codegate-ai 0.16.2 → 1.0.0

package/dist/layer3-dynamic/tool-description-scanner.js

@@ -1,8 +1,7 @@
-const HIDDEN_UNICODE = /[\u200B-\u200D\u2060\uFEFF]/u;
-const SENSITIVE_FILE_PATTERN = /(~\/\.ssh|~\/\.aws|id_rsa|\.env|credentials|\.git-credentials)/iu;
-const EXFIL_PATTERN = /(send .*https?:\/\/|upload|webhook|post to|exfiltrat)/iu;
-const OVERRIDE_PATTERN = /(ignore previous instructions|bypass safety|disable guardrails)/iu;
-const EXEC_PATTERN = /(run command|execute shell|bash -c|sh -c|powershell)/iu;
+import { scanEncodedPayloads } from "../layer2-static/text/encoded-payloads.js";
+import { normalizeForMatching } from "../layer2-static/text/normalize.js";
+import { COMMAND_EXECUTION_PATTERN, EXFIL_PATTERN, SENSITIVE_FILE_PATTERN, findOverridePhrase, } from "../layer2-static/text/threat-patterns.js";
+import { HIDDEN_UNICODE_CLASS, findHiddenUnicode } from "../layer2-static/text/unicode.js";
 function makeFinding(input, tool, ruleId, severity, description) {
     return {
         rule_id: ruleId,
@@ -27,24 +26,34 @@ export function scanToolDescriptions(input) {
     const findings = [];
     for (const tool of input.tools) {
         const text = tool.description;
-        const hasSensitive = SENSITIVE_FILE_PATTERN.test(text);
-        const hasExfil = EXFIL_PATTERN.test(text);
-        const hasOverride = OVERRIDE_PATTERN.test(text);
-        const hasExec = EXEC_PATTERN.test(text);
-        const hasUnicode = input.unicodeAnalysis === false ? false : HIDDEN_UNICODE.test(text);
+        const normalized = normalizeForMatching(text);
+        const hasSensitive = SENSITIVE_FILE_PATTERN.test(normalized);
+        const hasExfil = EXFIL_PATTERN.test(normalized);
+        const overrideMatch = findOverridePhrase(normalized);
+        const hasExec = COMMAND_EXECUTION_PATTERN.test(normalized);
+        const hiddenMatches = input.unicodeAnalysis === false ? [] : findHiddenUnicode(text);
+        const tagMatches = hiddenMatches.filter((match) => match.class === HIDDEN_UNICODE_CLASS.Tags);
+        const otherHiddenMatches = hiddenMatches.filter((match) => match.class !== HIDDEN_UNICODE_CLASS.Tags);
         const isLong = text.length > 1000;
         if (hasSensitive && hasExfil) {
             findings.push(makeFinding(input, tool, "tool-description-sensitive-exfiltration", "CRITICAL", `Tool description references sensitive file access with exfiltration behavior: ${tool.name}`));
         }
-        if (hasOverride) {
-            findings.push(makeFinding(input, tool, "tool-description-instruction-override", "HIGH", `Tool description contains instruction-override language: ${tool.name}`));
+        if (overrideMatch) {
+            findings.push(makeFinding(input, tool, "tool-description-instruction-override", "HIGH", `Tool description contains instruction-override language ("${overrideMatch.phrase}"): ${tool.name}`));
         }
         if (hasExec) {
             findings.push(makeFinding(input, tool, "tool-description-command-execution", "HIGH", `Tool description encourages command execution patterns: ${tool.name}`));
         }
-        if (hasUnicode) {
+        if (otherHiddenMatches.length > 0) {
             findings.push(makeFinding(input, tool, "tool-description-hidden-unicode", "MEDIUM", `Tool description includes hidden Unicode characters: ${tool.name}`));
         }
+        if (tagMatches.length > 0) {
+            findings.push(makeFinding(input, tool, "tool-description-hidden-unicode-tags", "HIGH", `Tool description includes ${tagMatches.length} Unicode tag character(s) ` +
+                `(U+E0000-U+E007F, ASCII smuggling): ${tool.name}`));
+        }
+        for (const payload of scanEncodedPayloads(text)) {
+            findings.push(makeFinding(input, tool, "tool-description-encoded-payload", payload.matchesRemoteShell ? "CRITICAL" : "HIGH", `Tool description contains a ${payload.kind}-encoded payload with hidden instructions: ${tool.name}`));
+        }
         if (isLong) {
             findings.push(makeFinding(input, tool, "tool-description-unusually-long", "MEDIUM", `Tool description is unusually long and may hide instructions: ${tool.name}`));
         }

package/dist/layer3-dynamic/toxic-flow.d.ts

@@ -8,5 +8,9 @@ export interface ToxicFlowInput {
     scopeId: string;
     tools: ToxicFlowTool[];
     knownClassifications?: Record<string, ToxicToolClass[]>;
+    /** Maps tool name to its origin server, for cross-server workspace analysis. */
+    origins?: Record<string, string>;
+    /** Only report chains spanning at least two distinct origins. */
+    crossOriginOnly?: boolean;
 }
 export declare function detectToxicFlows(input: ToxicFlowInput): Finding[];

package/dist/layer3-dynamic/toxic-flow.js

@@ -1,3 +1,4 @@
+const MAX_REPORTED_CHAINS = 10;
 function classifyByDescription(description) {
     const classes = new Set();
     const text = description.toLowerCase();
@@ -25,16 +26,20 @@ function classifyTools(input) {
         return { tool, classes };
     });
 }
+function describeTool(input, toolName) {
+    const origin = input.origins?.[toolName];
+    return origin ? `${toolName} (server: ${origin})` : toolName;
+}
 function makeFinding(input, sourceTool, sensitiveTool, sinkTool) {
     return {
         rule_id: "toxic-flow-chain-detected",
-        finding_id: `TOXIC_FLOW-${sourceTool}-${sensitiveTool}-${sinkTool}`,
+        finding_id: `TOXIC_FLOW-${input.scopeId}-${sourceTool}-${sensitiveTool}-${sinkTool}`,
         severity: "CRITICAL",
         category: "TOXIC_FLOW",
         layer: "L3",
         file_path: input.scopeId,
         location: { field: "tool_interaction_graph" },
-        description: `Toxic Flow detected: ${sourceTool} -> ${sensitiveTool} -> ${sinkTool}. This chain can propagate untrusted input into sensitive data access and external exfiltration.`,
+        description: `Toxic Flow detected: ${describeTool(input, sourceTool)} -> ${describeTool(input, sensitiveTool)} -> ${describeTool(input, sinkTool)}. This chain can propagate untrusted input into sensitive data access and external exfiltration.`,
         affected_tools: [],
         cve: null,
         owasp: ["ASI08"],
@@ -51,13 +56,41 @@ function makeFinding(input, sourceTool, sensitiveTool, sinkTool) {
         suppressed: false,
     };
 }
+function distinctOriginCount(input, toolNames) {
+    const origins = new Set();
+    for (const name of toolNames) {
+        const origin = input.origins?.[name];
+        if (origin) {
+            origins.add(origin);
+        }
+    }
+    return origins.size;
+}
 export function detectToxicFlows(input) {
     const classified = classifyTools(input);
-    const untrusted = classified.find((entry) => entry.classes.has("untrusted_input"))?.tool.name;
-    const sensitive = classified.find((entry) => entry.classes.has("sensitive_access"))?.tool.name;
-    const exfil = classified.find((entry) => entry.classes.has("exfiltration_sink"))?.tool.name;
-    if (!untrusted || !sensitive || !exfil) {
-        return [];
+    const untrusted = classified
+        .filter((entry) => entry.classes.has("untrusted_input"))
+        .map((entry) => entry.tool.name);
+    const sensitive = classified
+        .filter((entry) => entry.classes.has("sensitive_access"))
+        .map((entry) => entry.tool.name);
+    const exfil = classified
+        .filter((entry) => entry.classes.has("exfiltration_sink"))
+        .map((entry) => entry.tool.name);
+    const findings = [];
+    for (const source of untrusted) {
+        for (const sensitiveTool of sensitive) {
+            for (const sink of exfil) {
+                if (findings.length >= MAX_REPORTED_CHAINS) {
+                    return findings;
+                }
+                if (input.crossOriginOnly &&
+                    distinctOriginCount(input, [source, sensitiveTool, sink]) < 2) {
+                    continue;
+                }
+                findings.push(makeFinding(input, source, sensitiveTool, sink));
+            }
+        }
     }
-    return [makeFinding(input, untrusted, sensitive, exfil)];
+    return findings;
 }

package/dist/pipeline.d.ts

@@ -3,6 +3,7 @@ import { type CodeGateReport } from "./types/report.js";
 import type { GitHookEntry } from "./layer2-static/detectors/git-hooks.js";
 import type { SymlinkEscapeEntry } from "./layer2-static/detectors/symlink.js";
 import type { ResourceFetchResult, ResourceRequest } from "./layer3-dynamic/resource-fetcher.js";
+import { type RegistryHeuristicsOptions } from "./layer3-dynamic/registry-findings.js";
 import type { Finding } from "./types/finding.js";
 export interface StaticPipelineInput {
     version: string;
@@ -27,8 +28,10 @@ export interface DeepScanOutcome {
     result?: ResourceFetchResult;
 }
 export declare function runStaticPipeline(input: StaticPipelineInput): Promise<CodeGateReport>;
-export declare function layer3OutcomesToFindings(outcomes: DeepScanOutcome[], options?: {
+export interface Layer3FindingOptions {
     unicodeAnalysis?: boolean;
-}): Finding[];
+    registryHeuristics?: RegistryHeuristicsOptions;
+}
+export declare function layer3OutcomesToFindings(outcomes: DeepScanOutcome[], options?: Layer3FindingOptions): Finding[];
 export declare function mergeLayer3Findings(baseReport: CodeGateReport, layer3Findings: Finding[]): CodeGateReport;
 export declare function runDeepScanWithConsent(resources: DeepScanResource[], requestConsent: (resource: DeepScanResource) => Promise<boolean> | boolean, execute: (resource: DeepScanResource) => Promise<ResourceFetchResult>): Promise<DeepScanOutcome[]>;

package/dist/pipeline.js

@@ -2,6 +2,7 @@ import { runStaticEngine, } from "./layer2-static/engine.js";
 import { createEmptyReport } from "./types/report.js";
 import { scanToolDescriptions, } from "./layer3-dynamic/tool-description-scanner.js";
 import { detectToxicFlows } from "./layer3-dynamic/toxic-flow.js";
+import { deriveRegistryFindings, } from "./layer3-dynamic/registry-findings.js";
 import { applyReportSummary } from "./report-summary.js";
 import { withFindingFingerprint } from "./report/finding-fingerprint.js";
 export async function runStaticPipeline(input) {
@@ -158,28 +159,32 @@ function parseToolClassifications(metadata, tools) {
     }
     return map;
 }
-function deriveLayer3ToolFindings(resourceId, metadata, options = {}) {
+function analyzeLayer3Tools(resourceId, metadata, options = {}) {
     const toolEntries = parseToolEntries(metadata);
     if (toolEntries.length === 0) {
-        return [];
+        return { findings: [], toolDescriptions: [], knownClassifications: {} };
     }
     const toolDescriptions = toolEntries.map((entry) => ({
         name: entry.name,
         description: entry.description,
     }));
     const knownClassifications = parseToolClassifications(metadata, toolEntries);
-    return [
-        ...scanToolDescriptions({
-            serverId: resourceId,
-            tools: toolDescriptions,
-            unicodeAnalysis: options.unicodeAnalysis,
-        }).map(withFindingFingerprint),
-        ...detectToxicFlows({
-            scopeId: resourceId,
-            tools: toolDescriptions,
-            knownClassifications,
-        }).map(withFindingFingerprint),
-    ];
+    return {
+        findings: [
+            ...scanToolDescriptions({
+                serverId: resourceId,
+                tools: toolDescriptions,
+                unicodeAnalysis: options.unicodeAnalysis,
+            }).map(withFindingFingerprint),
+            ...detectToxicFlows({
+                scopeId: resourceId,
+                tools: toolDescriptions,
+                knownClassifications,
+            }).map(withFindingFingerprint),
+        ],
+        toolDescriptions,
+        knownClassifications,
+    };
 }
 function layer3ErrorFinding(resourceId, status, description) {
     const severity = status === "timeout" ? "MEDIUM" : status === "skipped_without_consent" ? "INFO" : "LOW";
@@ -204,6 +209,25 @@ function layer3ErrorFinding(resourceId, status, description) {
 }
 export function layer3OutcomesToFindings(outcomes, options = {}) {
     const findings = [];
+    const workspaceTools = [];
+    const workspaceClassifications = {};
+    const workspaceOrigins = {};
+    const contributingServers = new Set();
+    const addWorkspaceTools = (resourceId, analysis) => {
+        for (const tool of analysis.toolDescriptions) {
+            // Keep workspace tool names unique across servers so origins stay unambiguous.
+            const uniqueName = workspaceOrigins[tool.name] === undefined ? tool.name : `${tool.name}@${resourceId}`;
+            workspaceTools.push({ name: uniqueName, description: tool.description });
+            workspaceOrigins[uniqueName] = resourceId;
+            const classifications = analysis.knownClassifications[tool.name];
+            if (classifications && classifications.length > 0) {
+                workspaceClassifications[uniqueName] = classifications;
+            }
+        }
+        if (analysis.toolDescriptions.length > 0) {
+            contributingServers.add(resourceId);
+        }
+    };
     for (const outcome of outcomes) {
         if (!outcome.approved || outcome.status === "skipped_without_consent") {
             findings.push(layer3ErrorFinding(outcome.resourceId, "skipped_without_consent", "Deep scan skipped because consent was not granted"));
@@ -214,8 +238,10 @@ export function layer3OutcomesToFindings(outcomes, options = {}) {
             continue;
         }
         const parsed = parseLayer3Response(outcome.resourceId, outcome.result.metadata);
-        const derived = deriveLayer3ToolFindings(outcome.resourceId, outcome.result.metadata, options);
-        const combined = [...parsed, ...derived];
+        const analysis = analyzeLayer3Tools(outcome.resourceId, outcome.result.metadata, options);
+        addWorkspaceTools(outcome.resourceId, analysis);
+        const registryFindings = deriveRegistryFindings(outcome.resourceId, outcome.result.metadata, options.registryHeuristics).map(withFindingFingerprint);
+        const combined = [...parsed, ...analysis.findings, ...registryFindings];
         // If a Layer 3 resource was fetched successfully but carries no
         // actionable metadata (no `findings[]`, no `tools[]`), that is not an
         // issue with the scan target itself — it usually means the default
@@ -231,6 +257,17 @@ export function layer3OutcomesToFindings(outcomes, options = {}) {
         }
         findings.push(...combined);
     }
+    // Cross-server pass: a toxic chain whose links live on different servers
+    // is invisible to the per-server analysis above.
+    if (contributingServers.size >= 2) {
+        findings.push(...detectToxicFlows({
+            scopeId: "workspace",
+            tools: workspaceTools,
+            knownClassifications: workspaceClassifications,
+            origins: workspaceOrigins,
+            crossOriginOnly: true,
+        }).map(withFindingFingerprint));
+    }
     return findings;
 }
 export function mergeLayer3Findings(baseReport, layer3Findings) {

package/dist/report-summary.d.ts

@@ -1,4 +1,4 @@
-import type { Finding } from "./types/finding.js";
+import { type Finding } from "./types/finding.js";
 import type { CodeGateReport, ReportSummary } from "./types/report.js";
 export type ReportThreshold = "critical" | "high" | "medium" | "low" | "info";
 export declare function computeExitCode(findings: Finding[], threshold?: ReportThreshold): number;

package/dist/report-summary.js

@@ -1,3 +1,4 @@
+import { isUntrustedInlineSuppression } from "./types/finding.js";
 const SEVERITY_LEVEL = {
     CRITICAL: 4,
     HIGH: 3,
@@ -12,8 +13,13 @@ const THRESHOLD_LEVEL = {
     low: 1,
     info: 0,
 };
+function countsTowardExitCode(finding) {
+    // Inline suppressions from untrusted content stay visible as suppressed
+    // but must not weaken gating.
+    return !finding.suppressed || isUntrustedInlineSuppression(finding);
+}
 export function computeExitCode(findings, threshold = "high") {
-    const unsuppressed = findings.filter((finding) => !finding.suppressed);
+    const unsuppressed = findings.filter(countsTowardExitCode);
     if (unsuppressed.length === 0) {
         return 0;
     }
@@ -32,11 +38,13 @@ export function summarizeFindings(findings, threshold = "high") {
     for (const finding of findings) {
         bySeverity[finding.severity] = (bySeverity[finding.severity] ?? 0) + 1;
     }
+    const suppressedUntrusted = findings.filter(isUntrustedInlineSuppression).length;
     return {
         total: findings.length,
         by_severity: bySeverity,
         fixable: findings.filter((finding) => finding.fixable).length,
         suppressed: findings.filter((finding) => finding.suppressed).length,
+        ...(suppressedUntrusted > 0 ? { suppressed_untrusted: suppressedUntrusted } : {}),
         exit_code: computeExitCode(findings, threshold),
     };
 }

package/dist/scan.d.ts

@@ -6,6 +6,18 @@ import type { DiscoveryFormat } from "./types/discovery.js";
 import type { CodeGateReport } from "./types/report.js";
 import type { CodeGateConfig, ScanCollectionKind, ScanCollectionMode } from "./config.js";
 import type { DeepScanResource } from "./pipeline.js";
+export declare const SKILL_BINARY_KIND: {
+    readonly Elf: "elf";
+    readonly MachO: "mach-o";
+    readonly Pe: "pe";
+    readonly Unknown: "binary";
+};
+export type SkillBinaryKind = (typeof SKILL_BINARY_KIND)[keyof typeof SKILL_BINARY_KIND];
+export interface SkillBinaryArtifact {
+    reportPath: string;
+    kind: SkillBinaryKind;
+    executable: boolean;
+}
 export interface ScanEngineInput {
     version: string;
     scanTarget: string;
@@ -43,6 +55,7 @@ export interface ScanDiscoveryContext {
     walked: WalkResult;
     selected: ScanDiscoveryCandidate[];
     parsedCandidates?: ParsedScanDiscoveryCandidate[];
+    skillBinaries?: SkillBinaryArtifact[];
 }
 export interface ScanDiscoveryContextOptions {
     includeUserScope?: boolean;