codegate-ai 0.8.0 → 0.9.1

package/dist/layer2-static/rules/claude-code.json

@@ -0,0 +1,16 @@
+[
+  {
+    "id": "claude-mcp-consent-bypass",
+    "severity": "critical",
+    "category": "CONSENT_BYPASS",
+    "description": "Project config auto-approves MCP servers",
+    "tool": "claude-code",
+    "file_pattern": ".claude/settings*.json",
+    "query_type": "json_path",
+    "query": "$.enableAllProjectMcpServers",
+    "condition": "equals_true",
+    "cve": "CVE-2025-59536",
+    "owasp": ["ASI05", "ASI09"],
+    "cwe": "CWE-78"
+  }
+]

package/dist/layer2-static/rules/codex.json

@@ -0,0 +1,16 @@
+[
+  {
+    "id": "codex-mcp-command-exec",
+    "severity": "critical",
+    "category": "COMMAND_EXEC",
+    "description": "MCP server command execution in Codex config",
+    "tool": "codex-cli",
+    "file_pattern": ".codex/config.toml",
+    "query_type": "toml_path",
+    "query": "mcp.*.command",
+    "condition": "exists",
+    "cve": "CVE-2025-61260",
+    "owasp": ["ASI02", "ASI05"],
+    "cwe": "CWE-78"
+  }
+]

package/dist/layer2-static/rules/common.json

@@ -0,0 +1,15 @@
+[
+  {
+    "id": "env-base-url-override",
+    "severity": "critical",
+    "category": "ENV_OVERRIDE",
+    "description": "Environment override routes API traffic to a potentially untrusted endpoint",
+    "tool": "*",
+    "file_pattern": ".env|.env.local|.codex/.env",
+    "query_type": "env_key",
+    "query": "ANTHROPIC_BASE_URL|OPENAI_BASE_URL|OPENAI_API_BASE",
+    "condition": "exists",
+    "owasp": ["ASI03", "ASI06"],
+    "cwe": "CWE-522"
+  }
+]

package/dist/layer2-static/rules/copilot.json

@@ -0,0 +1,15 @@
+[
+  {
+    "id": "copilot-instructions-hidden-unicode",
+    "severity": "high",
+    "category": "RULE_INJECTION",
+    "description": "Copilot instruction file contains hidden Unicode characters",
+    "tool": "github-copilot",
+    "file_pattern": ".github/copilot-instructions.md",
+    "query_type": "text_pattern",
+    "query": "[\\u200B\\u200C\\u200D\\u2060\\uFEFF\\u202A-\\u202E]",
+    "condition": "regex_match",
+    "owasp": ["ASI01"],
+    "cwe": "CWE-116"
+  }
+]

package/dist/layer2-static/rules/cursor.json

@@ -0,0 +1,15 @@
+[
+  {
+    "id": "cursor-rule-hidden-unicode",
+    "severity": "high",
+    "category": "RULE_INJECTION",
+    "description": "Rule file contains hidden Unicode characters",
+    "tool": "cursor",
+    "file_pattern": ".cursorrules|.cursor/rules/*.mdc",
+    "query_type": "text_pattern",
+    "query": "[\\u200B\\u200C\\u200D\\u2060\\uFEFF\\u202A-\\u202E]",
+    "condition": "regex_match",
+    "owasp": ["ASI01"],
+    "cwe": "CWE-116"
+  }
+]

package/dist/layer2-static/rules/opencode.json

@@ -0,0 +1,15 @@
+[
+  {
+    "id": "opencode-command-array",
+    "severity": "critical",
+    "category": "COMMAND_EXEC",
+    "description": "OpenCode command array can execute local commands",
+    "tool": "opencode",
+    "file_pattern": "opencode.json",
+    "query_type": "json_path",
+    "query": "$.mcp.*.command",
+    "condition": "exists",
+    "owasp": ["ASI02", "ASI05"],
+    "cwe": "CWE-78"
+  }
+]

package/dist/layer2-static/workflow/injection-sinks.json

@@ -0,0 +1,5 @@
+{
+    "actions/github-script": ["script"],
+    "azure/powershell": ["inlineScript"],
+    "addnab/docker-run-action": ["run", "options"]
+}

package/dist/layer2-static/workflow/parser.d.ts

@@ -0,0 +1,3 @@
+import type { WorkflowFacts } from "./types.js";
+export declare function isGitHubWorkflowPath(path: string): boolean;
+export declare function extractWorkflowFacts(parsed: unknown): WorkflowFacts | null;

package/dist/layer2-static/workflow/parser.js

@@ -0,0 +1,88 @@
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function normalizeWorkflowPath(value) {
+    return value.replaceAll("\\", "/");
+}
+export function isGitHubWorkflowPath(path) {
+    return /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu.test(normalizeWorkflowPath(path));
+}
+function extractTriggers(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (Array.isArray(value)) {
+        return value.filter((entry) => typeof entry === "string");
+    }
+    const record = asRecord(value);
+    if (!record) {
+        return [];
+    }
+    return Object.keys(record);
+}
+function extractStepFacts(step) {
+    const stepRecord = asRecord(step);
+    if (!stepRecord) {
+        return null;
+    }
+    const withValues = asRecord(stepRecord.with);
+    const withEntries = {};
+    if (withValues) {
+        for (const [key, value] of Object.entries(withValues)) {
+            if (typeof value === "string") {
+                withEntries[key] = value;
+            }
+        }
+    }
+    const stepFacts = {
+        uses: asString(stepRecord.uses),
+        run: asString(stepRecord.run),
+        with: Object.keys(withEntries).length > 0 ? withEntries : undefined,
+    };
+    if (!stepFacts.uses && !stepFacts.run) {
+        return null;
+    }
+    return stepFacts;
+}
+function extractJobFacts(id, value) {
+    const jobRecord = asRecord(value);
+    if (!jobRecord) {
+        return null;
+    }
+    const stepsRaw = Array.isArray(jobRecord.steps) ? jobRecord.steps : [];
+    const steps = stepsRaw
+        .map((step) => extractStepFacts(step))
+        .filter((step) => step !== null);
+    return {
+        id,
+        permissions: jobRecord.permissions,
+        steps,
+    };
+}
+export function extractWorkflowFacts(parsed) {
+    const root = asRecord(parsed);
+    if (!root) {
+        return null;
+    }
+    const triggers = extractTriggers(root.on);
+    const jobsRecord = asRecord(root.jobs);
+    const jobs = jobsRecord
+        ? Object.entries(jobsRecord)
+            .map(([id, value]) => extractJobFacts(id, value))
+            .filter((job) => job !== null)
+        : [];
+    if (triggers.length === 0 && jobs.length === 0) {
+        return null;
+    }
+    return {
+        triggers,
+        workflowPermissions: root.permissions,
+        jobs,
+    };
+}

package/dist/layer2-static/workflow/types.d.ts

@@ -0,0 +1,15 @@
+export interface WorkflowStepFacts {
+    uses?: string;
+    run?: string;
+    with?: Record<string, string>;
+}
+export interface WorkflowJobFacts {
+    id: string;
+    permissions?: unknown;
+    steps: WorkflowStepFacts[];
+}
+export interface WorkflowFacts {
+    triggers: string[];
+    workflowPermissions?: unknown;
+    jobs: WorkflowJobFacts[];
+}

package/dist/layer2-static/workflow/types.js

@@ -0,0 +1 @@
+export {};

package/dist/pipeline.d.ts

@@ -26,7 +26,7 @@ export interface DeepScanOutcome {
     status: "skipped_without_consent" | "ok" | "auth_failure" | "timeout" | "network_error" | "command_error";
     result?: ResourceFetchResult;
 }
-export declare function runStaticPipeline(input: StaticPipelineInput): CodeGateReport;
+export declare function runStaticPipeline(input: StaticPipelineInput): Promise<CodeGateReport>;
 export declare function layer3OutcomesToFindings(outcomes: DeepScanOutcome[], options?: {
     unicodeAnalysis?: boolean;
 }): Finding[];

package/dist/pipeline.js

@@ -4,14 +4,14 @@ import { scanToolDescriptions, } from "./layer3-dynamic/tool-description-scanner
 import { detectToxicFlows } from "./layer3-dynamic/toxic-flow.js";
 import { applyReportSummary } from "./report-summary.js";
 import { withFindingFingerprint } from "./report/finding-fingerprint.js";
-export function runStaticPipeline(input) {
-    const findings = runStaticEngine({
+export async function runStaticPipeline(input) {
+    const findings = (await runStaticEngine({
         projectRoot: input.projectRoot,
         files: input.files,
         symlinkEscapes: input.symlinkEscapes,
         hooks: input.hooks,
         config: input.config,
-    }).map(withFindingFingerprint);
+    })).map(withFindingFingerprint);
     const report = createEmptyReport({
         version: input.version,
         kbVersion: input.kbVersion,

package/dist/reporter/sarif.js

@@ -8,22 +8,39 @@ function toSarifLevel(severity) {
     return "note";
 }
 function findingToLocation(finding) {
+    return locationToSarif({
+        filePath: finding.file_path,
+        location: finding.location,
+    });
+}
+function locationToSarif(input) {
     const region = {};
-    if (typeof finding.location.line === "number") {
-        region.startLine = finding.location.line;
+    if (typeof input.location?.line === "number") {
+        region.startLine = input.location.line;
     }
-    if (typeof finding.location.column === "number") {
-        region.startColumn = finding.location.column;
+    if (typeof input.location?.column === "number") {
+        region.startColumn = input.location.column;
     }
     return {
         physicalLocation: {
             artifactLocation: {
-                uri: finding.file_path,
+                uri: input.filePath,
             },
             region: Object.keys(region).length > 0 ? region : undefined,
         },
     };
 }
+function findingToRelatedLocations(finding) {
+    const related = finding.affected_locations ?? [];
+    if (related.length === 0) {
+        return undefined;
+    }
+    const locations = related.map((location) => locationToSarif({
+        filePath: location.file_path,
+        location: location.location,
+    }));
+    return locations.length > 0 ? locations : undefined;
+}
 function buildRules(findings) {
     const byRuleId = new Map();
     for (const finding of findings) {
@@ -47,6 +64,7 @@ function findingToResult(finding) {
         level: toSarifLevel(finding.severity),
         message: { text: finding.description },
         locations: [findingToLocation(finding)],
+        relatedLocations: findingToRelatedLocations(finding),
         properties: {
             finding_id: finding.finding_id,
             fingerprint: finding.fingerprint ?? null,

package/dist/reporter/terminal.js

@@ -84,6 +84,18 @@ function appendFinding(lines, report, options, finding) {
         if (formattedLocation) {
             lines.push(`  Location: ${formattedLocation}`);
         }
+        if ((finding.affected_locations?.length ?? 0) > 0) {
+            lines.push("  Affected locations:");
+            for (const location of finding.affected_locations ?? []) {
+                const path = toAbsoluteDisplayPath(report.scan_target, location.file_path);
+                const locationText = formatLocation({
+                    field: location.location?.field,
+                    line: location.location?.line,
+                    column: location.location?.column,
+                });
+                lines.push(`    - ${path}${locationText ? ` (${locationText})` : ""}`);
+            }
+        }
         if (finding.cve) {
             lines.push(`  CVE: ${finding.cve}`);
         }

package/dist/scan.d.ts

@@ -4,7 +4,7 @@ import { type KnowledgeBaseLoadResult } from "./layer1-discovery/knowledge-base.
 import { type WalkResult } from "./layer1-discovery/file-walker.js";
 import type { DiscoveryFormat } from "./types/discovery.js";
 import type { CodeGateReport } from "./types/report.js";
-import type { CodeGateConfig } from "./config.js";
+import type { CodeGateConfig, ScanCollectionKind, ScanCollectionMode } from "./config.js";
 import type { DeepScanResource } from "./pipeline.js";
 export interface ScanEngineInput {
     version: string;
@@ -18,10 +18,14 @@ export interface ScanEngineInput {
 export interface DeepScanDiscoveryOptions {
     includeUserScope?: boolean;
     homeDir?: string;
+    collectModes?: ScanCollectionMode[];
+    collectKinds?: ScanCollectionKind[];
 }
 export interface ScanSurfaceOptions {
     includeUserScope?: boolean;
     homeDir?: string;
+    collectModes?: ScanCollectionMode[];
+    collectKinds?: ScanCollectionKind[];
 }
 export interface ScanDiscoveryCandidate {
     reportPath: string;
@@ -45,6 +49,8 @@ export interface ScanDiscoveryContextOptions {
     homeDir?: string;
     parseSelected?: boolean;
     explicitCandidates?: ScanDiscoveryCandidate[];
+    collectModes?: ScanCollectionMode[];
+    collectKinds?: ScanCollectionKind[];
 }
 export declare function discoverDeepScanResources(scanTarget: string, kbInput?: KnowledgeBaseLoadResult, options?: DeepScanDiscoveryOptions): DeepScanResource[];
 export declare function createScanDiscoveryContext(scanTarget: string, kbInput?: KnowledgeBaseLoadResult, options?: ScanDiscoveryContextOptions): ScanDiscoveryContext;