@sentriflow/cli 0.1.6 → 0.1.8

package/dist/index.js

@@ -9975,6 +9975,7 @@ var JsonRuleCompiler = class {
       id: jsonRule.id,
       selector: jsonRule.selector,
       vendor: jsonRule.vendor,
+      category: jsonRule.category,
       metadata: jsonRule.metadata,
       check: (node, _ctx) => {
         const passed = !this.evaluateCheck(jsonRule.check, node);
@@ -10333,6 +10334,350 @@ function validateRegex(pattern, flags, path, ctx) {
   }
 }
 
+// ../core/src/ip/extractor.ts
+function isValidIPv4(ip) {
+  if (!ip || typeof ip !== "string") return false;
+  const octets = ip.split(".");
+  if (octets.length !== 4) return false;
+  for (const octet of octets) {
+    if (!/^\d+$/.test(octet)) return false;
+    if (octet.length > 1 && octet.startsWith("0")) return false;
+    const num = parseInt(octet, 10);
+    if (isNaN(num) || num < 0 || num > 255) return false;
+  }
+  return true;
+}
+function isValidIPv6(ip) {
+  if (!ip || typeof ip !== "string") return false;
+  let addr = ip;
+  const zoneIndex = ip.indexOf("%");
+  if (zoneIndex !== -1) {
+    addr = ip.substring(0, zoneIndex);
+  }
+  if (!addr.includes(":")) return false;
+  if (addr.includes(":::")) return false;
+  const doubleColonCount = (addr.match(/::/g) || []).length;
+  if (doubleColonCount > 1) return false;
+  const parts = addr.split(":");
+  if (doubleColonCount === 1) {
+    const nonEmptyParts = parts.filter((p) => p !== "");
+    for (const part of nonEmptyParts) {
+      if (!/^[0-9a-fA-F]{1,4}$/.test(part)) return false;
+    }
+    if (nonEmptyParts.length > 7) return false;
+  } else {
+    if (parts.length !== 8) return false;
+    for (const part of parts) {
+      if (!/^[0-9a-fA-F]{1,4}$/.test(part)) return false;
+    }
+  }
+  return true;
+}
+function isValidSubnet(subnet) {
+  if (!subnet || typeof subnet !== "string") return false;
+  const slashIndex = subnet.lastIndexOf("/");
+  if (slashIndex === -1) return false;
+  const ip = subnet.substring(0, slashIndex);
+  const prefixStr = subnet.substring(slashIndex + 1);
+  if (!/^\d+$/.test(prefixStr)) return false;
+  const prefix = parseInt(prefixStr, 10);
+  if (isValidIPv4(ip)) {
+    return prefix >= 0 && prefix <= 32;
+  } else if (isValidIPv6(ip)) {
+    return prefix >= 0 && prefix <= 128;
+  }
+  return false;
+}
+function normalizeIPv4(ip) {
+  return ip.split(".").map((octet) => parseInt(octet, 10).toString()).join(".");
+}
+function normalizeIPv6(ip) {
+  let addr = ip;
+  const zoneIndex = ip.indexOf("%");
+  if (zoneIndex !== -1) {
+    addr = ip.substring(0, zoneIndex);
+  }
+  addr = addr.toLowerCase();
+  if (addr.includes("::")) {
+    const sides = addr.split("::");
+    const left = sides[0] ? sides[0].split(":").filter((p) => p !== "") : [];
+    const right = sides[1] ? sides[1].split(":").filter((p) => p !== "") : [];
+    const zerosNeeded = 8 - left.length - right.length;
+    const expanded = [];
+    for (const part of left) {
+      expanded.push(parseInt(part, 16).toString(16));
+    }
+    for (let i = 0; i < zerosNeeded; i++) {
+      expanded.push("0");
+    }
+    for (const part of right) {
+      expanded.push(parseInt(part, 16).toString(16));
+    }
+    return expanded.join(":");
+  }
+  const parts = addr.split(":");
+  const result = [];
+  for (const part of parts) {
+    if (part !== "") {
+      result.push(parseInt(part, 16).toString(16));
+    }
+  }
+  return result.join(":");
+}
+function ipv4ToNumber(ip) {
+  const octets = ip.split(".").map(Number);
+  const o0 = octets[0] ?? 0;
+  const o1 = octets[1] ?? 0;
+  const o2 = octets[2] ?? 0;
+  const o3 = octets[3] ?? 0;
+  return (o0 << 24 >>> 0) + (o1 << 16) + (o2 << 8) + o3;
+}
+function compareIPv4(a, b) {
+  const numA = ipv4ToNumber(a);
+  const numB = ipv4ToNumber(b);
+  return numA < numB ? -1 : numA > numB ? 1 : 0;
+}
+function expandIPv6(ip) {
+  let addr = ip;
+  const zoneIndex = ip.indexOf("%");
+  if (zoneIndex !== -1) {
+    addr = ip.substring(0, zoneIndex);
+  }
+  const parts = addr.split(":");
+  const result = [];
+  for (let i = 0; i < parts.length; i++) {
+    if (parts[i] === "" && i > 0 && i < parts.length - 1) {
+      const nonEmpty = parts.filter((p) => p !== "").length;
+      const zeros = 8 - nonEmpty;
+      for (let j = 0; j < zeros; j++) {
+        result.push("0");
+      }
+    } else if (parts[i] !== "") {
+      result.push(parts[i] ?? "0");
+    } else if (i === 0 && parts[1] === "") {
+      const nonEmpty = parts.filter((p) => p !== "").length;
+      const zeros = 8 - nonEmpty;
+      for (let j = 0; j < zeros; j++) {
+        result.push("0");
+      }
+    } else if (i === parts.length - 1 && parts[i - 1] === "") {
+    }
+  }
+  while (result.length < 8) {
+    result.push("0");
+  }
+  return result.slice(0, 8);
+}
+function ipv6ToBigInt(ip) {
+  const parts = expandIPv6(ip);
+  let result = 0n;
+  for (const part of parts) {
+    result = (result << 16n) + BigInt(parseInt(part, 16) || 0);
+  }
+  return result;
+}
+function compareIPv6(a, b) {
+  const bigA = ipv6ToBigInt(a);
+  const bigB = ipv6ToBigInt(b);
+  return bigA < bigB ? -1 : bigA > bigB ? 1 : 0;
+}
+function sortIPv4Addresses(ips) {
+  return [...ips].sort(compareIPv4);
+}
+function sortIPv6Addresses(ips) {
+  return [...ips].sort(compareIPv6);
+}
+function parseSubnet(subnet) {
+  const slashIndex = subnet.lastIndexOf("/");
+  return {
+    network: subnet.substring(0, slashIndex),
+    prefix: parseInt(subnet.substring(slashIndex + 1), 10)
+  };
+}
+function sortSubnets(subnets, type) {
+  const compare = type === "ipv4" ? compareIPv4 : compareIPv6;
+  return [...subnets].sort((a, b) => {
+    const subA = parseSubnet(a);
+    const subB = parseSubnet(b);
+    const netCompare = compare(subA.network, subB.network);
+    if (netCompare !== 0) return netCompare;
+    return subA.prefix - subB.prefix;
+  });
+}
+function isSubnetMask(ip) {
+  if (!ip.startsWith("255.")) return false;
+  const octets = ip.split(".").map(Number);
+  const num = ((octets[0] ?? 0) << 24) + ((octets[1] ?? 0) << 16) + ((octets[2] ?? 0) << 8) + (octets[3] ?? 0);
+  const inverted = ~num >>> 0;
+  return inverted === 0 || (inverted & inverted + 1) === 0;
+}
+function isWildcardMask(ip) {
+  if (!ip.startsWith("0.")) return false;
+  const octets = ip.split(".").map(Number);
+  const num = ((octets[0] ?? 0) << 24) + ((octets[1] ?? 0) << 16) + ((octets[2] ?? 0) << 8) + (octets[3] ?? 0);
+  return num === 0 || (num + 1 & num) === 0;
+}
+function maskToCidr(mask) {
+  if (!isSubnetMask(mask)) return -1;
+  const octets = mask.split(".").map(Number);
+  const num = ((octets[0] ?? 0) << 24) + ((octets[1] ?? 0) << 16) + ((octets[2] ?? 0) << 8) + (octets[3] ?? 0);
+  let prefix = 0;
+  let n = num >>> 0;
+  while (n & 2147483648) {
+    prefix++;
+    n = n << 1 >>> 0;
+  }
+  return prefix;
+}
+function wildcardToCidr(wildcard) {
+  if (!isWildcardMask(wildcard)) return -1;
+  const octets = wildcard.split(".").map(Number);
+  const num = ((octets[0] ?? 0) << 24) + ((octets[1] ?? 0) << 16) + ((octets[2] ?? 0) << 8) + (octets[3] ?? 0);
+  let prefix = 0;
+  let n = num >>> 0;
+  while (prefix < 32 && !(n & 2147483648)) {
+    prefix++;
+    n = n << 1 >>> 0;
+  }
+  return prefix;
+}
+var IPV4_PATTERN = /\b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\b/g;
+var IPV4_CIDR_PATTERN = /\b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\/(?:3[0-2]|[12]?[0-9])\b/g;
+var IPV4_WITH_MASK_PATTERN = /\b((?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]))\s+(255\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]))\b/g;
+var IPV4_WITH_MASK_KEYWORD_PATTERN = /\b((?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]))\s+mask\s+(255\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]))\b/gi;
+var IPV4_WITH_WILDCARD_PATTERN = /\b((?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]))\s+(0\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]))\b/g;
+var IPV6_PATTERN = /(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|:(?::[0-9a-fA-F]{1,4}){1,7}|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|(?:[0-9a-fA-F]{1,4}:){1,7}:|::/g;
+var IPV6_CIDR_PATTERN = /(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|:(?::[0-9a-fA-F]{1,4}){1,7}|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|(?:[0-9a-fA-F]{1,4}:){1,7}:|::)\/(?:12[0-8]|1[01][0-9]|[1-9]?[0-9])/g;
+function createEmptyIPSummary() {
+  return {
+    ipv4Addresses: [],
+    ipv6Addresses: [],
+    ipv4Subnets: [],
+    ipv6Subnets: [],
+    counts: {
+      ipv4: 0,
+      ipv6: 0,
+      ipv4Subnets: 0,
+      ipv6Subnets: 0,
+      total: 0
+    }
+  };
+}
+function extractIPSummary(content, options = {}) {
+  if (!content || typeof content !== "string") {
+    return createEmptyIPSummary();
+  }
+  const ipv4Set = /* @__PURE__ */ new Set();
+  const ipv6Set = /* @__PURE__ */ new Set();
+  const ipv4SubnetSet = /* @__PURE__ */ new Set();
+  const ipv6SubnetSet = /* @__PURE__ */ new Set();
+  const subnetNetworks = /* @__PURE__ */ new Set();
+  const ipsWithMasks = /* @__PURE__ */ new Set();
+  if (!options.skipSubnets) {
+    const ipv4CidrMatches = content.matchAll(IPV4_CIDR_PATTERN);
+    for (const match of ipv4CidrMatches) {
+      const subnet = match[0];
+      if (isValidSubnet(subnet)) {
+        const { network } = parseSubnet(subnet);
+        const normalizedNetwork = normalizeIPv4(network);
+        ipv4SubnetSet.add(`${normalizedNetwork}/${parseSubnet(subnet).prefix}`);
+        subnetNetworks.add(normalizedNetwork);
+      }
+    }
+    const ipMaskMatches = content.matchAll(IPV4_WITH_MASK_PATTERN);
+    for (const match of ipMaskMatches) {
+      const ip = match[1];
+      const mask = match[2];
+      if (ip && mask && isValidIPv4(ip) && isSubnetMask(mask)) {
+        const normalizedIP = normalizeIPv4(ip);
+        const prefix = maskToCidr(mask);
+        if (prefix >= 0) {
+          ipv4SubnetSet.add(`${normalizedIP}/${prefix}`);
+          ipsWithMasks.add(normalizedIP);
+        }
+      }
+    }
+    const ipMaskKeywordMatches = content.matchAll(IPV4_WITH_MASK_KEYWORD_PATTERN);
+    for (const match of ipMaskKeywordMatches) {
+      const ip = match[1];
+      const mask = match[2];
+      if (ip && mask && isValidIPv4(ip) && isSubnetMask(mask)) {
+        const normalizedIP = normalizeIPv4(ip);
+        const prefix = maskToCidr(mask);
+        if (prefix >= 0) {
+          ipv4SubnetSet.add(`${normalizedIP}/${prefix}`);
+          ipsWithMasks.add(normalizedIP);
+        }
+      }
+    }
+    const ipWildcardMatches = content.matchAll(IPV4_WITH_WILDCARD_PATTERN);
+    for (const match of ipWildcardMatches) {
+      const ip = match[1];
+      const wildcard = match[2];
+      if (ip && wildcard && isValidIPv4(ip) && isWildcardMask(wildcard)) {
+        const normalizedIP = normalizeIPv4(ip);
+        const prefix = wildcardToCidr(wildcard);
+        if (prefix >= 0) {
+          ipv4SubnetSet.add(`${normalizedIP}/${prefix}`);
+          ipsWithMasks.add(normalizedIP);
+        }
+      }
+    }
+  }
+  const ipv4Matches = content.matchAll(IPV4_PATTERN);
+  for (const match of ipv4Matches) {
+    const ip = match[0];
+    if (isValidIPv4(ip)) {
+      const normalized = normalizeIPv4(ip);
+      if (!subnetNetworks.has(normalized) && !ipsWithMasks.has(normalized) && !isSubnetMask(normalized) && !isWildcardMask(normalized)) {
+        ipv4Set.add(normalized);
+      }
+    }
+  }
+  if (!options.skipIPv6) {
+    if (!options.skipSubnets) {
+      const ipv6CidrMatches = content.matchAll(IPV6_CIDR_PATTERN);
+      for (const match of ipv6CidrMatches) {
+        const subnet = match[0];
+        if (isValidSubnet(subnet)) {
+          const { network, prefix } = parseSubnet(subnet);
+          const normalizedNetwork = normalizeIPv6(network);
+          ipv6SubnetSet.add(`${normalizedNetwork}/${prefix}`);
+          subnetNetworks.add(normalizedNetwork);
+        }
+      }
+    }
+    const ipv6Matches = content.matchAll(IPV6_PATTERN);
+    for (const match of ipv6Matches) {
+      const ip = match[0];
+      if (isValidIPv6(ip)) {
+        const normalized = normalizeIPv6(ip);
+        if (!subnetNetworks.has(normalized)) {
+          ipv6Set.add(normalized);
+        }
+      }
+    }
+  }
+  const ipv4Addresses = sortIPv4Addresses([...ipv4Set]);
+  const ipv6Addresses = sortIPv6Addresses([...ipv6Set]);
+  const ipv4Subnets = sortSubnets([...ipv4SubnetSet], "ipv4");
+  const ipv6Subnets = sortSubnets([...ipv6SubnetSet], "ipv6");
+  const counts = {
+    ipv4: ipv4Addresses.length,
+    ipv6: ipv6Addresses.length,
+    ipv4Subnets: ipv4Subnets.length,
+    ipv6Subnets: ipv6Subnets.length,
+    total: ipv4Addresses.length + ipv6Addresses.length + ipv4Subnets.length + ipv6Subnets.length
+  };
+  return {
+    ipv4Addresses,
+    ipv6Addresses,
+    ipv4Subnets,
+    ipv6Subnets,
+    counts
+  };
+}
+
 // index.ts
 import { readFile } from "fs/promises";
 import { statSync as statSync2 } from "fs";
@@ -10340,7 +10685,7 @@ import { resolve as resolve4, dirname as dirname2, basename } from "path";
 
 // src/sarif.ts
 import { relative } from "path";
-function generateSarif(results, filePath, rules, options = {}) {
+function generateSarif(results, filePath, rules, options = {}, ipSummary) {
   const fileUri = options.relativePaths ? relative(options.baseDir ?? process.cwd(), filePath) : filePath;
   const sarifResults = results.map((result) => {
     return {
@@ -10407,7 +10752,7 @@ function generateSarif(results, filePath, rules, options = {}) {
         tool: {
           driver: {
             name: "Sentriflow",
-            version: "0.1.6",
+            version: "0.1.8",
             informationUri: "https://github.com/sentriflow/sentriflow",
             rules: sarifRules,
             // SEC-007: Include CWE taxonomy when rules reference it
@@ -10434,13 +10779,61 @@ function generateSarif(results, filePath, rules, options = {}) {
             }
           ]
         },
-        results: sarifResults
+        results: sarifResults,
+        // Include IP summary in properties if available
+        ...ipSummary && {
+          properties: {
+            ipSummary
+          }
+        }
       }
     ]
   };
   return JSON.stringify(report, null, 2);
 }
+function aggregateIPSummaries(summaries) {
+  if (summaries.length === 0) return void 0;
+  const ipv4Set = /* @__PURE__ */ new Set();
+  const ipv6Set = /* @__PURE__ */ new Set();
+  const ipv4SubnetSet = /* @__PURE__ */ new Set();
+  const ipv6SubnetSet = /* @__PURE__ */ new Set();
+  for (const summary of summaries) {
+    for (const ip of summary.ipv4Addresses) ipv4Set.add(ip);
+    for (const ip of summary.ipv6Addresses) ipv6Set.add(ip);
+    for (const subnet of summary.ipv4Subnets) ipv4SubnetSet.add(subnet);
+    for (const subnet of summary.ipv6Subnets) ipv6SubnetSet.add(subnet);
+  }
+  const ipv4Addresses = [...ipv4Set].sort((a, b) => {
+    const aParts = a.split(".").map(Number);
+    const bParts = b.split(".").map(Number);
+    for (let i = 0; i < 4; i++) {
+      if ((aParts[i] ?? 0) !== (bParts[i] ?? 0)) {
+        return (aParts[i] ?? 0) - (bParts[i] ?? 0);
+      }
+    }
+    return 0;
+  });
+  const ipv6Addresses = [...ipv6Set].sort();
+  const ipv4Subnets = [...ipv4SubnetSet].sort();
+  const ipv6Subnets = [...ipv6SubnetSet].sort();
+  return {
+    ipv4Addresses,
+    ipv6Addresses,
+    ipv4Subnets,
+    ipv6Subnets,
+    counts: {
+      ipv4: ipv4Addresses.length,
+      ipv6: ipv6Addresses.length,
+      ipv4Subnets: ipv4Subnets.length,
+      ipv6Subnets: ipv6Subnets.length,
+      total: ipv4Addresses.length + ipv6Addresses.length + ipv4Subnets.length + ipv6Subnets.length
+    }
+  };
+}
 function generateMultiFileSarif(fileResults, rules, options = {}) {
+  const aggregatedIpSummary = aggregateIPSummaries(
+    fileResults.map((fr) => fr.ipSummary).filter((s) => !!s)
+  );
   const allSarifResults = fileResults.flatMap(({ filePath, results }) => {
     const fileUri = options.relativePaths ? relative(options.baseDir ?? process.cwd(), filePath) : filePath;
     return results.map((result) => ({
@@ -10513,7 +10906,7 @@ function generateMultiFileSarif(fileResults, rules, options = {}) {
         tool: {
           driver: {
             name: "Sentriflow",
-            version: "0.1.6",
+            version: "0.1.8",
             informationUri: "https://github.com/sentriflow/sentriflow",
             rules: sarifRules,
             // SEC-007: Include CWE taxonomy when rules reference it
@@ -10544,7 +10937,13 @@ function generateMultiFileSarif(fileResults, rules, options = {}) {
             }
           ]
         },
-        results: allSarifResults
+        results: allSarifResults,
+        // Include aggregated IP summary in properties if available
+        ...aggregatedIpSummary && {
+          properties: {
+            ipSummary: aggregatedIpSummary
+          }
+        }
       }
     ]
   };
@@ -10556,10 +10955,12 @@ var NoMulticastBroadcastIp = {
   id: "NET-IP-001",
   selector: "ip address",
   vendor: "common",
+  category: "IP-Addressing",
   metadata: {
     level: "error",
     obu: "Network Engineering",
     owner: "NetOps",
+    description: "Ensure IP addresses are not Multicast, Broadcast, or Network ID addresses.",
     remediation: "Configure a valid unicast IP address. Do not use Multicast, Broadcast, or Network ID addresses."
   },
   check: (node) => {
@@ -10669,10 +11070,12 @@ var InterfaceDescriptionRequired = {
   id: "NET-DOC-001",
   selector: "interface",
   vendor: "common",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
     owner: "NetOps",
+    description: "Ensure interfaces have descriptive labels for operational clarity.",
     remediation: 'Add a description to the interface using the "description" command.'
   },
   check: (node) => {
@@ -10750,6 +11153,7 @@ var TrunkNoDTP = {
   id: "NET-TRUNK-001",
   selector: "interface",
   vendor: "cisco-ios",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -10783,6 +11187,7 @@ var AccessExplicitMode = {
   id: "NET-ACCESS-001",
   selector: "interface",
   vendor: "cisco-ios",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -10812,6 +11217,7 @@ var EnableSecretStrong = {
   id: "NET-AAA-003",
   selector: "enable",
   vendor: "cisco-ios",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -10848,6 +11254,7 @@ var CiscoNoPlaintextPasswords = {
   id: "NET-SEC-001",
   selector: "password",
   vendor: ["cisco-ios", "cisco-nxos"],
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -10935,6 +11342,7 @@ var RootAuthRequired = {
   id: "JUN-SYS-001",
   selector: "system",
   vendor: "juniper-junos",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -10979,6 +11387,7 @@ var JunosBgpRouterId = {
   id: "JUN-BGP-001",
   selector: "routing-options",
   vendor: "juniper-junos",
+  category: "Routing",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11011,6 +11420,7 @@ var JunosFirewallDefaultDeny = {
   id: "JUN-FW-001",
   selector: "firewall",
   vendor: "juniper-junos",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -11082,6 +11492,7 @@ var SshEnabled = {
   id: "ARU-SEC-001",
   selector: "ssh",
   vendor: ["aruba-aoscx", "aruba-aosswitch", "aruba-wlc"],
+  category: "Session-Management",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11114,6 +11525,7 @@ var NtpConfigured = {
   id: "ARU-NTP-001",
   selector: "ntp",
   vendor: ["aruba-aoscx", "aruba-aosswitch", "aruba-wlc"],
+  category: "Time-Synchronization",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11154,6 +11566,7 @@ var AosCxInterfaceDescription = {
   id: "AOSCX-IF-001",
   selector: "interface",
   vendor: "aruba-aoscx",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11195,6 +11608,7 @@ var AosCxTrunkAllowedVlans = {
   id: "AOSCX-L2-001",
   selector: "interface",
   vendor: "aruba-aoscx",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11245,6 +11659,7 @@ var AosSwitchVlanName = {
   id: "AOSSW-L2-001",
   selector: "vlan",
   vendor: "aruba-aosswitch",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11286,6 +11701,7 @@ var AosSwitchManagerPassword = {
   id: "AOSSW-SEC-001",
   selector: "password",
   vendor: "aruba-aosswitch",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11326,6 +11742,7 @@ var WlcSsidEncryption = {
   id: "ARUWLC-WLAN-001",
   selector: "wlan ssid-profile",
   vendor: "aruba-wlc",
+  category: "Wireless",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11379,6 +11796,7 @@ var WlcRadiusHost = {
   id: "ARUWLC-AAA-001",
   selector: "aaa authentication-server radius",
   vendor: "aruba-wlc",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11440,6 +11858,7 @@ var HostnameRequired = {
   id: "PAN-SYS-001",
   selector: "deviceconfig",
   vendor: "paloalto-panos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11483,6 +11902,7 @@ var SecurityRuleLogging = {
   id: "PAN-SEC-001",
   selector: "rulebase",
   vendor: "paloalto-panos",
+  category: "Logging",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -11533,6 +11953,7 @@ var ZoneProtectionRequired = {
   id: "PAN-ZONE-001",
   selector: "zone",
   vendor: "paloalto-panos",
+  category: "Network-Segmentation",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11595,6 +12016,7 @@ var HostnameRequired2 = {
   id: "ARI-SYS-001",
   selector: "hostname",
   vendor: "arista-eos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11629,6 +12051,7 @@ var MlagConfigComplete = {
   id: "ARI-MLAG-001",
   selector: "mlag configuration",
   vendor: "arista-eos",
+  category: "High-Availability",
   metadata: {
     level: "error",
     obu: "Network Engineering",
@@ -11674,6 +12097,7 @@ var InterfaceDescription = {
   id: "ARI-INT-001",
   selector: "interface Ethernet",
   vendor: "arista-eos",
+  category: "Documentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -11731,6 +12155,7 @@ var VyosHostnameRequired = {
   id: "VYOS-SYS-001",
   selector: "system",
   vendor: "vyos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11763,6 +12188,7 @@ var VyosNoPlaintextPassword = {
   id: "VYOS-SEC-001",
   selector: "authentication",
   vendor: "vyos",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11797,6 +12223,7 @@ var VyosInterfaceDescription = {
   id: "VYOS-IF-001",
   selector: "interfaces",
   vendor: "vyos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11840,6 +12267,7 @@ var VyosFirewallDefaultAction = {
   id: "VYOS-FW-001",
   selector: "firewall",
   vendor: "vyos",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -11907,6 +12335,7 @@ var HostnameRequired3 = {
   id: "FGT-SYS-001",
   selector: "config system global",
   vendor: "fortinet-fortigate",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -11939,6 +12368,7 @@ var AdminTrustedHostRequired = {
   id: "FGT-ADMIN-001",
   selector: "config system admin",
   vendor: "fortinet-fortigate",
+  category: "Authentication",
   metadata: {
     level: "error",
     obu: "Security",
@@ -11993,6 +12423,7 @@ var PolicyLoggingRequired = {
   id: "FGT-POL-001",
   selector: "config firewall policy",
   vendor: "fortinet-fortigate",
+  category: "Logging",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -12059,6 +12490,7 @@ var ExosSysnameRequired = {
   id: "EXOS-SYS-001",
   selector: "configure snmp sysname",
   vendor: "extreme-exos",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12092,6 +12524,7 @@ var ExosSsh2Enabled = {
   id: "EXOS-SEC-001",
   selector: "enable ssh2",
   vendor: "extreme-exos",
+  category: "Session-Management",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -12123,6 +12556,7 @@ var ExosVlanNaming = {
   id: "EXOS-VLAN-001",
   selector: "create vlan",
   vendor: "extreme-exos",
+  category: "Documentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -12179,6 +12613,7 @@ var VossSysNameRequired = {
   id: "VOSS-SYS-001",
   selector: "snmp-server name",
   vendor: "extreme-voss",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12212,6 +12647,7 @@ var VossVlanIsidRequired = {
   id: "VOSS-VLAN-001",
   selector: "vlan create",
   vendor: "extreme-voss",
+  category: "Network-Segmentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -12264,6 +12700,7 @@ var VossInterfaceDefaultVlan = {
   id: "VOSS-INT-001",
   selector: "interface GigabitEthernet",
   vendor: "extreme-voss",
+  category: "Network-Segmentation",
   metadata: {
     level: "info",
     obu: "Network Engineering",
@@ -12348,6 +12785,7 @@ var SysnameRequired = {
   id: "HUAWEI-SYS-001",
   selector: "sysname",
   vendor: "huawei-vrp",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12380,6 +12818,7 @@ var InterfaceDescriptionRequired2 = {
   id: "HUAWEI-IF-001",
   selector: "interface",
   vendor: "huawei-vrp",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12432,6 +12871,7 @@ var VtySshRequired = {
   id: "HUAWEI-VTY-002",
   selector: "user-interface vty",
   vendor: "huawei-vrp",
+  category: "Session-Management",
   metadata: {
     level: "error",
     obu: "Security",
@@ -12496,6 +12936,7 @@ var MikrotikSystemIdentity = {
   id: "MIK-SYS-001",
   selector: "/system identity",
   vendor: "mikrotik-routeros",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12528,6 +12969,7 @@ var MikrotikDisableUnusedServices = {
   id: "MIK-SEC-001",
   selector: "/ip service",
   vendor: "mikrotik-routeros",
+  category: "Service-Hardening",
   metadata: {
     level: "warning",
     obu: "Security",
@@ -12572,6 +13014,7 @@ var MikrotikInputChainDrop = {
   id: "MIK-FW-001",
   selector: "/ip firewall filter",
   vendor: "mikrotik-routeros",
+  category: "Network-Segmentation",
   metadata: {
     level: "error",
     obu: "Security",
@@ -12625,6 +13068,7 @@ var SystemNameRequired = {
   id: "NOKIA-SYS-001",
   selector: "system",
   vendor: "nokia-sros",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12657,6 +13101,7 @@ var PortDescriptionRequired = {
   id: "NOKIA-PORT-001",
   selector: "port",
   vendor: "nokia-sros",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12709,6 +13154,7 @@ var BgpRouterIdRequired = {
   id: "NOKIA-BGP-001",
   selector: "bgp",
   vendor: "nokia-sros",
+  category: "Routing",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12765,6 +13211,7 @@ var CumulusInterfaceDescription = {
   id: "CUM-IF-001",
   selector: "iface",
   vendor: "cumulus-linux",
+  category: "Documentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12807,6 +13254,7 @@ var CumulusBridgeVlans = {
   id: "CUM-BR-001",
   selector: "iface",
   vendor: "cumulus-linux",
+  category: "Network-Segmentation",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12859,6 +13307,7 @@ var CumulusBgpRouterId = {
   id: "CUM-BGP-001",
   selector: "router bgp",
   vendor: "cumulus-linux",
+  category: "Routing",
   metadata: {
     level: "warning",
     obu: "Network Engineering",
@@ -12915,6 +13364,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-001",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Network-Segmentation",
       metadata: {
         level: "warning",
         obu: "Network Engineering",
@@ -12953,6 +13403,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-002",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Network-Segmentation",
       metadata: {
         level: "info",
         obu: "Network Engineering",
@@ -12991,6 +13442,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-003",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Documentation",
       metadata: {
         level: "warning",
         obu: "Network Engineering",
@@ -13024,6 +13476,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-004",
       selector: "interface",
       vendor: "cisco-ios",
+      category: "Protocol-Security",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13066,6 +13519,7 @@ var cisco_json_rules_default = {
       id: "JSON-CISCO-005",
       selector: "line vty",
       vendor: "cisco-ios",
+      category: "Session-Management",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13101,6 +13555,7 @@ var common_json_rules_default = {
       id: "JSON-COMMON-001",
       selector: "interface",
       vendor: "common",
+      category: "Documentation",
       metadata: {
         level: "info",
         obu: "Network Engineering",
@@ -13148,6 +13603,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-001",
       selector: "system services",
       vendor: "juniper-junos",
+      category: "Session-Management",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13180,6 +13636,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-002",
       selector: "system services",
       vendor: "juniper-junos",
+      category: "Service-Hardening",
       metadata: {
         level: "error",
         obu: "Security",
@@ -13202,6 +13659,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-003",
       selector: "system",
       vendor: "juniper-junos",
+      category: "Session-Management",
       metadata: {
         level: "warning",
         obu: "Security",
@@ -13221,6 +13679,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-004",
       selector: "protocols ospf area",
       vendor: "juniper-junos",
+      category: "Routing",
       metadata: {
         level: "warning",
         obu: "Network Engineering",
@@ -13240,6 +13699,7 @@ var juniper_json_rules_default = {
       id: "JSON-JUNOS-005",
       selector: "system syslog",
       vendor: "juniper-junos",
+      category: "Logging",
       metadata: {
         level: "warning",
         obu: "Operations",
@@ -14397,7 +14857,7 @@ function isStdinRequested(files) {
 
 // index.ts
 var program = new Command();
-program.name("sentriflow").description("SentriFlow Network Configuration Validator").version("0.1.6").argument("[files...]", "Path(s) to configuration file(s) (supports multiple files)").option("--ast", "Output the AST instead of rule results").option("-f, --format <format>", "Output format (json, sarif)", "json").option("-q, --quiet", "Only output failures (suppress passed results)").option("-c, --config <path>", "Path to config file (default: auto-detect)").option("--no-config", "Ignore config file").option("-r, --rules <path>", "Additional rules file to load (legacy)").option("-p, --rule-pack <path>", "Rule pack file to load").option(
+program.name("sentriflow").description("SentriFlow Network Configuration Validator").version("0.1.8").argument("[files...]", "Path(s) to configuration file(s) (supports multiple files)").option("--ast", "Output the AST instead of rule results").option("-f, --format <format>", "Output format (json, sarif)", "json").option("-q, --quiet", "Only output failures (suppress passed results)").option("-c, --config <path>", "Path to config file (default: auto-detect)").option("--no-config", "Ignore config file").option("-r, --rules <path>", "Additional rules file to load (legacy)").option("-p, --rule-pack <path>", "Rule pack file to load").option(
   "--encrypted-pack <path...>",
   "SEC-012: Path(s) to encrypted rule pack(s) (.grpx), can specify multiple"
 ).option(
@@ -14690,10 +15150,12 @@ Parsing complete: ${allAsts.length} files`);
           const passed = results2.filter((r) => r.passed).length;
           totalFailures += failures;
           totalPassed += passed;
+          const fileIpSummary = extractIPSummary(content2);
           allFileResults.push({
             filePath: filePath2,
             results: results2,
-            vendor: { id: vendor2.id, name: vendor2.name }
+            vendor: { id: vendor2.id, name: vendor2.name },
+            ipSummary: fileIpSummary
           });
         } catch (err) {
           const errMsg = err instanceof Error ? err.message : "Unknown error";
@@ -14725,7 +15187,8 @@ Parsing complete: ${allAsts.length} files`);
           files: allFileResults.map((fr) => ({
             file: fr.filePath,
             vendor: fr.vendor,
-            results: fr.results
+            results: fr.results,
+            ipSummary: fr.ipSummary
           }))
         };
         console.log(JSON.stringify(output, null, 2));
@@ -14801,17 +15264,19 @@ Scan complete: ${allFileResults.length} files, ${totalFailures} failures, ${tota
       if (options.quiet) {
         results2 = results2.filter((r) => !r.passed);
       }
+      const stdinIpSummary = extractIPSummary(content2);
       if (options.format === "sarif") {
         const sarifOptions = {
           relativePaths: options.relativePaths,
           baseDir: process.cwd()
         };
-        console.log(generateSarif(results2, "<stdin>", stdinRules, sarifOptions));
+        console.log(generateSarif(results2, "<stdin>", stdinRules, sarifOptions, stdinIpSummary));
       } else {
         const output = {
           file: "<stdin>",
           vendor: { id: vendor2.id, name: vendor2.name },
-          results: results2
+          results: results2,
+          ipSummary: stdinIpSummary
         };
         console.log(JSON.stringify(output, null, 2));
       }
@@ -14870,10 +15335,12 @@ Scan complete: ${allFileResults.length} files, ${totalFailures} failures, ${tota
           const passed = results2.filter((r) => r.passed).length;
           totalFailures += failures;
           totalPassed += passed;
+          const fileIpSummary = extractIPSummary(content2);
           allFileResults.push({
             filePath: filePath2,
             results: results2,
-            vendor: { id: vendor2.id, name: vendor2.name }
+            vendor: { id: vendor2.id, name: vendor2.name },
+            ipSummary: fileIpSummary
           });
         } catch (err) {
           const errMsg = err instanceof Error ? err.message : "Unknown error";
@@ -14900,7 +15367,8 @@ Scan complete: ${allFileResults.length} files, ${totalFailures} failures, ${tota
           files: allFileResults.map((fr) => ({
             file: fr.filePath,
             vendor: fr.vendor,
-            results: fr.results
+            results: fr.results,
+            ipSummary: fr.ipSummary
           }))
         };
         console.log(JSON.stringify(output, null, 2));
@@ -14985,13 +15453,14 @@ Scan complete: ${allFileResults.length} files, ${totalFailures} failures, ${tota
     if (options.quiet) {
       results = results.filter((r) => !r.passed);
     }
+    const ipSummary = extractIPSummary(content);
     if (options.format === "sarif") {
       const sarifOptions = {
         relativePaths: options.relativePaths,
         baseDir: process.cwd()
       };
       console.log(
-        generateSarif(results, filePath, singleFileRules, sarifOptions)
+        generateSarif(results, filePath, singleFileRules, sarifOptions, ipSummary)
       );
     } else {
       const output = {
@@ -14999,7 +15468,8 @@ Scan complete: ${allFileResults.length} files, ${totalFailures} failures, ${tota
           id: vendor.id,
           name: vendor.name
         },
-        results
+        results,
+        ipSummary
       };
       console.log(JSON.stringify(output, null, 2));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentriflow/cli",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "SentriFlow CLI - Network configuration linter and validator",
   "license": "Apache-2.0",
   "main": "dist/index.js",