codegate-ai 0.14.2 → 0.14.4

package/dist/cli.js

@@ -296,7 +296,24 @@ function addScanCommand(program, version, deps) {
                         ? true
                         : (baseConfig.workflow_audits?.enabled ?? false),
                 },
-                scan_user_scope: options.includeUserScope === true ? true : (baseConfig.scan_user_scope ?? false),
+                // When the raw input was a single local file (now staged into a
+                // temp dir), walking the full user-scope tree is off-target — the
+                // user asked to scan one file, not their whole home. Without
+                // this guard, sibling findings (e.g. `~/.agents/skills/*/SKILL.md`)
+                // leak into scans of files like `.claude/settings.json` or
+                // `.idea/workspace.xml`.
+                //
+                // Earlier we gated on `explicitCandidates.length > 0`, but that
+                // falsely passed for files whose extension is not in the
+                // text-like format list (XML, binary-ish configs, etc.) — those
+                // produce zero explicit candidates and the guard never fired.
+                // Using `stagedFromLocalFile` is the reliable signal.
+                // Explicit opt-in via `--include-user-scope` still forces it on.
+                scan_user_scope: options.includeUserScope === true
+                    ? true
+                    : resolvedTarget.stagedFromLocalFile === true
+                        ? false
+                        : (baseConfig.scan_user_scope ?? false),
             };
             if (options.resetState) {
                 const reset = deps.resetScanState ?? ((path) => resetScanState(path));

package/dist/scan-target/staging.js

@@ -78,6 +78,7 @@ export function stageLocalFile(absolutePath) {
             scanTarget: tempRoot,
             displayTarget: absolutePath,
             explicitCandidates: collectExplicitCandidates(tempRoot),
+            stagedFromLocalFile: true,
             cleanup: () => cleanupTempDir(tempRoot),
         };
     }
@@ -89,6 +90,7 @@ export function stageLocalFile(absolutePath) {
         scanTarget: tempRoot,
         displayTarget: absolutePath,
         explicitCandidates: collectExplicitCandidates(tempRoot),
+        stagedFromLocalFile: true,
         cleanup: () => cleanupTempDir(tempRoot),
     };
 }

package/dist/scan-target/types.d.ts

@@ -10,6 +10,14 @@ export interface ResolvedScanTarget {
     scanTarget: string;
     displayTarget: string;
     explicitCandidates?: ExplicitScanCandidate[];
+    /**
+     * `true` when the raw input was a local file that got staged into a
+     * temp directory. This is the signal the CLI uses to disable the
+     * user-scope walk, regardless of whether `explicitCandidates` could be
+     * inferred for the file (an XML / binary / unrecognised extension
+     * would still benefit from the scope guard).
+     */
+    stagedFromLocalFile?: boolean;
     cleanup?: () => Promise<void> | void;
 }
 export interface ResolveScanTargetInput {

package/dist/scan.js

@@ -148,18 +148,46 @@ function isPathInside(root, candidatePath) {
  * User-scope patterns (e.g. `~/.agents/skills/*/SKILL.md`) walk the whole
  * home directory, so they can match files belonging to completely unrelated
  * skills or agents. When the scan target is itself a specific location
- * **inside** the user's home — e.g. scanning a single skill directory — any
- * user-scope match outside that scan target belongs to a different scan and
- * must not be attributed here.
+ * **inside** the user's home — e.g. scanning a single skill directory or a
+ * single config file like `~/.claude/settings.json` — any user-scope match
+ * that does not belong to that target is a cross-scan leak and must be
+ * dropped.
  *
- * When the scan target lives outside the home directory (for example a
- * project root in a workspace), user-scope matches are accepted as legitimate
- * host-wide context for that scan.
+ * Three cases:
+ * - `scanTarget` is a directory inside `homeDir`: only keep candidates inside
+ *   that directory (existing PR #53 behavior).
+ * - `scanTarget` is a file inside `homeDir`: only keep candidates that resolve
+ *   to that exact file. "Inside" semantics do not apply to files, so the
+ *   previous check let every sibling through.
+ * - `scanTarget` lives outside the home directory (or cannot be stat'd,
+ *   e.g. a URL or a staged path that has been cleaned up): user-scope
+ *   matches are accepted as legitimate host-wide context.
  */
 function shouldKeepUserScopeCandidate(scanTarget, homeDir, candidatePath) {
-    if (isPathInside(homeDir, scanTarget)) {
+    if (!isPathInside(homeDir, scanTarget)) {
+        return true;
+    }
+    // Follow symlinks the same way the rest of the scan code does (walker,
+    // wildcard-base check, `isRegularFile`): `statSync` resolves them. If the
+    // target cannot be stat'd (missing / permission denied / URL that was never
+    // a local path), fall through to the pre-PR-#53 outside-home behavior so
+    // we do not over-filter project-scope scans on unusual inputs.
+    let targetStat;
+    try {
+        targetStat = statSync(scanTarget);
+    }
+    catch {
+        return true;
+    }
+    if (targetStat.isFile()) {
+        // Nothing is "inside" a file. The only user-scope candidate that can
+        // legitimately belong to a file-target scan is the file itself.
+        return resolve(candidatePath) === resolve(scanTarget);
+    }
+    if (targetStat.isDirectory()) {
         return isPathInside(scanTarget, candidatePath);
     }
+    // Sockets, devices, etc. — behave like the outside-home case.
     return true;
 }
 function toUserReportPath(pattern) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",