oauthlint 0.3.0 → 0.5.0

package/README.md

@@ -2,15 +2,16 @@
 
 # oauthlint
 
-**Catch the OAuth / OIDC / JWT anti-patterns AI coding tools systematically produce.**
+**Catch the OAuth / OIDC / JWT / session / CORS anti-patterns AI coding tools systematically produce.**
 
-A curated, multi-language Semgrep rule pack · JS/TS · Python · Go · Java · Rust (and growing) · CLI + GitHub Action + VS Code · free & MIT
+A curated, multi-language Semgrep rule pack · JS/TS · Python · Go · Java · Rust · CLI + GitHub Action + VS Code · free & MIT
 
 [![npm](https://img.shields.io/npm/v/oauthlint.svg)](https://www.npmjs.com/package/oauthlint)
 [![npm downloads](https://img.shields.io/npm/dm/oauthlint.svg)](https://www.npmjs.com/package/oauthlint)
 [![CI](https://github.com/Auspeo/oauthlint/actions/workflows/ci.yml/badge.svg)](https://github.com/Auspeo/oauthlint/actions/workflows/ci.yml)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![docs](https://img.shields.io/badge/docs-oauthlint.dev-2f6feb.svg)](https://oauthlint.dev)
+[![powered by Semgrep](https://img.shields.io/badge/powered%20by-Semgrep-0a7d6b.svg)](https://semgrep.dev)
 
 </div>
 
@@ -20,58 +21,10 @@ npx oauthlint scan ./src
 
 > Requires [Semgrep](https://semgrep.dev/docs/getting-started/) on the machine running the scan (`pipx install semgrep` or `brew install semgrep`). The CLI invokes it under the hood and normalises the output for humans and CI.
 
-📖 **Full documentation & rule catalogue → [oauthlint.dev](https://oauthlint.dev)**
+📖 **Full docs & rule catalogue → [oauthlint.dev/docs](https://oauthlint.dev/docs)** · 🔬 **the research behind it → [oauthlint.dev/research](https://oauthlint.dev/research)**
 
 ---
 
-## The problem
-
-LLM coding assistants — Cursor, Claude, GitHub Copilot, Gemini — ship the *same*
-OAuth/JWT mistakes across every project they touch:
-
-- a JWT verified with `alg: none` accepted
-- `client_secret` hard-coded in source
-- an OAuth flow with no `state` and no PKCE
-- a token written to `localStorage`, readable by any XSS
-- `redirect_uri` allow-listed with a `*` wildcard
-- a `/login` POST with no rate limiting
-- a password persisted in plaintext
-- `Math.random()` used for a CSRF token
-
-oauthlint is the layer between generic SAST and an enterprise IAM program:
-**free, focused, developer-first.** Every finding names the rule, the exact
-`file:line`, *why* it's dangerous, and *how* to fix it — with CWE/OWASP mappings.
-
-<div align="center">
-
-![oauthlint scanning a project and flagging JWT auth issues](https://raw.githubusercontent.com/Auspeo/oauthlint/main/docs/public/demo.gif)
-
-</div>
-
-## Why oauthlint, and not just Semgrep?
-
-Honest answer: nothing stops you from writing these rules yourself. Semgrep is
-open source — it's the engine we run — and a capable engineer could reproduce a
-lot of this. There's no technical moat and we won't pretend otherwise. What
-oauthlint gives you is the work most people never do:
-
-- **Low false positives, validated against real auth libraries.** The rules are
-  run against `jose`, NextAuth, PyJWT, Authlib, `golang/oauth2`, `oauth2-rs`,
-  Spring Security and more. Anything that fires on mature library source goes to
-  a triage queue, not to you — validated across thousands of files of real
-  auth-library source, with **zero false positives** on the clean libraries
-  ([validation report](https://oauthlint.dev/VALIDATION)).
-- **One coherent product across every language it covers.** Same concepts, same ID scheme,
-  same docs — not a patchwork of community rules with mismatched styles.
-- **Every finding teaches.** All 90 rules link to a fix page with CWE and OWASP
-  mappings. It's a lesson, not a grep hit.
-- **The angle the registry doesn't have:** oauthlint specifically targets the
-  auth bugs AI coding tools ship on repeat, encoded in each rule's
-  `llm-prevalence` metadata and measured by a [reproducible benchmark](https://github.com/Auspeo/oauthlint/tree/main/benchmark).
-
-Use oauthlint when you'd rather not write and maintain an auth rule pack
-yourself. That's the whole pitch.
-
 ## Quick start
 
 ```bash
@@ -81,162 +34,49 @@ npx oauthlint scan ./src
 # fail CI on HIGH severity and above
 npx oauthlint scan ./src --fail-on HIGH
 
-# machine-readable output
-npx oauthlint scan ./src --json
-
-# GitHub Code Scanning
+# GitHub Code Scanning (SARIF) or a shareable HTML audit report
 npx oauthlint scan ./src --format sarif > oauthlint.sarif
-
-# auto-apply safe fixes (e.g. cookie flags)
-npx oauthlint scan ./src --fix
-
-# scan several explicit paths (e.g. a list of changed files)
-npx oauthlint scan src/auth.ts src/session.ts
-
-# scan only what changed vs the default branch (fast, incremental)
-npx oauthlint scan --diff
-
-# scan only git-staged files (ideal in a pre-commit hook)
-npx oauthlint scan --staged
+npx oauthlint scan ./src --format html  > report.html
 ```
 
-## Incremental scanning
+Scan only what changed for fast pre-commit hooks and editors with `--diff` / `--staged`, or adopt on a large repo with a [baseline](https://oauthlint.dev/docs/baseline) (`oauthlint baseline ./src` then `scan --baseline`) so you're alerted on **new** findings only. Other commands: `list`, `init`, `doctor`. Run `oauthlint --help` or see the [full CLI reference](https://oauthlint.dev/docs/cli).
 
-For pre-commit hooks and editor integrations, scanning the whole tree on every
-keystroke is wasteful. OAuthLint can scan **only the files that changed**:
-
-```bash
-# files changed vs the merge-base with the repo's default branch
-oauthlint scan --diff
-
-# files changed vs an explicit ref (branch, tag, or commit)
-oauthlint scan --diff origin/main
-oauthlint scan --diff HEAD~5
+## What it catches
 
-# only git-staged files — drop this in a pre-commit hook
-oauthlint scan --staged --fail-on HIGH
-```
+LLM coding assistants — Cursor, Claude, Copilot, Gemini — ship the *same* auth bugs across every project: a JWT accepted with `alg: none`, a hard-coded `client_secret`, an OAuth flow with no `state`/PKCE, a token in `localStorage`, a `*` wildcard `redirect_uri`, an unrate-limited `/login`, a plaintext password, `Math.random()` for a CSRF token.
 
-How the change set is resolved:
+- **100+ rules** across **JS/TS · Python · Go · Java · Rust**, each mapped to CWE/OWASP with a fix page — a lesson, not a grep hit.
+- **Dataflow (taint) analysis** — beyond pattern-matching, the pack traces untrusted input through to dangerous sinks to catch **open-redirect** and **SSRF**.
+- **HTML report** — `scan --format html` renders a self-contained, offline, no-JavaScript audit you can email or attach to a PR.
+- Plus **SARIF** for Code Scanning, `--fix` for safe auto-fixes, incremental `--diff`/`--staged`, and a [baseline](https://oauthlint.dev/docs/baseline) for existing codebases.
 
-- **`--diff [ref]`** — when no `ref` is given, the base is the merge-base with the
-  repo's default branch (`origin/HEAD` → `origin/main` → `origin/master`, falling
-  back to `HEAD` when there's no remote). The change set is everything Added /
-  Copied / Modified / Renamed since that base, plus uncommitted work-tree and
-  staged changes, plus new untracked files. Deleted files are skipped.
-- **`--staged`** — only the staged set (`git diff --cached`), the same files a
-  commit is about to capture.
-- Explicit path args (`oauthlint scan a.ts b.ts`) scan exactly those paths.
+👉 **Browse the always-current catalogue at [oauthlint.dev/rules](https://oauthlint.dev/rules/).**
 
-In every mode, files in a language the rule pack doesn't cover (Markdown,
-lockfiles, images, …) are filtered out automatically, and an **empty change set
-exits `0`** with a `No changed files to scan.` note — it never fails your commit.
-Outside a git repository, `--diff` / `--staged` print a clear error and exit `2`
-instead of crashing. Git is always invoked with arguments passed as an array
-(never a shell string), so a ref name can't inject a shell command.
+## Use directly with Semgrep — no install
 
-Example pre-commit hook (`.git/hooks/pre-commit`):
+Already have [Semgrep](https://semgrep.dev)? Run the full pack with one command, no config file:
 
 ```bash
-#!/bin/sh
-npx oauthlint scan --staged --fail-on HIGH
+semgrep --config https://oauthlint.dev/r/oauthlint.yaml ./src
 ```
 
-## Commands
+Per-language bundles exist too (`oauthlint-python.yaml`, `oauthlint-go.yaml`, …). That URL is always the latest pack; for a pinned ruleset in CI, use this CLI (`npx oauthlint@<version> scan`) or vendor [`oauthlint-rules`](https://www.npmjs.com/package/oauthlint-rules). See [the Semgrep docs](https://oauthlint.dev/docs/semgrep).
 
-```
-oauthlint scan [paths...]       Scan files/directories (default: current dir)
-oauthlint scan a.ts b.ts        Scan an explicit list of paths
-oauthlint scan --diff [ref]     Scan only files changed vs a git ref
-oauthlint scan --staged         Scan only git-staged files (pre-commit)
-oauthlint scan --json           Emit machine-readable JSON
-oauthlint scan --format sarif   Emit SARIF for GitHub Code Scanning
-oauthlint scan --severity HIGH  Only show findings ≥ HIGH
-oauthlint scan --fail-on off    Never fail the build (CI dry-run)
-oauthlint scan --fix            Auto-apply safe fixes
-oauthlint list                  List every shipped rule
-oauthlint list --json           Same, as JSON
-oauthlint init                  Generate .oauthlintrc.yml at cwd
-oauthlint init --force          Overwrite an existing config
-oauthlint doctor                Check your setup (Semgrep, config, …)
-```
-
-## Use it in CI
-
-Run the CLI in a workflow and upload SARIF to **GitHub Code Scanning** so
-findings appear inline on the PR:
-
-```yaml
-# .github/workflows/oauthlint.yml
-jobs:
-  oauthlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: pipx install semgrep          # the engine oauthlint runs
-      - run: npx oauthlint scan ./src --format sarif > oauthlint.sarif
-      - uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: oauthlint.sarif
-```
-
-Or just fail the build on HIGH findings: `npx oauthlint scan ./src --fail-on HIGH`.
-
-> A dedicated **GitHub Action** and a **VS Code extension** (inline diagnostics +
-> Quick Fix suppressions) are on the way — follow the [repo](https://github.com/Auspeo/oauthlint) for releases.
-
-## What it catches
-
-Rules across OAuth 2.0, OIDC, JWT, cookies, CORS, secrets and session hygiene —
-each mapped to CWE & OWASP, each with a documentation page. Languages covered
-today (more on the way):
-
-| Language | Libraries |
-|----------|-----------|
-| JavaScript / TypeScript | jose, jsonwebtoken, NextAuth, express, … |
-| Python | PyJWT, Authlib, requests, Flask, Django |
-| Java | Spring Security, jjwt, nimbus-jose-jwt |
-| Go | golang-jwt, crypto/tls, net/http |
-| Rust | jsonwebtoken, reqwest, actix/tower |
-
-👉 **Browse the full, always-current catalogue at [oauthlint.dev/rules](https://oauthlint.dev/rules/).**
-
-## Configuration
-
-Generate a `.oauthlintrc.yml` at your repo root with `oauthlint init`:
-
-```yaml
-version: 1
-include:
-  - "src/**/*.{ts,tsx,js,jsx}"
-exclude:
-  - "**/*.test.ts"
-rules:
-  auth.cookie.no-samesite: warn
-  auth.session.id-in-url: off
-failOn: HIGH
-```
+## Why oauthlint, and not just Semgrep?
 
-### Inline suppression
+Honest answer: nothing stops you writing these rules yourself — Semgrep is open source and it's the engine we run. There's no technical moat. What oauthlint gives you is the work most people never do:
 
-```ts
-// oauthlint-disable-next-line auth.jwt.alg-none -- legacy code, replaced in Q2
-return jwt.verify(token, key, { algorithms: ['RS256', 'none'] });
-```
+- **Low false positives, validated against real auth libraries** — `jose`, NextAuth, PyJWT, Authlib, `golang/oauth2`, `oauth2-rs`, Spring Security and more. Anything that fires on mature library source goes to a triage queue, not to you ([validation report](https://oauthlint.dev/VALIDATION)).
+- **One coherent product across every language** — same concepts, same ID scheme, same docs; not a patchwork of community rules.
+- **The angle the registry doesn't have** — it targets the auth bugs AI tools ship on repeat, encoded in each rule's `llm-prevalence` metadata and measured by a reproducible benchmark ([the research](https://oauthlint.dev/research)).
 
-Wholesale silencing (`oauthlint-disable-file *`) is intentionally unsupported —
-the next reviewer needs to see exactly which lines opted out, and why.
+Use oauthlint when you'd rather not write and maintain an auth rule pack yourself. That's the whole pitch.
 
-## Exit codes
+## Also available
 
-| Code | When |
-|:----:|------|
-| `0` | No finding at or above the `--fail-on` threshold |
-| `1` | At least one **HIGH** finding |
-| `2` | At least one **CRITICAL** finding, or a scan whose output could not be parsed (it never silently exits clean) |
-| `127` | Semgrep is not installed |
+- **GitHub Action** — `Auspeo/oauthlint/action@v1`, Docker-based (any language), with inline PR annotations + a job summary. [Docs](https://github.com/Auspeo/oauthlint/tree/main/action).
+- **VS Code / Cursor / Windsurf** — [oauthlint](https://marketplace.visualstudio.com/items?itemName=auspeo.oauthlint-vscode) on the VS Code Marketplace and [OpenVSX](https://open-vsx.org/extension/auspeo/oauthlint-vscode): inline diagnostics on save, a status-bar finding count, and Quick Fix suppressions.
 
 ## License
 
-MIT — see [LICENSE](https://github.com/Auspeo/oauthlint/blob/main/LICENSE).
-Built and maintained by [Auspeo](https://github.com/Auspeo).
+MIT — see [LICENSE](https://github.com/Auspeo/oauthlint/blob/main/LICENSE). Built and maintained by [Auspeo](https://github.com/Auspeo).

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoDpC,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAuErD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyEpC,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CA2HrD"}

package/dist/cli.js

@@ -3,10 +3,12 @@ import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Command } from 'commander';
 import pc from 'picocolors';
+import { runBaseline } from './commands/baseline.js';
 import { runDoctor } from './commands/doctor.js';
 import { runInit } from './commands/init.js';
 import { runList } from './commands/list.js';
 import { runScan } from './commands/scan.js';
+import { maybeNotifyUpdate } from './core/update-notifier.js';
 import { SEVERITIES } from './types.js';
 /**
  * Exit only once buffered stdout/stderr have drained.
@@ -28,6 +30,21 @@ async function exitAfterFlush(code) {
     await Promise.all([flush(process.stdout), flush(process.stderr)]);
     process.exit(code);
 }
+/**
+ * Print the "update available" notice (when allowed) AFTER the command's normal
+ * output, then exit once everything is flushed. The notifier is fire-and-forget
+ * and self-suppressing: it never blocks, never touches stdout, and is silent
+ * under `--json`/`--format sarif`, in CI, when piped, when `NO_UPDATE_NOTIFIER`
+ * is set, or when `--no-update-check` is passed.
+ */
+async function finishWithNotice(code, ctx) {
+    await maybeNotifyUpdate({
+        currentVersion: ctx.version,
+        machineReadable: ctx.machineReadable,
+        disabled: !ctx.updateCheck,
+    });
+    return exitAfterFlush(code);
+}
 async function readPackageVersion() {
     const here = dirname(fileURLToPath(import.meta.url));
     // dist/cli.js → ../package.json (when published)
@@ -53,19 +70,24 @@ export async function buildProgram() {
     program
         .name('oauthlint')
         .description('OAuthLint — catch the OAuth/OIDC/JWT anti-patterns AI coding tools systematically produce.')
-        .version(version, '-v, --version');
+        .version(version, '-v, --version')
+        .option('--no-update-check', 'Do not check npm for a newer oauthlint version');
+    // Resolve the global update-check opt-out once, lazily, from the root program.
+    // Commander sets `updateCheck: false` when `--no-update-check` is given.
+    const updateCheckEnabled = () => program.opts().updateCheck !== false;
     program
         .command('scan')
         .argument('[paths...]', 'One or more files/directories to scan', ['.'])
         .description('Scan files or directories for auth misconfigurations')
         .option('--json', 'Emit JSON (shortcut for --format json)')
-        .option('--format <fmt>', 'Output format: pretty | json | sarif', parseFormat)
+        .option('--format <fmt>', 'Output format: pretty | json | sarif | html', parseFormat)
         .option('--severity <level>', 'Only emit findings ≥ this severity', parseSeverity)
         .option('--fail-on <level>', 'Process exits non-zero if any finding ≥ this severity', parseFailOn)
         .option('--diff [ref]', 'Scan only files changed vs a git ref (default: merge-base with the default branch)')
         .option('--staged', 'Scan only git-staged files (useful for pre-commit hooks)')
         .option('--rules-dir <path>', 'Override the bundled rules directory')
         .option('--fix', 'Apply auto-fixes (rewrites source in place where possible)')
+        .option('--baseline [file]', 'Suppress findings already in a baseline file; report only NEW findings (default: .oauthlint-baseline.json)')
         .action(async (paths, opts) => {
         const code = await runScan({
             paths,
@@ -77,29 +99,68 @@ export async function buildProgram() {
             failOn: opts.failOn,
             rulesDir: opts.rulesDir,
             fix: opts.fix,
+            baseline: opts.baseline,
+        });
+        const machineReadable = opts.json === true ||
+            opts.format === 'json' ||
+            opts.format === 'sarif' ||
+            opts.format === 'html';
+        await finishWithNotice(code, { version, machineReadable, updateCheck: updateCheckEnabled() });
+    });
+    program
+        .command('baseline')
+        .argument('[paths...]', 'One or more files/directories to scan', ['.'])
+        .description('Scan and write a baseline of current findings (for adopting on an existing codebase)')
+        .option('-o, --output <file>', 'Where to write the baseline JSON', '.oauthlint-baseline.json')
+        .option('--rules-dir <path>', 'Override the bundled rules directory')
+        .action(async (paths, opts) => {
+        const code = await runBaseline({
+            paths,
+            output: opts.output,
+            rulesDir: opts.rulesDir,
+        });
+        // baseline writes a JSON file but its stdout is a human summary.
+        await finishWithNotice(code, {
+            version,
+            machineReadable: false,
+            updateCheck: updateCheckEnabled(),
         });
-        await exitAfterFlush(code);
     });
     program
         .command('list')
         .description('List every rule the current install ships with')
         .option('--json', 'Emit JSON instead of pretty output')
         .action(async (opts) => {
-        await exitAfterFlush(await runList({ json: opts.json }));
+        const code = await runList({ json: opts.json });
+        await finishWithNotice(code, {
+            version,
+            machineReadable: opts.json === true,
+            updateCheck: updateCheckEnabled(),
+        });
     });
     program
         .command('init')
         .description('Generate a .oauthlintrc.yml at the current directory')
         .option('-f, --force', 'Overwrite an existing config file')
         .action(async (opts) => {
-        await exitAfterFlush(await runInit({ cwd: process.cwd(), force: opts.force }));
+        const code = await runInit({ cwd: process.cwd(), force: opts.force });
+        await finishWithNotice(code, {
+            version,
+            machineReadable: false,
+            updateCheck: updateCheckEnabled(),
+        });
     });
     program
         .command('doctor')
         .description('Diagnose your OAuthLint install (Node, Semgrep, rule pack)')
         .option('--json', 'Emit JSON instead of pretty output')
         .action(async (opts) => {
-        await exitAfterFlush(await runDoctor({ json: opts.json }));
+        const code = await runDoctor({ json: opts.json });
+        await finishWithNotice(code, {
+            version,
+            machineReadable: opts.json === true,
+            updateCheck: updateCheckEnabled(),
+        });
     });
     program.showHelpAfterError(pc.dim('(run `oauthlint --help` for available commands)'));
     return program;
@@ -116,7 +177,7 @@ function parseFailOn(v) {
         return 'off';
     return parseSeverity(v);
 }
-const FORMATS = ['pretty', 'json', 'sarif'];
+const FORMATS = ['pretty', 'json', 'sarif', 'html'];
 function parseFormat(v) {
     const lower = v.toLowerCase();
     if (!FORMATS.includes(lower)) {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAmB,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAM3D;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAiB,EAAE,CACrD,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,EAAE,CAAC;YACN,OAAO;QACT,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,iDAAiD;IACjD,8DAA8D;IAC9D,KAAK,MAAM,SAAS,IAAI;QACtB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QACnC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;KAC1C,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAY,CAAC;YACrE,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE3C,OAAO;SACJ,IAAI,CAAC,WAAW,CAAC;SACjB,WAAW,CACV,4FAA4F,CAC7F;SACA,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAErC,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,YAAY,EAAE,uCAAuC,EAAE,CAAC,GAAG,CAAC,CAAC;SACtE,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,WAAW,CAAC;SAC7E,MAAM,CAAC,oBAAoB,EAAE,oCAAoC,EAAE,aAAa,CAAC;SACjF,MAAM,CACL,mBAAmB,EACnB,uDAAuD,EACvD,WAAW,CACZ;SACA,MAAM,CACL,cAAc,EACd,oFAAoF,CACrF;SACA,MAAM,CAAC,UAAU,EAAE,0DAA0D,CAAC;SAC9E,MAAM,CAAC,oBAAoB,EAAE,sCAAsC,CAAC;SACpE,MAAM,CAAC,OAAO,EAAE,4DAA4D,CAAC;SAC7E,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,IAAoB,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,MAAM,cAAc,CAAC,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,aAAa,EAAE,mCAAmC,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,MAAM,cAAc,CAAC,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,MAAM,cAAc,CAAC,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC;AACjB,CAAC;AAcD,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAkB,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AACrD,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAgB,CAAC;IAC5C,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAmB,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAM3D;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAiB,EAAE,CACrD,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,EAAE,CAAC;YACN,OAAO;QACT,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,GAAwE;IAExE,MAAM,iBAAiB,CAAC;QACtB,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,QAAQ,EAAE,CAAC,GAAG,CAAC,WAAW;KAC3B,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,iDAAiD;IACjD,8DAA8D;IAC9D,KAAK,MAAM,SAAS,IAAI;QACtB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QACnC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;KAC1C,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAY,CAAC;YACrE,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE3C,OAAO;SACJ,IAAI,CAAC,WAAW,CAAC;SACjB,WAAW,CACV,4FAA4F,CAC7F;SACA,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;IAEjF,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC;IAE/E,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,YAAY,EAAE,uCAAuC,EAAE,CAAC,GAAG,CAAC,CAAC;SACtE,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,WAAW,CAAC;SACpF,MAAM,CAAC,oBAAoB,EAAE,oCAAoC,EAAE,aAAa,CAAC;SACjF,MAAM,CACL,mBAAmB,EACnB,uDAAuD,EACvD,WAAW,CACZ;SACA,MAAM,CACL,cAAc,EACd,oFAAoF,CACrF;SACA,MAAM,CAAC,UAAU,EAAE,0DAA0D,CAAC;SAC9E,MAAM,CAAC,oBAAoB,EAAE,sCAAsC,CAAC;SACpE,MAAM,CAAC,OAAO,EAAE,4DAA4D,CAAC;SAC7E,MAAM,CACL,mBAAmB,EACnB,4GAA4G,CAC7G;SACA,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,IAAoB,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,eAAe,GACnB,IAAI,CAAC,IAAI,KAAK,IAAI;YAClB,IAAI,CAAC,MAAM,KAAK,MAAM;YACtB,IAAI,CAAC,MAAM,KAAK,OAAO;YACvB,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QACzB,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,QAAQ,CAAC,YAAY,EAAE,uCAAuC,EAAE,CAAC,GAAG,CAAC,CAAC;SACtE,WAAW,CACV,sFAAsF,CACvF;SACA,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,EAAE,0BAA0B,CAAC;SAC7F,MAAM,CAAC,oBAAoB,EAAE,sCAAsC,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,IAAwB,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;YAC7B,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,iEAAiE;QACjE,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YACnC,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,aAAa,EAAE,mCAAmC,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YACnC,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC;AACjB,CAAC;AAsBD,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAkB,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAC7D,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAgB,CAAC;IAC5C,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/baseline.d.ts

@@ -0,0 +1,21 @@
+import { SemgrepAdapter } from '../adapters/semgrep.js';
+export interface BaselineCommandOptions {
+    /** Path(s) to scan when capturing the baseline. Defaults to `['.']`. */
+    paths?: string[];
+    /** Where to write the baseline JSON. Defaults to `.oauthlint-baseline.json`. */
+    output?: string;
+    rulesDir?: string;
+    /** Used by tests to inject a mock adapter. */
+    adapter?: SemgrepAdapter;
+    /** Used by tests to capture output. */
+    stream?: NodeJS.WritableStream;
+    /** Override the directory git/relative paths resolve from (defaults to cwd). */
+    cwd?: string;
+}
+/**
+ * `oauthlint baseline [paths...]` — scan the codebase and write a baseline file
+ * capturing the CURRENT findings by stable fingerprint, so a later
+ * `scan --baseline` only surfaces NEW findings.
+ */
+export declare function runBaseline(opts: BaselineCommandOptions): Promise<number>;
+//# sourceMappingURL=baseline.d.ts.map

package/dist/commands/baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../../src/commands/baseline.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,cAAc,EAGf,MAAM,wBAAwB,CAAC;AAMhC,MAAM,WAAW,sBAAsB;IACrC,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E"}

package/dist/commands/baseline.js

@@ -0,0 +1,50 @@
+import { writeFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { RULES_ROOT } from 'oauthlint-rules';
+import pc from 'picocolors';
+import { SemgrepAdapter, SemgrepNotInstalledError, SemgrepOutputError, } from '../adapters/semgrep.js';
+import { DEFAULT_BASELINE_FILE, buildBaseline, serialiseBaseline } from '../core/baseline.js';
+import { loadConfig } from '../core/config.js';
+import { applySuppressions } from '../core/suppress.js';
+/**
+ * `oauthlint baseline [paths...]` — scan the codebase and write a baseline file
+ * capturing the CURRENT findings by stable fingerprint, so a later
+ * `scan --baseline` only surfaces NEW findings.
+ */
+export async function runBaseline(opts) {
+    const cwd = opts.cwd ?? process.cwd();
+    const config = await loadConfig(cwd);
+    const rulesDir = opts.rulesDir ?? config.customRulesDir ?? RULES_ROOT;
+    const stream = opts.stream ?? process.stdout;
+    const errStream = opts.stream ?? process.stderr;
+    const requested = opts.paths?.length ? opts.paths : ['.'];
+    const targets = requested.map((p) => resolve(cwd, p));
+    const adapter = opts.adapter ?? new SemgrepAdapter({ configPath: rulesDir });
+    let result;
+    try {
+        result = await adapter.scan(targets);
+    }
+    catch (err) {
+        if (err instanceof SemgrepNotInstalledError) {
+            errStream.write(`${err.message}\n`);
+            return 127;
+        }
+        if (err instanceof SemgrepOutputError) {
+            errStream.write(`${err.message}\n`);
+            return 2;
+        }
+        throw err;
+    }
+    // Honour inline suppression directives so the baseline mirrors what `scan`
+    // would actually report (we don't want to baseline already-suppressed noise).
+    const { kept } = await applySuppressions(result.findings);
+    const findings = kept;
+    const outputPath = resolve(cwd, opts.output ?? DEFAULT_BASELINE_FILE);
+    const baseline = await buildBaseline(findings, cwd);
+    await writeFile(outputPath, serialiseBaseline(baseline), 'utf8');
+    const n = baseline.findings.length;
+    stream.write(pc.green(`✓ Baselined ${n} finding${n === 1 ? '' : 's'} → ${opts.output ?? DEFAULT_BASELINE_FILE}\n`));
+    stream.write(pc.dim(`Future runs of ${pc.bold('oauthlint scan --baseline')} will report only NEW findings.\n`));
+    return 0;
+}
+//# sourceMappingURL=baseline.js.map

package/dist/commands/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../src/commands/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAiBxD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAEhD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAmD,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACpC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACpC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAc,IAAI,CAAC;IAEjC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAEjE,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnC,MAAM,CAAC,KAAK,CACV,EAAE,CAAC,KAAK,CACN,eAAe,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,IAAI,qBAAqB,IAAI,CAC5F,CACF,CAAC;IACF,MAAM,CAAC,KAAK,CACV,EAAE,CAAC,GAAG,CACJ,kBAAkB,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,mCAAmC,CAC1F,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/scan.d.ts

@@ -1,6 +1,6 @@
 import { SemgrepAdapter } from '../adapters/semgrep.js';
 import type { SeverityName } from '../types.js';
-export type ScanFormat = 'pretty' | 'json' | 'sarif';
+export type ScanFormat = 'pretty' | 'json' | 'sarif' | 'html';
 export interface ScanCommandOptions {
     /**
      * Path(s) to scan. Accepts one or many — e.g. a pre-commit hook or editor
@@ -30,6 +30,13 @@ export interface ScanCommandOptions {
      * ship a `fix:` template. Currently the cookie-* rules.
      */
     fix?: boolean;
+    /**
+     * Suppress findings already captured in a baseline file, reporting only NEW
+     * findings. A bare `true` uses the default `.oauthlint-baseline.json`; a
+     * string is treated as an explicit baseline path. A missing file is a clear
+     * error, never silently an empty allow-list.
+     */
+    baseline?: string | boolean;
     /** Used by tests to inject a mock adapter. */
     adapter?: SemgrepAdapter;
     /** Used by tests to capture output. */

package/dist/commands/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EAGf,MAAM,wBAAwB,CAAC;AAOhC,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,GAAG,KAAK,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,8CAA8C;IAC9C,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoHvE"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EAGf,MAAM,wBAAwB,CAAC;AAehC,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,GAAG,KAAK,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkLvE"}

package/dist/commands/scan.js

@@ -1,12 +1,14 @@
 import { resolve } from 'node:path';
 import { RULES_ROOT } from 'oauthlint-rules';
 import { SemgrepAdapter, SemgrepNotInstalledError, SemgrepOutputError, } from '../adapters/semgrep.js';
+import { BaselineNotFoundError, BaselineParseError, DEFAULT_BASELINE_FILE, loadBaseline, partitionByBaseline, } from '../core/baseline.js';
 import { GitError, resolveDiffFiles, resolveStagedFiles } from '../core/changed-files.js';
 import { loadConfig } from '../core/config.js';
 import { Reporter } from '../core/reporter.js';
 import { toSarif } from '../core/sarif.js';
 import { exitCodeFor, highestSeverity, meetsThreshold } from '../core/severity.js';
 import { applySuppressions } from '../core/suppress.js';
+import { renderHtmlReport } from '../formatters/html.js';
 export async function runScan(opts) {
     const cwd = opts.cwd ?? process.cwd();
     const config = await loadConfig(cwd);
@@ -15,6 +17,22 @@ export async function runScan(opts) {
     const format = opts.format ?? (opts.json ? 'json' : 'pretty');
     const stream = opts.stream ?? process.stdout;
     const errStream = opts.stream ?? process.stderr;
+    // Load the baseline up front so a missing/malformed file fails fast — before
+    // we pay for a full scan — with a clear error rather than a silent no-op.
+    let baseline = null;
+    if (opts.baseline !== undefined && opts.baseline !== false) {
+        const baselinePath = resolve(cwd, typeof opts.baseline === 'string' ? opts.baseline : DEFAULT_BASELINE_FILE);
+        try {
+            baseline = await loadBaseline(baselinePath);
+        }
+        catch (err) {
+            if (err instanceof BaselineNotFoundError || err instanceof BaselineParseError) {
+                errStream.write(`${err.message}\n`);
+                return 2;
+            }
+            throw err;
+        }
+    }
     // Resolve the set of targets to hand Semgrep. Incremental flags (--diff /
     // --staged) win and narrow the scan to changed files only; otherwise we scan
     // the explicit path args (default ['.']).
@@ -63,6 +81,11 @@ export async function runScan(opts) {
             });
             stream.write(`${JSON.stringify(empty, null, 2)}\n`);
         }
+        else if (format === 'html') {
+            const html = await renderHtmlReport({ findings: [], scannedFiles: 0, durationMs: 0, semgrepVersion: null, errors: [] }, { target: 'changed files (none)' });
+            stream.write(html);
+            errStream.write('No changed files to scan.\n');
+        }
         else {
             stream.write('No changed files to scan.\n');
         }
@@ -99,10 +122,31 @@ export async function runScan(opts) {
     if (minSeverity) {
         findings = findings.filter((f) => meetsThreshold(f.severity, minSeverity));
     }
+    // Baseline suppression: drop findings whose fingerprint is already recorded,
+    // so only genuinely NEW findings are reported and gate the exit code.
+    let baselinedCount = 0;
+    if (baseline) {
+        const { newFindings, baselined } = await partitionByBaseline(findings, baseline, cwd);
+        findings = newFindings;
+        baselinedCount = baselined.length;
+    }
     if (format === 'sarif') {
         const sarif = await toSarif({ ...result, findings });
         stream.write(`${JSON.stringify(sarif, null, 2)}\n`);
     }
+    else if (format === 'html') {
+        // HTML is the report artifact → stdout only. Any human chatter (e.g. the
+        // update notice, suppression counts) stays on stderr so the document is
+        // never corrupted and `> report.html` is always valid.
+        const html = await renderHtmlReport({ ...result, findings }, { target: label });
+        stream.write(html);
+        if (suppressed.length > 0) {
+            errStream.write(`ℹ ${suppressed.length} finding${suppressed.length === 1 ? '' : 's'} suppressed via inline directives.\n`);
+        }
+        if (baselinedCount > 0) {
+            errStream.write(`ℹ ${baselinedCount} finding${baselinedCount === 1 ? '' : 's'} already in the baseline (reporting NEW findings only).\n`);
+        }
+    }
     else {
         reporter.reportResult({ ...result, findings });
         if (opts.fix && format === 'pretty') {
@@ -112,6 +156,9 @@ export async function runScan(opts) {
         if (suppressed.length > 0 && format === 'pretty') {
             stream.write(`\nℹ ${suppressed.length} finding${suppressed.length === 1 ? '' : 's'} suppressed via inline directives.\n`);
         }
+        if (baselinedCount > 0 && format === 'pretty') {
+            stream.write(`\nℹ ${baselinedCount} finding${baselinedCount === 1 ? '' : 's'} already in the baseline (reporting NEW findings only).\n`);
+        }
     }
     if (failOn === 'off')
         return 0;