@gulu9527/code-trust 0.3.0 → 0.3.1

package/dist/cli/index.js

@@ -128,33 +128,64 @@ import { fileURLToPath } from "url";
 
 // src/parsers/diff.ts
 import simpleGit from "simple-git";
+var GIT_DIFF_UNIFIED = "--unified=3";
+var SHORT_HASH_LENGTH = 7;
 var DiffParser = class {
   git;
   constructor(workDir) {
     this.git = simpleGit(workDir);
   }
   async getStagedFiles() {
-    const diffDetail = await this.git.diff(["--cached", "--unified=3"]);
+    const diffDetail = await this.git.diff(["--cached", GIT_DIFF_UNIFIED]);
     return this.parseDiffOutput(diffDetail);
   }
   async getDiffFromRef(ref) {
-    const diffDetail = await this.git.diff([ref, "--unified=3"]);
+    const diffDetail = await this.git.diff([ref, GIT_DIFF_UNIFIED]);
     return this.parseDiffOutput(diffDetail);
   }
   async getChangedFiles() {
-    const diffDetail = await this.git.diff(["--unified=3"]);
-    const stagedDetail = await this.git.diff(["--cached", "--unified=3"]);
-    const allDiff = diffDetail + "\n" + stagedDetail;
-    return this.parseDiffOutput(allDiff);
+    const diffDetail = await this.git.diff([GIT_DIFF_UNIFIED]);
+    const stagedDetail = await this.git.diff(["--cached", GIT_DIFF_UNIFIED]);
+    const unstagedFiles = this.parseDiffOutput(diffDetail);
+    const stagedFiles = this.parseDiffOutput(stagedDetail);
+    return this.mergeDiffFiles(unstagedFiles, stagedFiles);
+  }
+  /**
+   * Merge two sets of diff files, deduplicating by file path.
+   * When a file appears in both, merge their hunks and combine stats.
+   */
+  mergeDiffFiles(unstaged, staged) {
+    const fileMap = /* @__PURE__ */ new Map();
+    for (const file of unstaged) {
+      fileMap.set(file.filePath, file);
+    }
+    for (const file of staged) {
+      const existing = fileMap.get(file.filePath);
+      if (existing) {
+        fileMap.set(file.filePath, {
+          ...existing,
+          // Combine additions/deletions
+          additions: existing.additions + file.additions,
+          deletions: existing.deletions + file.deletions,
+          // Merge hunks (preserve order: staged first, then unstaged)
+          hunks: [...file.hunks, ...existing.hunks],
+          // Status: if either is 'added', treat as added; otherwise keep modified
+          status: existing.status === "added" || file.status === "added" ? "added" : "modified"
+        });
+      } else {
+        fileMap.set(file.filePath, file);
+      }
+    }
+    return Array.from(fileMap.values());
   }
   async getLastCommitDiff() {
-    const diffDetail = await this.git.diff(["HEAD~1", "HEAD", "--unified=3"]);
+    const diffDetail = await this.git.diff(["HEAD~1", "HEAD", GIT_DIFF_UNIFIED]);
     return this.parseDiffOutput(diffDetail);
   }
   async getCurrentCommitHash() {
     try {
       const hash = await this.git.revparse(["HEAD"]);
-      return hash.trim().slice(0, 7);
+      return hash.trim().slice(0, SHORT_HASH_LENGTH);
     } catch {
       return void 0;
     }
@@ -781,6 +812,9 @@ function analyzeFunctionNode(node) {
 function calculateCyclomaticComplexity(root) {
   let complexity = 1;
   walkAST(root, (n) => {
+    if (n.type === AST_NODE_TYPES.FunctionDeclaration || n.type === AST_NODE_TYPES.FunctionExpression || n.type === AST_NODE_TYPES.ArrowFunctionExpression || n.type === AST_NODE_TYPES.MethodDefinition) {
+      return false;
+    }
     switch (n.type) {
       case AST_NODE_TYPES.IfStatement:
       case AST_NODE_TYPES.ConditionalExpression:
@@ -809,6 +843,9 @@ function calculateCognitiveComplexity(root) {
   const depthMap = /* @__PURE__ */ new WeakMap();
   depthMap.set(root, 0);
   walkAST(root, (n, parent) => {
+    if (n.type === AST_NODE_TYPES.FunctionDeclaration || n.type === AST_NODE_TYPES.FunctionExpression || n.type === AST_NODE_TYPES.ArrowFunctionExpression || n.type === AST_NODE_TYPES.MethodDefinition) {
+      return false;
+    }
     const parentDepth = parent ? depthMap.get(parent) ?? 0 : 0;
     const isNesting = isNestingNode(n);
     const depth = isNesting ? parentDepth + 1 : parentDepth;
@@ -827,6 +864,9 @@ function calculateMaxNestingDepth(root) {
   const depthMap = /* @__PURE__ */ new WeakMap();
   depthMap.set(root, 0);
   walkAST(root, (n, parent) => {
+    if (n.type === AST_NODE_TYPES.FunctionDeclaration || n.type === AST_NODE_TYPES.FunctionExpression || n.type === AST_NODE_TYPES.ArrowFunctionExpression || n.type === AST_NODE_TYPES.MethodDefinition) {
+      return false;
+    }
     const parentDepth = parent ? depthMap.get(parent) ?? 0 : 0;
     const isNesting = n.type === AST_NODE_TYPES.IfStatement || n.type === AST_NODE_TYPES.ForStatement || n.type === AST_NODE_TYPES.ForInStatement || n.type === AST_NODE_TYPES.ForOfStatement || n.type === AST_NODE_TYPES.WhileStatement || n.type === AST_NODE_TYPES.DoWhileStatement || n.type === AST_NODE_TYPES.SwitchStatement || n.type === AST_NODE_TYPES.TryStatement;
     const currentDepth = isNesting ? parentDepth + 1 : parentDepth;
@@ -1008,14 +1048,19 @@ function stringifyCondition(node) {
     case AST_NODE_TYPES.Literal:
       return String(node.value);
     case AST_NODE_TYPES.BinaryExpression:
+      return `${stringifyCondition(node.left)} ${node.operator} ${stringifyCondition(node.right)}`;
     case AST_NODE_TYPES.LogicalExpression:
       return `${stringifyCondition(node.left)} ${node.operator} ${stringifyCondition(node.right)}`;
     case AST_NODE_TYPES.UnaryExpression:
       return `${node.operator}${stringifyCondition(node.argument)}`;
     case AST_NODE_TYPES.MemberExpression:
       return `${stringifyCondition(node.object)}.${stringifyCondition(node.property)}`;
-    case AST_NODE_TYPES.CallExpression:
-      return `${stringifyCondition(node.callee)}(...)`;
+    case AST_NODE_TYPES.CallExpression: {
+      const args = node.arguments.map((arg) => stringifyCondition(arg)).join(", ");
+      return `${stringifyCondition(node.callee)}(${args})`;
+    }
+    case AST_NODE_TYPES.ConditionalExpression:
+      return `${stringifyCondition(node.test)} ? ${stringifyCondition(node.consequent)} : ${stringifyCondition(node.alternate)}`;
     default:
       return `[${node.type}]`;
   }
@@ -1176,9 +1221,11 @@ var securityRules = [
       const issues = [];
       const lines = context.fileContent.split("\n");
       for (let i = 0; i < lines.length; i++) {
-        const trimmed = lines[i].trim();
+        const line = lines[i];
+        const trimmed = line.trim();
         if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
-        if (/\.(innerHTML|outerHTML)\s*=/.test(lines[i]) || /dangerouslySetInnerHTML/.test(lines[i])) {
+        const cleaned = line.replace(/(['"`])(?:(?!\1|\\).|\\.)*\1/g, '""').replace(/\/\/.*$/, "").replace(/\/[^/]+\/[dgimsuvy]*/g, '""');
+        if (/\.(innerHTML|outerHTML)\s*=/.test(cleaned) || /dangerouslySetInnerHTML/.test(cleaned)) {
           issues.push({
             ruleId: "security/dangerous-html",
             severity: "medium",
@@ -1706,6 +1753,9 @@ var missingAwaitRule = {
       const body = getFunctionBody(node);
       if (!body) return;
       walkAST(body, (inner, parent) => {
+        if (inner.type === AST_NODE_TYPES.ArrowFunctionExpression) {
+          return;
+        }
         if (inner !== body && isAsyncFunction(inner)) return false;
         if (inner.type !== AST_NODE_TYPES.CallExpression) return;
         if (parent?.type === AST_NODE_TYPES.AwaitExpression) return;
@@ -1715,6 +1765,9 @@ var missingAwaitRule = {
         if (parent?.type === AST_NODE_TYPES.AssignmentExpression) return;
         if (parent?.type === AST_NODE_TYPES.ArrayExpression) return;
         if (parent?.type === AST_NODE_TYPES.CallExpression && parent !== inner) return;
+        if (parent?.type === AST_NODE_TYPES.ArrowFunctionExpression) {
+          return;
+        }
         const callName = getCallName(inner);
         if (!callName) return;
         if (!asyncFuncNames.has(callName)) return;
@@ -1926,9 +1979,28 @@ var typeCoercionRule = {
 var ALLOWED_NUMBERS = /* @__PURE__ */ new Set([
   -1,
   0,
+  0.1,
+  0.1,
+  0.15,
+  0.2,
+  0.2,
+  0.25,
+  0.3,
+  0.3,
+  0.5,
   1,
   2,
+  3,
+  4,
+  5,
   10,
+  15,
+  20,
+  30,
+  40,
+  50,
+  70,
+  90,
   100
 ]);
 var magicNumberRule = {
@@ -1957,6 +2029,7 @@ var magicNumberRule = {
       if (/^\s*(export\s+)?enum\s/.test(line)) continue;
       if (trimmed.startsWith("import ")) continue;
       if (/^\s*return\s+[0-9]+\s*;?\s*$/.test(line)) continue;
+      if (/^\s*['"]?[-\w]+['"]?\s*:\s*-?\d+\.?\d*(?:e[+-]?\d+)?\s*,?\s*$/.test(trimmed)) continue;
       const cleaned = line.replace(/(['"`])(?:(?!\1|\\).|\\.)*\1/g, '""').replace(/\/\/.*$/, "");
       const numRegex = /(?<![.\w])(-?\d+\.?\d*(?:e[+-]?\d+)?)\b/gi;
       let match;
@@ -2053,6 +2126,17 @@ var nestedTernaryRule = {
 // src/rules/builtin/duplicate-string.ts
 var MIN_STRING_LENGTH = 6;
 var MIN_OCCURRENCES = 3;
+var IGNORED_LITERALS = /* @__PURE__ */ new Set([
+  "high",
+  "medium",
+  "low",
+  "info",
+  "logic",
+  "security",
+  "structure",
+  "style",
+  "coverage"
+]);
 var duplicateStringRule = {
   id: "logic/duplicate-string",
   category: "logic",
@@ -2083,6 +2167,7 @@ var duplicateStringRule = {
       while ((match = stringRegex.exec(cleaned)) !== null) {
         const value = match[2];
         if (value.length < MIN_STRING_LENGTH) continue;
+        if (IGNORED_LITERALS.has(value)) continue;
         if (value.includes("${")) continue;
         if (value.startsWith("http") || value.startsWith("/")) continue;
         if (value.startsWith("test") || value.startsWith("mock")) continue;
@@ -2352,13 +2437,28 @@ var promiseVoidRule = {
       /^save/,
       /^load/,
       /^send/,
-      /^delete/,
       /^update/,
       /^create/,
       /^connect/,
       /^disconnect/,
       /^init/
     ];
+    const syncMethods = [
+      "delete",
+      // Map.delete(), Set.delete(), Object.delete() are synchronous
+      "has",
+      // Map.has(), Set.has() are synchronous
+      "get",
+      // Map.get() is synchronous
+      "set",
+      // Map.set() is synchronous (though some consider it potentially async)
+      "keys",
+      // Object.keys() is synchronous
+      "values",
+      // Object.values() is synchronous
+      "entries"
+      // Object.entries() is synchronous
+    ];
     walkAST(ast, (node) => {
       if (node.type !== AST_NODE_TYPES.ExpressionStatement) return;
       const expr = node.expression;
@@ -2369,6 +2469,7 @@ var promiseVoidRule = {
       const isKnownAsync = asyncFnNames.has(fnName);
       const matchesPattern = commonAsyncPatterns.some((p) => p.test(fnName));
       const endsWithAsync = fnName.endsWith("Async") || fnName.endsWith("async");
+      if (syncMethods.includes(fnName)) return;
       if (!isKnownAsync && !matchesPattern && !endsWithAsync) return;
       const line = node.loc?.start.line ?? 0;
       if (line === 0) return;
@@ -3120,7 +3221,11 @@ var ScanEngine = class {
       }
     }
     const issuesWithFingerprints = this.attachFingerprints(allIssues);
-    const dimensions = this.groupByDimension(issuesWithFingerprints);
+    const baseline = await this.loadBaseline(options.baseline);
+    const issuesWithLifecycle = this.attachLifecycle(issuesWithFingerprints, baseline);
+    const fixedIssues = this.getFixedIssues(issuesWithLifecycle, baseline);
+    const lifecycle = this.buildLifecycleSummary(issuesWithLifecycle, fixedIssues, baseline);
+    const dimensions = this.groupByDimension(issuesWithLifecycle);
     const overallScore = calculateOverallScore(dimensions, this.config.weights);
     const grade = getGrade(overallScore);
     const commitHash = await this.diffParser.getCurrentCommitHash();
@@ -3134,7 +3239,7 @@ var ScanEngine = class {
         score: overallScore,
         grade,
         filesScanned,
-        issuesFound: issuesWithFingerprints.length
+        issuesFound: issuesWithLifecycle.length
       },
       toolHealth: {
         rulesExecuted,
@@ -3147,70 +3252,75 @@ var ScanEngine = class {
         ruleFailures
       },
       dimensions,
-      issues: issuesWithFingerprints.sort((a, b) => {
+      issues: issuesWithLifecycle.sort((a, b) => {
         const severityOrder = { high: 0, medium: 1, low: 2, info: 3 };
         return severityOrder[a.severity] - severityOrder[b.severity];
-      })
+      }),
+      lifecycle,
+      fixedIssues
     };
   }
   async scanFile(diffFile) {
     if (diffFile.status === "deleted") {
-      return {
-        issues: [],
-        ruleFailures: [],
-        rulesExecuted: 0,
-        rulesFailed: 0,
-        scanErrors: [
-          {
-            type: "deleted-file",
-            file: diffFile.filePath,
-            message: `Skipped deleted file: ${diffFile.filePath}`
-          }
-        ],
-        scanned: false
-      };
+      return this.createSkippedResult(diffFile, "deleted-file", `Skipped deleted file: ${diffFile.filePath}`);
     }
     if (!this.isTsJsFile(diffFile.filePath)) {
-      return {
-        issues: [],
-        ruleFailures: [],
-        rulesExecuted: 0,
-        rulesFailed: 0,
-        scanErrors: [
-          {
-            type: "unsupported-file-type",
-            file: diffFile.filePath,
-            message: `Skipped unsupported file type: ${diffFile.filePath}`
-          }
-        ],
-        scanned: false
-      };
+      return this.createSkippedResult(diffFile, "unsupported-file-type", `Skipped unsupported file type: ${diffFile.filePath}`);
     }
+    const fileContent = await this.readFileContent(diffFile);
+    if (!fileContent) {
+      return this.createErrorResult(diffFile, "missing-file-content", `Unable to read file content for ${diffFile.filePath}`);
+    }
+    const addedLines = this.extractAddedLines(diffFile);
+    const ruleResult = this.ruleEngine.runWithDiagnostics({
+      filePath: diffFile.filePath,
+      fileContent,
+      addedLines
+    });
+    const issues = [...ruleResult.issues];
+    issues.push(...this.runStructureAnalysis(fileContent, diffFile.filePath));
+    issues.push(...analyzeStyle(fileContent, diffFile.filePath).issues);
+    issues.push(...analyzeCoverage(fileContent, diffFile.filePath).issues);
+    return {
+      issues,
+      ruleFailures: ruleResult.ruleFailures,
+      rulesExecuted: ruleResult.rulesExecuted,
+      rulesFailed: ruleResult.rulesFailed,
+      scanErrors: [],
+      scanned: true
+    };
+  }
+  createSkippedResult(diffFile, type, message) {
+    return {
+      issues: [],
+      ruleFailures: [],
+      rulesExecuted: 0,
+      rulesFailed: 0,
+      scanErrors: [{ type, file: diffFile.filePath, message }],
+      scanned: false
+    };
+  }
+  createErrorResult(diffFile, type, message) {
+    return {
+      issues: [],
+      ruleFailures: [],
+      rulesExecuted: 0,
+      rulesFailed: 0,
+      scanErrors: [{ type, file: diffFile.filePath, message }],
+      scanned: false
+    };
+  }
+  async readFileContent(diffFile) {
     const filePath = resolve2(diffFile.filePath);
-    let fileContent;
     try {
-      fileContent = await readFile(filePath, "utf-8");
+      return await readFile(filePath, "utf-8");
     } catch {
       const content = await this.diffParser.getFileContent(diffFile.filePath);
-      if (!content) {
-        return {
-          issues: [],
-          ruleFailures: [],
-          rulesExecuted: 0,
-          rulesFailed: 0,
-          scanErrors: [
-            {
-              type: "missing-file-content",
-              file: diffFile.filePath,
-              message: `Unable to read file content for ${diffFile.filePath}`
-            }
-          ],
-          scanned: false
-        };
-      }
-      fileContent = content;
+      return content ?? null;
     }
-    const addedLines = diffFile.hunks.flatMap((hunk) => {
+  }
+  extractAddedLines(diffFile) {
+    return diffFile.hunks.flatMap((hunk) => {
       const lines = hunk.content.split("\n");
       const result = [];
       let currentLine = hunk.newStart;
@@ -3225,32 +3335,15 @@ var ScanEngine = class {
       }
       return result;
     });
-    const ruleResult = this.ruleEngine.runWithDiagnostics({
-      filePath: diffFile.filePath,
-      fileContent,
-      addedLines
-    });
-    const issues = [...ruleResult.issues];
-    const structureResult = analyzeStructure(fileContent, diffFile.filePath, {
+  }
+  runStructureAnalysis(fileContent, filePath) {
+    return analyzeStructure(fileContent, filePath, {
       maxCyclomaticComplexity: this.config.thresholds["max-cyclomatic-complexity"],
       maxCognitiveComplexity: this.config.thresholds["max-cognitive-complexity"],
       maxFunctionLength: this.config.thresholds["max-function-length"],
       maxNestingDepth: this.config.thresholds["max-nesting-depth"],
       maxParamCount: this.config.thresholds["max-params"]
-    });
-    issues.push(...structureResult.issues);
-    const styleResult = analyzeStyle(fileContent, diffFile.filePath);
-    issues.push(...styleResult.issues);
-    const coverageResult = analyzeCoverage(fileContent, diffFile.filePath);
-    issues.push(...coverageResult.issues);
-    return {
-      issues,
-      ruleFailures: ruleResult.ruleFailures,
-      rulesExecuted: ruleResult.rulesExecuted,
-      rulesFailed: ruleResult.rulesFailed,
-      scanErrors: [],
-      scanned: true
-    };
+    }).issues;
   }
   async getScanCandidates(options) {
     const scanMode = this.getScanMode(options);
@@ -3291,7 +3384,7 @@ var ScanEngine = class {
     }
     return "changed";
   }
-  async getDiffFiles(options) {
+  getDiffFiles(options) {
     if (options.staged) {
       return this.diffParser.getStagedFiles();
     }
@@ -3372,6 +3465,96 @@ var ScanEngine = class {
     const relativePath = relative(process.cwd(), absolutePath) || filePath;
     return relativePath.split(sep).join("/");
   }
+  async loadBaseline(baselinePath) {
+    if (!baselinePath) {
+      return void 0;
+    }
+    const baselineContent = await readFile(resolve2(baselinePath), "utf-8");
+    const parsed = JSON.parse(baselineContent);
+    const issues = this.parseBaselineIssues(parsed.issues);
+    return {
+      issues,
+      fingerprintSet: new Set(issues.map((issue) => issue.fingerprint)),
+      commit: typeof parsed.commit === "string" ? parsed.commit : void 0,
+      timestamp: typeof parsed.timestamp === "string" ? parsed.timestamp : void 0
+    };
+  }
+  parseBaselineIssues(input) {
+    if (!Array.isArray(input)) {
+      return [];
+    }
+    return input.flatMap((item) => {
+      const issue = this.parseBaselineIssue(item);
+      return issue ? [issue] : [];
+    });
+  }
+  parseBaselineIssue(input) {
+    if (!input || typeof input !== "object") {
+      return void 0;
+    }
+    const issue = input;
+    if (!this.isValidBaselineIssue(issue)) {
+      return void 0;
+    }
+    return {
+      ruleId: issue.ruleId,
+      severity: issue.severity,
+      category: issue.category,
+      file: issue.file,
+      startLine: issue.startLine,
+      endLine: issue.endLine,
+      message: issue.message,
+      fingerprint: issue.fingerprint,
+      fingerprintVersion: typeof issue.fingerprintVersion === "string" ? issue.fingerprintVersion : void 0
+    };
+  }
+  isValidBaselineIssue(issue) {
+    return typeof issue.ruleId === "string" && this.isSeverity(issue.severity) && this.isRuleCategory(issue.category) && typeof issue.file === "string" && typeof issue.startLine === "number" && typeof issue.endLine === "number" && typeof issue.message === "string" && typeof issue.fingerprint === "string";
+  }
+  attachLifecycle(issues, baseline) {
+    if (!baseline) {
+      return issues;
+    }
+    return issues.map((issue) => ({
+      ...issue,
+      lifecycle: baseline.fingerprintSet.has(issue.fingerprint) ? "existing" : "new"
+    }));
+  }
+  getFixedIssues(issues, baseline) {
+    if (!baseline) {
+      return [];
+    }
+    const currentFingerprints = new Set(issues.map((issue) => issue.fingerprint));
+    return baseline.issues.filter((issue) => !currentFingerprints.has(issue.fingerprint));
+  }
+  buildLifecycleSummary(issues, fixedIssues, baseline) {
+    if (!baseline) {
+      return void 0;
+    }
+    let newIssues = 0;
+    let existingIssues = 0;
+    for (const issue of issues) {
+      if (issue.lifecycle === "existing") {
+        existingIssues++;
+      } else {
+        newIssues++;
+      }
+    }
+    return {
+      newIssues,
+      existingIssues,
+      fixedIssues: fixedIssues.length,
+      baselineUsed: true,
+      baselineCommit: baseline.commit,
+      baselineTimestamp: baseline.timestamp
+    };
+  }
+  isSeverity(value) {
+    return value === "high" || value === "medium" || value === "low" || value === "info";
+  }
+  isRuleCategory(value) {
+    return ["security", "logic", "structure", "style", "coverage"].includes(value);
+  }
   groupByDimension(issues) {
     const categories = [
       "security",
@@ -3406,7 +3589,9 @@ var en = {
   healthHeader: "Tool Health",
   rulesFailed: "Failed rules: {{count}}",
   filesSkipped: "Skipped files: {{count}}",
-  filesExcluded: "Excluded files: {{count}}"
+  filesExcluded: "Excluded files: {{count}}",
+  lifecycleHeader: "Lifecycle",
+  lifecycleSummary: "New: {{new}}  Existing: {{existing}}  Fixed: {{fixed}}"
 };
 var zh = {
   reportTitle: "\u{1F4CA} CodeTrust \u62A5\u544A",
@@ -3422,7 +3607,9 @@ var zh = {
   healthHeader: "\u5DE5\u5177\u5065\u5EB7\u5EA6",
   rulesFailed: "\u5931\u8D25\u89C4\u5219\u6570\uFF1A{{count}}",
   filesSkipped: "\u8DF3\u8FC7\u6587\u4EF6\u6570\uFF1A{{count}}",
-  filesExcluded: "\u6392\u9664\u6587\u4EF6\u6570\uFF1A{{count}}"
+  filesExcluded: "\u6392\u9664\u6587\u4EF6\u6570\uFF1A{{count}}",
+  lifecycleHeader: "\u751F\u547D\u5468\u671F",
+  lifecycleSummary: "\u65B0\u589E\uFF1A{{new}}  \u5DF2\u5B58\u5728\uFF1A{{existing}}  \u5DF2\u4FEE\u590D\uFF1A{{fixed}}"
 };
 function renderTerminalReport(report) {
   const isZh = isZhLocale();
@@ -3490,6 +3677,11 @@ function renderTerminalReport(report) {
     }
     lines.push("");
   }
+  if (report.lifecycle) {
+    lines.push(pc.bold(t2.lifecycleHeader));
+    lines.push(`  ${t2.lifecycleSummary.replace("{{new}}", String(report.lifecycle.newIssues)).replace("{{existing}}", String(report.lifecycle.existingIssues)).replace("{{fixed}}", String(report.lifecycle.fixedIssues))}`);
+    lines.push("");
+  }
   if (report.issues.length > 0) {
     lines.push(pc.bold(t2.issuesHeader.replace("{{count}}", String(report.issues.length))));
     lines.push("");
@@ -3562,14 +3754,16 @@ function renderJsonReport(report) {
     overall: report.overall,
     toolHealth: report.toolHealth,
     dimensions: report.dimensions,
-    issues: report.issues
+    issues: report.issues,
+    lifecycle: report.lifecycle,
+    fixedIssues: report.fixedIssues
   };
   return JSON.stringify(payload, null, 2);
 }
 
 // src/cli/commands/scan.ts
 function createScanCommand() {
-  const cmd = new Command("scan").description("Run the primary live trust analysis command").argument("[files...]", "Specific files to scan").option("--staged", "Scan only git staged files").option("--diff <ref>", "Scan diff against a git ref (e.g. HEAD~1, origin/main)").option("--format <format>", "Output format: terminal, json", "terminal").option("--min-score <score>", "Minimum trust score threshold", "0").action(async (files, opts) => {
+  const cmd = new Command("scan").description("Run the primary live trust analysis command").argument("[files...]", "Specific files to scan").option("--staged", "Scan only git staged files").option("--diff <ref>", "Scan diff against a git ref (e.g. HEAD~1, origin/main)").option("--format <format>", "Output format: terminal, json", "terminal").option("--min-score <score>", "Minimum trust score threshold", "0").option("--baseline <path>", "Compare current findings against a prior CodeTrust JSON report").action(async (files, opts) => {
     try {
       const config = await loadConfig();
       const engine = new ScanEngine(config);
@@ -3578,7 +3772,8 @@ function createScanCommand() {
         diff: opts.diff,
         files: files.length > 0 ? files : void 0,
         format: opts.format,
-        minScore: parseInt(opts.minScore, 10)
+        minScore: parseInt(opts.minScore, 10),
+        baseline: opts.baseline
       };
       const report = await engine.scan(scanOptions);
       if (opts.format === "json") {