codegate-ai 0.12.4 → 0.14.0

package/dist/cli.js

@@ -17,6 +17,7 @@ import { renderTuiApp } from "./tui/app.js";
 import { executeWrapperRun } from "./wrapper.js";
 import { runRemediation as runRemediationWorkflow, } from "./layer4-remediation/remediation-runner.js";
 import { undoLatestSession } from "./commands/undo.js";
+import { runInventory } from "./commands/inventory-command.js";
 import { executeScanCommand } from "./commands/scan-command.js";
 import { executeScanContentCommand, SCAN_CONTENT_TYPES, } from "./commands/scan-content-command.js";
 import { executeSkillsWrapper, launchSkillsPassthrough, } from "./commands/skills-wrapper.js";
@@ -619,6 +620,70 @@ function addInitCommand(program, deps) {
         }
     });
 }
+const INVENTORY_SCOPES = ["user", "project", "all"];
+const INVENTORY_KINDS = ["skills", "configs", "all"];
+function addInventoryCommand(program, deps) {
+    program
+        .command("inventory")
+        .description("List the AI-tool config + skill artifacts the knowledge base knows about, resolved against this machine.")
+        .addOption(new Option("--scope <scope>", "scope filter")
+        .choices(INVENTORY_SCOPES)
+        .default("all"))
+        .addOption(new Option("--kind <kind>", "artifact kind filter")
+        .choices(INVENTORY_KINDS)
+        .default("all"))
+        .option("--only-existing", "return only items that currently exist on disk")
+        .option("--workspace <path>", "additional project-scope root (repeatable); defaults to cwd when omitted", collectRepeatable, [])
+        .addOption(new Option("--format <format>", "output format").choices(["text", "json"]).default("text"))
+        .addHelpText("after", renderExampleHelp([
+        "codegate inventory",
+        "codegate inventory --format json --kind skills --only-existing",
+        "codegate inventory --scope user --format json",
+        "codegate inventory --workspace . --workspace /path/to/other/repo",
+    ]))
+        .action((options) => {
+        try {
+            const home = deps.homeDir?.() ?? homedir();
+            const explicitWorkspaces = options.workspace ?? [];
+            const workspaces = explicitWorkspaces.length > 0
+                ? explicitWorkspaces.map((w) => resolve(deps.cwd(), w))
+                : [deps.cwd()];
+            const summary = runInventory({
+                scope: options.scope ?? "all",
+                kind: options.kind ?? "all",
+                onlyExisting: options.onlyExisting === true,
+                workspaces,
+                homeDir: home,
+            });
+            if (options.format === "json") {
+                deps.stdout(JSON.stringify(summary, null, 2));
+            }
+            else {
+                renderInventoryText(summary, deps.stdout);
+            }
+            deps.setExitCode(0);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            deps.stderr(`Inventory failed: ${message}`);
+            deps.setExitCode(3);
+        }
+    });
+}
+function collectRepeatable(value, previous) {
+    return [...previous, value];
+}
+function renderInventoryText(summary, stdout) {
+    stdout(`Knowledge base v${summary.kb_version}`);
+    stdout(`Tools: ${summary.tools.map((t) => t.name).join(", ")}`);
+    stdout(`Items: ${summary.items.length}`);
+    stdout("");
+    for (const item of summary.items) {
+        const mark = item.exists ? "✓" : "·";
+        const tag = item.kind === "skill" ? `${item.kind}:${item.type ?? "?"}` : item.kind;
+        stdout(`  ${mark} [${item.tool}] ${tag} (${item.scope}) ${item.path}`);
+    }
+}
 function addUpdateCommands(program, deps) {
     const guidance = [
         "Updates are bundled with CodeGate releases in v1/v2.",
@@ -680,6 +745,7 @@ export function createCli(version = packageJson.version ?? "0.0.0-dev", deps = d
     addRunCommand(program, version, deps);
     addUndoCommand(program, deps);
     addInitCommand(program, deps);
+    addInventoryCommand(program, deps);
     addUpdateCommands(program, deps);
     return program;
 }

package/dist/commands/inventory-command.d.ts

@@ -0,0 +1,39 @@
+/** One resolved artifact the scanner knows about. */
+export interface InventoryItem {
+    tool: string;
+    kind: "config" | "skill";
+    /** Only set for skill entries; mirrors KB `skill_paths[].type`. */
+    type?: string;
+    scope: "user" | "project";
+    /** Pattern as declared in the KB (relative, may contain wildcards). */
+    pattern: string;
+    /** Absolute resolved filesystem path (concrete, not the pattern). */
+    path: string;
+    /** True if the filesystem shows the path exists. */
+    exists: boolean;
+    risk_surface: string[];
+    /** Only populated for config entries that declare them. */
+    fields_of_interest?: Record<string, string>;
+    /** Resolution root used (e.g., the home dir or a workspace root). */
+    resolved_against: string;
+}
+export interface InventorySummary {
+    kb_version: string;
+    /** Known tools (from KB file names) with their version ranges. */
+    tools: Array<{
+        name: string;
+        version_range: string;
+    }>;
+    items: InventoryItem[];
+}
+export interface InventoryOptions {
+    scope: "user" | "project" | "all";
+    kind: "skills" | "configs" | "all";
+    onlyExisting: boolean;
+    /** Roots for project-scope resolution. Empty if project scope is skipped. */
+    workspaces: string[];
+    homeDir: string;
+    /** Optional injection for tests. */
+    kbBaseDir?: string;
+}
+export declare function runInventory(options: InventoryOptions): InventorySummary;

package/dist/commands/inventory-command.js

@@ -0,0 +1,194 @@
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { join, relative, resolve, sep } from "node:path";
+import { loadKnowledgeBase, } from "../layer1-discovery/knowledge-base.js";
+const MAX_WILDCARD_DEPTH = 8;
+const MAX_WILDCARD_MATCHES = 2000;
+export function runInventory(options) {
+    const kb = loadKnowledgeBase(options.kbBaseDir);
+    const includeConfigs = options.kind === "all" || options.kind === "configs";
+    const includeSkills = options.kind === "all" || options.kind === "skills";
+    const rawItems = [];
+    for (const entry of kb.entries) {
+        if (includeConfigs) {
+            for (const cp of entry.config_paths) {
+                rawItems.push(...resolveConfigEntry(entry.tool, cp, options));
+            }
+        }
+        if (includeSkills) {
+            for (const sp of entry.skill_paths ?? []) {
+                rawItems.push(...resolveSkillEntry(entry.tool, sp, options));
+            }
+        }
+    }
+    const items = options.onlyExisting ? rawItems.filter((item) => item.exists) : rawItems;
+    // Stable ordering: by tool, then kind, then scope, then path.
+    items.sort((a, b) => {
+        if (a.tool !== b.tool)
+            return a.tool.localeCompare(b.tool);
+        if (a.kind !== b.kind)
+            return a.kind.localeCompare(b.kind);
+        if (a.scope !== b.scope)
+            return a.scope.localeCompare(b.scope);
+        return a.path.localeCompare(b.path);
+    });
+    return {
+        kb_version: kb.schemaVersion,
+        tools: kb.entries
+            .map((entry) => ({
+            name: entry.tool,
+            version_range: entry.version_range,
+        }))
+            .sort((a, b) => a.name.localeCompare(b.name)),
+        items,
+    };
+}
+function resolveConfigEntry(tool, cp, options) {
+    if (!scopeIncluded(cp.scope, options.scope))
+        return [];
+    const roots = rootsFor(cp.scope, options);
+    const items = [];
+    for (const root of roots) {
+        items.push(...resolvePattern({
+            tool,
+            kind: "config",
+            scope: cp.scope,
+            pattern: cp.path,
+            root,
+            riskSurface: cp.risk_surface,
+            fieldsOfInterest: cp.fields_of_interest,
+        }));
+    }
+    return items;
+}
+function resolveSkillEntry(tool, sp, options) {
+    if (!scopeIncluded(sp.scope, options.scope))
+        return [];
+    const roots = rootsFor(sp.scope, options);
+    const items = [];
+    for (const root of roots) {
+        items.push(...resolvePattern({
+            tool,
+            kind: "skill",
+            type: sp.type,
+            scope: sp.scope,
+            pattern: sp.path,
+            root,
+            riskSurface: sp.risk_surface,
+        }));
+    }
+    return items;
+}
+function scopeIncluded(entryScope, optionScope) {
+    if (optionScope === "all")
+        return true;
+    return entryScope === optionScope;
+}
+function rootsFor(entryScope, options) {
+    if (entryScope === "user")
+        return [options.homeDir];
+    if (options.workspaces.length === 0)
+        return [];
+    return options.workspaces;
+}
+function resolvePattern(input) {
+    const normalized = normalizePattern(input.pattern);
+    const hasWildcard = /[*?]/.test(normalized);
+    if (!hasWildcard) {
+        const absolute = resolve(input.root, normalized);
+        return [makeItem(input, absolute, existsSync(absolute))];
+    }
+    const matches = expandWildcard(input.root, normalized);
+    return matches.map((absolute) => makeItem(input, absolute, true));
+}
+function makeItem(input, absolute, exists) {
+    return {
+        tool: input.tool,
+        kind: input.kind,
+        type: input.type,
+        scope: input.scope,
+        pattern: input.pattern,
+        path: absolute,
+        exists,
+        risk_surface: input.riskSurface,
+        fields_of_interest: input.fieldsOfInterest,
+        resolved_against: input.root,
+    };
+}
+function normalizePattern(pattern) {
+    return pattern.replace(/^~\//, "").replace(/^\/+/, "");
+}
+function escapeRegex(value) {
+    return value.replace(/[|\\{}()[\]^$+?.*]/g, "\\$&");
+}
+function wildcardToRegex(pattern) {
+    let escaped = escapeRegex(pattern);
+    escaped = escaped.replace(/\\\*\\\*\//g, "(?:[^/]+/)*");
+    escaped = escaped.replace(/\\\*\\\*/g, ".*");
+    escaped = escaped.replace(/\\\*/g, "[^/]*");
+    escaped = escaped.replace(/\\\?/g, "[^/]");
+    return new RegExp(`^${escaped}$`);
+}
+function fixedPrefix(pattern) {
+    const firstStar = pattern.indexOf("*");
+    const firstQuestion = pattern.indexOf("?");
+    const firstWildcard = firstStar === -1
+        ? firstQuestion
+        : firstQuestion === -1
+            ? firstStar
+            : Math.min(firstStar, firstQuestion);
+    if (firstWildcard === -1)
+        return pattern;
+    const prefix = pattern.slice(0, firstWildcard);
+    const lastSlash = prefix.lastIndexOf("/");
+    return lastSlash === -1 ? "" : prefix.slice(0, lastSlash);
+}
+function expandWildcard(root, pattern) {
+    const matchRegex = wildcardToRegex(pattern);
+    const prefix = fixedPrefix(pattern);
+    const baseDir = prefix ? resolve(root, prefix) : resolve(root);
+    if (!existsSync(baseDir))
+        return [];
+    try {
+        if (!statSync(baseDir).isDirectory())
+            return [];
+    }
+    catch {
+        return [];
+    }
+    const matches = [];
+    const queue = [{ dir: baseDir, depth: 0 }];
+    while (queue.length > 0 && matches.length < MAX_WILDCARD_MATCHES) {
+        const current = queue.pop();
+        if (!current)
+            break;
+        let entries;
+        try {
+            entries = readdirSync(current.dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (matches.length >= MAX_WILDCARD_MATCHES)
+                break;
+            const absolute = join(current.dir, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                if (current.depth < MAX_WILDCARD_DEPTH) {
+                    queue.push({ dir: absolute, depth: current.depth + 1 });
+                }
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const rel = relative(root, absolute).split(sep).join("/");
+            if (rel.startsWith(".."))
+                continue;
+            if (!matchRegex.test(rel))
+                continue;
+            matches.push(absolute);
+        }
+    }
+    return matches;
+}

package/dist/knowledge-base/claude-code.json

@@ -133,6 +133,18 @@
       "scope": "user",
       "type": "custom_command",
       "risk_surface": ["prompt_injection"]
+    },
+    {
+      "path": ".claude/skills/*/SKILL.md",
+      "scope": "project",
+      "type": "anthropic_skill",
+      "risk_surface": ["prompt_injection", "unicode_backdoor", "command_exec", "mcp_config"]
+    },
+    {
+      "path": ".claude/skills/*/SKILL.md",
+      "scope": "user",
+      "type": "anthropic_skill",
+      "risk_surface": ["prompt_injection", "unicode_backdoor", "command_exec", "mcp_config"]
     }
   ],
   "extension_mechanisms": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.12.4",
+  "version": "0.14.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",