codegate-ai 0.3.1 → 0.4.0

package/dist/commands/scan-command/helpers.js

@@ -4,31 +4,27 @@ import { renderJsonReport } from "../../reporter/json.js";
 import { renderMarkdownReport } from "../../reporter/markdown.js";
 import { renderSarifReport } from "../../reporter/sarif.js";
 import { renderTerminalReport } from "../../reporter/terminal.js";
+import { partitionRequestedTargetFindings } from "../../report/requested-target-findings.js";
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isHttpLikeTarget(target) {
-    return /^https?:\/\//iu.test(target);
-}
-function isUserScopeFindingPath(path) {
-    return path === "~" || path.startsWith("~/");
-}
 export function summarizeRequestedTargetFindings(report, displayTarget) {
-    if (!displayTarget || !isHttpLikeTarget(displayTarget)) {
+    const groups = partitionRequestedTargetFindings(report, displayTarget);
+    if (!groups) {
         return null;
     }
-    const targetFindings = report.findings.filter((finding) => !isUserScopeFindingPath(finding.file_path)).length;
-    const userScopeFindings = report.findings.length - targetFindings;
+    const targetFindings = groups.targetFindings.length;
+    const localFindings = groups.localFindings.length;
     if (targetFindings === 0) {
-        if (userScopeFindings === 0) {
+        if (localFindings === 0) {
             return "Requested URL target result: no findings were detected in the URL content.";
         }
-        return `Requested URL target result: no findings were detected in the URL content. ${userScopeFindings} finding(s) came from enabled user-scope paths (~/*).`;
+        return `Requested URL target result: no findings were detected in the URL content. ${localFindings} finding(s) came from local host paths (~/* or absolute host paths).`;
     }
-    if (userScopeFindings === 0) {
+    if (localFindings === 0) {
         return `Requested URL target result: ${targetFindings} finding(s) were detected in the URL content.`;
     }
-    return `Requested URL target result: ${targetFindings} finding(s) were detected in the URL content. ${userScopeFindings} additional finding(s) came from enabled user-scope paths (~/*).`;
+    return `Requested URL target result: ${targetFindings} finding(s) were detected in the URL content. ${localFindings} additional finding(s) came from local host paths (~/* or absolute host paths).`;
 }
 export function metadataSummary(metadata) {
     let raw;

package/dist/commands/scan-command.js

@@ -7,6 +7,7 @@ import { buildPromptEvidenceText, supportsToollessLocalTextAnalysis, } from "../
 import { buildLocalTextAnalysisPrompt, buildSecurityAnalysisPrompt, } from "../layer3-dynamic/meta-agent.js";
 import { layer3OutcomesToFindings, mergeLayer3Findings, runDeepScanWithConsent, } from "../pipeline.js";
 import { mergeMetaAgentMetadata, metadataSummary, noEligibleDeepResourceNotes, parseLocalTextFindings, parseMetaAgentOutput, remediationSummaryLines, renderByFormat, summarizeRequestedTargetFindings, withMetaAgentFinding, } from "./scan-command/helpers.js";
+import { reorderRequestedTargetFindings } from "../report/requested-target-findings.js";
 function toMetaAgentPreference(value) {
     const normalized = value.trim().toLowerCase();
     if (normalized === "claude" || normalized === "claude-code") {
@@ -289,6 +290,7 @@ export async function executeScanCommand(input, deps) {
             }
         }
         report = applyConfigPolicy(report, input.config);
+        report = reorderRequestedTargetFindings(report, input.displayTarget);
         const remediationRequested = input.options.remediate ||
             input.options.fixSafe ||
             input.options.dryRun ||

package/dist/commands/skills-wrapper.js

@@ -4,6 +4,7 @@ import { createInterface } from "node:readline/promises";
 import { resolve } from "node:path";
 import { applyConfigPolicy, OUTPUT_FORMATS, } from "../config.js";
 import { renderByFormat, summarizeRequestedTargetFindings } from "./scan-command/helpers.js";
+import { reorderRequestedTargetFindings } from "../report/requested-target-findings.js";
 import { resolveScanTarget } from "../scan-target.js";
 function parseWrapperOptionValue(args, index, flag) {
     const current = args[index] ?? "";
@@ -16,7 +17,10 @@ function parseWrapperOptionValue(args, index, flag) {
         return [value, index];
     }
     const nextValue = args[index + 1];
-    if (!nextValue || nextValue.trim().length === 0) {
+    if (!nextValue ||
+        nextValue.trim().length === 0 ||
+        nextValue === "--" ||
+        nextValue.startsWith("-")) {
         throw new Error(`${flag} requires a value`);
     }
     return [nextValue, index + 1];
@@ -74,6 +78,15 @@ function firstLikelySourceAfterAdd(args, addIndex, context) {
             return null;
         }
         if (looksLikeSourceToken(token, context)) {
+            // Heuristic: if a source-looking token is immediately after an option flag and followed by
+            // another source-looking token, treat the first one as an option value and continue.
+            const previous = index > addIndex + 1 ? (args[index - 1] ?? "") : "";
+            const next = args[index + 1] ?? "";
+            if (previous.startsWith("-") &&
+                !previous.startsWith("--skill") &&
+                looksLikeSourceToken(next, context)) {
+                continue;
+            }
             return token;
         }
     }
@@ -327,6 +340,7 @@ export async function executeSkillsWrapper(input, deps) {
             };
         }
         report = applyConfigPolicy(report, config);
+        report = reorderRequestedTargetFindings(report, resolvedTarget.displayTarget);
         const shouldUseTui = config.tui.enabled && isTTY && deps.renderTui !== undefined && noTui !== true;
         const targetSummaryNote = config.output_format === "terminal"
             ? summarizeRequestedTargetFindings(report, resolvedTarget.displayTarget)

package/dist/report/requested-target-findings.d.ts

@@ -0,0 +1,8 @@
+import type { Finding } from "../types/finding.js";
+import type { CodeGateReport } from "../types/report.js";
+export interface RequestedTargetFindingGroups {
+    targetFindings: Finding[];
+    localFindings: Finding[];
+}
+export declare function partitionRequestedTargetFindings(report: CodeGateReport, displayTarget?: string): RequestedTargetFindingGroups | null;
+export declare function reorderRequestedTargetFindings(report: CodeGateReport, displayTarget?: string): CodeGateReport;

package/dist/report/requested-target-findings.js

@@ -0,0 +1,51 @@
+import { isAbsolute } from "node:path";
+const HTTP_LIKE_TARGET_PATTERN = /^https?:\/\//iu;
+const WINDOWS_ABSOLUTE_PATH_PATTERN = /^[a-z]:[\\/]/iu;
+const WINDOWS_USER_SCOPE_PATH_PATTERN = /^~[\\/]/u;
+const UNC_PATH_PATTERN = /^[\\/]{2}[^\\/]/u;
+const FILE_URI_PATH_PATTERN = /^file:\/\//iu;
+function isHttpLikeTarget(target) {
+    return HTTP_LIKE_TARGET_PATTERN.test(target);
+}
+function isUserScopeFindingPath(path) {
+    return path === "~" || path.startsWith("~/") || WINDOWS_USER_SCOPE_PATH_PATTERN.test(path);
+}
+function isWindowsAbsolutePath(path) {
+    return WINDOWS_ABSOLUTE_PATH_PATTERN.test(path);
+}
+function isLocalHostFindingPath(path) {
+    return (isUserScopeFindingPath(path) ||
+        isAbsolute(path) ||
+        isWindowsAbsolutePath(path) ||
+        UNC_PATH_PATTERN.test(path) ||
+        FILE_URI_PATH_PATTERN.test(path));
+}
+export function partitionRequestedTargetFindings(report, displayTarget) {
+    const target = displayTarget ?? report.scan_target;
+    if (!isHttpLikeTarget(target)) {
+        return null;
+    }
+    const targetFindings = [];
+    const localFindings = [];
+    for (const finding of report.findings) {
+        if (isLocalHostFindingPath(finding.file_path)) {
+            localFindings.push(finding);
+            continue;
+        }
+        targetFindings.push(finding);
+    }
+    return {
+        targetFindings,
+        localFindings,
+    };
+}
+export function reorderRequestedTargetFindings(report, displayTarget) {
+    const groups = partitionRequestedTargetFindings(report, displayTarget);
+    if (!groups) {
+        return report;
+    }
+    return {
+        ...report,
+        findings: [...groups.targetFindings, ...groups.localFindings],
+    };
+}

package/dist/reporter/terminal.js

@@ -1,4 +1,5 @@
 import { toAbsoluteDisplayPath } from "../path-display.js";
+import { partitionRequestedTargetFindings } from "../report/requested-target-findings.js";
 function appendLabeledList(lines, label, values) {
     if (values.length === 0) {
         return;
@@ -36,8 +37,46 @@ function formatLocation(location) {
     }
     return parts.length > 0 ? parts.join(" @ ") : null;
 }
-export function renderTerminalReport(report, options = {}) {
+function appendFinding(lines, report, options, finding) {
     const verbose = options.verbose === true;
+    lines.push(`[${finding.severity}] ${toAbsoluteDisplayPath(report.scan_target, finding.file_path)}`);
+    lines.push(`  ${finding.description}`);
+    if (finding.incident_title) {
+        appendLabeledText(lines, "Incident", finding.incident_title);
+    }
+    if (finding.evidence && finding.evidence.length > 0) {
+        appendEvidence(lines, finding.evidence);
+    }
+    appendLabeledList(lines, "Observed", finding.observed ?? []);
+    if (finding.inference) {
+        appendLabeledText(lines, "Inference", finding.inference);
+    }
+    appendLabeledList(lines, "Not verified", finding.not_verified ?? []);
+    if (verbose) {
+        lines.push(`  Rule: ${finding.rule_id}`);
+        lines.push(`  Finding ID: ${finding.finding_id}`);
+        lines.push(`  Category: ${finding.category} | Layer: ${finding.layer} | Confidence: ${finding.confidence}`);
+        const formattedLocation = formatLocation(finding.location);
+        if (formattedLocation) {
+            lines.push(`  Location: ${formattedLocation}`);
+        }
+        if (finding.cve) {
+            lines.push(`  CVE: ${finding.cve}`);
+        }
+        lines.push(`  CWE: ${finding.cwe}`);
+        if (finding.owasp.length > 0) {
+            lines.push(`  OWASP: ${finding.owasp.join(", ")}`);
+        }
+        if (finding.remediation_actions.length > 0) {
+            lines.push(`  Remediation: ${finding.remediation_actions.join(", ")}`);
+        }
+    }
+    if (finding.layer === "L3" && finding.source_config) {
+        const fieldSuffix = finding.source_config.field ? ` (${finding.source_config.field})` : "";
+        lines.push(`  source config: ${finding.source_config.file_path}${fieldSuffix}`);
+    }
+}
+export function renderTerminalReport(report, options = {}) {
     const lines = [];
     lines.push(`CodeGate v${report.version}`);
     lines.push(`Target: ${report.scan_target}`);
@@ -52,43 +91,28 @@ export function renderTerminalReport(report, options = {}) {
         lines.push("No findings.");
         return lines.join("\n");
     }
-    for (const finding of report.findings) {
-        lines.push(`[${finding.severity}] ${toAbsoluteDisplayPath(report.scan_target, finding.file_path)}`);
-        lines.push(`  ${finding.description}`);
-        if (finding.incident_title) {
-            appendLabeledText(lines, "Incident", finding.incident_title);
-        }
-        if (finding.evidence && finding.evidence.length > 0) {
-            appendEvidence(lines, finding.evidence);
+    const groups = partitionRequestedTargetFindings(report);
+    if (groups) {
+        lines.push(`Requested URL target findings (${groups.targetFindings.length}):`);
+        if (groups.targetFindings.length === 0) {
+            lines.push("  none");
         }
-        appendLabeledList(lines, "Observed", finding.observed ?? []);
-        if (finding.inference) {
-            appendLabeledText(lines, "Inference", finding.inference);
-        }
-        appendLabeledList(lines, "Not verified", finding.not_verified ?? []);
-        if (verbose) {
-            lines.push(`  Rule: ${finding.rule_id}`);
-            lines.push(`  Finding ID: ${finding.finding_id}`);
-            lines.push(`  Category: ${finding.category} | Layer: ${finding.layer} | Confidence: ${finding.confidence}`);
-            const formattedLocation = formatLocation(finding.location);
-            if (formattedLocation) {
-                lines.push(`  Location: ${formattedLocation}`);
-            }
-            if (finding.cve) {
-                lines.push(`  CVE: ${finding.cve}`);
-            }
-            lines.push(`  CWE: ${finding.cwe}`);
-            if (finding.owasp.length > 0) {
-                lines.push(`  OWASP: ${finding.owasp.join(", ")}`);
-            }
-            if (finding.remediation_actions.length > 0) {
-                lines.push(`  Remediation: ${finding.remediation_actions.join(", ")}`);
+        else {
+            for (const finding of groups.targetFindings) {
+                appendFinding(lines, report, options, finding);
             }
         }
-        if (finding.layer === "L3" && finding.source_config) {
-            const fieldSuffix = finding.source_config.field ? ` (${finding.source_config.field})` : "";
-            lines.push(`  source config: ${finding.source_config.file_path}${fieldSuffix}`);
+        if (groups.localFindings.length > 0) {
+            lines.push("");
+            lines.push(`Additional local host findings (${groups.localFindings.length}):`);
+            for (const finding of groups.localFindings) {
+                appendFinding(lines, report, options, finding);
+            }
         }
+        return lines.join("\n");
+    }
+    for (const finding of report.findings) {
+        appendFinding(lines, report, options, finding);
     }
     return lines.join("\n");
 }

package/dist/tui/views/dashboard.js

@@ -1,8 +1,18 @@
-import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
 import { Box, Text } from "ink";
 import { toAbsoluteDisplayPath } from "../../path-display.js";
+import { partitionRequestedTargetFindings } from "../../report/requested-target-findings.js";
 import { defaultTheme } from "../theme.js";
+const FINDINGS_PER_SECTION_LIMIT = 5;
+function FindingBlock(props) {
+    return (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { children: ["[", props.finding.severity, "]", " ", toAbsoluteDisplayPath(props.report.scan_target, props.finding.file_path)] }), _jsx(Text, { children: props.finding.description }), props.finding.evidence ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "Evidence:" }), props.finding.evidence.split("\n").map((line, index) => (_jsx(Text, { children: line }, `${props.finding.finding_id}-evidence-${index}`)))] })) : null] }, props.finding.finding_id));
+}
+function FindingsSection(props) {
+    const visibleFindings = props.findings.slice(0, FINDINGS_PER_SECTION_LIMIT);
+    const remaining = props.findings.length - visibleFindings.length;
+    return (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { color: defaultTheme.title, children: [props.title, " (", props.findings.length, "):"] }), visibleFindings.length === 0 ? (_jsx(Text, { color: defaultTheme.muted, children: "none" })) : (visibleFindings.map((finding) => (_jsx(FindingBlock, { report: props.report, finding: finding }, finding.finding_id)))), remaining > 0 ? (_jsxs(Text, { color: defaultTheme.muted, children: ["...and ", remaining, " more findings"] })) : null] }));
+}
 export function DashboardView(props) {
-    const visibleFindings = props.report.findings.slice(0, 5);
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", paddingX: 1, children: [_jsxs(Text, { color: defaultTheme.title, children: ["CodeGate v", props.report.version] }), _jsxs(Text, { color: defaultTheme.muted, children: ["Target: ", props.report.scan_target] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: ["Installed tools: ", props.report.tools_detected.join(", ") || "none"] }), _jsxs(Text, { children: ["Findings: ", props.report.summary.total, " (CRITICAL", " ", props.report.summary.by_severity.CRITICAL ?? 0, ", HIGH", " ", props.report.summary.by_severity.HIGH ?? 0, ", MEDIUM", " ", props.report.summary.by_severity.MEDIUM ?? 0, ", LOW", " ", props.report.summary.by_severity.LOW ?? 0, ", INFO", " ", props.report.summary.by_severity.INFO ?? 0, ")"] }), props.notices && props.notices.length > 0 ? (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: defaultTheme.title, children: "Notes:" }), props.notices.map((notice, index) => (_jsx(Text, { color: defaultTheme.muted, children: notice }, `notice-${index}`)))] })) : null] }), visibleFindings.length > 0 ? (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: defaultTheme.title, children: "Findings detail:" }), visibleFindings.map((finding) => (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { children: ["[", finding.severity, "]", " ", toAbsoluteDisplayPath(props.report.scan_target, finding.file_path)] }), _jsx(Text, { children: finding.description }), finding.evidence ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "Evidence:" }), finding.evidence.split("\n").map((line, index) => (_jsx(Text, { children: line }, `${finding.finding_id}-evidence-${index}`)))] })) : null] }, finding.finding_id))), props.report.findings.length > visibleFindings.length ? (_jsxs(Text, { color: defaultTheme.muted, children: ["...and ", props.report.findings.length - visibleFindings.length, " more findings"] })) : null] })) : null] }));
+    const groupedFindings = partitionRequestedTargetFindings(props.report);
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", paddingX: 1, children: [_jsxs(Text, { color: defaultTheme.title, children: ["CodeGate v", props.report.version] }), _jsxs(Text, { color: defaultTheme.muted, children: ["Target: ", props.report.scan_target] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: ["Installed tools: ", props.report.tools_detected.join(", ") || "none"] }), _jsxs(Text, { children: ["Findings: ", props.report.summary.total, " (CRITICAL", " ", props.report.summary.by_severity.CRITICAL ?? 0, ", HIGH", " ", props.report.summary.by_severity.HIGH ?? 0, ", MEDIUM", " ", props.report.summary.by_severity.MEDIUM ?? 0, ", LOW", " ", props.report.summary.by_severity.LOW ?? 0, ", INFO", " ", props.report.summary.by_severity.INFO ?? 0, ")"] }), props.notices && props.notices.length > 0 ? (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: defaultTheme.title, children: "Notes:" }), props.notices.map((notice, index) => (_jsx(Text, { color: defaultTheme.muted, children: notice }, `notice-${index}`)))] })) : null] }), props.report.findings.length > 0 ? (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: defaultTheme.title, children: "Findings detail:" }), groupedFindings ? (_jsxs(_Fragment, { children: [_jsx(FindingsSection, { title: "Requested URL target findings", report: props.report, findings: groupedFindings.targetFindings }), groupedFindings.localFindings.length > 0 ? (_jsx(FindingsSection, { title: "Additional local host findings", report: props.report, findings: groupedFindings.localFindings })) : null] })) : (_jsx(FindingsSection, { title: "Findings", report: props.report, findings: props.report.findings }))] })) : null] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",