REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging|io\.github\.oshai\.kotlinlogging)/;
+    javaSystemOutPrintlnRule = createRule({
+      id: "java/system-out-println",
+      category: "logic",
+      severity: "low",
+      aiSpecific: false,
+      description: "System.out.println() used for logging \u2014 use SLF4J, Log4j2, or java.util.logging",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        if (REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
+        let m;
+        SYSTEM_OUT_REGEX.lastIndex = 0;
+        while ((m = SYSTEM_OUT_REGEX.exec(source)) !== null) {
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "java/system-out-println",
+            category: "logic",
+            severity: "low",
+            aiSpecific: false,
+            message: `System.out.println() at line ${line}`,
+            line,
+            column: 1,
+            advice: "Use a real logging library: SLF4J (the standard facade), Log4j2, or java.util.logging. System.out has no log level, no timestamp, no correlation ID, and cannot be filtered. Migration: add `private static final Logger log = LoggerFactory.getLogger(MyClass.class);` and replace `System.out.println(x)` with `log.info(x)`. Reference: java/system-out-println v0.30."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/java/thread-sleep-in-loop.ts
+var THREAD_SLEEP_REGEX, javaThreadSleepInLoopRule;
+var init_thread_sleep_in_loop = __esm({
+  "src/rules/java/thread-sleep-in-loop.ts"() {
+    "use strict";
+    init_rule();
+    THREAD_SLEEP_REGEX = /\bThread\.sleep\s*\(/g;
+    javaThreadSleepInLoopRule = createRule({
+      id: "java/thread-sleep-in-loop",
+      category: "perf",
+      severity: "medium",
+      aiSpecific: false,
+      description: "Thread.sleep() in a loop \u2014 use ScheduledExecutorService or BlockingQueue",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (!/\bThread\.sleep\s*\(/.test(source)) return issues;
+        if (!/\b(?:for|while|do)\b/.test(source)) return issues;
+        let m;
+        THREAD_SLEEP_REGEX.lastIndex = 0;
+        while ((m = THREAD_SLEEP_REGEX.exec(source)) !== null) {
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "java/thread-sleep-in-loop",
+            category: "perf",
+            severity: "medium",
+            aiSpecific: false,
+            message: `Thread.sleep() at line ${line}`,
+            line,
+            column: 1,
+            advice: 'Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the classic "polling with sleep" anti-pattern \u2014 the thread blocks for the sleep duration each iteration. In server contexts this ties up Tomcat/Jetty/Netty threads. Reference: java/thread-sleep-in-loop v0.30.'
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/kotlin/coroutine-global-scope.ts
 var GLOBAL_SCOPE_REGEX, kotlinCoroutineGlobalScopeRule;
 var init_coroutine_global_scope = __esm({
@@ -30749,6 +30989,115 @@ var init_data_class_defaults_overuse = __esm({
   }
 });
 
+// src/rules/kotlin/force-unwrap.ts
+var FORCE_UNWRAP_REGEX, kotlinForceUnwrapRule;
+var init_force_unwrap = __esm({
+  "src/rules/kotlin/force-unwrap.ts"() {
+    "use strict";
+    init_rule();
+    FORCE_UNWRAP_REGEX = /!!(?=\s*[.\)}\};,\n\[])/g;
+    kotlinForceUnwrapRule = createRule({
+      id: "kotlin/force-unwrap",
+      category: "logic",
+      severity: "medium",
+      aiSpecific: false,
+      description: "!! force-unwrap \u2014 use ?. (safe call) or a proper null check",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kts?$/i.test(facts.filePath)) return issues;
+        let m;
+        FORCE_UNWRAP_REGEX.lastIndex = 0;
+        while ((m = FORCE_UNWRAP_REGEX.exec(source)) !== null) {
+          const line = source.slice(0, m.index).split("\n").length;
+          const lineStart = source.lastIndexOf("\n", m.index) + 1;
+          const lineText = source.slice(lineStart, m.index);
+          const quoteCount = (lineText.match(/"/g) || []).length;
+          if (quoteCount % 2 === 1) continue;
+          issues.push({
+            ruleId: "kotlin/force-unwrap",
+            category: "logic",
+            severity: "medium",
+            aiSpecific: false,
+            message: `!! force-unwrap at line ${line}`,
+            line,
+            column: m.index - lineStart + 1,
+            advice: "Use ?. (safe call) with ?: (Elvis) for a default, or a proper when/if check. !! throws NullPointerException at runtime \u2014 it bypasses Kotlin's type system. Reference: kotlin/force-unwrap v0.29."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/kotlin/hardcoded-credential.ts
+var KEY_REGEX2, VALUE_REGEX2, FALSE_POSITIVES2, kotlinHardcodedCredentialRule;
+var init_hardcoded_credential2 = __esm({
+  "src/rules/kotlin/hardcoded-credential.ts"() {
+    "use strict";
+    init_rule();
+    KEY_REGEX2 = /\b(api[_-]?key|apikey|secret|token|password|auth|access[_-]?key|client[_-]?secret|private[_-]?key)\b\s*[=:]/i;
+    VALUE_REGEX2 = /["']([A-Za-z0-9_\-+/=.@*!]{16,})["']/;
+    FALSE_POSITIVES2 = /* @__PURE__ */ new Set([
+      "passwordless",
+      "tokenize",
+      "tokenizer",
+      "authorizationrequired",
+      "authenticated",
+      "authenticatortoken",
+      "authtoken",
+      "placeholder",
+      // common in test fixtures
+      "changeme"
+      // placeholder, but still suspicious — kept for review
+    ]);
+    kotlinHardcodedCredentialRule = createRule({
+      id: "kotlin/hardcoded-credential",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "Hardcoded credential literal \u2014 use env vars or a secrets manager",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kts?$/i.test(facts.filePath)) return issues;
+        const lines = source.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i];
+          if (!KEY_REGEX2.test(line)) continue;
+          const valueMatch = VALUE_REGEX2.exec(line);
+          if (!valueMatch) continue;
+          const value = valueMatch[1];
+          if (FALSE_POSITIVES2.has(value.toLowerCase())) continue;
+          if (!/[a-zA-Z]/.test(value) || !/[0-9]/.test(value)) continue;
+          if (value.startsWith("$")) continue;
+          if (/\/test\//i.test(facts.filePath) || /\.test\.kts?$/i.test(facts.filePath)) continue;
+          issues.push({
+            ruleId: "kotlin/hardcoded-credential",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `Hardcoded credential at line ${i + 1}`,
+            line: i + 1,
+            column: 1,
+            advice: "Move the credential to an environment variable, a .env file that is .gitignore'd, or a secrets manager (Vault, AWS Secrets Manager, GCP Secret Manager). Hardcoded credentials are the #1 source of secret leaks on GitHub. Reference: kotlin/hardcoded-credential v0.29 (OWASP A07:2021 \u2014 Identification and Authentication Failures)."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/kotlin/object-singleton-misuse.ts
 var OBJECT_DECL_REGEX, kotlinObjectSingletonMisuseRule;
 var init_object_singleton_misuse = __esm({
@@ -30806,13 +31155,58 @@ var init_object_singleton_misuse = __esm({
   }
 });
 
+// src/rules/kotlin/println-as-log.ts
+var PRINTLN_REGEX, REAL_LOGGING_IMPORT_REGEX2, kotlinPrintlnAsLogRule;
+var init_println_as_log = __esm({
+  "src/rules/kotlin/println-as-log.ts"() {
+    "use strict";
+    init_rule();
+    PRINTLN_REGEX = /\bprintln\s*\(/g;
+    REAL_LOGGING_IMPORT_REGEX2 = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
+    kotlinPrintlnAsLogRule = createRule({
+      id: "kotlin/println-as-log",
+      category: "logic",
+      severity: "low",
+      aiSpecific: false,
+      description: "println() used for logging \u2014 use slf4j, kermit, or android.util.Log",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kts?$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\.test\.kts?$/i.test(facts.filePath)) return issues;
+        if (REAL_LOGGING_IMPORT_REGEX2.test(source)) return issues;
+        let m;
+        PRINTLN_REGEX.lastIndex = 0;
+        while ((m = PRINTLN_REGEX.exec(source)) !== null) {
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "kotlin/println-as-log",
+            category: "logic",
+            severity: "low",
+            aiSpecific: false,
+            message: `println() as logger at line ${line}`,
+            line,
+            column: 1,
+            advice: "Use a real logging library: slf4j (JVM), android.util.Log (Android), Timber (Android), kermit (multiplatform), or kotlin-logging. println() has no log level, no timestamp, no correlation ID, and cannot be filtered. Reference: kotlin/println-as-log v0.29."
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/kotlin/println-debug.ts
-var PRINTLN_REGEX, DEFAULT_THRESHOLD, kotlinPrintlnDebugRule;
+var PRINTLN_REGEX2, DEFAULT_THRESHOLD, kotlinPrintlnDebugRule;
 var init_println_debug = __esm({
   "src/rules/kotlin/println-debug.ts"() {
     "use strict";
     init_rule();
-    PRINTLN_REGEX = /^\s*println\s*\(/gm;
+    PRINTLN_REGEX2 = /^\s*println\s*\(/gm;
     DEFAULT_THRESHOLD = 1;
     kotlinPrintlnDebugRule = createRule({
       id: "kotlin/println-debug",
@@ -30830,8 +31224,8 @@ var init_println_debug = __esm({
         if (!/\.kts?$/i.test(facts.filePath)) return issues;
         const matches = [];
         let m;
-        PRINTLN_REGEX.lastIndex = 0;
-        while ((m = PRINTLN_REGEX.exec(source)) !== null) {
+        PRINTLN_REGEX2.lastIndex = 0;
+        while ((m = PRINTLN_REGEX2.exec(source)) !== null) {
           matches.push(m.index);
         }
         if (matches.length <= context.threshold) return issues;
@@ -30856,13 +31250,102 @@ var init_println_debug = __esm({
   }
 });
 
+// src/rules/kotlin/runblocking-misuse.ts
+var RUN_BLOCKING_REGEX, kotlinRunBlockingMisuseRule;
+var init_runblocking_misuse = __esm({
+  "src/rules/kotlin/runblocking-misuse.ts"() {
+    "use strict";
+    init_rule();
+    RUN_BLOCKING_REGEX = /\brunBlocking\s*[({]/g;
+    kotlinRunBlockingMisuseRule = createRule({
+      id: "kotlin/runblocking-misuse",
+      category: "perf",
+      severity: "medium",
+      aiSpecific: false,
+      description: "runBlocking { ... } \u2014 blocks the calling thread; use coroutineScope {} or call suspend fun directly",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kts?$/i.test(facts.filePath)) return issues;
+        if (/\bfun\s+main\s*\(/.test(source)) return issues;
+        let m;
+        RUN_BLOCKING_REGEX.lastIndex = 0;
+        while ((m = RUN_BLOCKING_REGEX.exec(source)) !== null) {
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "kotlin/runblocking-misuse",
+            category: "perf",
+            severity: "medium",
+            aiSpecific: false,
+            message: `runBlocking { ... } at line ${line}`,
+            line,
+            column: 1,
+            advice: 'runBlocking blocks the calling thread, defeating the purpose of coroutines. Use coroutineScope { } for structured concurrency, or call the suspend function directly. The Kotlin coroutines docs: runBlocking "should rarely (if ever) be used outside of main()". Reference: kotlin/runblocking-misuse v0.29.'
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
+// src/rules/kotlin/sql-string-concat.ts
+var SQL_KEYWORD_REGEX2, UNSAFE_REGEX2, SAFE_REGEX2, kotlinSqlStringConcatRule;
+var init_sql_string_concat2 = __esm({
+  "src/rules/kotlin/sql-string-concat.ts"() {
+    "use strict";
+    init_rule();
+    SQL_KEYWORD_REGEX2 = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
+    UNSAFE_REGEX2 = /(?:\+|\$\{)/;
+    SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\\?\\?|\?\\s*,)/;
+    kotlinSqlStringConcatRule = createRule({
+      id: "kotlin/sql-string-concat",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "SQL query built via string concat / template \u2014 use PreparedStatement or setParameter()",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.kts?$/i.test(facts.filePath)) return issues;
+        const lines = source.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i];
+          if (!SQL_KEYWORD_REGEX2.test(line)) continue;
+          if (!UNSAFE_REGEX2.test(line)) continue;
+          if (SAFE_REGEX2.test(line)) continue;
+          issues.push({
+            ruleId: "kotlin/sql-string-concat",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `SQL query built via string concat/template at line ${i + 1}`,
+            line: i + 1,
+            column: 1,
+            advice: 'Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concatenation or template interpolation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: kotlin/sql-string-concat v0.29 (OWASP A03:2021).'
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/kotlin/string-concat-loop.ts
-var STRING_CONCAT_REGEX, kotlinStringConcatLoopRule;
+var STRING_CONCAT_REGEX2, kotlinStringConcatLoopRule;
 var init_string_concat_loop = __esm({
   "src/rules/kotlin/string-concat-loop.ts"() {
     "use strict";
     init_rule();
-    STRING_CONCAT_REGEX = /\b(\w+)\s*=\s*\1\s*\+\s*[^;}]+[;}\n]/g;
+    STRING_CONCAT_REGEX2 = /\b(\w+)\s*=\s*\1\s*\+\s*[^;}]+[;}\n]/g;
     kotlinStringConcatLoopRule = createRule({
       id: "kotlin/string-concat-loop",
       category: "perf",
@@ -30879,8 +31362,8 @@ var init_string_concat_loop = __esm({
         if (!/\.kts?$/i.test(facts.filePath)) return issues;
         if (!/\b(?:for|while|repeat|forEach)\b/.test(source)) return issues;
         let m;
-        STRING_CONCAT_REGEX.lastIndex = 0;
-        while ((m = STRING_CONCAT_REGEX.exec(source)) !== null) {
+        STRING_CONCAT_REGEX2.lastIndex = 0;
+        while ((m = STRING_CONCAT_REGEX2.exec(source)) !== null) {
           const line = source.slice(0, m.index).split("\n").length;
           const lineText = source.slice(0, m.index).split("\n").pop() ?? "";
           if (/\.append\s*\(/.test(lineText)) continue;
@@ -40440,7 +40923,7 @@ var init_fatal_error_thrown = __esm({
 
 // src/rules/swift/force-unwrap.ts
 var AS_FORCE_REGEX, ACCESS_FORCE_REGEX, TRY_FORCE_REGEX, swiftForceUnwrapRule;
-var init_force_unwrap = __esm({
+var init_force_unwrap2 = __esm({
   "src/rules/swift/force-unwrap.ts"() {
     "use strict";
     init_rule();
@@ -46299,10 +46782,20 @@ var init_builtins = __esm({
     init_error_wrap_without_context();
     init_nil_slice_vs_empty();
     init_struct_tag_inconsistency();
+    init_command_injection();
+    init_hardcoded_credential();
+    init_sql_string_concat();
+    init_system_out_println();
+    init_thread_sleep_in_loop();
     init_coroutine_global_scope();
     init_data_class_defaults_overuse();
+    init_force_unwrap();
+    init_hardcoded_credential2();
     init_object_singleton_misuse();
+    init_println_as_log();
     init_println_debug();
+    init_runblocking_misuse();
+    init_sql_string_concat2();
     init_string_concat_loop();
     init_gap_monopoly();
     init_math_element_uniformity();
@@ -46343,7 +46836,7 @@ var init_builtins = __esm({
     init_target_blank_no_noopener();
     init_unsafe_html_render();
     init_fatal_error_thrown();
-    init_force_unwrap();
+    init_force_unwrap2();
     init_implicitly_unwrapped_optional();
     init_print_debug();
     init_strong_self_capture();
@@ -46428,10 +46921,20 @@ var init_builtins = __esm({
       goErrorWrapWithoutContextRule,
       goNilSliceVsEmptyRule,
       goStructTagInconsistencyRule,
+      javaCommandInjectionRule,
+      javaHardcodedCredentialRule,
+      javaSqlStringConcatRule,
+      javaSystemOutPrintlnRule,
+      javaThreadSleepInLoopRule,
       kotlinCoroutineGlobalScopeRule,
       kotlinDataClassDefaultsOveruseRule,
+      kotlinForceUnwrapRule,
+      kotlinHardcodedCredentialRule,
       kotlinObjectSingletonMisuseRule,
+      kotlinPrintlnAsLogRule,
       kotlinPrintlnDebugRule,
+      kotlinRunBlockingMisuseRule,
+      kotlinSqlStringConcatRule,
       kotlinStringConcatLoopRule,
       gapMonopolyRule,
       mathElementUniformityRule,
@@ -50952,6 +51455,166 @@ var init_signal_strength = __esm({
         _v9Precision: 0.125,
         defaultOff: true
       },
+      "kotlin/sql-string-concat": {
+        recall: 469e-5,
+        fpRate: 63e-4,
+        ratio: 0.75,
+        precision: 0.0556,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.75 (DORMANT). 18 fires total \u2014 modern Kotlin mostly uses ORMs (Room/Exposed) so SQL string concat is rare in both arms. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: rule is loadable but invisible by default until v0.30 re-calibration with a larger pos arm.",
+        aiSpecific: false,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.75,
+        _v9Recall: 469e-5,
+        _v9FpRate: 63e-4,
+        _v9Precision: 0.0556,
+        defaultOff: true
+      },
+      "kotlin/hardcoded-credential": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). 0 fires. The 16-char value threshold + letters+digit heuristic is too strict for the corpus; real-world secrets are in env vars / config files, not source. INSUFFICIENT_DATA: needs different corpus (CI configs, .env samples). defaultOff: loadable but invisible by default.",
+        aiSpecific: false,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: true
+      },
+      "kotlin/runblocking-misuse": {
+        recall: 0.10798,
+        fpRate: 0.21534,
+        ratio: 0.5,
+        precision: 0.0381,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.50 \u2014 fires 2x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Kotlin coroutines used runBlocking more; modern Kotlin uses coroutineScope. Same direction as kotlin/coroutine-global-scope (0.09). defaultOff: loadable but invisible by default until v0.30 re-calibration.",
+        aiSpecific: false,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.5,
+        _v9Recall: 0.10798,
+        _v9FpRate: 0.21534,
+        _v9Precision: 0.0381,
+        defaultOff: true
+      },
+      "kotlin/println-as-log": {
+        recall: 0.08451,
+        fpRate: 0.04596,
+        ratio: 1.84,
+        precision: 0.1268,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=1.84 (\u22651.5) \u2014 first rule in this entire session with a positive direction! Fires 1.84x more on post-2024 AI/demos than pre-2022 production. Precision=12.7% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Kotlin code (especially AI-generated examples) uses println for output; pre-2022 production code uses slf4j/kermit. INSUFFICIENT_DATA: pos arm only 213 files. defaultOff: still set to true (verdict is OK but precision is below 50% \u2014 the guardrail expects OK/USEFUL rules to be defaultOff:false only when calibrated with a meaningful pos arm).",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 1.84,
+        _v9Recall: 0.08451,
+        _v9FpRate: 0.04596,
+        _v9Precision: 0.1268,
+        defaultOff: true
+      },
+      "kotlin/force-unwrap": {
+        recall: 0.11737,
+        fpRate: 0.33284,
+        ratio: 0.35,
+        precision: 0.0271,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.29: v9 Kotlin calibration (2698 neg, 213 pos). ratio=0.35 \u2014 fires 3x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Kotlin code uses !! freely; modern Kotlin relies on ?./?: and Result<T> wrappers. Stronger era signal than runblocking-misuse. defaultOff: loadable but invisible by default.",
+        aiSpecific: false,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.35,
+        _v9Recall: 0.11737,
+        _v9FpRate: 0.33284,
+        _v9Precision: 0.0271,
+        defaultOff: true
+      },
+      "java/sql-string-concat": {
+        recall: 0.01116,
+        fpRate: 0.01892,
+        ratio: 0.59,
+        precision: 0.0691,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.59 \u2014 fires 1.7x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. Same direction as kotlin/sql-string-concat. 1664 total fires \u2014 Java uses ORMs (Hibernate) heavily so SQL concat is rare in both arms. defaultOff.",
+        aiSpecific: false,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.59,
+        _v9Recall: 0.01116,
+        _v9FpRate: 0.01892,
+        _v9Precision: 0.0691,
+        defaultOff: true
+      },
+      "java/hardcoded-credential": {
+        recall: 0,
+        fpRate: 4e-5,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). 3 fires total \u2014 only in pre-2022 (neg). Real secrets are in env vars / config files, not source. INSUFFICIENT_DATA: needs different corpus (CI configs, .env samples, leaked-secret datasets). defaultOff.",
+        aiSpecific: false,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 4e-5,
+        _v9Precision: 0,
+        defaultOff: true
+      },
+      "java/thread-sleep-in-loop": {
+        recall: 0.0228,
+        fpRate: 0.02343,
+        ratio: 0.97,
+        precision: 0.1091,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.97 (just below 1.0) \u2014 fires equally on both arms. Borderline era-confound: pre-2022 Java had more Thread.sleep in loops (less mature concurrency APIs); modern Java uses ScheduledExecutorService. Same direction as kotlin/runblocking-misuse (0.50). 2154 total fires \u2014 high absolute count, meaningful measurement. defaultOff.",
+        aiSpecific: false,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0.97,
+        _v9Recall: 0.0228,
+        _v9FpRate: 0.02343,
+        _v9Precision: 0.1091,
+        defaultOff: true
+      },
+      "java/system-out-println": {
+        recall: 0.16681,
+        fpRate: 0.05064,
+        ratio: 3.29,
+        precision: 0.293,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=3.29 (\u22651.5) \u2014 second positive-signal rule in v9 history (after kotlin/println-as-log at 1.84). Fires 3.29x more on post-2024 (pos) AI code than pre-2022 (neg) production. 5866 total fires (highest of any v0.30 rule). Precision=29.3% (below 50% USEFUL threshold); verdict=OK. The signal is real: post-2024 Java (especially AI-generated examples) uses System.out for output; pre-2022 production uses slf4j. With 10k pos files, this is a production-grade measurement (vs kotlin/println-as-log's 213 files). defaultOff: still set true because the guardrail expects OK/USEFUL rules to be default-on only with sufficient precision. The v0.31+ re-calibration may flip this if precision improves.",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 3.29,
+        _v9Recall: 0.16681,
+        _v9FpRate: 0.05064,
+        _v9Precision: 0.293,
+        defaultOff: true
+      },
+      "java/command-injection": {
+        recall: 0,
+        fpRate: 1e-4,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "DORMANT",
+        _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). 8 fires total, all in neg. Command injection is rare in modern Java \u2014 most apps use ProcessBuilder with List<String> args, not Runtime.exec with concat. INSUFFICIENT_DATA: needs different corpus (security benchmarks, CVE samples). defaultOff.",
+        aiSpecific: false,
+        _v9Verdict: "DORMANT",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 1e-4,
+        _v9Precision: 0,
+        defaultOff: true
+      },
       "swift/force-unwrap": {
         recall: 0,
         fpRate: 0,
@@ -59085,6 +59748,18 @@ var RULE_HINTS = {
   "kotlin/println-debug": "Replace with `Timber.d(...)` or `android.util.Log`. `println` writes to stdout with no level, no redaction, can't be silenced in release builds. (v0.24.0 \u2014 DORMANT.)",
   "kotlin/object-singleton-misuse": "Replace with a class injected via DI, a Repository, or `MutableStateFlow`. The `object` keyword gives a thread-safe singleton handle, NOT thread-safe `var` fields. (v0.24.0 \u2014 DORMANT.)",
   "kotlin/string-concat-loop": "Wrap the loop in `buildString { append(...) }` or hoist a `StringBuilder`. Kotlin can't optimize `s = s + x` in a loop \u2014 O(n\xB2). (v0.24.0 \u2014 DORMANT.)",
+  // v0.29.0 — non-AI Kotlin rules (DORMANT until larger pos arm)
+  "kotlin/sql-string-concat": "Use a PreparedStatement (JDBC), setParameter() (Exposed), or an ORM (Room, jOOQ). String concat or template interpolation into a SQL query is the canonical SQL-injection pattern. OWASP A03:2021. (v0.29.0 \u2014 DORMANT.)",
+  "kotlin/hardcoded-credential": "Move the credential to an env var, a .env file (gitignored), or a secrets manager (Vault, AWS Secrets Manager). Hardcoded creds are the #1 secret-leak vector. OWASP A07:2021. (v0.29.0 \u2014 DORMANT.)",
+  "kotlin/runblocking-misuse": "Use coroutineScope { } for structured concurrency, or call the suspend function directly. runBlocking blocks the calling thread and is rarely correct outside main(). (v0.29.0 \u2014 DORMANT.)",
+  "kotlin/println-as-log": "Use slf4j (JVM), android.util.Log (Android), Timber, kermit, or kotlin-logging. println has no log level, no timestamp, no correlation ID. (v0.29.0 \u2014 OK; first positive-signal rule in v9 history, ratio 1.84.)",
+  "kotlin/force-unwrap": "Use ?. (safe call) with ?: (Elvis) for a default, or a proper when/if check. !! throws NullPointerException at runtime and bypasses Kotlin's type system. (v0.29.0 \u2014 DORMANT, era-confounded.)",
+  // v0.30.0 — non-AI Java rules (Option C applied to v9 Java corpus, 92k files)
+  "java/sql-string-concat": "Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{}). String concat into SQL is the canonical SQL-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT, ratio 0.59.)",
+  "java/hardcoded-credential": "Move the credential to an env var, a .env file (gitignored), or a secrets manager (Vault, AWS Secrets Manager). Hardcoded creds are the #1 secret-leak vector. OWASP A07:2021. (v0.30.0 \u2014 DORMANT, 0 fires on v9 Java corpus.)",
+  "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
+  "java/system-out-println": "Use SLF4J (the standard facade), Log4j2, or java.util.logging. System.out has no log level, no timestamp, no correlation ID. (v0.30.0 \u2014 OK; second positive-signal rule in v9 history, ratio 3.29.)",
+  "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
   "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",