codegate-ai 0.16.2 → 1.0.0

package/dist/cli.d.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 import { type CodeGateConfig, type ResolveConfigOptions } from "./config.js";
+import { type DeepResourceExecutionContext } from "./layer3-dynamic/deep-resource-executor.js";
 import type { ResourceFetchResult } from "./layer3-dynamic/resource-fetcher.js";
 import type { LocalTextAnalysisTarget } from "./layer3-dynamic/local-text-analysis.js";
 import { type DeepScanResource } from "./pipeline.js";
@@ -55,8 +56,9 @@ export interface CliDeps {
     runMetaAgentCommand?: (context: MetaAgentCommandConsentContext) => Promise<MetaAgentCommandRunResult> | MetaAgentCommandRunResult;
     requestRemediationConsent?: (context: RemediationConsentContext) => Promise<boolean> | boolean;
     requestRunWarningConsent?: (context: RunWarningConsentContext) => Promise<boolean> | boolean;
+    requestTrustConsent?: (directory: string) => Promise<boolean> | boolean;
     requestSkillSelection?: (options: string[]) => Promise<string | null> | string | null;
-    executeDeepResource?: (resource: DeepScanResource) => Promise<ResourceFetchResult>;
+    executeDeepResource?: (resource: DeepScanResource, context?: DeepResourceExecutionContext) => Promise<ResourceFetchResult>;
     launchSkills?: (args: string[], cwd: string) => SkillsWrapperLaunchResult;
     launchClawhub?: (args: string[], cwd: string) => ClawhubWrapperLaunchResult;
     runSkillsWrapper?: (input: {

package/dist/cli.js

@@ -8,6 +8,7 @@ import { pathToFileURL } from "node:url";
 import { Command, Option } from "commander";
 import { DEFAULT_CONFIG, OUTPUT_FORMATS, PERSONAS, RUNTIME_MODES, SCAN_COLLECTION_MODES, SCAN_COLLECTION_KINDS, resolveEffectiveConfig, } from "./config.js";
 import { APP_NAME } from "./index.js";
+import { createDeepResourceExecutor, } from "./layer3-dynamic/deep-resource-executor.js";
 import { runSandboxCommand } from "./layer3-dynamic/sandbox.js";
 import { runClaudeViaSdk } from "./layer3-dynamic/claude-sdk-provider.js";
 import { loadKnowledgeBase } from "./layer1-discovery/knowledge-base.js";
@@ -18,6 +19,8 @@ import { renderTuiApp } from "./tui/app.js";
 import { executeWrapperRun } from "./wrapper.js";
 import { runRemediation as runRemediationWorkflow, } from "./layer4-remediation/remediation-runner.js";
 import { undoLatestSession } from "./commands/undo.js";
+import { addTrustedDirectory, listTrustedDirectories, removeTrustedDirectory, } from "./commands/trust.js";
+import { checkContentUpdate, rollbackContent, updateContent } from "./content/content-updater.js";
 import { runInventory } from "./commands/inventory-command.js";
 import { executeScanCommand } from "./commands/scan-command.js";
 import { executeScanContentCommand, SCAN_CONTENT_TYPES, } from "./commands/scan-content-command.js";
@@ -206,23 +209,10 @@ const defaultCliDeps = {
             collectKinds: config?.scan_collection_kinds,
         }),
     discoverLocalTextTargets: (_scanTarget, _config, discoveryContext) => discoveryContext ? discoverLocalTextAnalysisTargetsFromContext(discoveryContext) : [],
-    // Deep resource execution never makes outbound network calls.
-    // Connecting to URLs found in scanned config files is a security risk:
-    // the endpoint could be malicious (crafted responses, SSRF, IP logging).
-    // Instead, we record the URL as metadata for the agent to analyze.
-    executeDeepResource: async (resource) => {
-        return {
-            status: "ok",
-            attempts: 0,
-            elapsedMs: 0,
-            metadata: {
-                resource_id: resource.id,
-                resource_kind: resource.request.kind,
-                resource_url: resource.request.locator,
-                note: "URL recorded for analysis without making outbound connections.",
-            },
-        };
-    },
+    // URL resources are never fetched (SSRF/IP-logging risk); npm/pypi registry
+    // metadata is fetched from pinned hosts only when runtime_mode is "online".
+    // See createDeepResourceExecutor for the full policy.
+    executeDeepResource: createDeepResourceExecutor(),
     launchSkills: (args, cwd) => launchSkillsPassthrough(args, cwd),
     launchClawhub: (args, cwd) => launchClawhubPassthrough(args, cwd),
 };
@@ -604,6 +594,100 @@ function addClawhubCommand(program, version, deps) {
         }
     });
 }
+async function promptTrustConsent(directory) {
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    const prompt = [
+        `Trusting ${directory} lets its .codegate.json set scanner policy`,
+        "(allowlists, rule skips, suppressions) and relaxes launch gating for it.",
+        "Only trust directories whose contents you control.",
+        "Proceed? [y/N]: ",
+    ].join("\n");
+    try {
+        const answer = await rl.question(prompt);
+        return /^y(es)?$/iu.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+function addTrustCommand(program, deps) {
+    program
+        .command("trust [dir]")
+        .description("Manage trusted directories where project config policy is honored")
+        .option("--list", "list trusted directories")
+        .option("--remove <dir>", "remove a directory from the trusted list")
+        .option("--config <path>", "use a specific global config file")
+        .option("--yes", "skip the confirmation prompt")
+        .addHelpText("after", renderExampleHelp([
+        "codegate trust",
+        "codegate trust ./project --yes",
+        "codegate trust --list",
+        "codegate trust --remove ./project",
+    ]))
+        .action(async (dir, options) => {
+        try {
+            if (options.list) {
+                const listed = listTrustedDirectories({ configPath: options.config });
+                if (listed.trustedDirectories.length === 0) {
+                    deps.stdout(`No trusted directories configured (${listed.configPath}).`);
+                }
+                else {
+                    deps.stdout(`Trusted directories (${listed.configPath}):`);
+                    for (const entry of listed.trustedDirectories) {
+                        deps.stdout(`  ${entry}`);
+                    }
+                }
+                deps.setExitCode(0);
+                return;
+            }
+            if (options.remove) {
+                const removed = removeTrustedDirectory({
+                    dir: options.remove,
+                    cwd: deps.cwd(),
+                    configPath: options.config,
+                });
+                deps.stdout(removed.changed
+                    ? `Removed ${removed.directory} from trusted directories.`
+                    : `${removed.directory} was not in the trusted list.`);
+                deps.setExitCode(0);
+                return;
+            }
+            const targetDir = dir ?? ".";
+            const resolvedPreview = resolve(deps.cwd(), targetDir);
+            if (!options.yes) {
+                const requestConsent = deps.requestTrustConsent ?? (deps.isTTY() ? promptTrustConsent : undefined);
+                if (!requestConsent) {
+                    deps.stderr("Confirmation required. Re-run with --yes to trust non-interactively.");
+                    deps.setExitCode(3);
+                    return;
+                }
+                const approved = await requestConsent(resolvedPreview);
+                if (!approved) {
+                    deps.stdout("Trust not granted.");
+                    deps.setExitCode(1);
+                    return;
+                }
+            }
+            const added = addTrustedDirectory({
+                dir: targetDir,
+                cwd: deps.cwd(),
+                configPath: options.config,
+            });
+            deps.stdout(added.changed
+                ? `Trusted ${added.directory} (${added.configPath}).`
+                : `${added.directory} is already trusted.`);
+            deps.setExitCode(0);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            deps.stderr(`Trust failed: ${message}`);
+            deps.setExitCode(3);
+        }
+    });
+}
 function addUndoCommand(program, deps) {
     program
         .command("undo [dir]")
@@ -723,33 +807,57 @@ function renderInventoryText(summary, stdout) {
     }
 }
 function addUpdateCommands(program, deps) {
-    const guidance = [
-        "Updates are bundled with CodeGate releases in v1/v2.",
-        "Run: npm update -g codegate-ai",
-        "Or run latest directly: npx codegate-ai@latest scan .",
-    ];
-    program
-        .command("update-kb")
-        .description("Check for newer knowledge-base content")
-        .addHelpText("after", renderExampleHelp(["codegate update-kb"]))
-        .action(() => {
-        deps.stdout("update-kb:");
-        for (const line of guidance) {
-            deps.stdout(line);
-        }
-        deps.setExitCode(0);
-    });
-    program
-        .command("update-rules")
-        .description("Check for newer rules content")
-        .addHelpText("after", renderExampleHelp(["codegate update-rules"]))
-        .action(() => {
-        deps.stdout("update-rules:");
-        for (const line of guidance) {
-            deps.stdout(line);
-        }
-        deps.setExitCode(0);
-    });
+    const registerUpdateCommand = (name, description) => {
+        program
+            .command(name)
+            .description(description)
+            .option("--check", "check for a newer signed content bundle without installing")
+            .option("--rollback", "switch back to the previously installed content version")
+            .option("--url <baseUrl>", "override the content download base URL (the signature is still required to verify)")
+            .addHelpText("after", renderExampleHelp([
+            `codegate ${name}`,
+            `codegate ${name} --check`,
+            `codegate ${name} --rollback`,
+        ]))
+            .action(async (options) => {
+            try {
+                if (options.rollback) {
+                    const rolledBack = rollbackContent();
+                    deps.stdout(`Rolled back to content version ${rolledBack.version}.`);
+                    deps.setExitCode(0);
+                    return;
+                }
+                if (options.check) {
+                    const checked = await checkContentUpdate({}, { baseUrl: options.url });
+                    deps.stdout(`Installed content: ${checked.currentVersion ?? "bundled only"}`);
+                    deps.stdout(`Latest published:  ${checked.remoteVersion}`);
+                    deps.stdout(checked.updateAvailable
+                        ? `Update available. Run: codegate ${name}`
+                        : "Content is up to date.");
+                    deps.setExitCode(0);
+                    return;
+                }
+                const updated = await updateContent({}, { baseUrl: options.url });
+                if (updated.changed) {
+                    deps.stdout(`Updated content: ${updated.previousVersion ?? "bundled only"} -> ${updated.version}`);
+                    if (updated.pruned.length > 0) {
+                        deps.stdout(`Pruned old versions: ${updated.pruned.join(", ")}`);
+                    }
+                }
+                else {
+                    deps.stdout(`Content already up to date (${updated.version}).`);
+                }
+                deps.setExitCode(0);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                deps.stderr(`${name} failed: ${message}`);
+                deps.setExitCode(3);
+            }
+        });
+    };
+    registerUpdateCommand("update-kb", "Fetch and verify the signed content bundle (knowledge base, rules, phrase lists)");
+    registerUpdateCommand("update-rules", "Alias of update-kb: content ships as one signed bundle");
 }
 function resolveKnowledgeBaseVersion() {
     try {
@@ -781,6 +889,7 @@ export function createCli(version = packageJson.version ?? "0.0.0-dev", deps = d
     addSkillsCommand(program, version, deps);
     addClawhubCommand(program, version, deps);
     addRunCommand(program, version, deps);
+    addTrustCommand(program, deps);
     addUndoCommand(program, deps);
     addInitCommand(program, deps);
     addInventoryCommand(program, deps);

package/dist/commands/scan-command.d.ts

@@ -1,6 +1,7 @@
 import { type AuditPersona, type CodeGateConfig, type OutputFormat, type RuntimeMode, type ScanCollectionMode } from "../config.js";
 import { type MetaAgentCommand, type MetaAgentTool } from "../layer3-dynamic/command-builder.js";
 import type { LocalTextAnalysisTarget } from "../layer3-dynamic/local-text-analysis.js";
+import type { DeepResourceExecutionContext } from "../layer3-dynamic/deep-resource-executor.js";
 import type { ResourceFetchResult } from "../layer3-dynamic/resource-fetcher.js";
 import { type DeepScanResource } from "../pipeline.js";
 import type { ScanDiscoveryCandidate, ScanDiscoveryContext } from "../scan.js";
@@ -81,7 +82,7 @@ export interface ExecuteScanCommandDeps {
     requestMetaAgentCommandConsent?: (context: MetaAgentCommandConsentContext) => Promise<boolean> | boolean;
     runMetaAgentCommand?: (context: MetaAgentCommandConsentContext) => Promise<MetaAgentCommandRunResult> | MetaAgentCommandRunResult;
     requestRemediationConsent?: (context: RemediationConsentContext) => Promise<boolean> | boolean;
-    executeDeepResource?: (resource: DeepScanResource) => Promise<ResourceFetchResult>;
+    executeDeepResource?: (resource: DeepScanResource, context?: DeepResourceExecutionContext) => Promise<ResourceFetchResult>;
     runRemediation?: (input: RemediationRunnerInput) => Promise<RemediationRunnerResult> | RemediationRunnerResult;
     stdout: (message: string) => void;
     stderr: (message: string) => void;

package/dist/commands/scan-command.js

@@ -130,7 +130,9 @@ export async function runScanAnalysis(input, deps) {
                     }
                     return false;
                 }, async (resource) => {
-                    const fetched = await deps.executeDeepResource(resource);
+                    const fetched = await deps.executeDeepResource(resource, {
+                        runtimeMode: input.config.runtime_mode,
+                    });
                     if (fetched.status !== "ok" || !selectedAgent) {
                         return fetched;
                     }
@@ -202,6 +204,9 @@ export async function runScanAnalysis(input, deps) {
                 });
                 const layer3Findings = layer3OutcomesToFindings(outcomes, {
                     unicodeAnalysis: input.config.unicode_analysis,
+                    registryHeuristics: {
+                        recentPublishDays: input.config.registry_heuristics?.recent_publish_days,
+                    },
                 });
                 report = mergeLayer3Findings(report, layer3Findings);
                 if (selectedAgent) {

package/dist/commands/trust.d.ts

@@ -0,0 +1,28 @@
+export interface TrustStoreDeps {
+    homeDir: () => string;
+    pathExists: (path: string) => boolean;
+    readFile: (path: string) => string;
+    writeFile: (path: string, content: string) => void;
+}
+export interface TrustActionResult {
+    configPath: string;
+    directory: string;
+    changed: boolean;
+    trustedDirectories: string[];
+}
+export declare function listTrustedDirectories(input?: {
+    configPath?: string;
+}, deps?: TrustStoreDeps): {
+    configPath: string;
+    trustedDirectories: string[];
+};
+export declare function addTrustedDirectory(input: {
+    dir: string;
+    cwd: string;
+    configPath?: string;
+}, deps?: TrustStoreDeps): TrustActionResult;
+export declare function removeTrustedDirectory(input: {
+    dir: string;
+    cwd: string;
+    configPath?: string;
+}, deps?: TrustStoreDeps): TrustActionResult;

package/dist/commands/trust.js

@@ -0,0 +1,69 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { parse as parseJsonc } from "jsonc-parser";
+import { expandHomePath } from "../config/trust.js";
+const defaultTrustStoreDeps = {
+    homeDir: () => homedir(),
+    pathExists: (path) => existsSync(path),
+    readFile: (path) => readFileSync(path, "utf8"),
+    writeFile: (path, content) => {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, content, "utf8");
+    },
+};
+function resolveConfigPath(configPath, deps) {
+    return configPath ?? join(deps.homeDir(), ".codegate", "config.json");
+}
+function readConfigObject(path, deps) {
+    if (!deps.pathExists(path)) {
+        return {};
+    }
+    const parsed = parseJsonc(deps.readFile(path));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`Invalid config file: ${path}`);
+    }
+    return parsed;
+}
+function readTrustedList(config) {
+    const raw = config.trusted_directories;
+    if (!Array.isArray(raw)) {
+        return [];
+    }
+    return raw.filter((entry) => typeof entry === "string" && entry.length > 0);
+}
+function writeConfigObject(path, config, deps) {
+    deps.writeFile(path, `${JSON.stringify(config, null, 2)}\n`);
+}
+function sameDirectory(left, right) {
+    return resolve(expandHomePath(left)) === resolve(expandHomePath(right));
+}
+export function listTrustedDirectories(input = {}, deps = defaultTrustStoreDeps) {
+    const configPath = resolveConfigPath(input.configPath, deps);
+    const config = readConfigObject(configPath, deps);
+    return { configPath, trustedDirectories: readTrustedList(config) };
+}
+export function addTrustedDirectory(input, deps = defaultTrustStoreDeps) {
+    const directory = resolve(input.cwd, expandHomePath(input.dir));
+    const configPath = resolveConfigPath(input.configPath, deps);
+    const config = readConfigObject(configPath, deps);
+    const trusted = readTrustedList(config);
+    if (trusted.some((entry) => sameDirectory(entry, directory))) {
+        return { configPath, directory, changed: false, trustedDirectories: trusted };
+    }
+    const next = [...trusted, directory];
+    writeConfigObject(configPath, { ...config, trusted_directories: next }, deps);
+    return { configPath, directory, changed: true, trustedDirectories: next };
+}
+export function removeTrustedDirectory(input, deps = defaultTrustStoreDeps) {
+    const directory = resolve(input.cwd, expandHomePath(input.dir));
+    const configPath = resolveConfigPath(input.configPath, deps);
+    const config = readConfigObject(configPath, deps);
+    const trusted = readTrustedList(config);
+    const next = trusted.filter((entry) => !sameDirectory(entry, directory));
+    if (next.length === trusted.length) {
+        return { configPath, directory, changed: false, trustedDirectories: trusted };
+    }
+    writeConfigObject(configPath, { ...config, trusted_directories: next }, deps);
+    return { configPath, directory, changed: true, trustedDirectories: next };
+}

package/dist/config/inline-ignore.d.ts

@@ -1,4 +1,4 @@
-import type { Finding } from "../types/finding.js";
+import { type Finding } from "../types/finding.js";
 export interface InlineIgnoreDirectiveSet {
     rules: Set<string>;
     ruleLines: Map<string, Set<number>>;
@@ -8,4 +8,12 @@ export declare function collectInlineIgnoreDirectives(files: Array<{
     filePath: string;
     textContent: string;
 }>): InlineIgnoreMap;
-export declare function applyInlineIgnoreDirectives<T extends Finding>(findings: T[], directives: InlineIgnoreMap): T[];
+export interface ApplyInlineIgnoreOptions {
+    /**
+     * Whether the scanned target is trusted. Inline directives in untrusted
+     * content are recorded but must not weaken gating, so they are tagged
+     * "inline-untrusted" and still count toward the exit code.
+     */
+    trustedTarget: boolean;
+}
+export declare function applyInlineIgnoreDirectives<T extends Finding>(findings: T[], directives: InlineIgnoreMap, options?: ApplyInlineIgnoreOptions): T[];

package/dist/config/inline-ignore.js

@@ -1,3 +1,4 @@
+import { SUPPRESSION_SOURCE } from "../types/finding.js";
 function normalizeRuleId(value) {
     const trimmed = value.trim();
     return trimmed.length > 0 ? trimmed : null;
@@ -43,7 +44,7 @@ export function collectInlineIgnoreDirectives(files) {
     }
     return directives;
 }
-export function applyInlineIgnoreDirectives(findings, directives) {
+export function applyInlineIgnoreDirectives(findings, directives, options = { trustedTarget: true }) {
     return findings.map((finding) => {
         const set = directives.get(finding.file_path);
         if (!set || !set.rules.has(finding.rule_id)) {
@@ -52,6 +53,9 @@ export function applyInlineIgnoreDirectives(findings, directives) {
         return {
             ...finding,
             suppressed: true,
+            suppression_source: options.trustedTarget
+                ? SUPPRESSION_SOURCE.Inline
+                : SUPPRESSION_SOURCE.InlineUntrusted,
         };
     });
 }

package/dist/config/suppression-policy.d.ts

@@ -1,4 +1,4 @@
-import type { Finding } from "../types/finding.js";
+import { type Finding } from "../types/finding.js";
 export interface SuppressionRule {
     rule_id?: string;
     file_path?: string;

package/dist/config/suppression-policy.js

@@ -1,3 +1,4 @@
+import { SUPPRESSION_SOURCE } from "../types/finding.js";
 function normalizeString(value) {
     if (typeof value !== "string") {
         return undefined;
@@ -138,9 +139,11 @@ export function applySuppressionPolicy(findings, policy) {
         const rulePolicy = rulePolicies[finding.rule_id];
         const ruleDisabled = rulePolicy?.disable === true;
         const ruleIgnoreMatch = rulePolicy?.ignore?.some((location) => matchesRulePolicyIgnore(finding, location)) ?? false;
+        const policyMatch = legacyMatch || ruleMatch || ruleDisabled || ruleIgnoreMatch;
         return {
             ...finding,
-            suppressed: finding.suppressed || legacyMatch || ruleMatch || ruleDisabled || ruleIgnoreMatch,
+            suppressed: finding.suppressed || policyMatch,
+            suppression_source: finding.suppression_source ?? (policyMatch ? SUPPRESSION_SOURCE.Config : undefined),
         };
     });
 }

package/dist/config/trust.d.ts

@@ -0,0 +1,2 @@
+export declare function expandHomePath(path: string): string;
+export declare function isTrustedDirectory(target: string, trustedDirectories: string[]): boolean;

package/dist/config/trust.js

@@ -0,0 +1,19 @@
+import { homedir } from "node:os";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+export function expandHomePath(path) {
+    if (path === "~") {
+        return homedir();
+    }
+    if (path.startsWith(`~${sep}`) || path.startsWith("~/")) {
+        return resolve(homedir(), path.slice(2));
+    }
+    return path;
+}
+export function isTrustedDirectory(target, trustedDirectories) {
+    const resolvedTarget = resolve(target);
+    return trustedDirectories.some((trustedPath) => {
+        const resolvedTrusted = resolve(expandHomePath(trustedPath));
+        const rel = relative(resolvedTrusted, resolvedTarget);
+        return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+    });
+}

package/dist/config.d.ts

@@ -26,6 +26,9 @@ export interface ToolDiscoveryConfig {
 export interface WorkflowAuditConfig {
     enabled: boolean;
 }
+export interface RegistryHeuristicsConfig {
+    recent_publish_days: number;
+}
 export interface CodeGateConfig {
     severity_threshold: SeverityThreshold;
     auto_proceed_below_threshold: boolean;
@@ -42,6 +45,8 @@ export interface CodeGateConfig {
     known_safe_hooks: string[];
     unicode_analysis: boolean;
     check_ide_settings: boolean;
+    /** Emit review findings for MCP servers seen for the first time in a project. */
+    first_scan_review?: boolean;
     owasp_mapping: boolean;
     trusted_api_domains: string[];
     rule_pack_paths?: string[];
@@ -54,6 +59,7 @@ export interface CodeGateConfig {
     persona?: AuditPersona;
     runtime_mode?: RuntimeMode;
     workflow_audits?: WorkflowAuditConfig;
+    registry_heuristics?: RegistryHeuristicsConfig;
     suppress_findings: string[];
     suppression_rules?: SuppressionRule[];
     /**
@@ -72,6 +78,10 @@ export interface CodeGateConfig {
      * `CODEGATE_LAYER3_REMOTE_FETCH_MAX_BYTES`.
      */
     layer3_remote_fetch_max_bytes: number;
+    /** True when the scan target sits inside a globally trusted directory. */
+    project_config_trusted?: boolean;
+    /** Policy keys present in the target's .codegate.json that were ignored because the target is untrusted. */
+    ignored_project_settings?: string[];
 }
 export interface CliConfigOverrides {
     format?: OutputFormat;
@@ -88,6 +98,10 @@ export declare const DEFAULT_CONFIG: CodeGateConfig;
 export declare const LAYER3_REMOTE_FETCH_TIMEOUT_ENV = "CODEGATE_LAYER3_REMOTE_FETCH_TIMEOUT_MS";
 /** Env var name that overrides `layer3_remote_fetch_max_bytes`. */
 export declare const LAYER3_REMOTE_FETCH_MAX_BYTES_ENV = "CODEGATE_LAYER3_REMOTE_FETCH_MAX_BYTES";
+export declare const PROJECT_COSMETIC_KEYS: readonly ["output_format", "tui", "owasp_mapping"];
+export type ProjectCosmeticKey = (typeof PROJECT_COSMETIC_KEYS)[number];
+export declare const PROJECT_FORBIDDEN_KEYS: readonly ["trusted_directories"];
+export type ProjectForbiddenKey = (typeof PROJECT_FORBIDDEN_KEYS)[number];
 export declare function resolveEffectiveConfig(options: ResolveConfigOptions): CodeGateConfig;
 export declare function computeExitCode(findings: Finding[], threshold: SeverityThreshold): number;
 export declare function applyConfigPolicy(report: CodeGateReport, config: CodeGateConfig): CodeGateReport;

package/dist/config.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { parse as parseJsonc } from "jsonc-parser";
+import { isTrustedDirectory } from "./config/trust.js";
 import { applyReportSummary, computeExitCode as computeReportExitCode } from "./report-summary.js";
 import { applySuppressionPolicy, } from "./config/suppression-policy.js";
 export const OUTPUT_FORMATS = ["terminal", "json", "sarif", "markdown", "html"];
@@ -37,6 +38,7 @@ export const DEFAULT_CONFIG = {
     known_safe_hooks: [],
     unicode_analysis: true,
     check_ide_settings: true,
+    first_scan_review: true,
     owasp_mapping: true,
     trusted_api_domains: [],
     rule_pack_paths: [],
@@ -47,6 +49,7 @@ export const DEFAULT_CONFIG = {
     persona: "regular",
     runtime_mode: "offline",
     workflow_audits: { enabled: false },
+    registry_heuristics: { recent_publish_days: 30 },
     suppress_findings: [],
     suppression_rules: [],
     layer3_remote_fetch_timeout_ms: 5000,
@@ -270,12 +273,47 @@ function pickFirst(...values) {
     }
     return undefined;
 }
+// Presentation-only keys the scan target's .codegate.json may always set.
+// Every other key is policy: it changes what is detected, suppressed,
+// executed, or gated, so untrusted targets must not control it.
+export const PROJECT_COSMETIC_KEYS = ["output_format", "tui", "owasp_mapping"];
+// Keys never honored from project config, whether the target is trusted or not.
+export const PROJECT_FORBIDDEN_KEYS = ["trusted_directories"];
+function isProjectCosmeticKey(key) {
+    return PROJECT_COSMETIC_KEYS.includes(key);
+}
+function isProjectForbiddenKey(key) {
+    return PROJECT_FORBIDDEN_KEYS.includes(key);
+}
+function isProjectKeyHonored(key, trusted) {
+    if (isProjectForbiddenKey(key)) {
+        return false;
+    }
+    return trusted || isProjectCosmeticKey(key);
+}
+function partitionProjectConfig(projectConfig, trusted) {
+    const effective = {};
+    const ignoredKeys = [];
+    for (const [key, value] of Object.entries(projectConfig)) {
+        if (value === undefined) {
+            continue;
+        }
+        if (isProjectKeyHonored(key, trusted)) {
+            effective[key] = value;
+            continue;
+        }
+        ignoredKeys.push(key);
+    }
+    return { effective, ignoredKeys: ignoredKeys.sort() };
+}
 export function resolveEffectiveConfig(options) {
     const home = options.homeDir ?? homedir();
     const scanTarget = resolve(options.scanTarget);
     const globalConfigPath = options.cli?.configPath ?? join(home, ".codegate", "config.json");
     const globalConfig = readConfigFile(globalConfigPath);
-    const projectConfig = readConfigFile(join(scanTarget, ".codegate.json"));
+    const rawProjectConfig = readConfigFile(join(scanTarget, ".codegate.json"));
+    const projectConfigTrusted = isTrustedDirectory(scanTarget, unique([DEFAULT_CONFIG.trusted_directories, globalConfig.trusted_directories]));
+    const { effective: projectConfig, ignoredKeys: ignoredProjectSettings } = partitionProjectConfig(rawProjectConfig, projectConfigTrusted);
     const severity_threshold = pickFirst(normalizeSeverityThreshold(undefined), normalizeSeverityThreshold(projectConfig.severity_threshold), normalizeSeverityThreshold(globalConfig.severity_threshold), DEFAULT_CONFIG.severity_threshold) ?? DEFAULT_CONFIG.severity_threshold;
     const output_format = pickFirst(options.cli?.format, normalizeOutputFormat(projectConfig.output_format), normalizeOutputFormat(globalConfig.output_format), DEFAULT_CONFIG.output_format) ?? DEFAULT_CONFIG.output_format;
     return {
@@ -336,6 +374,7 @@ export function resolveEffectiveConfig(options) {
         ]),
         unicode_analysis: pickFirst(projectConfig.unicode_analysis, globalConfig.unicode_analysis, DEFAULT_CONFIG.unicode_analysis) ?? DEFAULT_CONFIG.unicode_analysis,
         check_ide_settings: pickFirst(projectConfig.check_ide_settings, globalConfig.check_ide_settings, DEFAULT_CONFIG.check_ide_settings) ?? DEFAULT_CONFIG.check_ide_settings,
+        first_scan_review: pickFirst(projectConfig.first_scan_review, globalConfig.first_scan_review, DEFAULT_CONFIG.first_scan_review) ?? true,
         owasp_mapping: pickFirst(projectConfig.owasp_mapping, globalConfig.owasp_mapping, DEFAULT_CONFIG.owasp_mapping) ?? DEFAULT_CONFIG.owasp_mapping,
         trusted_api_domains: unique([
             DEFAULT_CONFIG.trusted_api_domains,
@@ -366,6 +405,9 @@ export function resolveEffectiveConfig(options) {
         workflow_audits: {
             enabled: pickFirst(projectConfig.workflow_audits?.enabled, globalConfig.workflow_audits?.enabled, DEFAULT_CONFIG.workflow_audits?.enabled) ?? false,
         },
+        registry_heuristics: {
+            recent_publish_days: pickFirst(projectConfig.registry_heuristics?.recent_publish_days, globalConfig.registry_heuristics?.recent_publish_days, DEFAULT_CONFIG.registry_heuristics?.recent_publish_days) ?? 30,
+        },
         suppress_findings: unique([
             DEFAULT_CONFIG.suppress_findings,
             globalConfig.suppress_findings,
@@ -378,6 +420,8 @@ export function resolveEffectiveConfig(options) {
         ],
         layer3_remote_fetch_timeout_ms: pickFirst(readEnvOverride(LAYER3_REMOTE_FETCH_TIMEOUT_ENV), normalizePositiveInteger(projectConfig.layer3_remote_fetch_timeout_ms), normalizePositiveInteger(globalConfig.layer3_remote_fetch_timeout_ms), DEFAULT_CONFIG.layer3_remote_fetch_timeout_ms) ?? DEFAULT_CONFIG.layer3_remote_fetch_timeout_ms,
         layer3_remote_fetch_max_bytes: pickFirst(readEnvOverride(LAYER3_REMOTE_FETCH_MAX_BYTES_ENV), normalizePositiveInteger(projectConfig.layer3_remote_fetch_max_bytes), normalizePositiveInteger(globalConfig.layer3_remote_fetch_max_bytes), DEFAULT_CONFIG.layer3_remote_fetch_max_bytes) ?? DEFAULT_CONFIG.layer3_remote_fetch_max_bytes,
+        project_config_trusted: projectConfigTrusted,
+        ignored_project_settings: ignoredProjectSettings.length > 0 ? ignoredProjectSettings : undefined,
     };
 }
 export function computeExitCode(findings, threshold) {