codesentry 0.1.10 → 0.2.1

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { createRequire as createRequire4 } from "module";
+import { readFileSync as readFileSync3 } from "fs";
+import { createRequire as createRequire5 } from "module";
 import { Command } from "commander";
 import figlet from "figlet";
 import gradient from "gradient-string";
@@ -45,13 +45,13 @@ var isExecImport = (specifier) => {
   return specifier.type === "ImportSpecifier" && imported?.type === "Identifier" && EXEC_METHOD_NAMES.has(imported.name);
 };
 var isNamespaceImport = (specifier) => specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier";
+var bindingSetForImportSpecifier = (specifier, bindings) => isExecImport(specifier) ? bindings.directCalls : isNamespaceImport(specifier) ? bindings.namespaces : void 0;
 var collectImportBinding = (specifier, bindings) => {
   const name = localName(specifier);
   if (!name) {
     return;
   }
-  const bindingSet = isExecImport(specifier) ? bindings.directCalls : isNamespaceImport(specifier) ? bindings.namespaces : void 0;
-  bindingSet?.add(name);
+  bindingSetForImportSpecifier(specifier, bindings)?.add(name);
 };
 var collectFromImportDeclaration = (node, bindings) => {
   if (!isChildProcessModuleSpecifier(node.source)) {
@@ -71,13 +71,15 @@ var collectDirectCallBindings = (id, bindings) => {
     }
   }
 };
+var namespaceNameFromDeclaratorId = (id) => id?.type === "Identifier" ? id.name : void 0;
+var destructuredBindingsFromDeclaratorId = (id) => id?.type === "ObjectPattern" ? id : void 0;
 var collectFromVariableDeclarator = (node, bindings) => {
   if (!isRequireCall(node.init)) {
     return;
   }
   const id = node.id;
-  const namespaceName = id?.type === "Identifier" ? id.name : void 0;
-  const destructuredBindings = id?.type === "ObjectPattern" ? id : void 0;
+  const namespaceName = namespaceNameFromDeclaratorId(id);
+  const destructuredBindings = destructuredBindingsFromDeclaratorId(id);
   namespaceName && bindings.namespaces.add(namespaceName);
   destructuredBindings && collectDirectCallBindings(destructuredBindings, bindings);
 };
@@ -92,11 +94,8 @@ var collectChildProcessBindings = (sourceFile) => {
   });
   return bindings;
 };
-var isKnownChildProcessCallee = (callee, bindings) => {
-  if (callee?.type === "Identifier") {
-    return bindings.directCalls.has(callee.name);
-  }
-  if (callee?.type !== "MemberExpression") {
+var isKnownChildProcessMemberCallee = (callee, bindings) => {
+  if (callee.type !== "MemberExpression") {
     return false;
   }
   const object = callee.object;
@@ -104,6 +103,12 @@ var isKnownChildProcessCallee = (callee, bindings) => {
   const methodName = property?.type === "Identifier" ? property.name : void 0;
   return !!methodName && EXEC_METHOD_NAMES.has(methodName) && object?.type === "Identifier" && bindings.namespaces.has(object.name);
 };
+var isKnownChildProcessCallee = (callee, bindings) => {
+  if (callee?.type === "Identifier") {
+    return bindings.directCalls.has(callee.name);
+  }
+  return callee !== void 0 && isKnownChildProcessMemberCallee(callee, bindings);
+};
 var isDynamicCommandArgument = (argument) => argument?.type === "StringLiteral" ? false : argument?.type === "TemplateLiteral" ? (argument.expressions?.length ?? 0) > 0 : argument !== void 0;
 var isCommandInjectionCall = (node, bindings) => {
   if (node.type !== "CallExpression") {
@@ -141,9 +146,12 @@ var commandInjectionRule = {
   }
 };
 
+// src/commands/scan/scan-options.ts
+var withScanOptions = (command) => command.option("--json", "exibe o resultado em JSON").option("--tests", "inclui arquivos de teste na an\xE1lise (por padr\xE3o s\xE3o ignorados)");
+
 // src/commands/scan/scan-runner.ts
 import { writeFile } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import chalk2 from "chalk";
 import { Listr } from "listr2";
 
@@ -169,15 +177,53 @@ var formatErrorChain = (error) => {
 // src/reporters/console.reporter.ts
 import chalk from "chalk";
 import Table from "cli-table3";
+
+// src/scanner/scan-result.ts
+var DEPENDENCY_AUDIT_NOTE = 'Dependency audit n\xE3o foi inclu\xEDdo neste scan \u2014 rode "codesentry dependency-audit" separadamente.';
+var ZERO_SEMGREP_COVERAGE_WARNING = "Semgrep n\xE3o analisou nenhum arquivo nesta execu\xE7\xE3o \u2014 verifique se o ruleset offline est\xE1 instalado/preparado.";
+var mergeScanResults = (nativeResult, semgrepResult) => ({
+  scannedFiles: nativeResult.scannedFiles,
+  findings: [...nativeResult.findings, ...semgrepResult.findings],
+  durationMs: nativeResult.durationMs + semgrepResult.durationMs,
+  engines: {
+    codesentry: nativeResult.engines?.codesentry ?? nativeResult.scannedFiles,
+    semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
+  }
+});
+var finalizeScanResult = (result, dependencyAuditCoverage2 = false) => ({
+  ...result,
+  engines: { ...result.engines, dependencyAudit: dependencyAuditCoverage2 },
+  warnings: result.engines?.semgrep === 0 ? [...result.warnings ?? [], ZERO_SEMGREP_COVERAGE_WARNING] : result.warnings
+});
+
+// src/reporters/console.reporter.ts
 var SEVERITY_COLOR = {
   low: (text2) => chalk.gray(text2),
   medium: (text2) => chalk.yellow(text2),
   high: (text2) => chalk.red(text2),
   critical: (text2) => chalk.bgRed.white(text2)
 };
-var coverageText = (result) => result.engines?.semgrep === void 0 ? "" : ` CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s).`;
+var semgrepCoverage = (result) => result.engines?.semgrep === void 0 ? void 0 : `CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s)`;
+var dependencyAuditCoverage = (result) => typeof result.engines?.dependencyAudit === "number" ? `Dependency audit: ${result.engines.dependencyAudit} pacote(s) via npm audit` : void 0;
+var osvCoverage = (result) => result.engines?.osv ? `OSV.dev: ${result.engines.osv.checked}/${result.engines.osv.total} verificados` : void 0;
+var coverageParts = (result) => [semgrepCoverage(result), dependencyAuditCoverage(result), osvCoverage(result)].filter(
+  (part) => part !== void 0
+);
+var coverageText = (result) => {
+  const parts = coverageParts(result);
+  return parts.length ? ` ${parts.join("; ")}.` : "";
+};
+var printNotes = (result) => {
+  if (result.engines?.dependencyAudit === false) {
+    console.log(chalk.cyan(DEPENDENCY_AUDIT_NOTE));
+  }
+  for (const warning of result.warnings ?? []) {
+    console.log(chalk.yellow(`Aviso: ${warning}`));
+  }
+};
 var printCleanReport = (result, coverage) => {
   console.log(chalk.green(`Nenhum problema encontrado (${result.scannedFiles} arquivos analisados).${coverage}`));
+  printNotes(result);
 };
 var findingsTable = (result) => {
   const table = new Table({ head: ["Severity", "Rule", "File", "Line", "Message"] });
@@ -201,6 +247,7 @@ var printFindingsReport = (result, coverage) => {
 ${result.findings.length} problema(s) encontrado(s) em ${result.scannedFiles} arquivo(s) (${result.durationMs}ms).${coverage}`
     )
   );
+  printNotes(result);
 };
 var printConsoleReport = (result) => {
   const coverage = coverageText(result);
@@ -261,8 +308,10 @@ var reportHeader = (result, generatedAt) => [
   ],
   `- **Dura\xE7\xE3o:** ${result.durationMs}ms`,
   `- **Total de problemas:** ${result.findings.length}`,
+  ...result.engines?.dependencyAudit === false ? [`- **Nota:** ${DEPENDENCY_AUDIT_NOTE}`] : [],
   ""
 ];
+var warningsSection = (result) => (result.warnings ?? []).length === 0 ? [] : ["## Avisos", "", ...(result.warnings ?? []).map((warning) => `- ${warning}`), ""];
 var summaryTable = (bySeverity) => {
   const lines = ["## Resumo por severidade", "", "| Severidade | Quantidade |", "| --- | --- |"];
   for (const severity of SEVERITY_ORDER) {
@@ -281,76 +330,410 @@ var severitySections = (bySeverity) => {
   }
   return lines;
 };
+var osvCheckedSection = (result) => {
+  const { osvCheckedPackages } = result;
+  if (!osvCheckedPackages || osvCheckedPackages.length === 0) {
+    return [];
+  }
+  const checked = result.engines?.osv?.checked ?? osvCheckedPackages.length;
+  const total = result.engines?.osv?.total ?? osvCheckedPackages.length;
+  return [
+    `## Depend\xEAncias verificadas no OSV.dev (${checked}/${total})`,
+    "",
+    ...osvCheckedPackages.map((pkg) => `- ${pkg}`),
+    ""
+  ];
+};
 var toMarkdownReport = (result, generatedAt = /* @__PURE__ */ new Date()) => {
   const bySeverity = groupBy(result.findings, (f) => f.severity);
-  return [...reportHeader(result, generatedAt), ...summaryTable(bySeverity), ...severitySections(bySeverity)].join(
-    "\n"
-  );
+  return [
+    ...reportHeader(result, generatedAt),
+    ...warningsSection(result),
+    ...summaryTable(bySeverity),
+    ...severitySections(bySeverity),
+    ...osvCheckedSection(result)
+  ].join("\n");
 };
 
-// src/scanner/scan-result.ts
-var mergeScanResults = (nativeResult, semgrepResult) => ({
-  scannedFiles: nativeResult.scannedFiles,
-  findings: [...nativeResult.findings, ...semgrepResult.findings],
-  durationMs: nativeResult.durationMs + semgrepResult.durationMs,
-  engines: {
-    codesentry: nativeResult.engines?.codesentry ?? nativeResult.scannedFiles,
-    semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
+// src/scanner/dependency-audit.ts
+import { execFile } from "child_process";
+import { readFile } from "fs/promises";
+import { join } from "path";
+import { promisify } from "util";
+
+// src/scanner/run-with-concurrency-limit.ts
+import pLimit from "p-limit";
+var runWithConcurrencyLimit = async (items, concurrency, task) => {
+  const limit = pLimit(concurrency);
+  return Promise.all(items.map((item) => limit(() => task(item))));
+};
+
+// src/scanner/osv-client.ts
+var OSV_BATCH_CHUNK_SIZE = 100;
+var OSV_DETAIL_CONCURRENCY = 10;
+var OSV_API_BASE = "https://api.osv.dev/v1";
+var SEVERITY_MAP = {
+  LOW: "low",
+  MODERATE: "medium",
+  HIGH: "high",
+  CRITICAL: "critical"
+};
+var chunk = (items, size) => {
+  const chunks = [];
+  for (let i = 0; i < items.length; i += size) {
+    chunks.push(items.slice(i, i + size));
   }
-});
+  return chunks;
+};
+var zipVulnIdsByPackage = (packages, body) => {
+  const vulnIdsByPackage = /* @__PURE__ */ new Map();
+  packages.forEach((pkg, index) => {
+    const ids = body.results?.[index]?.vulns?.map((v) => v.id);
+    if (ids?.length) {
+      vulnIdsByPackage.set(`${pkg.name}@${pkg.version}`, ids);
+    }
+  });
+  return vulnIdsByPackage;
+};
+var queryBatchChunk = async (packages, fetchImpl) => {
+  try {
+    const response = await fetchImpl(`${OSV_API_BASE}/querybatch`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        queries: packages.map((p) => ({
+          package: { name: p.name, ecosystem: "npm" },
+          version: p.version
+        }))
+      })
+    });
+    if (!response.ok) {
+      return { vulnIdsByPackage: /* @__PURE__ */ new Map(), checkedPackages: [], failedCount: packages.length };
+    }
+    const body = await response.json();
+    return { vulnIdsByPackage: zipVulnIdsByPackage(packages, body), checkedPackages: packages, failedCount: 0 };
+  } catch {
+    return { vulnIdsByPackage: /* @__PURE__ */ new Map(), checkedPackages: [], failedCount: packages.length };
+  }
+};
+var queryOsvBatch = async (packages, fetchImpl = fetch) => {
+  const vulnIdsByPackage = /* @__PURE__ */ new Map();
+  const checkedPackages = [];
+  let failedCount = 0;
+  try {
+    for (const packageChunk of chunk(packages, OSV_BATCH_CHUNK_SIZE)) {
+      const result = await queryBatchChunk(packageChunk, fetchImpl);
+      result.vulnIdsByPackage.forEach((ids, key) => vulnIdsByPackage.set(key, ids));
+      checkedPackages.push(...result.checkedPackages);
+      failedCount += result.failedCount;
+    }
+  } catch {
+    failedCount += packages.length - checkedPackages.length;
+  }
+  return {
+    vulnIdsByPackage,
+    checkedPackages,
+    warning: failedCount > 0 ? `N\xE3o foi poss\xEDvel consultar o OSV.dev para ${failedCount} pacote(s).` : void 0
+  };
+};
+var fetchOneVulnerabilityDetail = async (id, fetchImpl, detailsById) => {
+  try {
+    const response = await fetchImpl(`${OSV_API_BASE}/vulns/${id}`);
+    if (!response.ok) {
+      return false;
+    }
+    detailsById.set(id, await response.json());
+    return true;
+  } catch {
+    return false;
+  }
+};
+var fetchOsvVulnerabilityDetails = async (ids, fetchImpl = fetch) => {
+  const uniqueIds = [...new Set(ids)];
+  const detailsById = /* @__PURE__ */ new Map();
+  let results;
+  try {
+    results = await runWithConcurrencyLimit(
+      uniqueIds,
+      OSV_DETAIL_CONCURRENCY,
+      (id) => fetchOneVulnerabilityDetail(id, fetchImpl, detailsById)
+    );
+  } catch (error) {
+    throw error;
+  }
+  const failedCount = results.filter((ok) => !ok).length;
+  return {
+    detailsById,
+    warning: failedCount > 0 ? `N\xE3o foi poss\xEDvel obter detalhes do OSV.dev para ${failedCount} advisory(s).` : void 0
+  };
+};
+var isMatchingNpmPackage = (affected, packageName) => affected.package.ecosystem === "npm" && affected.package.name === packageName;
+var extractFixedVersions = (vuln, packageName) => {
+  const fixedVersions = (vuln.affected ?? []).filter((affected) => isMatchingNpmPackage(affected, packageName)).flatMap((affected) => affected.ranges ?? []).flatMap((range) => range.events).map((event) => event.fixed).filter((fixed) => Boolean(fixed));
+  return [...new Set(fixedVersions)];
+};
+var mapOsvSeverity = (vuln) => {
+  const severity = vuln.database_specific?.severity;
+  if (!severity) {
+    return "medium";
+  }
+  return SEVERITY_MAP[severity] ?? "medium";
+};
+
+// src/scanner/package-lock-parser.ts
+var NODE_MODULES_SEGMENT = "node_modules/";
+var isUnresolvableSource = (resolved) => resolved !== void 0 && (resolved.startsWith("file:") || resolved.startsWith("git"));
+var nameFromKey = (key) => {
+  const lastIndex = key.lastIndexOf(NODE_MODULES_SEGMENT);
+  return lastIndex === -1 ? void 0 : key.slice(lastIndex + NODE_MODULES_SEGMENT.length);
+};
+var toLockedPackage = (key, entry) => {
+  if (entry.link || !entry.version || isUnresolvableSource(entry.resolved)) {
+    return void 0;
+  }
+  const name = entry.name ?? nameFromKey(key);
+  return name ? { name, version: entry.version } : void 0;
+};
+var assertSupportedLockfileVersion = (lockfileVersion) => {
+  if (lockfileVersion !== 2 && lockfileVersion !== 3) {
+    throw new Error("lockfileVersion 1 n\xE3o \xE9 suportado \u2014 regenere o lockfile com npm 7+.");
+  }
+};
+var parsePackageLock = (rawJson) => {
+  const parsed = JSON.parse(rawJson);
+  assertSupportedLockfileVersion(parsed.lockfileVersion);
+  const deduped = /* @__PURE__ */ new Map();
+  Object.entries(parsed.packages ?? {}).filter(([key]) => key.includes(NODE_MODULES_SEGMENT)).forEach(([key, entry]) => {
+    const locked = toLockedPackage(key, entry);
+    if (locked) {
+      deduped.set(`${locked.name}@${locked.version}`, locked);
+    }
+  });
+  return [...deduped.values()];
+};
+
+// src/scanner/dependency-audit.ts
+var execFileAsync = promisify(execFile);
+var SEVERITY_MAP2 = {
+  info: "low",
+  low: "low",
+  moderate: "medium",
+  high: "high",
+  critical: "critical"
+};
+var vulnerabilityTitle = (vulnerability) => {
+  const firstVia = vulnerability.via[0];
+  if (typeof firstVia === "object" && firstVia?.title) {
+    return firstVia.title;
+  }
+  return 'ver "npm audit" para detalhes';
+};
+var npmFixSuggestion = (vulnerability) => {
+  const { fixAvailable } = vulnerability;
+  if (fixAvailable === false) {
+    return "sem corre\xE7\xE3o dispon\xEDvel ainda";
+  }
+  if (fixAvailable === true) {
+    return `atualize para uma vers\xE3o fora do intervalo vulner\xE1vel (${vulnerability.range})`;
+  }
+  return `atualize para ${fixAvailable.name}@${fixAvailable.version}`;
+};
+var mapAuditReportToFindings = (report) => {
+  return Object.values(report.vulnerabilities).map((vulnerability) => ({
+    ruleId: "dependency-audit",
+    message: `Depend\xEAncia vulner\xE1vel: ${vulnerability.name} (${vulnerability.severity}) \u2014 ${vulnerabilityTitle(vulnerability)} \u2014 ${npmFixSuggestion(vulnerability)}`,
+    file: "package.json",
+    line: 1,
+    severity: SEVERITY_MAP2[vulnerability.severity]
+  }));
+};
+var osvFixSuggestion = (fixedVersions) => fixedVersions.length ? `atualize para ${fixedVersions.join(" ou ")}` : "nenhuma vers\xE3o corrigida publicada pelo OSV.dev ainda";
+var buildOsvFinding = (pkg, vuln) => {
+  const fixedVersions = extractFixedVersions(vuln, pkg.name);
+  return {
+    ruleId: "dependency-audit",
+    message: `OSV ${vuln.id}: ${pkg.name}@${pkg.version} (${mapOsvSeverity(vuln)}) \u2014 ${vuln.summary ?? "ver OSV.dev para detalhes"} \u2014 ${osvFixSuggestion(fixedVersions)}`,
+    file: "package-lock.json",
+    line: 1,
+    severity: mapOsvSeverity(vuln)
+  };
+};
+var findingsForLockedPackage = (pkg, vulnIdsByPackage, detailsById) => {
+  const ids = vulnIdsByPackage.get(`${pkg.name}@${pkg.version}`) ?? [];
+  return ids.map((id) => detailsById.get(id)).filter((vuln) => vuln !== void 0).map((vuln) => buildOsvFinding(pkg, vuln));
+};
+var mapOsvFindingsToRuleFindings = (lockedPackages, vulnIdsByPackage, detailsById, npmFlaggedNames) => lockedPackages.filter((pkg) => !npmFlaggedNames.has(pkg.name)).flatMap((pkg) => findingsForLockedPackage(pkg, vulnIdsByPackage, detailsById));
+var errorMessage = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var hasVulnerabilitiesRecord = (value) => typeof value === "object" && value !== null && typeof value.vulnerabilities === "object" && value.vulnerabilities !== null;
+var normalizeNpmAuditReport = (raw) => {
+  if (hasVulnerabilitiesRecord(raw)) {
+    return { report: { vulnerabilities: raw.vulnerabilities } };
+  }
+  const errorSummary = typeof raw === "object" && raw !== null && "error" in raw ? raw.error?.summary ?? "formato de resposta inesperado" : "formato de resposta inesperado";
+  return {
+    report: { vulnerabilities: {} },
+    warning: `"npm audit" n\xE3o retornou um relat\xF3rio v\xE1lido: ${errorSummary}.`
+  };
+};
+var combineWarnings = (...warnings) => {
+  const present = warnings.filter((warning) => Boolean(warning));
+  return present.length ? present.join(" ") : void 0;
+};
+var fetchDetailsForIds = (ids, fetchImpl) => ids.length ? fetchOsvVulnerabilityDetails(ids, fetchImpl) : Promise.resolve({ detailsById: /* @__PURE__ */ new Map(), warning: void 0 });
+var auditPackagesWithOsv = async (lockedPackages, npmFlaggedNames, fetchImpl = fetch) => {
+  try {
+    return await collectOsvAuditResult(lockedPackages, npmFlaggedNames, fetchImpl);
+  } catch (error) {
+    return {
+      findings: [],
+      checkedPackages: [],
+      warning: `N\xE3o foi poss\xEDvel consultar o OSV.dev: ${errorMessage(error)}.`
+    };
+  }
+};
+var collectOsvAuditResult = async (lockedPackages, npmFlaggedNames, fetchImpl) => {
+  try {
+    const {
+      vulnIdsByPackage,
+      checkedPackages,
+      warning: batchWarning
+    } = await queryOsvBatch(lockedPackages, fetchImpl);
+    const ids = [...new Set([...vulnIdsByPackage.values()].flat())];
+    const { detailsById, warning: detailsWarning } = await fetchDetailsForIds(ids, fetchImpl);
+    return {
+      findings: mapOsvFindingsToRuleFindings(
+        lockedPackages,
+        vulnIdsByPackage,
+        detailsById,
+        npmFlaggedNames
+      ),
+      checkedPackages,
+      warning: combineWarnings(batchWarning, detailsWarning)
+    };
+  } catch (error) {
+    throw new Error("N\xE3o foi poss\xEDvel consolidar os resultados do OSV.dev.", { cause: error });
+  }
+};
+var runNpmAudit = async (targetDir) => {
+  let stdout;
+  try {
+    ({ stdout } = await execFileAsync("npm", ["audit", "--json"], {
+      cwd: targetDir,
+      maxBuffer: 10 * 1024 * 1024
+    }));
+  } catch (error) {
+    const stdoutFromError = error.stdout;
+    if (!stdoutFromError) {
+      throw new Error(`N\xE3o foi poss\xEDvel executar "npm audit" em "${targetDir}".`, { cause: error });
+    }
+    stdout = stdoutFromError;
+  }
+  return JSON.parse(stdout);
+};
+var auditPackagesFromLockfile = async (targetDir, npmFlaggedNames, fetchImpl) => {
+  try {
+    const raw = await readFile(join(targetDir, "package-lock.json"), "utf-8");
+    const lockedPackages = parsePackageLock(raw);
+    const osvResult = await auditPackagesWithOsv(lockedPackages, npmFlaggedNames, fetchImpl);
+    return {
+      findings: osvResult.findings,
+      packagesAudited: lockedPackages.length,
+      osvChecked: { checked: osvResult.checkedPackages.length, total: lockedPackages.length },
+      osvCheckedPackages: osvResult.checkedPackages.map((pkg) => `${pkg.name}@${pkg.version}`).sort(),
+      warning: osvResult.warning
+    };
+  } catch (error) {
+    return {
+      findings: [],
+      packagesAudited: false,
+      warning: `N\xE3o foi poss\xEDvel checar o OSV.dev: ${errorMessage(error)}.`
+    };
+  }
+};
+var runDependencyAudit = async (targetDir, fetchImpl = fetch) => {
+  const startedAt = Date.now();
+  try {
+    const { report: npmReport, warning: npmWarning } = normalizeNpmAuditReport(await runNpmAudit(targetDir));
+    const npmFindings = mapAuditReportToFindings(npmReport);
+    const npmFlaggedNames = new Set(Object.keys(npmReport.vulnerabilities));
+    const osv = await auditPackagesFromLockfile(targetDir, npmFlaggedNames, fetchImpl);
+    const warnings = combineWarnings(npmWarning, osv.warning);
+    return {
+      scannedFiles: 1,
+      findings: [...npmFindings, ...osv.findings],
+      durationMs: Date.now() - startedAt,
+      engines: {
+        dependencyAudit: osv.packagesAudited === false ? npmFlaggedNames.size : osv.packagesAudited,
+        osv: osv.osvChecked
+      },
+      osvCheckedPackages: osv.osvCheckedPackages,
+      warnings: warnings ? [warnings] : void 0
+    };
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel auditar depend\xEAncias em "${targetDir}".`, { cause: error });
+  }
+};
 
 // src/scanner/scanner.ts
-import { readFile } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 import { availableParallelism } from "os";
 
 // src/scanner/file-finder.ts
 import { readdir } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
+
+// src/scanner/ignore-patterns.ts
+var ALWAYS_IGNORED_DIR_NAMES = ["node_modules", ".git", "dist", ".next", ".angular"];
+var TEST_DIR_NAMES = ["tests", "test", "__tests__"];
+var TEST_FILE_GLOBS = ["*.spec.*", "*.test.*"];
+var TEST_FILE_NAME_PATTERN = /\.(spec|test)\.[^./]+$/;
+var isIgnoredDirName = (name, includeTests = false) => ALWAYS_IGNORED_DIR_NAMES.includes(name) || !includeTests && TEST_DIR_NAMES.includes(name);
+var isTestFileName = (fileName) => TEST_FILE_NAME_PATTERN.test(fileName);
+
+// src/scanner/file-finder.ts
 var SCANNABLE_EXTENSIONS = [".js", ".ts", ".jsx", ".tsx"];
-var IGNORED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".next", "tests"]);
 var isScannable = (fileName) => SCANNABLE_EXTENSIONS.some((ext) => fileName.endsWith(ext));
-var filesFromEntry = async (currentDir, entry) => {
+var filesFromDirectory = async (currentDir, entry, includeTests) => {
+  return isIgnoredDirName(entry.name, includeTests) ? [] : walk(join2(currentDir, entry.name), includeTests);
+};
+var filesFromFile = (currentDir, entry, includeTests) => {
+  return entry.isFile() && isScannable(entry.name) && (includeTests || !isTestFileName(entry.name)) ? [join2(currentDir, entry.name)] : [];
+};
+var filesFromEntry = async (currentDir, entry, includeTests) => {
   if (entry.isDirectory()) {
-    return IGNORED_DIRS.has(entry.name) ? [] : walk(join(currentDir, entry.name));
+    return filesFromDirectory(currentDir, entry, includeTests);
   }
-  return entry.isFile() && isScannable(entry.name) ? [join(currentDir, entry.name)] : [];
+  return filesFromFile(currentDir, entry, includeTests);
 };
-var walk = async (currentDir) => {
+var walk = async (currentDir, includeTests) => {
   try {
     const entries = await readdir(currentDir, { withFileTypes: true });
-    return (await Promise.all(entries.map((entry) => filesFromEntry(currentDir, entry)))).flat();
+    return (await Promise.all(entries.map((entry) => filesFromEntry(currentDir, entry, includeTests)))).flat();
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel listar os arquivos em "${currentDir}".`, { cause: error });
   }
 };
-var findFiles = async (targetDir) => {
+var findFiles = async (targetDir, includeTests = false) => {
   try {
-    return await walk(targetDir);
+    return await walk(targetDir, includeTests);
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel listar os arquivos em "${targetDir}".`, { cause: error });
   }
 };
 
-// src/scanner/run-with-concurrency-limit.ts
-import pLimit from "p-limit";
-var runWithConcurrencyLimit = async (items, concurrency, task) => {
-  const limit = pLimit(concurrency);
-  return Promise.all(items.map((item) => limit(() => task(item))));
-};
-
 // src/scanner/scanner.ts
 var DEFAULT_SCAN_CONCURRENCY = Math.max(1, Math.min(8, availableParallelism()));
-var errorMessage = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var errorMessage2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var parseErrorFinding = (filePath, error) => ({
   ruleId: "parse-error",
-  message: `N\xE3o foi poss\xEDvel analisar este arquivo (erro de sintaxe): ${errorMessage(error)}`,
+  message: `N\xE3o foi poss\xEDvel analisar este arquivo (erro de sintaxe): ${errorMessage2(error)}`,
   file: filePath,
   line: 1,
   severity: "low"
 });
 var readFileContent = async (filePath) => {
   try {
-    return await readFile(filePath, "utf-8");
+    return await readFile2(filePath, "utf-8");
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel ler o arquivo "${filePath}".`, { cause: error });
   }
@@ -380,10 +763,10 @@ var scanFile = async (filePath, rules) => {
     throw new Error(`N\xE3o foi poss\xEDvel analisar o arquivo "${filePath}".`, { cause: error });
   }
 };
-var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY) => {
+var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY, includeTests = false) => {
   try {
     const startedAt = Date.now();
-    const files = await findFiles(targetDir);
+    const files = await findFiles(targetDir, includeTests);
     const findings = (await runWithConcurrencyLimit(files, concurrency, (filePath) => scanFile(filePath, rules))).flat();
     return {
       scannedFiles: files.length,
@@ -397,9 +780,9 @@ var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY) =
 };
 
 // src/scanner/semgrep.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import { delimiter, dirname as dirname2 } from "path";
-import { promisify } from "util";
+import { promisify as promisify2 } from "util";
 
 // src/scanner/semgrep-runtime.ts
 import { existsSync, readFileSync } from "fs";
@@ -416,6 +799,7 @@ var packageForPlatform = (platform, architecture) => {
   return void 0;
 };
 var unsupportedRuntimeMessage = (platform, architecture) => `O runtime Semgrep embutido n\xE3o est\xE1 dispon\xEDvel para ${platform}-${architecture}. O CodeSentry oferece suporte a Linux x64 e Windows x64.`;
+var errorReason = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var resolveBundledSemgrepRuntime = (platform = process.platform, architecture = process.arch, resolveManifestPath = (packageName) => require2.resolve(`${packageName}/runtime.json`)) => {
   const packageName = packageForPlatform(platform, architecture);
   if (!packageName) {
@@ -432,8 +816,7 @@ var resolveBundledSemgrepRuntime = (platform = process.platform, architecture =
     }
     return runtime;
   } catch (error) {
-    const reason = error instanceof Error ? error.message : "erro desconhecido";
-    throw new Error(`N\xE3o foi poss\xEDvel carregar o runtime Semgrep embutido: ${reason}`, { cause: error });
+    throw new Error(`N\xE3o foi poss\xEDvel carregar o runtime Semgrep embutido: ${errorReason(error)}`, { cause: error });
   }
 };
 
@@ -455,7 +838,7 @@ var resolveBundledSemgrepRuleset = () => {
 };
 
 // src/scanner/semgrep.ts
-var execFileAsync = promisify(execFile);
+var execFileAsync2 = promisify2(execFile2);
 var SEMGREP_SEVERITIES = {
   INFO: "low",
   WARNING: "medium",
@@ -482,23 +865,16 @@ var mapSemgrepReportToFindings = (report) => report.results.map((finding) => ({
   severity: SEMGREP_SEVERITIES[finding.extra.severity] ?? "medium"
 }));
 var outputFromError = (error) => typeof error.stdout === "string" ? error.stdout : void 0;
-var semgrepArgs = (ruleset) => [
+var excludeArgs = (names) => names.flatMap((name) => ["--exclude", name]);
+var semgrepArgs = (ruleset, includeTests) => [
   "scan",
   "--config",
   ruleset,
   "--metrics=off",
   "--json",
   "--quiet",
-  "--exclude",
-  "node_modules",
-  "--exclude",
-  ".git",
-  "--exclude",
-  "dist",
-  "--exclude",
-  ".next",
-  "--exclude",
-  "tests",
+  ...excludeArgs(ALWAYS_IGNORED_DIR_NAMES),
+  ...includeTests ? [] : excludeArgs([...TEST_DIR_NAMES, ...TEST_FILE_GLOBS]),
   // Não repetir targetDir aqui: o processo já roda com cwd = targetDir,
   // então o alvo relativo a esse cwd é o diretório atual.
   "."
@@ -511,9 +887,9 @@ var semgrepEnvironment = (runtime) => {
     PATH: `${semgrepDir}${delimiter}${dirname2(semgrepDir)}${delimiter}${process.env.PATH ?? ""}${delimiter}${systemPathFallback}`
   };
 };
-var executeSemgrep = async (targetDir, runtime, ruleset, execute) => {
+var executeSemgrep = async (targetDir, runtime, ruleset, execute, includeTests) => {
   try {
-    const { stdout } = await execute(runtime.semgrep, semgrepArgs(ruleset), {
+    const { stdout } = await execute(runtime.semgrep, semgrepArgs(ruleset, includeTests), {
       cwd: targetDir,
       maxBuffer: 20 * 1024 * 1024,
       env: semgrepEnvironment(runtime)
@@ -527,10 +903,10 @@ var executeSemgrep = async (targetDir, runtime, ruleset, execute) => {
     throw new Error("N\xE3o foi poss\xEDvel executar o Semgrep embutido.", { cause: error });
   }
 };
-var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync) => {
+var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync2, includeTests = false) => {
   const startedAt = Date.now();
   try {
-    const report = parseSemgrepReport(await executeSemgrep(targetDir, runtime, ruleset, execute));
+    const report = parseSemgrepReport(await executeSemgrep(targetDir, runtime, ruleset, execute, includeTests));
     const scannedFiles = report.paths?.scanned.length ?? 0;
     return {
       scannedFiles,
@@ -551,7 +927,7 @@ var generateMarkdownReportFilename = (date = /* @__PURE__ */ new Date()) => {
 };
 
 // src/commands/scan/scan-runner.ts
-var errorMessage2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var errorMessage3 = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var reportScanFailure = (error) => {
   process.exitCode = 1;
   console.error(`Falha ao executar o scan: ${formatErrorChain(error)}`);
@@ -567,25 +943,53 @@ var writeMarkdownReportIfNeeded = async (result, targetDir) => {
   if (result.findings.length <= MARKDOWN_REPORT_FINDINGS_THRESHOLD) {
     return;
   }
-  const filePath = join2(targetDir, generateMarkdownReportFilename());
+  const filePath = join3(targetDir, generateMarkdownReportFilename());
   try {
     await writeFile(filePath, toMarkdownReport(result), "utf-8");
     console.log(chalk2.cyan(`
 Relat\xF3rio detalhado gerado em: ${filePath}`));
   } catch (error) {
-    console.error(chalk2.red(`N\xE3o foi poss\xEDvel gerar o relat\xF3rio Markdown: ${errorMessage2(error)}`));
+    console.error(chalk2.red(`N\xE3o foi poss\xEDvel gerar o relat\xF3rio Markdown: ${errorMessage3(error)}`));
+  }
+};
+var runNativeAndSemgrep = async (path, rules, options) => {
+  try {
+    const includeTests = options.tests ?? false;
+    const nativeResult = await runScan(path, rules, options.concurrency, includeTests);
+    return options.semgrep ? mergeScanResults(
+      nativeResult,
+      await runBundledSemgrep(path, void 0, options.config, void 0, includeTests)
+    ) : nativeResult;
+  } catch (error) {
+    throw new Error(`Falha durante a an\xE1lise: ${errorMessage3(error)}`, { cause: error });
+  }
+};
+var runOptionalDependencyAudit = async (path, merged) => {
+  try {
+    const auditResult = await runDependencyAudit(path);
+    return finalizeScanResult(
+      {
+        ...merged,
+        findings: [...merged.findings, ...auditResult.findings],
+        warnings: [...merged.warnings ?? [], ...auditResult.warnings ?? []],
+        engines: { ...merged.engines, osv: auditResult.engines?.osv },
+        osvCheckedPackages: auditResult.osvCheckedPackages
+      },
+      auditResult.engines?.dependencyAudit ?? false
+    );
+  } catch (error) {
+    return finalizeScanResult({
+      ...merged,
+      warnings: [...merged.warnings ?? [], `Auditoria de depend\xEAncias falhou: ${errorMessage3(error)}.`]
+    });
   }
 };
 var runScanEngines = async (path, rules, options) => {
   try {
-    const nativeResult = await runScan(path, rules, options.concurrency);
-    if (!options.semgrep) {
-      return nativeResult;
-    }
-    const semgrepResult = await runBundledSemgrep(path, void 0, options.config);
-    return mergeScanResults(nativeResult, semgrepResult);
+    const merged = await runNativeAndSemgrep(path, rules, options);
+    return options.deps ? runOptionalDependencyAudit(path, merged) : finalizeScanResult(merged);
   } catch (error) {
-    throw new Error(`Falha durante a an\xE1lise: ${errorMessage2(error)}`, { cause: error });
+    throw error;
   }
 };
 var createScanTasks = (path, rules, taskTitle, options, onResult) => new Listr([
@@ -618,7 +1022,9 @@ var scanAndReport = async (path, rules, taskTitle, options) => {
 
 // src/commands/command-injection/command-injection.command.ts
 var registerCommandInjectionCommand = (program) => {
-  program.command("command-injection").description("Detecta child_process.exec()/execSync() recebendo entrada externa").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("command-injection").description("Detecta child_process.exec()/execSync() recebendo entrada externa").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [commandInjectionRule], "Checking command injection...", options)
   );
 };
@@ -689,8 +1095,11 @@ var walkNestingBlock = (node, depth, results) => {
   checkDepth(newDepth, node.loc?.start.line, results);
   walkChildren(node, newDepth, results);
 };
+var selectNonFunctionWalker = (node) => {
+  return node.type === "IfStatement" ? walkIfChain : NESTING_TYPES.has(node.type) ? walkNestingBlock : walkChildren;
+};
 var selectWalker = (node) => {
-  return FUNCTION_TYPES.has(node.type) ? walkFunction : node.type === "IfStatement" ? walkIfChain : NESTING_TYPES.has(node.type) ? walkNestingBlock : walkChildren;
+  return FUNCTION_TYPES.has(node.type) ? walkFunction : selectNonFunctionWalker(node);
 };
 var walk2 = (node, depth, results) => {
   selectWalker(node)(node, depth, results);
@@ -717,61 +1126,13 @@ var deepNestingRule = {
 
 // src/commands/deep-nesting/deep-nesting.command.ts
 var registerDeepNestingCommand = (program) => {
-  program.command("deep-nesting").description("Detecta blocos aninhados al\xE9m do limite recomendado").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("deep-nesting").description("Detecta blocos aninhados al\xE9m do limite recomendado").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [deepNestingRule], "Checking nesting depth...", options)
   );
 };
 
-// src/scanner/dependency-audit.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFileAsync2 = promisify2(execFile2);
-var SEVERITY_MAP = {
-  info: "low",
-  low: "low",
-  moderate: "medium",
-  high: "high",
-  critical: "critical"
-};
-var vulnerabilityTitle = (vulnerability) => {
-  const firstVia = vulnerability.via[0];
-  if (typeof firstVia === "object" && firstVia?.title) {
-    return firstVia.title;
-  }
-  return 'ver "npm audit" para detalhes';
-};
-var mapAuditReportToFindings = (report) => {
-  return Object.values(report.vulnerabilities).map((vulnerability) => ({
-    ruleId: "dependency-audit",
-    message: `Depend\xEAncia vulner\xE1vel: ${vulnerability.name} (${vulnerability.severity}) \u2014 ${vulnerabilityTitle(vulnerability)}`,
-    file: "package.json",
-    line: 1,
-    severity: SEVERITY_MAP[vulnerability.severity]
-  }));
-};
-var runDependencyAudit = async (targetDir) => {
-  const startedAt = Date.now();
-  let stdout;
-  try {
-    ({ stdout } = await execFileAsync2("npm", ["audit", "--json"], {
-      cwd: targetDir,
-      maxBuffer: 10 * 1024 * 1024
-    }));
-  } catch (error) {
-    const stdoutFromError = error.stdout;
-    if (!stdoutFromError) {
-      throw new Error(`N\xE3o foi poss\xEDvel executar "npm audit" em "${targetDir}".`, { cause: error });
-    }
-    stdout = stdoutFromError;
-  }
-  const report = JSON.parse(stdout);
-  return {
-    scannedFiles: 1,
-    findings: mapAuditReportToFindings(report),
-    durationMs: Date.now() - startedAt
-  };
-};
-
 // src/commands/dependency-audit/dependency-audit.command.ts
 var printAuditResult = (result, json) => {
   if (json) {
@@ -791,7 +1152,7 @@ var auditAndReport = async (path, options) => {
 };
 var registerDependencyAuditCommand = (program) => {
   program.command("dependency-audit").description(
-    'Audita as depend\xEAncias do projeto contra vulnerabilidades conhecidas (via "npm audit"; requer npm no PATH e acesso \xE0 rede)'
+    'Audita as depend\xEAncias do projeto contra vulnerabilidades conhecidas (via "npm audit" e OSV.dev; requer npm no PATH e acesso \xE0 rede)'
   ).argument("[path]", "diret\xF3rio do projeto a ser auditado", ".").option("--json", "exibe o resultado em JSON").action((path, options) => auditAndReport(path, options));
 };
 
@@ -829,7 +1190,9 @@ var emptyCatchRule = {
 
 // src/commands/empty-catch/empty-catch.command.ts
 var registerEmptyCatchCommand = (program) => {
-  program.command("empty-catch").description("Detecta blocos catch vazios").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("empty-catch").description("Detecta blocos catch vazios").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [emptyCatchRule], "Checking empty catch blocks...", options)
   );
 };
@@ -847,12 +1210,24 @@ var hasLimitOption = (options) => {
     return key?.type === "Identifier" && key.name === "limit";
   }) ?? false;
 };
+var getMemberCallParts = (node) => {
+  if (node.type !== "CallExpression") {
+    return { object: void 0, property: void 0, args: void 0 };
+  }
+  const callee = node.callee;
+  const args = node.arguments;
+  if (callee?.type !== "MemberExpression") {
+    return { object: void 0, property: void 0, args };
+  }
+  return {
+    object: callee.object,
+    property: callee.property,
+    args
+  };
+};
 var isBodyParserWithoutLimit = (node) => {
-  const callee = node.type === "CallExpression" ? node.callee : void 0;
-  const object = callee?.type === "MemberExpression" ? callee.object : void 0;
-  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  const { object, property, args } = getMemberCallParts(node);
   const isBodyParserCall = object?.type === "Identifier" && BODY_PARSER_OBJECTS.has(object.name) && property?.type === "Identifier" && BODY_PARSER_METHODS.has(property.name);
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
   return isBodyParserCall && !hasLimitOption(args?.[0]);
 };
 var findMissingBodyLimitLines = (filePath, content) => {
@@ -881,11 +1256,85 @@ var expressMissingBodyLimitRule = {
 
 // src/commands/express-missing-body-limit/express-missing-body-limit.command.ts
 var registerExpressMissingBodyLimitCommand = (program) => {
-  program.command("express-missing-body-limit").description("Detecta middlewares de body parsing do Express sem limite de tamanho de requisi\xE7\xE3o").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("express-missing-body-limit").description("Detecta middlewares de body parsing do Express sem limite de tamanho de requisi\xE7\xE3o").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [expressMissingBodyLimitRule], "Checking Express body limits...", options)
   );
 };
 
+// src/rules/hardcoded-authorization-value.rule.ts
+var HEADER_OR_COOKIE_NAME_PATTERN = /headers|cookies?/i;
+var accessObjectName = (object) => {
+  const objectProperty = object?.type === "MemberExpression" ? object.property : object;
+  return objectProperty?.type === "Identifier" ? objectProperty.name : void 0;
+};
+var isHeaderOrCookieAccessCall = (node) => {
+  const callee = node?.callee;
+  const property = callee?.property;
+  const object = callee?.object;
+  return node?.type === "CallExpression" && callee?.type === "MemberExpression" && property?.type === "Identifier" && property.name === "get" && HEADER_OR_COOKIE_NAME_PATTERN.test(accessObjectName(object) ?? "");
+};
+var collectStringConstants = (sourceFile) => {
+  const constants = /* @__PURE__ */ new Map();
+  visitSourceNodes(sourceFile, (node) => {
+    if (node.type !== "VariableDeclarator") {
+      return;
+    }
+    const id = node.id;
+    const init = node.init;
+    if (id?.type === "Identifier" && init?.type === "StringLiteral") {
+      constants.set(id.name, init.value);
+    }
+  });
+  return constants;
+};
+var isConstantStringSide = (node, constants) => {
+  if (node?.type === "StringLiteral") {
+    return true;
+  }
+  return node?.type === "Identifier" && constants.has(node.name);
+};
+var isHardcodedAuthorizationComparison = (node, constants) => {
+  const left = node.left;
+  const right = node.right;
+  const isEquality = node.operator === "===" || node.operator === "==";
+  return node.type === "BinaryExpression" && isEquality && (isHeaderOrCookieAccessCall(left) && isConstantStringSide(right, constants) || isHeaderOrCookieAccessCall(right) && isConstantStringSide(left, constants));
+};
+var findHardcodedAuthorizationLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  const constants = collectStringConstants(sourceFile);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isHardcodedAuthorizationComparison(node, constants) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var hardcodedAuthorizationValueRule = {
+  id: "hardcoded-authorization-value",
+  description: "Detecta um header/cookie de requisi\xE7\xE3o comparado com um valor fixo no c\xF3digo para conceder acesso",
+  check(filePath, content) {
+    return findHardcodedAuthorizationLines(filePath, content).map((line) => ({
+      ruleId: "hardcoded-authorization-value",
+      message: "Autoriza\xE7\xE3o baseada em compara\xE7\xE3o de header/cookie com valor fixo no c\xF3digo-fonte",
+      file: filePath,
+      line,
+      severity: "critical"
+    }));
+  }
+};
+
+// src/commands/hardcoded-authorization-value/hardcoded-authorization-value.command.ts
+var registerHardcodedAuthorizationValueCommand = (program) => {
+  withScanOptions(
+    program.command("hardcoded-authorization-value").description("Detecta compara\xE7\xE3o de headers/cookies de autoriza\xE7\xE3o com um valor fixo no c\xF3digo").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [hardcodedAuthorizationValueRule], "Checking hardcoded authorization values...", options)
+  );
+};
+
 // src/commands/help/help.command.ts
 import Table2 from "cli-table3";
 var buildHelpTable = (commands) => {
@@ -1023,9 +1472,10 @@ var createFunctionStatementCountRule = (config) => ({
 // src/rules/high-complexity.rule.ts
 var highComplexityRule = createFunctionStatementCountRule({
   id: "high-complexity",
-  description: "Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)",
+  description: "Detecta fun\xE7\xF5es com muitos condicionais/loops/tern\xE1rios (complexidade alta)",
   statementTypes: /* @__PURE__ */ new Set([
     "IfStatement",
+    "ConditionalExpression",
     "ForStatement",
     "ForInStatement",
     "ForOfStatement",
@@ -1035,12 +1485,14 @@ var highComplexityRule = createFunctionStatementCountRule({
     "CatchClause"
   ]),
   maxCount: 5,
-  unitLabel: "condicionais/loops"
+  unitLabel: "condicionais/loops/tern\xE1rios"
 });
 
 // src/commands/high-complexity/high-complexity.command.ts
 var registerHighComplexityCommand = (program) => {
-  program.command("high-complexity").description("Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("high-complexity").description("Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [highComplexityRule], "Checking function complexity...", options)
   );
 };
@@ -1104,13 +1556,16 @@ var isMathRandomCall = (node) => {
   return object?.type === "Identifier" && object.name === "Math" && property?.type === "Identifier" && property.name === "random";
 };
 var HASH_LIKE_NAME_PATTERN = /hash|md5|sha1/i;
+var memberPropertyName = (callee) => {
+  const property = callee.property;
+  return property?.type === "Identifier" ? property.name : void 0;
+};
 var calleeName = (callee) => {
   if (callee?.type === "Identifier") {
     return callee.name;
   }
   if (callee?.type === "MemberExpression") {
-    const property = callee.property;
-    return property?.type === "Identifier" ? property.name : void 0;
+    return memberPropertyName(callee);
   }
   return void 0;
 };
@@ -1190,7 +1645,9 @@ var insecureRandomTokenRule = {
 
 // src/commands/insecure-random-token/insecure-random-token.command.ts
 var registerInsecureRandomTokenCommand = (program) => {
-  program.command("insecure-random-token").description("Detecta o uso de Math.random() para gerar tokens/segredos previs\xEDveis").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("insecure-random-token").description("Detecta o uso de Math.random() para gerar tokens/segredos previs\xEDveis").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [insecureRandomTokenRule], "Checking insecure random tokens...", options)
   );
 };
@@ -1274,13 +1731,12 @@ var jwtDecodeWithoutVerifyRule = {
 
 // src/commands/jwt-decode-without-verify/jwt-decode-without-verify.command.ts
 var registerJwtDecodeWithoutVerifyCommand = (program) => {
-  program.command("jwt-decode-without-verify").description("Detecta decodifica\xE7\xE3o manual de um token (base64 + JSON.parse) sem verificar a assinatura").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
-    (path, options) => scanAndReport(
-      path,
-      [jwtDecodeWithoutVerifyRule],
-      "Checking JWT decode without verification...",
-      options
-    )
+  withScanOptions(
+    program.command("jwt-decode-without-verify").description(
+      "Detecta decodifica\xE7\xE3o manual de um token (base64 + JSON.parse) sem verificar a assinatura"
+    ).argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [jwtDecodeWithoutVerifyRule], "Checking JWT decode without verification...", options)
   );
 };
 
@@ -1295,12 +1751,24 @@ var objectHasProperty = (object, propertyName) => {
     return key?.type === "Identifier" && key.name === propertyName;
   }) ?? false;
 };
-var isJwtSignWithoutExpiration = (node) => {
+var getCallExpressionParts = (node) => {
   const callee = node.type === "CallExpression" ? node.callee : void 0;
+  const args = node.type === "CallExpression" ? node.arguments : void 0;
+  return { callee, args };
+};
+var getMemberExpressionParts = (callee) => {
   const object = callee?.type === "MemberExpression" ? callee.object : void 0;
   const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  return { object, property };
+};
+var getJwtSignCallParts = (node) => {
+  const { callee, args } = getCallExpressionParts(node);
+  const { object, property } = getMemberExpressionParts(callee);
+  return { object, property, args };
+};
+var isJwtSignWithoutExpiration = (node) => {
+  const { object, property, args } = getJwtSignCallParts(node);
   const isJwtSignCall = object?.type === "Identifier" && object.name === "jwt" && property?.type === "Identifier" && property.name === "sign";
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
   const payload = args?.[0];
   const options = args?.[2];
   const hasExpInPayload = objectHasProperty(payload, "exp");
@@ -1333,7 +1801,9 @@ var jwtNoExpirationRule = {
 
 // src/commands/jwt-no-expiration/jwt-no-expiration.command.ts
 var registerJwtNoExpirationCommand = (program) => {
-  program.command("jwt-no-expiration").description("Detecta jwt.sign() sem expira\xE7\xE3o configurada").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("jwt-no-expiration").description("Detecta jwt.sign() sem expira\xE7\xE3o configurada").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [jwtNoExpirationRule], "Checking JWT expiration...", options)
   );
 };
@@ -1386,7 +1856,9 @@ var longFunctionRule = {
 
 // src/commands/long-functions/long-functions.command.ts
 var registerLongFunctionsCommand = (program) => {
-  program.command("long-functions").description("Detecta fun\xE7\xF5es com mais de 30 linhas").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("long-functions").description("Detecta fun\xE7\xF5es com mais de 30 linhas").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [longFunctionRule], "Checking function length...", options)
   );
 };
@@ -1418,7 +1890,9 @@ var noAnyRule = {
 
 // src/commands/no-any/no-any.command.ts
 var registerNoAnyCommand = (program) => {
-  program.command("no-any").description('Detecta o uso do tipo "any" no TypeScript').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("no-any").description('Detecta o uso do tipo "any" no TypeScript').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [noAnyRule], "Checking any usage...", options)
   );
 };
@@ -1466,7 +1940,9 @@ var noEvalRule = {
 
 // src/commands/no-eval/no-eval.command.ts
 var registerNoEvalCommand = (program) => {
-  program.command("no-eval").description("Detecta o uso de eval() ou new Function()").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("no-eval").description("Detecta o uso de eval() ou new Function()").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [noEvalRule], "Checking eval/new Function usage...", options)
   );
 };
@@ -1534,7 +2010,9 @@ var noHardcodedSecretRule = {
 
 // src/commands/no-hardcoded-secret/no-hardcoded-secret.command.ts
 var registerNoHardcodedSecretCommand = (program) => {
-  program.command("no-hardcoded-secret").description("Detecta segredos/credenciais hardcoded no c\xF3digo-fonte").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("no-hardcoded-secret").description("Detecta segredos/credenciais hardcoded no c\xF3digo-fonte").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [noHardcodedSecretRule], "Checking hardcoded secrets...", options)
   );
 };
@@ -1563,12 +2041,26 @@ var isPermissiveCorsCall = (node) => {
   const args = node.arguments;
   return (args?.length ?? 0) === 0 || isWildcardOriginOption(args?.[0]);
 };
+var callExpressionParts = (node) => {
+  if (node.type !== "CallExpression") {
+    return void 0;
+  }
+  return {
+    callee: node.callee,
+    args: node.arguments
+  };
+};
+var memberCalleeProperty = (callee) => {
+  if (callee?.type !== "MemberExpression") {
+    return void 0;
+  }
+  return callee.property;
+};
 var isWildcardOriginHeader = (node) => {
-  const callee = node.type === "CallExpression" ? node.callee : void 0;
-  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
-  const headerName = args?.[0];
-  const headerValue = args?.[1];
+  const parts = callExpressionParts(node);
+  const property = memberCalleeProperty(parts?.callee);
+  const headerName = parts?.args?.[0];
+  const headerValue = parts?.args?.[1];
   return property?.type === "Identifier" && HEADER_SETTER_METHODS.has(property.name) && headerName?.type === "StringLiteral" && headerName.value === "Access-Control-Allow-Origin" && headerValue?.type === "StringLiteral" && headerValue.value === "*";
 };
 var findPermissiveCorsLines = (filePath, content) => {
@@ -1597,7 +2089,9 @@ var permissiveCorsRule = {
 
 // src/commands/permissive-cors/permissive-cors.command.ts
 var registerPermissiveCorsCommand = (program) => {
-  program.command("permissive-cors").description("Detecta CORS configurado para permitir qualquer origem").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("permissive-cors").description("Detecta CORS configurado para permitir qualquer origem").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [permissiveCorsRule], "Checking permissive CORS...", options)
   );
 };
@@ -1642,7 +2136,11 @@ var publicEnvVarSecretRule = {
 
 // src/commands/public-env-var-secret/public-env-var-secret.command.ts
 var registerPublicEnvVarSecretCommand = (program) => {
-  program.command("public-env-var-secret").description("Detecta uma vari\xE1vel de ambiente p\xFAblica (NEXT_PUBLIC_/VITE_/REACT_APP_) com nome de segredo").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("public-env-var-secret").description(
+      "Detecta uma vari\xE1vel de ambiente p\xFAblica (NEXT_PUBLIC_/VITE_/REACT_APP_) com nome de segredo"
+    ).argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [publicEnvVarSecretRule], "Checking public env var secrets...", options)
   );
 };
@@ -1716,13 +2214,26 @@ var awaitNoTryCatchRule = {
 
 // src/rules/floating-promise.rule.ts
 var PROMISE_STATIC_METHODS = /* @__PURE__ */ new Set(["all", "race", "allSettled", "any"]);
-var asyncFunctionName = (node) => {
+var functionDeclarationName = (node) => {
   const declarationId = node.type === "FunctionDeclaration" ? node.id : void 0;
-  const declarationName = declarationId?.type === "Identifier" ? declarationId.name : void 0;
-  const id = node.type === "VariableDeclarator" ? node.id : void 0;
-  const init = node.type === "VariableDeclarator" ? node.init : void 0;
-  const hasAsyncFunctionValue = (init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression") && init.async;
-  return declarationName ?? (id?.type === "Identifier" && hasAsyncFunctionValue ? id.name : void 0);
+  return declarationId?.type === "Identifier" ? declarationId.name : void 0;
+};
+var isAsyncFunctionValue = (init) => {
+  return (init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression") && init.async;
+};
+var asyncVariableDeclaratorId = (node) => {
+  return node.type === "VariableDeclarator" ? node.id : void 0;
+};
+var asyncVariableDeclaratorInit = (node) => {
+  return node.type === "VariableDeclarator" ? node.init : void 0;
+};
+var asyncVariableDeclaratorName = (node) => {
+  const id = asyncVariableDeclaratorId(node);
+  const init = asyncVariableDeclaratorInit(node);
+  return id?.type === "Identifier" && isAsyncFunctionValue(init) ? id.name : void 0;
+};
+var asyncFunctionName = (node) => {
+  return functionDeclarationName(node) ?? asyncVariableDeclaratorName(node);
 };
 var collectAsyncFunctionNames = (sourceFile) => {
   const names = /* @__PURE__ */ new Set();
@@ -1734,16 +2245,20 @@ var collectAsyncFunctionNames = (sourceFile) => {
   });
   return names;
 };
+var isKnownFunctionCall = (callee, asyncFunctionNames) => {
+  return callee.type === "Identifier" && (callee.name === "fetch" || asyncFunctionNames.has(callee.name));
+};
+var isPromiseStaticMethodCall = (callee) => {
+  const object = callee.type === "MemberExpression" ? callee.object : void 0;
+  const property = callee.type === "MemberExpression" ? callee.property : void 0;
+  return object?.type === "Identifier" && object.name === "Promise" && property?.type === "Identifier" && PROMISE_STATIC_METHODS.has(property.name);
+};
 var isKnownPromiseReturningCall = (call, asyncFunctionNames) => {
   const callee = call.callee;
   if (!callee) {
     return false;
   }
-  const isKnownFunction = callee.type === "Identifier" && (callee.name === "fetch" || asyncFunctionNames.has(callee.name));
-  const object = callee.type === "MemberExpression" ? callee.object : void 0;
-  const property = callee.type === "MemberExpression" ? callee.property : void 0;
-  const isPromiseStaticMethod = object?.type === "Identifier" && object.name === "Promise" && property?.type === "Identifier" && PROMISE_STATIC_METHODS.has(property.name);
-  return isKnownFunction || isPromiseStaticMethod;
+  return isKnownFunctionCall(callee, asyncFunctionNames) || isPromiseStaticMethodCall(callee);
 };
 var findFloatingPromiseLines = (filePath, content) => {
   const lines = /* @__PURE__ */ new Set();
@@ -1773,7 +2288,7 @@ var floatingPromiseRule = {
 };
 
 // src/rules/promise-no-catch.rule.ts
-var memberPropertyName = (member) => {
+var memberPropertyName2 = (member) => {
   const property = member.property;
   return property?.type === "Identifier" ? property.name : void 0;
 };
@@ -1786,7 +2301,11 @@ var isThenCall = (node) => {
   }
   const callee = node.callee;
   const args = node.arguments;
-  return callee?.type === "MemberExpression" && memberPropertyName(callee) === "then" && (args?.length ?? 0) < 2;
+  return callee?.type === "MemberExpression" && memberPropertyName2(callee) === "then" && (args?.length ?? 0) < 2;
+};
+var chainMethodName = (currentCall, member, nextCall) => {
+  const isChainMember = member !== void 0 && member.type === "MemberExpression" && member.object === currentCall && isCallOf(nextCall, member);
+  return isChainMember ? memberPropertyName2(member) : void 0;
 };
 var chainReachesCatch = (thenCall, ancestors) => {
   let currentCall = thenCall;
@@ -1794,8 +2313,7 @@ var chainReachesCatch = (thenCall, ancestors) => {
   while (i < ancestors.length) {
     const member = ancestors.at(i);
     const nextCall = ancestors.at(i + 1);
-    const isChainMember = member !== void 0 && member.type === "MemberExpression" && member.object === currentCall && isCallOf(nextCall, member);
-    const methodName = isChainMember ? memberPropertyName(member) : void 0;
+    const methodName = chainMethodName(currentCall, member, nextCall);
     const continuesChain = methodName === "then" || methodName === "finally";
     if (methodName === "catch") {
       return true;
@@ -2037,10 +2555,10 @@ var tooManyForLoopsRule = createFunctionStatementCountRule({
 // src/rules/too-many-ifs.rule.ts
 var tooManyIfsRule = createFunctionStatementCountRule({
   id: "too-many-ifs",
-  description: 'Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")',
-  statementTypes: /* @__PURE__ */ new Set(["IfStatement"]),
+  description: 'Detecta fun\xE7\xF5es com muitos "if" ou tern\xE1rios (incluindo "else if")',
+  statementTypes: /* @__PURE__ */ new Set(["IfStatement", "ConditionalExpression"]),
   maxCount: 2,
-  unitLabel: "declara\xE7\xF5es if (incluindo else if)"
+  unitLabel: "declara\xE7\xF5es if e express\xF5es tern\xE1rias (incluindo else if)"
 });
 
 // src/rules/too-many-switch-cases.rule.ts
@@ -2143,14 +2661,61 @@ var unsafeSqlRule = {
   }
 };
 
+// src/rules/weak-cipher-mode.rule.ts
+var CIPHER_METHOD_NAMES = /* @__PURE__ */ new Set(["createCipheriv", "createDecipheriv"]);
+var WEAK_MODE_PATTERN = /-(cbc|ecb)$/i;
+var isWeakCipherModeCall = (node) => {
+  const callee = node.callee;
+  const property = callee?.property;
+  const args = node.arguments;
+  const algorithm = args?.[0];
+  return node.type === "CallExpression" && callee?.type === "MemberExpression" && property?.type === "Identifier" && CIPHER_METHOD_NAMES.has(property.name) && algorithm?.type === "StringLiteral" && WEAK_MODE_PATTERN.test(algorithm.value);
+};
+var findWeakCipherModeLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isWeakCipherModeCall(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var weakCipherModeRule = {
+  id: "weak-cipher-mode",
+  description: "Detecta cifragem em modo n\xE3o autenticado (CBC/ECB) sem AEAD/HMAC associado",
+  check(filePath, content) {
+    return findWeakCipherModeLines(filePath, content).map((line) => ({
+      ruleId: "weak-cipher-mode",
+      message: "Modo de cifra sem autentica\xE7\xE3o (CBC/ECB) \u2014 considere um modo AEAD como GCM",
+      file: filePath,
+      line,
+      severity: "high"
+    }));
+  }
+};
+
 // src/rules/weak-hash-algorithm.rule.ts
 var WEAK_ALGORITHMS = /^(md5|sha1)$/i;
+var getCallExpressionCallee = (node) => {
+  return node.type === "CallExpression" ? node.callee : void 0;
+};
+var getCallExpressionArgs = (node) => {
+  return node.type === "CallExpression" ? node.arguments : void 0;
+};
+var getCreateHashProperty = (callee) => {
+  return callee?.type === "MemberExpression" ? callee.property : void 0;
+};
+var isCreateHashProperty = (property) => {
+  return property?.type === "Identifier" && property.name === "createHash";
+};
+var isWeakAlgorithmLiteral = (algorithm) => {
+  return algorithm?.type === "StringLiteral" && WEAK_ALGORITHMS.test(algorithm.value);
+};
 var isWeakCreateHashCall = (node) => {
-  const callee = node.type === "CallExpression" ? node.callee : void 0;
-  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
-  const algorithm = args?.[0];
-  return property?.type === "Identifier" && property.name === "createHash" && algorithm?.type === "StringLiteral" && WEAK_ALGORITHMS.test(algorithm.value);
+  const property = getCreateHashProperty(getCallExpressionCallee(node));
+  const algorithm = getCallExpressionArgs(node)?.[0];
+  return isCreateHashProperty(property) && isWeakAlgorithmLiteral(algorithm);
 };
 var findWeakHashLines = (filePath, content) => {
   const lines = /* @__PURE__ */ new Set();
@@ -2352,7 +2917,9 @@ var allRules = [
   jwtDecodeWithoutVerifyRule,
   xxeUnsafeXmlParsingRule,
   sensitiveDataInLogsRule,
-  publicEnvVarSecretRule
+  publicEnvVarSecretRule,
+  weakCipherModeRule,
+  hardcodedAuthorizationValueRule
 ];
 
 // src/commands/rules/rules.command.ts
@@ -2382,70 +2949,93 @@ var parseLocalSemgrepConfig = (value) => {
   return resolve2(value);
 };
 var registerScanCommand = (program) => {
-  program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig).action(
+  withScanOptions(
+    program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig).option(
+      "--no-deps",
+      "n\xE3o inclui a auditoria de depend\xEAncias (npm audit + OSV.dev) neste scan \u2014 permite rodar offline"
+    )
+  ).action(
     (path, options) => scanAndReport(path, allRules, "Scanning files...", { ...options, semgrep: true })
   );
 };
 
 // src/commands/security-lint/security-lint.command.ts
 var registerSecurityLintCommand = (program) => {
-  program.command("security-lint").description("Detecta padr\xF5es de seguran\xE7a gen\xE9ricos via eslint-plugin-security").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("security-lint").description("Detecta padr\xF5es de seguran\xE7a gen\xE9ricos via eslint-plugin-security").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [securityLintRule], "Checking generic security patterns...", options)
   );
 };
 
 // src/commands/sensitive-data-in-logs/sensitive-data-in-logs.command.ts
 var registerSensitiveDataInLogsCommand = (program) => {
-  program.command("sensitive-data-in-logs").description("Detecta senhas/segredos/tokens sendo passados para chamadas de log").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("sensitive-data-in-logs").description("Detecta senhas/segredos/tokens sendo passados para chamadas de log").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [sensitiveDataInLogsRule], "Checking sensitive data in logs...", options)
   );
 };
 
 // src/commands/tls-validation-disabled/tls-validation-disabled.command.ts
 var registerTlsValidationDisabledCommand = (program) => {
-  program.command("tls-validation-disabled").description("Detecta a desativa\xE7\xE3o da valida\xE7\xE3o de certificados TLS").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("tls-validation-disabled").description("Detecta a desativa\xE7\xE3o da valida\xE7\xE3o de certificados TLS").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tlsValidationDisabledRule], "Checking TLS validation...", options)
   );
 };
 
 // src/commands/too-many-for-loops/too-many-for-loops.command.ts
 var registerTooManyForLoopsCommand = (program) => {
-  program.command("too-many-for-loops").description('Detecta fun\xE7\xF5es com muitos loops "for"/"for-in"/"for-of"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-for-loops").description('Detecta fun\xE7\xF5es com muitos loops "for"/"for-in"/"for-of"').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyForLoopsRule], "Checking for-loop count...", options)
   );
 };
 
 // src/commands/too-many-ifs/too-many-ifs.command.ts
 var registerTooManyIfsCommand = (program) => {
-  program.command("too-many-ifs").description('Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-ifs").description('Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyIfsRule], "Checking if count...", options)
   );
 };
 
 // src/commands/too-many-switch-cases/too-many-switch-cases.command.ts
 var registerTooManySwitchCasesCommand = (program) => {
-  program.command("too-many-switch-cases").description('Detecta "switch" com muitos "case" (considere um mapa/lookup)').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-switch-cases").description('Detecta "switch" com muitos "case" (considere um mapa/lookup)').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManySwitchCasesRule], "Checking switch cases...", options)
   );
 };
 
 // src/commands/too-many-try-catch/too-many-try-catch.command.ts
 var registerTooManyTryCatchCommand = (program) => {
-  program.command("too-many-try-catch").description('Detecta fun\xE7\xF5es com muitos blocos "try/catch"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-try-catch").description('Detecta fun\xE7\xF5es com muitos blocos "try/catch"').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyTryCatchRule], "Checking try/catch count...", options)
   );
 };
 
 // src/commands/too-many-while-loops/too-many-while-loops.command.ts
 var registerTooManyWhileLoopsCommand = (program) => {
-  program.command("too-many-while-loops").description('Detecta fun\xE7\xF5es com muitos loops "while"/"do-while"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-while-loops").description('Detecta fun\xE7\xF5es com muitos loops "while"/"do-while"').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyWhileLoopsRule], "Checking while-loop count...", options)
   );
 };
 
 // src/commands/unhandled-promises/unhandled-promises.command.ts
 var registerUnhandledPromisesCommand = (program) => {
-  program.command("unhandled-promises").description("Detecta promises sem tratamento (sem .catch, await sem try/catch ou promises soltas)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("unhandled-promises").description("Detecta promises sem tratamento (sem .catch, await sem try/catch ou promises soltas)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(
       path,
       [promiseNoCatchRule, awaitNoTryCatchRule, floatingPromiseRule],
@@ -2457,37 +3047,168 @@ var registerUnhandledPromisesCommand = (program) => {
 
 // src/commands/unsafe-sql/unsafe-sql.command.ts
 var registerUnsafeSqlCommand = (program) => {
-  program.command("unsafe-sql").description("Detecta concatena\xE7\xE3o insegura de SQL (risco de SQL injection)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("unsafe-sql").description("Detecta concatena\xE7\xE3o insegura de SQL (risco de SQL injection)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [unsafeSqlRule], "Checking unsafe SQL...", options)
   );
 };
 
+// src/engines/engine-metadata.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { createRequire as createRequire4 } from "module";
+var require5 = createRequire4(import.meta.url);
+var packageForPlatform2 = (platform, architecture) => {
+  if (platform === "linux" && architecture === "x64") {
+    return "codesentry-semgrep-linux-x64";
+  }
+  if (platform === "win32" && architecture === "x64") {
+    return "codesentry-semgrep-win32-x64";
+  }
+  return void 0;
+};
+var unsupportedRuntimeMessage2 = (platform, architecture) => `O runtime Semgrep embutido n\xE3o est\xE1 dispon\xEDvel para ${platform}-${architecture}. O CodeSentry oferece suporte a Linux x64 e Windows x64.`;
+var readJsonFile = (path) => {
+  return JSON.parse(readFileSync2(path, "utf-8"));
+};
+var nonEmptyString = (value) => typeof value === "string" && value.length > 0;
+var errorReason2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var validRuntimeLock = (lock) => lock.schemaVersion === 1 && nonEmptyString(lock.semgrepVersion) && nonEmptyString(lock.pythonVersion) && /^[a-f0-9]{64}$/i.test(lock.runtimeSha256);
+var validRulesetLock = (lock) => lock.schemaVersion === 1 && nonEmptyString(lock.packageVersion) && nonEmptyString(lock.ruleset) && nonEmptyString(lock.source) && /^[a-f0-9]{64}$/i.test(lock.sha256) && nonEmptyString(lock.capturedAt) && !Number.isNaN(Date.parse(lock.capturedAt)) && (lock.upstreamRevision === void 0 || nonEmptyString(lock.upstreamRevision));
+var loadBundledSemgrepRuntimeMetadata = (platform = process.platform, architecture = process.arch, resolveLockPath = (packageName) => require5.resolve(`${packageName}/runtime.lock.json`)) => {
+  const packageName = packageForPlatform2(platform, architecture);
+  if (!packageName) {
+    throw new Error(unsupportedRuntimeMessage2(platform, architecture));
+  }
+  try {
+    const lock = readJsonFile(resolveLockPath(packageName));
+    if (!validRuntimeLock(lock)) {
+      throw new Error("manifesto de vers\xE3o inv\xE1lido");
+    }
+    return {
+      packageName,
+      semgrepVersion: lock.semgrepVersion,
+      pythonVersion: lock.pythonVersion,
+      runtimeSha256: lock.runtimeSha256
+    };
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel carregar os metadados do runtime Semgrep embutido: ${errorReason2(error)}`, {
+      cause: error
+    });
+  }
+};
+var loadBundledOwaspRulesetMetadata = (resolveLockPath = () => require5.resolve("codesentry-semgrep-rules/rules/ruleset.lock.json")) => {
+  try {
+    const lock = readJsonFile(resolveLockPath());
+    if (!validRulesetLock(lock)) {
+      throw new Error("manifesto de vers\xE3o inv\xE1lido");
+    }
+    return {
+      packageVersion: lock.packageVersion,
+      ruleset: lock.ruleset,
+      source: lock.source,
+      sha256: lock.sha256,
+      capturedAt: lock.capturedAt,
+      ...lock.upstreamRevision ? { upstreamRevision: lock.upstreamRevision } : {}
+    };
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel carregar os metadados do ruleset OWASP embutido: ${errorReason2(error)}`, {
+      cause: error
+    });
+  }
+};
+var loadEngineMetadata = () => ({
+  semgrep: loadBundledSemgrepRuntimeMetadata(),
+  owaspRuleset: loadBundledOwaspRulesetMetadata()
+});
+
+// src/commands/version/version.command.ts
+var buildVersionReport = (codesentryVersion, engines) => ({
+  codesentryVersion,
+  engines
+});
+var formatEngineVersions = (report) => {
+  const { semgrep, owaspRuleset } = report.engines;
+  return [
+    `CodeSentry: ${report.codesentryVersion}`,
+    "",
+    "Runtime Semgrep CE",
+    `  Vers\xE3o: ${semgrep.semgrepVersion}`,
+    `  Python: ${semgrep.pythonVersion}`,
+    `  Pacote: ${semgrep.packageName}`,
+    `  SHA-256: ${semgrep.runtimeSha256}`,
+    "",
+    "Ruleset OWASP",
+    `  Snapshot: ${owaspRuleset.ruleset}`,
+    `  Vers\xE3o do pacote: ${owaspRuleset.packageVersion}`,
+    `  Origem: ${owaspRuleset.source}`,
+    `  Capturado em: ${owaspRuleset.capturedAt}`,
+    ...owaspRuleset.upstreamRevision ? [`  Revis\xE3o upstream: ${owaspRuleset.upstreamRevision}`] : [],
+    `  SHA-256: ${owaspRuleset.sha256}`
+  ].join("\n");
+};
+var errorReason3 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var formatVersionOutput = (options, report) => options.json ? JSON.stringify(report, null, 2) : formatEngineVersions(report);
+var registerVersionCommand = (program, readPackageVersion2, readEngineMetadata = loadEngineMetadata) => {
+  program.command("version").description("Exibe a vers\xE3o do CodeSentry e dos motores embutidos").option("--engines", "inclui vers\xF5es e proveni\xEAncia do Semgrep e ruleset OWASP").option("--json", "emite o relat\xF3rio de vers\xF5es em JSON").action((options) => {
+    const codesentryVersion = readPackageVersion2();
+    if (!options.engines && !options.json) {
+      console.log(`CodeSentry: ${codesentryVersion}`);
+      return;
+    }
+    try {
+      const report = buildVersionReport(codesentryVersion, readEngineMetadata());
+      console.log(formatVersionOutput(options, report));
+    } catch (error) {
+      process.exitCode = 1;
+      console.error(`N\xE3o foi poss\xEDvel auditar as vers\xF5es dos motores: ${errorReason3(error)}`);
+    }
+  });
+};
+
+// src/commands/weak-cipher-mode/weak-cipher-mode.command.ts
+var registerWeakCipherModeCommand = (program) => {
+  withScanOptions(
+    program.command("weak-cipher-mode").description("Detecta o uso de modos de cifra fracos (CBC, ECB) em createCipheriv/createDecipheriv").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [weakCipherModeRule], "Checking weak cipher modes...", options)
+  );
+};
+
 // src/commands/weak-hash-algorithm/weak-hash-algorithm.command.ts
 var registerWeakHashAlgorithmCommand = (program) => {
-  program.command("weak-hash-algorithm").description("Detecta o uso de algoritmos de hash fracos (MD5, SHA-1)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("weak-hash-algorithm").description("Detecta o uso de algoritmos de hash fracos (MD5, SHA-1)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [weakHashAlgorithmRule], "Checking weak hash algorithms...", options)
   );
 };
 
 // src/commands/weak-secret-fallback/weak-secret-fallback.command.ts
 var registerWeakSecretFallbackCommand = (program) => {
-  program.command("weak-secret-fallback").description(
-    "Detecta uma vari\xE1vel de ambiente de segredo/chave com um valor hardcoded como fallback (|| ou ??)"
-  ).argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("weak-secret-fallback").description(
+      "Detecta uma vari\xE1vel de ambiente de segredo/chave com um valor hardcoded como fallback (|| ou ??)"
+    ).argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [weakSecretFallbackRule], "Checking weak secret fallbacks...", options)
   );
 };
 
 // src/commands/xss/xss.command.ts
 var registerXssCommand = (program) => {
-  program.command("xss").description("Detecta sinks perigosos de XSS (innerHTML, document.write, etc.)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("xss").description("Detecta sinks perigosos de XSS (innerHTML, document.write, etc.)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [xssRule], "Checking XSS sinks...", options)
   );
 };
 
 // src/commands/xxe-unsafe-xml-parsing/xxe-unsafe-xml-parsing.command.ts
 var registerXxeUnsafeXmlParsingCommand = (program) => {
-  program.command("xxe-unsafe-xml-parsing").description("Detecta parsing de XML com noent/dtdload habilitados (risco de XXE)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("xxe-unsafe-xml-parsing").description("Detecta parsing de XML com noent/dtdload habilitados (risco de XXE)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [xxeUnsafeXmlParsingRule], "Checking unsafe XML parsing...", options)
   );
 };
@@ -2537,17 +3258,20 @@ var registerSecurityCommands = (program) => {
   registerXxeUnsafeXmlParsingCommand(program);
   registerSensitiveDataInLogsCommand(program);
   registerPublicEnvVarSecretCommand(program);
+  registerWeakCipherModeCommand(program);
+  registerHardcodedAuthorizationValueCommand(program);
 };
-var require5 = createRequire4(import.meta.url);
+var require6 = createRequire5(import.meta.url);
 var readPackageVersion = () => {
-  const packageJsonPath = require5.resolve("../package.json");
-  const { version } = JSON.parse(readFileSync2(packageJsonPath, "utf-8"));
+  const packageJsonPath = require6.resolve("../package.json");
+  const { version } = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
   return version;
 };
 var createCli = () => {
   printBanner();
   const program = new Command().name("codesentry").description("CLI de verifica\xE7\xE3o de vulnerabilidades e qualidade de c\xF3digo").version(readPackageVersion()).helpCommand(false);
   registerInitCommand(program);
+  registerVersionCommand(program, readPackageVersion);
   registerAnalysisCommands(program);
   registerQualityCommands(program);
   registerSecurityCommands(program);