codegate-ai 0.8.0 → 0.9.0

package/dist/layer2-static/workflow/parser.d.ts

@@ -0,0 +1,3 @@
+import type { WorkflowFacts } from "./types.js";
+export declare function isGitHubWorkflowPath(path: string): boolean;
+export declare function extractWorkflowFacts(parsed: unknown): WorkflowFacts | null;

package/dist/layer2-static/workflow/parser.js

@@ -0,0 +1,88 @@
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function normalizeWorkflowPath(value) {
+    return value.replaceAll("\\", "/");
+}
+export function isGitHubWorkflowPath(path) {
+    return /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu.test(normalizeWorkflowPath(path));
+}
+function extractTriggers(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (Array.isArray(value)) {
+        return value.filter((entry) => typeof entry === "string");
+    }
+    const record = asRecord(value);
+    if (!record) {
+        return [];
+    }
+    return Object.keys(record);
+}
+function extractStepFacts(step) {
+    const stepRecord = asRecord(step);
+    if (!stepRecord) {
+        return null;
+    }
+    const withValues = asRecord(stepRecord.with);
+    const withEntries = {};
+    if (withValues) {
+        for (const [key, value] of Object.entries(withValues)) {
+            if (typeof value === "string") {
+                withEntries[key] = value;
+            }
+        }
+    }
+    const stepFacts = {
+        uses: asString(stepRecord.uses),
+        run: asString(stepRecord.run),
+        with: Object.keys(withEntries).length > 0 ? withEntries : undefined,
+    };
+    if (!stepFacts.uses && !stepFacts.run) {
+        return null;
+    }
+    return stepFacts;
+}
+function extractJobFacts(id, value) {
+    const jobRecord = asRecord(value);
+    if (!jobRecord) {
+        return null;
+    }
+    const stepsRaw = Array.isArray(jobRecord.steps) ? jobRecord.steps : [];
+    const steps = stepsRaw
+        .map((step) => extractStepFacts(step))
+        .filter((step) => step !== null);
+    return {
+        id,
+        permissions: jobRecord.permissions,
+        steps,
+    };
+}
+export function extractWorkflowFacts(parsed) {
+    const root = asRecord(parsed);
+    if (!root) {
+        return null;
+    }
+    const triggers = extractTriggers(root.on);
+    const jobsRecord = asRecord(root.jobs);
+    const jobs = jobsRecord
+        ? Object.entries(jobsRecord)
+            .map(([id, value]) => extractJobFacts(id, value))
+            .filter((job) => job !== null)
+        : [];
+    if (triggers.length === 0 && jobs.length === 0) {
+        return null;
+    }
+    return {
+        triggers,
+        workflowPermissions: root.permissions,
+        jobs,
+    };
+}

package/dist/layer2-static/workflow/types.d.ts

@@ -0,0 +1,15 @@
+export interface WorkflowStepFacts {
+    uses?: string;
+    run?: string;
+    with?: Record<string, string>;
+}
+export interface WorkflowJobFacts {
+    id: string;
+    permissions?: unknown;
+    steps: WorkflowStepFacts[];
+}
+export interface WorkflowFacts {
+    triggers: string[];
+    workflowPermissions?: unknown;
+    jobs: WorkflowJobFacts[];
+}

package/dist/layer2-static/workflow/types.js

@@ -0,0 +1 @@
+export {};

package/dist/pipeline.d.ts

@@ -26,7 +26,7 @@ export interface DeepScanOutcome {
     status: "skipped_without_consent" | "ok" | "auth_failure" | "timeout" | "network_error" | "command_error";
     result?: ResourceFetchResult;
 }
-export declare function runStaticPipeline(input: StaticPipelineInput): CodeGateReport;
+export declare function runStaticPipeline(input: StaticPipelineInput): Promise<CodeGateReport>;
 export declare function layer3OutcomesToFindings(outcomes: DeepScanOutcome[], options?: {
     unicodeAnalysis?: boolean;
 }): Finding[];

package/dist/pipeline.js

@@ -4,14 +4,14 @@ import { scanToolDescriptions, } from "./layer3-dynamic/tool-description-scanner
 import { detectToxicFlows } from "./layer3-dynamic/toxic-flow.js";
 import { applyReportSummary } from "./report-summary.js";
 import { withFindingFingerprint } from "./report/finding-fingerprint.js";
-export function runStaticPipeline(input) {
-    const findings = runStaticEngine({
+export async function runStaticPipeline(input) {
+    const findings = (await runStaticEngine({
         projectRoot: input.projectRoot,
         files: input.files,
         symlinkEscapes: input.symlinkEscapes,
         hooks: input.hooks,
         config: input.config,
-    }).map(withFindingFingerprint);
+    })).map(withFindingFingerprint);
     const report = createEmptyReport({
         version: input.version,
         kbVersion: input.kbVersion,

package/dist/reporter/sarif.js

@@ -8,22 +8,39 @@ function toSarifLevel(severity) {
     return "note";
 }
 function findingToLocation(finding) {
+    return locationToSarif({
+        filePath: finding.file_path,
+        location: finding.location,
+    });
+}
+function locationToSarif(input) {
     const region = {};
-    if (typeof finding.location.line === "number") {
-        region.startLine = finding.location.line;
+    if (typeof input.location?.line === "number") {
+        region.startLine = input.location.line;
     }
-    if (typeof finding.location.column === "number") {
-        region.startColumn = finding.location.column;
+    if (typeof input.location?.column === "number") {
+        region.startColumn = input.location.column;
     }
     return {
         physicalLocation: {
             artifactLocation: {
-                uri: finding.file_path,
+                uri: input.filePath,
             },
             region: Object.keys(region).length > 0 ? region : undefined,
         },
     };
 }
+function findingToRelatedLocations(finding) {
+    const related = finding.affected_locations ?? [];
+    if (related.length === 0) {
+        return undefined;
+    }
+    const locations = related.map((location) => locationToSarif({
+        filePath: location.file_path,
+        location: location.location,
+    }));
+    return locations.length > 0 ? locations : undefined;
+}
 function buildRules(findings) {
     const byRuleId = new Map();
     for (const finding of findings) {
@@ -47,6 +64,7 @@ function findingToResult(finding) {
         level: toSarifLevel(finding.severity),
         message: { text: finding.description },
         locations: [findingToLocation(finding)],
+        relatedLocations: findingToRelatedLocations(finding),
         properties: {
             finding_id: finding.finding_id,
             fingerprint: finding.fingerprint ?? null,

package/dist/reporter/terminal.js

@@ -84,6 +84,18 @@ function appendFinding(lines, report, options, finding) {
         if (formattedLocation) {
             lines.push(`  Location: ${formattedLocation}`);
         }
+        if ((finding.affected_locations?.length ?? 0) > 0) {
+            lines.push("  Affected locations:");
+            for (const location of finding.affected_locations ?? []) {
+                const path = toAbsoluteDisplayPath(report.scan_target, location.file_path);
+                const locationText = formatLocation({
+                    field: location.location?.field,
+                    line: location.location?.line,
+                    column: location.location?.column,
+                });
+                lines.push(`    - ${path}${locationText ? ` (${locationText})` : ""}`);
+            }
+        }
         if (finding.cve) {
             lines.push(`  CVE: ${finding.cve}`);
         }

package/dist/scan.d.ts

@@ -4,7 +4,7 @@ import { type KnowledgeBaseLoadResult } from "./layer1-discovery/knowledge-base.
 import { type WalkResult } from "./layer1-discovery/file-walker.js";
 import type { DiscoveryFormat } from "./types/discovery.js";
 import type { CodeGateReport } from "./types/report.js";
-import type { CodeGateConfig } from "./config.js";
+import type { CodeGateConfig, ScanCollectionKind, ScanCollectionMode } from "./config.js";
 import type { DeepScanResource } from "./pipeline.js";
 export interface ScanEngineInput {
     version: string;
@@ -18,10 +18,14 @@ export interface ScanEngineInput {
 export interface DeepScanDiscoveryOptions {
     includeUserScope?: boolean;
     homeDir?: string;
+    collectModes?: ScanCollectionMode[];
+    collectKinds?: ScanCollectionKind[];
 }
 export interface ScanSurfaceOptions {
     includeUserScope?: boolean;
     homeDir?: string;
+    collectModes?: ScanCollectionMode[];
+    collectKinds?: ScanCollectionKind[];
 }
 export interface ScanDiscoveryCandidate {
     reportPath: string;
@@ -45,6 +49,8 @@ export interface ScanDiscoveryContextOptions {
     homeDir?: string;
     parseSelected?: boolean;
     explicitCandidates?: ScanDiscoveryCandidate[];
+    collectModes?: ScanCollectionMode[];
+    collectKinds?: ScanCollectionKind[];
 }
 export declare function discoverDeepScanResources(scanTarget: string, kbInput?: KnowledgeBaseLoadResult, options?: DeepScanDiscoveryOptions): DeepScanResource[];
 export declare function createScanDiscoveryContext(scanTarget: string, kbInput?: KnowledgeBaseLoadResult, options?: ScanDiscoveryContextOptions): ScanDiscoveryContext;

package/dist/scan.js

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, relative, resolve, sep } from "node:path";
+import { basename, join, relative, resolve, sep } from "node:path";
 import { collectLocalTextAnalysisTargets, } from "./layer3-dynamic/local-text-analysis.js";
 import { runStaticPipeline } from "./pipeline.js";
 import { applyReportSummary } from "./report-summary.js";
@@ -9,11 +9,28 @@ import { loadKnowledgeBase, } from "./layer1-discovery/knowledge-base.js";
 import { detectTools } from "./layer1-discovery/tool-detector.js";
 import { walkProjectTree } from "./layer1-discovery/file-walker.js";
 import { evaluateScanStateSnapshots, extractMcpServerSnapshots, loadScanState, saveScanState, } from "./layer2-static/state/scan-state.js";
+import { applyInlineIgnoreDirectives, collectInlineIgnoreDirectives, } from "./config/inline-ignore.js";
+import { isGitHubDependabotPath } from "./layer2-static/dependabot/parser.js";
 const MCP_SERVER_CONTAINER_KEYS = ["mcpServers", "mcp_servers", "context_servers"];
 const REMOTE_MCP_SERVER_ARRAY_KEYS = ["remoteMCPServers", "remote_mcp_servers"];
 const USER_SCOPE_WILDCARD_MAX_DEPTH = 6;
 const USER_SCOPE_WILDCARD_MAX_FILES = 500;
 const INFERRED_ARTIFACT_RULES = [
+    {
+        pattern: /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu,
+        format: "yaml",
+        tool: "github-actions",
+    },
+    {
+        pattern: /(?:^|\/)\.github\/dependabot\.ya?ml$/iu,
+        format: "yaml",
+        tool: "dependabot",
+    },
+    {
+        pattern: /(?:^|\/)action\.ya?ml$/iu,
+        format: "yaml",
+        tool: "github-actions",
+    },
     { pattern: /(?:^|\/)agents\.md$/iu, format: "markdown", tool: "claude-code" },
     { pattern: /(?:^|\/)claude\.md$/iu, format: "markdown", tool: "claude-code" },
     { pattern: /(?:^|\/)codex\.md$/iu, format: "markdown", tool: "codex-cli" },
@@ -37,6 +54,12 @@ function wildcardToRegex(pattern) {
 function normalizePathForMatch(path) {
     return path.split(sep).join("/");
 }
+function normalizeCollectionKinds(input) {
+    if (!input || input.length === 0) {
+        return undefined;
+    }
+    return new Set(input);
+}
 function normalizeUserScopePattern(pattern) {
     return normalizePathForMatch(pattern).replace(/^~\//u, "").replace(/^\/+/u, "");
 }
@@ -63,6 +86,32 @@ function gatherCandidatePatterns(kb) {
     }
     return candidates;
 }
+function isWorkflowCollectionCandidate(reportPath) {
+    return /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu.test(normalizePathForMatch(reportPath));
+}
+function isActionCollectionCandidate(reportPath) {
+    const fileName = basename(normalizePathForMatch(reportPath)).toLowerCase();
+    return fileName === "action.yml" || fileName === "action.yaml";
+}
+function inferCollectionKind(reportPath) {
+    if (isWorkflowCollectionCandidate(reportPath)) {
+        return "workflows";
+    }
+    if (isActionCollectionCandidate(reportPath)) {
+        return "actions";
+    }
+    if (isGitHubDependabotPath(reportPath)) {
+        return "dependabot";
+    }
+    return null;
+}
+function matchesCollectionKinds(reportPath, collectKinds) {
+    if (!collectKinds) {
+        return true;
+    }
+    const kind = inferCollectionKind(reportPath);
+    return kind !== null && collectKinds.has(kind);
+}
 function isRegularFile(path) {
     try {
         return statSync(path).isFile();
@@ -149,6 +198,11 @@ function collectUserScopeWildcardMatches(homeDir, pattern) {
 }
 function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, options) {
     const selected = new Map();
+    const includeAll = options.collectModes.has("all");
+    const includeProject = includeAll || options.collectModes.has("default") || options.collectModes.has("project");
+    const includeUser = includeAll ||
+        options.collectModes.has("user") ||
+        (options.collectModes.has("default") && options.includeUserScope);
     const filesByRelativePath = walkedFiles
         .map((filePath) => ({
         absolutePath: filePath,
@@ -156,6 +210,9 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
     }))
         .filter((entry) => !entry.relativePath.startsWith(".."));
     for (const file of filesByRelativePath) {
+        if (!includeProject) {
+            continue;
+        }
         for (const candidate of patterns) {
             if (candidate.scope !== "project") {
                 continue;
@@ -163,6 +220,9 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
             if (!wildcardToRegex(candidate.pattern).test(file.relativePath)) {
                 continue;
             }
+            if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
+                continue;
+            }
             if (!selected.has(file.relativePath)) {
                 selected.set(file.relativePath, {
                     reportPath: file.relativePath,
@@ -173,8 +233,14 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
             }
         }
     }
-    if (!options.includeUserScope) {
+    if (!includeUser) {
         for (const file of filesByRelativePath) {
+            if (!includeProject) {
+                continue;
+            }
+            if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
+                continue;
+            }
             if (selected.has(file.relativePath)) {
                 continue;
             }
@@ -186,40 +252,54 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
         }
         return Array.from(selected.values());
     }
-    for (const candidate of patterns) {
-        if (candidate.scope !== "user") {
-            continue;
-        }
-        const userPattern = normalizeUserScopePattern(candidate.pattern);
-        if (userPattern.includes("*")) {
-            for (const match of collectUserScopeWildcardMatches(options.homeDir, userPattern)) {
-                const reportPath = toUserReportPath(match.relativePath);
-                if (!selected.has(reportPath)) {
-                    selected.set(reportPath, {
-                        reportPath,
-                        absolutePath: match.absolutePath,
-                        format: candidate.format,
-                        tool: candidate.tool,
-                    });
+    if (includeUser) {
+        for (const candidate of patterns) {
+            if (candidate.scope !== "user") {
+                continue;
+            }
+            const userPattern = normalizeUserScopePattern(candidate.pattern);
+            if (userPattern.includes("*")) {
+                for (const match of collectUserScopeWildcardMatches(options.homeDir, userPattern)) {
+                    const reportPath = toUserReportPath(match.relativePath);
+                    if (!matchesCollectionKinds(reportPath, options.collectKinds)) {
+                        continue;
+                    }
+                    if (!selected.has(reportPath)) {
+                        selected.set(reportPath, {
+                            reportPath,
+                            absolutePath: match.absolutePath,
+                            format: candidate.format,
+                            tool: candidate.tool,
+                        });
+                    }
                 }
+                continue;
+            }
+            const absolutePath = resolve(options.homeDir, userPattern);
+            if (!existsSync(absolutePath) || !isRegularFile(absolutePath)) {
+                continue;
+            }
+            const reportPath = toUserReportPath(userPattern);
+            if (!matchesCollectionKinds(reportPath, options.collectKinds)) {
+                continue;
+            }
+            if (!selected.has(reportPath)) {
+                selected.set(reportPath, {
+                    reportPath,
+                    absolutePath,
+                    format: candidate.format,
+                    tool: candidate.tool,
+                });
             }
-            continue;
         }
-        const absolutePath = resolve(options.homeDir, userPattern);
-        if (!existsSync(absolutePath) || !isRegularFile(absolutePath)) {
+    }
+    for (const file of filesByRelativePath) {
+        if (!includeProject && !includeAll) {
             continue;
         }
-        const reportPath = toUserReportPath(userPattern);
-        if (!selected.has(reportPath)) {
-            selected.set(reportPath, {
-                reportPath,
-                absolutePath,
-                format: candidate.format,
-                tool: candidate.tool,
-            });
+        if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
+            continue;
         }
-    }
-    for (const file of filesByRelativePath) {
         if (selected.has(file.relativePath)) {
             continue;
         }
@@ -231,7 +311,17 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
     }
     return Array.from(selected.values());
 }
-function mergeExplicitCandidates(selected, explicitCandidates) {
+function normalizeCollectionModes(input) {
+    const normalized = new Set();
+    for (const mode of input ?? []) {
+        normalized.add(mode);
+    }
+    if (normalized.size === 0) {
+        normalized.add("default");
+    }
+    return normalized;
+}
+function mergeExplicitCandidates(selected, explicitCandidates, collectKinds) {
     if (!explicitCandidates || explicitCandidates.length === 0) {
         return selected;
     }
@@ -240,6 +330,9 @@ function mergeExplicitCandidates(selected, explicitCandidates) {
         merged.set(candidate.reportPath, candidate);
     }
     for (const candidate of explicitCandidates) {
+        if (!matchesCollectionKinds(candidate.reportPath, collectKinds)) {
+            continue;
+        }
         merged.set(candidate.reportPath, candidate);
     }
     return Array.from(merged.values());
@@ -272,11 +365,11 @@ function ensureParsedCandidates(context) {
     }
     return context.parsedCandidates;
 }
-function makeParseErrorFinding(filePath, tool, message) {
+function makeParseErrorFinding(filePath, tool, message, strictCollection) {
     return {
         rule_id: "parse-error",
         finding_id: `PARSE_ERROR-${filePath}`,
-        severity: "LOW",
+        severity: strictCollection ? "HIGH" : "LOW",
         category: "PARSE_ERROR",
         layer: "L1",
         file_path: filePath,
@@ -455,6 +548,8 @@ export function discoverDeepScanResources(scanTarget, kbInput, options = {}) {
     const context = createScanDiscoveryContext(scanTarget, kbInput, {
         includeUserScope: options.includeUserScope,
         homeDir: options.homeDir,
+        collectModes: options.collectModes,
+        collectKinds: options.collectKinds,
         parseSelected: true,
     });
     return discoverDeepScanResourcesFromContext(context);
@@ -468,10 +563,17 @@ export function createScanDiscoveryContext(scanTarget, kbInput, options = {}) {
     const kb = kbInput ?? loadKnowledgeBase();
     const patterns = gatherCandidatePatterns(kb);
     const walked = walkProjectTree(absoluteTarget);
-    const selected = mergeExplicitCandidates(collectSelectedCandidates(absoluteTarget, walked.files, patterns, {
-        includeUserScope: options.includeUserScope === true,
-        homeDir: resolve(options.homeDir ?? homedir()),
-    }), options.explicitCandidates);
+    const collectModes = normalizeCollectionModes(options.collectModes);
+    const collectKinds = normalizeCollectionKinds(options.collectKinds);
+    const explicitOnly = collectModes.size === 1 && collectModes.has("explicit");
+    const selected = mergeExplicitCandidates(explicitOnly
+        ? []
+        : collectSelectedCandidates(absoluteTarget, walked.files, patterns, {
+            includeUserScope: options.includeUserScope === true,
+            homeDir: resolve(options.homeDir ?? homedir()),
+            collectModes,
+            collectKinds,
+        }), options.explicitCandidates, collectKinds);
     return {
         absoluteTarget,
         kb,
@@ -494,6 +596,8 @@ export function collectScanSurface(scanTarget, kbInput, options = {}) {
     const context = createScanDiscoveryContext(scanTarget, kbInput, {
         includeUserScope: options.includeUserScope === true,
         homeDir: options.homeDir,
+        collectModes: options.collectModes,
+        collectKinds: options.collectKinds,
     });
     const surface = new Set(context.walked.files);
     for (const item of context.selected) {
@@ -513,6 +617,8 @@ export async function runScanEngine(input) {
     const context = input.discoveryContext ??
         createScanDiscoveryContext(input.scanTarget, input.kb, {
             includeUserScope: input.config.scan_user_scope === true,
+            collectModes: input.config.scan_collection_modes,
+            collectKinds: input.config.scan_collection_kinds,
             homeDir: input.homeDir,
             parseSelected: true,
         });
@@ -522,7 +628,7 @@ export async function runScanEngine(input) {
     const staticFiles = [];
     for (const item of ensureParsedCandidates(context)) {
         if (!item.parsed.ok) {
-            parseErrors.push(makeParseErrorFinding(item.reportPath, item.tool, item.parsed.error));
+            parseErrors.push(makeParseErrorFinding(item.reportPath, item.tool, item.parsed.error, input.config.strict_collection === true));
             continue;
         }
         staticFiles.push({
@@ -548,7 +654,7 @@ export async function runScanEngine(input) {
             executable: (mode & 0o111) !== 0,
         };
     });
-    const report = runStaticPipeline({
+    const report = await runStaticPipeline({
         version: input.version,
         kbVersion: kb.schemaVersion,
         scanTarget: input.scanTarget,
@@ -574,6 +680,10 @@ export async function runScanEngine(input) {
             rulePackPaths: input.config.rule_pack_paths,
             allowedRules: input.config.allowed_rules,
             skipRules: input.config.skip_rules,
+            persona: input.config.persona,
+            runtimeMode: input.config.runtime_mode,
+            workflowAuditsEnabled: input.config.workflow_audits?.enabled === true,
+            rulePolicies: input.config.rules,
         },
     });
     const snapshots = new Map();
@@ -588,7 +698,11 @@ export async function runScanEngine(input) {
         previousState,
     });
     saveScanState(stateResult.nextState, input.scanStatePath);
-    const findings = [...report.findings, ...parseErrors, ...stateResult.findings];
+    const inlineIgnores = collectInlineIgnoreDirectives(staticFiles.map((file) => ({
+        filePath: file.filePath,
+        textContent: file.textContent,
+    })));
+    const findings = applyInlineIgnoreDirectives([...report.findings, ...parseErrors, ...stateResult.findings], inlineIgnores);
     return applyReportSummary({
         ...report,
         findings,

package/dist/types/finding.d.ts

@@ -1,6 +1,6 @@
 export declare const SEVERITIES: readonly ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
 export type Severity = (typeof SEVERITIES)[number];
-export declare const FINDING_CATEGORIES: readonly ["ENV_OVERRIDE", "COMMAND_EXEC", "CONSENT_BYPASS", "RULE_INJECTION", "IDE_SETTINGS", "SYMLINK_ESCAPE", "GIT_HOOK", "CONFIG_PRESENT", "PARSE_ERROR", "CONFIG_CHANGE", "NEW_SERVER", "TOXIC_FLOW"];
+export declare const FINDING_CATEGORIES: readonly ["ENV_OVERRIDE", "COMMAND_EXEC", "CONSENT_BYPASS", "RULE_INJECTION", "IDE_SETTINGS", "SYMLINK_ESCAPE", "GIT_HOOK", "CONFIG_PRESENT", "PARSE_ERROR", "CONFIG_CHANGE", "NEW_SERVER", "TOXIC_FLOW", "CI_SUPPLY_CHAIN", "CI_TRIGGER", "CI_PERMISSIONS", "CI_TEMPLATE_INJECTION", "CI_VULNERABLE_ACTION"];
 export type FindingCategory = (typeof FINDING_CATEGORIES)[number];
 export type FindingLayer = "L1" | "L2" | "L3";
 export type FindingConfidence = "HIGH" | "MEDIUM" | "LOW";

package/dist/types/finding.js

@@ -12,4 +12,9 @@ export const FINDING_CATEGORIES = [
     "CONFIG_CHANGE",
     "NEW_SERVER",
     "TOXIC_FLOW",
+    "CI_SUPPLY_CHAIN",
+    "CI_TRIGGER",
+    "CI_PERMISSIONS",
+    "CI_TEMPLATE_INJECTION",
+    "CI_VULNERABLE_ACTION",
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",