@sentriflow/cli 0.1.5 → 0.1.7

package/dist/index.js

@@ -9975,6 +9975,7 @@ var JsonRuleCompiler = class {
       id: jsonRule.id,
       selector: jsonRule.selector,
       vendor: jsonRule.vendor,
+      category: jsonRule.category,
       metadata: jsonRule.metadata,
       check: (node, _ctx) => {
         const passed = !this.evaluateCheck(jsonRule.check, node);
@@ -10407,7 +10408,7 @@ function generateSarif(results, filePath, rules, options = {}) {
         tool: {
           driver: {
             name: "Sentriflow",
-            version: "0.1.5",
+            version: "0.1.7",
             informationUri: "https://github.com/sentriflow/sentriflow",
             rules: sarifRules,
             // SEC-007: Include CWE taxonomy when rules reference it
@@ -10513,7 +10514,7 @@ function generateMultiFileSarif(fileResults, rules, options = {}) {
         tool: {
           driver: {
             name: "Sentriflow",
-            version: "0.1.5",
+            version: "0.1.7",
             informationUri: "https://github.com/sentriflow/sentriflow",
             rules: sarifRules,
             // SEC-007: Include CWE taxonomy when rules reference it
@@ -10556,10 +10557,12 @@ var NoMulticastBroadcastIp = {
   id: "NET-IP-001",
   selector: "ip address",
   vendor: "common",
+  category: "IP-Addressing",
   metadata: {
     level: "error",
     obu: "Network Engineering",
     owner: "NetOps",
+    description: "Ensure IP addresses are not Multicast, Broadcast, or Network ID addresses.",
     remediation: "Configure a valid unicast IP address. Do not use Multicast, Broadcast, or Network ID addresses."
   },
   check: (node) => {
@@ -10669,10 +10672,12 @@ var InterfaceDescriptionRequired = {
   id: "NET-DOC-001",
   selector: "interface",
   vendor: "common",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
     owner: "NetOps",
+    description: "Ensure interfaces have descriptive labels for operational clarity.",
     remediation: 'Add a description to the interface using the "description" command.'
   },
   check: (node) => {
@@ -10750,6 +10755,7 @@ var TrunkNoDTP = {
   id: "NET-TRUNK-001",
   selector: "interface",
   vendor: "cisco-ios",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -10783,6 +10789,7 @@ var AccessExplicitMode = {
   id: "NET-ACCESS-001",
   selector: "interface",
   vendor: "cisco-ios",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -10812,6 +10819,7 @@ var EnableSecretStrong = {
   id: "NET-AAA-003",
   selector: "enable",
   vendor: "cisco-ios",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -10848,6 +10856,7 @@ var CiscoNoPlaintextPasswords = {
   id: "NET-SEC-001",
   selector: "password",
   vendor: ["cisco-ios", "cisco-nxos"],
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -10935,6 +10944,7 @@ var RootAuthRequired = {
   id: "JUN-SYS-001",
   selector: "system",
   vendor: "juniper-junos",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -10979,6 +10989,7 @@ var JunosBgpRouterId = {
   id: "JUN-BGP-001",
   selector: "routing-options",
   vendor: "juniper-junos",
+  category: "Routing",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11011,6 +11022,7 @@ var JunosFirewallDefaultDeny = {
   id: "JUN-FW-001",
   selector: "firewall",
   vendor: "juniper-junos",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -11082,6 +11094,7 @@ var SshEnabled = {
   id: "ARU-SEC-001",
   selector: "ssh",
   vendor: ["aruba-aoscx", "aruba-aosswitch", "aruba-wlc"],
+  category: "Session-Management",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11114,6 +11127,7 @@ var NtpConfigured = {
   id: "ARU-NTP-001",
   selector: "ntp",
   vendor: ["aruba-aoscx", "aruba-aosswitch", "aruba-wlc"],
+  category: "Time-Synchronization",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11154,6 +11168,7 @@ var AosCxInterfaceDescription = {
   id: "AOSCX-IF-001",
   selector: "interface",
   vendor: "aruba-aoscx",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11195,6 +11210,7 @@ var AosCxTrunkAllowedVlans = {
   id: "AOSCX-L2-001",
   selector: "interface",
   vendor: "aruba-aoscx",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11245,6 +11261,7 @@ var AosSwitchVlanName = {
   id: "AOSSW-L2-001",
   selector: "vlan",
   vendor: "aruba-aosswitch",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11286,6 +11303,7 @@ var AosSwitchManagerPassword = {
   id: "AOSSW-SEC-001",
   selector: "password",
   vendor: "aruba-aosswitch",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11326,6 +11344,7 @@ var WlcSsidEncryption = {
   id: "ARUWLC-WLAN-001",
   selector: "wlan ssid-profile",
   vendor: "aruba-wlc",
+  category: "Wireless",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11379,6 +11398,7 @@ var WlcRadiusHost = {
   id: "ARUWLC-AAA-001",
   selector: "aaa authentication-server radius",
   vendor: "aruba-wlc",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11440,6 +11460,7 @@ var HostnameRequired = {
   id: "PAN-SYS-001",
   selector: "deviceconfig",
   vendor: "paloalto-panos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11483,6 +11504,7 @@ var SecurityRuleLogging = {
   id: "PAN-SEC-001",
   selector: "rulebase",
   vendor: "paloalto-panos",
+  category: "Logging",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -11533,6 +11555,7 @@ var ZoneProtectionRequired = {
   id: "PAN-ZONE-001",
   selector: "zone",
   vendor: "paloalto-panos",
+  category: "Network-Segmentation",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11595,6 +11618,7 @@ var HostnameRequired2 = {
   id: "ARI-SYS-001",
   selector: "hostname",
   vendor: "arista-eos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11629,6 +11653,7 @@ var MlagConfigComplete = {
   id: "ARI-MLAG-001",
   selector: "mlag configuration",
   vendor: "arista-eos",
+  category: "High-Availability",
   metadata: {
     level: "error",
     obu: "Network Engineering",
@@ -11674,6 +11699,7 @@ var InterfaceDescription = {
   id: "ARI-INT-001",
   selector: "interface Ethernet",
   vendor: "arista-eos",
+  category: "Documentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -11731,6 +11757,7 @@ var VyosHostnameRequired = {
   id: "VYOS-SYS-001",
   selector: "system",
   vendor: "vyos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11763,6 +11790,7 @@ var VyosNoPlaintextPassword = {
   id: "VYOS-SEC-001",
   selector: "authentication",
   vendor: "vyos",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11797,6 +11825,7 @@ var VyosInterfaceDescription = {
   id: "VYOS-IF-001",
   selector: "interfaces",
   vendor: "vyos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11840,6 +11869,7 @@ var VyosFirewallDefaultAction = {
   id: "VYOS-FW-001",
   selector: "firewall",
   vendor: "vyos",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -11907,6 +11937,7 @@ var HostnameRequired3 = {
   id: "FGT-SYS-001",
   selector: "config system global",
   vendor: "fortinet-fortigate",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11939,6 +11970,7 @@ var AdminTrustedHostRequired = {
   id: "FGT-ADMIN-001",
   selector: "config system admin",
   vendor: "fortinet-fortigate",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11993,6 +12025,7 @@ var PolicyLoggingRequired = {
   id: "FGT-POL-001",
   selector: "config firewall policy",
   vendor: "fortinet-fortigate",
+  category: "Logging",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -12059,6 +12092,7 @@ var ExosSysnameRequired = {
   id: "EXOS-SYS-001",
   selector: "configure snmp sysname",
   vendor: "extreme-exos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12092,6 +12126,7 @@ var ExosSsh2Enabled = {
   id: "EXOS-SEC-001",
   selector: "enable ssh2",
   vendor: "extreme-exos",
+  category: "Session-Management",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -12123,6 +12158,7 @@ var ExosVlanNaming = {
   id: "EXOS-VLAN-001",
   selector: "create vlan",
   vendor: "extreme-exos",
+  category: "Documentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -12179,6 +12215,7 @@ var VossSysNameRequired = {
   id: "VOSS-SYS-001",
   selector: "snmp-server name",
   vendor: "extreme-voss",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12212,6 +12249,7 @@ var VossVlanIsidRequired = {
   id: "VOSS-VLAN-001",
   selector: "vlan create",
   vendor: "extreme-voss",
+  category: "Network-Segmentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -12264,6 +12302,7 @@ var VossInterfaceDefaultVlan = {
   id: "VOSS-INT-001",
   selector: "interface GigabitEthernet",
   vendor: "extreme-voss",
+  category: "Network-Segmentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -12348,6 +12387,7 @@ var SysnameRequired = {
   id: "HUAWEI-SYS-001",
   selector: "sysname",
   vendor: "huawei-vrp",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12380,6 +12420,7 @@ var InterfaceDescriptionRequired2 = {
   id: "HUAWEI-IF-001",
   selector: "interface",
   vendor: "huawei-vrp",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12432,6 +12473,7 @@ var VtySshRequired = {
   id: "HUAWEI-VTY-002",
   selector: "user-interface vty",
   vendor: "huawei-vrp",
+  category: "Session-Management",
   metadata: {
     level: "error",
     obu: "Security",
@@ -12496,6 +12538,7 @@ var MikrotikSystemIdentity = {
   id: "MIK-SYS-001",
   selector: "/system identity",
   vendor: "mikrotik-routeros",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12528,6 +12571,7 @@ var MikrotikDisableUnusedServices = {
   id: "MIK-SEC-001",
   selector: "/ip service",
   vendor: "mikrotik-routeros",
+  category: "Service-Hardening",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -12572,6 +12616,7 @@ var MikrotikInputChainDrop = {
   id: "MIK-FW-001",
   selector: "/ip firewall filter",
   vendor: "mikrotik-routeros",
+  category: "Network-Segmentation",
   metadata: {
     level: "error",
     obu: "Security",
@@ -12625,6 +12670,7 @@ var SystemNameRequired = {
   id: "NOKIA-SYS-001",
   selector: "system",
   vendor: "nokia-sros",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12657,6 +12703,7 @@ var PortDescriptionRequired = {
   id: "NOKIA-PORT-001",
   selector: "port",
   vendor: "nokia-sros",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12709,6 +12756,7 @@ var BgpRouterIdRequired = {
   id: "NOKIA-BGP-001",
   selector: "bgp",
   vendor: "nokia-sros",
+  category: "Routing",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12765,6 +12813,7 @@ var CumulusInterfaceDescription = {
   id: "CUM-IF-001",
   selector: "iface",
   vendor: "cumulus-linux",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12807,6 +12856,7 @@ var CumulusBridgeVlans = {
   id: "CUM-BR-001",
   selector: "iface",
   vendor: "cumulus-linux",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12859,6 +12909,7 @@ var CumulusBgpRouterId = {
   id: "CUM-BGP-001",
   selector: "router bgp",
   vendor: "cumulus-linux",
+  category: "Routing",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12915,6 +12966,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-001",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Network-Segmentation",
       metadata: {
         level: "warning",
         obu: "Network Engineering",
@@ -12953,6 +13005,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-002",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Network-Segmentation",
       metadata: {
         level: "info",
         obu: "Network Engineering",
@@ -12991,6 +13044,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-003",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Documentation",
       metadata: {
         level: "warning",
         obu: "Network Engineering",
@@ -13024,6 +13078,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-004",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Protocol-Security",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13066,6 +13121,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-005",
       selector: "line vty",
       vendor: "cisco-ios",
+      category: "Session-Management",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13101,6 +13157,7 @@ var common_json_rules_default = {
       id: "JSON-COMMON-001",
       selector: "interface",
       vendor: "common",
+      category: "Documentation",
       metadata: {
         level: "info",
         obu: "Network Engineering",
@@ -13148,6 +13205,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-001",
       selector: "system services",
       vendor: "juniper-junos",
+      category: "Session-Management",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13180,6 +13238,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-002",
       selector: "system services",
       vendor: "juniper-junos",
+      category: "Service-Hardening",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13202,6 +13261,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-003",
       selector: "system",
       vendor: "juniper-junos",
+      category: "Session-Management",
       metadata: {
         level: "warning",
         obu: "Security",
@@ -13221,6 +13281,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-004",
       selector: "protocols ospf area",
       vendor: "juniper-junos",
+      category: "Routing",
       metadata: {
         level: "warning",
         obu: "Network Engineering",
@@ -13240,6 +13301,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-005",
       selector: "system syslog",
       vendor: "juniper-junos",
+      category: "Logging",
       metadata: {
         level: "warning",
         obu: "Operations",
@@ -13602,8 +13664,110 @@ function isValidSentriflowConfig(config) {
       }
     }
   }
+  if (obj.directory !== void 0) {
+    if (!isValidDirectoryConfig(obj.directory)) {
+      return false;
+    }
+  }
+  return true;
+}
+function isValidDirectoryConfig(config) {
+  if (config === null || config === void 0) {
+    return false;
+  }
+  if (typeof config !== "object") {
+    return false;
+  }
+  const obj = config;
+  if (obj.excludePatterns !== void 0) {
+    if (!Array.isArray(obj.excludePatterns)) {
+      return false;
+    }
+    for (const pattern of obj.excludePatterns) {
+      if (typeof pattern !== "string") {
+        return false;
+      }
+      try {
+        new RegExp(pattern);
+      } catch {
+        return false;
+      }
+    }
+  }
+  if (obj.extensions !== void 0) {
+    if (!Array.isArray(obj.extensions)) {
+      return false;
+    }
+    for (const ext of obj.extensions) {
+      if (typeof ext !== "string") {
+        return false;
+      }
+    }
+  }
+  if (obj.recursive !== void 0 && typeof obj.recursive !== "boolean") {
+    return false;
+  }
+  if (obj.maxDepth !== void 0) {
+    if (typeof obj.maxDepth !== "number") {
+      return false;
+    }
+    if (obj.maxDepth < 0 || obj.maxDepth > 1e3) {
+      return false;
+    }
+  }
+  if (obj.exclude !== void 0) {
+    if (!Array.isArray(obj.exclude)) {
+      return false;
+    }
+    for (const pattern of obj.exclude) {
+      if (typeof pattern !== "string") {
+        return false;
+      }
+    }
+  }
   return true;
 }
+function mergeDirectoryOptions(cliOptions, configOptions) {
+  const result = {};
+  if (cliOptions.excludePatterns) {
+    result.excludePatterns = [...cliOptions.excludePatterns];
+  } else {
+    result.excludePatterns = [];
+  }
+  if (configOptions?.excludePatterns) {
+    for (const pattern of configOptions.excludePatterns) {
+      try {
+        const regex = new RegExp(pattern);
+        result.excludePatterns.push(regex);
+      } catch {
+      }
+    }
+  }
+  const excludeSet = /* @__PURE__ */ new Set();
+  if (cliOptions.exclude) {
+    for (const p of cliOptions.exclude) excludeSet.add(p);
+  }
+  if (configOptions?.exclude) {
+    for (const p of configOptions.exclude) excludeSet.add(p);
+  }
+  result.exclude = [...excludeSet];
+  if (cliOptions.recursive !== void 0) {
+    result.recursive = cliOptions.recursive;
+  } else if (configOptions?.recursive !== void 0) {
+    result.recursive = configOptions.recursive;
+  }
+  if (cliOptions.maxDepth !== void 0) {
+    result.maxDepth = cliOptions.maxDepth;
+  } else if (configOptions?.maxDepth !== void 0) {
+    result.maxDepth = configOptions.maxDepth;
+  }
+  if (cliOptions.extensions !== void 0) {
+    result.extensions = cliOptions.extensions;
+  } else if (configOptions?.extensions !== void 0) {
+    result.extensions = configOptions.extensions;
+  }
+  return result;
+}
 function isValidRule(rule) {
   if (typeof rule !== "object" || rule === null) {
     return false;
@@ -14048,6 +14212,19 @@ function isExcluded(relativePath, excludePatterns) {
   if (excludePatterns.length === 0) return false;
   return excludePatterns.some((pattern) => matchesPattern(relativePath, pattern));
 }
+function validateRegexPattern(pattern) {
+  try {
+    const regex = new RegExp(pattern);
+    return { valid: true, regex };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Invalid regex pattern";
+    return { valid: false, error: message };
+  }
+}
+function isExcludedByRegex(relativePath, patterns) {
+  if (patterns.length === 0 || relativePath === "") return false;
+  return patterns.some((pattern) => pattern.test(relativePath));
+}
 async function scanDirectory(dirPath, options = {}) {
   const {
     recursive = false,
@@ -14056,7 +14233,8 @@ async function scanDirectory(dirPath, options = {}) {
     maxFileSize = MAX_CONFIG_SIZE,
     maxDepth = 100,
     allowedBaseDirs,
-    exclude = []
+    exclude = [],
+    excludePatterns = []
   } = options;
   const result = {
     files: [],
@@ -14102,7 +14280,11 @@ async function scanDirectory(dirPath, options = {}) {
     for (const entry of entries) {
       const fullPath = join(currentDir, entry);
       const relativePath = join(basePath, entry);
-      if (isExcluded(relativePath, exclude)) {
+      const normalizedRelativePath = normalizeSeparators2(relativePath);
+      if (isExcluded(normalizedRelativePath, exclude)) {
+        continue;
+      }
+      if (isExcludedByRegex(normalizedRelativePath, excludePatterns)) {
         continue;
       }
       let stats;
@@ -14188,9 +14370,96 @@ function validateDirectoryPath(dirPath, allowedBaseDirs) {
   }
 }
 
+// src/loaders/stdin.ts
+async function readStdin() {
+  return new Promise((resolve5) => {
+    const stdin = process.stdin;
+    const chunks = [];
+    let totalSize = 0;
+    let sizeLimitExceeded = false;
+    stdin.setEncoding("utf8");
+    if (stdin.isTTY) {
+      resolve5({
+        success: false,
+        error: "No input received from stdin"
+      });
+      return;
+    }
+    stdin.on("data", (chunk) => {
+      if (sizeLimitExceeded) return;
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, "utf8");
+      totalSize += buffer.length;
+      if (totalSize > MAX_CONFIG_SIZE) {
+        sizeLimitExceeded = true;
+        resolve5({
+          success: false,
+          error: `Input exceeds maximum size (${totalSize} > ${MAX_CONFIG_SIZE} bytes)`
+        });
+        stdin.destroy();
+        return;
+      }
+      chunks.push(buffer);
+    });
+    stdin.on("end", () => {
+      if (sizeLimitExceeded) return;
+      const content = Buffer.concat(chunks).toString("utf8");
+      if (content.length === 0) {
+        resolve5({
+          success: false,
+          error: "No input received from stdin"
+        });
+        return;
+      }
+      resolve5({
+        success: true,
+        content
+      });
+    });
+    stdin.on("error", (err) => {
+      resolve5({
+        success: false,
+        error: `Failed to read from stdin: ${err.message}`
+      });
+    });
+    const timeout = setTimeout(() => {
+      if (chunks.length === 0 && !sizeLimitExceeded) {
+        stdin.destroy();
+        resolve5({
+          success: false,
+          error: "No input received from stdin (timeout)"
+        });
+      }
+    }, 100);
+    stdin.on("end", () => clearTimeout(timeout));
+    stdin.on("error", () => clearTimeout(timeout));
+  });
+}
+function validateStdinArgument(files, hasDirectory) {
+  const hasStdin = files.includes("-");
+  if (!hasStdin) {
+    return { valid: true };
+  }
+  if (files.length > 1) {
+    return {
+      valid: false,
+      error: "Cannot combine stdin (-) with other file arguments"
+    };
+  }
+  if (hasDirectory) {
+    return {
+      valid: false,
+      error: "Cannot combine stdin (-) with directory mode (-D)"
+    };
+  }
+  return { valid: true };
+}
+function isStdinRequested(files) {
+  return files.length === 1 && files[0] === "-";
+}
+
 // index.ts
 var program = new Command();
-program.name("sentriflow").description("SentriFlow Network Configuration Validator").version("0.1.5").argument("[file]", "Path to the configuration file").option("--ast", "Output the AST instead of rule results").option("-f, --format <format>", "Output format (json, sarif)", "json").option("-q, --quiet", "Only output failures (suppress passed results)").option("-c, --config <path>", "Path to config file (default: auto-detect)").option("--no-config", "Ignore config file").option("-r, --rules <path>", "Additional rules file to load (legacy)").option("-p, --rule-pack <path>", "Rule pack file to load").option(
+program.name("sentriflow").description("SentriFlow Network Configuration Validator").version("0.1.7").argument("[files...]", "Path(s) to configuration file(s) (supports multiple files)").option("--ast", "Output the AST instead of rule results").option("-f, --format <format>", "Output format (json, sarif)", "json").option("-q, --quiet", "Only output failures (suppress passed results)").option("-c, --config <path>", "Path to config file (default: auto-detect)").option("--no-config", "Ignore config file").option("-r, --rules <path>", "Additional rules file to load (legacy)").option("-p, --rule-pack <path>", "Rule pack file to load").option(
   "--encrypted-pack <path...>",
   "SEC-012: Path(s) to encrypted rule pack(s) (.grpx), can specify multiple"
 ).option(
@@ -14231,7 +14500,14 @@ program.name("sentriflow").description("SentriFlow Network Configuration Validat
   "--exclude <patterns>",
   "Exclude patterns (comma-separated glob patterns)",
   (val) => val.split(",")
-).option("--progress", "Show progress during directory scanning").action(async (file, options) => {
+).option(
+  "--exclude-pattern <pattern...>",
+  "Regex pattern(s) to exclude files (JavaScript regex syntax, can specify multiple)"
+).option(
+  "--max-depth <number>",
+  "Maximum recursion depth for directory scanning (use with -R)",
+  (val) => parseInt(val, 10)
+).option("--progress", "Show progress during directory scanning").action(async (files, options) => {
   try {
     if (options.listVendors) {
       console.log("Supported vendors:\n");
@@ -14258,8 +14534,21 @@ Use: sentriflow --vendor <vendor> <file>`);
     }
     const workingDir = process.cwd();
     const allowedBaseDirs = options.allowExternal ? void 0 : [workingDir];
+    const excludePatterns = [];
+    if (options.excludePattern) {
+      for (const pattern of options.excludePattern) {
+        const result = validateRegexPattern(pattern);
+        if (!result.valid) {
+          console.error(`Error: Invalid regex pattern '${pattern}'`);
+          console.error(`  ${result.error}`);
+          process.exit(2);
+        }
+        excludePatterns.push(result.regex);
+      }
+    }
     const licenseKey = options.licenseKey || process.env.SENTRIFLOW_LICENSE_KEY;
-    const configSearchDir = file ? dirname2(resolve4(file)) : workingDir;
+    const firstFile = files.length > 0 ? files[0] : void 0;
+    const configSearchDir = firstFile ? dirname2(resolve4(firstFile)) : workingDir;
     const rules = await resolveRules({
       configPath: options.config,
       noConfig: options.config === false,
@@ -14313,18 +14602,44 @@ Config file: ${configFile}`);
         process.exit(2);
       }
       const canonicalDir = dirValidation.canonicalPath;
+      let directoryConfig;
+      if (options.config !== false) {
+        const configPath = options.config ?? findConfigFile(canonicalDir);
+        if (configPath) {
+          try {
+            const config = await loadConfigFile(configPath, allowedBaseDirs);
+            directoryConfig = config.directory;
+          } catch (err) {
+            if (options.progress) {
+              const msg = err instanceof Error ? err.message : "Unknown error";
+              console.error(`Warning: Failed to load config: ${msg}`);
+            }
+          }
+        }
+      }
+      const cliDirOptions = {
+        recursive: options.recursive,
+        extensions: options.extensions,
+        exclude: options.exclude,
+        excludePatterns: excludePatterns.length > 0 ? excludePatterns : void 0,
+        maxDepth: options.maxDepth
+      };
+      const mergedOptions = mergeDirectoryOptions(cliDirOptions, directoryConfig);
       if (options.progress) {
+        const recursive = mergedOptions.recursive ?? false;
         console.error(
-          `Scanning directory: ${canonicalDir}${options.recursive ? " (recursive)" : ""}`
+          `Scanning directory: ${canonicalDir}${recursive ? " (recursive)" : ""}`
         );
       }
       const scanResult = await scanDirectory(canonicalDir, {
-        recursive: options.recursive ?? false,
+        recursive: mergedOptions.recursive ?? false,
         patterns: options.glob ? [options.glob] : [],
-        extensions: options.extensions ?? DEFAULT_CONFIG_EXTENSIONS,
+        extensions: mergedOptions.extensions ?? DEFAULT_CONFIG_EXTENSIONS,
         maxFileSize: MAX_CONFIG_SIZE,
+        maxDepth: mergedOptions.maxDepth,
         allowedBaseDirs,
-        exclude: options.exclude ?? []
+        exclude: mergedOptions.exclude ?? [],
+        excludePatterns: mergedOptions.excludePatterns ?? []
       });
       if (scanResult.errors.length > 0 && options.progress) {
         console.error(`
@@ -14488,10 +14803,176 @@ Scan complete: ${allFileResults.length} files, ${totalFailures} failures, ${tota
       }
       return;
     }
-    if (!file) {
+    if (files.length === 0) {
       program.help();
       return;
     }
+    const stdinValidation = validateStdinArgument(files, !!options.directory);
+    if (!stdinValidation.valid) {
+      console.error(`Error: ${stdinValidation.error}`);
+      process.exit(2);
+    }
+    if (isStdinRequested(files)) {
+      const stdinResult = await readStdin();
+      if (!stdinResult.success) {
+        console.error(`Error: ${stdinResult.error}`);
+        process.exit(2);
+      }
+      const content2 = stdinResult.content;
+      let vendor2;
+      if (options.vendor === "auto") {
+        vendor2 = detectVendor(content2);
+        if (!options.quiet && !options.ast) {
+          console.error(`Detected vendor: ${vendor2.name} (${vendor2.id})`);
+        }
+      } else {
+        try {
+          vendor2 = getVendor(options.vendor);
+        } catch {
+          console.error(`Error: Unknown vendor '${options.vendor}'`);
+          console.error(`Available vendors: ${getAvailableVendors().join(", ")}, auto`);
+          process.exit(2);
+        }
+      }
+      const stdinRules = await resolveRules({
+        configPath: options.config,
+        noConfig: options.config === false,
+        rulesPath: options.rules,
+        rulePackPath: options.rulePack,
+        encryptedPackPaths: options.encryptedPack,
+        licenseKey,
+        strictPacks: options.strictPacks,
+        jsonRulesPaths: options.jsonRules,
+        disableIds: options.disable ?? [],
+        vendorId: vendor2.id,
+        cwd: workingDir,
+        allowedBaseDirs
+      });
+      const parser2 = new SchemaAwareParser({ vendor: vendor2 });
+      const nodes2 = parser2.parse(content2);
+      if (options.ast) {
+        const output = {
+          vendor: { id: vendor2.id, name: vendor2.name },
+          ast: nodes2
+        };
+        console.log(JSON.stringify(output, null, 2));
+        return;
+      }
+      const engine2 = new RuleEngine();
+      let results2 = engine2.run(nodes2, stdinRules);
+      if (options.quiet) {
+        results2 = results2.filter((r) => !r.passed);
+      }
+      if (options.format === "sarif") {
+        const sarifOptions = {
+          relativePaths: options.relativePaths,
+          baseDir: process.cwd()
+        };
+        console.log(generateSarif(results2, "<stdin>", stdinRules, sarifOptions));
+      } else {
+        const output = {
+          file: "<stdin>",
+          vendor: { id: vendor2.id, name: vendor2.name },
+          results: results2
+        };
+        console.log(JSON.stringify(output, null, 2));
+      }
+      const hasFailures2 = results2.some((r) => !r.passed);
+      if (hasFailures2) {
+        process.exit(1);
+      }
+      return;
+    }
+    if (files.length > 1) {
+      const allFileResults = [];
+      let totalFailures = 0;
+      let totalPassed = 0;
+      const engine2 = new RuleEngine();
+      for (let i = 0; i < files.length; i++) {
+        const file2 = files[i];
+        if (!file2) continue;
+        const fileValidation2 = validateInputFilePath(
+          file2,
+          MAX_CONFIG_SIZE,
+          allowedBaseDirs
+        );
+        if (!fileValidation2.valid) {
+          console.error(`Error processing ${file2}: ${fileValidation2.error}`);
+          allFileResults.push({
+            filePath: file2,
+            results: []
+          });
+          continue;
+        }
+        const filePath2 = fileValidation2.canonicalPath;
+        try {
+          const stats2 = statSync2(filePath2);
+          if (stats2.size > MAX_CONFIG_SIZE) {
+            console.error(`Error: ${file2} exceeds maximum size`);
+            allFileResults.push({ filePath: file2, results: [] });
+            continue;
+          }
+          const content2 = await readFile(filePath2, "utf-8");
+          let vendor2;
+          if (options.vendor === "auto") {
+            vendor2 = detectVendor(content2);
+          } else {
+            vendor2 = getVendor(options.vendor);
+          }
+          const fileRules = rules.filter(
+            (rule) => ruleAppliesToVendor(rule, vendor2.id)
+          );
+          const parser2 = new SchemaAwareParser({ vendor: vendor2 });
+          const nodes2 = parser2.parse(content2);
+          let results2 = engine2.run(nodes2, fileRules);
+          if (options.quiet) {
+            results2 = results2.filter((r) => !r.passed);
+          }
+          const failures = results2.filter((r) => !r.passed).length;
+          const passed = results2.filter((r) => r.passed).length;
+          totalFailures += failures;
+          totalPassed += passed;
+          allFileResults.push({
+            filePath: filePath2,
+            results: results2,
+            vendor: { id: vendor2.id, name: vendor2.name }
+          });
+        } catch (err) {
+          const errMsg = err instanceof Error ? err.message : "Unknown error";
+          console.error(`Error processing ${basename(file2)}: ${errMsg}`);
+          allFileResults.push({ filePath: file2, results: [] });
+        }
+      }
+      if (options.format === "sarif") {
+        const sarifOptions = {
+          relativePaths: options.relativePaths,
+          baseDir: process.cwd()
+        };
+        console.log(
+          generateMultiFileSarif(allFileResults, rules, sarifOptions)
+        );
+      } else {
+        const output = {
+          summary: {
+            filesScanned: allFileResults.length,
+            totalResults: totalFailures + totalPassed,
+            failures: totalFailures,
+            passed: totalPassed
+          },
+          files: allFileResults.map((fr) => ({
+            file: fr.filePath,
+            vendor: fr.vendor,
+            results: fr.results
+          }))
+        };
+        console.log(JSON.stringify(output, null, 2));
+      }
+      if (totalFailures > 0) {
+        process.exit(1);
+      }
+      return;
+    }
+    const file = files[0];
     const fileValidation = validateInputFilePath(
       file,
       MAX_CONFIG_SIZE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentriflow/cli",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "SentriFlow CLI - Network configuration linter and validator",
   "license": "Apache-2.0",
   "main": "dist/index.js",