@sentriflow/cli 0.1.6 → 0.1.7

package/dist/index.js

@@ -9975,6 +9975,7 @@ var JsonRuleCompiler = class {
       id: jsonRule.id,
       selector: jsonRule.selector,
       vendor: jsonRule.vendor,
+      category: jsonRule.category,
       metadata: jsonRule.metadata,
       check: (node, _ctx) => {
         const passed = !this.evaluateCheck(jsonRule.check, node);
@@ -10407,7 +10408,7 @@ function generateSarif(results, filePath, rules, options = {}) {
         tool: {
           driver: {
             name: "Sentriflow",
-            version: "0.1.6",
+            version: "0.1.7",
             informationUri: "https://github.com/sentriflow/sentriflow",
             rules: sarifRules,
             // SEC-007: Include CWE taxonomy when rules reference it
@@ -10513,7 +10514,7 @@ function generateMultiFileSarif(fileResults, rules, options = {}) {
         tool: {
           driver: {
             name: "Sentriflow",
-            version: "0.1.6",
+            version: "0.1.7",
             informationUri: "https://github.com/sentriflow/sentriflow",
             rules: sarifRules,
             // SEC-007: Include CWE taxonomy when rules reference it
@@ -10556,10 +10557,12 @@ var NoMulticastBroadcastIp = {
   id: "NET-IP-001",
   selector: "ip address",
   vendor: "common",
+  category: "IP-Addressing",
   metadata: {
     level: "error",
     obu: "Network Engineering",
     owner: "NetOps",
+    description: "Ensure IP addresses are not Multicast, Broadcast, or Network ID addresses.",
     remediation: "Configure a valid unicast IP address. Do not use Multicast, Broadcast, or Network ID addresses."
   },
   check: (node) => {
@@ -10669,10 +10672,12 @@ var InterfaceDescriptionRequired = {
   id: "NET-DOC-001",
   selector: "interface",
   vendor: "common",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
     owner: "NetOps",
+    description: "Ensure interfaces have descriptive labels for operational clarity.",
     remediation: 'Add a description to the interface using the "description" command.'
   },
   check: (node) => {
@@ -10750,6 +10755,7 @@ var TrunkNoDTP = {
   id: "NET-TRUNK-001",
   selector: "interface",
   vendor: "cisco-ios",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -10783,6 +10789,7 @@ var AccessExplicitMode = {
   id: "NET-ACCESS-001",
   selector: "interface",
   vendor: "cisco-ios",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -10812,6 +10819,7 @@ var EnableSecretStrong = {
   id: "NET-AAA-003",
   selector: "enable",
   vendor: "cisco-ios",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -10848,6 +10856,7 @@ var CiscoNoPlaintextPasswords = {
   id: "NET-SEC-001",
   selector: "password",
   vendor: ["cisco-ios", "cisco-nxos"],
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -10935,6 +10944,7 @@ var RootAuthRequired = {
   id: "JUN-SYS-001",
   selector: "system",
   vendor: "juniper-junos",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -10979,6 +10989,7 @@ var JunosBgpRouterId = {
   id: "JUN-BGP-001",
   selector: "routing-options",
   vendor: "juniper-junos",
+  category: "Routing",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11011,6 +11022,7 @@ var JunosFirewallDefaultDeny = {
   id: "JUN-FW-001",
   selector: "firewall",
   vendor: "juniper-junos",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -11082,6 +11094,7 @@ var SshEnabled = {
   id: "ARU-SEC-001",
   selector: "ssh",
   vendor: ["aruba-aoscx", "aruba-aosswitch", "aruba-wlc"],
+  category: "Session-Management",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11114,6 +11127,7 @@ var NtpConfigured = {
   id: "ARU-NTP-001",
   selector: "ntp",
   vendor: ["aruba-aoscx", "aruba-aosswitch", "aruba-wlc"],
+  category: "Time-Synchronization",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11154,6 +11168,7 @@ var AosCxInterfaceDescription = {
   id: "AOSCX-IF-001",
   selector: "interface",
   vendor: "aruba-aoscx",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11195,6 +11210,7 @@ var AosCxTrunkAllowedVlans = {
   id: "AOSCX-L2-001",
   selector: "interface",
   vendor: "aruba-aoscx",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11245,6 +11261,7 @@ var AosSwitchVlanName = {
   id: "AOSSW-L2-001",
   selector: "vlan",
   vendor: "aruba-aosswitch",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11286,6 +11303,7 @@ var AosSwitchManagerPassword = {
   id: "AOSSW-SEC-001",
   selector: "password",
   vendor: "aruba-aosswitch",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11326,6 +11344,7 @@ var WlcSsidEncryption = {
   id: "ARUWLC-WLAN-001",
   selector: "wlan ssid-profile",
   vendor: "aruba-wlc",
+  category: "Wireless",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11379,6 +11398,7 @@ var WlcRadiusHost = {
   id: "ARUWLC-AAA-001",
   selector: "aaa authentication-server radius",
   vendor: "aruba-wlc",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11440,6 +11460,7 @@ var HostnameRequired = {
   id: "PAN-SYS-001",
   selector: "deviceconfig",
   vendor: "paloalto-panos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11483,6 +11504,7 @@ var SecurityRuleLogging = {
   id: "PAN-SEC-001",
   selector: "rulebase",
   vendor: "paloalto-panos",
+  category: "Logging",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -11533,6 +11555,7 @@ var ZoneProtectionRequired = {
   id: "PAN-ZONE-001",
   selector: "zone",
   vendor: "paloalto-panos",
+  category: "Network-Segmentation",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11595,6 +11618,7 @@ var HostnameRequired2 = {
   id: "ARI-SYS-001",
   selector: "hostname",
   vendor: "arista-eos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11629,6 +11653,7 @@ var MlagConfigComplete = {
   id: "ARI-MLAG-001",
   selector: "mlag configuration",
   vendor: "arista-eos",
+  category: "High-Availability",
   metadata: {
     level: "error",
     obu: "Network Engineering",
@@ -11674,6 +11699,7 @@ var InterfaceDescription = {
   id: "ARI-INT-001",
   selector: "interface Ethernet",
   vendor: "arista-eos",
+  category: "Documentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -11731,6 +11757,7 @@ var VyosHostnameRequired = {
   id: "VYOS-SYS-001",
   selector: "system",
   vendor: "vyos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11763,6 +11790,7 @@ var VyosNoPlaintextPassword = {
   id: "VYOS-SEC-001",
   selector: "authentication",
   vendor: "vyos",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11797,6 +11825,7 @@ var VyosInterfaceDescription = {
   id: "VYOS-IF-001",
   selector: "interfaces",
   vendor: "vyos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11840,6 +11869,7 @@ var VyosFirewallDefaultAction = {
   id: "VYOS-FW-001",
   selector: "firewall",
   vendor: "vyos",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -11907,6 +11937,7 @@ var HostnameRequired3 = {
   id: "FGT-SYS-001",
   selector: "config system global",
   vendor: "fortinet-fortigate",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11939,6 +11970,7 @@ var AdminTrustedHostRequired = {
   id: "FGT-ADMIN-001",
   selector: "config system admin",
   vendor: "fortinet-fortigate",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11993,6 +12025,7 @@ var PolicyLoggingRequired = {
   id: "FGT-POL-001",
   selector: "config firewall policy",
   vendor: "fortinet-fortigate",
+  category: "Logging",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -12059,6 +12092,7 @@ var ExosSysnameRequired = {
   id: "EXOS-SYS-001",
   selector: "configure snmp sysname",
   vendor: "extreme-exos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12092,6 +12126,7 @@ var ExosSsh2Enabled = {
   id: "EXOS-SEC-001",
   selector: "enable ssh2",
   vendor: "extreme-exos",
+  category: "Session-Management",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -12123,6 +12158,7 @@ var ExosVlanNaming = {
   id: "EXOS-VLAN-001",
   selector: "create vlan",
   vendor: "extreme-exos",
+  category: "Documentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -12179,6 +12215,7 @@ var VossSysNameRequired = {
   id: "VOSS-SYS-001",
   selector: "snmp-server name",
   vendor: "extreme-voss",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12212,6 +12249,7 @@ var VossVlanIsidRequired = {
   id: "VOSS-VLAN-001",
   selector: "vlan create",
   vendor: "extreme-voss",
+  category: "Network-Segmentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -12264,6 +12302,7 @@ var VossInterfaceDefaultVlan = {
   id: "VOSS-INT-001",
   selector: "interface GigabitEthernet",
   vendor: "extreme-voss",
+  category: "Network-Segmentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -12348,6 +12387,7 @@ var SysnameRequired = {
   id: "HUAWEI-SYS-001",
   selector: "sysname",
   vendor: "huawei-vrp",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12380,6 +12420,7 @@ var InterfaceDescriptionRequired2 = {
   id: "HUAWEI-IF-001",
   selector: "interface",
   vendor: "huawei-vrp",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12432,6 +12473,7 @@ var VtySshRequired = {
   id: "HUAWEI-VTY-002",
   selector: "user-interface vty",
   vendor: "huawei-vrp",
+  category: "Session-Management",
   metadata: {
     level: "error",
     obu: "Security",
@@ -12496,6 +12538,7 @@ var MikrotikSystemIdentity = {
   id: "MIK-SYS-001",
   selector: "/system identity",
   vendor: "mikrotik-routeros",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12528,6 +12571,7 @@ var MikrotikDisableUnusedServices = {
   id: "MIK-SEC-001",
   selector: "/ip service",
   vendor: "mikrotik-routeros",
+  category: "Service-Hardening",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -12572,6 +12616,7 @@ var MikrotikInputChainDrop = {
   id: "MIK-FW-001",
   selector: "/ip firewall filter",
   vendor: "mikrotik-routeros",
+  category: "Network-Segmentation",
   metadata: {
     level: "error",
     obu: "Security",
@@ -12625,6 +12670,7 @@ var SystemNameRequired = {
   id: "NOKIA-SYS-001",
   selector: "system",
   vendor: "nokia-sros",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12657,6 +12703,7 @@ var PortDescriptionRequired = {
   id: "NOKIA-PORT-001",
   selector: "port",
   vendor: "nokia-sros",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12709,6 +12756,7 @@ var BgpRouterIdRequired = {
   id: "NOKIA-BGP-001",
   selector: "bgp",
   vendor: "nokia-sros",
+  category: "Routing",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12765,6 +12813,7 @@ var CumulusInterfaceDescription = {
   id: "CUM-IF-001",
   selector: "iface",
   vendor: "cumulus-linux",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12807,6 +12856,7 @@ var CumulusBridgeVlans = {
   id: "CUM-BR-001",
   selector: "iface",
   vendor: "cumulus-linux",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12859,6 +12909,7 @@ var CumulusBgpRouterId = {
   id: "CUM-BGP-001",
   selector: "router bgp",
   vendor: "cumulus-linux",
+  category: "Routing",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12915,6 +12966,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-001",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Network-Segmentation",
       metadata: {
         level: "warning",
         obu: "Network Engineering",
@@ -12953,6 +13005,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-002",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Network-Segmentation",
       metadata: {
         level: "info",
         obu: "Network Engineering",
@@ -12991,6 +13044,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-003",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Documentation",
       metadata: {
         level: "warning",
         obu: "Network Engineering",
@@ -13024,6 +13078,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-004",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Protocol-Security",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13066,6 +13121,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-005",
       selector: "line vty",
       vendor: "cisco-ios",
+      category: "Session-Management",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13101,6 +13157,7 @@ var common_json_rules_default = {
       id: "JSON-COMMON-001",
       selector: "interface",
       vendor: "common",
+      category: "Documentation",
       metadata: {
         level: "info",
         obu: "Network Engineering",
@@ -13148,6 +13205,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-001",
       selector: "system services",
       vendor: "juniper-junos",
+      category: "Session-Management",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13180,6 +13238,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-002",
       selector: "system services",
       vendor: "juniper-junos",
+      category: "Service-Hardening",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13202,6 +13261,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-003",
       selector: "system",
       vendor: "juniper-junos",
+      category: "Session-Management",
       metadata: {
         level: "warning",
         obu: "Security",
@@ -13221,6 +13281,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-004",
       selector: "protocols ospf area",
       vendor: "juniper-junos",
+      category: "Routing",
       metadata: {
         level: "warning",
         obu: "Network Engineering",
@@ -13240,6 +13301,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-005",
       selector: "system syslog",
       vendor: "juniper-junos",
+      category: "Logging",
       metadata: {
         level: "warning",
         obu: "Operations",
@@ -14397,7 +14459,7 @@ function isStdinRequested(files) {
 
 // index.ts
 var program = new Command();
-program.name("sentriflow").description("SentriFlow Network Configuration Validator").version("0.1.6").argument("[files...]", "Path(s) to configuration file(s) (supports multiple files)").option("--ast", "Output the AST instead of rule results").option("-f, --format <format>", "Output format (json, sarif)", "json").option("-q, --quiet", "Only output failures (suppress passed results)").option("-c, --config <path>", "Path to config file (default: auto-detect)").option("--no-config", "Ignore config file").option("-r, --rules <path>", "Additional rules file to load (legacy)").option("-p, --rule-pack <path>", "Rule pack file to load").option(
+program.name("sentriflow").description("SentriFlow Network Configuration Validator").version("0.1.7").argument("[files...]", "Path(s) to configuration file(s) (supports multiple files)").option("--ast", "Output the AST instead of rule results").option("-f, --format <format>", "Output format (json, sarif)", "json").option("-q, --quiet", "Only output failures (suppress passed results)").option("-c, --config <path>", "Path to config file (default: auto-detect)").option("--no-config", "Ignore config file").option("-r, --rules <path>", "Additional rules file to load (legacy)").option("-p, --rule-pack <path>", "Rule pack file to load").option(
   "--encrypted-pack <path...>",
   "SEC-012: Path(s) to encrypted rule pack(s) (.grpx), can specify multiple"
 ).option(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentriflow/cli",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "SentriFlow CLI - Network configuration linter and validator",
   "license": "Apache-2.0",
   "main": "dist/index.js",