codegate-ai 0.7.0 → 0.9.0

package/dist/layer2-static/detectors/advisory-intelligence.js

@@ -0,0 +1,170 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildFindingEvidence } from "../evidence.js";
+const COMPONENTS_PATH = join(dirname(fileURLToPath(import.meta.url)), "../advisories/agent-components.json");
+const GENERIC_AFFECTED_TOOLS = [
+    "claude-code",
+    "codex-cli",
+    "opencode",
+    "cursor",
+    "windsurf",
+    "github-copilot",
+];
+function globToRegExp(glob) {
+    const pattern = glob.replaceAll("\\", "/").trim();
+    if (pattern.length === 0) {
+        return /^$/u;
+    }
+    let regex = "^";
+    for (let index = 0; index < pattern.length; index += 1) {
+        const char = pattern[index];
+        if (char === "*") {
+            if (pattern[index + 1] === "*") {
+                regex += ".*";
+                index += 1;
+            }
+            else {
+                regex += "[^/]*";
+            }
+            continue;
+        }
+        if (char === "?") {
+            regex += "[^/]";
+            continue;
+        }
+        if ("\\^$.*+?()[]{}|".includes(char)) {
+            regex += `\\${char}`;
+            continue;
+        }
+        regex += char;
+    }
+    regex += "$";
+    return new RegExp(regex, "u");
+}
+function matchesGlob(value, glob) {
+    const normalizedValue = value.replaceAll("\\", "/");
+    const normalizedGlob = glob.replaceAll("\\", "/").trim();
+    if (normalizedGlob.startsWith("**/")) {
+        const suffix = normalizedGlob.slice(3);
+        return normalizedValue === suffix || normalizedValue.endsWith(`/${suffix}`);
+    }
+    return globToRegExp(normalizedGlob).test(normalizedValue);
+}
+function loadComponents() {
+    const raw = readFileSync(COMPONENTS_PATH, "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed;
+}
+const ADVISORY_COMPONENTS = loadComponents();
+function normalizeToken(value) {
+    return value.trim().toLowerCase();
+}
+function collectStringCandidates(value, path = [], output = []) {
+    if (typeof value === "string") {
+        output.push({ path: path.join("."), value });
+        return output;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => {
+            collectStringCandidates(entry, [...path, String(index)], output);
+        });
+        return output;
+    }
+    if (!value || typeof value !== "object") {
+        return output;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        collectStringCandidates(child, [...path, key], output);
+    }
+    return output;
+}
+function makeFinding(filePath, matchedPath, component, signature, evidence) {
+    const location = { field: matchedPath };
+    if (typeof evidence?.line === "number") {
+        location.line = evidence.line;
+    }
+    if (typeof evidence?.column === "number") {
+        location.column = evidence.column;
+    }
+    return {
+        rule_id: component.rule_id,
+        finding_id: `${component.rule_id}-${filePath}-${matchedPath}`,
+        severity: component.severity,
+        category: component.category,
+        layer: "L2",
+        file_path: filePath,
+        location,
+        description: component.description,
+        affected_tools: GENERIC_AFFECTED_TOOLS,
+        cve: null,
+        owasp: component.owasp,
+        cwe: component.cwe,
+        confidence: component.confidence,
+        fixable: true,
+        remediation_actions: component.remediation_actions,
+        metadata: {
+            sources: component.metadata?.sources ?? [],
+            sinks: component.metadata?.sinks ?? [],
+            referenced_secrets: component.metadata?.referenced_secrets ?? [],
+            risk_tags: component.metadata?.risk_tags ?? [],
+            origin: component.metadata?.origin ?? "agent-components.json",
+        },
+        evidence: evidence?.evidence ?? null,
+        suppressed: false,
+    };
+}
+function componentMatchesFile(component, filePath) {
+    return component.file_patterns.some((pattern) => matchesGlob(filePath, pattern));
+}
+function signatureMatches(value, signatures) {
+    const normalizedValue = normalizeToken(value);
+    for (const signature of signatures) {
+        const normalizedSignature = normalizeToken(signature);
+        if (normalizedSignature.length > 0 && normalizedValue.includes(normalizedSignature)) {
+            return signature;
+        }
+    }
+    return null;
+}
+function detectComponentMatch(input, component) {
+    if (!componentMatchesFile(component, input.filePath)) {
+        return null;
+    }
+    const stringCandidates = collectStringCandidates(input.parsed);
+    for (const candidate of stringCandidates) {
+        const signature = signatureMatches(candidate.value, component.signatures);
+        if (!signature) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            jsonPaths: candidate.path.length > 0 ? [candidate.path] : [],
+            searchTerms: [signature],
+            fallbackValue: `${candidate.path} = ${candidate.value}`,
+        });
+        return makeFinding(input.filePath, candidate.path || component.id, component, signature, evidence);
+    }
+    for (const signature of component.signatures) {
+        if (!signatureMatches(input.textContent, [signature])) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [signature],
+            fallbackValue: signature,
+        });
+        return makeFinding(input.filePath, component.id, component, signature, evidence);
+    }
+    return null;
+}
+export function detectAdvisoryIntelligence(input) {
+    const findings = [];
+    for (const component of ADVISORY_COMPONENTS) {
+        const finding = detectComponentMatch(input, component);
+        if (finding) {
+            findings.push(finding);
+        }
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/command-exec.js

@@ -95,6 +95,12 @@ function makeFinding(filePath, field, ruleId, severity, description, evidence) {
         confidence: "HIGH",
         fixable: true,
         remediation_actions: ["remove_field", "replace_with_default"],
+        metadata: {
+            sources: [filePath, field],
+            sinks: ["process-execution"],
+            risk_tags: ["command-execution", "shell-pipeline"],
+            origin: "command-exec",
+        },
         evidence: evidence?.evidence ?? null,
         suppressed: false,
     };

package/dist/layer2-static/detectors/dependabot-cooldown.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface DependabotCooldownInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectDependabotCooldown(input: DependabotCooldownInput): Finding[];

package/dist/layer2-static/detectors/dependabot-cooldown.js

@@ -0,0 +1,54 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractDependabotFacts, isGitHubDependabotPath } from "../dependabot/parser.js";
+function hasCooldown(update) {
+    const cooldown = update.cooldown;
+    if (!cooldown) {
+        return false;
+    }
+    return (typeof cooldown.defaultDays === "number" ||
+        typeof cooldown.semverMajorDays === "number" ||
+        typeof cooldown.semverMinorDays === "number" ||
+        typeof cooldown.semverPatchDays === "number");
+}
+export function detectDependabotCooldown(input) {
+    if (!isGitHubDependabotPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractDependabotFacts(input.parsed);
+    if (!facts || facts.updates.length === 0) {
+        return [];
+    }
+    const findings = [];
+    facts.updates.forEach((update, index) => {
+        if (!update.schedule || hasCooldown(update)) {
+            return;
+        }
+        const ecosystem = update.packageEcosystem ?? "unknown-ecosystem";
+        const directory = update.directory ?? "/";
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [ecosystem, directory, "schedule", "cooldown"],
+            fallbackValue: `${ecosystem} ${directory} update rule has no cooldown`,
+        });
+        findings.push({
+            rule_id: "dependabot-cooldown",
+            finding_id: `DEPENDABOT_COOLDOWN-${input.filePath}-${index}`,
+            severity: "LOW",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `updates[${index}].cooldown` },
+            description: "Dependabot update rule has no cooldown window, increasing update churn and review pressure",
+            affected_tools: ["dependabot"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-400",
+            confidence: "MEDIUM",
+            fixable: false,
+            remediation_actions: ["Add cooldown settings to pace update volume and review load"],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/dependabot-execution.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface DependabotExecutionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectDependabotExecution(input: DependabotExecutionInput): Finding[];

package/dist/layer2-static/detectors/dependabot-execution.js

@@ -0,0 +1,68 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { isGitHubDependabotPath } from "../dependabot/parser.js";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function isExternalCodeExecutionAllowed(value) {
+    if (value === true) {
+        return true;
+    }
+    if (typeof value === "string") {
+        const normalized = value.trim().toLowerCase();
+        return normalized === "allow" || normalized === "true";
+    }
+    return false;
+}
+export function detectDependabotExecution(input) {
+    if (!isGitHubDependabotPath(input.filePath)) {
+        return [];
+    }
+    const root = asRecord(input.parsed);
+    const updates = Array.isArray(root?.updates) ? root.updates : [];
+    if (updates.length === 0) {
+        return [];
+    }
+    const findings = [];
+    updates.forEach((entry, index) => {
+        const update = asRecord(entry);
+        if (!update) {
+            return;
+        }
+        if (!isExternalCodeExecutionAllowed(update["insecure-external-code-execution"])) {
+            return;
+        }
+        const ecosystem = typeof update["package-ecosystem"] === "string"
+            ? update["package-ecosystem"]
+            : "unknown-ecosystem";
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [ecosystem, "insecure-external-code-execution", "allow"],
+            fallbackValue: `${ecosystem} enables insecure external code execution`,
+        });
+        findings.push({
+            rule_id: "dependabot-execution",
+            finding_id: `DEPENDABOT_EXECUTION-${input.filePath}-${index}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `updates[${index}].insecure-external-code-execution` },
+            description: "Dependabot update rule allows insecure external code execution",
+            affected_tools: ["dependabot"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-94",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Remove insecure-external-code-execution allowances and isolate registries through trusted credentials",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/rule-file.js

@@ -48,6 +48,11 @@ function makeFinding(filePath, field, ruleId, description, evidence, severity =
         confidence: "HIGH",
         fixable: true,
         remediation_actions: ["strip_unicode", "remove_block", "quarantine_file"],
+        metadata: {
+            sources: [filePath, field],
+            risk_tags: ["rule-injection", "prompt-injection"],
+            origin: "rule-file",
+        },
         evidence: evidence?.evidence ?? null,
         observed: narrative.observed ?? null,
         inference: narrative.inference ?? null,

package/dist/layer2-static/detectors/workflow-anonymous-definition.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowAnonymousDefinitionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowAnonymousDefinition(input: WorkflowAnonymousDefinitionInput): Finding[];

package/dist/layer2-static/detectors/workflow-anonymous-definition.js

@@ -0,0 +1,48 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+export function detectWorkflowAnonymousDefinition(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const root = asRecord(input.parsed);
+    const name = typeof root?.name === "string" ? root.name.trim() : "";
+    if (name.length > 0) {
+        return [];
+    }
+    const evidence = buildFindingEvidence({
+        textContent: input.textContent,
+        searchTerms: ["name:"],
+        fallbackValue: "workflow has no top-level name",
+    });
+    return [
+        {
+            rule_id: "workflow-anonymous-definition",
+            finding_id: `WORKFLOW_ANONYMOUS_DEFINITION-${input.filePath}`,
+            severity: "LOW",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: "name" },
+            description: "Workflow omits a top-level name, reducing review clarity and incident traceability",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-200",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: ["Add an explicit top-level workflow name"],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        },
+    ];
+}

package/dist/layer2-static/detectors/workflow-archived-uses.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowArchivedUsesInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowArchivedUses(input: WorkflowArchivedUsesInput): Promise<Finding[]>;

package/dist/layer2-static/detectors/workflow-archived-uses.js

@@ -0,0 +1,147 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const archivedRepoCacheByFetch = new WeakMap();
+const GITHUB_API_HEADERS = {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "CodeGate",
+};
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function isExternalRepositoryUse(value) {
+    return value.startsWith("./") || value.startsWith("../") || value.startsWith("docker://");
+}
+function trimTrailingSlashes(value) {
+    return value.replace(/\/+$/u, "");
+}
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || isExternalRepositoryUse(trimmed)) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimTrailingSlashes(trimmed.slice(0, atIndex).trim());
+    const [owner, repo] = slug.split("/");
+    if (!owner || !repo) {
+        return null;
+    }
+    return {
+        raw: trimmed,
+        owner: owner.toLowerCase(),
+        repo: repo.toLowerCase(),
+    };
+}
+async function isArchivedRepository(owner, repo) {
+    const fetchFn = globalThis.fetch;
+    if (typeof fetchFn !== "function") {
+        return false;
+    }
+    let cache = archivedRepoCacheByFetch.get(fetchFn);
+    if (!cache) {
+        cache = new Map();
+        archivedRepoCacheByFetch.set(fetchFn, cache);
+    }
+    const cacheKey = `${owner}/${repo}`;
+    const cached = cache.get(cacheKey);
+    if (cached !== undefined) {
+        return cached;
+    }
+    try {
+        const response = await fetchFn(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`, {
+            headers: GITHUB_API_HEADERS,
+        });
+        if (!response.ok) {
+            cache.set(cacheKey, false);
+            return false;
+        }
+        const payload = (await response.json());
+        const archived = Boolean(payload && typeof payload === "object" && payload.archived === true);
+        cache.set(cacheKey, archived);
+        return archived;
+    }
+    catch {
+        return false;
+    }
+}
+function gatherUsesTargets(parsed) {
+    const root = asRecord(parsed);
+    const jobsRecord = asRecord(root?.jobs);
+    if (!jobsRecord) {
+        return [];
+    }
+    const targets = [];
+    const addTarget = (uses, field) => {
+        const parsedUses = parseRepositoryUses(uses);
+        if (parsedUses) {
+            targets.push({
+                ...parsedUses,
+                field,
+            });
+        }
+    };
+    for (const [jobId, jobValue] of Object.entries(jobsRecord)) {
+        const jobRecord = asRecord(jobValue);
+        if (!jobRecord) {
+            continue;
+        }
+        if (typeof jobRecord.uses === "string") {
+            addTarget(jobRecord.uses, `jobs.${jobId}.uses`);
+        }
+        const steps = Array.isArray(jobRecord.steps) ? jobRecord.steps : [];
+        steps.forEach((step, stepIndex) => {
+            const stepRecord = asRecord(step);
+            if (stepRecord && typeof stepRecord.uses === "string") {
+                addTarget(stepRecord.uses, `jobs.${jobId}.steps[${stepIndex}].uses`);
+            }
+        });
+    }
+    return targets;
+}
+export async function detectWorkflowArchivedUses(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    if (!extractWorkflowFacts(input.parsed)) {
+        return [];
+    }
+    const targets = gatherUsesTargets(input.parsed);
+    const findings = [];
+    for (const target of targets) {
+        if (!(await isArchivedRepository(target.owner, target.repo))) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [target.raw, `${target.owner}/${target.repo}`],
+            fallbackValue: target.raw,
+        });
+        findings.push({
+            rule_id: "workflow-archived-uses",
+            finding_id: `WORKFLOW_ARCHIVED_USES-${input.filePath}-${target.field}`,
+            severity: "MEDIUM",
+            category: "CI_VULNERABLE_ACTION",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: target.field },
+            description: "Workflow action or reusable workflow comes from an archived repository",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Replace the archived repository reference with an actively maintained alternative",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-artipacked.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowArtipackedInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowArtipacked(input: WorkflowArtipackedInput): Finding[];

package/dist/layer2-static/detectors/workflow-artipacked.js

@@ -0,0 +1,62 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function isCheckoutStep(uses) {
+    return typeof uses === "string" && /^actions\/checkout(?:@.+)?$/iu.test(uses.trim());
+}
+function persistsCredentials(value) {
+    if (typeof value !== "string") {
+        return true;
+    }
+    return value.trim().toLowerCase() !== "false";
+}
+export function detectWorkflowArtipacked(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (!isCheckoutStep(step.uses)) {
+                return;
+            }
+            if (!persistsCredentials(step.with?.["persist-credentials"])) {
+                return;
+            }
+            const searchTerms = ["persist-credentials: true"];
+            if (step.uses) {
+                searchTerms.push(step.uses);
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms,
+                fallbackValue: "actions/checkout persists credentials on disk",
+            });
+            findings.push({
+                rule_id: "workflow-artipacked",
+                finding_id: `WORKFLOW_ARTIPACKED-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].with.persist-credentials` },
+                description: "Checkout step persists credentials on disk",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-922",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Set actions/checkout persist-credentials to false unless the workflow explicitly needs Git credentials",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-bot-conditions.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowBotConditionsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowBotConditions(input: WorkflowBotConditionsInput): Finding[];