codegate-ai 0.16.2 → 1.0.0

package/dist/content/content-bundle.d.ts

@@ -0,0 +1,27 @@
+import type { KnowledgeBaseEntry } from "../layer1-discovery/knowledge-base.js";
+import type { OverridePhrase } from "../layer2-static/text/override-phrases.js";
+export declare const CONTENT_BUNDLE_SCHEMA_VERSION = "1";
+export declare const KNOWN_BAD_INDICATOR_KEYS: readonly ["file_sha256", "package_names", "url_patterns", "finding_fingerprints"];
+export type KnownBadIndicatorKey = (typeof KNOWN_BAD_INDICATOR_KEYS)[number];
+export type KnownBadIndicators = Partial<Record<KnownBadIndicatorKey, string[]>>;
+export interface ContentBundle {
+    schema_version: string;
+    content_version: string;
+    released_at: string;
+    kb_schema_version?: string;
+    kb_entries?: KnowledgeBaseEntry[];
+    rules?: unknown[];
+    override_phrases?: OverridePhrase[];
+    popular_packages?: {
+        npm?: string[];
+        pypi?: string[];
+    };
+    known_bad?: KnownBadIndicators;
+}
+/**
+ * Verify the detached Ed25519 signature over the exact bundle bytes.
+ * Verification always happens BEFORE parsing untrusted bytes.
+ */
+export declare function verifyBundleSignature(bundleBytes: Buffer, signatureBase64: string, publicKeyPem: string): boolean;
+/** Structural validation of a verified bundle. Throws with a clear reason. */
+export declare function parseContentBundle(bundleBytes: Buffer): ContentBundle;

package/dist/content/content-bundle.js

@@ -0,0 +1,73 @@
+import { createPublicKey, verify as cryptoVerify } from "node:crypto";
+export const CONTENT_BUNDLE_SCHEMA_VERSION = "1";
+export const KNOWN_BAD_INDICATOR_KEYS = [
+    "file_sha256",
+    "package_names",
+    "url_patterns",
+    "finding_fingerprints",
+];
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+/**
+ * Verify the detached Ed25519 signature over the exact bundle bytes.
+ * Verification always happens BEFORE parsing untrusted bytes.
+ */
+export function verifyBundleSignature(bundleBytes, signatureBase64, publicKeyPem) {
+    try {
+        const key = createPublicKey(publicKeyPem);
+        const signature = Buffer.from(signatureBase64.trim(), "base64");
+        return cryptoVerify(null, bundleBytes, key, signature);
+    }
+    catch {
+        return false;
+    }
+}
+/** Structural validation of a verified bundle. Throws with a clear reason. */
+export function parseContentBundle(bundleBytes) {
+    let parsed;
+    try {
+        parsed = JSON.parse(bundleBytes.toString("utf8"));
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Content bundle is not valid JSON: ${reason}`, { cause: error });
+    }
+    if (!isRecord(parsed)) {
+        throw new Error("Content bundle must be a JSON object");
+    }
+    if (parsed.schema_version !== CONTENT_BUNDLE_SCHEMA_VERSION) {
+        throw new Error(`Unsupported content bundle schema_version: ${String(parsed.schema_version)} ` +
+            `(this build supports ${CONTENT_BUNDLE_SCHEMA_VERSION})`);
+    }
+    if (typeof parsed.content_version !== "string" || parsed.content_version.length === 0) {
+        throw new Error("Content bundle is missing content_version");
+    }
+    if (typeof parsed.released_at !== "string" || Number.isNaN(Date.parse(parsed.released_at))) {
+        throw new Error("Content bundle is missing a valid released_at timestamp");
+    }
+    if (parsed.kb_entries !== undefined && !Array.isArray(parsed.kb_entries)) {
+        throw new Error("Content bundle kb_entries must be an array");
+    }
+    if (parsed.rules !== undefined && !Array.isArray(parsed.rules)) {
+        throw new Error("Content bundle rules must be an array");
+    }
+    if (parsed.override_phrases !== undefined && !Array.isArray(parsed.override_phrases)) {
+        throw new Error("Content bundle override_phrases must be an array");
+    }
+    if (parsed.known_bad !== undefined) {
+        if (!isRecord(parsed.known_bad)) {
+            throw new Error("Content bundle known_bad must be an object");
+        }
+        for (const key of KNOWN_BAD_INDICATOR_KEYS) {
+            const list = parsed.known_bad[key];
+            if (list !== undefined && !isStringArray(list)) {
+                throw new Error(`Content bundle known_bad.${key} must be an array of strings`);
+            }
+        }
+    }
+    return parsed;
+}

package/dist/content/content-store.d.ts

@@ -0,0 +1,27 @@
+import { type ContentBundle } from "./content-bundle.js";
+export interface ContentStoreDeps {
+    homeDir?: () => string;
+    publisherKeyPem?: string | null;
+}
+export interface InstalledContentVersion {
+    version: string;
+    releasedAt: string;
+}
+/** Installed versions, newest first by released_at. */
+export declare function listInstalledContentVersions(deps?: ContentStoreDeps): InstalledContentVersion[];
+export declare function getActiveContentVersion(deps?: ContentStoreDeps): string | null;
+export declare function setActiveContentVersion(version: string, deps?: ContentStoreDeps): void;
+export interface StoredContentVersion {
+    version: string;
+    pruned: string[];
+}
+/** Persist a verified bundle, activate it, and prune old versions. */
+export declare function storeContentVersion(bundle: ContentBundle, bundleBytes: Buffer, signatureBase64: string, deps?: ContentStoreDeps): StoredContentVersion;
+export declare function resetContentStoreCache(): void;
+/**
+ * Load the active, signature-verified content bundle, or null when no
+ * publisher key is configured, nothing is installed, or verification or
+ * parsing fails. Never throws: content-feed problems must degrade to
+ * bundled content, not break scanning.
+ */
+export declare function loadActiveContentBundle(deps?: ContentStoreDeps): ContentBundle | null;

package/dist/content/content-updater.d.ts

@@ -0,0 +1,32 @@
+import { type ContentStoreDeps } from "./content-store.js";
+/**
+ * Explicit, user-initiated content updates. Scanning never triggers a
+ * fetch; these functions run only from the update-kb/update-rules commands.
+ * Integrity comes from the Ed25519 signature (verified before parsing),
+ * not from the transport, so release-hosting redirects are acceptable —
+ * but the URL must be https.
+ */
+export declare const DEFAULT_CONTENT_BASE_URL = "https://github.com/jonathansantilli/codegate-content/releases/latest/download";
+export interface ContentUpdaterDeps extends ContentStoreDeps {
+    fetchImpl?: typeof fetch;
+}
+export interface ContentUpdateOptions {
+    baseUrl?: string;
+}
+export interface ContentUpdateResult {
+    changed: boolean;
+    previousVersion: string | null;
+    version: string;
+    pruned: string[];
+}
+export declare function updateContent(deps?: ContentUpdaterDeps, options?: ContentUpdateOptions): Promise<ContentUpdateResult>;
+export interface ContentCheckResult {
+    currentVersion: string | null;
+    remoteVersion: string;
+    updateAvailable: boolean;
+}
+export declare function checkContentUpdate(deps?: ContentUpdaterDeps, options?: ContentUpdateOptions): Promise<ContentCheckResult>;
+export interface ContentRollbackResult {
+    version: string;
+}
+export declare function rollbackContent(deps?: ContentUpdaterDeps): ContentRollbackResult;

package/dist/content/content-updater.js

@@ -0,0 +1,111 @@
+import { parseContentBundle, verifyBundleSignature } from "./content-bundle.js";
+import { getActiveContentVersion, listInstalledContentVersions, setActiveContentVersion, storeContentVersion, } from "./content-store.js";
+import { CONTENT_PUBLISHER_PUBLIC_KEY_PEM } from "./publisher-key.js";
+/**
+ * Explicit, user-initiated content updates. Scanning never triggers a
+ * fetch; these functions run only from the update-kb/update-rules commands.
+ * Integrity comes from the Ed25519 signature (verified before parsing),
+ * not from the transport, so release-hosting redirects are acceptable —
+ * but the URL must be https.
+ */
+export const DEFAULT_CONTENT_BASE_URL = "https://github.com/jonathansantilli/codegate-content/releases/latest/download";
+const BUNDLE_NAME = "codegate-content.json";
+const FETCH_TIMEOUT_MS = 15_000;
+const MAX_BUNDLE_BYTES = 8 * 1024 * 1024;
+const MAX_SIGNATURE_BYTES = 4096;
+function requirePublisherKey(deps) {
+    const key = deps.publisherKeyPem !== undefined ? deps.publisherKeyPem : CONTENT_PUBLISHER_PUBLIC_KEY_PEM;
+    if (!key) {
+        throw new Error("No content publisher key is configured in this build, so remote content cannot be " +
+            "verified. Content updates ship with CodeGate releases: npm update -g codegate-ai");
+    }
+    return key;
+}
+async function fetchBytes(url, maxBytes, deps) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") {
+        throw new Error(`Content URL must use https: ${url}`);
+    }
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const response = await fetchImpl(url, {
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        throw new Error(`Content download failed with HTTP ${response.status} for ${url}`);
+    }
+    const contentLength = response.headers.get("content-length");
+    if (contentLength && Number.parseInt(contentLength, 10) > maxBytes) {
+        throw new Error(`Content download exceeds ${maxBytes} bytes: ${url}`);
+    }
+    const body = response.body;
+    if (!body) {
+        const buffer = Buffer.from(await response.arrayBuffer());
+        if (buffer.byteLength > maxBytes) {
+            throw new Error(`Content download exceeds ${maxBytes} bytes: ${url}`);
+        }
+        return buffer;
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new Error(`Content download exceeds ${maxBytes} bytes: ${url}`);
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+}
+async function fetchAndVerifyBundle(deps, options) {
+    const key = requirePublisherKey(deps);
+    const baseUrl = (options.baseUrl ?? DEFAULT_CONTENT_BASE_URL).replace(/\/+$/u, "");
+    const bundleBytes = await fetchBytes(`${baseUrl}/${BUNDLE_NAME}`, MAX_BUNDLE_BYTES, deps);
+    const signature = (await fetchBytes(`${baseUrl}/${BUNDLE_NAME}.sig`, MAX_SIGNATURE_BYTES, deps)).toString("utf8");
+    if (!verifyBundleSignature(bundleBytes, signature, key)) {
+        throw new Error("Content bundle signature verification failed. The download was rejected and nothing was installed.");
+    }
+    // Parse only after the signature proved the bytes came from the publisher.
+    const bundle = parseContentBundle(bundleBytes);
+    return { bundleBytes, signature, version: bundle.content_version };
+}
+export async function updateContent(deps = {}, options = {}) {
+    const fetched = await fetchAndVerifyBundle(deps, options);
+    const previousVersion = getActiveContentVersion(deps);
+    if (previousVersion === fetched.version) {
+        return { changed: false, previousVersion, version: fetched.version, pruned: [] };
+    }
+    const bundle = parseContentBundle(fetched.bundleBytes);
+    const stored = storeContentVersion(bundle, fetched.bundleBytes, fetched.signature, deps);
+    return {
+        changed: true,
+        previousVersion,
+        version: stored.version,
+        pruned: stored.pruned,
+    };
+}
+export async function checkContentUpdate(deps = {}, options = {}) {
+    const fetched = await fetchAndVerifyBundle(deps, options);
+    const currentVersion = getActiveContentVersion(deps);
+    return {
+        currentVersion,
+        remoteVersion: fetched.version,
+        updateAvailable: currentVersion !== fetched.version,
+    };
+}
+export function rollbackContent(deps = {}) {
+    const installed = listInstalledContentVersions(deps);
+    const active = getActiveContentVersion(deps);
+    const candidates = installed.filter((entry) => entry.version !== active);
+    const target = candidates[0];
+    if (!target) {
+        throw new Error("No previous content version is installed to roll back to.");
+    }
+    setActiveContentVersion(target.version, deps);
+    return { version: target.version };
+}

package/dist/content/known-bad.d.ts

@@ -0,0 +1,26 @@
+export interface KnownBadDeps {
+    homeDir?: () => string;
+}
+/**
+ * Indicators normalized for matching: hashes and package names lowercased,
+ * fingerprints carrying the `sha256:` prefix used by finding fingerprints.
+ */
+export interface ResolvedKnownBadIndicators {
+    fileSha256: ReadonlySet<string>;
+    packageNames: ReadonlySet<string>;
+    urlPatterns: readonly string[];
+    findingFingerprints: ReadonlySet<string>;
+}
+export declare function hasKnownBadIndicators(indicators: ResolvedKnownBadIndicators): boolean;
+/** Accepts `sha256:<hex>` or bare hex; returns bare lowercase hex or null. */
+export declare function normalizeSha256Indicator(value: string): string | null;
+/** Finding fingerprints are stored and compared with the `sha256:` prefix. */
+export declare function normalizeFingerprintIndicator(value: string): string | null;
+export declare function resetKnownBadIndicatorsCache(): void;
+/**
+ * Known-bad indicators merged from the verified content feed and the local
+ * `~/.codegate/known-bad.json`. The local file is user-controlled (same trust
+ * as the global config) and exists so indicators work before the feed is
+ * live. Never throws: indicator problems must not break scanning.
+ */
+export declare function loadKnownBadIndicators(deps?: KnownBadDeps): ResolvedKnownBadIndicators;

package/dist/content/known-bad.js

@@ -0,0 +1,100 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { KNOWN_BAD_INDICATOR_KEYS, } from "./content-bundle.js";
+import { loadActiveContentBundle } from "./content-store.js";
+const LOCAL_INDICATORS_FILE = "known-bad.json";
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/u;
+const SHA256_PREFIX = "sha256:";
+export function hasKnownBadIndicators(indicators) {
+    return (indicators.fileSha256.size > 0 ||
+        indicators.packageNames.size > 0 ||
+        indicators.urlPatterns.length > 0 ||
+        indicators.findingFingerprints.size > 0);
+}
+/** Accepts `sha256:<hex>` or bare hex; returns bare lowercase hex or null. */
+export function normalizeSha256Indicator(value) {
+    const trimmed = value.trim().toLowerCase();
+    const bare = trimmed.startsWith(SHA256_PREFIX) ? trimmed.slice(SHA256_PREFIX.length) : trimmed;
+    return SHA256_HEX_PATTERN.test(bare) ? bare : null;
+}
+/** Finding fingerprints are stored and compared with the `sha256:` prefix. */
+export function normalizeFingerprintIndicator(value) {
+    const bare = normalizeSha256Indicator(value);
+    return bare === null ? null : `${SHA256_PREFIX}${bare}`;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Keep only well-formed string lists; anything else degrades to empty. */
+function sanitizeIndicators(value) {
+    if (!isRecord(value)) {
+        return {};
+    }
+    const sanitized = {};
+    for (const key of KNOWN_BAD_INDICATOR_KEYS) {
+        const list = value[key];
+        if (Array.isArray(list)) {
+            sanitized[key] = list.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+        }
+    }
+    return sanitized;
+}
+function loadLocalIndicators(deps) {
+    const home = deps.homeDir ? deps.homeDir() : homedir();
+    try {
+        const raw = readFileSync(join(home, ".codegate", LOCAL_INDICATORS_FILE), "utf8");
+        return sanitizeIndicators(JSON.parse(raw));
+    }
+    catch {
+        return {};
+    }
+}
+function indicatorList(sources, key) {
+    return sources.flatMap((source) => source[key] ?? []);
+}
+function resolveIndicators(sources) {
+    const fileSha256 = new Set();
+    for (const entry of indicatorList(sources, "file_sha256")) {
+        const normalized = normalizeSha256Indicator(entry);
+        if (normalized) {
+            fileSha256.add(normalized);
+        }
+    }
+    const packageNames = new Set(indicatorList(sources, "package_names").map((entry) => entry.trim().toLowerCase()));
+    const urlPatterns = Array.from(new Set(indicatorList(sources, "url_patterns").map((entry) => entry.trim().toLowerCase())));
+    const findingFingerprints = new Set();
+    for (const entry of indicatorList(sources, "finding_fingerprints")) {
+        const normalized = normalizeFingerprintIndicator(entry);
+        if (normalized) {
+            findingFingerprints.add(normalized);
+        }
+    }
+    return { fileSha256, packageNames, urlPatterns, findingFingerprints };
+}
+let cache = null;
+export function resetKnownBadIndicatorsCache() {
+    cache = null;
+}
+/**
+ * Known-bad indicators merged from the verified content feed and the local
+ * `~/.codegate/known-bad.json`. The local file is user-controlled (same trust
+ * as the global config) and exists so indicators work before the feed is
+ * live. Never throws: indicator problems must not break scanning.
+ */
+export function loadKnownBadIndicators(deps = {}) {
+    const home = deps.homeDir ? deps.homeDir() : homedir();
+    if (cache && cache.key === home) {
+        return cache.indicators;
+    }
+    let feedIndicators;
+    try {
+        feedIndicators = sanitizeIndicators(loadActiveContentBundle()?.known_bad);
+    }
+    catch {
+        feedIndicators = {};
+    }
+    const indicators = resolveIndicators([feedIndicators, loadLocalIndicators(deps)]);
+    cache = { key: home, indicators };
+    return indicators;
+}

package/dist/content/publisher-key.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ed25519 public key of the CodeGate content publisher, PEM (SPKI) format.
+ *
+ * Deliberately null until the owner decides key custody and the content
+ * repository location (see docs/content-feed.md). While null, the update
+ * commands refuse to fetch and every loader uses only bundled content.
+ * Generate a pair with scripts/content-feed/generate-keypair.mjs and paste
+ * the public PEM here.
+ */
+export declare const CONTENT_PUBLISHER_PUBLIC_KEY_PEM: string | null;

package/dist/content/publisher-key.js

@@ -0,0 +1,10 @@
+/**
+ * Ed25519 public key of the CodeGate content publisher, PEM (SPKI) format.
+ *
+ * Deliberately null until the owner decides key custody and the content
+ * repository location (see docs/content-feed.md). While null, the update
+ * commands refuse to fetch and every loader uses only bundled content.
+ * Generate a pair with scripts/content-feed/generate-keypair.mjs and paste
+ * the public PEM here.
+ */
+export const CONTENT_PUBLISHER_PUBLIC_KEY_PEM = null;

package/dist/layer1-discovery/knowledge-base.js

@@ -2,6 +2,7 @@ import { readdirSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, extname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { loadActiveContentBundle } from "../content/content-store.js";
 const defaultKnowledgeBaseDir = resolve(dirname(fileURLToPath(import.meta.url)), "../knowledge-base");
 const schemaPath = join(defaultKnowledgeBaseDir, "schema.json");
 const require = createRequire(import.meta.url);
@@ -32,7 +33,38 @@ export function validateKnowledgeBaseEntry(candidate, path = schemaPath) {
         errors: toErrors(validator.errors),
     };
 }
-export function loadKnowledgeBase(baseDir = defaultKnowledgeBaseDir) {
+function loadKnowledgeBaseFromContentFeed() {
+    try {
+        const bundle = loadActiveContentBundle();
+        if (!bundle?.kb_entries || bundle.kb_entries.length === 0) {
+            return null;
+        }
+        const validator = createValidator(schemaPath);
+        for (const entry of bundle.kb_entries) {
+            if (!validator(entry)) {
+                // One invalid feed entry disqualifies the whole feed KB; bundled
+                // content is the safe fallback.
+                return null;
+            }
+        }
+        return {
+            schemaVersion: bundle.kb_schema_version ?? `feed-${bundle.content_version}`,
+            entries: bundle.kb_entries,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function loadKnowledgeBase(baseDir) {
+    // An explicit baseDir bypasses the content feed (tests, custom setups).
+    if (baseDir === undefined) {
+        const fromFeed = loadKnowledgeBaseFromContentFeed();
+        if (fromFeed) {
+            return fromFeed;
+        }
+        baseDir = defaultKnowledgeBaseDir;
+    }
     const schema = loadSchema(join(baseDir, "schema.json"));
     const validator = createValidator(join(baseDir, "schema.json"));
     const entryFiles = readdirSync(baseDir)

package/dist/layer2-static/data/popular-mcp-packages.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Well-known MCP server packages used as the reference set for typosquat
+ * detection. Curated, not exhaustive: entries should be packages an
+ * attacker would plausibly imitate. Data-driven so the content feed can
+ * extend it without a release.
+ */
+export declare const POPULAR_MCP_PACKAGES: Readonly<{
+    npm: readonly string[];
+    pypi: readonly string[];
+}>;
+export declare function resetActivePopularMcpPackagesCache(): void;
+/** Bundled popular packages plus any extras delivered by the verified content feed. */
+export declare function activePopularMcpPackages(): {
+    npm: readonly string[];
+    pypi: readonly string[];
+};

package/dist/layer2-static/data/popular-mcp-packages.js

@@ -0,0 +1,83 @@
+import { loadActiveContentBundle } from "../../content/content-store.js";
+/**
+ * Well-known MCP server packages used as the reference set for typosquat
+ * detection. Curated, not exhaustive: entries should be packages an
+ * attacker would plausibly imitate. Data-driven so the content feed can
+ * extend it without a release.
+ */
+export const POPULAR_MCP_PACKAGES = {
+    npm: [
+        "@modelcontextprotocol/server-brave-search",
+        "@modelcontextprotocol/server-everything",
+        "@modelcontextprotocol/server-filesystem",
+        "@modelcontextprotocol/server-github",
+        "@modelcontextprotocol/server-gitlab",
+        "@modelcontextprotocol/server-google-maps",
+        "@modelcontextprotocol/server-memory",
+        "@modelcontextprotocol/server-postgres",
+        "@modelcontextprotocol/server-puppeteer",
+        "@modelcontextprotocol/server-sequential-thinking",
+        "@modelcontextprotocol/server-slack",
+        "@modelcontextprotocol/server-sqlite",
+        "@modelcontextprotocol/inspector",
+        "@anthropic/mcp-server-filesystem",
+        "@playwright/mcp",
+        "@browserbasehq/mcp",
+        "@notionhq/notion-mcp-server",
+        "@supabase/mcp-server-supabase",
+        "@upstash/context7-mcp",
+        "@21st-dev/magic",
+        "@sentry/mcp-server",
+        "@elastic/mcp-server-elasticsearch",
+        "firecrawl-mcp",
+        "tavily-mcp",
+        "exa-mcp-server",
+        "mcp-remote",
+        "supergateway",
+        "figma-developer-mcp",
+        "chrome-devtools-mcp",
+        "graphlit-mcp-server",
+    ],
+    pypi: [
+        "mcp",
+        "mcp-server-git",
+        "mcp-server-fetch",
+        "mcp-server-time",
+        "mcp-server-sqlite",
+        "mcp-server-sentry",
+        "fastmcp",
+        "mcp-atlassian",
+        "awslabs.aws-documentation-mcp-server",
+    ],
+};
+let cachedActivePackages = null;
+export function resetActivePopularMcpPackagesCache() {
+    cachedActivePackages = null;
+}
+function feedList(value) {
+    return Array.isArray(value)
+        ? value.filter((entry) => typeof entry === "string" && entry.length > 0)
+        : [];
+}
+/** Bundled popular packages plus any extras delivered by the verified content feed. */
+export function activePopularMcpPackages() {
+    if (cachedActivePackages) {
+        return cachedActivePackages;
+    }
+    let npmExtra;
+    let pypiExtra;
+    try {
+        const bundle = loadActiveContentBundle();
+        npmExtra = feedList(bundle?.popular_packages?.npm);
+        pypiExtra = feedList(bundle?.popular_packages?.pypi);
+    }
+    catch {
+        npmExtra = [];
+        pypiExtra = [];
+    }
+    cachedActivePackages = {
+        npm: [...new Set([...POPULAR_MCP_PACKAGES.npm, ...npmExtra])],
+        pypi: [...new Set([...POPULAR_MCP_PACKAGES.pypi, ...pypiExtra])],
+    };
+    return cachedActivePackages;
+}

package/dist/layer2-static/detectors/known-bad.d.ts

@@ -0,0 +1,22 @@
+import { type ResolvedKnownBadIndicators } from "../../content/known-bad.js";
+import type { Finding } from "../../types/finding.js";
+export interface KnownBadDetectionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+    indicators: ResolvedKnownBadIndicators;
+}
+export declare const KNOWN_BAD_MATCH_KIND: {
+    readonly FileHash: "file-hash";
+    readonly PackageName: "package-name";
+    readonly UrlPattern: "url-pattern";
+};
+export type KnownBadMatchKind = (typeof KNOWN_BAD_MATCH_KIND)[keyof typeof KNOWN_BAD_MATCH_KIND];
+export declare const KNOWN_BAD_RULE_ID = "known-malicious-content";
+export declare function detectKnownBadContent(input: KnownBadDetectionInput): Finding[];
+/**
+ * Escalate findings whose stable fingerprint appears in the known-bad
+ * indicator set to CRITICAL. Runs on the assembled finding list so it also
+ * covers findings produced outside the static engine.
+ */
+export declare function escalateKnownBadFindings(findings: Finding[], indicators: ResolvedKnownBadIndicators): Finding[];