codegate-ai 0.16.2 → 1.0.1

package/dist/layer2-static/detectors/rule-file.js

@@ -1,22 +1,8 @@
 import { buildFindingEvidence } from "../evidence.js";
-const DIRECT_OVERRIDE_PHRASES = [
-    "ignore previous instructions",
-    "skip permissions",
-    "bypass permissions",
-];
-const NEGATION_PATTERN = /\b(?:must not|should not|do not|don't|never)\b/iu;
-const SENSITIVE_READ_PATTERN = /\b(?:read|cat)\s+(?:~\/\.ssh(?:\/[^\s]+)?|\.env\b|~\/\.[a-z0-9._-]+(?:\/[^\s]+)*)/iu;
-const OUTBOUND_TRANSFER_PATTERN = /\b(?:upload externally|send to (?:an |a )?(?:external )?(?:webhook|endpoint|server)|curl\b|wget\b|invoke-webrequest\b|post to\b|https?:\/\/|exfiltrat(?:e|ion|ing))\b/iu;
-const SUSPICIOUS_LONG_LINE_PATTERN = /\b(?:ignore previous instructions|skip permissions|bypass permissions|upload externally|curl\b|wget\b|https?:\/\/|bash\s+-lc|sh\s+-c|powershell\b|base64\b|~\/\.ssh|\.env\b)\b/iu;
-const REMOTE_SHELL_PATTERN = /\b(?:curl|wget)\b[^\n|]{0,240}\|\s*(?:bash|sh)\b|\b(?:invoke-webrequest|iwr)\b[^\n|]{0,240}\|\s*(?:iex|invoke-expression)\b/iu;
-const HTML_COMMENT_PATTERN = /<!--([\s\S]*?)-->/gu;
-const COMMENT_PAYLOAD_PATTERN = /\b(?:secret instructions|ignore previous instructions|curl\b|wget\b|invoke-webrequest\b|bash\b|powershell\b|session share\b|profile sync\b)\b/iu;
-const COOKIE_EXPORT_PATTERN = /\bcookies?\s+(?:export|import|get)\b/iu;
-const SESSION_SHARE_PATTERN = /\bsession\s+share\b|\blive url\b/iu;
-const PROFILE_SYNC_PATTERN = /\bprofile\s+sync\b|\breal chrome\b|\blogin sessions\b|\bsession tokens?\b|--profile\b/iu;
-const BOOTSTRAP_INSTALL_PATTERN = /\b(?:npm|pnpm|yarn|bun)\s+install\s+-g\b|\bbrew\s+install\b|\bpipx\s+install\b|\bgo\s+install\b|\b(?:npx|pnpx|uvx)\b[^\n`]{0,160}@latest\b/iu;
-const AGENT_CONTROL_POINT_PATTERN = /\.claude\/hooks\/|\.claude\/settings\.json|\.claude\/agents\/|\bclaude\.md\b|\bagents\.md\b|\bmcp configuration\b/iu;
-const RESTART_LOAD_PATTERN = /\brestart\b.*\b(?:load|take effect|activate|reload|work)\b|\bonly load after restart\b|\bafter restarting\b/iu;
+import { scanEncodedPayloads } from "../text/encoded-payloads.js";
+import { normalizeForMatching } from "../text/normalize.js";
+import { AGENT_CONTROL_POINT_PATTERN, BOOTSTRAP_INSTALL_PATTERN, COMMENT_PAYLOAD_PATTERN, COOKIE_EXPORT_PATTERN, HTML_COMMENT_PATTERN, NEGATION_PATTERN, OUTBOUND_TRANSFER_PATTERN, PROFILE_SYNC_PATTERN, REMOTE_INSTRUCTION_INDIRECTION_PATTERN, REMOTE_SHELL_PATTERN, RESTART_LOAD_PATTERN, SENSITIVE_READ_PATTERN, SESSION_SHARE_PATTERN, SUSPICIOUS_LONG_LINE_PATTERN, findOverridePhrase, hasNegationBefore, } from "../text/threat-patterns.js";
+import { HIDDEN_UNICODE_CLASS, findHiddenUnicode } from "../text/unicode.js";
 function makeFinding(filePath, field, ruleId, description, evidence, severity = "HIGH", narrative = {}) {
     const location = { field };
     if (typeof evidence?.line === "number") {
@@ -79,53 +65,45 @@ function buildMultilineEvidence(lines, lineNumbers) {
         column: 1,
     };
 }
-function hasNearbyNegation(line, matchIndex) {
-    const prefix = line.slice(Math.max(0, matchIndex - 24), matchIndex);
-    return NEGATION_PATTERN.test(prefix);
-}
 function detectSuspiciousInstruction(lines) {
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index] ?? "";
-        const lower = line.toLowerCase();
-        for (const phrase of DIRECT_OVERRIDE_PHRASES) {
-            const matchIndex = lower.indexOf(phrase);
-            if (matchIndex < 0 || hasNearbyNegation(lower, matchIndex)) {
-                continue;
-            }
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
+        const original = lines.original[index] ?? "";
+        const overrideMatch = findOverridePhrase(normalized);
+        if (overrideMatch) {
             return {
-                phrase,
-                evidence: buildLineEvidence(line, index + 1, matchIndex + 1),
+                phrase: overrideMatch.phrase,
+                evidence: buildLineEvidence(original, index + 1, overrideMatch.index + 1),
             };
         }
-        const sensitiveReadMatch = line.match(SENSITIVE_READ_PATTERN);
-        const outboundMatch = line.match(OUTBOUND_TRANSFER_PATTERN);
+        const sensitiveReadMatch = normalized.match(SENSITIVE_READ_PATTERN);
+        const outboundMatch = normalized.match(OUTBOUND_TRANSFER_PATTERN);
         if (!sensitiveReadMatch || !outboundMatch) {
             continue;
         }
-        const outboundIndex = outboundMatch.index ?? line.length;
-        if (hasNearbyNegation(lower, outboundIndex)) {
+        const outboundIndex = outboundMatch.index ?? normalized.length;
+        if (hasNegationBefore(normalized, outboundIndex)) {
             continue;
         }
-        const phrase = outboundMatch[0].toLowerCase();
         return {
-            phrase,
-            evidence: buildLineEvidence(line, index + 1, outboundIndex + 1),
+            phrase: outboundMatch[0].toLowerCase(),
+            evidence: buildLineEvidence(original, index + 1, outboundIndex + 1),
         };
     }
     return null;
 }
 function detectRemoteShell(lines) {
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index] ?? "";
-        const match = line.match(REMOTE_SHELL_PATTERN);
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
+        const match = normalized.match(REMOTE_SHELL_PATTERN);
         if (!match) {
             continue;
         }
         const matchIndex = match.index ?? 0;
-        if (hasNearbyNegation(line.toLowerCase(), matchIndex)) {
+        if (hasNegationBefore(normalized, matchIndex)) {
             continue;
         }
-        return buildLineEvidence(line, index + 1, matchIndex + 1);
+        return buildLineEvidence(lines.original[index] ?? "", index + 1, matchIndex + 1);
     }
     return null;
 }
@@ -143,12 +121,12 @@ function shellLabelFromEvidence(evidence) {
     return "a shell";
 }
 function detectHiddenCommentPayload(input, lines) {
-    HTML_COMMENT_PATTERN.lastIndex = 0;
-    let match = HTML_COMMENT_PATTERN.exec(input.textContent);
+    const commentRegex = new RegExp(HTML_COMMENT_PATTERN.source, "gu");
+    let match = commentRegex.exec(input.textContent);
     while (match) {
-        const commentBody = match[1] ?? "";
+        const commentBody = normalizeForMatching(match[1] ?? "");
         if (!COMMENT_PAYLOAD_PATTERN.test(commentBody)) {
-            match = HTML_COMMENT_PATTERN.exec(input.textContent);
+            match = commentRegex.exec(input.textContent);
             continue;
         }
         const startLine = input.textContent.slice(0, match.index ?? 0).split(/\r?\n/u).length;
@@ -161,22 +139,21 @@ function detectHiddenCommentPayload(input, lines) {
 function detectSessionTransfer(lines) {
     const matchedLines = [];
     const categories = new Set();
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index] ?? "";
-        const lower = line.toLowerCase();
-        if (NEGATION_PATTERN.test(lower)) {
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
+        if (NEGATION_PATTERN.test(normalized)) {
             continue;
         }
         let matched = false;
-        if (COOKIE_EXPORT_PATTERN.test(line)) {
+        if (COOKIE_EXPORT_PATTERN.test(normalized)) {
             categories.add("cookies");
             matched = true;
         }
-        if (SESSION_SHARE_PATTERN.test(line)) {
+        if (SESSION_SHARE_PATTERN.test(normalized)) {
             categories.add("session_share");
             matched = true;
         }
-        if (PROFILE_SYNC_PATTERN.test(line)) {
+        if (PROFILE_SYNC_PATTERN.test(normalized)) {
             categories.add("profile");
             matched = true;
         }
@@ -187,52 +164,110 @@ function detectSessionTransfer(lines) {
     if (categories.size < 2 || matchedLines.length < 2) {
         return null;
     }
-    return buildMultilineEvidence(lines, matchedLines.slice(0, 4));
+    return buildMultilineEvidence(lines.original, matchedLines.slice(0, 4));
 }
 function detectBootstrapControlPoints(lines) {
     const installLines = [];
     const controlPointLines = [];
     const restartLines = [];
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index] ?? "";
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
         const lineNumber = index + 1;
-        if (BOOTSTRAP_INSTALL_PATTERN.test(line)) {
+        if (BOOTSTRAP_INSTALL_PATTERN.test(normalized)) {
             installLines.push(lineNumber);
         }
-        if (AGENT_CONTROL_POINT_PATTERN.test(line)) {
+        if (AGENT_CONTROL_POINT_PATTERN.test(normalized)) {
             controlPointLines.push(lineNumber);
         }
-        if (RESTART_LOAD_PATTERN.test(line)) {
+        if (RESTART_LOAD_PATTERN.test(normalized)) {
             restartLines.push(lineNumber);
         }
     }
     if (installLines.length === 0 || controlPointLines.length === 0 || restartLines.length === 0) {
         return null;
     }
-    return buildMultilineEvidence(lines, [
+    return buildMultilineEvidence(lines.original, [
         ...installLines.slice(0, 2),
         ...controlPointLines.slice(0, 2),
         restartLines[0],
     ]);
 }
-export function detectRuleFileIssues(input) {
+function hiddenUnicodeFindings(input) {
+    if (input.unicodeAnalysis === false) {
+        return [];
+    }
+    const matches = findHiddenUnicode(input.textContent);
+    if (matches.length === 0) {
+        return [];
+    }
     const findings = [];
-    const hiddenUnicodeRegex = /(?:\u200B|\u200C|\u200D|\u2060|\uFEFF|[\u202A-\u202E])/u;
-    const hiddenRemoteShellIncident = {
-        incidentId: "hidden-remote-shell-payload",
-        incidentTitle: "Hidden remote shell payload in skill file",
-    };
-    const hiddenMatch = input.unicodeAnalysis === false ? null : input.textContent.match(hiddenUnicodeRegex);
-    if (hiddenMatch?.[0]) {
+    const tagMatches = matches.filter((match) => match.class === HIDDEN_UNICODE_CLASS.Tags);
+    const otherMatches = matches.filter((match) => match.class !== HIDDEN_UNICODE_CLASS.Tags);
+    if (otherMatches.length > 0) {
+        const firstChar = String.fromCodePoint(otherMatches[0]?.codePoint ?? 0x200b);
         const evidence = buildFindingEvidence({
             textContent: input.textContent,
-            searchTerms: [hiddenMatch[0]],
+            searchTerms: [firstChar],
             fallbackValue: "hidden Unicode character detected",
         });
         findings.push(makeFinding(input.filePath, "hidden_unicode", "rule-file-hidden-unicode", "Rule file contains hidden Unicode characters", evidence));
     }
-    const lines = input.textContent.split(/\r?\n/u);
-    const hiddenCommentPayload = detectHiddenCommentPayload(input, lines);
+    if (tagMatches.length > 0) {
+        const lineNumber = input.textContent.slice(0, tagMatches[0]?.index ?? 0).split(/\r?\n/u).length;
+        findings.push(makeFinding(input.filePath, "hidden_unicode_tags", "rule-file-hidden-unicode-tags", `Rule file contains ${tagMatches.length} Unicode tag character(s) (U+E0000-U+E007F), ` +
+            "an ASCII-smuggling channel that hides instructions from human reviewers", { evidence: `line ${lineNumber}: ${tagMatches.length} tag character(s)`, line: lineNumber }, "HIGH", {
+            observed: [
+                "The file embeds Unicode tag characters that render as nothing in editors and diffs.",
+                "Tag characters encode invisible ASCII that still reaches models that read the file.",
+            ],
+            inference: "Invisible tag-character content is a known prompt-injection smuggling technique.",
+            notVerified: ["CodeGate did not decode or follow any smuggled instruction."],
+        }));
+    }
+    return findings;
+}
+function encodedPayloadFindings(input, lines) {
+    return scanEncodedPayloads(input.textContent).map((match) => {
+        const severity = match.matchesRemoteShell ? "CRITICAL" : "HIGH";
+        const behaviors = [
+            match.matchesRemoteShell ? "remote shell execution" : null,
+            match.matchesOverridePhrase ? "instruction override" : null,
+            match.matchesSensitiveExfil ? "sensitive-data exfiltration" : null,
+            match.matchesCommandExecution ? "command execution" : null,
+        ].filter((entry) => entry !== null);
+        const sourceLine = lines[match.line - 1] ?? "";
+        const evidence = {
+            evidence: `line ${match.line}\n${match.line} | ${sourceLine.slice(0, 200)}\n` +
+                `decoded (${match.kind}): ${match.decodedExcerpt}`,
+            line: match.line,
+            column: 1,
+        };
+        return makeFinding(input.filePath, `encoded_payload:${match.line}`, "rule-file-encoded-payload", `Rule file contains a ${match.kind}-encoded payload that decodes to ${behaviors.join(", ")}`, evidence, severity, {
+            observed: [
+                `An encoded ${match.kind} blob decodes to readable instructions.`,
+                `The decoded content matches: ${behaviors.join(", ")}.`,
+            ],
+            inference: "Encoding hides the payload from human review while keeping it machine-usable.",
+            notVerified: [
+                "CodeGate did not execute any decoded instruction.",
+                "CodeGate did not fetch any URL referenced by the decoded content.",
+            ],
+        });
+    });
+}
+export function detectRuleFileIssues(input) {
+    const findings = [];
+    const hiddenRemoteShellIncident = {
+        incidentId: "hidden-remote-shell-payload",
+        incidentTitle: "Hidden remote shell payload in skill file",
+    };
+    findings.push(...hiddenUnicodeFindings(input));
+    const originalLines = input.textContent.split(/\r?\n/u);
+    const lines = {
+        original: originalLines,
+        normalized: originalLines.map((line) => normalizeForMatching(line)),
+    };
+    const hiddenCommentPayload = detectHiddenCommentPayload(input, lines.original);
     if (hiddenCommentPayload) {
         findings.push(makeFinding(input.filePath, "hidden_comment_payload", "rule-file-hidden-comment-payload", "Rule file contains a hidden comment payload with executable or override instructions", hiddenCommentPayload, "CRITICAL", {
             ...hiddenRemoteShellIncident,
@@ -290,11 +325,29 @@ export function detectRuleFileIssues(input) {
             ],
         }));
     }
-    const longLineIndex = lines.findIndex((line) => line.length > 300 && SUSPICIOUS_LONG_LINE_PATTERN.test(line) && !NEGATION_PATTERN.test(line));
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
+        const match = normalized.match(REMOTE_INSTRUCTION_INDIRECTION_PATTERN);
+        if (!match || hasNegationBefore(normalized, match.index ?? 0)) {
+            continue;
+        }
+        findings.push(makeFinding(input.filePath, "remote_instruction_indirection", "rule-file-remote-instruction-indirection", "Rule file directs the agent to fetch and follow instructions from a remote URL", buildLineEvidence(lines.original[index] ?? "", index + 1, (match.index ?? 0) + 1), "HIGH", {
+            observed: [
+                "The file tells the agent to read or follow instructions hosted at an external URL.",
+            ],
+            inference: "Remote instructions can change at any time after review, so the effective behavior is not what was audited.",
+            notVerified: ["CodeGate did not fetch the referenced URL."],
+        }));
+        break;
+    }
+    findings.push(...encodedPayloadFindings(input, lines.original));
+    const longLineIndex = lines.normalized.findIndex((normalized, index) => (lines.original[index] ?? "").length > 300 &&
+        SUSPICIOUS_LONG_LINE_PATTERN.test(normalized) &&
+        !NEGATION_PATTERN.test(normalized));
     if (longLineIndex >= 0) {
         const lineNumber = longLineIndex + 1;
         const evidence = {
-            evidence: `line ${lineNumber}\n${lineNumber} | ${lines[longLineIndex]}`,
+            evidence: `line ${lineNumber}\n${lineNumber} | ${lines.original[longLineIndex]}`,
             line: lineNumber,
             column: 1,
         };

package/dist/layer2-static/detectors/skill-frontmatter.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from "../../types/finding.js";
+export interface SkillFrontmatterInput {
+    filePath: string;
+    textContent: string;
+}
+export declare function detectSkillFrontmatterIssues(input: SkillFrontmatterInput): Finding[];

package/dist/layer2-static/detectors/skill-frontmatter.js

@@ -0,0 +1,130 @@
+import { load as parseYaml } from "js-yaml";
+import { normalizeForMatching } from "../text/normalize.js";
+import { REMOTE_INSTRUCTION_INDIRECTION_PATTERN, REMOTE_SHELL_PATTERN, findOverridePhrase, } from "../text/threat-patterns.js";
+const SKILL_FILE_NAME = "skill.md";
+const FRONTMATTER_PATTERN = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/u;
+// Tool grants that hand a skill unrestricted execution or wildcard access.
+const BROAD_TOOL_BASES = new Set(["bash", "shell", "terminal", "exec", "execute"]);
+const WILDCARD_GRANTS = new Set(["*", "all"]);
+function isSkillFile(filePath) {
+    const segments = filePath.replaceAll("\\", "/").split("/");
+    return (segments[segments.length - 1] ?? "").toLowerCase() === SKILL_FILE_NAME;
+}
+function skillDirectoryName(filePath) {
+    const segments = filePath.replaceAll("\\", "/").split("/");
+    return segments.length >= 2 ? (segments[segments.length - 2] ?? null) : null;
+}
+function makeFinding(input, ruleId, field, severity, category, description, cwe) {
+    return {
+        rule_id: ruleId,
+        finding_id: `SKILL_FRONTMATTER-${input.filePath}-${field}`,
+        severity,
+        category,
+        layer: "L2",
+        file_path: input.filePath,
+        location: { field: `frontmatter.${field}` },
+        description,
+        affected_tools: ["claude-code", "codex-cli", "opencode", "cursor"],
+        cve: null,
+        owasp: ["ASI02"],
+        cwe,
+        confidence: "HIGH",
+        fixable: true,
+        remediation_actions: ["remove_field", "quarantine_file"],
+        metadata: {
+            sources: [input.filePath, field],
+            risk_tags: ["skill", "frontmatter"],
+            origin: "skill-frontmatter",
+        },
+        suppressed: false,
+    };
+}
+function parseFrontmatter(textContent) {
+    const match = textContent.match(FRONTMATTER_PATTERN);
+    if (!match?.[1]) {
+        return null;
+    }
+    try {
+        const parsed = parseYaml(match[1]);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function collectToolGrants(value) {
+    if (typeof value === "string") {
+        return value
+            .split(",")
+            .map((entry) => entry.trim())
+            .filter((entry) => entry.length > 0);
+    }
+    if (Array.isArray(value)) {
+        return value
+            .filter((entry) => typeof entry === "string")
+            .map((entry) => entry.trim())
+            .filter((entry) => entry.length > 0);
+    }
+    return [];
+}
+function parseToolGrant(raw) {
+    const match = raw.match(/^([^()]+)(?:\(([^)]*)\))?$/u);
+    const base = (match?.[1] ?? raw).trim().toLowerCase();
+    const qualifier = match?.[2] !== undefined ? match[2].trim() : null;
+    return { raw, base, qualifier };
+}
+function isBroadGrant(grant) {
+    if (WILDCARD_GRANTS.has(grant.base)) {
+        return true;
+    }
+    if (!BROAD_TOOL_BASES.has(grant.base)) {
+        return false;
+    }
+    return grant.qualifier === null || grant.qualifier === "" || grant.qualifier === "*";
+}
+function frontmatterTextFields(frontmatter) {
+    const texts = [];
+    for (const value of Object.values(frontmatter)) {
+        if (typeof value === "string") {
+            texts.push(value);
+        }
+    }
+    return texts;
+}
+export function detectSkillFrontmatterIssues(input) {
+    if (!isSkillFile(input.filePath)) {
+        return [];
+    }
+    const frontmatter = parseFrontmatter(input.textContent);
+    if (!frontmatter) {
+        return [];
+    }
+    const findings = [];
+    const grantsRaw = frontmatter["allowed-tools"] ?? frontmatter.allowed_tools;
+    const broadGrants = collectToolGrants(grantsRaw).map(parseToolGrant).filter(isBroadGrant);
+    if (broadGrants.length > 0) {
+        findings.push(makeFinding(input, "skill-allowed-tools-broad", "allowed-tools", "HIGH", "CONSENT_BYPASS", `Skill frontmatter requests unrestricted tool access: ${broadGrants
+            .map((grant) => grant.raw)
+            .join(", ")}. Unqualified shell or wildcard grants let the skill run arbitrary commands.`, "CWE-250"));
+    }
+    const hiddenInstructionTexts = frontmatterTextFields(frontmatter).filter((text) => {
+        const normalized = normalizeForMatching(text);
+        return (findOverridePhrase(normalized) !== null ||
+            REMOTE_SHELL_PATTERN.test(normalized) ||
+            REMOTE_INSTRUCTION_INDIRECTION_PATTERN.test(normalized));
+    });
+    if (hiddenInstructionTexts.length > 0) {
+        findings.push(makeFinding(input, "skill-frontmatter-hidden-instructions", "metadata", "HIGH", "RULE_INJECTION", "Skill frontmatter metadata contains override, remote-shell, or remote-instruction language " +
+            "outside the visible skill body.", "CWE-116"));
+    }
+    const declaredName = typeof frontmatter.name === "string" ? frontmatter.name.trim() : null;
+    const directoryName = skillDirectoryName(input.filePath);
+    if (declaredName && directoryName && declaredName.toLowerCase() !== directoryName.toLowerCase()) {
+        findings.push(makeFinding(input, "skill-frontmatter-mismatch", "name", "INFO", "CONFIG_PRESENT", `Skill frontmatter name "${declaredName}" does not match its directory "${directoryName}". ` +
+            "Name confusion is a common registry-squatting signal.", "CWE-1021"));
+    }
+    return findings;
+}

package/dist/layer2-static/engine.d.ts

@@ -3,6 +3,7 @@ import { type SymlinkEscapeEntry } from "./detectors/symlink.js";
 import type { AuditPersona, RuntimeMode } from "../config.js";
 import { type Finding } from "../types/finding.js";
 import type { DiscoveryFormat } from "../types/discovery.js";
+import type { ResolvedKnownBadIndicators } from "../content/known-bad.js";
 export interface StaticFileInput {
     filePath: string;
     format: DiscoveryFormat;
@@ -28,6 +29,7 @@ export interface StaticEngineConfig {
         disable?: boolean;
         config?: Record<string, unknown>;
     }>;
+    knownBadIndicators?: ResolvedKnownBadIndicators;
 }
 export interface StaticEngineInput {
     projectRoot: string;

package/dist/layer2-static/rule-pack-loader.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, extname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { loadActiveContentBundle } from "../content/content-store.js";
 const defaultRulesDir = resolve(dirname(fileURLToPath(import.meta.url)), "rules");
 const require = createRequire(import.meta.url);
 const Ajv = require("ajv");
@@ -179,9 +180,31 @@ function normalizeOptions(arg) {
         skipRules: normalizeRuleIds(options.skip_rules),
     };
 }
+function loadContentFeedRules() {
+    try {
+        const bundle = loadActiveContentBundle();
+        const rules = bundle?.rules ?? [];
+        const validated = [];
+        for (const candidate of rules) {
+            if (!ruleValidator(candidate)) {
+                // One invalid feed rule disqualifies the feed's rule set; bundled
+                // rules remain the safe baseline.
+                return [];
+            }
+            validated.push(candidate);
+        }
+        return validated;
+    }
+    catch {
+        return [];
+    }
+}
 export function loadRulePacks(arg) {
     const options = normalizeOptions(arg);
     const bundledRules = collectRulesFromPaths([options.baseDir]);
+    const feedRules = loadContentFeedRules();
     const externalRules = collectRulesFromPaths(options.rulePackPaths);
-    return filterRules(dedupeByRuleId([...bundledRules, ...externalRules]), options.allowedRules, options.skipRules);
+    // Later entries win in dedupe: user packs override feed rules, which
+    // override bundled rules.
+    return filterRules(dedupeByRuleId([...bundledRules, ...feedRules, ...externalRules]), options.allowedRules, options.skipRules);
 }

package/dist/layer2-static/state/scan-state.d.ts

@@ -5,6 +5,7 @@ export interface ScanStateServerEntry {
     first_seen: string;
     last_seen: string;
 }
+/** Scan state for a single project root (one slice of the state file). */
 export interface ScanState {
     servers: Record<string, ScanStateServerEntry>;
 }
@@ -19,14 +20,18 @@ export interface EvaluateScanStateSnapshotsInput {
     snapshots: McpServerSnapshot[];
     previousState: ScanState;
     nowIso?: string;
+    /** Trusted targets get INFO first-seen findings; untrusted get MEDIUM. */
+    trustedTarget?: boolean;
+    /** When false, first-seen findings are skipped (state is still recorded). */
+    firstScanReview?: boolean;
 }
 export interface EvaluateScanStateSnapshotsResult {
     findings: Finding[];
     nextState: ScanState;
 }
 export declare function getScanStatePath(customPath?: string): string;
-export declare function loadScanState(customPath?: string): ScanState;
-export declare function saveScanState(state: ScanState, customPath?: string): void;
+export declare function loadScanState(customPath?: string, projectRoot?: string): ScanState;
+export declare function saveScanState(state: ScanState, customPath?: string, projectRoot?: string): void;
 export declare function resetScanState(customPath?: string): void;
 export declare function evaluateScanStateSnapshots(input: EvaluateScanStateSnapshotsInput): EvaluateScanStateSnapshotsResult;
 export declare function extractMcpServerSnapshots(filePath: string, parsed: unknown): McpServerSnapshot[];