seaworthycode 1.2.6 → 1.2.7

package/dist/index.js

@@ -64,7 +64,7 @@ import { createHash as createHash5, randomBytes } from "crypto";
 import * as fs8 from "fs";
 import { join as join11 } from "path";
 import { createHash as createHash6 } from "crypto";
-import { Query as TSQuery2 } from "web-tree-sitter";
+import { Parser as TSParser, Query as TSQuery2 } from "web-tree-sitter";
 import { readFileSync as readFileSync4, readdirSync, existsSync as existsSync4 } from "fs";
 import { dirname as dirname3, resolve as pathResolve3 } from "path";
 import { parse as parseYaml } from "yaml";
@@ -1497,7 +1497,10 @@ var copy = {
   "remediation.resilience.orm-n-plus-one": "Replace per-row queries inside loops with a single batch query using include/eager loading (Prisma include, Sequelize eager loading, SQLAlchemy joinedload, ActiveRecord includes).",
   // Reporting labels
   "reporting.analysisType.pattern": "pattern",
-  "reporting.analysisType.semantic": "semantic"
+  "reporting.analysisType.semantic": "semantic",
+  // Collapsed low/info finding groups
+  "reporting.collapsed.summary": (count, files) => `${count} findings across ${files} ${files === 1 ? "file" : "files"}`,
+  "reporting.collapsed.hint": "Run with --all to list each finding, or --output report.html for full detail."
 };
 function getCopy(key, ...args) {
   const value = copy[key];
@@ -1613,7 +1616,8 @@ var ScanRunner = class {
       files,
       meta,
       taintCache: /* @__PURE__ */ new Map(),
-      astCache: /* @__PURE__ */ new Map()
+      astCache: /* @__PURE__ */ new Map(),
+      bashAstCache: /* @__PURE__ */ new Map()
     };
     const results = [];
     const checkResults = /* @__PURE__ */ new Map();
@@ -1646,18 +1650,15 @@ var ScanRunner = class {
         }
       }
     }
-    if (ctx.astCache) {
-      for (const promise of ctx.astCache.values()) {
-        try {
-          const { tree } = await promise;
-          if (tree) {
-            tree.delete();
-          }
-        } catch {
-        }
+    ctx.astCache?.clear();
+    for (const [, promise] of ctx.bashAstCache ?? []) {
+      try {
+        const parsed = await promise;
+        parsed.tree.delete();
+      } catch {
       }
-      ctx.astCache.clear();
     }
+    ctx.bashAstCache?.clear();
     let findings = sortFindings(
       dedupeDegradedFindings(dedupeCrossCheck(dedupeFindings(results)))
     );
@@ -2427,6 +2428,7 @@ var text = {
   success: (s) => source_default.hex(tokens.success)(s)
 };
 var SEVERITY_ORDER2 = ["critical", "high", "medium", "low", "info"];
+var COLLAPSIBLE_SEVERITIES = /* @__PURE__ */ new Set(["low", "info"]);
 function checkNameOf(checkId) {
   const short = checkId.replace(/^[^.]+\./, "");
   try {
@@ -2435,9 +2437,49 @@ function checkNameOf(checkId) {
     return short;
   }
 }
+function analysisTypeSuffix(f) {
+  const rawAnalysisType = f.properties?.analysisType;
+  const analysisTypeValue = rawAnalysisType === "pattern" || rawAnalysisType === "semantic" ? rawAnalysisType : void 0;
+  return analysisTypeValue ? text.meta(` [${getCopy(`reporting.analysisType.${analysisTypeValue}`)}]`) : "";
+}
+function renderFinding(f, showIds) {
+  const severityLabel = textForSeverity(f.severity);
+  const baselineLabel = f.baselineState === "new" ? text.success(" [NEW]") : "";
+  const loc = f.file ? text.meta(` (${f.file}:${f.line ?? "-"})`) : "";
+  const confidenceLabel = f.confidence && f.confidence !== "high" ? text.meta(` [${f.confidence} confidence]`) : "";
+  const analysisType = analysisTypeSuffix(f);
+  const name = checkNameOf(f.checkId);
+  const idSuffix = showIds ? text.meta(` \xB7 ${f.checkId}`) : "";
+  const lines = [];
+  lines.push(`${severityLabel}${baselineLabel} ${name}${idSuffix}${analysisType} \u2014 ${f.message}${loc}${confidenceLabel}`);
+  if (f.remediation) {
+    lines.push(`  ${text.meta(`\u2192 ${f.remediation}`)}`);
+  }
+  if (f.properties?.suggestion) {
+    lines.push(`  ${text.meta(`\u{1F4A1} ${f.properties.suggestion}`)}`);
+  }
+  return lines;
+}
+function renderCollapsedGroup(group, showIds) {
+  const first = group[0];
+  const severityLabel = textForSeverity(first.severity);
+  const analysisType = analysisTypeSuffix(first);
+  const name = checkNameOf(first.checkId);
+  const idSuffix = showIds ? text.meta(` \xB7 ${first.checkId}`) : "";
+  const total = group.length;
+  const fileCount = new Set(group.map((f) => f.file).filter(Boolean)).size;
+  const countPhrase = getCopy("reporting.collapsed.summary", total, fileCount);
+  const lines = [];
+  lines.push(`${severityLabel} ${name}${idSuffix}${analysisType} \u2014 ${countPhrase}`);
+  if (first.remediation) {
+    lines.push(`  ${text.meta(`\u2192 ${first.remediation}`)}`);
+  }
+  lines.push(`  ${text.meta(`\u2192 ${getCopy("reporting.collapsed.hint")}`)}`);
+  return lines;
+}
 var TerminalReporter = class {
   generate(input) {
-    const { findings: rawFindings, targetDir, tier, licensedTo, scannedFileCount, skippedChecks = [], showIds = false } = input;
+    const { findings: rawFindings, targetDir, tier, licensedTo, scannedFileCount, skippedChecks = [], showIds = false, all = false } = input;
     const findings = dedupeDegradedFindings(rawFindings);
     if (findings.length === 0) {
       const lines2 = [];
@@ -2456,22 +2498,30 @@ var TerminalReporter = class {
     const lines = [];
     lines.push(text.heading(getCopy("report.header", targetDir, findings.length)));
     lines.push("");
-    for (const f of findings) {
-      const severityLabel = textForSeverity(f.severity);
-      const baselineLabel = f.baselineState === "new" ? text.success(" [NEW]") : "";
-      const loc = f.file ? text.meta(` (${f.file}:${f.line ?? "-"})`) : "";
-      const confidenceLabel = f.confidence && f.confidence !== "high" ? text.meta(` [${f.confidence} confidence]`) : "";
-      const rawAnalysisType = f.properties?.analysisType;
-      const analysisTypeValue = rawAnalysisType === "pattern" || rawAnalysisType === "semantic" ? rawAnalysisType : void 0;
-      const analysisType = analysisTypeValue ? text.meta(` [${getCopy(`reporting.analysisType.${analysisTypeValue}`)}]`) : "";
-      const name = checkNameOf(f.checkId);
-      const idSuffix = showIds ? text.meta(` \xB7 ${f.checkId}`) : "";
-      lines.push(`${severityLabel}${baselineLabel} ${name}${idSuffix}${analysisType} \u2014 ${f.message}${loc}${confidenceLabel}`);
-      if (f.remediation) {
-        lines.push(`  ${text.meta(`\u2192 ${f.remediation}`)}`);
+    if (all) {
+      for (const f of findings) {
+        lines.push(...renderFinding(f, showIds));
       }
-      if (f.properties?.suggestion) {
-        lines.push(`  ${text.meta(`\u{1F4A1} ${f.properties.suggestion}`)}`);
+    } else {
+      const collapsibleGroups = /* @__PURE__ */ new Map();
+      for (const f of findings) {
+        if (COLLAPSIBLE_SEVERITIES.has(f.severity)) {
+          const group = collapsibleGroups.get(f.checkId);
+          if (group) {
+            group.push(f);
+          } else {
+            collapsibleGroups.set(f.checkId, [f]);
+          }
+        } else {
+          lines.push(...renderFinding(f, showIds));
+        }
+      }
+      for (const group of collapsibleGroups.values()) {
+        if (group.length === 1) {
+          lines.push(...renderFinding(group[0], showIds));
+        } else {
+          lines.push(...renderCollapsedGroup(group, showIds));
+        }
       }
     }
     lines.push("");
@@ -3582,7 +3632,56 @@ function getOrCreateParser(lang, langKey) {
   }
   return parser;
 }
-async function queryFile(file, queryString, astCache) {
+async function resolveContent(file, contentCache) {
+  if (contentCache) {
+    const cacheKey = `${file.path}::${file.language}`;
+    let contentPromise = contentCache.get(cacheKey);
+    if (!contentPromise) {
+      contentPromise = file.content().catch(() => {
+        throw new Error("read_failed");
+      });
+      contentCache.set(cacheKey, contentPromise);
+    }
+    return contentPromise;
+  }
+  return file.content();
+}
+async function parseFile(file, contentCache) {
+  if (!isLanguageSupported(file.language)) return null;
+  const wasmFilename = LANGUAGE_WASM_MAP[file.language];
+  if (!wasmFilename) return null;
+  try {
+    await ensureParserInit();
+  } catch {
+    return null;
+  }
+  let lang;
+  try {
+    lang = await loadLanguage(file.language);
+  } catch {
+    return null;
+  }
+  if (languageVerified.get(file.language) === false) return null;
+  let source;
+  try {
+    source = await resolveContent(file, contentCache);
+  } catch {
+    return null;
+  }
+  if (source.length === 0 || source.length > MAX_PARSE_BYTES) return null;
+  const freshParser = new Parser();
+  freshParser.setLanguage(lang);
+  try {
+    const tree = freshParser.parse(source);
+    freshParser.delete();
+    if (!tree) return null;
+    return { tree, source };
+  } catch {
+    freshParser.delete();
+    return null;
+  }
+}
+async function queryFile(file, queryString, astCache, bashAstCache) {
   if (!isLanguageSupported(file.language)) {
     return { matches: [], degraded: true };
   }
@@ -3610,32 +3709,30 @@ async function queryFile(file, queryString, astCache) {
     return { matches: [], degraded: true, error: `languageVerified is false for ${file.language}` };
   }
   let source;
+  try {
+    source = await resolveContent(file, astCache);
+  } catch {
+    return { matches: [], degraded: true };
+  }
+  if (source.length === 0) {
+    return { matches: [], degraded: false };
+  }
+  if (source.length > MAX_PARSE_BYTES) {
+    return { matches: [], degraded: true };
+  }
   let tree;
-  if (astCache) {
+  let ownTree = false;
+  if (file.language === "bash" && bashAstCache) {
     const cacheKey = `${file.path}::${file.language}`;
-    let parsePromise = astCache.get(cacheKey);
+    let parsePromise = bashAstCache.get(cacheKey);
     if (!parsePromise) {
       parsePromise = (async () => {
-        let s;
-        try {
-          s = await file.content();
-        } catch {
-          throw new Error("read_failed");
-        }
-        if (s.length === 0) {
-          return { tree: null, source: s };
-        }
-        if (s.length > MAX_PARSE_BYTES) {
-          throw new Error("file_too_large");
-        }
         const parser = getOrCreateParser(lang, file.language);
-        const parsed2 = parser.parse(s);
-        if (!parsed2) {
-          throw new Error("parse_failed");
-        }
-        return { tree: parsed2, source: s };
+        const parsed2 = parser.parse(source);
+        if (!parsed2) throw new Error("parse_failed");
+        return { tree: parsed2, source };
       })();
-      astCache.set(cacheKey, parsePromise);
+      bashAstCache.set(cacheKey, parsePromise);
     }
     let parsed;
     try {
@@ -3643,31 +3740,20 @@ async function queryFile(file, queryString, astCache) {
     } catch {
       return { matches: [], degraded: true };
     }
-    if (parsed.source.length === 0) {
-      return { matches: [], degraded: false };
-    }
-    source = parsed.source;
     tree = parsed.tree;
   } else {
+    ownTree = true;
+    const freshParser = new Parser();
+    freshParser.setLanguage(lang);
     try {
-      source = await file.content();
-    } catch {
-      return { matches: [], degraded: true };
-    }
-    if (source.length === 0) {
-      return { matches: [], degraded: false };
-    }
-    if (source.length > MAX_PARSE_BYTES) {
-      return { matches: [], degraded: true };
-    }
-    try {
-      const parser = getOrCreateParser(lang, file.language);
-      const parsed = parser.parse(source);
+      const parsed = freshParser.parse(source);
+      freshParser.delete();
       if (!parsed) {
         return { matches: [], degraded: true };
       }
       tree = parsed;
     } catch {
+      freshParser.delete();
       return { matches: [], degraded: true };
     }
   }
@@ -3679,7 +3765,7 @@ async function queryFile(file, queryString, astCache) {
       query = new TSQuery(lang, queryString);
       compiledQueryCache.set(queryCacheKey, query);
     } catch (err) {
-      tree.delete();
+      if (ownTree) tree.delete();
       console.error(
         `[seaworthy] Invalid query for ${file.language}:`,
         err.message
@@ -3729,9 +3815,7 @@ async function queryFile(file, queryString, astCache) {
     }
     return true;
   });
-  if (!astCache) {
-    tree.delete();
-  }
+  if (ownTree) tree.delete();
   return { matches, degraded: false };
 }
 function setAnalysisType(finding, analysisType = "pattern") {
@@ -3785,7 +3869,7 @@ function createTreeSitterCheck(options) {
         async (file) => {
           const query = queries[file.language];
           try {
-            const result = await queryFile(file, query, ctx.astCache);
+            const result = await queryFile(file, query, ctx.astCache, ctx.bashAstCache);
             if (result.degraded) {
               if (!degradedLanguages.has(file.language)) {
                 degradedLanguages.add(file.language);
@@ -11870,36 +11954,21 @@ function runAnalyse(file, table, fileContent, astCache) {
     }
     if (content.length === 0) return { flows: [], degraded: false };
     let tree;
-    let ownTree = false;
+    const ownTree = true;
     const cacheKey = `${file.path}::${file.language}`;
-    if (astCache) {
-      let cached = astCache.get(cacheKey);
-      if (!cached) {
-        cached = (async () => {
-          const parser = getOrCreateParser(lang, file.language);
-          const parsed = parser.parse(content);
-          if (!parsed) throw new Error("parse failed");
-          return { tree: parsed, source: content };
-        })();
-        astCache.set(cacheKey, cached);
-        ownTree = false;
-      }
-      try {
-        const r = await cached;
-        tree = r.tree;
-      } catch {
-        return { flows: [], degraded: true };
-      }
-    } else {
-      try {
-        const parser = getOrCreateParser(lang, file.language);
-        const parsed = parser.parse(content);
-        if (!parsed) return { flows: [], degraded: true };
-        tree = parsed;
-        ownTree = true;
-      } catch {
-        return { flows: [], degraded: true };
-      }
+    if (astCache && !astCache.has(cacheKey)) {
+      astCache.set(cacheKey, Promise.resolve(content));
+    }
+    const freshParser = new TSParser();
+    freshParser.setLanguage(lang);
+    try {
+      const parsed = freshParser.parse(content);
+      freshParser.delete();
+      if (!parsed) return { flows: [], degraded: true };
+      tree = parsed;
+    } catch {
+      freshParser.delete();
+      return { flows: [], degraded: true };
     }
     const entries = collectEntries(table);
     const taggedByNode = /* @__PURE__ */ new Map();
@@ -12833,7 +12902,7 @@ var check = {
     const _exampleLine = 1;
     for (const file of eligible) {
       const query = QUERIES9[file.language];
-      const result = await queryFile(file, query, ctx.astCache);
+      const result = await queryFile(file, query, ctx.astCache, ctx.bashAstCache);
       if (result.degraded) {
         if (!degradedLanguages.has(file.language)) {
           degradedLanguages.add(file.language);
@@ -13836,7 +13905,7 @@ var sqlRlsStaticCheck = {
       const dialect = classifySqlDialect(content);
       if (dialect !== "postgres" && dialect !== "supabase") continue;
       const tableQuery = "(create_table (object_reference name: (identifier) @table_name))";
-      const tableResult = await queryFile(file, tableQuery, ctx.astCache);
+      const tableResult = await queryFile(file, tableQuery, ctx.astCache, ctx.bashAstCache);
       if (tableResult.degraded) continue;
       const tables = [];
       for (const match of tableResult.matches) {
@@ -13846,7 +13915,7 @@ var sqlRlsStaticCheck = {
         const columnQuery = `(create_table
           (object_reference name: (identifier) @t_name (#eq? @t_name "${tableNameRaw}"))
           (column_definitions (column_definition name: (identifier) @col_name)))`;
-        const columnResult = await queryFile(file, columnQuery, ctx.astCache);
+        const columnResult = await queryFile(file, columnQuery, ctx.astCache, ctx.bashAstCache);
         const columns = columnResult.matches.map((m) => normalizeIdentifier(m.captures.col_name ?? ""));
         const tenantColumns = ["tenant_id", "org_id", "workspace_id", "account_id", "user_id"];
         const isTenantTable = columns.some((c) => tenantColumns.includes(c));
@@ -14295,7 +14364,7 @@ var unprotectedSensitiveSqlColumnsCheck = {
           (identifier) @col_type
           (keyword_text) @col_type
         ])`;
-      const result = await queryFile(file, query, ctx.astCache);
+      const result = await queryFile(file, query, ctx.astCache, ctx.bashAstCache);
       if (result.degraded) continue;
       for (const match of result.matches) {
         const colNameRaw = match.captures.col_name;
@@ -14394,7 +14463,7 @@ registry.register({
         continue;
       }
       const lines = code.split("\n");
-      const queryResult = await queryFile(file, "(unsafe_block) @unsafe", ctx.astCache);
+      const queryResult = await queryFile(file, "(unsafe_block) @unsafe", ctx.astCache, ctx.bashAstCache);
       if (queryResult.degraded) continue;
       for (let i = 0; i < queryResult.matches.length; i++) {
         const match = queryResult.matches[i];
@@ -14546,50 +14615,51 @@ registry.register({
       }
       const isWebFile = /axum|actix/i.test(code);
       if (!isWebFile) continue;
-      const queryResult = await queryFile(file, RUST_QUERY, ctx.astCache);
+      const queryResult = await queryFile(file, RUST_QUERY, ctx.astCache, ctx.bashAstCache);
       if (queryResult.degraded) continue;
-      const cacheKey = `${file.path}::${file.language}`;
-      const parsePromise = ctx.astCache?.get(cacheKey);
-      if (!parsePromise) continue;
-      const parsed = await parsePromise;
-      if (!parsed || !parsed.tree) continue;
+      const parsed = await parseFile(file, ctx.astCache);
+      if (!parsed) continue;
       const parentMap = /* @__PURE__ */ new Map();
       walk2(parsed.tree.rootNode);
-      for (let i = 0; i < queryResult.matches.length; i++) {
-        const match = queryResult.matches[i];
-        if (!match) continue;
-        const node = findNodeAt2(parsed.tree.rootNode, match.startLine, match.startColumn ?? 0);
-        if (!node) continue;
-        let curr = node;
-        let enclosingFunction = null;
-        while (curr) {
-          if (curr.type === "function_item") {
-            enclosingFunction = curr;
-            break;
+      try {
+        for (let i = 0; i < queryResult.matches.length; i++) {
+          const match = queryResult.matches[i];
+          if (!match) continue;
+          const node = findNodeAt2(parsed.tree.rootNode, match.startLine, match.startColumn ?? 0);
+          if (!node) continue;
+          let curr = node;
+          let enclosingFunction = null;
+          while (curr) {
+            if (curr.type === "function_item") {
+              enclosingFunction = curr;
+              break;
+            }
+            const next = parentMap.get(curr.id);
+            if (!next) break;
+            curr = next;
           }
-          const next = parentMap.get(curr.id);
-          if (!next) break;
-          curr = next;
-        }
-        if (enclosingFunction) {
-          const isAsync = hasAsyncModifier(enclosingFunction);
-          if (isAsync) {
-            const finding = {
-              id: `${CHECK_ID56}:${file.relativePath}:${match.startLine}:${match.startColumn ?? 0}:${i}`,
-              checkId: CHECK_ID56,
-              category: "resilience",
-              severity: "high",
-              message: getCopy("checks.rust-handler-panics.message", match.nodeText),
-              file: file.relativePath,
-              line: match.startLine,
-              column: match.startColumn,
-              confidence: "high",
-              remediation
-            };
-            setAnalysisType(finding, "pattern");
-            findings.push(finding);
+          if (enclosingFunction) {
+            const isAsync = hasAsyncModifier(enclosingFunction);
+            if (isAsync) {
+              const finding = {
+                id: `${CHECK_ID56}:${file.relativePath}:${match.startLine}:${match.startColumn ?? 0}:${i}`,
+                checkId: CHECK_ID56,
+                category: "resilience",
+                severity: "high",
+                message: getCopy("checks.rust-handler-panics.message", match.nodeText),
+                file: file.relativePath,
+                line: match.startLine,
+                column: match.startColumn,
+                confidence: "high",
+                remediation
+              };
+              setAnalysisType(finding, "pattern");
+              findings.push(finding);
+            }
           }
         }
+      } finally {
+        parsed.tree.delete();
       }
     }
     return findings;
@@ -16013,7 +16083,8 @@ async function executeScan(args, ctx) {
     licensedTo: ctx.licensedTo ?? "free tier",
     scannedFileCount: result.scannedFileCount,
     skippedChecks: result.skippedChecks,
-    showIds: args.showIds ?? args.debug
+    showIds: args.showIds ?? args.debug,
+    all: args.all
   };
   let primaryOutput;
   switch (args.format) {
@@ -16358,7 +16429,8 @@ async function runCli(options) {
     debug: options.debug,
     baseline: options.baseline,
     minConfidence: options.minConfidence,
-    showIds: options.showIds
+    showIds: options.showIds,
+    all: options.all
   };
   const updateStart = Date.now();
   const updatePromise = checkUpdate().catch(() => void 0);
@@ -16535,12 +16607,12 @@ var require5 = createRequire4(import.meta.url);
 var { version } = require5("../package.json");
 var cli = cac("seaworthy");
 cli.version(version);
-cli.command("[path]", "Scan a directory for issues").option("--json", "Output JSON to stdout").option("--output <path>", "Write HTML report to file").option("--sarif <path>", "Write SARIF report to file").option("--sarif-stdout", "Write SARIF report to stdout").option("--fail-on-findings", "Exit with code 5 when findings are found").option("--tier <tier>", "Select tier (free, pro)").option("--provider <provider>", "LLM provider (anthropic, openai, kimi, moonshot, deepseek, gemini, minimax, ollama, openrouter)").option("--max-file-size <bytes>", "Skip files larger than this (default: 1 MB)").option("--show-ids", "Show check IDs alongside names in terminal output").option("--debug", "Enable debug logging").option("--baseline [ref]", "Compare against a baseline file or save current findings as baseline (--baseline save)").option("--min-confidence <level>", "Hide findings below this confidence (high, medium, low)").action(async (targetDir, options) => {
+cli.command("[path]", "Scan a directory for issues").option("--json", "Output JSON to stdout").option("--output <path>", "Write HTML report to file").option("--sarif <path>", "Write SARIF report to file").option("--sarif-stdout", "Write SARIF report to stdout").option("--fail-on-findings", "Exit with code 5 when findings are found").option("--tier <tier>", "Select tier (free, pro)").option("--provider <provider>", "LLM provider (anthropic, openai, kimi, moonshot, deepseek, gemini, minimax, ollama, openrouter)").option("--max-file-size <bytes>", "Skip files larger than this (default: 1 MB)").option("--show-ids", "Show check IDs alongside names in terminal output").option("--debug", "Enable debug logging").option("--baseline [ref]", "Compare against a baseline file or save current findings as baseline (--baseline save)").option("--min-confidence <level>", "Hide findings below this confidence (high, medium, low)").option("--all", "List every finding; do not collapse low-severity findings").action(async (targetDir, options) => {
   const maxFileSize = options.maxFileSize ? Number(options.maxFileSize) : void 0;
   const tier = options.tier;
   const baseline = options.baseline === "save" ? "save" : options.baseline;
   const minConfidence = options.minConfidence;
-  const result = await runCli({ targetDir, json: options.json, output: options.output, sarif: options.sarif, sarifStdout: options.sarifStdout, failOnFindings: options.failOnFindings, tier, provider: options.provider, maxFileSize, showIds: options.showIds, debug: options.debug, baseline, minConfidence });
+  const result = await runCli({ targetDir, json: options.json, output: options.output, sarif: options.sarif, sarifStdout: options.sarifStdout, failOnFindings: options.failOnFindings, tier, provider: options.provider, maxFileSize, showIds: options.showIds, debug: options.debug, baseline, minConfidence, all: options.all });
   if (result.updateMessage) {
     console.error(result.updateMessage);
   }
@@ -16609,6 +16681,7 @@ cli.help(() => {
   --baseline [ref]       Compare against baseline file or save (--baseline save)
   --min-confidence <level>  Hide findings below confidence (high, medium, low)
   --show-ids             Show check IDs alongside names
+  --all                  List every finding; do not collapse low-severity findings
   --debug                Enable debug logging`
     },
     {