codesentry 0.1.11 → 0.2.1

package/README.md

@@ -16,7 +16,7 @@ Semgrep CE para as linguagens suportadas por ele.
 
 ## O que o CodeSentry faz
 
-Rodando `codesentry scan` num projeto, dois motores de análise trabalham
+Rodando `codesentry scan` num projeto, três motores de análise trabalham
 juntos e o resultado sai unificado em um único relatório:
 
 - **Motor nativo** — regras próprias em TypeScript, sem dependências
@@ -29,6 +29,12 @@ juntos e o resultado sai unificado em um único relatório:
   as linguagens que o Semgrep suporta (não só JS/TS), cobrindo os riscos
   do OWASP Top 10 de forma mais ampla que regras hand-rolled sozinhas
   conseguiriam.
+- **Auditoria de dependências** (`npm audit` + [OSV.dev](https://osv.dev)) —
+  identifica vulnerabilidades conhecidas nas dependências reais do
+  projeto (via `package-lock.json`), com a sugestão de correção vindo
+  diretamente do banco consultado. Roda por padrão a partir desta versão
+  e exige rede; use `--no-deps` para um scan 100% offline. Ver
+  [ADR 0005](docs/adr/0005-osv-dependency-database.md).
 
 Cada achado no relatório mostra o arquivo, a linha, a severidade e qual
 motor encontrou o problema (prefixo `semgrep/` para achados do Semgrep).
@@ -141,6 +147,7 @@ codesentry scan . --json
 codesentry scan . --concurrency 4
 codesentry scan . --config ./rules/security.yml
 codesentry scan . --tests
+codesentry scan . --no-deps
 ```
 
 O Semgrep CE embutido é executado automaticamente depois das regras nativas,
@@ -148,6 +155,44 @@ usando um snapshot local do ruleset OWASP e `--metrics=off`. O comando não
 consulta a Semgrep Registry, não envia métricas e não requer internet após a
 instalação.
 
+Por padrão, `scan` também roda a auditoria de dependências (`npm audit` +
+OSV.dev) e funde os achados no mesmo relatório — isso exige `npm` no `PATH`
+e acesso à rede. Use `--no-deps` para pular essa etapa e manter o scan
+100% offline (CI sem egress, ambientes air-gapped). Ver
+[ADR 0005](docs/adr/0005-osv-dependency-database.md).
+
+O console mostra quantos pacotes o `npm audit` cobriu e quantos deles o
+OSV.dev conseguiu verificar de fato (`OSV.dev: 360/363 verificados`, por
+exemplo — a diferença indica pacotes cuja consulta falhou, reportados
+também como aviso). No relatório Markdown gerado automaticamente (mais de
+20 problemas), a lista completa de dependências verificadas no OSV.dev
+(`nome@versão`) aparece numa seção própria ao final do arquivo.
+
+### Versões e atualização dos motores
+
+Use `codesentry version --engines` para auditar exatamente os componentes
+embutidos na sua instalação. O comando não executa o Semgrep nem acessa a
+rede; ele mostra a versão do CodeSentry, a versão do Semgrep CE e Python do
+runtime da plataforma, e a proveniência do snapshot `p/owasp-top-ten`
+(origem, data de captura, revisão upstream quando disponível e SHA-256).
+
+```bash
+codesentry version --engines
+codesentry version --engines --json
+```
+
+O snapshot do ruleset é identificado pela versão do pacote publicada junto ao
+CodeSentry e pelo SHA-256 do seu conteúdo. A Semgrep Registry não fornece
+necessariamente um commit estável para um ruleset público; nesse caso, o hash
+é o identificador imutável que permite comparar o conteúdo auditado.
+
+**Política de atualização:** revisamos semanalmente novas versões do Semgrep
+e alterações no `p/owasp-top-ten`; atualizações regulares são publicadas em
+até 30 dias. Correções upstream classificadas como críticas ou que afetem a
+integridade da análise têm prioridade para uma release em até 48 horas. Toda
+release que atualizar um motor ou ruleset registra as versões e hashes nos
+artefatos publicados.
+
 `--concurrency <n>` limita o processamento paralelo do scanner nativo; use
 apenas inteiros positivos. Sem valor, o limite é ajustado para a máquina
 (`min(8, availableParallelism())`). Não há `--config` remoto: atualizações de
@@ -199,7 +244,7 @@ codesentry xss ./src --json          # possíveis XSS (innerHTML, document.write
 codesentry unsafe-sql ./src          # SQL injection por concatenação
 codesentry command-injection ./src   # child_process com entrada não sanitizada
 codesentry weak-hash-algorithm ./src # uso de MD5/SHA-1 para hashing sensível
-codesentry dependency-audit .        # `npm audit` das dependências do projeto (sem --tests: não lê arquivos-fonte)
+codesentry dependency-audit .        # `npm audit` + OSV.dev nas dependências do projeto (sem --tests: não lê arquivos-fonte)
 ```
 
 Assim como em `scan`, `--tests` inclui arquivos de teste na análise (por

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { createRequire as createRequire4 } from "module";
+import { readFileSync as readFileSync3 } from "fs";
+import { createRequire as createRequire5 } from "module";
 import { Command } from "commander";
 import figlet from "figlet";
 import gradient from "gradient-string";
@@ -45,13 +45,13 @@ var isExecImport = (specifier) => {
   return specifier.type === "ImportSpecifier" && imported?.type === "Identifier" && EXEC_METHOD_NAMES.has(imported.name);
 };
 var isNamespaceImport = (specifier) => specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier";
+var bindingSetForImportSpecifier = (specifier, bindings) => isExecImport(specifier) ? bindings.directCalls : isNamespaceImport(specifier) ? bindings.namespaces : void 0;
 var collectImportBinding = (specifier, bindings) => {
   const name = localName(specifier);
   if (!name) {
     return;
   }
-  const bindingSet = isExecImport(specifier) ? bindings.directCalls : isNamespaceImport(specifier) ? bindings.namespaces : void 0;
-  bindingSet?.add(name);
+  bindingSetForImportSpecifier(specifier, bindings)?.add(name);
 };
 var collectFromImportDeclaration = (node, bindings) => {
   if (!isChildProcessModuleSpecifier(node.source)) {
@@ -71,13 +71,15 @@ var collectDirectCallBindings = (id, bindings) => {
     }
   }
 };
+var namespaceNameFromDeclaratorId = (id) => id?.type === "Identifier" ? id.name : void 0;
+var destructuredBindingsFromDeclaratorId = (id) => id?.type === "ObjectPattern" ? id : void 0;
 var collectFromVariableDeclarator = (node, bindings) => {
   if (!isRequireCall(node.init)) {
     return;
   }
   const id = node.id;
-  const namespaceName = id?.type === "Identifier" ? id.name : void 0;
-  const destructuredBindings = id?.type === "ObjectPattern" ? id : void 0;
+  const namespaceName = namespaceNameFromDeclaratorId(id);
+  const destructuredBindings = destructuredBindingsFromDeclaratorId(id);
   namespaceName && bindings.namespaces.add(namespaceName);
   destructuredBindings && collectDirectCallBindings(destructuredBindings, bindings);
 };
@@ -92,11 +94,8 @@ var collectChildProcessBindings = (sourceFile) => {
   });
   return bindings;
 };
-var isKnownChildProcessCallee = (callee, bindings) => {
-  if (callee?.type === "Identifier") {
-    return bindings.directCalls.has(callee.name);
-  }
-  if (callee?.type !== "MemberExpression") {
+var isKnownChildProcessMemberCallee = (callee, bindings) => {
+  if (callee.type !== "MemberExpression") {
     return false;
   }
   const object = callee.object;
@@ -104,6 +103,12 @@ var isKnownChildProcessCallee = (callee, bindings) => {
   const methodName = property?.type === "Identifier" ? property.name : void 0;
   return !!methodName && EXEC_METHOD_NAMES.has(methodName) && object?.type === "Identifier" && bindings.namespaces.has(object.name);
 };
+var isKnownChildProcessCallee = (callee, bindings) => {
+  if (callee?.type === "Identifier") {
+    return bindings.directCalls.has(callee.name);
+  }
+  return callee !== void 0 && isKnownChildProcessMemberCallee(callee, bindings);
+};
 var isDynamicCommandArgument = (argument) => argument?.type === "StringLiteral" ? false : argument?.type === "TemplateLiteral" ? (argument.expressions?.length ?? 0) > 0 : argument !== void 0;
 var isCommandInjectionCall = (node, bindings) => {
   if (node.type !== "CallExpression") {
@@ -146,7 +151,7 @@ var withScanOptions = (command) => command.option("--json", "exibe o resultado e
 
 // src/commands/scan/scan-runner.ts
 import { writeFile } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import chalk2 from "chalk";
 import { Listr } from "listr2";
 
@@ -185,9 +190,9 @@ var mergeScanResults = (nativeResult, semgrepResult) => ({
     semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
   }
 });
-var finalizeScanResult = (result) => ({
+var finalizeScanResult = (result, dependencyAuditCoverage2 = false) => ({
   ...result,
-  engines: { ...result.engines, dependencyAudit: false },
+  engines: { ...result.engines, dependencyAudit: dependencyAuditCoverage2 },
   warnings: result.engines?.semgrep === 0 ? [...result.warnings ?? [], ZERO_SEMGREP_COVERAGE_WARNING] : result.warnings
 });
 
@@ -198,7 +203,16 @@ var SEVERITY_COLOR = {
   high: (text2) => chalk.red(text2),
   critical: (text2) => chalk.bgRed.white(text2)
 };
-var coverageText = (result) => result.engines?.semgrep === void 0 ? "" : ` CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s).`;
+var semgrepCoverage = (result) => result.engines?.semgrep === void 0 ? void 0 : `CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s)`;
+var dependencyAuditCoverage = (result) => typeof result.engines?.dependencyAudit === "number" ? `Dependency audit: ${result.engines.dependencyAudit} pacote(s) via npm audit` : void 0;
+var osvCoverage = (result) => result.engines?.osv ? `OSV.dev: ${result.engines.osv.checked}/${result.engines.osv.total} verificados` : void 0;
+var coverageParts = (result) => [semgrepCoverage(result), dependencyAuditCoverage(result), osvCoverage(result)].filter(
+  (part) => part !== void 0
+);
+var coverageText = (result) => {
+  const parts = coverageParts(result);
+  return parts.length ? ` ${parts.join("; ")}.` : "";
+};
 var printNotes = (result) => {
   if (result.engines?.dependencyAudit === false) {
     console.log(chalk.cyan(DEPENDENCY_AUDIT_NOTE));
@@ -316,26 +330,360 @@ var severitySections = (bySeverity) => {
   }
   return lines;
 };
+var osvCheckedSection = (result) => {
+  const { osvCheckedPackages } = result;
+  if (!osvCheckedPackages || osvCheckedPackages.length === 0) {
+    return [];
+  }
+  const checked = result.engines?.osv?.checked ?? osvCheckedPackages.length;
+  const total = result.engines?.osv?.total ?? osvCheckedPackages.length;
+  return [
+    `## Depend\xEAncias verificadas no OSV.dev (${checked}/${total})`,
+    "",
+    ...osvCheckedPackages.map((pkg) => `- ${pkg}`),
+    ""
+  ];
+};
 var toMarkdownReport = (result, generatedAt = /* @__PURE__ */ new Date()) => {
   const bySeverity = groupBy(result.findings, (f) => f.severity);
   return [
     ...reportHeader(result, generatedAt),
     ...warningsSection(result),
     ...summaryTable(bySeverity),
-    ...severitySections(bySeverity)
+    ...severitySections(bySeverity),
+    ...osvCheckedSection(result)
   ].join("\n");
 };
 
-// src/scanner/scanner.ts
+// src/scanner/dependency-audit.ts
+import { execFile } from "child_process";
 import { readFile } from "fs/promises";
+import { join } from "path";
+import { promisify } from "util";
+
+// src/scanner/run-with-concurrency-limit.ts
+import pLimit from "p-limit";
+var runWithConcurrencyLimit = async (items, concurrency, task) => {
+  const limit = pLimit(concurrency);
+  return Promise.all(items.map((item) => limit(() => task(item))));
+};
+
+// src/scanner/osv-client.ts
+var OSV_BATCH_CHUNK_SIZE = 100;
+var OSV_DETAIL_CONCURRENCY = 10;
+var OSV_API_BASE = "https://api.osv.dev/v1";
+var SEVERITY_MAP = {
+  LOW: "low",
+  MODERATE: "medium",
+  HIGH: "high",
+  CRITICAL: "critical"
+};
+var chunk = (items, size) => {
+  const chunks = [];
+  for (let i = 0; i < items.length; i += size) {
+    chunks.push(items.slice(i, i + size));
+  }
+  return chunks;
+};
+var zipVulnIdsByPackage = (packages, body) => {
+  const vulnIdsByPackage = /* @__PURE__ */ new Map();
+  packages.forEach((pkg, index) => {
+    const ids = body.results?.[index]?.vulns?.map((v) => v.id);
+    if (ids?.length) {
+      vulnIdsByPackage.set(`${pkg.name}@${pkg.version}`, ids);
+    }
+  });
+  return vulnIdsByPackage;
+};
+var queryBatchChunk = async (packages, fetchImpl) => {
+  try {
+    const response = await fetchImpl(`${OSV_API_BASE}/querybatch`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        queries: packages.map((p) => ({
+          package: { name: p.name, ecosystem: "npm" },
+          version: p.version
+        }))
+      })
+    });
+    if (!response.ok) {
+      return { vulnIdsByPackage: /* @__PURE__ */ new Map(), checkedPackages: [], failedCount: packages.length };
+    }
+    const body = await response.json();
+    return { vulnIdsByPackage: zipVulnIdsByPackage(packages, body), checkedPackages: packages, failedCount: 0 };
+  } catch {
+    return { vulnIdsByPackage: /* @__PURE__ */ new Map(), checkedPackages: [], failedCount: packages.length };
+  }
+};
+var queryOsvBatch = async (packages, fetchImpl = fetch) => {
+  const vulnIdsByPackage = /* @__PURE__ */ new Map();
+  const checkedPackages = [];
+  let failedCount = 0;
+  try {
+    for (const packageChunk of chunk(packages, OSV_BATCH_CHUNK_SIZE)) {
+      const result = await queryBatchChunk(packageChunk, fetchImpl);
+      result.vulnIdsByPackage.forEach((ids, key) => vulnIdsByPackage.set(key, ids));
+      checkedPackages.push(...result.checkedPackages);
+      failedCount += result.failedCount;
+    }
+  } catch {
+    failedCount += packages.length - checkedPackages.length;
+  }
+  return {
+    vulnIdsByPackage,
+    checkedPackages,
+    warning: failedCount > 0 ? `N\xE3o foi poss\xEDvel consultar o OSV.dev para ${failedCount} pacote(s).` : void 0
+  };
+};
+var fetchOneVulnerabilityDetail = async (id, fetchImpl, detailsById) => {
+  try {
+    const response = await fetchImpl(`${OSV_API_BASE}/vulns/${id}`);
+    if (!response.ok) {
+      return false;
+    }
+    detailsById.set(id, await response.json());
+    return true;
+  } catch {
+    return false;
+  }
+};
+var fetchOsvVulnerabilityDetails = async (ids, fetchImpl = fetch) => {
+  const uniqueIds = [...new Set(ids)];
+  const detailsById = /* @__PURE__ */ new Map();
+  let results;
+  try {
+    results = await runWithConcurrencyLimit(
+      uniqueIds,
+      OSV_DETAIL_CONCURRENCY,
+      (id) => fetchOneVulnerabilityDetail(id, fetchImpl, detailsById)
+    );
+  } catch (error) {
+    throw error;
+  }
+  const failedCount = results.filter((ok) => !ok).length;
+  return {
+    detailsById,
+    warning: failedCount > 0 ? `N\xE3o foi poss\xEDvel obter detalhes do OSV.dev para ${failedCount} advisory(s).` : void 0
+  };
+};
+var isMatchingNpmPackage = (affected, packageName) => affected.package.ecosystem === "npm" && affected.package.name === packageName;
+var extractFixedVersions = (vuln, packageName) => {
+  const fixedVersions = (vuln.affected ?? []).filter((affected) => isMatchingNpmPackage(affected, packageName)).flatMap((affected) => affected.ranges ?? []).flatMap((range) => range.events).map((event) => event.fixed).filter((fixed) => Boolean(fixed));
+  return [...new Set(fixedVersions)];
+};
+var mapOsvSeverity = (vuln) => {
+  const severity = vuln.database_specific?.severity;
+  if (!severity) {
+    return "medium";
+  }
+  return SEVERITY_MAP[severity] ?? "medium";
+};
+
+// src/scanner/package-lock-parser.ts
+var NODE_MODULES_SEGMENT = "node_modules/";
+var isUnresolvableSource = (resolved) => resolved !== void 0 && (resolved.startsWith("file:") || resolved.startsWith("git"));
+var nameFromKey = (key) => {
+  const lastIndex = key.lastIndexOf(NODE_MODULES_SEGMENT);
+  return lastIndex === -1 ? void 0 : key.slice(lastIndex + NODE_MODULES_SEGMENT.length);
+};
+var toLockedPackage = (key, entry) => {
+  if (entry.link || !entry.version || isUnresolvableSource(entry.resolved)) {
+    return void 0;
+  }
+  const name = entry.name ?? nameFromKey(key);
+  return name ? { name, version: entry.version } : void 0;
+};
+var assertSupportedLockfileVersion = (lockfileVersion) => {
+  if (lockfileVersion !== 2 && lockfileVersion !== 3) {
+    throw new Error("lockfileVersion 1 n\xE3o \xE9 suportado \u2014 regenere o lockfile com npm 7+.");
+  }
+};
+var parsePackageLock = (rawJson) => {
+  const parsed = JSON.parse(rawJson);
+  assertSupportedLockfileVersion(parsed.lockfileVersion);
+  const deduped = /* @__PURE__ */ new Map();
+  Object.entries(parsed.packages ?? {}).filter(([key]) => key.includes(NODE_MODULES_SEGMENT)).forEach(([key, entry]) => {
+    const locked = toLockedPackage(key, entry);
+    if (locked) {
+      deduped.set(`${locked.name}@${locked.version}`, locked);
+    }
+  });
+  return [...deduped.values()];
+};
+
+// src/scanner/dependency-audit.ts
+var execFileAsync = promisify(execFile);
+var SEVERITY_MAP2 = {
+  info: "low",
+  low: "low",
+  moderate: "medium",
+  high: "high",
+  critical: "critical"
+};
+var vulnerabilityTitle = (vulnerability) => {
+  const firstVia = vulnerability.via[0];
+  if (typeof firstVia === "object" && firstVia?.title) {
+    return firstVia.title;
+  }
+  return 'ver "npm audit" para detalhes';
+};
+var npmFixSuggestion = (vulnerability) => {
+  const { fixAvailable } = vulnerability;
+  if (fixAvailable === false) {
+    return "sem corre\xE7\xE3o dispon\xEDvel ainda";
+  }
+  if (fixAvailable === true) {
+    return `atualize para uma vers\xE3o fora do intervalo vulner\xE1vel (${vulnerability.range})`;
+  }
+  return `atualize para ${fixAvailable.name}@${fixAvailable.version}`;
+};
+var mapAuditReportToFindings = (report) => {
+  return Object.values(report.vulnerabilities).map((vulnerability) => ({
+    ruleId: "dependency-audit",
+    message: `Depend\xEAncia vulner\xE1vel: ${vulnerability.name} (${vulnerability.severity}) \u2014 ${vulnerabilityTitle(vulnerability)} \u2014 ${npmFixSuggestion(vulnerability)}`,
+    file: "package.json",
+    line: 1,
+    severity: SEVERITY_MAP2[vulnerability.severity]
+  }));
+};
+var osvFixSuggestion = (fixedVersions) => fixedVersions.length ? `atualize para ${fixedVersions.join(" ou ")}` : "nenhuma vers\xE3o corrigida publicada pelo OSV.dev ainda";
+var buildOsvFinding = (pkg, vuln) => {
+  const fixedVersions = extractFixedVersions(vuln, pkg.name);
+  return {
+    ruleId: "dependency-audit",
+    message: `OSV ${vuln.id}: ${pkg.name}@${pkg.version} (${mapOsvSeverity(vuln)}) \u2014 ${vuln.summary ?? "ver OSV.dev para detalhes"} \u2014 ${osvFixSuggestion(fixedVersions)}`,
+    file: "package-lock.json",
+    line: 1,
+    severity: mapOsvSeverity(vuln)
+  };
+};
+var findingsForLockedPackage = (pkg, vulnIdsByPackage, detailsById) => {
+  const ids = vulnIdsByPackage.get(`${pkg.name}@${pkg.version}`) ?? [];
+  return ids.map((id) => detailsById.get(id)).filter((vuln) => vuln !== void 0).map((vuln) => buildOsvFinding(pkg, vuln));
+};
+var mapOsvFindingsToRuleFindings = (lockedPackages, vulnIdsByPackage, detailsById, npmFlaggedNames) => lockedPackages.filter((pkg) => !npmFlaggedNames.has(pkg.name)).flatMap((pkg) => findingsForLockedPackage(pkg, vulnIdsByPackage, detailsById));
+var errorMessage = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var hasVulnerabilitiesRecord = (value) => typeof value === "object" && value !== null && typeof value.vulnerabilities === "object" && value.vulnerabilities !== null;
+var normalizeNpmAuditReport = (raw) => {
+  if (hasVulnerabilitiesRecord(raw)) {
+    return { report: { vulnerabilities: raw.vulnerabilities } };
+  }
+  const errorSummary = typeof raw === "object" && raw !== null && "error" in raw ? raw.error?.summary ?? "formato de resposta inesperado" : "formato de resposta inesperado";
+  return {
+    report: { vulnerabilities: {} },
+    warning: `"npm audit" n\xE3o retornou um relat\xF3rio v\xE1lido: ${errorSummary}.`
+  };
+};
+var combineWarnings = (...warnings) => {
+  const present = warnings.filter((warning) => Boolean(warning));
+  return present.length ? present.join(" ") : void 0;
+};
+var fetchDetailsForIds = (ids, fetchImpl) => ids.length ? fetchOsvVulnerabilityDetails(ids, fetchImpl) : Promise.resolve({ detailsById: /* @__PURE__ */ new Map(), warning: void 0 });
+var auditPackagesWithOsv = async (lockedPackages, npmFlaggedNames, fetchImpl = fetch) => {
+  try {
+    return await collectOsvAuditResult(lockedPackages, npmFlaggedNames, fetchImpl);
+  } catch (error) {
+    return {
+      findings: [],
+      checkedPackages: [],
+      warning: `N\xE3o foi poss\xEDvel consultar o OSV.dev: ${errorMessage(error)}.`
+    };
+  }
+};
+var collectOsvAuditResult = async (lockedPackages, npmFlaggedNames, fetchImpl) => {
+  try {
+    const {
+      vulnIdsByPackage,
+      checkedPackages,
+      warning: batchWarning
+    } = await queryOsvBatch(lockedPackages, fetchImpl);
+    const ids = [...new Set([...vulnIdsByPackage.values()].flat())];
+    const { detailsById, warning: detailsWarning } = await fetchDetailsForIds(ids, fetchImpl);
+    return {
+      findings: mapOsvFindingsToRuleFindings(
+        lockedPackages,
+        vulnIdsByPackage,
+        detailsById,
+        npmFlaggedNames
+      ),
+      checkedPackages,
+      warning: combineWarnings(batchWarning, detailsWarning)
+    };
+  } catch (error) {
+    throw new Error("N\xE3o foi poss\xEDvel consolidar os resultados do OSV.dev.", { cause: error });
+  }
+};
+var runNpmAudit = async (targetDir) => {
+  let stdout;
+  try {
+    ({ stdout } = await execFileAsync("npm", ["audit", "--json"], {
+      cwd: targetDir,
+      maxBuffer: 10 * 1024 * 1024
+    }));
+  } catch (error) {
+    const stdoutFromError = error.stdout;
+    if (!stdoutFromError) {
+      throw new Error(`N\xE3o foi poss\xEDvel executar "npm audit" em "${targetDir}".`, { cause: error });
+    }
+    stdout = stdoutFromError;
+  }
+  return JSON.parse(stdout);
+};
+var auditPackagesFromLockfile = async (targetDir, npmFlaggedNames, fetchImpl) => {
+  try {
+    const raw = await readFile(join(targetDir, "package-lock.json"), "utf-8");
+    const lockedPackages = parsePackageLock(raw);
+    const osvResult = await auditPackagesWithOsv(lockedPackages, npmFlaggedNames, fetchImpl);
+    return {
+      findings: osvResult.findings,
+      packagesAudited: lockedPackages.length,
+      osvChecked: { checked: osvResult.checkedPackages.length, total: lockedPackages.length },
+      osvCheckedPackages: osvResult.checkedPackages.map((pkg) => `${pkg.name}@${pkg.version}`).sort(),
+      warning: osvResult.warning
+    };
+  } catch (error) {
+    return {
+      findings: [],
+      packagesAudited: false,
+      warning: `N\xE3o foi poss\xEDvel checar o OSV.dev: ${errorMessage(error)}.`
+    };
+  }
+};
+var runDependencyAudit = async (targetDir, fetchImpl = fetch) => {
+  const startedAt = Date.now();
+  try {
+    const { report: npmReport, warning: npmWarning } = normalizeNpmAuditReport(await runNpmAudit(targetDir));
+    const npmFindings = mapAuditReportToFindings(npmReport);
+    const npmFlaggedNames = new Set(Object.keys(npmReport.vulnerabilities));
+    const osv = await auditPackagesFromLockfile(targetDir, npmFlaggedNames, fetchImpl);
+    const warnings = combineWarnings(npmWarning, osv.warning);
+    return {
+      scannedFiles: 1,
+      findings: [...npmFindings, ...osv.findings],
+      durationMs: Date.now() - startedAt,
+      engines: {
+        dependencyAudit: osv.packagesAudited === false ? npmFlaggedNames.size : osv.packagesAudited,
+        osv: osv.osvChecked
+      },
+      osvCheckedPackages: osv.osvCheckedPackages,
+      warnings: warnings ? [warnings] : void 0
+    };
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel auditar depend\xEAncias em "${targetDir}".`, { cause: error });
+  }
+};
+
+// src/scanner/scanner.ts
+import { readFile as readFile2 } from "fs/promises";
 import { availableParallelism } from "os";
 
 // src/scanner/file-finder.ts
 import { readdir } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // src/scanner/ignore-patterns.ts
-var ALWAYS_IGNORED_DIR_NAMES = ["node_modules", ".git", "dist", ".next"];
+var ALWAYS_IGNORED_DIR_NAMES = ["node_modules", ".git", "dist", ".next", ".angular"];
 var TEST_DIR_NAMES = ["tests", "test", "__tests__"];
 var TEST_FILE_GLOBS = ["*.spec.*", "*.test.*"];
 var TEST_FILE_NAME_PATTERN = /\.(spec|test)\.[^./]+$/;
@@ -345,11 +693,17 @@ var isTestFileName = (fileName) => TEST_FILE_NAME_PATTERN.test(fileName);
 // src/scanner/file-finder.ts
 var SCANNABLE_EXTENSIONS = [".js", ".ts", ".jsx", ".tsx"];
 var isScannable = (fileName) => SCANNABLE_EXTENSIONS.some((ext) => fileName.endsWith(ext));
+var filesFromDirectory = async (currentDir, entry, includeTests) => {
+  return isIgnoredDirName(entry.name, includeTests) ? [] : walk(join2(currentDir, entry.name), includeTests);
+};
+var filesFromFile = (currentDir, entry, includeTests) => {
+  return entry.isFile() && isScannable(entry.name) && (includeTests || !isTestFileName(entry.name)) ? [join2(currentDir, entry.name)] : [];
+};
 var filesFromEntry = async (currentDir, entry, includeTests) => {
   if (entry.isDirectory()) {
-    return isIgnoredDirName(entry.name, includeTests) ? [] : walk(join(currentDir, entry.name), includeTests);
+    return filesFromDirectory(currentDir, entry, includeTests);
   }
-  return entry.isFile() && isScannable(entry.name) && (includeTests || !isTestFileName(entry.name)) ? [join(currentDir, entry.name)] : [];
+  return filesFromFile(currentDir, entry, includeTests);
 };
 var walk = async (currentDir, includeTests) => {
   try {
@@ -367,26 +721,19 @@ var findFiles = async (targetDir, includeTests = false) => {
   }
 };
 
-// src/scanner/run-with-concurrency-limit.ts
-import pLimit from "p-limit";
-var runWithConcurrencyLimit = async (items, concurrency, task) => {
-  const limit = pLimit(concurrency);
-  return Promise.all(items.map((item) => limit(() => task(item))));
-};
-
 // src/scanner/scanner.ts
 var DEFAULT_SCAN_CONCURRENCY = Math.max(1, Math.min(8, availableParallelism()));
-var errorMessage = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var errorMessage2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var parseErrorFinding = (filePath, error) => ({
   ruleId: "parse-error",
-  message: `N\xE3o foi poss\xEDvel analisar este arquivo (erro de sintaxe): ${errorMessage(error)}`,
+  message: `N\xE3o foi poss\xEDvel analisar este arquivo (erro de sintaxe): ${errorMessage2(error)}`,
   file: filePath,
   line: 1,
   severity: "low"
 });
 var readFileContent = async (filePath) => {
   try {
-    return await readFile(filePath, "utf-8");
+    return await readFile2(filePath, "utf-8");
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel ler o arquivo "${filePath}".`, { cause: error });
   }
@@ -433,9 +780,9 @@ var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY, i
 };
 
 // src/scanner/semgrep.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import { delimiter, dirname as dirname2 } from "path";
-import { promisify } from "util";
+import { promisify as promisify2 } from "util";
 
 // src/scanner/semgrep-runtime.ts
 import { existsSync, readFileSync } from "fs";
@@ -452,6 +799,7 @@ var packageForPlatform = (platform, architecture) => {
   return void 0;
 };
 var unsupportedRuntimeMessage = (platform, architecture) => `O runtime Semgrep embutido n\xE3o est\xE1 dispon\xEDvel para ${platform}-${architecture}. O CodeSentry oferece suporte a Linux x64 e Windows x64.`;
+var errorReason = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var resolveBundledSemgrepRuntime = (platform = process.platform, architecture = process.arch, resolveManifestPath = (packageName) => require2.resolve(`${packageName}/runtime.json`)) => {
   const packageName = packageForPlatform(platform, architecture);
   if (!packageName) {
@@ -468,8 +816,7 @@ var resolveBundledSemgrepRuntime = (platform = process.platform, architecture =
     }
     return runtime;
   } catch (error) {
-    const reason = error instanceof Error ? error.message : "erro desconhecido";
-    throw new Error(`N\xE3o foi poss\xEDvel carregar o runtime Semgrep embutido: ${reason}`, { cause: error });
+    throw new Error(`N\xE3o foi poss\xEDvel carregar o runtime Semgrep embutido: ${errorReason(error)}`, { cause: error });
   }
 };
 
@@ -491,7 +838,7 @@ var resolveBundledSemgrepRuleset = () => {
 };
 
 // src/scanner/semgrep.ts
-var execFileAsync = promisify(execFile);
+var execFileAsync2 = promisify2(execFile2);
 var SEMGREP_SEVERITIES = {
   INFO: "low",
   WARNING: "medium",
@@ -556,7 +903,7 @@ var executeSemgrep = async (targetDir, runtime, ruleset, execute, includeTests)
     throw new Error("N\xE3o foi poss\xEDvel executar o Semgrep embutido.", { cause: error });
   }
 };
-var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync, includeTests = false) => {
+var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync2, includeTests = false) => {
   const startedAt = Date.now();
   try {
     const report = parseSemgrepReport(await executeSemgrep(targetDir, runtime, ruleset, execute, includeTests));
@@ -580,7 +927,7 @@ var generateMarkdownReportFilename = (date = /* @__PURE__ */ new Date()) => {
 };
 
 // src/commands/scan/scan-runner.ts
-var errorMessage2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var errorMessage3 = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var reportScanFailure = (error) => {
   process.exitCode = 1;
   console.error(`Falha ao executar o scan: ${formatErrorChain(error)}`);
@@ -596,26 +943,53 @@ var writeMarkdownReportIfNeeded = async (result, targetDir) => {
   if (result.findings.length <= MARKDOWN_REPORT_FINDINGS_THRESHOLD) {
     return;
   }
-  const filePath = join2(targetDir, generateMarkdownReportFilename());
+  const filePath = join3(targetDir, generateMarkdownReportFilename());
   try {
     await writeFile(filePath, toMarkdownReport(result), "utf-8");
     console.log(chalk2.cyan(`
 Relat\xF3rio detalhado gerado em: ${filePath}`));
   } catch (error) {
-    console.error(chalk2.red(`N\xE3o foi poss\xEDvel gerar o relat\xF3rio Markdown: ${errorMessage2(error)}`));
+    console.error(chalk2.red(`N\xE3o foi poss\xEDvel gerar o relat\xF3rio Markdown: ${errorMessage3(error)}`));
   }
 };
-var runScanEngines = async (path, rules, options) => {
+var runNativeAndSemgrep = async (path, rules, options) => {
   try {
     const includeTests = options.tests ?? false;
     const nativeResult = await runScan(path, rules, options.concurrency, includeTests);
-    if (!options.semgrep) {
-      return finalizeScanResult(nativeResult);
-    }
-    const semgrepResult = await runBundledSemgrep(path, void 0, options.config, void 0, includeTests);
-    return finalizeScanResult(mergeScanResults(nativeResult, semgrepResult));
+    return options.semgrep ? mergeScanResults(
+      nativeResult,
+      await runBundledSemgrep(path, void 0, options.config, void 0, includeTests)
+    ) : nativeResult;
   } catch (error) {
-    throw new Error(`Falha durante a an\xE1lise: ${errorMessage2(error)}`, { cause: error });
+    throw new Error(`Falha durante a an\xE1lise: ${errorMessage3(error)}`, { cause: error });
+  }
+};
+var runOptionalDependencyAudit = async (path, merged) => {
+  try {
+    const auditResult = await runDependencyAudit(path);
+    return finalizeScanResult(
+      {
+        ...merged,
+        findings: [...merged.findings, ...auditResult.findings],
+        warnings: [...merged.warnings ?? [], ...auditResult.warnings ?? []],
+        engines: { ...merged.engines, osv: auditResult.engines?.osv },
+        osvCheckedPackages: auditResult.osvCheckedPackages
+      },
+      auditResult.engines?.dependencyAudit ?? false
+    );
+  } catch (error) {
+    return finalizeScanResult({
+      ...merged,
+      warnings: [...merged.warnings ?? [], `Auditoria de depend\xEAncias falhou: ${errorMessage3(error)}.`]
+    });
+  }
+};
+var runScanEngines = async (path, rules, options) => {
+  try {
+    const merged = await runNativeAndSemgrep(path, rules, options);
+    return options.deps ? runOptionalDependencyAudit(path, merged) : finalizeScanResult(merged);
+  } catch (error) {
+    throw error;
   }
 };
 var createScanTasks = (path, rules, taskTitle, options, onResult) => new Listr([
@@ -721,8 +1095,11 @@ var walkNestingBlock = (node, depth, results) => {
   checkDepth(newDepth, node.loc?.start.line, results);
   walkChildren(node, newDepth, results);
 };
+var selectNonFunctionWalker = (node) => {
+  return node.type === "IfStatement" ? walkIfChain : NESTING_TYPES.has(node.type) ? walkNestingBlock : walkChildren;
+};
 var selectWalker = (node) => {
-  return FUNCTION_TYPES.has(node.type) ? walkFunction : node.type === "IfStatement" ? walkIfChain : NESTING_TYPES.has(node.type) ? walkNestingBlock : walkChildren;
+  return FUNCTION_TYPES.has(node.type) ? walkFunction : selectNonFunctionWalker(node);
 };
 var walk2 = (node, depth, results) => {
   selectWalker(node)(node, depth, results);
@@ -756,56 +1133,6 @@ var registerDeepNestingCommand = (program) => {
   );
 };
 
-// src/scanner/dependency-audit.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFileAsync2 = promisify2(execFile2);
-var SEVERITY_MAP = {
-  info: "low",
-  low: "low",
-  moderate: "medium",
-  high: "high",
-  critical: "critical"
-};
-var vulnerabilityTitle = (vulnerability) => {
-  const firstVia = vulnerability.via[0];
-  if (typeof firstVia === "object" && firstVia?.title) {
-    return firstVia.title;
-  }
-  return 'ver "npm audit" para detalhes';
-};
-var mapAuditReportToFindings = (report) => {
-  return Object.values(report.vulnerabilities).map((vulnerability) => ({
-    ruleId: "dependency-audit",
-    message: `Depend\xEAncia vulner\xE1vel: ${vulnerability.name} (${vulnerability.severity}) \u2014 ${vulnerabilityTitle(vulnerability)}`,
-    file: "package.json",
-    line: 1,
-    severity: SEVERITY_MAP[vulnerability.severity]
-  }));
-};
-var runDependencyAudit = async (targetDir) => {
-  const startedAt = Date.now();
-  let stdout;
-  try {
-    ({ stdout } = await execFileAsync2("npm", ["audit", "--json"], {
-      cwd: targetDir,
-      maxBuffer: 10 * 1024 * 1024
-    }));
-  } catch (error) {
-    const stdoutFromError = error.stdout;
-    if (!stdoutFromError) {
-      throw new Error(`N\xE3o foi poss\xEDvel executar "npm audit" em "${targetDir}".`, { cause: error });
-    }
-    stdout = stdoutFromError;
-  }
-  const report = JSON.parse(stdout);
-  return {
-    scannedFiles: 1,
-    findings: mapAuditReportToFindings(report),
-    durationMs: Date.now() - startedAt
-  };
-};
-
 // src/commands/dependency-audit/dependency-audit.command.ts
 var printAuditResult = (result, json) => {
   if (json) {
@@ -825,7 +1152,7 @@ var auditAndReport = async (path, options) => {
 };
 var registerDependencyAuditCommand = (program) => {
   program.command("dependency-audit").description(
-    'Audita as depend\xEAncias do projeto contra vulnerabilidades conhecidas (via "npm audit"; requer npm no PATH e acesso \xE0 rede)'
+    'Audita as depend\xEAncias do projeto contra vulnerabilidades conhecidas (via "npm audit" e OSV.dev; requer npm no PATH e acesso \xE0 rede)'
   ).argument("[path]", "diret\xF3rio do projeto a ser auditado", ".").option("--json", "exibe o resultado em JSON").action((path, options) => auditAndReport(path, options));
 };
 
@@ -883,12 +1210,24 @@ var hasLimitOption = (options) => {
     return key?.type === "Identifier" && key.name === "limit";
   }) ?? false;
 };
+var getMemberCallParts = (node) => {
+  if (node.type !== "CallExpression") {
+    return { object: void 0, property: void 0, args: void 0 };
+  }
+  const callee = node.callee;
+  const args = node.arguments;
+  if (callee?.type !== "MemberExpression") {
+    return { object: void 0, property: void 0, args };
+  }
+  return {
+    object: callee.object,
+    property: callee.property,
+    args
+  };
+};
 var isBodyParserWithoutLimit = (node) => {
-  const callee = node.type === "CallExpression" ? node.callee : void 0;
-  const object = callee?.type === "MemberExpression" ? callee.object : void 0;
-  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  const { object, property, args } = getMemberCallParts(node);
   const isBodyParserCall = object?.type === "Identifier" && BODY_PARSER_OBJECTS.has(object.name) && property?.type === "Identifier" && BODY_PARSER_METHODS.has(property.name);
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
   return isBodyParserCall && !hasLimitOption(args?.[0]);
 };
 var findMissingBodyLimitLines = (filePath, content) => {
@@ -1133,9 +1472,10 @@ var createFunctionStatementCountRule = (config) => ({
 // src/rules/high-complexity.rule.ts
 var highComplexityRule = createFunctionStatementCountRule({
   id: "high-complexity",
-  description: "Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)",
+  description: "Detecta fun\xE7\xF5es com muitos condicionais/loops/tern\xE1rios (complexidade alta)",
   statementTypes: /* @__PURE__ */ new Set([
     "IfStatement",
+    "ConditionalExpression",
     "ForStatement",
     "ForInStatement",
     "ForOfStatement",
@@ -1145,7 +1485,7 @@ var highComplexityRule = createFunctionStatementCountRule({
     "CatchClause"
   ]),
   maxCount: 5,
-  unitLabel: "condicionais/loops"
+  unitLabel: "condicionais/loops/tern\xE1rios"
 });
 
 // src/commands/high-complexity/high-complexity.command.ts
@@ -1216,13 +1556,16 @@ var isMathRandomCall = (node) => {
   return object?.type === "Identifier" && object.name === "Math" && property?.type === "Identifier" && property.name === "random";
 };
 var HASH_LIKE_NAME_PATTERN = /hash|md5|sha1/i;
+var memberPropertyName = (callee) => {
+  const property = callee.property;
+  return property?.type === "Identifier" ? property.name : void 0;
+};
 var calleeName = (callee) => {
   if (callee?.type === "Identifier") {
     return callee.name;
   }
   if (callee?.type === "MemberExpression") {
-    const property = callee.property;
-    return property?.type === "Identifier" ? property.name : void 0;
+    return memberPropertyName(callee);
   }
   return void 0;
 };
@@ -1408,12 +1751,24 @@ var objectHasProperty = (object, propertyName) => {
     return key?.type === "Identifier" && key.name === propertyName;
   }) ?? false;
 };
-var isJwtSignWithoutExpiration = (node) => {
+var getCallExpressionParts = (node) => {
   const callee = node.type === "CallExpression" ? node.callee : void 0;
+  const args = node.type === "CallExpression" ? node.arguments : void 0;
+  return { callee, args };
+};
+var getMemberExpressionParts = (callee) => {
   const object = callee?.type === "MemberExpression" ? callee.object : void 0;
   const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  return { object, property };
+};
+var getJwtSignCallParts = (node) => {
+  const { callee, args } = getCallExpressionParts(node);
+  const { object, property } = getMemberExpressionParts(callee);
+  return { object, property, args };
+};
+var isJwtSignWithoutExpiration = (node) => {
+  const { object, property, args } = getJwtSignCallParts(node);
   const isJwtSignCall = object?.type === "Identifier" && object.name === "jwt" && property?.type === "Identifier" && property.name === "sign";
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
   const payload = args?.[0];
   const options = args?.[2];
   const hasExpInPayload = objectHasProperty(payload, "exp");
@@ -1686,12 +2041,26 @@ var isPermissiveCorsCall = (node) => {
   const args = node.arguments;
   return (args?.length ?? 0) === 0 || isWildcardOriginOption(args?.[0]);
 };
+var callExpressionParts = (node) => {
+  if (node.type !== "CallExpression") {
+    return void 0;
+  }
+  return {
+    callee: node.callee,
+    args: node.arguments
+  };
+};
+var memberCalleeProperty = (callee) => {
+  if (callee?.type !== "MemberExpression") {
+    return void 0;
+  }
+  return callee.property;
+};
 var isWildcardOriginHeader = (node) => {
-  const callee = node.type === "CallExpression" ? node.callee : void 0;
-  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
-  const headerName = args?.[0];
-  const headerValue = args?.[1];
+  const parts = callExpressionParts(node);
+  const property = memberCalleeProperty(parts?.callee);
+  const headerName = parts?.args?.[0];
+  const headerValue = parts?.args?.[1];
   return property?.type === "Identifier" && HEADER_SETTER_METHODS.has(property.name) && headerName?.type === "StringLiteral" && headerName.value === "Access-Control-Allow-Origin" && headerValue?.type === "StringLiteral" && headerValue.value === "*";
 };
 var findPermissiveCorsLines = (filePath, content) => {
@@ -1845,13 +2214,26 @@ var awaitNoTryCatchRule = {
 
 // src/rules/floating-promise.rule.ts
 var PROMISE_STATIC_METHODS = /* @__PURE__ */ new Set(["all", "race", "allSettled", "any"]);
-var asyncFunctionName = (node) => {
+var functionDeclarationName = (node) => {
   const declarationId = node.type === "FunctionDeclaration" ? node.id : void 0;
-  const declarationName = declarationId?.type === "Identifier" ? declarationId.name : void 0;
-  const id = node.type === "VariableDeclarator" ? node.id : void 0;
-  const init = node.type === "VariableDeclarator" ? node.init : void 0;
-  const hasAsyncFunctionValue = (init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression") && init.async;
-  return declarationName ?? (id?.type === "Identifier" && hasAsyncFunctionValue ? id.name : void 0);
+  return declarationId?.type === "Identifier" ? declarationId.name : void 0;
+};
+var isAsyncFunctionValue = (init) => {
+  return (init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression") && init.async;
+};
+var asyncVariableDeclaratorId = (node) => {
+  return node.type === "VariableDeclarator" ? node.id : void 0;
+};
+var asyncVariableDeclaratorInit = (node) => {
+  return node.type === "VariableDeclarator" ? node.init : void 0;
+};
+var asyncVariableDeclaratorName = (node) => {
+  const id = asyncVariableDeclaratorId(node);
+  const init = asyncVariableDeclaratorInit(node);
+  return id?.type === "Identifier" && isAsyncFunctionValue(init) ? id.name : void 0;
+};
+var asyncFunctionName = (node) => {
+  return functionDeclarationName(node) ?? asyncVariableDeclaratorName(node);
 };
 var collectAsyncFunctionNames = (sourceFile) => {
   const names = /* @__PURE__ */ new Set();
@@ -1863,16 +2245,20 @@ var collectAsyncFunctionNames = (sourceFile) => {
   });
   return names;
 };
+var isKnownFunctionCall = (callee, asyncFunctionNames) => {
+  return callee.type === "Identifier" && (callee.name === "fetch" || asyncFunctionNames.has(callee.name));
+};
+var isPromiseStaticMethodCall = (callee) => {
+  const object = callee.type === "MemberExpression" ? callee.object : void 0;
+  const property = callee.type === "MemberExpression" ? callee.property : void 0;
+  return object?.type === "Identifier" && object.name === "Promise" && property?.type === "Identifier" && PROMISE_STATIC_METHODS.has(property.name);
+};
 var isKnownPromiseReturningCall = (call, asyncFunctionNames) => {
   const callee = call.callee;
   if (!callee) {
     return false;
   }
-  const isKnownFunction = callee.type === "Identifier" && (callee.name === "fetch" || asyncFunctionNames.has(callee.name));
-  const object = callee.type === "MemberExpression" ? callee.object : void 0;
-  const property = callee.type === "MemberExpression" ? callee.property : void 0;
-  const isPromiseStaticMethod = object?.type === "Identifier" && object.name === "Promise" && property?.type === "Identifier" && PROMISE_STATIC_METHODS.has(property.name);
-  return isKnownFunction || isPromiseStaticMethod;
+  return isKnownFunctionCall(callee, asyncFunctionNames) || isPromiseStaticMethodCall(callee);
 };
 var findFloatingPromiseLines = (filePath, content) => {
   const lines = /* @__PURE__ */ new Set();
@@ -1902,7 +2288,7 @@ var floatingPromiseRule = {
 };
 
 // src/rules/promise-no-catch.rule.ts
-var memberPropertyName = (member) => {
+var memberPropertyName2 = (member) => {
   const property = member.property;
   return property?.type === "Identifier" ? property.name : void 0;
 };
@@ -1915,7 +2301,11 @@ var isThenCall = (node) => {
   }
   const callee = node.callee;
   const args = node.arguments;
-  return callee?.type === "MemberExpression" && memberPropertyName(callee) === "then" && (args?.length ?? 0) < 2;
+  return callee?.type === "MemberExpression" && memberPropertyName2(callee) === "then" && (args?.length ?? 0) < 2;
+};
+var chainMethodName = (currentCall, member, nextCall) => {
+  const isChainMember = member !== void 0 && member.type === "MemberExpression" && member.object === currentCall && isCallOf(nextCall, member);
+  return isChainMember ? memberPropertyName2(member) : void 0;
 };
 var chainReachesCatch = (thenCall, ancestors) => {
   let currentCall = thenCall;
@@ -1923,8 +2313,7 @@ var chainReachesCatch = (thenCall, ancestors) => {
   while (i < ancestors.length) {
     const member = ancestors.at(i);
     const nextCall = ancestors.at(i + 1);
-    const isChainMember = member !== void 0 && member.type === "MemberExpression" && member.object === currentCall && isCallOf(nextCall, member);
-    const methodName = isChainMember ? memberPropertyName(member) : void 0;
+    const methodName = chainMethodName(currentCall, member, nextCall);
     const continuesChain = methodName === "then" || methodName === "finally";
     if (methodName === "catch") {
       return true;
@@ -2166,10 +2555,10 @@ var tooManyForLoopsRule = createFunctionStatementCountRule({
 // src/rules/too-many-ifs.rule.ts
 var tooManyIfsRule = createFunctionStatementCountRule({
   id: "too-many-ifs",
-  description: 'Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")',
-  statementTypes: /* @__PURE__ */ new Set(["IfStatement"]),
+  description: 'Detecta fun\xE7\xF5es com muitos "if" ou tern\xE1rios (incluindo "else if")',
+  statementTypes: /* @__PURE__ */ new Set(["IfStatement", "ConditionalExpression"]),
   maxCount: 2,
-  unitLabel: "declara\xE7\xF5es if (incluindo else if)"
+  unitLabel: "declara\xE7\xF5es if e express\xF5es tern\xE1rias (incluindo else if)"
 });
 
 // src/rules/too-many-switch-cases.rule.ts
@@ -2308,12 +2697,25 @@ var weakCipherModeRule = {
 
 // src/rules/weak-hash-algorithm.rule.ts
 var WEAK_ALGORITHMS = /^(md5|sha1)$/i;
+var getCallExpressionCallee = (node) => {
+  return node.type === "CallExpression" ? node.callee : void 0;
+};
+var getCallExpressionArgs = (node) => {
+  return node.type === "CallExpression" ? node.arguments : void 0;
+};
+var getCreateHashProperty = (callee) => {
+  return callee?.type === "MemberExpression" ? callee.property : void 0;
+};
+var isCreateHashProperty = (property) => {
+  return property?.type === "Identifier" && property.name === "createHash";
+};
+var isWeakAlgorithmLiteral = (algorithm) => {
+  return algorithm?.type === "StringLiteral" && WEAK_ALGORITHMS.test(algorithm.value);
+};
 var isWeakCreateHashCall = (node) => {
-  const callee = node.type === "CallExpression" ? node.callee : void 0;
-  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
-  const algorithm = args?.[0];
-  return property?.type === "Identifier" && property.name === "createHash" && algorithm?.type === "StringLiteral" && WEAK_ALGORITHMS.test(algorithm.value);
+  const property = getCreateHashProperty(getCallExpressionCallee(node));
+  const algorithm = getCallExpressionArgs(node)?.[0];
+  return isCreateHashProperty(property) && isWeakAlgorithmLiteral(algorithm);
 };
 var findWeakHashLines = (filePath, content) => {
   const lines = /* @__PURE__ */ new Set();
@@ -2548,7 +2950,10 @@ var parseLocalSemgrepConfig = (value) => {
 };
 var registerScanCommand = (program) => {
   withScanOptions(
-    program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig)
+    program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig).option(
+      "--no-deps",
+      "n\xE3o inclui a auditoria de depend\xEAncias (npm audit + OSV.dev) neste scan \u2014 permite rodar offline"
+    )
   ).action(
     (path, options) => scanAndReport(path, allRules, "Scanning files...", { ...options, semgrep: true })
   );
@@ -2649,6 +3054,118 @@ var registerUnsafeSqlCommand = (program) => {
   );
 };
 
+// src/engines/engine-metadata.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { createRequire as createRequire4 } from "module";
+var require5 = createRequire4(import.meta.url);
+var packageForPlatform2 = (platform, architecture) => {
+  if (platform === "linux" && architecture === "x64") {
+    return "codesentry-semgrep-linux-x64";
+  }
+  if (platform === "win32" && architecture === "x64") {
+    return "codesentry-semgrep-win32-x64";
+  }
+  return void 0;
+};
+var unsupportedRuntimeMessage2 = (platform, architecture) => `O runtime Semgrep embutido n\xE3o est\xE1 dispon\xEDvel para ${platform}-${architecture}. O CodeSentry oferece suporte a Linux x64 e Windows x64.`;
+var readJsonFile = (path) => {
+  return JSON.parse(readFileSync2(path, "utf-8"));
+};
+var nonEmptyString = (value) => typeof value === "string" && value.length > 0;
+var errorReason2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var validRuntimeLock = (lock) => lock.schemaVersion === 1 && nonEmptyString(lock.semgrepVersion) && nonEmptyString(lock.pythonVersion) && /^[a-f0-9]{64}$/i.test(lock.runtimeSha256);
+var validRulesetLock = (lock) => lock.schemaVersion === 1 && nonEmptyString(lock.packageVersion) && nonEmptyString(lock.ruleset) && nonEmptyString(lock.source) && /^[a-f0-9]{64}$/i.test(lock.sha256) && nonEmptyString(lock.capturedAt) && !Number.isNaN(Date.parse(lock.capturedAt)) && (lock.upstreamRevision === void 0 || nonEmptyString(lock.upstreamRevision));
+var loadBundledSemgrepRuntimeMetadata = (platform = process.platform, architecture = process.arch, resolveLockPath = (packageName) => require5.resolve(`${packageName}/runtime.lock.json`)) => {
+  const packageName = packageForPlatform2(platform, architecture);
+  if (!packageName) {
+    throw new Error(unsupportedRuntimeMessage2(platform, architecture));
+  }
+  try {
+    const lock = readJsonFile(resolveLockPath(packageName));
+    if (!validRuntimeLock(lock)) {
+      throw new Error("manifesto de vers\xE3o inv\xE1lido");
+    }
+    return {
+      packageName,
+      semgrepVersion: lock.semgrepVersion,
+      pythonVersion: lock.pythonVersion,
+      runtimeSha256: lock.runtimeSha256
+    };
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel carregar os metadados do runtime Semgrep embutido: ${errorReason2(error)}`, {
+      cause: error
+    });
+  }
+};
+var loadBundledOwaspRulesetMetadata = (resolveLockPath = () => require5.resolve("codesentry-semgrep-rules/rules/ruleset.lock.json")) => {
+  try {
+    const lock = readJsonFile(resolveLockPath());
+    if (!validRulesetLock(lock)) {
+      throw new Error("manifesto de vers\xE3o inv\xE1lido");
+    }
+    return {
+      packageVersion: lock.packageVersion,
+      ruleset: lock.ruleset,
+      source: lock.source,
+      sha256: lock.sha256,
+      capturedAt: lock.capturedAt,
+      ...lock.upstreamRevision ? { upstreamRevision: lock.upstreamRevision } : {}
+    };
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel carregar os metadados do ruleset OWASP embutido: ${errorReason2(error)}`, {
+      cause: error
+    });
+  }
+};
+var loadEngineMetadata = () => ({
+  semgrep: loadBundledSemgrepRuntimeMetadata(),
+  owaspRuleset: loadBundledOwaspRulesetMetadata()
+});
+
+// src/commands/version/version.command.ts
+var buildVersionReport = (codesentryVersion, engines) => ({
+  codesentryVersion,
+  engines
+});
+var formatEngineVersions = (report) => {
+  const { semgrep, owaspRuleset } = report.engines;
+  return [
+    `CodeSentry: ${report.codesentryVersion}`,
+    "",
+    "Runtime Semgrep CE",
+    `  Vers\xE3o: ${semgrep.semgrepVersion}`,
+    `  Python: ${semgrep.pythonVersion}`,
+    `  Pacote: ${semgrep.packageName}`,
+    `  SHA-256: ${semgrep.runtimeSha256}`,
+    "",
+    "Ruleset OWASP",
+    `  Snapshot: ${owaspRuleset.ruleset}`,
+    `  Vers\xE3o do pacote: ${owaspRuleset.packageVersion}`,
+    `  Origem: ${owaspRuleset.source}`,
+    `  Capturado em: ${owaspRuleset.capturedAt}`,
+    ...owaspRuleset.upstreamRevision ? [`  Revis\xE3o upstream: ${owaspRuleset.upstreamRevision}`] : [],
+    `  SHA-256: ${owaspRuleset.sha256}`
+  ].join("\n");
+};
+var errorReason3 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var formatVersionOutput = (options, report) => options.json ? JSON.stringify(report, null, 2) : formatEngineVersions(report);
+var registerVersionCommand = (program, readPackageVersion2, readEngineMetadata = loadEngineMetadata) => {
+  program.command("version").description("Exibe a vers\xE3o do CodeSentry e dos motores embutidos").option("--engines", "inclui vers\xF5es e proveni\xEAncia do Semgrep e ruleset OWASP").option("--json", "emite o relat\xF3rio de vers\xF5es em JSON").action((options) => {
+    const codesentryVersion = readPackageVersion2();
+    if (!options.engines && !options.json) {
+      console.log(`CodeSentry: ${codesentryVersion}`);
+      return;
+    }
+    try {
+      const report = buildVersionReport(codesentryVersion, readEngineMetadata());
+      console.log(formatVersionOutput(options, report));
+    } catch (error) {
+      process.exitCode = 1;
+      console.error(`N\xE3o foi poss\xEDvel auditar as vers\xF5es dos motores: ${errorReason3(error)}`);
+    }
+  });
+};
+
 // src/commands/weak-cipher-mode/weak-cipher-mode.command.ts
 var registerWeakCipherModeCommand = (program) => {
   withScanOptions(
@@ -2744,16 +3261,17 @@ var registerSecurityCommands = (program) => {
   registerWeakCipherModeCommand(program);
   registerHardcodedAuthorizationValueCommand(program);
 };
-var require5 = createRequire4(import.meta.url);
+var require6 = createRequire5(import.meta.url);
 var readPackageVersion = () => {
-  const packageJsonPath = require5.resolve("../package.json");
-  const { version } = JSON.parse(readFileSync2(packageJsonPath, "utf-8"));
+  const packageJsonPath = require6.resolve("../package.json");
+  const { version } = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
   return version;
 };
 var createCli = () => {
   printBanner();
   const program = new Command().name("codesentry").description("CLI de verifica\xE7\xE3o de vulnerabilidades e qualidade de c\xF3digo").version(readPackageVersion()).helpCommand(false);
   registerInitCommand(program);
+  registerVersionCommand(program, readPackageVersion);
   registerAnalysisCommands(program);
   registerQualityCommands(program);
   registerSecurityCommands(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codesentry",
-  "version": "0.1.11",
+  "version": "0.2.1",
   "workspaces": [
     "packages/semgrep-rules"
   ],
@@ -48,7 +48,7 @@
     "@clack/prompts": "^1.7.0",
     "chalk": "^6.0.0",
     "cli-table3": "^0.6.5",
-    "codesentry-semgrep-rules": "0.1.11",
+    "codesentry-semgrep-rules": "0.2.1",
     "commander": "^15.0.0",
     "eslint": "^10.10.0",
     "eslint-plugin-no-unsanitized": "^4.1.5",
@@ -59,8 +59,8 @@
     "p-limit": "^7.3.2"
   },
   "optionalDependencies": {
-    "codesentry-semgrep-linux-x64": "0.1.11",
-    "codesentry-semgrep-win32-x64": "0.1.11"
+    "codesentry-semgrep-linux-x64": "0.2.1",
+    "codesentry-semgrep-win32-x64": "0.2.1"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",
@@ -70,5 +70,8 @@
     "tsx": "^4.23.13",
     "typescript": "^7.0.2",
     "vitest": "^5.0.0"
+  },
+  "overrides": {
+    "esbuild": "^0.28.2"
   }
 }