codegate-ai 0.16.2 → 1.0.0

package/dist/scan.js

@@ -1,6 +1,6 @@
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { closeSync, existsSync, openSync, readSync, readdirSync, readFileSync, statSync, } from "node:fs";
 import { homedir } from "node:os";
-import { basename, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { collectLocalTextAnalysisTargets, } from "./layer3-dynamic/local-text-analysis.js";
 import { buildResourceId, normalizeRemoteUrl } from "./layer3-dynamic/url-validation.js";
 import { runStaticPipeline } from "./pipeline.js";
@@ -11,11 +11,46 @@ import { detectTools } from "./layer1-discovery/tool-detector.js";
 import { walkProjectTree } from "./layer1-discovery/file-walker.js";
 import { evaluateScanStateSnapshots, extractMcpServerSnapshots, loadScanState, saveScanState, } from "./layer2-static/state/scan-state.js";
 import { applyInlineIgnoreDirectives, collectInlineIgnoreDirectives, } from "./config/inline-ignore.js";
+import { isTrustedDirectory } from "./config/trust.js";
+import { loadKnownBadIndicators } from "./content/known-bad.js";
+import { escalateKnownBadFindings } from "./layer2-static/detectors/known-bad.js";
+import { normalizeForMatching } from "./layer2-static/text/normalize.js";
+import { REMOTE_INSTRUCTION_INDIRECTION_PATTERN } from "./layer2-static/text/threat-patterns.js";
+import { withFindingFingerprint } from "./report/finding-fingerprint.js";
 import { isGitHubDependabotPath } from "./layer2-static/dependabot/parser.js";
 const MCP_SERVER_CONTAINER_KEYS = ["mcpServers", "mcp_servers", "context_servers"];
 const REMOTE_MCP_SERVER_ARRAY_KEYS = ["remoteMCPServers", "remote_mcp_servers"];
 const USER_SCOPE_WILDCARD_MAX_DEPTH = 6;
 const USER_SCOPE_WILDCARD_MAX_FILES = 500;
+const SKILL_FILE_NAME = "skill.md";
+const SKILL_SIBLING_MAX_DEPTH = 3;
+const SKILL_SIBLING_MAX_FILES = 200;
+const BINARY_SNIFF_BYTES = 512;
+const SKILL_SIBLING_FORMATS = {
+    md: "markdown",
+    markdown: "markdown",
+    json: "json",
+    yaml: "yaml",
+    yml: "yaml",
+    toml: "toml",
+    sh: "text",
+    bash: "text",
+    zsh: "text",
+    ps1: "text",
+    py: "text",
+    js: "text",
+    mjs: "text",
+    cjs: "text",
+    ts: "text",
+    rb: "text",
+    txt: "text",
+};
+export const SKILL_BINARY_KIND = {
+    Elf: "elf",
+    MachO: "mach-o",
+    Pe: "pe",
+    Unknown: "binary",
+};
 const INFERRED_ARTIFACT_RULES = [
     {
         pattern: /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu,
@@ -45,12 +80,19 @@ const INFERRED_ARTIFACT_RULES = [
 function escapeRegex(value) {
     return value.replace(/[|\\{}()[\]^$+?.*]/g, "\\$&");
 }
+const wildcardRegexCache = new Map();
 function wildcardToRegex(pattern) {
+    const cached = wildcardRegexCache.get(pattern);
+    if (cached) {
+        return cached;
+    }
     let escaped = escapeRegex(pattern);
     escaped = escaped.replace(/\\\*\\\*\//g, "(?:[^/]+/)*");
     escaped = escaped.replace(/\\\*\\\*/g, ".*");
     escaped = escaped.replace(/\\\*/g, "[^/]*");
-    return new RegExp(`^${escaped}$`, "u");
+    const regex = new RegExp(`^${escaped}$`, "u");
+    wildcardRegexCache.set(pattern, regex);
+    return regex;
 }
 function normalizePathForMatch(path) {
     return path.split(sep).join("/");
@@ -279,15 +321,15 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
         relativePath: normalizePathForMatch(relative(absoluteTarget, filePath)),
     }))
         .filter((entry) => !entry.relativePath.startsWith(".."));
+    const projectPatterns = patterns
+        .filter((candidate) => candidate.scope === "project")
+        .map((candidate) => ({ candidate, regex: wildcardToRegex(candidate.pattern) }));
     for (const file of filesByRelativePath) {
         if (!includeProject) {
             continue;
         }
-        for (const candidate of patterns) {
-            if (candidate.scope !== "project") {
-                continue;
-            }
-            if (!wildcardToRegex(candidate.pattern).test(file.relativePath)) {
+        for (const { candidate, regex } of projectPatterns) {
+            if (!regex.test(file.relativePath)) {
                 continue;
             }
             if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
@@ -418,6 +460,140 @@ function mergeExplicitCandidates(selected, explicitCandidates, collectKinds) {
     }
     return Array.from(merged.values());
 }
+function sniffFileHead(path) {
+    const buffer = Buffer.alloc(BINARY_SNIFF_BYTES);
+    let bytesRead;
+    try {
+        const fd = openSync(path, "r");
+        try {
+            bytesRead = readSync(fd, buffer, 0, BINARY_SNIFF_BYTES, 0);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        return { binaryKind: null, hasShebang: false };
+    }
+    const head = buffer.subarray(0, bytesRead);
+    const hasShebang = bytesRead >= 2 && head[0] === 0x23 && head[1] === 0x21;
+    if (bytesRead >= 4 &&
+        head[0] === 0x7f &&
+        head[1] === 0x45 &&
+        head[2] === 0x4c &&
+        head[3] === 0x46) {
+        return { binaryKind: SKILL_BINARY_KIND.Elf, hasShebang: false };
+    }
+    const magic = bytesRead >= 4 ? head.readUInt32BE(0) : 0;
+    if (magic === 0xfeedface ||
+        magic === 0xfeedfacf ||
+        magic === 0xcefaedfe ||
+        magic === 0xcffaedfe ||
+        magic === 0xcafebabe) {
+        return { binaryKind: SKILL_BINARY_KIND.MachO, hasShebang: false };
+    }
+    if (bytesRead >= 2 && head[0] === 0x4d && head[1] === 0x5a) {
+        return { binaryKind: SKILL_BINARY_KIND.Pe, hasShebang: false };
+    }
+    if (head.includes(0)) {
+        return { binaryKind: SKILL_BINARY_KIND.Unknown, hasShebang: false };
+    }
+    return { binaryKind: null, hasShebang };
+}
+function isSkillCandidate(candidate) {
+    return basename(normalizePathForMatch(candidate.reportPath)).toLowerCase() === SKILL_FILE_NAME;
+}
+function siblingReportPath(candidate, siblingAbsolute) {
+    const skillDir = dirname(candidate.absolutePath);
+    const relFromSkillDir = normalizePathForMatch(relative(skillDir, siblingAbsolute));
+    const normalizedReport = normalizePathForMatch(candidate.reportPath);
+    const slashIndex = normalizedReport.lastIndexOf("/");
+    const parentReport = slashIndex >= 0 ? normalizedReport.slice(0, slashIndex) : "";
+    return parentReport ? `${parentReport}/${relFromSkillDir}` : relFromSkillDir;
+}
+/**
+ * Skills ship payloads next to SKILL.md (helper scripts, nested docs,
+ * sometimes binaries). Collect text-like siblings as scan candidates so the
+ * rule-file detectors see them, and record binary artifacts for reporting.
+ */
+function collectSkillSiblings(selected) {
+    const known = new Set(selected.map((candidate) => normalizePathForMatch(candidate.reportPath)));
+    const candidates = [];
+    const binaries = [];
+    const visitedDirs = new Set();
+    for (const skillCandidate of selected.filter(isSkillCandidate)) {
+        const skillDir = dirname(skillCandidate.absolutePath);
+        if (visitedDirs.has(skillDir)) {
+            continue;
+        }
+        visitedDirs.add(skillDir);
+        let filesSeen = 0;
+        const queue = [{ dir: skillDir, depth: 0 }];
+        while (queue.length > 0 && filesSeen < SKILL_SIBLING_MAX_FILES) {
+            const current = queue.pop();
+            if (!current) {
+                break;
+            }
+            let entries;
+            try {
+                entries = readdirSync(current.dir, { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const entry of entries) {
+                if (filesSeen >= SKILL_SIBLING_MAX_FILES) {
+                    break;
+                }
+                if (entry.isSymbolicLink()) {
+                    continue;
+                }
+                const absolutePath = join(current.dir, entry.name);
+                if (entry.isDirectory()) {
+                    if (current.depth < SKILL_SIBLING_MAX_DEPTH) {
+                        queue.push({ dir: absolutePath, depth: current.depth + 1 });
+                    }
+                    continue;
+                }
+                if (!entry.isFile() || absolutePath === skillCandidate.absolutePath) {
+                    continue;
+                }
+                filesSeen += 1;
+                const reportPath = siblingReportPath(skillCandidate, absolutePath);
+                if (known.has(reportPath)) {
+                    continue;
+                }
+                const sniffed = sniffFileHead(absolutePath);
+                if (sniffed.binaryKind) {
+                    let executable;
+                    try {
+                        executable = (statSync(absolutePath).mode & 0o111) !== 0;
+                    }
+                    catch {
+                        executable = false;
+                    }
+                    binaries.push({ reportPath, kind: sniffed.binaryKind, executable });
+                    continue;
+                }
+                const extension = entry.name.includes(".")
+                    ? (entry.name.split(".").pop() ?? "").toLowerCase()
+                    : "";
+                const format = SKILL_SIBLING_FORMATS[extension] ?? (sniffed.hasShebang ? "text" : null);
+                if (!format) {
+                    continue;
+                }
+                known.add(reportPath);
+                candidates.push({
+                    reportPath,
+                    absolutePath,
+                    format,
+                    tool: skillCandidate.tool,
+                });
+            }
+        }
+    }
+    return { candidates, binaries };
+}
 function inferArtifactCandidate(relativePath, absolutePath) {
     for (const rule of INFERRED_ARTIFACT_RULES) {
         if (!rule.pattern.test(relativePath)) {
@@ -446,6 +622,57 @@ function ensureParsedCandidates(context) {
     }
     return context.parsedCandidates;
 }
+function makeUntrustedProjectConfigFinding(ignoredSettings) {
+    return {
+        rule_id: "untrusted-project-config",
+        finding_id: "UNTRUSTED_PROJECT_CONFIG-.codegate.json",
+        severity: "INFO",
+        category: "CONFIG_CHANGE",
+        layer: "L1",
+        file_path: ".codegate.json",
+        location: { field: ignoredSettings.join(", ") },
+        description: `Ignored ${ignoredSettings.length} policy setting(s) from untrusted project config: ` +
+            `${ignoredSettings.join(", ")}. Project config in untrusted directories may only set ` +
+            "presentation options. Run `codegate trust <dir>` to honor its policy settings.",
+        affected_tools: [],
+        cve: null,
+        owasp: [],
+        cwe: "CWE-807",
+        confidence: "HIGH",
+        fixable: false,
+        remediation_actions: [],
+        suppressed: false,
+    };
+}
+function makeSkillBinaryFinding(artifact) {
+    const isExecutableFormat = artifact.kind !== SKILL_BINARY_KIND.Unknown;
+    const severity = artifact.executable || isExecutableFormat ? "HIGH" : "MEDIUM";
+    const kindLabel = isExecutableFormat ? `${artifact.kind} executable` : "binary file";
+    return {
+        rule_id: "skill-binary-payload",
+        finding_id: `SKILL_BINARY-${artifact.reportPath}`,
+        severity,
+        category: "COMMAND_EXEC",
+        layer: "L1",
+        file_path: artifact.reportPath,
+        location: { field: "content" },
+        description: `Skill directory ships a ${kindLabel}${artifact.executable ? " with execute permissions" : ""}. ` +
+            "Binary payloads cannot be reviewed as text and have no place in an instruction skill.",
+        affected_tools: ["claude-code", "codex-cli", "opencode", "cursor"],
+        cve: null,
+        owasp: ["ASI02"],
+        cwe: "CWE-506",
+        confidence: "HIGH",
+        fixable: true,
+        remediation_actions: ["quarantine_file"],
+        metadata: {
+            sources: [artifact.reportPath],
+            risk_tags: ["skill", "binary-payload"],
+            origin: "skill-siblings",
+        },
+        suppressed: false,
+    };
+}
 function makeParseErrorFinding(filePath, tool, message, strictCollection) {
     return {
         rule_id: "parse-error",
@@ -507,7 +734,7 @@ function commandResourceFromTokens(command) {
             id: `npm:${locator}`,
             kind: "npm",
             locator,
-            preview: `npm view ${locator} --json`,
+            preview: `GET https://registry.npmjs.org/${locator}  (online mode only; offline records the package name)`,
         };
     }
     if (launcher === "uvx" || launcher === "pipx") {
@@ -519,7 +746,7 @@ function commandResourceFromTokens(command) {
             id: `pypi:${locator}`,
             kind: "pypi",
             locator,
-            preview: `https://pypi.org/pypi/${locator}/json`,
+            preview: `GET https://pypi.org/pypi/${locator}/json  (online mode only; offline records the package name)`,
         };
     }
     return null;
@@ -654,7 +881,7 @@ export function createScanDiscoveryContext(scanTarget, kbInput, options = {}) {
     const collectModes = normalizeCollectionModes(options.collectModes);
     const collectKinds = normalizeCollectionKinds(options.collectKinds);
     const explicitOnly = collectModes.size === 1 && collectModes.has("explicit");
-    const selected = mergeExplicitCandidates(explicitOnly
+    const baseSelected = mergeExplicitCandidates(explicitOnly
         ? []
         : collectSelectedCandidates(absoluteTarget, walked.files, patterns, {
             includeUserScope: options.includeUserScope === true,
@@ -662,21 +889,50 @@ export function createScanDiscoveryContext(scanTarget, kbInput, options = {}) {
             collectModes,
             collectKinds,
         }), options.explicitCandidates, collectKinds);
+    const skillSiblings = collectSkillSiblings(baseSelected);
+    const selected = [...baseSelected, ...skillSiblings.candidates];
     return {
         absoluteTarget,
         kb,
         walked,
         selected,
         parsedCandidates: options.parseSelected ? parseSelectedCandidates(selected) : undefined,
+        skillBinaries: skillSiblings.binaries,
     };
 }
+function collectIndirectionUrlResources(textContent, filePath, resources) {
+    const lines = textContent.split(/\r?\n/u);
+    for (const line of lines) {
+        const normalized = normalizeForMatching(line);
+        if (!REMOTE_INSTRUCTION_INDIRECTION_PATTERN.test(normalized)) {
+            continue;
+        }
+        const urlMatch = line.match(/https?:\/\/[^\s)\]"'`<>]+/iu);
+        if (!urlMatch) {
+            continue;
+        }
+        const url = urlMatch[0];
+        const kind = inferHttpKind(url);
+        const id = `${kind}:${url}`;
+        if (resources.has(id)) {
+            continue;
+        }
+        resources.set(id, {
+            id,
+            request: { id, kind, locator: url },
+            commandPreview: `GET ${url}  (from ${filePath} -> remote instruction indirection)`,
+        });
+    }
+}
 export function discoverDeepScanResourcesFromContext(context) {
     const discovered = new Map();
     for (const item of ensureParsedCandidates(context)) {
-        if (!item.parsed.ok) {
-            continue;
+        if (item.parsed.ok) {
+            collectDeepScanResourcesFromParsed(item.parsed.data, item.reportPath, discovered);
+        }
+        if (item.format === "markdown" || item.format === "text") {
+            collectIndirectionUrlResources(readCandidateText(item), item.reportPath, discovered);
         }
-        collectDeepScanResourcesFromParsed(item.parsed.data, item.reportPath, discovered);
     }
     return Array.from(discovered.values()).sort((a, b) => a.id.localeCompare(b.id));
 }
@@ -712,6 +968,8 @@ export async function runScanEngine(input) {
         });
     const absoluteTarget = context.absoluteTarget;
     const kb = context.kb;
+    const scanHomeDir = input.homeDir;
+    const knownBadIndicators = loadKnownBadIndicators(scanHomeDir ? { homeDir: () => scanHomeDir } : {});
     const parseErrors = [];
     const staticFiles = [];
     for (const item of ensureParsedCandidates(context)) {
@@ -772,6 +1030,7 @@ export async function runScanEngine(input) {
             runtimeMode: input.config.runtime_mode,
             workflowAuditsEnabled: input.config.workflow_audits?.enabled === true,
             rulePolicies: input.config.rules,
+            knownBadIndicators,
         },
     });
     const snapshots = new Map();
@@ -780,17 +1039,32 @@ export async function runScanEngine(input) {
             snapshots.set(snapshot.serverId, snapshot);
         }
     }
-    const previousState = loadScanState(input.scanStatePath);
+    const trustedTarget = input.config.project_config_trusted ??
+        isTrustedDirectory(absoluteTarget, input.config.trusted_directories);
+    const previousState = loadScanState(input.scanStatePath, absoluteTarget);
     const stateResult = evaluateScanStateSnapshots({
         snapshots: Array.from(snapshots.values()),
         previousState,
+        trustedTarget,
+        firstScanReview: input.config.first_scan_review,
     });
-    saveScanState(stateResult.nextState, input.scanStatePath);
+    saveScanState(stateResult.nextState, input.scanStatePath, absoluteTarget);
     const inlineIgnores = collectInlineIgnoreDirectives(staticFiles.map((file) => ({
         filePath: file.filePath,
         textContent: file.textContent,
     })));
-    const findings = applyInlineIgnoreDirectives([...report.findings, ...parseErrors, ...stateResult.findings], inlineIgnores);
+    const ignoredProjectSettings = input.config.ignored_project_settings ?? [];
+    const configNoticeFindings = ignoredProjectSettings.length > 0
+        ? [withFindingFingerprint(makeUntrustedProjectConfigFinding(ignoredProjectSettings))]
+        : [];
+    const skillBinaryFindings = (context.skillBinaries ?? []).map((artifact) => withFindingFingerprint(makeSkillBinaryFinding(artifact)));
+    const findings = applyInlineIgnoreDirectives(escalateKnownBadFindings([
+        ...report.findings,
+        ...parseErrors,
+        ...stateResult.findings,
+        ...configNoticeFindings,
+        ...skillBinaryFindings,
+    ], knownBadIndicators), inlineIgnores, { trustedTarget });
     return applyReportSummary({
         ...report,
         findings,

package/dist/types/finding.d.ts

@@ -4,6 +4,19 @@ export declare const FINDING_CATEGORIES: readonly ["ENV_OVERRIDE", "COMMAND_EXEC
 export type FindingCategory = (typeof FINDING_CATEGORIES)[number];
 export type FindingLayer = "L1" | "L2" | "L3";
 export type FindingConfidence = "HIGH" | "MEDIUM" | "LOW";
+/**
+ * Where a suppression came from. InlineUntrusted marks inline
+ * `codegate: ignore[...]` directives found in content the user has not
+ * trusted; such findings stay visibly suppressed in reports but still
+ * count toward the exit code so untrusted content cannot self-approve.
+ */
+export declare const SUPPRESSION_SOURCE: {
+    readonly Inline: "inline";
+    readonly InlineUntrusted: "inline-untrusted";
+    readonly Config: "config";
+};
+export type SuppressionSource = (typeof SUPPRESSION_SOURCE)[keyof typeof SUPPRESSION_SOURCE];
+export declare function isUntrustedInlineSuppression(finding: Pick<Finding, "suppressed" | "suppression_source">): boolean;
 export interface FindingLocation {
     field?: string;
     line?: number;
@@ -52,4 +65,5 @@ export interface Finding {
     incident_primary?: boolean | null;
     source_config?: FindingSourceConfig | null;
     suppressed: boolean;
+    suppression_source?: SuppressionSource | null;
 }

package/dist/types/finding.js

@@ -18,3 +18,17 @@ export const FINDING_CATEGORIES = [
     "CI_TEMPLATE_INJECTION",
     "CI_VULNERABLE_ACTION",
 ];
+/**
+ * Where a suppression came from. InlineUntrusted marks inline
+ * `codegate: ignore[...]` directives found in content the user has not
+ * trusted; such findings stay visibly suppressed in reports but still
+ * count toward the exit code so untrusted content cannot self-approve.
+ */
+export const SUPPRESSION_SOURCE = {
+    Inline: "inline",
+    InlineUntrusted: "inline-untrusted",
+    Config: "config",
+};
+export function isUntrustedInlineSuppression(finding) {
+    return (finding.suppressed === true && finding.suppression_source === SUPPRESSION_SOURCE.InlineUntrusted);
+}

package/dist/types/report.d.ts

@@ -4,6 +4,8 @@ export interface ReportSummary {
     by_severity: Record<string, number>;
     fixable: number;
     suppressed: number;
+    /** Suppressions requested by untrusted content; these still count toward exit_code. */
+    suppressed_untrusted?: number;
     exit_code: number;
 }
 export interface CodeGateReport {

package/dist/wrapper.js

@@ -1,9 +1,9 @@
 import { spawnSync } from "node:child_process";
 import { readFileSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { homedir } from "node:os";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { resolve } from "node:path";
 import { applyConfigPolicy } from "./config.js";
+import { isTrustedDirectory } from "./config/trust.js";
 import { evaluatePostScanGuard, evaluatePreLaunchGuard } from "./commands/run-policy.js";
 import { detectTools } from "./layer1-discovery/tool-detector.js";
 import { renderTerminalReport } from "./reporter/terminal.js";
@@ -87,23 +87,6 @@ function snapshotsEqual(before, after) {
     }
     return true;
 }
-function expandHomePath(path) {
-    if (path === "~") {
-        return homedir();
-    }
-    if (path.startsWith(`~${sep}`) || path.startsWith("~/")) {
-        return resolve(homedir(), path.slice(2));
-    }
-    return path;
-}
-function isTrustedDirectory(cwd, trustedDirectories) {
-    const resolvedCwd = resolve(cwd);
-    return trustedDirectories.some((trustedPath) => {
-        const resolvedTrusted = resolve(expandHomePath(trustedPath));
-        const rel = relative(resolvedTrusted, resolvedCwd);
-        return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-    });
-}
 const defaultWrapperDeps = {
     runScan: async (input) => runScanEngine({
         version: input.version,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.16.2",
+  "version": "1.0.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",