codesentry 0.1.9 → 0.1.11

package/dist/index.js

@@ -36,38 +36,33 @@ var visitSourceNodes = (node, visitor, parent) => {
 var EXEC_METHOD_NAMES = /* @__PURE__ */ new Set(["exec", "execSync"]);
 var CHILD_PROCESS_MODULE_NAMES = /* @__PURE__ */ new Set(["child_process", "node:child_process"]);
 var isChildProcessModuleSpecifier = (node) => node?.type === "StringLiteral" && CHILD_PROCESS_MODULE_NAMES.has(node.value);
+var localName = (specifier) => {
+  const local = specifier.local;
+  return local?.type === "Identifier" ? local.name : void 0;
+};
+var isExecImport = (specifier) => {
+  const imported = specifier.imported;
+  return specifier.type === "ImportSpecifier" && imported?.type === "Identifier" && EXEC_METHOD_NAMES.has(imported.name);
+};
+var isNamespaceImport = (specifier) => specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier";
+var collectImportBinding = (specifier, bindings) => {
+  const name = localName(specifier);
+  if (!name) {
+    return;
+  }
+  const bindingSet = isExecImport(specifier) ? bindings.directCalls : isNamespaceImport(specifier) ? bindings.namespaces : void 0;
+  bindingSet?.add(name);
+};
 var collectFromImportDeclaration = (node, bindings) => {
   if (!isChildProcessModuleSpecifier(node.source)) {
     return;
   }
   for (const specifier of node.specifiers ?? []) {
-    const local = specifier.local;
-    if (local?.type !== "Identifier") {
-      continue;
-    }
-    if (specifier.type === "ImportSpecifier") {
-      const imported = specifier.imported;
-      if (imported?.type === "Identifier" && EXEC_METHOD_NAMES.has(imported.name)) {
-        bindings.directCalls.add(local.name);
-      }
-    } else if (specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier") {
-      bindings.namespaces.add(local.name);
-    }
+    collectImportBinding(specifier, bindings);
   }
 };
 var isRequireCall = (node) => node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "require" && isChildProcessModuleSpecifier(node.arguments?.[0]);
-var collectFromVariableDeclarator = (node, bindings) => {
-  if (!isRequireCall(node.init)) {
-    return;
-  }
-  const id = node.id;
-  if (id?.type === "Identifier") {
-    bindings.namespaces.add(id.name);
-    return;
-  }
-  if (id?.type !== "ObjectPattern") {
-    return;
-  }
+var collectDirectCallBindings = (id, bindings) => {
   for (const property of id.properties ?? []) {
     const key = property.key;
     const value = property.value;
@@ -76,6 +71,16 @@ var collectFromVariableDeclarator = (node, bindings) => {
     }
   }
 };
+var collectFromVariableDeclarator = (node, bindings) => {
+  if (!isRequireCall(node.init)) {
+    return;
+  }
+  const id = node.id;
+  const namespaceName = id?.type === "Identifier" ? id.name : void 0;
+  const destructuredBindings = id?.type === "ObjectPattern" ? id : void 0;
+  namespaceName && bindings.namespaces.add(namespaceName);
+  destructuredBindings && collectDirectCallBindings(destructuredBindings, bindings);
+};
 var collectChildProcessBindings = (sourceFile) => {
   const bindings = { directCalls: /* @__PURE__ */ new Set(), namespaces: /* @__PURE__ */ new Set() };
   visitSourceNodes(sourceFile, (node) => {
@@ -136,6 +141,9 @@ var commandInjectionRule = {
   }
 };
 
+// src/commands/scan/scan-options.ts
+var withScanOptions = (command) => command.option("--json", "exibe o resultado em JSON").option("--tests", "inclui arquivos de teste na an\xE1lise (por padr\xE3o s\xE3o ignorados)");
+
 // src/commands/scan/scan-runner.ts
 import { writeFile } from "fs/promises";
 import { join as join2 } from "path";
@@ -164,23 +172,47 @@ var formatErrorChain = (error) => {
 // src/reporters/console.reporter.ts
 import chalk from "chalk";
 import Table from "cli-table3";
+
+// src/scanner/scan-result.ts
+var DEPENDENCY_AUDIT_NOTE = 'Dependency audit n\xE3o foi inclu\xEDdo neste scan \u2014 rode "codesentry dependency-audit" separadamente.';
+var ZERO_SEMGREP_COVERAGE_WARNING = "Semgrep n\xE3o analisou nenhum arquivo nesta execu\xE7\xE3o \u2014 verifique se o ruleset offline est\xE1 instalado/preparado.";
+var mergeScanResults = (nativeResult, semgrepResult) => ({
+  scannedFiles: nativeResult.scannedFiles,
+  findings: [...nativeResult.findings, ...semgrepResult.findings],
+  durationMs: nativeResult.durationMs + semgrepResult.durationMs,
+  engines: {
+    codesentry: nativeResult.engines?.codesentry ?? nativeResult.scannedFiles,
+    semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
+  }
+});
+var finalizeScanResult = (result) => ({
+  ...result,
+  engines: { ...result.engines, dependencyAudit: false },
+  warnings: result.engines?.semgrep === 0 ? [...result.warnings ?? [], ZERO_SEMGREP_COVERAGE_WARNING] : result.warnings
+});
+
+// src/reporters/console.reporter.ts
 var SEVERITY_COLOR = {
   low: (text2) => chalk.gray(text2),
   medium: (text2) => chalk.yellow(text2),
   high: (text2) => chalk.red(text2),
   critical: (text2) => chalk.bgRed.white(text2)
 };
-var printConsoleReport = (result) => {
-  const coverage = result.engines?.semgrep === void 0 ? "" : ` CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s).`;
-  if (result.findings.length === 0) {
-    console.log(
-      chalk.green(`Nenhum problema encontrado (${result.scannedFiles} arquivos analisados).${coverage}`)
-    );
-    return;
+var coverageText = (result) => result.engines?.semgrep === void 0 ? "" : ` CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s).`;
+var printNotes = (result) => {
+  if (result.engines?.dependencyAudit === false) {
+    console.log(chalk.cyan(DEPENDENCY_AUDIT_NOTE));
   }
-  const table = new Table({
-    head: ["Severity", "Rule", "File", "Line", "Message"]
-  });
+  for (const warning of result.warnings ?? []) {
+    console.log(chalk.yellow(`Aviso: ${warning}`));
+  }
+};
+var printCleanReport = (result, coverage) => {
+  console.log(chalk.green(`Nenhum problema encontrado (${result.scannedFiles} arquivos analisados).${coverage}`));
+  printNotes(result);
+};
+var findingsTable = (result) => {
+  const table = new Table({ head: ["Severity", "Rule", "File", "Line", "Message"] });
   for (const finding of result.findings) {
     const colorize = SEVERITY_COLOR[finding.severity];
     table.push([
@@ -191,13 +223,25 @@ var printConsoleReport = (result) => {
       finding.message
     ]);
   }
-  console.log(table.toString());
+  return table;
+};
+var printFindingsReport = (result, coverage) => {
+  console.log(findingsTable(result).toString());
   console.log(
     chalk.bold(
       `
 ${result.findings.length} problema(s) encontrado(s) em ${result.scannedFiles} arquivo(s) (${result.durationMs}ms).${coverage}`
     )
   );
+  printNotes(result);
+};
+var printConsoleReport = (result) => {
+  const coverage = coverageText(result);
+  if (result.findings.length === 0) {
+    printCleanReport(result, coverage);
+    return;
+  }
+  printFindingsReport(result, coverage);
 };
 
 // src/reporters/json.reporter.ts
@@ -207,12 +251,13 @@ var toJsonReport = (result) => {
 
 // src/reporters/markdown.reporter.ts
 var SEVERITY_ORDER = ["critical", "high", "medium", "low"];
-var SEVERITY_LABEL = {
-  critical: "Critical",
-  high: "High",
-  medium: "Medium",
-  low: "Low"
-};
+var SEVERITY_LABEL = /* @__PURE__ */ new Map([
+  ["critical", "Critical"],
+  ["high", "High"],
+  ["medium", "Medium"],
+  ["low", "Low"]
+]);
+var severityLabel = (severity) => SEVERITY_LABEL.get(severity) ?? severity;
 var escapeCell = (text2) => text2.replaceAll("|", "\\|");
 var groupBy = (items, keyOf) => {
   const map = /* @__PURE__ */ new Map();
@@ -222,7 +267,7 @@ var groupBy = (items, keyOf) => {
   }
   return map;
 };
-var findingsTable = (findings) => {
+var findingsTable2 = (findings) => {
   const sorted = [...findings].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
   const lines = ["| Arquivo | Linha | Mensagem |", "| --- | --- | --- |"];
   for (const f of sorted) {
@@ -231,11 +276,11 @@ var findingsTable = (findings) => {
   return lines;
 };
 var severitySection = (severity, findings) => {
-  const lines = [`## ${SEVERITY_LABEL[severity]} (${findings.length})`, ""];
+  const lines = [`## ${severityLabel(severity)} (${findings.length})`, ""];
   const byRule = groupBy(findings, (f) => f.ruleId);
   for (const ruleId of [...byRule.keys()].sort()) {
     const ruleFindings = byRule.get(ruleId) ?? [];
-    lines.push(`### ${ruleId} (${ruleFindings.length})`, "", ...findingsTable(ruleFindings), "");
+    lines.push(`### ${ruleId} (${ruleFindings.length})`, "", ...findingsTable2(ruleFindings), "");
   }
   return lines;
 };
@@ -249,12 +294,14 @@ var reportHeader = (result, generatedAt) => [
   ],
   `- **Dura\xE7\xE3o:** ${result.durationMs}ms`,
   `- **Total de problemas:** ${result.findings.length}`,
+  ...result.engines?.dependencyAudit === false ? [`- **Nota:** ${DEPENDENCY_AUDIT_NOTE}`] : [],
   ""
 ];
+var warningsSection = (result) => (result.warnings ?? []).length === 0 ? [] : ["## Avisos", "", ...(result.warnings ?? []).map((warning) => `- ${warning}`), ""];
 var summaryTable = (bySeverity) => {
   const lines = ["## Resumo por severidade", "", "| Severidade | Quantidade |", "| --- | --- |"];
   for (const severity of SEVERITY_ORDER) {
-    lines.push(`| ${SEVERITY_LABEL[severity]} | ${(bySeverity.get(severity) ?? []).length} |`);
+    lines.push(`| ${severityLabel(severity)} | ${(bySeverity.get(severity) ?? []).length} |`);
   }
   lines.push("");
   return lines;
@@ -271,22 +318,14 @@ var severitySections = (bySeverity) => {
 };
 var toMarkdownReport = (result, generatedAt = /* @__PURE__ */ new Date()) => {
   const bySeverity = groupBy(result.findings, (f) => f.severity);
-  return [...reportHeader(result, generatedAt), ...summaryTable(bySeverity), ...severitySections(bySeverity)].join(
-    "\n"
-  );
+  return [
+    ...reportHeader(result, generatedAt),
+    ...warningsSection(result),
+    ...summaryTable(bySeverity),
+    ...severitySections(bySeverity)
+  ].join("\n");
 };
 
-// src/scanner/scan-result.ts
-var mergeScanResults = (nativeResult, semgrepResult) => ({
-  scannedFiles: nativeResult.scannedFiles,
-  findings: [...nativeResult.findings, ...semgrepResult.findings],
-  durationMs: nativeResult.durationMs + semgrepResult.durationMs,
-  engines: {
-    codesentry: nativeResult.engines?.codesentry ?? nativeResult.scannedFiles,
-    semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
-  }
-});
-
 // src/scanner/scanner.ts
 import { readFile } from "fs/promises";
 import { availableParallelism } from "os";
@@ -294,25 +333,35 @@ import { availableParallelism } from "os";
 // src/scanner/file-finder.ts
 import { readdir } from "fs/promises";
 import { join } from "path";
+
+// src/scanner/ignore-patterns.ts
+var ALWAYS_IGNORED_DIR_NAMES = ["node_modules", ".git", "dist", ".next"];
+var TEST_DIR_NAMES = ["tests", "test", "__tests__"];
+var TEST_FILE_GLOBS = ["*.spec.*", "*.test.*"];
+var TEST_FILE_NAME_PATTERN = /\.(spec|test)\.[^./]+$/;
+var isIgnoredDirName = (name, includeTests = false) => ALWAYS_IGNORED_DIR_NAMES.includes(name) || !includeTests && TEST_DIR_NAMES.includes(name);
+var isTestFileName = (fileName) => TEST_FILE_NAME_PATTERN.test(fileName);
+
+// src/scanner/file-finder.ts
 var SCANNABLE_EXTENSIONS = [".js", ".ts", ".jsx", ".tsx"];
-var IGNORED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".next"]);
 var isScannable = (fileName) => SCANNABLE_EXTENSIONS.some((ext) => fileName.endsWith(ext));
-var walk = async (currentDir) => {
-  const entries = await readdir(currentDir, { withFileTypes: true });
-  const files = [];
-  for (const entry of entries) {
-    if (entry.isDirectory()) {
-      if (IGNORED_DIRS.has(entry.name)) continue;
-      files.push(...await walk(join(currentDir, entry.name)));
-    } else if (entry.isFile() && isScannable(entry.name)) {
-      files.push(join(currentDir, entry.name));
-    }
+var filesFromEntry = async (currentDir, entry, includeTests) => {
+  if (entry.isDirectory()) {
+    return isIgnoredDirName(entry.name, includeTests) ? [] : walk(join(currentDir, entry.name), includeTests);
   }
-  return files;
+  return entry.isFile() && isScannable(entry.name) && (includeTests || !isTestFileName(entry.name)) ? [join(currentDir, entry.name)] : [];
 };
-var findFiles = async (targetDir) => {
+var walk = async (currentDir, includeTests) => {
   try {
-    return await walk(targetDir);
+    const entries = await readdir(currentDir, { withFileTypes: true });
+    return (await Promise.all(entries.map((entry) => filesFromEntry(currentDir, entry, includeTests)))).flat();
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel listar os arquivos em "${currentDir}".`, { cause: error });
+  }
+};
+var findFiles = async (targetDir, includeTests = false) => {
+  try {
+    return await walk(targetDir, includeTests);
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel listar os arquivos em "${targetDir}".`, { cause: error });
   }
@@ -342,26 +391,35 @@ var readFileContent = async (filePath) => {
     throw new Error(`N\xE3o foi poss\xEDvel ler o arquivo "${filePath}".`, { cause: error });
   }
 };
+var checkRule = (rule, filePath, content) => {
+  try {
+    return { findings: rule.check(filePath, content) };
+  } catch (error) {
+    return { findings: [], error };
+  }
+};
 var scanFile = async (filePath, rules) => {
-  const content = await readFileContent(filePath);
-  const findings = [];
-  let hasParseError = false;
-  for (const rule of rules) {
-    try {
-      findings.push(...rule.check(filePath, content));
-    } catch (error) {
-      if (!hasParseError) {
-        findings.push(parseErrorFinding(filePath, error));
+  try {
+    const content = await readFileContent(filePath);
+    const findings = [];
+    let hasParseError = false;
+    for (const rule of rules) {
+      const result = checkRule(rule, filePath, content);
+      findings.push(...result.findings);
+      if (result.error && !hasParseError) {
+        findings.push(parseErrorFinding(filePath, result.error));
         hasParseError = true;
       }
     }
+    return findings;
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel analisar o arquivo "${filePath}".`, { cause: error });
   }
-  return findings;
 };
-var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY) => {
+var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY, includeTests = false) => {
   try {
     const startedAt = Date.now();
-    const files = await findFiles(targetDir);
+    const files = await findFiles(targetDir, includeTests);
     const findings = (await runWithConcurrencyLimit(files, concurrency, (filePath) => scanFile(filePath, rules))).flat();
     return {
       scannedFiles: files.length,
@@ -460,51 +518,58 @@ var mapSemgrepReportToFindings = (report) => report.results.map((finding) => ({
   severity: SEMGREP_SEVERITIES[finding.extra.severity] ?? "medium"
 }));
 var outputFromError = (error) => typeof error.stdout === "string" ? error.stdout : void 0;
-var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync) => {
-  const startedAt = Date.now();
-  const args = [
-    "scan",
-    "--config",
-    ruleset,
-    "--metrics=off",
-    "--json",
-    "--quiet",
-    "--exclude",
-    "node_modules",
-    "--exclude",
-    ".git",
-    "--exclude",
-    "dist",
-    "--exclude",
-    ".next",
-    // Não repetir targetDir aqui: o processo já roda com cwd = targetDir
-    // (abaixo), então o alvo relativo a esse cwd é o diretório atual.
-    "."
-  ];
-  let stdout;
+var excludeArgs = (names) => names.flatMap((name) => ["--exclude", name]);
+var semgrepArgs = (ruleset, includeTests) => [
+  "scan",
+  "--config",
+  ruleset,
+  "--metrics=off",
+  "--json",
+  "--quiet",
+  ...excludeArgs(ALWAYS_IGNORED_DIR_NAMES),
+  ...includeTests ? [] : excludeArgs([...TEST_DIR_NAMES, ...TEST_FILE_GLOBS]),
+  // Não repetir targetDir aqui: o processo já roda com cwd = targetDir,
+  // então o alvo relativo a esse cwd é o diretório atual.
+  "."
+];
+var semgrepEnvironment = (runtime) => {
   const semgrepDir = dirname2(runtime.semgrep);
-  const SYSTEM_PATH_FALLBACK = process.platform === "win32" ? "C:\\Windows\\System32;C:\\Windows" : "/usr/local/bin:/usr/bin:/bin";
-  const env = {
+  const systemPathFallback = process.platform === "win32" ? "C:\\Windows\\System32;C:\\Windows" : "/usr/local/bin:/usr/bin:/bin";
+  return {
     ...process.env,
-    PATH: `${semgrepDir}${delimiter}${dirname2(semgrepDir)}${delimiter}${process.env.PATH ?? ""}${delimiter}${SYSTEM_PATH_FALLBACK}`
+    PATH: `${semgrepDir}${delimiter}${dirname2(semgrepDir)}${delimiter}${process.env.PATH ?? ""}${delimiter}${systemPathFallback}`
   };
+};
+var executeSemgrep = async (targetDir, runtime, ruleset, execute, includeTests) => {
   try {
-    ({ stdout } = await execute(runtime.semgrep, args, { cwd: targetDir, maxBuffer: 20 * 1024 * 1024, env }));
+    const { stdout } = await execute(runtime.semgrep, semgrepArgs(ruleset, includeTests), {
+      cwd: targetDir,
+      maxBuffer: 20 * 1024 * 1024,
+      env: semgrepEnvironment(runtime)
+    });
+    return stdout;
   } catch (error) {
     const output = outputFromError(error);
-    if (!output) {
-      throw new Error("N\xE3o foi poss\xEDvel executar o Semgrep embutido.", { cause: error });
+    if (output) {
+      return output;
     }
-    stdout = output;
+    throw new Error("N\xE3o foi poss\xEDvel executar o Semgrep embutido.", { cause: error });
+  }
+};
+var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync, includeTests = false) => {
+  const startedAt = Date.now();
+  try {
+    const report = parseSemgrepReport(await executeSemgrep(targetDir, runtime, ruleset, execute, includeTests));
+    const scannedFiles = report.paths?.scanned.length ?? 0;
+    return {
+      scannedFiles,
+      findings: mapSemgrepReportToFindings(report),
+      durationMs: Date.now() - startedAt,
+      engines: { semgrep: scannedFiles }
+    };
+  } catch (error) {
+    throw new Error("N\xE3o foi poss\xEDvel processar o resultado do Semgrep.", { cause: error });
   }
-  const report = parseSemgrepReport(stdout);
-  const scannedFiles = report.paths?.scanned.length ?? 0;
-  return {
-    scannedFiles,
-    findings: mapSemgrepReportToFindings(report),
-    durationMs: Date.now() - startedAt,
-    engines: { semgrep: scannedFiles }
-  };
 };
 
 // src/commands/scan/report-filename.ts
@@ -540,22 +605,29 @@ Relat\xF3rio detalhado gerado em: ${filePath}`));
     console.error(chalk2.red(`N\xE3o foi poss\xEDvel gerar o relat\xF3rio Markdown: ${errorMessage2(error)}`));
   }
 };
+var runScanEngines = async (path, rules, options) => {
+  try {
+    const includeTests = options.tests ?? false;
+    const nativeResult = await runScan(path, rules, options.concurrency, includeTests);
+    if (!options.semgrep) {
+      return finalizeScanResult(nativeResult);
+    }
+    const semgrepResult = await runBundledSemgrep(path, void 0, options.config, void 0, includeTests);
+    return finalizeScanResult(mergeScanResults(nativeResult, semgrepResult));
+  } catch (error) {
+    throw new Error(`Falha durante a an\xE1lise: ${errorMessage2(error)}`, { cause: error });
+  }
+};
 var createScanTasks = (path, rules, taskTitle, options, onResult) => new Listr([
   {
     title: taskTitle,
-    task: () => runScan(path, rules, options.concurrency).then((nativeResult) => {
-      if (!options.semgrep) {
-        onResult(nativeResult);
-        return void 0;
+    task: async () => {
+      try {
+        onResult(await runScanEngines(path, rules, options));
+      } catch (error) {
+        throw error;
       }
-      return runBundledSemgrep(path, void 0, options.config).then((semgrepResult) => {
-        onResult(mergeScanResults(nativeResult, semgrepResult));
-      });
-    }).catch((error) => {
-      throw new Error(`Falha durante a an\xE1lise: ${errorMessage2(error)}`, {
-        cause: error
-      });
-    })
+    }
   }
 ]);
 var scanAndReport = async (path, rules, taskTitle, options) => {
@@ -576,7 +648,9 @@ var scanAndReport = async (path, rules, taskTitle, options) => {
 
 // src/commands/command-injection/command-injection.command.ts
 var registerCommandInjectionCommand = (program) => {
-  program.command("command-injection").description("Detecta child_process.exec()/execSync() recebendo entrada externa").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("command-injection").description("Detecta child_process.exec()/execSync() recebendo entrada externa").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [commandInjectionRule], "Checking command injection...", options)
   );
 };
@@ -675,7 +749,9 @@ var deepNestingRule = {
 
 // src/commands/deep-nesting/deep-nesting.command.ts
 var registerDeepNestingCommand = (program) => {
-  program.command("deep-nesting").description("Detecta blocos aninhados al\xE9m do limite recomendado").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("deep-nesting").description("Detecta blocos aninhados al\xE9m do limite recomendado").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [deepNestingRule], "Checking nesting depth...", options)
   );
 };
@@ -787,7 +863,9 @@ var emptyCatchRule = {
 
 // src/commands/empty-catch/empty-catch.command.ts
 var registerEmptyCatchCommand = (program) => {
-  program.command("empty-catch").description("Detecta blocos catch vazios").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("empty-catch").description("Detecta blocos catch vazios").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [emptyCatchRule], "Checking empty catch blocks...", options)
   );
 };
@@ -839,11 +917,85 @@ var expressMissingBodyLimitRule = {
 
 // src/commands/express-missing-body-limit/express-missing-body-limit.command.ts
 var registerExpressMissingBodyLimitCommand = (program) => {
-  program.command("express-missing-body-limit").description("Detecta middlewares de body parsing do Express sem limite de tamanho de requisi\xE7\xE3o").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("express-missing-body-limit").description("Detecta middlewares de body parsing do Express sem limite de tamanho de requisi\xE7\xE3o").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [expressMissingBodyLimitRule], "Checking Express body limits...", options)
   );
 };
 
+// src/rules/hardcoded-authorization-value.rule.ts
+var HEADER_OR_COOKIE_NAME_PATTERN = /headers|cookies?/i;
+var accessObjectName = (object) => {
+  const objectProperty = object?.type === "MemberExpression" ? object.property : object;
+  return objectProperty?.type === "Identifier" ? objectProperty.name : void 0;
+};
+var isHeaderOrCookieAccessCall = (node) => {
+  const callee = node?.callee;
+  const property = callee?.property;
+  const object = callee?.object;
+  return node?.type === "CallExpression" && callee?.type === "MemberExpression" && property?.type === "Identifier" && property.name === "get" && HEADER_OR_COOKIE_NAME_PATTERN.test(accessObjectName(object) ?? "");
+};
+var collectStringConstants = (sourceFile) => {
+  const constants = /* @__PURE__ */ new Map();
+  visitSourceNodes(sourceFile, (node) => {
+    if (node.type !== "VariableDeclarator") {
+      return;
+    }
+    const id = node.id;
+    const init = node.init;
+    if (id?.type === "Identifier" && init?.type === "StringLiteral") {
+      constants.set(id.name, init.value);
+    }
+  });
+  return constants;
+};
+var isConstantStringSide = (node, constants) => {
+  if (node?.type === "StringLiteral") {
+    return true;
+  }
+  return node?.type === "Identifier" && constants.has(node.name);
+};
+var isHardcodedAuthorizationComparison = (node, constants) => {
+  const left = node.left;
+  const right = node.right;
+  const isEquality = node.operator === "===" || node.operator === "==";
+  return node.type === "BinaryExpression" && isEquality && (isHeaderOrCookieAccessCall(left) && isConstantStringSide(right, constants) || isHeaderOrCookieAccessCall(right) && isConstantStringSide(left, constants));
+};
+var findHardcodedAuthorizationLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  const constants = collectStringConstants(sourceFile);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isHardcodedAuthorizationComparison(node, constants) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var hardcodedAuthorizationValueRule = {
+  id: "hardcoded-authorization-value",
+  description: "Detecta um header/cookie de requisi\xE7\xE3o comparado com um valor fixo no c\xF3digo para conceder acesso",
+  check(filePath, content) {
+    return findHardcodedAuthorizationLines(filePath, content).map((line) => ({
+      ruleId: "hardcoded-authorization-value",
+      message: "Autoriza\xE7\xE3o baseada em compara\xE7\xE3o de header/cookie com valor fixo no c\xF3digo-fonte",
+      file: filePath,
+      line,
+      severity: "critical"
+    }));
+  }
+};
+
+// src/commands/hardcoded-authorization-value/hardcoded-authorization-value.command.ts
+var registerHardcodedAuthorizationValueCommand = (program) => {
+  withScanOptions(
+    program.command("hardcoded-authorization-value").description("Detecta compara\xE7\xE3o de headers/cookies de autoriza\xE7\xE3o com um valor fixo no c\xF3digo").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [hardcodedAuthorizationValueRule], "Checking hardcoded authorization values...", options)
+  );
+};
+
 // src/commands/help/help.command.ts
 import Table2 from "cli-table3";
 var buildHelpTable = (commands) => {
@@ -884,14 +1036,14 @@ var nodeName = (node) => {
   }
   return nameValue(node) ?? literalValue(node) ?? nodeName(node.id);
 };
-var PARENT_NAME_KEYS = {
-  VariableDeclarator: "id",
-  ObjectProperty: "key",
-  AssignmentExpression: "left"
-};
+var PARENT_NAME_READERS = /* @__PURE__ */ new Map([
+  ["VariableDeclarator", (parent) => parent.id],
+  ["ObjectProperty", (parent) => parent.key],
+  ["AssignmentExpression", (parent) => parent.left]
+]);
 var parentFunctionName = (parent) => {
-  const nameKey = parent ? PARENT_NAME_KEYS[parent.type] : void 0;
-  return nameKey ? nodeName(parent?.[nameKey]) : void 0;
+  const readName = parent ? PARENT_NAME_READERS.get(parent.type) : void 0;
+  return readName && parent ? nodeName(readName(parent)) : void 0;
 };
 var isConstructor = (node) => {
   return node.type === "ClassMethod" && node.kind === "constructor";
@@ -998,7 +1150,9 @@ var highComplexityRule = createFunctionStatementCountRule({
 
 // src/commands/high-complexity/high-complexity.command.ts
 var registerHighComplexityCommand = (program) => {
-  program.command("high-complexity").description("Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("high-complexity").description("Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [highComplexityRule], "Checking function complexity...", options)
   );
 };
@@ -1073,20 +1227,11 @@ var calleeName = (callee) => {
   return void 0;
 };
 var isDateNowOrGetTimeCall = (node) => {
-  if (node.type !== "CallExpression") {
-    return false;
-  }
   const callee = node.callee;
-  if (callee?.type !== "MemberExpression") {
-    return false;
-  }
-  const property = callee.property;
+  const property = callee?.property;
   const propertyName = property?.type === "Identifier" ? property.name : void 0;
-  if (propertyName === "getTime") {
-    return true;
-  }
-  const object = callee.object;
-  return object?.type === "Identifier" && object.name === "Date" && propertyName === "now";
+  const object = callee?.object;
+  return node.type === "CallExpression" && callee?.type === "MemberExpression" && (propertyName === "getTime" || object?.type === "Identifier" && object.name === "Date" && propertyName === "now");
 };
 var TIMESTAMP_NAME_PATTERN = /timestamp|^now$/i;
 var containsPredictableTimestamp = (node) => {
@@ -1157,7 +1302,9 @@ var insecureRandomTokenRule = {
 
 // src/commands/insecure-random-token/insecure-random-token.command.ts
 var registerInsecureRandomTokenCommand = (program) => {
-  program.command("insecure-random-token").description("Detecta o uso de Math.random() para gerar tokens/segredos previs\xEDveis").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("insecure-random-token").description("Detecta o uso de Math.random() para gerar tokens/segredos previs\xEDveis").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [insecureRandomTokenRule], "Checking insecure random tokens...", options)
   );
 };
@@ -1208,13 +1355,12 @@ var analyzeFile = (sourceFile) => {
     hasSignatureVerification: false
   };
   visitSourceNodes(sourceFile, (node) => {
-    if (isBase64DecodeCall(node) && node.loc) {
-      analysis.base64DecodeLines.push(node.loc.start.line);
-    } else if (isJsonParseCall(node)) {
-      analysis.hasJsonParse = true;
-    } else if (isSignatureVerificationCall(node)) {
-      analysis.hasSignatureVerification = true;
+    const base64DecodeLine = isBase64DecodeCall(node) ? node.loc?.start.line : void 0;
+    if (base64DecodeLine !== void 0) {
+      analysis.base64DecodeLines.push(base64DecodeLine);
     }
+    analysis.hasJsonParse ||= isJsonParseCall(node);
+    analysis.hasSignatureVerification ||= isSignatureVerificationCall(node);
   });
   return analysis;
 };
@@ -1242,14 +1388,13 @@ var jwtDecodeWithoutVerifyRule = {
 
 // src/commands/jwt-decode-without-verify/jwt-decode-without-verify.command.ts
 var registerJwtDecodeWithoutVerifyCommand = (program) => {
-  program.command("jwt-decode-without-verify").description("Detecta decodifica\xE7\xE3o manual de um token (base64 + JSON.parse) sem verificar a assinatura").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
-    await scanAndReport(
-      path,
-      [jwtDecodeWithoutVerifyRule],
-      "Checking JWT decode without verification...",
-      options
-    );
-  });
+  withScanOptions(
+    program.command("jwt-decode-without-verify").description(
+      "Detecta decodifica\xE7\xE3o manual de um token (base64 + JSON.parse) sem verificar a assinatura"
+    ).argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [jwtDecodeWithoutVerifyRule], "Checking JWT decode without verification...", options)
+  );
 };
 
 // src/rules/jwt-no-expiration.rule.ts
@@ -1301,7 +1446,9 @@ var jwtNoExpirationRule = {
 
 // src/commands/jwt-no-expiration/jwt-no-expiration.command.ts
 var registerJwtNoExpirationCommand = (program) => {
-  program.command("jwt-no-expiration").description("Detecta jwt.sign() sem expira\xE7\xE3o configurada").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("jwt-no-expiration").description("Detecta jwt.sign() sem expira\xE7\xE3o configurada").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [jwtNoExpirationRule], "Checking JWT expiration...", options)
   );
 };
@@ -1354,7 +1501,9 @@ var longFunctionRule = {
 
 // src/commands/long-functions/long-functions.command.ts
 var registerLongFunctionsCommand = (program) => {
-  program.command("long-functions").description("Detecta fun\xE7\xF5es com mais de 30 linhas").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("long-functions").description("Detecta fun\xE7\xF5es com mais de 30 linhas").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [longFunctionRule], "Checking function length...", options)
   );
 };
@@ -1386,7 +1535,9 @@ var noAnyRule = {
 
 // src/commands/no-any/no-any.command.ts
 var registerNoAnyCommand = (program) => {
-  program.command("no-any").description('Detecta o uso do tipo "any" no TypeScript').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("no-any").description('Detecta o uso do tipo "any" no TypeScript').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [noAnyRule], "Checking any usage...", options)
   );
 };
@@ -1434,7 +1585,9 @@ var noEvalRule = {
 
 // src/commands/no-eval/no-eval.command.ts
 var registerNoEvalCommand = (program) => {
-  program.command("no-eval").description("Detecta o uso de eval() ou new Function()").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("no-eval").description("Detecta o uso de eval() ou new Function()").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [noEvalRule], "Checking eval/new Function usage...", options)
   );
 };
@@ -1502,7 +1655,9 @@ var noHardcodedSecretRule = {
 
 // src/commands/no-hardcoded-secret/no-hardcoded-secret.command.ts
 var registerNoHardcodedSecretCommand = (program) => {
-  program.command("no-hardcoded-secret").description("Detecta segredos/credenciais hardcoded no c\xF3digo-fonte").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("no-hardcoded-secret").description("Detecta segredos/credenciais hardcoded no c\xF3digo-fonte").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [noHardcodedSecretRule], "Checking hardcoded secrets...", options)
   );
 };
@@ -1565,7 +1720,9 @@ var permissiveCorsRule = {
 
 // src/commands/permissive-cors/permissive-cors.command.ts
 var registerPermissiveCorsCommand = (program) => {
-  program.command("permissive-cors").description("Detecta CORS configurado para permitir qualquer origem").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("permissive-cors").description("Detecta CORS configurado para permitir qualquer origem").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [permissiveCorsRule], "Checking permissive CORS...", options)
   );
 };
@@ -1610,9 +1767,13 @@ var publicEnvVarSecretRule = {
 
 // src/commands/public-env-var-secret/public-env-var-secret.command.ts
 var registerPublicEnvVarSecretCommand = (program) => {
-  program.command("public-env-var-secret").description("Detecta uma vari\xE1vel de ambiente p\xFAblica (NEXT_PUBLIC_/VITE_/REACT_APP_) com nome de segredo").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
-    await scanAndReport(path, [publicEnvVarSecretRule], "Checking public env var secrets...", options);
-  });
+  withScanOptions(
+    program.command("public-env-var-secret").description(
+      "Detecta uma vari\xE1vel de ambiente p\xFAblica (NEXT_PUBLIC_/VITE_/REACT_APP_) com nome de segredo"
+    ).argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [publicEnvVarSecretRule], "Checking public env var secrets...", options)
+  );
 };
 
 // src/commands/rules/rules.command.ts
@@ -1760,15 +1921,15 @@ var chainReachesCatch = (thenCall, ancestors) => {
   let currentCall = thenCall;
   let i = 0;
   while (i < ancestors.length) {
-    const member = ancestors[i];
-    const nextCall = ancestors[i + 1];
-    const isChainMember = member?.type === "MemberExpression" && member.object === currentCall && isCallOf(nextCall, member);
+    const member = ancestors.at(i);
+    const nextCall = ancestors.at(i + 1);
+    const isChainMember = member !== void 0 && member.type === "MemberExpression" && member.object === currentCall && isCallOf(nextCall, member);
     const methodName = isChainMember ? memberPropertyName(member) : void 0;
     const continuesChain = methodName === "then" || methodName === "finally";
     if (methodName === "catch") {
       return true;
     }
-    if (!continuesChain) {
+    if (!nextCall || !continuesChain) {
       return false;
     }
     currentCall = nextCall;
@@ -1864,11 +2025,14 @@ var RULES = {
   "security/detect-new-buffer": "error"
 };
 var PLUGINS = { security: securityPlugin };
+var suppressionMarker = (ruleId) => `codesentry-disable-next-line ${ruleId}`;
+var isSuppressed = (contentLines, finding) => contentLines.at(finding.line - 2)?.includes(suppressionMarker(finding.ruleId)) ?? false;
 var securityLintRule = {
   id: "security-lint",
   description: "Detecta padr\xF5es de seguran\xE7a gen\xE9ricos (object injection, regex n\xE3o literal, fs n\xE3o literal, etc.) via eslint-plugin-security",
   check(filePath, content) {
-    return runEslintRules(filePath, content, RULES, PLUGINS).map((finding) => ({
+    const contentLines = content.split("\n");
+    return runEslintRules(filePath, content, RULES, PLUGINS).filter((finding) => !isSuppressed(contentLines, finding)).map((finding) => ({
       ruleId: finding.ruleId,
       message: `Padr\xE3o inseguro detectado (${finding.ruleId}): ${finding.message}`,
       file: filePath,
@@ -1906,14 +2070,9 @@ var propertyKeyName = (property) => {
 var argumentContainsSensitiveData = (argument) => {
   let found = false;
   visitSourceNodes(argument, (node) => {
-    if (node.type === "Identifier" && SENSITIVE_NAME_PATTERN2.test(node.name)) {
-      found = true;
-    } else if (node.type === "ObjectProperty") {
-      const keyName = propertyKeyName(node);
-      if (keyName && SENSITIVE_NAME_PATTERN2.test(keyName)) {
-        found = true;
-      }
-    }
+    const isSensitiveIdentifier = node.type === "Identifier" && SENSITIVE_NAME_PATTERN2.test(node.name);
+    const keyName = node.type === "ObjectProperty" ? propertyKeyName(node) : void 0;
+    found ||= isSensitiveIdentifier || keyName !== void 0 && SENSITIVE_NAME_PATTERN2.test(keyName);
   });
   return found;
 };
@@ -2113,6 +2272,40 @@ var unsafeSqlRule = {
   }
 };
 
+// src/rules/weak-cipher-mode.rule.ts
+var CIPHER_METHOD_NAMES = /* @__PURE__ */ new Set(["createCipheriv", "createDecipheriv"]);
+var WEAK_MODE_PATTERN = /-(cbc|ecb)$/i;
+var isWeakCipherModeCall = (node) => {
+  const callee = node.callee;
+  const property = callee?.property;
+  const args = node.arguments;
+  const algorithm = args?.[0];
+  return node.type === "CallExpression" && callee?.type === "MemberExpression" && property?.type === "Identifier" && CIPHER_METHOD_NAMES.has(property.name) && algorithm?.type === "StringLiteral" && WEAK_MODE_PATTERN.test(algorithm.value);
+};
+var findWeakCipherModeLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isWeakCipherModeCall(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var weakCipherModeRule = {
+  id: "weak-cipher-mode",
+  description: "Detecta cifragem em modo n\xE3o autenticado (CBC/ECB) sem AEAD/HMAC associado",
+  check(filePath, content) {
+    return findWeakCipherModeLines(filePath, content).map((line) => ({
+      ruleId: "weak-cipher-mode",
+      message: "Modo de cifra sem autentica\xE7\xE3o (CBC/ECB) \u2014 considere um modo AEAD como GCM",
+      file: filePath,
+      line,
+      severity: "high"
+    }));
+  }
+};
+
 // src/rules/weak-hash-algorithm.rule.ts
 var WEAK_ALGORITHMS = /^(md5|sha1)$/i;
 var isWeakCreateHashCall = (node) => {
@@ -2198,29 +2391,18 @@ var RULES2 = {
   "no-unsanitized/method": "error"
 };
 var PLUGINS2 = { "no-unsanitized": noUnsanitizedPlugin };
+var isHtmlProperty = (property) => {
+  const key = property.key;
+  return key?.type === "Identifier" && key.name === "__html";
+};
 var isDangerouslySetInnerHtmlWithDynamicValue = (node) => {
-  if (node.type !== "JSXAttribute") {
-    return false;
-  }
   const name = node.name;
-  if (name?.type !== "JSXIdentifier" || name.name !== "dangerouslySetInnerHTML") {
-    return false;
-  }
   const value = node.value;
-  if (value?.type !== "JSXExpressionContainer") {
-    return false;
-  }
-  const expression = value.expression;
-  if (expression?.type !== "ObjectExpression") {
-    return false;
-  }
-  const properties = expression.properties;
-  const htmlProperty = properties?.find((property) => {
-    const key = property.key;
-    return key?.type === "Identifier" && key.name === "__html";
-  });
+  const expression = value?.expression;
+  const properties = expression?.properties;
+  const htmlProperty = properties?.find(isHtmlProperty);
   const htmlValue = htmlProperty?.value;
-  return htmlValue !== void 0 && htmlValue.type !== "StringLiteral";
+  return node.type === "JSXAttribute" && name?.type === "JSXIdentifier" && name.name === "dangerouslySetInnerHTML" && value?.type === "JSXExpressionContainer" && expression?.type === "ObjectExpression" && htmlValue !== void 0 && htmlValue.type !== "StringLiteral";
 };
 var findDangerouslySetInnerHtmlFindings = (filePath, content) => {
   const findings = [];
@@ -2273,19 +2455,10 @@ var hasRiskyOptionEnabled = (options) => {
   }) ?? false;
 };
 var isUnsafeXmlParseCall = (node) => {
-  if (node.type !== "CallExpression") {
-    return false;
-  }
   const callee = node.callee;
-  if (callee?.type !== "MemberExpression") {
-    return false;
-  }
-  const property = callee.property;
-  if (property?.type !== "Identifier" || !XML_PARSE_METHOD_NAMES.has(property.name)) {
-    return false;
-  }
+  const property = callee?.property;
   const args = node.arguments;
-  return hasRiskyOptionEnabled(args?.[1]);
+  return node.type === "CallExpression" && callee?.type === "MemberExpression" && property?.type === "Identifier" && XML_PARSE_METHOD_NAMES.has(property.name) && hasRiskyOptionEnabled(args?.[1]);
 };
 var findUnsafeXmlParsingLines = (filePath, content) => {
   const lines = /* @__PURE__ */ new Set();
@@ -2342,7 +2515,9 @@ var allRules = [
   jwtDecodeWithoutVerifyRule,
   xxeUnsafeXmlParsingRule,
   sensitiveDataInLogsRule,
-  publicEnvVarSecretRule
+  publicEnvVarSecretRule,
+  weakCipherModeRule,
+  hardcodedAuthorizationValueRule
 ];
 
 // src/commands/rules/rules.command.ts
@@ -2372,70 +2547,90 @@ var parseLocalSemgrepConfig = (value) => {
   return resolve2(value);
 };
 var registerScanCommand = (program) => {
-  program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig).action(
+  withScanOptions(
+    program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig)
+  ).action(
     (path, options) => scanAndReport(path, allRules, "Scanning files...", { ...options, semgrep: true })
   );
 };
 
 // src/commands/security-lint/security-lint.command.ts
 var registerSecurityLintCommand = (program) => {
-  program.command("security-lint").description("Detecta padr\xF5es de seguran\xE7a gen\xE9ricos via eslint-plugin-security").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("security-lint").description("Detecta padr\xF5es de seguran\xE7a gen\xE9ricos via eslint-plugin-security").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [securityLintRule], "Checking generic security patterns...", options)
   );
 };
 
 // src/commands/sensitive-data-in-logs/sensitive-data-in-logs.command.ts
 var registerSensitiveDataInLogsCommand = (program) => {
-  program.command("sensitive-data-in-logs").description("Detecta senhas/segredos/tokens sendo passados para chamadas de log").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
-    await scanAndReport(path, [sensitiveDataInLogsRule], "Checking sensitive data in logs...", options);
-  });
+  withScanOptions(
+    program.command("sensitive-data-in-logs").description("Detecta senhas/segredos/tokens sendo passados para chamadas de log").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [sensitiveDataInLogsRule], "Checking sensitive data in logs...", options)
+  );
 };
 
 // src/commands/tls-validation-disabled/tls-validation-disabled.command.ts
 var registerTlsValidationDisabledCommand = (program) => {
-  program.command("tls-validation-disabled").description("Detecta a desativa\xE7\xE3o da valida\xE7\xE3o de certificados TLS").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("tls-validation-disabled").description("Detecta a desativa\xE7\xE3o da valida\xE7\xE3o de certificados TLS").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tlsValidationDisabledRule], "Checking TLS validation...", options)
   );
 };
 
 // src/commands/too-many-for-loops/too-many-for-loops.command.ts
 var registerTooManyForLoopsCommand = (program) => {
-  program.command("too-many-for-loops").description('Detecta fun\xE7\xF5es com muitos loops "for"/"for-in"/"for-of"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-for-loops").description('Detecta fun\xE7\xF5es com muitos loops "for"/"for-in"/"for-of"').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyForLoopsRule], "Checking for-loop count...", options)
   );
 };
 
 // src/commands/too-many-ifs/too-many-ifs.command.ts
 var registerTooManyIfsCommand = (program) => {
-  program.command("too-many-ifs").description('Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-ifs").description('Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyIfsRule], "Checking if count...", options)
   );
 };
 
 // src/commands/too-many-switch-cases/too-many-switch-cases.command.ts
 var registerTooManySwitchCasesCommand = (program) => {
-  program.command("too-many-switch-cases").description('Detecta "switch" com muitos "case" (considere um mapa/lookup)').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-switch-cases").description('Detecta "switch" com muitos "case" (considere um mapa/lookup)').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManySwitchCasesRule], "Checking switch cases...", options)
   );
 };
 
 // src/commands/too-many-try-catch/too-many-try-catch.command.ts
 var registerTooManyTryCatchCommand = (program) => {
-  program.command("too-many-try-catch").description('Detecta fun\xE7\xF5es com muitos blocos "try/catch"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-try-catch").description('Detecta fun\xE7\xF5es com muitos blocos "try/catch"').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyTryCatchRule], "Checking try/catch count...", options)
   );
 };
 
 // src/commands/too-many-while-loops/too-many-while-loops.command.ts
 var registerTooManyWhileLoopsCommand = (program) => {
-  program.command("too-many-while-loops").description('Detecta fun\xE7\xF5es com muitos loops "while"/"do-while"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("too-many-while-loops").description('Detecta fun\xE7\xF5es com muitos loops "while"/"do-while"').argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [tooManyWhileLoopsRule], "Checking while-loop count...", options)
   );
 };
 
 // src/commands/unhandled-promises/unhandled-promises.command.ts
 var registerUnhandledPromisesCommand = (program) => {
-  program.command("unhandled-promises").description("Detecta promises sem tratamento (sem .catch, await sem try/catch ou promises soltas)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("unhandled-promises").description("Detecta promises sem tratamento (sem .catch, await sem try/catch ou promises soltas)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(
       path,
       [promiseNoCatchRule, awaitNoTryCatchRule, floatingPromiseRule],
@@ -2447,39 +2642,58 @@ var registerUnhandledPromisesCommand = (program) => {
 
 // src/commands/unsafe-sql/unsafe-sql.command.ts
 var registerUnsafeSqlCommand = (program) => {
-  program.command("unsafe-sql").description("Detecta concatena\xE7\xE3o insegura de SQL (risco de SQL injection)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("unsafe-sql").description("Detecta concatena\xE7\xE3o insegura de SQL (risco de SQL injection)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [unsafeSqlRule], "Checking unsafe SQL...", options)
   );
 };
 
+// src/commands/weak-cipher-mode/weak-cipher-mode.command.ts
+var registerWeakCipherModeCommand = (program) => {
+  withScanOptions(
+    program.command("weak-cipher-mode").description("Detecta o uso de modos de cifra fracos (CBC, ECB) em createCipheriv/createDecipheriv").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [weakCipherModeRule], "Checking weak cipher modes...", options)
+  );
+};
+
 // src/commands/weak-hash-algorithm/weak-hash-algorithm.command.ts
 var registerWeakHashAlgorithmCommand = (program) => {
-  program.command("weak-hash-algorithm").description("Detecta o uso de algoritmos de hash fracos (MD5, SHA-1)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("weak-hash-algorithm").description("Detecta o uso de algoritmos de hash fracos (MD5, SHA-1)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [weakHashAlgorithmRule], "Checking weak hash algorithms...", options)
   );
 };
 
 // src/commands/weak-secret-fallback/weak-secret-fallback.command.ts
 var registerWeakSecretFallbackCommand = (program) => {
-  program.command("weak-secret-fallback").description(
-    "Detecta uma vari\xE1vel de ambiente de segredo/chave com um valor hardcoded como fallback (|| ou ??)"
-  ).argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
-    await scanAndReport(path, [weakSecretFallbackRule], "Checking weak secret fallbacks...", options);
-  });
+  withScanOptions(
+    program.command("weak-secret-fallback").description(
+      "Detecta uma vari\xE1vel de ambiente de segredo/chave com um valor hardcoded como fallback (|| ou ??)"
+    ).argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [weakSecretFallbackRule], "Checking weak secret fallbacks...", options)
+  );
 };
 
 // src/commands/xss/xss.command.ts
 var registerXssCommand = (program) => {
-  program.command("xss").description("Detecta sinks perigosos de XSS (innerHTML, document.write, etc.)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+  withScanOptions(
+    program.command("xss").description("Detecta sinks perigosos de XSS (innerHTML, document.write, etc.)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
     (path, options) => scanAndReport(path, [xssRule], "Checking XSS sinks...", options)
   );
 };
 
 // src/commands/xxe-unsafe-xml-parsing/xxe-unsafe-xml-parsing.command.ts
 var registerXxeUnsafeXmlParsingCommand = (program) => {
-  program.command("xxe-unsafe-xml-parsing").description("Detecta parsing de XML com noent/dtdload habilitados (risco de XXE)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
-    await scanAndReport(path, [xxeUnsafeXmlParsingRule], "Checking unsafe XML parsing...", options);
-  });
+  withScanOptions(
+    program.command("xxe-unsafe-xml-parsing").description("Detecta parsing de XML com noent/dtdload habilitados (risco de XXE)").argument("[path]", "diret\xF3rio a ser analisado", ".")
+  ).action(
+    (path, options) => scanAndReport(path, [xxeUnsafeXmlParsingRule], "Checking unsafe XML parsing...", options)
+  );
 };
 
 // src/cli.ts
@@ -2527,6 +2741,8 @@ var registerSecurityCommands = (program) => {
   registerXxeUnsafeXmlParsingCommand(program);
   registerSensitiveDataInLogsCommand(program);
   registerPublicEnvVarSecretCommand(program);
+  registerWeakCipherModeCommand(program);
+  registerHardcodedAuthorizationValueCommand(program);
 };
 var require5 = createRequire4(import.meta.url);
 var readPackageVersion = () => {