codegate-ai 0.7.0 → 0.9.0

package/dist/reporter/terminal.js

@@ -15,6 +15,27 @@ function appendLabeledText(lines, label, value) {
     }
     lines.push(`  ${label}: ${value}`);
 }
+function appendMetadata(lines, metadata) {
+    if (!metadata) {
+        return;
+    }
+    const hasContent = (metadata.sources?.length ?? 0) > 0 ||
+        (metadata.sinks?.length ?? 0) > 0 ||
+        (metadata.referenced_secrets?.length ?? 0) > 0 ||
+        (metadata.risk_tags?.length ?? 0) > 0 ||
+        typeof metadata.origin === "string";
+    if (!hasContent) {
+        return;
+    }
+    lines.push("  Metadata:");
+    appendLabeledList(lines, "Sources", metadata.sources ?? []);
+    appendLabeledList(lines, "Sinks", metadata.sinks ?? []);
+    appendLabeledList(lines, "Referenced secrets", metadata.referenced_secrets ?? []);
+    appendLabeledList(lines, "Risk tags", metadata.risk_tags ?? []);
+    if (metadata.origin) {
+        appendLabeledText(lines, "Origin", metadata.origin);
+    }
+}
 function appendEvidence(lines, evidence) {
     const evidenceLines = evidence.split("\n");
     if (evidenceLines.length === 1) {
@@ -55,11 +76,26 @@ function appendFinding(lines, report, options, finding) {
     if (verbose) {
         lines.push(`  Rule: ${finding.rule_id}`);
         lines.push(`  Finding ID: ${finding.finding_id}`);
+        if (finding.fingerprint) {
+            lines.push(`  Fingerprint: ${finding.fingerprint}`);
+        }
         lines.push(`  Category: ${finding.category} | Layer: ${finding.layer} | Confidence: ${finding.confidence}`);
         const formattedLocation = formatLocation(finding.location);
         if (formattedLocation) {
             lines.push(`  Location: ${formattedLocation}`);
         }
+        if ((finding.affected_locations?.length ?? 0) > 0) {
+            lines.push("  Affected locations:");
+            for (const location of finding.affected_locations ?? []) {
+                const path = toAbsoluteDisplayPath(report.scan_target, location.file_path);
+                const locationText = formatLocation({
+                    field: location.location?.field,
+                    line: location.location?.line,
+                    column: location.location?.column,
+                });
+                lines.push(`    - ${path}${locationText ? ` (${locationText})` : ""}`);
+            }
+        }
         if (finding.cve) {
             lines.push(`  CVE: ${finding.cve}`);
         }
@@ -70,6 +106,7 @@ function appendFinding(lines, report, options, finding) {
         if (finding.remediation_actions.length > 0) {
             lines.push(`  Remediation: ${finding.remediation_actions.join(", ")}`);
         }
+        appendMetadata(lines, finding.metadata);
     }
     if (finding.layer === "L3" && finding.source_config) {
         const fieldSuffix = finding.source_config.field ? ` (${finding.source_config.field})` : "";

package/dist/scan-target/fetch-plan.d.ts

@@ -0,0 +1,8 @@
+export interface SparseFetchPlan {
+    sparsePaths: string[];
+}
+export interface BuildSparseFetchPlanInput {
+    preferredSkill?: string;
+    inferredSkill?: string;
+}
+export declare function buildSparseFetchPlan(source: string, input?: BuildSparseFetchPlanInput): SparseFetchPlan | null;

package/dist/scan-target/fetch-plan.js

@@ -0,0 +1,30 @@
+import { isLikelyGitRepoUrl } from "./helpers.js";
+function normalizeSkillName(value) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+        return null;
+    }
+    return trimmed.replace(/^skills\//iu, "").replace(/^\/+/u, "");
+}
+function selectSkill(input) {
+    return normalizeSkillName(input.preferredSkill) ?? normalizeSkillName(input.inferredSkill);
+}
+export function buildSparseFetchPlan(source, input = {}) {
+    let url;
+    try {
+        url = new URL(source);
+    }
+    catch {
+        return null;
+    }
+    if (!isLikelyGitRepoUrl(url)) {
+        return null;
+    }
+    const selectedSkill = selectSkill(input);
+    if (!selectedSkill) {
+        return null;
+    }
+    return {
+        sparsePaths: ["/*", "!/*/", "/.*/**", "/hooks/**", `/skills/${selectedSkill}/**`],
+    };
+}

package/dist/scan-target/staging.js

@@ -2,16 +2,71 @@ import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, statSync
 import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
+import { buildSparseFetchPlan } from "./fetch-plan.js";
 import { cleanupTempDir, collectExplicitCandidates, copyDirectoryRecursive, extractSkillFromRepoPath, inferRemoteCandidateFormat, inferLocalFileStagePath, inferRemoteFileStagePath, inferToolFromReportPath, parseGitHubFileSource, preserveTailSegments, shouldStageContainingFolder, } from "./helpers.js";
-function cloneRepository(source, destination) {
-    const result = spawnSync("git", ["clone", "--depth", "1", "--filter=blob:none", source, destination], {
+function runGit(args) {
+    const result = spawnSync("git", args, {
+        encoding: "utf8",
+    });
+    if (result.status !== 0) {
+        const stderr = result.stderr?.trim();
+        throw new Error(stderr && stderr.length > 0 ? stderr : `git ${args.join(" ")} failed`);
+    }
+}
+function cloneRepository(source, destination, sparsePaths) {
+    const cloneArgs = ["clone", "--depth", "1", "--filter=blob:none"];
+    if (sparsePaths && sparsePaths.length > 0) {
+        cloneArgs.push("--no-checkout");
+    }
+    cloneArgs.push(source, destination);
+    const result = spawnSync("git", cloneArgs, {
         encoding: "utf8",
     });
     if (result.status !== 0) {
         const stderr = result.stderr?.trim();
         throw new Error(stderr && stderr.length > 0 ? stderr : `git clone failed for ${source}`);
     }
-    cleanupTempDir(join(destination, ".git"));
+    if (!sparsePaths || sparsePaths.length === 0) {
+        cleanupTempDir(join(destination, ".git"));
+        return;
+    }
+    try {
+        runGit(["-C", destination, "sparse-checkout", "init", "--no-cone"]);
+        runGit(["-C", destination, "sparse-checkout", "set", "--no-cone", ...sparsePaths]);
+        runGit(["-C", destination, "checkout", "--force", "HEAD"]);
+        cleanupTempDir(join(destination, ".git"));
+        return;
+    }
+    catch (error) {
+        cleanupTempDir(destination);
+        const fallback = spawnSync("git", ["clone", "--depth", "1", "--filter=blob:none", source, destination], {
+            encoding: "utf8",
+        });
+        if (fallback.status !== 0) {
+            const stderr = fallback.stderr?.trim();
+            throw new Error(stderr && stderr.length > 0 ? stderr : `git clone failed for ${source}`, {
+                cause: error,
+            });
+        }
+        cleanupTempDir(join(destination, ".git"));
+    }
+}
+function cloneSparseRepository(source, destination, sparsePaths) {
+    cloneRepository(source, destination, sparsePaths);
+}
+function cloneFullRepository(source, destination) {
+    cloneRepository(source, destination);
+}
+function stageSparseClone(source, destination, preferredSkill, inferredSkill) {
+    const sparsePlan = buildSparseFetchPlan(source, {
+        preferredSkill,
+        inferredSkill,
+    });
+    if (!sparsePlan) {
+        cloneFullRepository(source, destination);
+        return;
+    }
+    cloneSparseRepository(source, destination, sparsePlan.sparsePaths);
 }
 export function stageLocalFile(absolutePath) {
     const tempRoot = mkdtempSync(join(tmpdir(), "codegate-scan-target-"));
@@ -132,7 +187,7 @@ export async function cloneGitRepo(rawTarget, options = {}) {
     const tempRoot = mkdtempSync(join(tmpdir(), "codegate-scan-repo-"));
     const repoDir = join(tempRoot, "repo");
     try {
-        cloneRepository(rawTarget, repoDir);
+        stageSparseClone(rawTarget, repoDir, options.preferredSkill, options.inferredSkill);
         return await stageSkillAwareRepository(tempRoot, repoDir, options.displayTarget ?? rawTarget, options);
     }
     catch (error) {
@@ -144,7 +199,7 @@ export function stageRepoSubdirectory(repoUrl, filePath, displayTarget) {
     const tempRoot = mkdtempSync(join(tmpdir(), "codegate-scan-repo-file-"));
     const repoDir = join(tempRoot, "repo");
     try {
-        cloneRepository(repoUrl, repoDir);
+        stageSparseClone(repoUrl, repoDir, undefined, extractSkillFromRepoPath(filePath) ?? undefined);
         const inferredSkill = extractSkillFromRepoPath(filePath);
         if (inferredSkill) {
             const stageRoot = join(tempRoot, "staged");

package/dist/scan.d.ts

@@ -4,7 +4,7 @@ import { type KnowledgeBaseLoadResult } from "./layer1-discovery/knowledge-base.
 import { type WalkResult } from "./layer1-discovery/file-walker.js";
 import type { DiscoveryFormat } from "./types/discovery.js";
 import type { CodeGateReport } from "./types/report.js";
-import type { CodeGateConfig } from "./config.js";
+import type { CodeGateConfig, ScanCollectionKind, ScanCollectionMode } from "./config.js";
 import type { DeepScanResource } from "./pipeline.js";
 export interface ScanEngineInput {
     version: string;
@@ -18,10 +18,14 @@ export interface ScanEngineInput {
 export interface DeepScanDiscoveryOptions {
     includeUserScope?: boolean;
     homeDir?: string;
+    collectModes?: ScanCollectionMode[];
+    collectKinds?: ScanCollectionKind[];
 }
 export interface ScanSurfaceOptions {
     includeUserScope?: boolean;
     homeDir?: string;
+    collectModes?: ScanCollectionMode[];
+    collectKinds?: ScanCollectionKind[];
 }
 export interface ScanDiscoveryCandidate {
     reportPath: string;
@@ -45,6 +49,8 @@ export interface ScanDiscoveryContextOptions {
     homeDir?: string;
     parseSelected?: boolean;
     explicitCandidates?: ScanDiscoveryCandidate[];
+    collectModes?: ScanCollectionMode[];
+    collectKinds?: ScanCollectionKind[];
 }
 export declare function discoverDeepScanResources(scanTarget: string, kbInput?: KnowledgeBaseLoadResult, options?: DeepScanDiscoveryOptions): DeepScanResource[];
 export declare function createScanDiscoveryContext(scanTarget: string, kbInput?: KnowledgeBaseLoadResult, options?: ScanDiscoveryContextOptions): ScanDiscoveryContext;

package/dist/scan.js

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, relative, resolve, sep } from "node:path";
+import { basename, join, relative, resolve, sep } from "node:path";
 import { collectLocalTextAnalysisTargets, } from "./layer3-dynamic/local-text-analysis.js";
 import { runStaticPipeline } from "./pipeline.js";
 import { applyReportSummary } from "./report-summary.js";
@@ -9,11 +9,28 @@ import { loadKnowledgeBase, } from "./layer1-discovery/knowledge-base.js";
 import { detectTools } from "./layer1-discovery/tool-detector.js";
 import { walkProjectTree } from "./layer1-discovery/file-walker.js";
 import { evaluateScanStateSnapshots, extractMcpServerSnapshots, loadScanState, saveScanState, } from "./layer2-static/state/scan-state.js";
+import { applyInlineIgnoreDirectives, collectInlineIgnoreDirectives, } from "./config/inline-ignore.js";
+import { isGitHubDependabotPath } from "./layer2-static/dependabot/parser.js";
 const MCP_SERVER_CONTAINER_KEYS = ["mcpServers", "mcp_servers", "context_servers"];
 const REMOTE_MCP_SERVER_ARRAY_KEYS = ["remoteMCPServers", "remote_mcp_servers"];
 const USER_SCOPE_WILDCARD_MAX_DEPTH = 6;
 const USER_SCOPE_WILDCARD_MAX_FILES = 500;
 const INFERRED_ARTIFACT_RULES = [
+    {
+        pattern: /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu,
+        format: "yaml",
+        tool: "github-actions",
+    },
+    {
+        pattern: /(?:^|\/)\.github\/dependabot\.ya?ml$/iu,
+        format: "yaml",
+        tool: "dependabot",
+    },
+    {
+        pattern: /(?:^|\/)action\.ya?ml$/iu,
+        format: "yaml",
+        tool: "github-actions",
+    },
     { pattern: /(?:^|\/)agents\.md$/iu, format: "markdown", tool: "claude-code" },
     { pattern: /(?:^|\/)claude\.md$/iu, format: "markdown", tool: "claude-code" },
     { pattern: /(?:^|\/)codex\.md$/iu, format: "markdown", tool: "codex-cli" },
@@ -37,6 +54,12 @@ function wildcardToRegex(pattern) {
 function normalizePathForMatch(path) {
     return path.split(sep).join("/");
 }
+function normalizeCollectionKinds(input) {
+    if (!input || input.length === 0) {
+        return undefined;
+    }
+    return new Set(input);
+}
 function normalizeUserScopePattern(pattern) {
     return normalizePathForMatch(pattern).replace(/^~\//u, "").replace(/^\/+/u, "");
 }
@@ -63,6 +86,32 @@ function gatherCandidatePatterns(kb) {
     }
     return candidates;
 }
+function isWorkflowCollectionCandidate(reportPath) {
+    return /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu.test(normalizePathForMatch(reportPath));
+}
+function isActionCollectionCandidate(reportPath) {
+    const fileName = basename(normalizePathForMatch(reportPath)).toLowerCase();
+    return fileName === "action.yml" || fileName === "action.yaml";
+}
+function inferCollectionKind(reportPath) {
+    if (isWorkflowCollectionCandidate(reportPath)) {
+        return "workflows";
+    }
+    if (isActionCollectionCandidate(reportPath)) {
+        return "actions";
+    }
+    if (isGitHubDependabotPath(reportPath)) {
+        return "dependabot";
+    }
+    return null;
+}
+function matchesCollectionKinds(reportPath, collectKinds) {
+    if (!collectKinds) {
+        return true;
+    }
+    const kind = inferCollectionKind(reportPath);
+    return kind !== null && collectKinds.has(kind);
+}
 function isRegularFile(path) {
     try {
         return statSync(path).isFile();
@@ -149,6 +198,11 @@ function collectUserScopeWildcardMatches(homeDir, pattern) {
 }
 function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, options) {
     const selected = new Map();
+    const includeAll = options.collectModes.has("all");
+    const includeProject = includeAll || options.collectModes.has("default") || options.collectModes.has("project");
+    const includeUser = includeAll ||
+        options.collectModes.has("user") ||
+        (options.collectModes.has("default") && options.includeUserScope);
     const filesByRelativePath = walkedFiles
         .map((filePath) => ({
         absolutePath: filePath,
@@ -156,6 +210,9 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
     }))
         .filter((entry) => !entry.relativePath.startsWith(".."));
     for (const file of filesByRelativePath) {
+        if (!includeProject) {
+            continue;
+        }
         for (const candidate of patterns) {
             if (candidate.scope !== "project") {
                 continue;
@@ -163,6 +220,9 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
             if (!wildcardToRegex(candidate.pattern).test(file.relativePath)) {
                 continue;
             }
+            if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
+                continue;
+            }
             if (!selected.has(file.relativePath)) {
                 selected.set(file.relativePath, {
                     reportPath: file.relativePath,
@@ -173,8 +233,14 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
             }
         }
     }
-    if (!options.includeUserScope) {
+    if (!includeUser) {
         for (const file of filesByRelativePath) {
+            if (!includeProject) {
+                continue;
+            }
+            if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
+                continue;
+            }
             if (selected.has(file.relativePath)) {
                 continue;
             }
@@ -186,40 +252,54 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
         }
         return Array.from(selected.values());
     }
-    for (const candidate of patterns) {
-        if (candidate.scope !== "user") {
-            continue;
-        }
-        const userPattern = normalizeUserScopePattern(candidate.pattern);
-        if (userPattern.includes("*")) {
-            for (const match of collectUserScopeWildcardMatches(options.homeDir, userPattern)) {
-                const reportPath = toUserReportPath(match.relativePath);
-                if (!selected.has(reportPath)) {
-                    selected.set(reportPath, {
-                        reportPath,
-                        absolutePath: match.absolutePath,
-                        format: candidate.format,
-                        tool: candidate.tool,
-                    });
+    if (includeUser) {
+        for (const candidate of patterns) {
+            if (candidate.scope !== "user") {
+                continue;
+            }
+            const userPattern = normalizeUserScopePattern(candidate.pattern);
+            if (userPattern.includes("*")) {
+                for (const match of collectUserScopeWildcardMatches(options.homeDir, userPattern)) {
+                    const reportPath = toUserReportPath(match.relativePath);
+                    if (!matchesCollectionKinds(reportPath, options.collectKinds)) {
+                        continue;
+                    }
+                    if (!selected.has(reportPath)) {
+                        selected.set(reportPath, {
+                            reportPath,
+                            absolutePath: match.absolutePath,
+                            format: candidate.format,
+                            tool: candidate.tool,
+                        });
+                    }
                 }
+                continue;
+            }
+            const absolutePath = resolve(options.homeDir, userPattern);
+            if (!existsSync(absolutePath) || !isRegularFile(absolutePath)) {
+                continue;
+            }
+            const reportPath = toUserReportPath(userPattern);
+            if (!matchesCollectionKinds(reportPath, options.collectKinds)) {
+                continue;
+            }
+            if (!selected.has(reportPath)) {
+                selected.set(reportPath, {
+                    reportPath,
+                    absolutePath,
+                    format: candidate.format,
+                    tool: candidate.tool,
+                });
             }
-            continue;
         }
-        const absolutePath = resolve(options.homeDir, userPattern);
-        if (!existsSync(absolutePath) || !isRegularFile(absolutePath)) {
+    }
+    for (const file of filesByRelativePath) {
+        if (!includeProject && !includeAll) {
             continue;
         }
-        const reportPath = toUserReportPath(userPattern);
-        if (!selected.has(reportPath)) {
-            selected.set(reportPath, {
-                reportPath,
-                absolutePath,
-                format: candidate.format,
-                tool: candidate.tool,
-            });
+        if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
+            continue;
         }
-    }
-    for (const file of filesByRelativePath) {
         if (selected.has(file.relativePath)) {
             continue;
         }
@@ -231,7 +311,17 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
     }
     return Array.from(selected.values());
 }
-function mergeExplicitCandidates(selected, explicitCandidates) {
+function normalizeCollectionModes(input) {
+    const normalized = new Set();
+    for (const mode of input ?? []) {
+        normalized.add(mode);
+    }
+    if (normalized.size === 0) {
+        normalized.add("default");
+    }
+    return normalized;
+}
+function mergeExplicitCandidates(selected, explicitCandidates, collectKinds) {
     if (!explicitCandidates || explicitCandidates.length === 0) {
         return selected;
     }
@@ -240,6 +330,9 @@ function mergeExplicitCandidates(selected, explicitCandidates) {
         merged.set(candidate.reportPath, candidate);
     }
     for (const candidate of explicitCandidates) {
+        if (!matchesCollectionKinds(candidate.reportPath, collectKinds)) {
+            continue;
+        }
         merged.set(candidate.reportPath, candidate);
     }
     return Array.from(merged.values());
@@ -272,11 +365,11 @@ function ensureParsedCandidates(context) {
     }
     return context.parsedCandidates;
 }
-function makeParseErrorFinding(filePath, tool, message) {
+function makeParseErrorFinding(filePath, tool, message, strictCollection) {
     return {
         rule_id: "parse-error",
         finding_id: `PARSE_ERROR-${filePath}`,
-        severity: "LOW",
+        severity: strictCollection ? "HIGH" : "LOW",
         category: "PARSE_ERROR",
         layer: "L1",
         file_path: filePath,
@@ -455,6 +548,8 @@ export function discoverDeepScanResources(scanTarget, kbInput, options = {}) {
     const context = createScanDiscoveryContext(scanTarget, kbInput, {
         includeUserScope: options.includeUserScope,
         homeDir: options.homeDir,
+        collectModes: options.collectModes,
+        collectKinds: options.collectKinds,
         parseSelected: true,
     });
     return discoverDeepScanResourcesFromContext(context);
@@ -468,10 +563,17 @@ export function createScanDiscoveryContext(scanTarget, kbInput, options = {}) {
     const kb = kbInput ?? loadKnowledgeBase();
     const patterns = gatherCandidatePatterns(kb);
     const walked = walkProjectTree(absoluteTarget);
-    const selected = mergeExplicitCandidates(collectSelectedCandidates(absoluteTarget, walked.files, patterns, {
-        includeUserScope: options.includeUserScope === true,
-        homeDir: resolve(options.homeDir ?? homedir()),
-    }), options.explicitCandidates);
+    const collectModes = normalizeCollectionModes(options.collectModes);
+    const collectKinds = normalizeCollectionKinds(options.collectKinds);
+    const explicitOnly = collectModes.size === 1 && collectModes.has("explicit");
+    const selected = mergeExplicitCandidates(explicitOnly
+        ? []
+        : collectSelectedCandidates(absoluteTarget, walked.files, patterns, {
+            includeUserScope: options.includeUserScope === true,
+            homeDir: resolve(options.homeDir ?? homedir()),
+            collectModes,
+            collectKinds,
+        }), options.explicitCandidates, collectKinds);
     return {
         absoluteTarget,
         kb,
@@ -494,6 +596,8 @@ export function collectScanSurface(scanTarget, kbInput, options = {}) {
     const context = createScanDiscoveryContext(scanTarget, kbInput, {
         includeUserScope: options.includeUserScope === true,
         homeDir: options.homeDir,
+        collectModes: options.collectModes,
+        collectKinds: options.collectKinds,
     });
     const surface = new Set(context.walked.files);
     for (const item of context.selected) {
@@ -513,6 +617,8 @@ export async function runScanEngine(input) {
     const context = input.discoveryContext ??
         createScanDiscoveryContext(input.scanTarget, input.kb, {
             includeUserScope: input.config.scan_user_scope === true,
+            collectModes: input.config.scan_collection_modes,
+            collectKinds: input.config.scan_collection_kinds,
             homeDir: input.homeDir,
             parseSelected: true,
         });
@@ -522,7 +628,7 @@ export async function runScanEngine(input) {
     const staticFiles = [];
     for (const item of ensureParsedCandidates(context)) {
         if (!item.parsed.ok) {
-            parseErrors.push(makeParseErrorFinding(item.reportPath, item.tool, item.parsed.error));
+            parseErrors.push(makeParseErrorFinding(item.reportPath, item.tool, item.parsed.error, input.config.strict_collection === true));
             continue;
         }
         staticFiles.push({
@@ -548,7 +654,7 @@ export async function runScanEngine(input) {
             executable: (mode & 0o111) !== 0,
         };
     });
-    const report = runStaticPipeline({
+    const report = await runStaticPipeline({
         version: input.version,
         kbVersion: kb.schemaVersion,
         scanTarget: input.scanTarget,
@@ -571,6 +677,13 @@ export async function runScanEngine(input) {
             trustedApiDomains: input.config.trusted_api_domains,
             unicodeAnalysis: input.config.unicode_analysis,
             checkIdeSettings: input.config.check_ide_settings,
+            rulePackPaths: input.config.rule_pack_paths,
+            allowedRules: input.config.allowed_rules,
+            skipRules: input.config.skip_rules,
+            persona: input.config.persona,
+            runtimeMode: input.config.runtime_mode,
+            workflowAuditsEnabled: input.config.workflow_audits?.enabled === true,
+            rulePolicies: input.config.rules,
         },
     });
     const snapshots = new Map();
@@ -585,7 +698,11 @@ export async function runScanEngine(input) {
         previousState,
     });
     saveScanState(stateResult.nextState, input.scanStatePath);
-    const findings = [...report.findings, ...parseErrors, ...stateResult.findings];
+    const inlineIgnores = collectInlineIgnoreDirectives(staticFiles.map((file) => ({
+        filePath: file.filePath,
+        textContent: file.textContent,
+    })));
+    const findings = applyInlineIgnoreDirectives([...report.findings, ...parseErrors, ...stateResult.findings], inlineIgnores);
     return applyReportSummary({
         ...report,
         findings,

package/dist/types/finding.d.ts

@@ -1,6 +1,6 @@
 export declare const SEVERITIES: readonly ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
 export type Severity = (typeof SEVERITIES)[number];
-export declare const FINDING_CATEGORIES: readonly ["ENV_OVERRIDE", "COMMAND_EXEC", "CONSENT_BYPASS", "RULE_INJECTION", "IDE_SETTINGS", "SYMLINK_ESCAPE", "GIT_HOOK", "CONFIG_PRESENT", "PARSE_ERROR", "CONFIG_CHANGE", "NEW_SERVER", "TOXIC_FLOW"];
+export declare const FINDING_CATEGORIES: readonly ["ENV_OVERRIDE", "COMMAND_EXEC", "CONSENT_BYPASS", "RULE_INJECTION", "IDE_SETTINGS", "SYMLINK_ESCAPE", "GIT_HOOK", "CONFIG_PRESENT", "PARSE_ERROR", "CONFIG_CHANGE", "NEW_SERVER", "TOXIC_FLOW", "CI_SUPPLY_CHAIN", "CI_TRIGGER", "CI_PERMISSIONS", "CI_TEMPLATE_INJECTION", "CI_VULNERABLE_ACTION"];
 export type FindingCategory = (typeof FINDING_CATEGORIES)[number];
 export type FindingLayer = "L1" | "L2" | "L3";
 export type FindingConfidence = "HIGH" | "MEDIUM" | "LOW";
@@ -13,6 +13,13 @@ export interface FindingSourceConfig {
     file_path: string;
     field?: string;
 }
+export interface FindingMetadata {
+    sources?: string[];
+    sinks?: string[];
+    referenced_secrets?: string[];
+    risk_tags?: string[];
+    origin?: string;
+}
 export interface AffectedLocation {
     file_path: string;
     location?: FindingLocation;
@@ -20,6 +27,7 @@ export interface AffectedLocation {
 export interface Finding {
     rule_id: string;
     finding_id: string;
+    fingerprint?: string;
     severity: Severity;
     category: FindingCategory;
     layer: FindingLayer;
@@ -34,6 +42,7 @@ export interface Finding {
     confidence: FindingConfidence;
     fixable: boolean;
     remediation_actions: string[];
+    metadata?: FindingMetadata | null;
     evidence?: string | null;
     observed?: string[] | null;
     inference?: string | null;

package/dist/types/finding.js

@@ -12,4 +12,9 @@ export const FINDING_CATEGORIES = [
     "CONFIG_CHANGE",
     "NEW_SERVER",
     "TOXIC_FLOW",
+    "CI_SUPPLY_CHAIN",
+    "CI_TRIGGER",
+    "CI_PERMISSIONS",
+    "CI_TEMPLATE_INJECTION",
+    "CI_VULNERABLE_ACTION",
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",