codegate-ai 0.7.0 → 0.9.0

package/dist/layer2-static/github/client.d.ts

@@ -0,0 +1,17 @@
+import type { RuntimeMode } from "../../config.js";
+import { type AdvisoryPayload } from "./cache.js";
+export interface GithubMetadataClientOptions {
+    runtimeMode?: RuntimeMode;
+    cacheDir?: string;
+    cacheMaxAgeMs?: number;
+    now?: number;
+}
+export interface GithubMetadataClient {
+    runtimeMode: RuntimeMode;
+    cacheDir: string;
+    cacheMaxAgeMs: number;
+    isOnlineEnabled(): boolean;
+    loadKnownVulnerableActions(bundle: Record<string, string[]>): AdvisoryPayload;
+}
+export declare function createGithubMetadataClient(options?: GithubMetadataClientOptions): GithubMetadataClient;
+export declare function loadBundledGithubAdvisories(options?: GithubMetadataClientOptions): AdvisoryPayload;

package/dist/layer2-static/github/client.js

@@ -0,0 +1,43 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import bundledAdvisories from "../advisories/gha-known-vulnerable-actions.json" with { type: "json" };
+import { loadCachedAdvisoryPayload, saveCachedAdvisoryPayload, } from "./cache.js";
+function normalizeAdvisoryMap(value) {
+    const normalized = {};
+    for (const [action, versions] of Object.entries(value)) {
+        normalized[action.toLowerCase()] = versions.map((version) => version.toLowerCase());
+    }
+    return normalized;
+}
+export function createGithubMetadataClient(options = {}) {
+    const runtimeMode = options.runtimeMode ?? "offline";
+    const cacheDir = options.cacheDir ?? join(homedir(), ".codegate", "cache");
+    const cacheMaxAgeMs = options.cacheMaxAgeMs ?? 24 * 60 * 60 * 1000;
+    const now = options.now ?? Date.now();
+    return {
+        runtimeMode,
+        cacheDir,
+        cacheMaxAgeMs,
+        isOnlineEnabled() {
+            return runtimeMode === "online";
+        },
+        loadKnownVulnerableActions(bundle) {
+            const payload = {
+                generatedAt: now,
+                advisories: normalizeAdvisoryMap(bundle),
+            };
+            if (!runtimeMode || runtimeMode !== "online") {
+                return payload;
+            }
+            const cached = loadCachedAdvisoryPayload(cacheDir, cacheMaxAgeMs, now);
+            if (cached) {
+                return cached;
+            }
+            saveCachedAdvisoryPayload(cacheDir, payload);
+            return payload;
+        },
+    };
+}
+export function loadBundledGithubAdvisories(options = {}) {
+    return createGithubMetadataClient(options).loadKnownVulnerableActions(bundledAdvisories);
+}

package/dist/layer2-static/rule-engine.d.ts

@@ -21,4 +21,4 @@ export interface RuleEvaluationInput {
     textContent: string;
 }
 export declare function evaluateRule(rule: DetectionRule, input: RuleEvaluationInput): boolean;
-export declare function loadRulePacks(baseDir?: string): DetectionRule[];
+export { loadRulePacks } from "./rule-pack-loader.js";

package/dist/layer2-static/rule-engine.js

@@ -1,7 +1,3 @@
-import { readdirSync, readFileSync } from "node:fs";
-import { dirname, extname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-const rulesDir = resolve(dirname(fileURLToPath(import.meta.url)), "rules");
 function escapeRegex(value) {
     return value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
 }
@@ -127,12 +123,4 @@ export function evaluateRule(rule, input) {
     }
     return false;
 }
-export function loadRulePacks(baseDir = rulesDir) {
-    const files = readdirSync(baseDir)
-        .filter((file) => extname(file) === ".json")
-        .sort();
-    return files.flatMap((file) => {
-        const raw = readFileSync(join(baseDir, file), "utf8");
-        return JSON.parse(raw);
-    });
-}
+export { loadRulePacks } from "./rule-pack-loader.js";

package/dist/layer2-static/rule-pack-loader.d.ts

@@ -0,0 +1,10 @@
+import type { DetectionRule } from "./rule-engine.js";
+export interface RulePackLoaderOptions {
+    baseDir?: string;
+    rule_pack_paths?: string[];
+    allowed_rules?: string[];
+    skip_rules?: string[];
+}
+export declare function loadRulePacks(): DetectionRule[];
+export declare function loadRulePacks(baseDir: string): DetectionRule[];
+export declare function loadRulePacks(options: RulePackLoaderOptions): DetectionRule[];

package/dist/layer2-static/rule-pack-loader.js

@@ -0,0 +1,187 @@
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, extname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const defaultRulesDir = resolve(dirname(fileURLToPath(import.meta.url)), "rules");
+const require = createRequire(import.meta.url);
+const Ajv = require("ajv");
+const RULE_SCHEMA = {
+    type: "object",
+    additionalProperties: true,
+    required: [
+        "id",
+        "severity",
+        "category",
+        "description",
+        "tool",
+        "file_pattern",
+        "query_type",
+        "query",
+        "condition",
+        "owasp",
+        "cwe",
+    ],
+    properties: {
+        id: { type: "string", minLength: 1 },
+        severity: { type: "string", minLength: 1 },
+        category: { type: "string", minLength: 1 },
+        description: { type: "string", minLength: 1 },
+        tool: { type: "string", minLength: 1 },
+        file_pattern: { type: "string", minLength: 1 },
+        query_type: {
+            type: "string",
+            enum: ["json_path", "toml_path", "env_key", "text_pattern"],
+        },
+        query: { type: "string" },
+        condition: {
+            type: "string",
+            enum: [
+                "equals_true",
+                "equals_false",
+                "exists",
+                "not_empty",
+                "matches_regex",
+                "not_in_allowlist",
+                "regex_match",
+                "contains",
+                "line_length_exceeds",
+            ],
+        },
+        cve: { type: "string" },
+        owasp: {
+            type: "array",
+            items: { type: "string" },
+        },
+        cwe: { type: "string", minLength: 1 },
+    },
+};
+const ruleValidator = new Ajv({ allErrors: true, strict: false }).compile(RULE_SCHEMA);
+function normalizeRuleIds(values) {
+    const seen = new Set();
+    const normalized = [];
+    for (const value of values ?? []) {
+        const trimmed = value.trim();
+        if (trimmed.length === 0 || seen.has(trimmed)) {
+            continue;
+        }
+        seen.add(trimmed);
+        normalized.push(trimmed);
+    }
+    return normalized;
+}
+function toErrorMessage(errors) {
+    if (!errors || errors.length === 0) {
+        return "validation error";
+    }
+    return errors
+        .map((error) => {
+        const location = error.instancePath === "" ? "<root>" : error.instancePath;
+        return `${location}: ${error.message ?? "validation error"}`;
+    })
+        .join("; ");
+}
+function isPackDirectory(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function isPackFile(path) {
+    try {
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function resolvePackPaths(path) {
+    const absolutePath = resolve(path);
+    if (!existsSync(absolutePath)) {
+        throw new Error(`Rule pack path does not exist: ${absolutePath}`);
+    }
+    if (isPackFile(absolutePath)) {
+        return [absolutePath];
+    }
+    if (!isPackDirectory(absolutePath)) {
+        throw new Error(`Rule pack path is not a file or directory: ${absolutePath}`);
+    }
+    return readdirSync(absolutePath)
+        .filter((file) => extname(file) === ".json")
+        .filter((file) => file !== "schema.json")
+        .sort()
+        .map((file) => join(absolutePath, file));
+}
+function loadRulesFromFile(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to parse rule pack ${path}: ${reason}`, { cause: error });
+    }
+    if (!Array.isArray(parsed)) {
+        throw new Error(`Invalid rule pack ${path}: expected a JSON array of rule objects`);
+    }
+    return parsed.map((candidate, index) => {
+        if (!ruleValidator(candidate)) {
+            const reasons = toErrorMessage(ruleValidator.errors);
+            throw new Error(`Invalid rule pack ${path} [${index}]: ${reasons}`);
+        }
+        return candidate;
+    });
+}
+function collectRulesFromPaths(paths) {
+    const collected = [];
+    for (const path of paths) {
+        for (const packPath of resolvePackPaths(path)) {
+            collected.push(...loadRulesFromFile(packPath));
+        }
+    }
+    return collected;
+}
+function dedupeByRuleId(rules) {
+    const deduped = new Map();
+    for (const rule of rules) {
+        deduped.set(rule.id, rule);
+    }
+    return Array.from(deduped.values());
+}
+function filterRules(rules, allowedRules, skipRules) {
+    const allowed = new Set(allowedRules);
+    const skipped = new Set(skipRules);
+    return rules.filter((rule) => {
+        if (skipped.has(rule.id)) {
+            return false;
+        }
+        if (allowed.size > 0 && !allowed.has(rule.id)) {
+            return false;
+        }
+        return true;
+    });
+}
+function normalizeOptions(arg) {
+    if (typeof arg === "string") {
+        return {
+            baseDir: arg,
+            rulePackPaths: [],
+            allowedRules: [],
+            skipRules: [],
+        };
+    }
+    const options = arg ?? {};
+    return {
+        baseDir: options.baseDir ?? defaultRulesDir,
+        rulePackPaths: options.rule_pack_paths ?? [],
+        allowedRules: normalizeRuleIds(options.allowed_rules),
+        skipRules: normalizeRuleIds(options.skip_rules),
+    };
+}
+export function loadRulePacks(arg) {
+    const options = normalizeOptions(arg);
+    const bundledRules = collectRulesFromPaths([options.baseDir]);
+    const externalRules = collectRulesFromPaths(options.rulePackPaths);
+    return filterRules(dedupeByRuleId([...bundledRules, ...externalRules]), options.allowedRules, options.skipRules);
+}

package/dist/layer2-static/workflow/injection-sinks.json

@@ -0,0 +1,5 @@
+{
+    "actions/github-script": ["script"],
+    "azure/powershell": ["inlineScript"],
+    "addnab/docker-run-action": ["run", "options"]
+}

package/dist/layer2-static/workflow/parser.d.ts

@@ -0,0 +1,3 @@
+import type { WorkflowFacts } from "./types.js";
+export declare function isGitHubWorkflowPath(path: string): boolean;
+export declare function extractWorkflowFacts(parsed: unknown): WorkflowFacts | null;

package/dist/layer2-static/workflow/parser.js

@@ -0,0 +1,88 @@
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function normalizeWorkflowPath(value) {
+    return value.replaceAll("\\", "/");
+}
+export function isGitHubWorkflowPath(path) {
+    return /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu.test(normalizeWorkflowPath(path));
+}
+function extractTriggers(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (Array.isArray(value)) {
+        return value.filter((entry) => typeof entry === "string");
+    }
+    const record = asRecord(value);
+    if (!record) {
+        return [];
+    }
+    return Object.keys(record);
+}
+function extractStepFacts(step) {
+    const stepRecord = asRecord(step);
+    if (!stepRecord) {
+        return null;
+    }
+    const withValues = asRecord(stepRecord.with);
+    const withEntries = {};
+    if (withValues) {
+        for (const [key, value] of Object.entries(withValues)) {
+            if (typeof value === "string") {
+                withEntries[key] = value;
+            }
+        }
+    }
+    const stepFacts = {
+        uses: asString(stepRecord.uses),
+        run: asString(stepRecord.run),
+        with: Object.keys(withEntries).length > 0 ? withEntries : undefined,
+    };
+    if (!stepFacts.uses && !stepFacts.run) {
+        return null;
+    }
+    return stepFacts;
+}
+function extractJobFacts(id, value) {
+    const jobRecord = asRecord(value);
+    if (!jobRecord) {
+        return null;
+    }
+    const stepsRaw = Array.isArray(jobRecord.steps) ? jobRecord.steps : [];
+    const steps = stepsRaw
+        .map((step) => extractStepFacts(step))
+        .filter((step) => step !== null);
+    return {
+        id,
+        permissions: jobRecord.permissions,
+        steps,
+    };
+}
+export function extractWorkflowFacts(parsed) {
+    const root = asRecord(parsed);
+    if (!root) {
+        return null;
+    }
+    const triggers = extractTriggers(root.on);
+    const jobsRecord = asRecord(root.jobs);
+    const jobs = jobsRecord
+        ? Object.entries(jobsRecord)
+            .map(([id, value]) => extractJobFacts(id, value))
+            .filter((job) => job !== null)
+        : [];
+    if (triggers.length === 0 && jobs.length === 0) {
+        return null;
+    }
+    return {
+        triggers,
+        workflowPermissions: root.permissions,
+        jobs,
+    };
+}

package/dist/layer2-static/workflow/types.d.ts

@@ -0,0 +1,15 @@
+export interface WorkflowStepFacts {
+    uses?: string;
+    run?: string;
+    with?: Record<string, string>;
+}
+export interface WorkflowJobFacts {
+    id: string;
+    permissions?: unknown;
+    steps: WorkflowStepFacts[];
+}
+export interface WorkflowFacts {
+    triggers: string[];
+    workflowPermissions?: unknown;
+    jobs: WorkflowJobFacts[];
+}

package/dist/layer2-static/workflow/types.js

@@ -0,0 +1 @@
+export {};

package/dist/layer3-dynamic/toxic-flow.js

@@ -42,6 +42,12 @@ function makeFinding(input, sourceTool, sensitiveTool, sinkTool) {
         confidence: "HIGH",
         fixable: false,
         remediation_actions: [],
+        metadata: {
+            sources: [sourceTool],
+            sinks: [sinkTool],
+            risk_tags: ["toxic-flow"],
+            origin: "toxic-flow",
+        },
         suppressed: false,
     };
 }

package/dist/pipeline.d.ts

@@ -26,7 +26,7 @@ export interface DeepScanOutcome {
     status: "skipped_without_consent" | "ok" | "auth_failure" | "timeout" | "network_error" | "command_error";
     result?: ResourceFetchResult;
 }
-export declare function runStaticPipeline(input: StaticPipelineInput): CodeGateReport;
+export declare function runStaticPipeline(input: StaticPipelineInput): Promise<CodeGateReport>;
 export declare function layer3OutcomesToFindings(outcomes: DeepScanOutcome[], options?: {
     unicodeAnalysis?: boolean;
 }): Finding[];

package/dist/pipeline.js

@@ -3,14 +3,15 @@ import { createEmptyReport } from "./types/report.js";
 import { scanToolDescriptions, } from "./layer3-dynamic/tool-description-scanner.js";
 import { detectToxicFlows } from "./layer3-dynamic/toxic-flow.js";
 import { applyReportSummary } from "./report-summary.js";
-export function runStaticPipeline(input) {
-    const findings = runStaticEngine({
+import { withFindingFingerprint } from "./report/finding-fingerprint.js";
+export async function runStaticPipeline(input) {
+    const findings = (await runStaticEngine({
         projectRoot: input.projectRoot,
         files: input.files,
         symlinkEscapes: input.symlinkEscapes,
         hooks: input.hooks,
         config: input.config,
-    });
+    })).map(withFindingFingerprint);
     const report = createEmptyReport({
         version: input.version,
         kbVersion: input.kbVersion,
@@ -63,7 +64,7 @@ function parseLayer3Response(resourceId, metadata) {
         .filter((item) => typeof item === "object" && item !== null)
         .map((item, index) => {
         const findingId = item.id ?? `L3-${resourceId}-${index}`;
-        return {
+        return withFindingFingerprint({
             rule_id: item.id ?? "layer3-analysis-finding",
             finding_id: findingId,
             severity: parseSeverity(item.severity),
@@ -82,7 +83,7 @@ function parseLayer3Response(resourceId, metadata) {
             remediation_actions: item.remediation_actions ?? [],
             source_config: item.source_config ?? null,
             suppressed: false,
-        };
+        });
     });
 }
 function asRecord(value) {
@@ -172,17 +173,17 @@ function deriveLayer3ToolFindings(resourceId, metadata, options = {}) {
             serverId: resourceId,
             tools: toolDescriptions,
             unicodeAnalysis: options.unicodeAnalysis,
-        }),
+        }).map(withFindingFingerprint),
         ...detectToxicFlows({
             scopeId: resourceId,
             tools: toolDescriptions,
             knownClassifications,
-        }),
+        }).map(withFindingFingerprint),
     ];
 }
 function layer3ErrorFinding(resourceId, status, description) {
     const severity = status === "timeout" ? "MEDIUM" : status === "skipped_without_consent" ? "INFO" : "LOW";
-    return {
+    return withFindingFingerprint({
         rule_id: `layer3-${status}`,
         finding_id: `L3-${status}-${resourceId}`,
         severity,
@@ -199,7 +200,7 @@ function layer3ErrorFinding(resourceId, status, description) {
         fixable: false,
         remediation_actions: [],
         suppressed: false,
-    };
+    });
 }
 function isRegistryMetadataResource(resourceId) {
     return (resourceId.startsWith("npm:") || resourceId.startsWith("pypi:") || resourceId.startsWith("git:"));
@@ -232,7 +233,7 @@ export function layer3OutcomesToFindings(outcomes, options = {}) {
 export function mergeLayer3Findings(baseReport, layer3Findings) {
     return applyReportSummary({
         ...baseReport,
-        findings: [...baseReport.findings, ...layer3Findings],
+        findings: [...baseReport.findings, ...layer3Findings].map(withFindingFingerprint),
     });
 }
 export async function runDeepScanWithConsent(resources, requestConsent, execute) {

package/dist/report/finding-fingerprint.d.ts

@@ -0,0 +1,5 @@
+import type { Finding } from "../types/finding.js";
+export declare function buildFindingFingerprint(finding: Finding): string;
+export declare function withFindingFingerprint<T extends Finding>(finding: T): T & {
+    fingerprint: string;
+};

package/dist/report/finding-fingerprint.js

@@ -0,0 +1,47 @@
+import { createHash } from "node:crypto";
+function normalizeLocation(location) {
+    const normalized = {};
+    if (typeof location.field === "string" && location.field.length > 0) {
+        normalized.field = location.field;
+    }
+    if (typeof location.line === "number") {
+        normalized.line = location.line;
+    }
+    if (typeof location.column === "number") {
+        normalized.column = location.column;
+    }
+    return normalized;
+}
+function normalizeSourceConfig(sourceConfig) {
+    if (!sourceConfig) {
+        return null;
+    }
+    const normalized = {
+        file_path: sourceConfig.file_path,
+    };
+    if (typeof sourceConfig.field === "string" && sourceConfig.field.length > 0) {
+        normalized.field = sourceConfig.field;
+    }
+    return normalized;
+}
+function buildFingerprintPayload(finding) {
+    return {
+        rule_id: finding.rule_id,
+        category: finding.category,
+        layer: finding.layer,
+        file_path: finding.file_path,
+        location: normalizeLocation(finding.location),
+        source_config: normalizeSourceConfig(finding.source_config),
+        cwe: finding.cwe,
+    };
+}
+export function buildFindingFingerprint(finding) {
+    const payload = JSON.stringify(buildFingerprintPayload(finding));
+    return `sha256:${createHash("sha256").update(payload).digest("hex")}`;
+}
+export function withFindingFingerprint(finding) {
+    return {
+        ...finding,
+        fingerprint: buildFindingFingerprint(finding),
+    };
+}

package/dist/reporter/markdown.js

@@ -14,6 +14,28 @@ function formatLocation(location) {
     }
     return parts.join(", ") || "-";
 }
+function formatMetadata(metadata) {
+    if (!metadata) {
+        return "-";
+    }
+    const parts = [];
+    if (metadata.sources && metadata.sources.length > 0) {
+        parts.push(`sources=${metadata.sources.join(", ")}`);
+    }
+    if (metadata.sinks && metadata.sinks.length > 0) {
+        parts.push(`sinks=${metadata.sinks.join(", ")}`);
+    }
+    if (metadata.referenced_secrets && metadata.referenced_secrets.length > 0) {
+        parts.push(`referenced_secrets=${metadata.referenced_secrets.join(", ")}`);
+    }
+    if (metadata.risk_tags && metadata.risk_tags.length > 0) {
+        parts.push(`risk_tags=${metadata.risk_tags.join(", ")}`);
+    }
+    if (metadata.origin) {
+        parts.push(`origin=${metadata.origin}`);
+    }
+    return parts.length > 0 ? parts.join("; ") : "-";
+}
 export function renderMarkdownReport(report) {
     const lines = [];
     lines.push("# CodeGate Report");
@@ -43,10 +65,10 @@ export function renderMarkdownReport(report) {
         lines.push("No findings.");
         return lines.join("\n");
     }
-    lines.push("| Severity | Category | File | Location | Description |");
-    lines.push("| --- | --- | --- | --- | --- |");
+    lines.push("| Severity | Category | File | Location | Description | Fingerprint | Metadata |");
+    lines.push("| --- | --- | --- | --- | --- | --- | --- |");
     for (const finding of report.findings) {
-        lines.push(`| ${finding.severity} | ${finding.category} | \`${escapePipes(finding.file_path)}\` | ${escapePipes(formatLocation(finding.location))} | ${escapePipes(finding.description)} |`);
+        lines.push(`| ${finding.severity} | ${finding.category} | \`${escapePipes(finding.file_path)}\` | ${escapePipes(formatLocation(finding.location))} | ${escapePipes(finding.description)} | ${escapePipes(finding.fingerprint ?? "-")} | ${escapePipes(formatMetadata(finding.metadata))} |`);
     }
     return lines.join("\n");
 }

package/dist/reporter/sarif.js

@@ -8,22 +8,39 @@ function toSarifLevel(severity) {
     return "note";
 }
 function findingToLocation(finding) {
+    return locationToSarif({
+        filePath: finding.file_path,
+        location: finding.location,
+    });
+}
+function locationToSarif(input) {
     const region = {};
-    if (typeof finding.location.line === "number") {
-        region.startLine = finding.location.line;
+    if (typeof input.location?.line === "number") {
+        region.startLine = input.location.line;
     }
-    if (typeof finding.location.column === "number") {
-        region.startColumn = finding.location.column;
+    if (typeof input.location?.column === "number") {
+        region.startColumn = input.location.column;
     }
     return {
         physicalLocation: {
             artifactLocation: {
-                uri: finding.file_path,
+                uri: input.filePath,
             },
             region: Object.keys(region).length > 0 ? region : undefined,
         },
     };
 }
+function findingToRelatedLocations(finding) {
+    const related = finding.affected_locations ?? [];
+    if (related.length === 0) {
+        return undefined;
+    }
+    const locations = related.map((location) => locationToSarif({
+        filePath: location.file_path,
+        location: location.location,
+    }));
+    return locations.length > 0 ? locations : undefined;
+}
 function buildRules(findings) {
     const byRuleId = new Map();
     for (const finding of findings) {
@@ -47,8 +64,10 @@ function findingToResult(finding) {
         level: toSarifLevel(finding.severity),
         message: { text: finding.description },
         locations: [findingToLocation(finding)],
+        relatedLocations: findingToRelatedLocations(finding),
         properties: {
             finding_id: finding.finding_id,
+            fingerprint: finding.fingerprint ?? null,
             severity: finding.severity,
             category: finding.category,
             layer: finding.layer,
@@ -59,6 +78,7 @@ function findingToResult(finding) {
             evidence: finding.evidence ?? null,
             fixable: finding.fixable,
             suppressed: finding.suppressed,
+            metadata: finding.metadata ?? null,
             source_config: finding.source_config ?? null,
         },
     };