codegate-ai 0.14.3 → 0.15.0

package/dist/cli.js

@@ -296,16 +296,22 @@ function addScanCommand(program, version, deps) {
                         ? true
                         : (baseConfig.workflow_audits?.enabled ?? false),
                 },
-                // When the target was a single local file that got staged into a
-                // temp dir (explicitCandidates set), walking the full user-scope
-                // tree is off-target: the user asked to scan one file, not their
-                // whole home. Leaving user-scope on here let sibling findings
-                // (e.g. `~/.agents/skills/*/SKILL.md`) leak into single-file
-                // scans of configs like `.claude/settings.json`. Explicit opt-in
-                // via `--include-user-scope` still forces it on.
+                // When the raw input was a single local file (now staged into a
+                // temp dir), walking the full user-scope tree is off-target — the
+                // user asked to scan one file, not their whole home. Without
+                // this guard, sibling findings (e.g. `~/.agents/skills/*/SKILL.md`)
+                // leak into scans of files like `.claude/settings.json` or
+                // `.idea/workspace.xml`.
+                //
+                // Earlier we gated on `explicitCandidates.length > 0`, but that
+                // falsely passed for files whose extension is not in the
+                // text-like format list (XML, binary-ish configs, etc.) — those
+                // produce zero explicit candidates and the guard never fired.
+                // Using `stagedFromLocalFile` is the reliable signal.
+                // Explicit opt-in via `--include-user-scope` still forces it on.
                 scan_user_scope: options.includeUserScope === true
                     ? true
-                    : resolvedTarget.explicitCandidates && resolvedTarget.explicitCandidates.length > 0
+                    : resolvedTarget.stagedFromLocalFile === true
                         ? false
                         : (baseConfig.scan_user_scope ?? false),
             };

package/dist/knowledge-base/openclaw.json

@@ -0,0 +1,96 @@
+{
+  "tool": "openclaw",
+  "version_range": ">=0.1.0",
+  "config_paths": [
+    {
+      "path": ".openclaw/openclaw.json",
+      "scope": "user",
+      "format": "jsonc",
+      "risk_surface": ["agent_config", "channel_bindings", "provider_credentials", "mcp_config"],
+      "fields_of_interest": {
+        "agents": "agent definitions and the messaging channels they expose",
+        "providers": "configured LLM providers (API keys, custom base URLs)",
+        "channels": "enabled inbound/outbound channels (whatsapp, telegram, signal, slack, imessage, discord, line, matrix, teams, zalo, voice)",
+        "mcpServers": "MCP servers exposed to the agent",
+        "tools": "plugin-provided tools registered on the agent"
+      }
+    },
+    {
+      "path": ".openclaw/custom.json",
+      "scope": "user",
+      "format": "jsonc",
+      "risk_surface": ["agent_config", "user_override"]
+    },
+    {
+      "path": ".openclaw/hooks.json5",
+      "scope": "user",
+      "format": "text",
+      "risk_surface": ["hooks", "command_exec", "consent_bypass"],
+      "fields_of_interest": {
+        "pre": "pre-tool-use shell commands (runs with agent privileges)",
+        "post": "post-tool-use shell commands"
+      }
+    },
+    {
+      "path": ".openclaw/exec-approvals.json",
+      "scope": "user",
+      "format": "jsonc",
+      "risk_surface": ["consent_bypass", "command_exec"],
+      "fields_of_interest": {
+        "approved": "commands the agent can run without prompting the operator"
+      }
+    },
+    {
+      "path": ".openclaw/.env",
+      "scope": "user",
+      "format": "dotenv",
+      "risk_surface": ["secret_leak", "env_override"]
+    },
+    {
+      "path": ".openclaw/telegram.token",
+      "scope": "user",
+      "format": "text",
+      "risk_surface": ["secret_leak", "channel_token"]
+    }
+  ],
+  "skill_paths": [
+    {
+      "path": ".openclaw/extensions/*/package.json",
+      "scope": "user",
+      "type": "plugin_manifest",
+      "risk_surface": ["plugin_install", "supply_chain", "command_exec", "remote_resource"]
+    },
+    {
+      "path": ".openclaw/agents/*/agent",
+      "scope": "user",
+      "type": "agent",
+      "risk_surface": ["agent_config", "tool_access", "channel_bindings", "prompt_injection"]
+    },
+    {
+      "path": ".openclaw/workspace/IDENTITY.md",
+      "scope": "user",
+      "type": "identity",
+      "risk_surface": ["prompt_injection", "persona_override"]
+    }
+  ],
+  "extension_mechanisms": [
+    {
+      "type": "npm_plugin",
+      "install_pattern": ".openclaw/extensions/*/package.json",
+      "risk": "Plugins install via `npm install --omit=dev` with arbitrary package content; lifecycle scripts (postinstall, etc.) execute during install. Plugin code runs in-process with agent privileges.",
+      "fetchable": false
+    },
+    {
+      "type": "messaging_channel",
+      "install_pattern": ".openclaw/credentials/*",
+      "risk": "Inbound messages from external channels (WhatsApp, Telegram, Signal, Slack, iMessage, Discord, LINE, Matrix, Teams, Zalo, voice) feed untrusted text directly into LLM tool-use. Classic prompt-injection surface — every connected channel is an attacker-controllable input to the agent.",
+      "fetchable": false
+    },
+    {
+      "type": "hook",
+      "install_pattern": ".openclaw/hooks.json5",
+      "risk": "hooks.json5 declares shell commands to run before/after agent tool calls. An attacker with write access to this file can silently intercept or tamper with every agent action.",
+      "fetchable": false
+    }
+  ]
+}

package/dist/scan-target/staging.js

@@ -78,6 +78,7 @@ export function stageLocalFile(absolutePath) {
             scanTarget: tempRoot,
             displayTarget: absolutePath,
             explicitCandidates: collectExplicitCandidates(tempRoot),
+            stagedFromLocalFile: true,
             cleanup: () => cleanupTempDir(tempRoot),
         };
     }
@@ -89,6 +90,7 @@ export function stageLocalFile(absolutePath) {
         scanTarget: tempRoot,
         displayTarget: absolutePath,
         explicitCandidates: collectExplicitCandidates(tempRoot),
+        stagedFromLocalFile: true,
         cleanup: () => cleanupTempDir(tempRoot),
     };
 }

package/dist/scan-target/types.d.ts

@@ -10,6 +10,14 @@ export interface ResolvedScanTarget {
     scanTarget: string;
     displayTarget: string;
     explicitCandidates?: ExplicitScanCandidate[];
+    /**
+     * `true` when the raw input was a local file that got staged into a
+     * temp directory. This is the signal the CLI uses to disable the
+     * user-scope walk, regardless of whether `explicitCandidates` could be
+     * inferred for the file (an XML / binary / unrecognised extension
+     * would still benefit from the scope guard).
+     */
+    stagedFromLocalFile?: boolean;
     cleanup?: () => Promise<void> | void;
 }
 export interface ResolveScanTargetInput {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.14.3",
+  "version": "0.15.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",