codegate-ai 0.16.2 → 1.0.1

package/dist/pipeline.js

@@ -2,6 +2,7 @@ import { runStaticEngine, } from "./layer2-static/engine.js";
 import { createEmptyReport } from "./types/report.js";
 import { scanToolDescriptions, } from "./layer3-dynamic/tool-description-scanner.js";
 import { detectToxicFlows } from "./layer3-dynamic/toxic-flow.js";
+import { deriveRegistryFindings, } from "./layer3-dynamic/registry-findings.js";
 import { applyReportSummary } from "./report-summary.js";
 import { withFindingFingerprint } from "./report/finding-fingerprint.js";
 export async function runStaticPipeline(input) {
@@ -158,28 +159,32 @@ function parseToolClassifications(metadata, tools) {
     }
     return map;
 }
-function deriveLayer3ToolFindings(resourceId, metadata, options = {}) {
+function analyzeLayer3Tools(resourceId, metadata, options = {}) {
     const toolEntries = parseToolEntries(metadata);
     if (toolEntries.length === 0) {
-        return [];
+        return { findings: [], toolDescriptions: [], knownClassifications: {} };
     }
     const toolDescriptions = toolEntries.map((entry) => ({
         name: entry.name,
         description: entry.description,
     }));
     const knownClassifications = parseToolClassifications(metadata, toolEntries);
-    return [
-        ...scanToolDescriptions({
-            serverId: resourceId,
-            tools: toolDescriptions,
-            unicodeAnalysis: options.unicodeAnalysis,
-        }).map(withFindingFingerprint),
-        ...detectToxicFlows({
-            scopeId: resourceId,
-            tools: toolDescriptions,
-            knownClassifications,
-        }).map(withFindingFingerprint),
-    ];
+    return {
+        findings: [
+            ...scanToolDescriptions({
+                serverId: resourceId,
+                tools: toolDescriptions,
+                unicodeAnalysis: options.unicodeAnalysis,
+            }).map(withFindingFingerprint),
+            ...detectToxicFlows({
+                scopeId: resourceId,
+                tools: toolDescriptions,
+                knownClassifications,
+            }).map(withFindingFingerprint),
+        ],
+        toolDescriptions,
+        knownClassifications,
+    };
 }
 function layer3ErrorFinding(resourceId, status, description) {
     const severity = status === "timeout" ? "MEDIUM" : status === "skipped_without_consent" ? "INFO" : "LOW";
@@ -204,6 +209,25 @@ function layer3ErrorFinding(resourceId, status, description) {
 }
 export function layer3OutcomesToFindings(outcomes, options = {}) {
     const findings = [];
+    const workspaceTools = [];
+    const workspaceClassifications = {};
+    const workspaceOrigins = {};
+    const contributingServers = new Set();
+    const addWorkspaceTools = (resourceId, analysis) => {
+        for (const tool of analysis.toolDescriptions) {
+            // Keep workspace tool names unique across servers so origins stay unambiguous.
+            const uniqueName = workspaceOrigins[tool.name] === undefined ? tool.name : `${tool.name}@${resourceId}`;
+            workspaceTools.push({ name: uniqueName, description: tool.description });
+            workspaceOrigins[uniqueName] = resourceId;
+            const classifications = analysis.knownClassifications[tool.name];
+            if (classifications && classifications.length > 0) {
+                workspaceClassifications[uniqueName] = classifications;
+            }
+        }
+        if (analysis.toolDescriptions.length > 0) {
+            contributingServers.add(resourceId);
+        }
+    };
     for (const outcome of outcomes) {
         if (!outcome.approved || outcome.status === "skipped_without_consent") {
             findings.push(layer3ErrorFinding(outcome.resourceId, "skipped_without_consent", "Deep scan skipped because consent was not granted"));
@@ -214,8 +238,10 @@ export function layer3OutcomesToFindings(outcomes, options = {}) {
             continue;
         }
         const parsed = parseLayer3Response(outcome.resourceId, outcome.result.metadata);
-        const derived = deriveLayer3ToolFindings(outcome.resourceId, outcome.result.metadata, options);
-        const combined = [...parsed, ...derived];
+        const analysis = analyzeLayer3Tools(outcome.resourceId, outcome.result.metadata, options);
+        addWorkspaceTools(outcome.resourceId, analysis);
+        const registryFindings = deriveRegistryFindings(outcome.resourceId, outcome.result.metadata, options.registryHeuristics).map(withFindingFingerprint);
+        const combined = [...parsed, ...analysis.findings, ...registryFindings];
         // If a Layer 3 resource was fetched successfully but carries no
         // actionable metadata (no `findings[]`, no `tools[]`), that is not an
         // issue with the scan target itself — it usually means the default
@@ -231,6 +257,17 @@ export function layer3OutcomesToFindings(outcomes, options = {}) {
         }
         findings.push(...combined);
     }
+    // Cross-server pass: a toxic chain whose links live on different servers
+    // is invisible to the per-server analysis above.
+    if (contributingServers.size >= 2) {
+        findings.push(...detectToxicFlows({
+            scopeId: "workspace",
+            tools: workspaceTools,
+            knownClassifications: workspaceClassifications,
+            origins: workspaceOrigins,
+            crossOriginOnly: true,
+        }).map(withFindingFingerprint));
+    }
     return findings;
 }
 export function mergeLayer3Findings(baseReport, layer3Findings) {

package/dist/report-summary.d.ts

@@ -1,4 +1,4 @@
-import type { Finding } from "./types/finding.js";
+import { type Finding } from "./types/finding.js";
 import type { CodeGateReport, ReportSummary } from "./types/report.js";
 export type ReportThreshold = "critical" | "high" | "medium" | "low" | "info";
 export declare function computeExitCode(findings: Finding[], threshold?: ReportThreshold): number;

package/dist/report-summary.js

@@ -1,3 +1,4 @@
+import { isUntrustedInlineSuppression } from "./types/finding.js";
 const SEVERITY_LEVEL = {
     CRITICAL: 4,
     HIGH: 3,
@@ -12,8 +13,13 @@ const THRESHOLD_LEVEL = {
     low: 1,
     info: 0,
 };
+function countsTowardExitCode(finding) {
+    // Inline suppressions from untrusted content stay visible as suppressed
+    // but must not weaken gating.
+    return !finding.suppressed || isUntrustedInlineSuppression(finding);
+}
 export function computeExitCode(findings, threshold = "high") {
-    const unsuppressed = findings.filter((finding) => !finding.suppressed);
+    const unsuppressed = findings.filter(countsTowardExitCode);
     if (unsuppressed.length === 0) {
         return 0;
     }
@@ -32,11 +38,13 @@ export function summarizeFindings(findings, threshold = "high") {
     for (const finding of findings) {
         bySeverity[finding.severity] = (bySeverity[finding.severity] ?? 0) + 1;
     }
+    const suppressedUntrusted = findings.filter(isUntrustedInlineSuppression).length;
     return {
         total: findings.length,
         by_severity: bySeverity,
         fixable: findings.filter((finding) => finding.fixable).length,
         suppressed: findings.filter((finding) => finding.suppressed).length,
+        ...(suppressedUntrusted > 0 ? { suppressed_untrusted: suppressedUntrusted } : {}),
         exit_code: computeExitCode(findings, threshold),
     };
 }

package/dist/scan.d.ts

@@ -6,6 +6,18 @@ import type { DiscoveryFormat } from "./types/discovery.js";
 import type { CodeGateReport } from "./types/report.js";
 import type { CodeGateConfig, ScanCollectionKind, ScanCollectionMode } from "./config.js";
 import type { DeepScanResource } from "./pipeline.js";
+export declare const SKILL_BINARY_KIND: {
+    readonly Elf: "elf";
+    readonly MachO: "mach-o";
+    readonly Pe: "pe";
+    readonly Unknown: "binary";
+};
+export type SkillBinaryKind = (typeof SKILL_BINARY_KIND)[keyof typeof SKILL_BINARY_KIND];
+export interface SkillBinaryArtifact {
+    reportPath: string;
+    kind: SkillBinaryKind;
+    executable: boolean;
+}
 export interface ScanEngineInput {
     version: string;
     scanTarget: string;
@@ -43,6 +55,7 @@ export interface ScanDiscoveryContext {
     walked: WalkResult;
     selected: ScanDiscoveryCandidate[];
     parsedCandidates?: ParsedScanDiscoveryCandidate[];
+    skillBinaries?: SkillBinaryArtifact[];
 }
 export interface ScanDiscoveryContextOptions {
     includeUserScope?: boolean;

package/dist/scan.js

@@ -1,6 +1,6 @@
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { closeSync, existsSync, openSync, readSync, readdirSync, readFileSync, statSync, } from "node:fs";
 import { homedir } from "node:os";
-import { basename, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { collectLocalTextAnalysisTargets, } from "./layer3-dynamic/local-text-analysis.js";
 import { buildResourceId, normalizeRemoteUrl } from "./layer3-dynamic/url-validation.js";
 import { runStaticPipeline } from "./pipeline.js";
@@ -11,11 +11,46 @@ import { detectTools } from "./layer1-discovery/tool-detector.js";
 import { walkProjectTree } from "./layer1-discovery/file-walker.js";
 import { evaluateScanStateSnapshots, extractMcpServerSnapshots, loadScanState, saveScanState, } from "./layer2-static/state/scan-state.js";
 import { applyInlineIgnoreDirectives, collectInlineIgnoreDirectives, } from "./config/inline-ignore.js";
+import { isTrustedDirectory } from "./config/trust.js";
+import { loadKnownBadIndicators } from "./content/known-bad.js";
+import { escalateKnownBadFindings } from "./layer2-static/detectors/known-bad.js";
+import { normalizeForMatching } from "./layer2-static/text/normalize.js";
+import { REMOTE_INSTRUCTION_INDIRECTION_PATTERN } from "./layer2-static/text/threat-patterns.js";
+import { withFindingFingerprint } from "./report/finding-fingerprint.js";
 import { isGitHubDependabotPath } from "./layer2-static/dependabot/parser.js";
 const MCP_SERVER_CONTAINER_KEYS = ["mcpServers", "mcp_servers", "context_servers"];
 const REMOTE_MCP_SERVER_ARRAY_KEYS = ["remoteMCPServers", "remote_mcp_servers"];
 const USER_SCOPE_WILDCARD_MAX_DEPTH = 6;
 const USER_SCOPE_WILDCARD_MAX_FILES = 500;
+const SKILL_FILE_NAME = "skill.md";
+const SKILL_SIBLING_MAX_DEPTH = 3;
+const SKILL_SIBLING_MAX_FILES = 200;
+const BINARY_SNIFF_BYTES = 512;
+const SKILL_SIBLING_FORMATS = {
+    md: "markdown",
+    markdown: "markdown",
+    json: "json",
+    yaml: "yaml",
+    yml: "yaml",
+    toml: "toml",
+    sh: "text",
+    bash: "text",
+    zsh: "text",
+    ps1: "text",
+    py: "text",
+    js: "text",
+    mjs: "text",
+    cjs: "text",
+    ts: "text",
+    rb: "text",
+    txt: "text",
+};
+export const SKILL_BINARY_KIND = {
+    Elf: "elf",
+    MachO: "mach-o",
+    Pe: "pe",
+    Unknown: "binary",
+};
 const INFERRED_ARTIFACT_RULES = [
     {
         pattern: /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu,
@@ -45,12 +80,19 @@ const INFERRED_ARTIFACT_RULES = [
 function escapeRegex(value) {
     return value.replace(/[|\\{}()[\]^$+?.*]/g, "\\$&");
 }
+const wildcardRegexCache = new Map();
 function wildcardToRegex(pattern) {
+    const cached = wildcardRegexCache.get(pattern);
+    if (cached) {
+        return cached;
+    }
     let escaped = escapeRegex(pattern);
     escaped = escaped.replace(/\\\*\\\*\//g, "(?:[^/]+/)*");
     escaped = escaped.replace(/\\\*\\\*/g, ".*");
     escaped = escaped.replace(/\\\*/g, "[^/]*");
-    return new RegExp(`^${escaped}$`, "u");
+    const regex = new RegExp(`^${escaped}$`, "u");
+    wildcardRegexCache.set(pattern, regex);
+    return regex;
 }
 function normalizePathForMatch(path) {
     return path.split(sep).join("/");
@@ -279,15 +321,15 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
         relativePath: normalizePathForMatch(relative(absoluteTarget, filePath)),
     }))
         .filter((entry) => !entry.relativePath.startsWith(".."));
+    const projectPatterns = patterns
+        .filter((candidate) => candidate.scope === "project")
+        .map((candidate) => ({ candidate, regex: wildcardToRegex(candidate.pattern) }));
     for (const file of filesByRelativePath) {
         if (!includeProject) {
             continue;
         }
-        for (const candidate of patterns) {
-            if (candidate.scope !== "project") {
-                continue;
-            }
-            if (!wildcardToRegex(candidate.pattern).test(file.relativePath)) {
+        for (const { candidate, regex } of projectPatterns) {
+            if (!regex.test(file.relativePath)) {
                 continue;
             }
             if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
@@ -418,6 +460,140 @@ function mergeExplicitCandidates(selected, explicitCandidates, collectKinds) {
     }
     return Array.from(merged.values());
 }
+function sniffFileHead(path) {
+    const buffer = Buffer.alloc(BINARY_SNIFF_BYTES);
+    let bytesRead;
+    try {
+        const fd = openSync(path, "r");
+        try {
+            bytesRead = readSync(fd, buffer, 0, BINARY_SNIFF_BYTES, 0);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        return { binaryKind: null, hasShebang: false };
+    }
+    const head = buffer.subarray(0, bytesRead);
+    const hasShebang = bytesRead >= 2 && head[0] === 0x23 && head[1] === 0x21;
+    if (bytesRead >= 4 &&
+        head[0] === 0x7f &&
+        head[1] === 0x45 &&
+        head[2] === 0x4c &&
+        head[3] === 0x46) {
+        return { binaryKind: SKILL_BINARY_KIND.Elf, hasShebang: false };
+    }
+    const magic = bytesRead >= 4 ? head.readUInt32BE(0) : 0;
+    if (magic === 0xfeedface ||
+        magic === 0xfeedfacf ||
+        magic === 0xcefaedfe ||
+        magic === 0xcffaedfe ||
+        magic === 0xcafebabe) {
+        return { binaryKind: SKILL_BINARY_KIND.MachO, hasShebang: false };
+    }
+    if (bytesRead >= 2 && head[0] === 0x4d && head[1] === 0x5a) {
+        return { binaryKind: SKILL_BINARY_KIND.Pe, hasShebang: false };
+    }
+    if (head.includes(0)) {
+        return { binaryKind: SKILL_BINARY_KIND.Unknown, hasShebang: false };
+    }
+    return { binaryKind: null, hasShebang };
+}
+function isSkillCandidate(candidate) {
+    return basename(normalizePathForMatch(candidate.reportPath)).toLowerCase() === SKILL_FILE_NAME;
+}
+function siblingReportPath(candidate, siblingAbsolute) {
+    const skillDir = dirname(candidate.absolutePath);
+    const relFromSkillDir = normalizePathForMatch(relative(skillDir, siblingAbsolute));
+    const normalizedReport = normalizePathForMatch(candidate.reportPath);
+    const slashIndex = normalizedReport.lastIndexOf("/");
+    const parentReport = slashIndex >= 0 ? normalizedReport.slice(0, slashIndex) : "";
+    return parentReport ? `${parentReport}/${relFromSkillDir}` : relFromSkillDir;
+}
+/**
+ * Skills ship payloads next to SKILL.md (helper scripts, nested docs,
+ * sometimes binaries). Collect text-like siblings as scan candidates so the
+ * rule-file detectors see them, and record binary artifacts for reporting.
+ */
+function collectSkillSiblings(selected) {
+    const known = new Set(selected.map((candidate) => normalizePathForMatch(candidate.reportPath)));
+    const candidates = [];
+    const binaries = [];
+    const visitedDirs = new Set();
+    for (const skillCandidate of selected.filter(isSkillCandidate)) {
+        const skillDir = dirname(skillCandidate.absolutePath);
+        if (visitedDirs.has(skillDir)) {
+            continue;
+        }
+        visitedDirs.add(skillDir);
+        let filesSeen = 0;
+        const queue = [{ dir: skillDir, depth: 0 }];
+        while (queue.length > 0 && filesSeen < SKILL_SIBLING_MAX_FILES) {
+            const current = queue.pop();
+            if (!current) {
+                break;
+            }
+            let entries;
+            try {
+                entries = readdirSync(current.dir, { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const entry of entries) {
+                if (filesSeen >= SKILL_SIBLING_MAX_FILES) {
+                    break;
+                }
+                if (entry.isSymbolicLink()) {
+                    continue;
+                }
+                const absolutePath = join(current.dir, entry.name);
+                if (entry.isDirectory()) {
+                    if (current.depth < SKILL_SIBLING_MAX_DEPTH) {
+                        queue.push({ dir: absolutePath, depth: current.depth + 1 });
+                    }
+                    continue;
+                }
+                if (!entry.isFile() || absolutePath === skillCandidate.absolutePath) {
+                    continue;
+                }
+                filesSeen += 1;
+                const reportPath = siblingReportPath(skillCandidate, absolutePath);
+                if (known.has(reportPath)) {
+                    continue;
+                }
+                const sniffed = sniffFileHead(absolutePath);
+                if (sniffed.binaryKind) {
+                    let executable;
+                    try {
+                        executable = (statSync(absolutePath).mode & 0o111) !== 0;
+                    }
+                    catch {
+                        executable = false;
+                    }
+                    binaries.push({ reportPath, kind: sniffed.binaryKind, executable });
+                    continue;
+                }
+                const extension = entry.name.includes(".")
+                    ? (entry.name.split(".").pop() ?? "").toLowerCase()
+                    : "";
+                const format = SKILL_SIBLING_FORMATS[extension] ?? (sniffed.hasShebang ? "text" : null);
+                if (!format) {
+                    continue;
+                }
+                known.add(reportPath);
+                candidates.push({
+                    reportPath,
+                    absolutePath,
+                    format,
+                    tool: skillCandidate.tool,
+                });
+            }
+        }
+    }
+    return { candidates, binaries };
+}
 function inferArtifactCandidate(relativePath, absolutePath) {
     for (const rule of INFERRED_ARTIFACT_RULES) {
         if (!rule.pattern.test(relativePath)) {
@@ -446,6 +622,57 @@ function ensureParsedCandidates(context) {
     }
     return context.parsedCandidates;
 }
+function makeUntrustedProjectConfigFinding(ignoredSettings) {
+    return {
+        rule_id: "untrusted-project-config",
+        finding_id: "UNTRUSTED_PROJECT_CONFIG-.codegate.json",
+        severity: "INFO",
+        category: "CONFIG_CHANGE",
+        layer: "L1",
+        file_path: ".codegate.json",
+        location: { field: ignoredSettings.join(", ") },
+        description: `Ignored ${ignoredSettings.length} policy setting(s) from untrusted project config: ` +
+            `${ignoredSettings.join(", ")}. Project config in untrusted directories may only set ` +
+            "presentation options. Run `codegate trust <dir>` to honor its policy settings.",
+        affected_tools: [],
+        cve: null,
+        owasp: [],
+        cwe: "CWE-807",
+        confidence: "HIGH",
+        fixable: false,
+        remediation_actions: [],
+        suppressed: false,
+    };
+}
+function makeSkillBinaryFinding(artifact) {
+    const isExecutableFormat = artifact.kind !== SKILL_BINARY_KIND.Unknown;
+    const severity = artifact.executable || isExecutableFormat ? "HIGH" : "MEDIUM";
+    const kindLabel = isExecutableFormat ? `${artifact.kind} executable` : "binary file";
+    return {
+        rule_id: "skill-binary-payload",
+        finding_id: `SKILL_BINARY-${artifact.reportPath}`,
+        severity,
+        category: "COMMAND_EXEC",
+        layer: "L1",
+        file_path: artifact.reportPath,
+        location: { field: "content" },
+        description: `Skill directory ships a ${kindLabel}${artifact.executable ? " with execute permissions" : ""}. ` +
+            "Binary payloads cannot be reviewed as text and have no place in an instruction skill.",
+        affected_tools: ["claude-code", "codex-cli", "opencode", "cursor"],
+        cve: null,
+        owasp: ["ASI02"],
+        cwe: "CWE-506",
+        confidence: "HIGH",
+        fixable: true,
+        remediation_actions: ["quarantine_file"],
+        metadata: {
+            sources: [artifact.reportPath],
+            risk_tags: ["skill", "binary-payload"],
+            origin: "skill-siblings",
+        },
+        suppressed: false,
+    };
+}
 function makeParseErrorFinding(filePath, tool, message, strictCollection) {
     return {
         rule_id: "parse-error",
@@ -507,7 +734,7 @@ function commandResourceFromTokens(command) {
             id: `npm:${locator}`,
             kind: "npm",
             locator,
-            preview: `npm view ${locator} --json`,
+            preview: `GET https://registry.npmjs.org/${locator}  (online mode only; offline records the package name)`,
         };
     }
     if (launcher === "uvx" || launcher === "pipx") {
@@ -519,7 +746,7 @@ function commandResourceFromTokens(command) {
             id: `pypi:${locator}`,
             kind: "pypi",
             locator,
-            preview: `https://pypi.org/pypi/${locator}/json`,
+            preview: `GET https://pypi.org/pypi/${locator}/json  (online mode only; offline records the package name)`,
         };
     }
     return null;
@@ -654,7 +881,7 @@ export function createScanDiscoveryContext(scanTarget, kbInput, options = {}) {
     const collectModes = normalizeCollectionModes(options.collectModes);
     const collectKinds = normalizeCollectionKinds(options.collectKinds);
     const explicitOnly = collectModes.size === 1 && collectModes.has("explicit");
-    const selected = mergeExplicitCandidates(explicitOnly
+    const baseSelected = mergeExplicitCandidates(explicitOnly
         ? []
         : collectSelectedCandidates(absoluteTarget, walked.files, patterns, {
             includeUserScope: options.includeUserScope === true,
@@ -662,21 +889,50 @@ export function createScanDiscoveryContext(scanTarget, kbInput, options = {}) {
             collectModes,
             collectKinds,
         }), options.explicitCandidates, collectKinds);
+    const skillSiblings = collectSkillSiblings(baseSelected);
+    const selected = [...baseSelected, ...skillSiblings.candidates];
     return {
         absoluteTarget,
         kb,
         walked,
         selected,
         parsedCandidates: options.parseSelected ? parseSelectedCandidates(selected) : undefined,
+        skillBinaries: skillSiblings.binaries,
     };
 }
+function collectIndirectionUrlResources(textContent, filePath, resources) {
+    const lines = textContent.split(/\r?\n/u);
+    for (const line of lines) {
+        const normalized = normalizeForMatching(line);
+        if (!REMOTE_INSTRUCTION_INDIRECTION_PATTERN.test(normalized)) {
+            continue;
+        }
+        const urlMatch = line.match(/https?:\/\/[^\s)\]"'`<>]+/iu);
+        if (!urlMatch) {
+            continue;
+        }
+        const url = urlMatch[0];
+        const kind = inferHttpKind(url);
+        const id = `${kind}:${url}`;
+        if (resources.has(id)) {
+            continue;
+        }
+        resources.set(id, {
+            id,
+            request: { id, kind, locator: url },
+            commandPreview: `GET ${url}  (from ${filePath} -> remote instruction indirection)`,
+        });
+    }
+}
 export function discoverDeepScanResourcesFromContext(context) {
     const discovered = new Map();
     for (const item of ensureParsedCandidates(context)) {
-        if (!item.parsed.ok) {
-            continue;
+        if (item.parsed.ok) {
+            collectDeepScanResourcesFromParsed(item.parsed.data, item.reportPath, discovered);
+        }
+        if (item.format === "markdown" || item.format === "text") {
+            collectIndirectionUrlResources(readCandidateText(item), item.reportPath, discovered);
         }
-        collectDeepScanResourcesFromParsed(item.parsed.data, item.reportPath, discovered);
     }
     return Array.from(discovered.values()).sort((a, b) => a.id.localeCompare(b.id));
 }
@@ -712,6 +968,8 @@ export async function runScanEngine(input) {
         });
     const absoluteTarget = context.absoluteTarget;
     const kb = context.kb;
+    const scanHomeDir = input.homeDir;
+    const knownBadIndicators = loadKnownBadIndicators(scanHomeDir ? { homeDir: () => scanHomeDir } : {});
     const parseErrors = [];
     const staticFiles = [];
     for (const item of ensureParsedCandidates(context)) {
@@ -772,6 +1030,7 @@ export async function runScanEngine(input) {
             runtimeMode: input.config.runtime_mode,
             workflowAuditsEnabled: input.config.workflow_audits?.enabled === true,
             rulePolicies: input.config.rules,
+            knownBadIndicators,
         },
     });
     const snapshots = new Map();
@@ -780,17 +1039,32 @@ export async function runScanEngine(input) {
             snapshots.set(snapshot.serverId, snapshot);
         }
     }
-    const previousState = loadScanState(input.scanStatePath);
+    const trustedTarget = input.config.project_config_trusted ??
+        isTrustedDirectory(absoluteTarget, input.config.trusted_directories);
+    const previousState = loadScanState(input.scanStatePath, absoluteTarget);
     const stateResult = evaluateScanStateSnapshots({
         snapshots: Array.from(snapshots.values()),
         previousState,
+        trustedTarget,
+        firstScanReview: input.config.first_scan_review,
     });
-    saveScanState(stateResult.nextState, input.scanStatePath);
+    saveScanState(stateResult.nextState, input.scanStatePath, absoluteTarget);
     const inlineIgnores = collectInlineIgnoreDirectives(staticFiles.map((file) => ({
         filePath: file.filePath,
         textContent: file.textContent,
     })));
-    const findings = applyInlineIgnoreDirectives([...report.findings, ...parseErrors, ...stateResult.findings], inlineIgnores);
+    const ignoredProjectSettings = input.config.ignored_project_settings ?? [];
+    const configNoticeFindings = ignoredProjectSettings.length > 0
+        ? [withFindingFingerprint(makeUntrustedProjectConfigFinding(ignoredProjectSettings))]
+        : [];
+    const skillBinaryFindings = (context.skillBinaries ?? []).map((artifact) => withFindingFingerprint(makeSkillBinaryFinding(artifact)));
+    const findings = applyInlineIgnoreDirectives(escalateKnownBadFindings([
+        ...report.findings,
+        ...parseErrors,
+        ...stateResult.findings,
+        ...configNoticeFindings,
+        ...skillBinaryFindings,
+    ], knownBadIndicators), inlineIgnores, { trustedTarget });
     return applyReportSummary({
         ...report,
         findings,

package/dist/types/finding.d.ts

@@ -4,6 +4,19 @@ export declare const FINDING_CATEGORIES: readonly ["ENV_OVERRIDE", "COMMAND_EXEC
 export type FindingCategory = (typeof FINDING_CATEGORIES)[number];
 export type FindingLayer = "L1" | "L2" | "L3";
 export type FindingConfidence = "HIGH" | "MEDIUM" | "LOW";
+/**
+ * Where a suppression came from. InlineUntrusted marks inline
+ * `codegate: ignore[...]` directives found in content the user has not
+ * trusted; such findings stay visibly suppressed in reports but still
+ * count toward the exit code so untrusted content cannot self-approve.
+ */
+export declare const SUPPRESSION_SOURCE: {
+    readonly Inline: "inline";
+    readonly InlineUntrusted: "inline-untrusted";
+    readonly Config: "config";
+};
+export type SuppressionSource = (typeof SUPPRESSION_SOURCE)[keyof typeof SUPPRESSION_SOURCE];
+export declare function isUntrustedInlineSuppression(finding: Pick<Finding, "suppressed" | "suppression_source">): boolean;
 export interface FindingLocation {
     field?: string;
     line?: number;
@@ -52,4 +65,5 @@ export interface Finding {
     incident_primary?: boolean | null;
     source_config?: FindingSourceConfig | null;
     suppressed: boolean;
+    suppression_source?: SuppressionSource | null;
 }

package/dist/types/finding.js

@@ -18,3 +18,17 @@ export const FINDING_CATEGORIES = [
     "CI_TEMPLATE_INJECTION",
     "CI_VULNERABLE_ACTION",
 ];
+/**
+ * Where a suppression came from. InlineUntrusted marks inline
+ * `codegate: ignore[...]` directives found in content the user has not
+ * trusted; such findings stay visibly suppressed in reports but still
+ * count toward the exit code so untrusted content cannot self-approve.
+ */
+export const SUPPRESSION_SOURCE = {
+    Inline: "inline",
+    InlineUntrusted: "inline-untrusted",
+    Config: "config",
+};
+export function isUntrustedInlineSuppression(finding) {
+    return (finding.suppressed === true && finding.suppression_source === SUPPRESSION_SOURCE.InlineUntrusted);
+}

package/dist/types/report.d.ts

@@ -4,6 +4,8 @@ export interface ReportSummary {
     by_severity: Record<string, number>;
     fixable: number;
     suppressed: number;
+    /** Suppressions requested by untrusted content; these still count toward exit_code. */
+    suppressed_untrusted?: number;
     exit_code: number;
 }
 export interface CodeGateReport {