codegate-ai 0.16.2 → 1.0.1

package/dist/config.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { parse as parseJsonc } from "jsonc-parser";
+import { isTrustedDirectory } from "./config/trust.js";
 import { applyReportSummary, computeExitCode as computeReportExitCode } from "./report-summary.js";
 import { applySuppressionPolicy, } from "./config/suppression-policy.js";
 export const OUTPUT_FORMATS = ["terminal", "json", "sarif", "markdown", "html"];
@@ -37,6 +38,7 @@ export const DEFAULT_CONFIG = {
     known_safe_hooks: [],
     unicode_analysis: true,
     check_ide_settings: true,
+    first_scan_review: true,
     owasp_mapping: true,
     trusted_api_domains: [],
     rule_pack_paths: [],
@@ -47,6 +49,7 @@ export const DEFAULT_CONFIG = {
     persona: "regular",
     runtime_mode: "offline",
     workflow_audits: { enabled: false },
+    registry_heuristics: { recent_publish_days: 30 },
     suppress_findings: [],
     suppression_rules: [],
     layer3_remote_fetch_timeout_ms: 5000,
@@ -270,12 +273,47 @@ function pickFirst(...values) {
     }
     return undefined;
 }
+// Presentation-only keys the scan target's .codegate.json may always set.
+// Every other key is policy: it changes what is detected, suppressed,
+// executed, or gated, so untrusted targets must not control it.
+export const PROJECT_COSMETIC_KEYS = ["output_format", "tui", "owasp_mapping"];
+// Keys never honored from project config, whether the target is trusted or not.
+export const PROJECT_FORBIDDEN_KEYS = ["trusted_directories"];
+function isProjectCosmeticKey(key) {
+    return PROJECT_COSMETIC_KEYS.includes(key);
+}
+function isProjectForbiddenKey(key) {
+    return PROJECT_FORBIDDEN_KEYS.includes(key);
+}
+function isProjectKeyHonored(key, trusted) {
+    if (isProjectForbiddenKey(key)) {
+        return false;
+    }
+    return trusted || isProjectCosmeticKey(key);
+}
+function partitionProjectConfig(projectConfig, trusted) {
+    const effective = {};
+    const ignoredKeys = [];
+    for (const [key, value] of Object.entries(projectConfig)) {
+        if (value === undefined) {
+            continue;
+        }
+        if (isProjectKeyHonored(key, trusted)) {
+            effective[key] = value;
+            continue;
+        }
+        ignoredKeys.push(key);
+    }
+    return { effective, ignoredKeys: ignoredKeys.sort() };
+}
 export function resolveEffectiveConfig(options) {
     const home = options.homeDir ?? homedir();
     const scanTarget = resolve(options.scanTarget);
     const globalConfigPath = options.cli?.configPath ?? join(home, ".codegate", "config.json");
     const globalConfig = readConfigFile(globalConfigPath);
-    const projectConfig = readConfigFile(join(scanTarget, ".codegate.json"));
+    const rawProjectConfig = readConfigFile(join(scanTarget, ".codegate.json"));
+    const projectConfigTrusted = isTrustedDirectory(scanTarget, unique([DEFAULT_CONFIG.trusted_directories, globalConfig.trusted_directories]));
+    const { effective: projectConfig, ignoredKeys: ignoredProjectSettings } = partitionProjectConfig(rawProjectConfig, projectConfigTrusted);
     const severity_threshold = pickFirst(normalizeSeverityThreshold(undefined), normalizeSeverityThreshold(projectConfig.severity_threshold), normalizeSeverityThreshold(globalConfig.severity_threshold), DEFAULT_CONFIG.severity_threshold) ?? DEFAULT_CONFIG.severity_threshold;
     const output_format = pickFirst(options.cli?.format, normalizeOutputFormat(projectConfig.output_format), normalizeOutputFormat(globalConfig.output_format), DEFAULT_CONFIG.output_format) ?? DEFAULT_CONFIG.output_format;
     return {
@@ -336,6 +374,7 @@ export function resolveEffectiveConfig(options) {
         ]),
         unicode_analysis: pickFirst(projectConfig.unicode_analysis, globalConfig.unicode_analysis, DEFAULT_CONFIG.unicode_analysis) ?? DEFAULT_CONFIG.unicode_analysis,
         check_ide_settings: pickFirst(projectConfig.check_ide_settings, globalConfig.check_ide_settings, DEFAULT_CONFIG.check_ide_settings) ?? DEFAULT_CONFIG.check_ide_settings,
+        first_scan_review: pickFirst(projectConfig.first_scan_review, globalConfig.first_scan_review, DEFAULT_CONFIG.first_scan_review) ?? true,
         owasp_mapping: pickFirst(projectConfig.owasp_mapping, globalConfig.owasp_mapping, DEFAULT_CONFIG.owasp_mapping) ?? DEFAULT_CONFIG.owasp_mapping,
         trusted_api_domains: unique([
             DEFAULT_CONFIG.trusted_api_domains,
@@ -366,6 +405,9 @@ export function resolveEffectiveConfig(options) {
         workflow_audits: {
             enabled: pickFirst(projectConfig.workflow_audits?.enabled, globalConfig.workflow_audits?.enabled, DEFAULT_CONFIG.workflow_audits?.enabled) ?? false,
         },
+        registry_heuristics: {
+            recent_publish_days: pickFirst(projectConfig.registry_heuristics?.recent_publish_days, globalConfig.registry_heuristics?.recent_publish_days, DEFAULT_CONFIG.registry_heuristics?.recent_publish_days) ?? 30,
+        },
         suppress_findings: unique([
             DEFAULT_CONFIG.suppress_findings,
             globalConfig.suppress_findings,
@@ -378,6 +420,8 @@ export function resolveEffectiveConfig(options) {
         ],
         layer3_remote_fetch_timeout_ms: pickFirst(readEnvOverride(LAYER3_REMOTE_FETCH_TIMEOUT_ENV), normalizePositiveInteger(projectConfig.layer3_remote_fetch_timeout_ms), normalizePositiveInteger(globalConfig.layer3_remote_fetch_timeout_ms), DEFAULT_CONFIG.layer3_remote_fetch_timeout_ms) ?? DEFAULT_CONFIG.layer3_remote_fetch_timeout_ms,
         layer3_remote_fetch_max_bytes: pickFirst(readEnvOverride(LAYER3_REMOTE_FETCH_MAX_BYTES_ENV), normalizePositiveInteger(projectConfig.layer3_remote_fetch_max_bytes), normalizePositiveInteger(globalConfig.layer3_remote_fetch_max_bytes), DEFAULT_CONFIG.layer3_remote_fetch_max_bytes) ?? DEFAULT_CONFIG.layer3_remote_fetch_max_bytes,
+        project_config_trusted: projectConfigTrusted,
+        ignored_project_settings: ignoredProjectSettings.length > 0 ? ignoredProjectSettings : undefined,
     };
 }
 export function computeExitCode(findings, threshold) {

package/dist/content/content-bundle.d.ts

@@ -0,0 +1,27 @@
+import type { KnowledgeBaseEntry } from "../layer1-discovery/knowledge-base.js";
+import type { OverridePhrase } from "../layer2-static/text/override-phrases.js";
+export declare const CONTENT_BUNDLE_SCHEMA_VERSION = "1";
+export declare const KNOWN_BAD_INDICATOR_KEYS: readonly ["file_sha256", "package_names", "url_patterns", "finding_fingerprints"];
+export type KnownBadIndicatorKey = (typeof KNOWN_BAD_INDICATOR_KEYS)[number];
+export type KnownBadIndicators = Partial<Record<KnownBadIndicatorKey, string[]>>;
+export interface ContentBundle {
+    schema_version: string;
+    content_version: string;
+    released_at: string;
+    kb_schema_version?: string;
+    kb_entries?: KnowledgeBaseEntry[];
+    rules?: unknown[];
+    override_phrases?: OverridePhrase[];
+    popular_packages?: {
+        npm?: string[];
+        pypi?: string[];
+    };
+    known_bad?: KnownBadIndicators;
+}
+/**
+ * Verify the detached Ed25519 signature over the exact bundle bytes.
+ * Verification always happens BEFORE parsing untrusted bytes.
+ */
+export declare function verifyBundleSignature(bundleBytes: Buffer, signatureBase64: string, publicKeyPem: string): boolean;
+/** Structural validation of a verified bundle. Throws with a clear reason. */
+export declare function parseContentBundle(bundleBytes: Buffer): ContentBundle;

package/dist/content/content-bundle.js

@@ -0,0 +1,73 @@
+import { createPublicKey, verify as cryptoVerify } from "node:crypto";
+export const CONTENT_BUNDLE_SCHEMA_VERSION = "1";
+export const KNOWN_BAD_INDICATOR_KEYS = [
+    "file_sha256",
+    "package_names",
+    "url_patterns",
+    "finding_fingerprints",
+];
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+/**
+ * Verify the detached Ed25519 signature over the exact bundle bytes.
+ * Verification always happens BEFORE parsing untrusted bytes.
+ */
+export function verifyBundleSignature(bundleBytes, signatureBase64, publicKeyPem) {
+    try {
+        const key = createPublicKey(publicKeyPem);
+        const signature = Buffer.from(signatureBase64.trim(), "base64");
+        return cryptoVerify(null, bundleBytes, key, signature);
+    }
+    catch {
+        return false;
+    }
+}
+/** Structural validation of a verified bundle. Throws with a clear reason. */
+export function parseContentBundle(bundleBytes) {
+    let parsed;
+    try {
+        parsed = JSON.parse(bundleBytes.toString("utf8"));
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Content bundle is not valid JSON: ${reason}`, { cause: error });
+    }
+    if (!isRecord(parsed)) {
+        throw new Error("Content bundle must be a JSON object");
+    }
+    if (parsed.schema_version !== CONTENT_BUNDLE_SCHEMA_VERSION) {
+        throw new Error(`Unsupported content bundle schema_version: ${String(parsed.schema_version)} ` +
+            `(this build supports ${CONTENT_BUNDLE_SCHEMA_VERSION})`);
+    }
+    if (typeof parsed.content_version !== "string" || parsed.content_version.length === 0) {
+        throw new Error("Content bundle is missing content_version");
+    }
+    if (typeof parsed.released_at !== "string" || Number.isNaN(Date.parse(parsed.released_at))) {
+        throw new Error("Content bundle is missing a valid released_at timestamp");
+    }
+    if (parsed.kb_entries !== undefined && !Array.isArray(parsed.kb_entries)) {
+        throw new Error("Content bundle kb_entries must be an array");
+    }
+    if (parsed.rules !== undefined && !Array.isArray(parsed.rules)) {
+        throw new Error("Content bundle rules must be an array");
+    }
+    if (parsed.override_phrases !== undefined && !Array.isArray(parsed.override_phrases)) {
+        throw new Error("Content bundle override_phrases must be an array");
+    }
+    if (parsed.known_bad !== undefined) {
+        if (!isRecord(parsed.known_bad)) {
+            throw new Error("Content bundle known_bad must be an object");
+        }
+        for (const key of KNOWN_BAD_INDICATOR_KEYS) {
+            const list = parsed.known_bad[key];
+            if (list !== undefined && !isStringArray(list)) {
+                throw new Error(`Content bundle known_bad.${key} must be an array of strings`);
+            }
+        }
+    }
+    return parsed;
+}

package/dist/content/content-store.d.ts

@@ -0,0 +1,27 @@
+import { type ContentBundle } from "./content-bundle.js";
+export interface ContentStoreDeps {
+    homeDir?: () => string;
+    publisherKeyPem?: string | null;
+}
+export interface InstalledContentVersion {
+    version: string;
+    releasedAt: string;
+}
+/** Installed versions, newest first by released_at. */
+export declare function listInstalledContentVersions(deps?: ContentStoreDeps): InstalledContentVersion[];
+export declare function getActiveContentVersion(deps?: ContentStoreDeps): string | null;
+export declare function setActiveContentVersion(version: string, deps?: ContentStoreDeps): void;
+export interface StoredContentVersion {
+    version: string;
+    pruned: string[];
+}
+/** Persist a verified bundle, activate it, and prune old versions. */
+export declare function storeContentVersion(bundle: ContentBundle, bundleBytes: Buffer, signatureBase64: string, deps?: ContentStoreDeps): StoredContentVersion;
+export declare function resetContentStoreCache(): void;
+/**
+ * Load the active, signature-verified content bundle, or null when no
+ * publisher key is configured, nothing is installed, or verification or
+ * parsing fails. Never throws: content-feed problems must degrade to
+ * bundled content, not break scanning.
+ */
+export declare function loadActiveContentBundle(deps?: ContentStoreDeps): ContentBundle | null;

package/dist/content/content-updater.d.ts

@@ -0,0 +1,32 @@
+import { type ContentStoreDeps } from "./content-store.js";
+/**
+ * Explicit, user-initiated content updates. Scanning never triggers a
+ * fetch; these functions run only from the update-kb/update-rules commands.
+ * Integrity comes from the Ed25519 signature (verified before parsing),
+ * not from the transport, so release-hosting redirects are acceptable —
+ * but the URL must be https.
+ */
+export declare const DEFAULT_CONTENT_BASE_URL = "https://github.com/jonathansantilli/codegate-content/releases/latest/download";
+export interface ContentUpdaterDeps extends ContentStoreDeps {
+    fetchImpl?: typeof fetch;
+}
+export interface ContentUpdateOptions {
+    baseUrl?: string;
+}
+export interface ContentUpdateResult {
+    changed: boolean;
+    previousVersion: string | null;
+    version: string;
+    pruned: string[];
+}
+export declare function updateContent(deps?: ContentUpdaterDeps, options?: ContentUpdateOptions): Promise<ContentUpdateResult>;
+export interface ContentCheckResult {
+    currentVersion: string | null;
+    remoteVersion: string;
+    updateAvailable: boolean;
+}
+export declare function checkContentUpdate(deps?: ContentUpdaterDeps, options?: ContentUpdateOptions): Promise<ContentCheckResult>;
+export interface ContentRollbackResult {
+    version: string;
+}
+export declare function rollbackContent(deps?: ContentUpdaterDeps): ContentRollbackResult;

package/dist/content/content-updater.js

@@ -0,0 +1,111 @@
+import { parseContentBundle, verifyBundleSignature } from "./content-bundle.js";
+import { getActiveContentVersion, listInstalledContentVersions, setActiveContentVersion, storeContentVersion, } from "./content-store.js";
+import { CONTENT_PUBLISHER_PUBLIC_KEY_PEM } from "./publisher-key.js";
+/**
+ * Explicit, user-initiated content updates. Scanning never triggers a
+ * fetch; these functions run only from the update-kb/update-rules commands.
+ * Integrity comes from the Ed25519 signature (verified before parsing),
+ * not from the transport, so release-hosting redirects are acceptable —
+ * but the URL must be https.
+ */
+export const DEFAULT_CONTENT_BASE_URL = "https://github.com/jonathansantilli/codegate-content/releases/latest/download";
+const BUNDLE_NAME = "codegate-content.json";
+const FETCH_TIMEOUT_MS = 15_000;
+const MAX_BUNDLE_BYTES = 8 * 1024 * 1024;
+const MAX_SIGNATURE_BYTES = 4096;
+function requirePublisherKey(deps) {
+    const key = deps.publisherKeyPem !== undefined ? deps.publisherKeyPem : CONTENT_PUBLISHER_PUBLIC_KEY_PEM;
+    if (!key) {
+        throw new Error("No content publisher key is configured in this build, so remote content cannot be " +
+            "verified. Content updates ship with CodeGate releases: npm update -g codegate-ai");
+    }
+    return key;
+}
+async function fetchBytes(url, maxBytes, deps) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") {
+        throw new Error(`Content URL must use https: ${url}`);
+    }
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const response = await fetchImpl(url, {
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        throw new Error(`Content download failed with HTTP ${response.status} for ${url}`);
+    }
+    const contentLength = response.headers.get("content-length");
+    if (contentLength && Number.parseInt(contentLength, 10) > maxBytes) {
+        throw new Error(`Content download exceeds ${maxBytes} bytes: ${url}`);
+    }
+    const body = response.body;
+    if (!body) {
+        const buffer = Buffer.from(await response.arrayBuffer());
+        if (buffer.byteLength > maxBytes) {
+            throw new Error(`Content download exceeds ${maxBytes} bytes: ${url}`);
+        }
+        return buffer;
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new Error(`Content download exceeds ${maxBytes} bytes: ${url}`);
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+}
+async function fetchAndVerifyBundle(deps, options) {
+    const key = requirePublisherKey(deps);
+    const baseUrl = (options.baseUrl ?? DEFAULT_CONTENT_BASE_URL).replace(/\/+$/u, "");
+    const bundleBytes = await fetchBytes(`${baseUrl}/${BUNDLE_NAME}`, MAX_BUNDLE_BYTES, deps);
+    const signature = (await fetchBytes(`${baseUrl}/${BUNDLE_NAME}.sig`, MAX_SIGNATURE_BYTES, deps)).toString("utf8");
+    if (!verifyBundleSignature(bundleBytes, signature, key)) {
+        throw new Error("Content bundle signature verification failed. The download was rejected and nothing was installed.");
+    }
+    // Parse only after the signature proved the bytes came from the publisher.
+    const bundle = parseContentBundle(bundleBytes);
+    return { bundleBytes, signature, version: bundle.content_version };
+}
+export async function updateContent(deps = {}, options = {}) {
+    const fetched = await fetchAndVerifyBundle(deps, options);
+    const previousVersion = getActiveContentVersion(deps);
+    if (previousVersion === fetched.version) {
+        return { changed: false, previousVersion, version: fetched.version, pruned: [] };
+    }
+    const bundle = parseContentBundle(fetched.bundleBytes);
+    const stored = storeContentVersion(bundle, fetched.bundleBytes, fetched.signature, deps);
+    return {
+        changed: true,
+        previousVersion,
+        version: stored.version,
+        pruned: stored.pruned,
+    };
+}
+export async function checkContentUpdate(deps = {}, options = {}) {
+    const fetched = await fetchAndVerifyBundle(deps, options);
+    const currentVersion = getActiveContentVersion(deps);
+    return {
+        currentVersion,
+        remoteVersion: fetched.version,
+        updateAvailable: currentVersion !== fetched.version,
+    };
+}
+export function rollbackContent(deps = {}) {
+    const installed = listInstalledContentVersions(deps);
+    const active = getActiveContentVersion(deps);
+    const candidates = installed.filter((entry) => entry.version !== active);
+    const target = candidates[0];
+    if (!target) {
+        throw new Error("No previous content version is installed to roll back to.");
+    }
+    setActiveContentVersion(target.version, deps);
+    return { version: target.version };
+}

package/dist/content/known-bad.d.ts

@@ -0,0 +1,26 @@
+export interface KnownBadDeps {
+    homeDir?: () => string;
+}
+/**
+ * Indicators normalized for matching: hashes and package names lowercased,
+ * fingerprints carrying the `sha256:` prefix used by finding fingerprints.
+ */
+export interface ResolvedKnownBadIndicators {
+    fileSha256: ReadonlySet<string>;
+    packageNames: ReadonlySet<string>;
+    urlPatterns: readonly string[];
+    findingFingerprints: ReadonlySet<string>;
+}
+export declare function hasKnownBadIndicators(indicators: ResolvedKnownBadIndicators): boolean;
+/** Accepts `sha256:<hex>` or bare hex; returns bare lowercase hex or null. */
+export declare function normalizeSha256Indicator(value: string): string | null;
+/** Finding fingerprints are stored and compared with the `sha256:` prefix. */
+export declare function normalizeFingerprintIndicator(value: string): string | null;
+export declare function resetKnownBadIndicatorsCache(): void;
+/**
+ * Known-bad indicators merged from the verified content feed and the local
+ * `~/.codegate/known-bad.json`. The local file is user-controlled (same trust
+ * as the global config) and exists so indicators work before the feed is
+ * live. Never throws: indicator problems must not break scanning.
+ */
+export declare function loadKnownBadIndicators(deps?: KnownBadDeps): ResolvedKnownBadIndicators;

package/dist/content/known-bad.js

@@ -0,0 +1,100 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { KNOWN_BAD_INDICATOR_KEYS, } from "./content-bundle.js";
+import { loadActiveContentBundle } from "./content-store.js";
+const LOCAL_INDICATORS_FILE = "known-bad.json";
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/u;
+const SHA256_PREFIX = "sha256:";
+export function hasKnownBadIndicators(indicators) {
+    return (indicators.fileSha256.size > 0 ||
+        indicators.packageNames.size > 0 ||
+        indicators.urlPatterns.length > 0 ||
+        indicators.findingFingerprints.size > 0);
+}
+/** Accepts `sha256:<hex>` or bare hex; returns bare lowercase hex or null. */
+export function normalizeSha256Indicator(value) {
+    const trimmed = value.trim().toLowerCase();
+    const bare = trimmed.startsWith(SHA256_PREFIX) ? trimmed.slice(SHA256_PREFIX.length) : trimmed;
+    return SHA256_HEX_PATTERN.test(bare) ? bare : null;
+}
+/** Finding fingerprints are stored and compared with the `sha256:` prefix. */
+export function normalizeFingerprintIndicator(value) {
+    const bare = normalizeSha256Indicator(value);
+    return bare === null ? null : `${SHA256_PREFIX}${bare}`;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Keep only well-formed string lists; anything else degrades to empty. */
+function sanitizeIndicators(value) {
+    if (!isRecord(value)) {
+        return {};
+    }
+    const sanitized = {};
+    for (const key of KNOWN_BAD_INDICATOR_KEYS) {
+        const list = value[key];
+        if (Array.isArray(list)) {
+            sanitized[key] = list.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+        }
+    }
+    return sanitized;
+}
+function loadLocalIndicators(deps) {
+    const home = deps.homeDir ? deps.homeDir() : homedir();
+    try {
+        const raw = readFileSync(join(home, ".codegate", LOCAL_INDICATORS_FILE), "utf8");
+        return sanitizeIndicators(JSON.parse(raw));
+    }
+    catch {
+        return {};
+    }
+}
+function indicatorList(sources, key) {
+    return sources.flatMap((source) => source[key] ?? []);
+}
+function resolveIndicators(sources) {
+    const fileSha256 = new Set();
+    for (const entry of indicatorList(sources, "file_sha256")) {
+        const normalized = normalizeSha256Indicator(entry);
+        if (normalized) {
+            fileSha256.add(normalized);
+        }
+    }
+    const packageNames = new Set(indicatorList(sources, "package_names").map((entry) => entry.trim().toLowerCase()));
+    const urlPatterns = Array.from(new Set(indicatorList(sources, "url_patterns").map((entry) => entry.trim().toLowerCase())));
+    const findingFingerprints = new Set();
+    for (const entry of indicatorList(sources, "finding_fingerprints")) {
+        const normalized = normalizeFingerprintIndicator(entry);
+        if (normalized) {
+            findingFingerprints.add(normalized);
+        }
+    }
+    return { fileSha256, packageNames, urlPatterns, findingFingerprints };
+}
+let cache = null;
+export function resetKnownBadIndicatorsCache() {
+    cache = null;
+}
+/**
+ * Known-bad indicators merged from the verified content feed and the local
+ * `~/.codegate/known-bad.json`. The local file is user-controlled (same trust
+ * as the global config) and exists so indicators work before the feed is
+ * live. Never throws: indicator problems must not break scanning.
+ */
+export function loadKnownBadIndicators(deps = {}) {
+    const home = deps.homeDir ? deps.homeDir() : homedir();
+    if (cache && cache.key === home) {
+        return cache.indicators;
+    }
+    let feedIndicators;
+    try {
+        feedIndicators = sanitizeIndicators(loadActiveContentBundle()?.known_bad);
+    }
+    catch {
+        feedIndicators = {};
+    }
+    const indicators = resolveIndicators([feedIndicators, loadLocalIndicators(deps)]);
+    cache = { key: home, indicators };
+    return indicators;
+}

package/dist/content/publisher-key.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ed25519 public key of the CodeGate content publisher, PEM (SPKI) format.
+ *
+ * Deliberately null until the owner decides key custody and the content
+ * repository location (see docs/content-feed.md). While null, the update
+ * commands refuse to fetch and every loader uses only bundled content.
+ * Generate a pair with scripts/content-feed/generate-keypair.mjs and paste
+ * the public PEM here.
+ */
+export declare const CONTENT_PUBLISHER_PUBLIC_KEY_PEM: string | null;

package/dist/content/publisher-key.js

@@ -0,0 +1,10 @@
+/**
+ * Ed25519 public key of the CodeGate content publisher, PEM (SPKI) format.
+ *
+ * Deliberately null until the owner decides key custody and the content
+ * repository location (see docs/content-feed.md). While null, the update
+ * commands refuse to fetch and every loader uses only bundled content.
+ * Generate a pair with scripts/content-feed/generate-keypair.mjs and paste
+ * the public PEM here.
+ */
+export const CONTENT_PUBLISHER_PUBLIC_KEY_PEM = null;

package/dist/layer1-discovery/knowledge-base.js

@@ -2,6 +2,7 @@ import { readdirSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, extname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { loadActiveContentBundle } from "../content/content-store.js";
 const defaultKnowledgeBaseDir = resolve(dirname(fileURLToPath(import.meta.url)), "../knowledge-base");
 const schemaPath = join(defaultKnowledgeBaseDir, "schema.json");
 const require = createRequire(import.meta.url);
@@ -32,7 +33,38 @@ export function validateKnowledgeBaseEntry(candidate, path = schemaPath) {
         errors: toErrors(validator.errors),
     };
 }
-export function loadKnowledgeBase(baseDir = defaultKnowledgeBaseDir) {
+function loadKnowledgeBaseFromContentFeed() {
+    try {
+        const bundle = loadActiveContentBundle();
+        if (!bundle?.kb_entries || bundle.kb_entries.length === 0) {
+            return null;
+        }
+        const validator = createValidator(schemaPath);
+        for (const entry of bundle.kb_entries) {
+            if (!validator(entry)) {
+                // One invalid feed entry disqualifies the whole feed KB; bundled
+                // content is the safe fallback.
+                return null;
+            }
+        }
+        return {
+            schemaVersion: bundle.kb_schema_version ?? `feed-${bundle.content_version}`,
+            entries: bundle.kb_entries,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function loadKnowledgeBase(baseDir) {
+    // An explicit baseDir bypasses the content feed (tests, custom setups).
+    if (baseDir === undefined) {
+        const fromFeed = loadKnowledgeBaseFromContentFeed();
+        if (fromFeed) {
+            return fromFeed;
+        }
+        baseDir = defaultKnowledgeBaseDir;
+    }
     const schema = loadSchema(join(baseDir, "schema.json"));
     const validator = createValidator(join(baseDir, "schema.json"));
     const entryFiles = readdirSync(baseDir)

package/dist/layer2-static/data/popular-mcp-packages.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Well-known MCP server packages used as the reference set for typosquat
+ * detection. Curated, not exhaustive: entries should be packages an
+ * attacker would plausibly imitate. Data-driven so the content feed can
+ * extend it without a release.
+ */
+export declare const POPULAR_MCP_PACKAGES: Readonly<{
+    npm: readonly string[];
+    pypi: readonly string[];
+}>;
+export declare function resetActivePopularMcpPackagesCache(): void;
+/** Bundled popular packages plus any extras delivered by the verified content feed. */
+export declare function activePopularMcpPackages(): {
+    npm: readonly string[];
+    pypi: readonly string[];
+};