codegate-ai 0.8.0 → 0.9.1

package/dist/scan.js

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, relative, resolve, sep } from "node:path";
+import { basename, join, relative, resolve, sep } from "node:path";
 import { collectLocalTextAnalysisTargets, } from "./layer3-dynamic/local-text-analysis.js";
 import { runStaticPipeline } from "./pipeline.js";
 import { applyReportSummary } from "./report-summary.js";
@@ -9,11 +9,28 @@ import { loadKnowledgeBase, } from "./layer1-discovery/knowledge-base.js";
 import { detectTools } from "./layer1-discovery/tool-detector.js";
 import { walkProjectTree } from "./layer1-discovery/file-walker.js";
 import { evaluateScanStateSnapshots, extractMcpServerSnapshots, loadScanState, saveScanState, } from "./layer2-static/state/scan-state.js";
+import { applyInlineIgnoreDirectives, collectInlineIgnoreDirectives, } from "./config/inline-ignore.js";
+import { isGitHubDependabotPath } from "./layer2-static/dependabot/parser.js";
 const MCP_SERVER_CONTAINER_KEYS = ["mcpServers", "mcp_servers", "context_servers"];
 const REMOTE_MCP_SERVER_ARRAY_KEYS = ["remoteMCPServers", "remote_mcp_servers"];
 const USER_SCOPE_WILDCARD_MAX_DEPTH = 6;
 const USER_SCOPE_WILDCARD_MAX_FILES = 500;
 const INFERRED_ARTIFACT_RULES = [
+    {
+        pattern: /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu,
+        format: "yaml",
+        tool: "github-actions",
+    },
+    {
+        pattern: /(?:^|\/)\.github\/dependabot\.ya?ml$/iu,
+        format: "yaml",
+        tool: "dependabot",
+    },
+    {
+        pattern: /(?:^|\/)action\.ya?ml$/iu,
+        format: "yaml",
+        tool: "github-actions",
+    },
     { pattern: /(?:^|\/)agents\.md$/iu, format: "markdown", tool: "claude-code" },
     { pattern: /(?:^|\/)claude\.md$/iu, format: "markdown", tool: "claude-code" },
     { pattern: /(?:^|\/)codex\.md$/iu, format: "markdown", tool: "codex-cli" },
@@ -37,6 +54,12 @@ function wildcardToRegex(pattern) {
 function normalizePathForMatch(path) {
     return path.split(sep).join("/");
 }
+function normalizeCollectionKinds(input) {
+    if (!input || input.length === 0) {
+        return undefined;
+    }
+    return new Set(input);
+}
 function normalizeUserScopePattern(pattern) {
     return normalizePathForMatch(pattern).replace(/^~\//u, "").replace(/^\/+/u, "");
 }
@@ -63,6 +86,32 @@ function gatherCandidatePatterns(kb) {
     }
     return candidates;
 }
+function isWorkflowCollectionCandidate(reportPath) {
+    return /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/iu.test(normalizePathForMatch(reportPath));
+}
+function isActionCollectionCandidate(reportPath) {
+    const fileName = basename(normalizePathForMatch(reportPath)).toLowerCase();
+    return fileName === "action.yml" || fileName === "action.yaml";
+}
+function inferCollectionKind(reportPath) {
+    if (isWorkflowCollectionCandidate(reportPath)) {
+        return "workflows";
+    }
+    if (isActionCollectionCandidate(reportPath)) {
+        return "actions";
+    }
+    if (isGitHubDependabotPath(reportPath)) {
+        return "dependabot";
+    }
+    return null;
+}
+function matchesCollectionKinds(reportPath, collectKinds) {
+    if (!collectKinds) {
+        return true;
+    }
+    const kind = inferCollectionKind(reportPath);
+    return kind !== null && collectKinds.has(kind);
+}
 function isRegularFile(path) {
     try {
         return statSync(path).isFile();
@@ -149,6 +198,11 @@ function collectUserScopeWildcardMatches(homeDir, pattern) {
 }
 function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, options) {
     const selected = new Map();
+    const includeAll = options.collectModes.has("all");
+    const includeProject = includeAll || options.collectModes.has("default") || options.collectModes.has("project");
+    const includeUser = includeAll ||
+        options.collectModes.has("user") ||
+        (options.collectModes.has("default") && options.includeUserScope);
     const filesByRelativePath = walkedFiles
         .map((filePath) => ({
         absolutePath: filePath,
@@ -156,6 +210,9 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
     }))
         .filter((entry) => !entry.relativePath.startsWith(".."));
     for (const file of filesByRelativePath) {
+        if (!includeProject) {
+            continue;
+        }
         for (const candidate of patterns) {
             if (candidate.scope !== "project") {
                 continue;
@@ -163,6 +220,9 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
             if (!wildcardToRegex(candidate.pattern).test(file.relativePath)) {
                 continue;
             }
+            if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
+                continue;
+            }
             if (!selected.has(file.relativePath)) {
                 selected.set(file.relativePath, {
                     reportPath: file.relativePath,
@@ -173,8 +233,14 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
             }
         }
     }
-    if (!options.includeUserScope) {
+    if (!includeUser) {
         for (const file of filesByRelativePath) {
+            if (!includeProject) {
+                continue;
+            }
+            if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
+                continue;
+            }
             if (selected.has(file.relativePath)) {
                 continue;
             }
@@ -186,40 +252,54 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
         }
         return Array.from(selected.values());
     }
-    for (const candidate of patterns) {
-        if (candidate.scope !== "user") {
-            continue;
-        }
-        const userPattern = normalizeUserScopePattern(candidate.pattern);
-        if (userPattern.includes("*")) {
-            for (const match of collectUserScopeWildcardMatches(options.homeDir, userPattern)) {
-                const reportPath = toUserReportPath(match.relativePath);
-                if (!selected.has(reportPath)) {
-                    selected.set(reportPath, {
-                        reportPath,
-                        absolutePath: match.absolutePath,
-                        format: candidate.format,
-                        tool: candidate.tool,
-                    });
+    if (includeUser) {
+        for (const candidate of patterns) {
+            if (candidate.scope !== "user") {
+                continue;
+            }
+            const userPattern = normalizeUserScopePattern(candidate.pattern);
+            if (userPattern.includes("*")) {
+                for (const match of collectUserScopeWildcardMatches(options.homeDir, userPattern)) {
+                    const reportPath = toUserReportPath(match.relativePath);
+                    if (!matchesCollectionKinds(reportPath, options.collectKinds)) {
+                        continue;
+                    }
+                    if (!selected.has(reportPath)) {
+                        selected.set(reportPath, {
+                            reportPath,
+                            absolutePath: match.absolutePath,
+                            format: candidate.format,
+                            tool: candidate.tool,
+                        });
+                    }
                 }
+                continue;
+            }
+            const absolutePath = resolve(options.homeDir, userPattern);
+            if (!existsSync(absolutePath) || !isRegularFile(absolutePath)) {
+                continue;
+            }
+            const reportPath = toUserReportPath(userPattern);
+            if (!matchesCollectionKinds(reportPath, options.collectKinds)) {
+                continue;
+            }
+            if (!selected.has(reportPath)) {
+                selected.set(reportPath, {
+                    reportPath,
+                    absolutePath,
+                    format: candidate.format,
+                    tool: candidate.tool,
+                });
             }
-            continue;
         }
-        const absolutePath = resolve(options.homeDir, userPattern);
-        if (!existsSync(absolutePath) || !isRegularFile(absolutePath)) {
+    }
+    for (const file of filesByRelativePath) {
+        if (!includeProject && !includeAll) {
             continue;
         }
-        const reportPath = toUserReportPath(userPattern);
-        if (!selected.has(reportPath)) {
-            selected.set(reportPath, {
-                reportPath,
-                absolutePath,
-                format: candidate.format,
-                tool: candidate.tool,
-            });
+        if (!matchesCollectionKinds(file.relativePath, options.collectKinds)) {
+            continue;
         }
-    }
-    for (const file of filesByRelativePath) {
         if (selected.has(file.relativePath)) {
             continue;
         }
@@ -231,7 +311,17 @@ function collectSelectedCandidates(absoluteTarget, walkedFiles, patterns, option
     }
     return Array.from(selected.values());
 }
-function mergeExplicitCandidates(selected, explicitCandidates) {
+function normalizeCollectionModes(input) {
+    const normalized = new Set();
+    for (const mode of input ?? []) {
+        normalized.add(mode);
+    }
+    if (normalized.size === 0) {
+        normalized.add("default");
+    }
+    return normalized;
+}
+function mergeExplicitCandidates(selected, explicitCandidates, collectKinds) {
     if (!explicitCandidates || explicitCandidates.length === 0) {
         return selected;
     }
@@ -240,6 +330,9 @@ function mergeExplicitCandidates(selected, explicitCandidates) {
         merged.set(candidate.reportPath, candidate);
     }
     for (const candidate of explicitCandidates) {
+        if (!matchesCollectionKinds(candidate.reportPath, collectKinds)) {
+            continue;
+        }
         merged.set(candidate.reportPath, candidate);
     }
     return Array.from(merged.values());
@@ -272,11 +365,11 @@ function ensureParsedCandidates(context) {
     }
     return context.parsedCandidates;
 }
-function makeParseErrorFinding(filePath, tool, message) {
+function makeParseErrorFinding(filePath, tool, message, strictCollection) {
     return {
         rule_id: "parse-error",
         finding_id: `PARSE_ERROR-${filePath}`,
-        severity: "LOW",
+        severity: strictCollection ? "HIGH" : "LOW",
         category: "PARSE_ERROR",
         layer: "L1",
         file_path: filePath,
@@ -455,6 +548,8 @@ export function discoverDeepScanResources(scanTarget, kbInput, options = {}) {
     const context = createScanDiscoveryContext(scanTarget, kbInput, {
         includeUserScope: options.includeUserScope,
         homeDir: options.homeDir,
+        collectModes: options.collectModes,
+        collectKinds: options.collectKinds,
         parseSelected: true,
     });
     return discoverDeepScanResourcesFromContext(context);
@@ -468,10 +563,17 @@ export function createScanDiscoveryContext(scanTarget, kbInput, options = {}) {
     const kb = kbInput ?? loadKnowledgeBase();
     const patterns = gatherCandidatePatterns(kb);
     const walked = walkProjectTree(absoluteTarget);
-    const selected = mergeExplicitCandidates(collectSelectedCandidates(absoluteTarget, walked.files, patterns, {
-        includeUserScope: options.includeUserScope === true,
-        homeDir: resolve(options.homeDir ?? homedir()),
-    }), options.explicitCandidates);
+    const collectModes = normalizeCollectionModes(options.collectModes);
+    const collectKinds = normalizeCollectionKinds(options.collectKinds);
+    const explicitOnly = collectModes.size === 1 && collectModes.has("explicit");
+    const selected = mergeExplicitCandidates(explicitOnly
+        ? []
+        : collectSelectedCandidates(absoluteTarget, walked.files, patterns, {
+            includeUserScope: options.includeUserScope === true,
+            homeDir: resolve(options.homeDir ?? homedir()),
+            collectModes,
+            collectKinds,
+        }), options.explicitCandidates, collectKinds);
     return {
         absoluteTarget,
         kb,
@@ -494,6 +596,8 @@ export function collectScanSurface(scanTarget, kbInput, options = {}) {
     const context = createScanDiscoveryContext(scanTarget, kbInput, {
         includeUserScope: options.includeUserScope === true,
         homeDir: options.homeDir,
+        collectModes: options.collectModes,
+        collectKinds: options.collectKinds,
     });
     const surface = new Set(context.walked.files);
     for (const item of context.selected) {
@@ -513,6 +617,8 @@ export async function runScanEngine(input) {
     const context = input.discoveryContext ??
         createScanDiscoveryContext(input.scanTarget, input.kb, {
             includeUserScope: input.config.scan_user_scope === true,
+            collectModes: input.config.scan_collection_modes,
+            collectKinds: input.config.scan_collection_kinds,
             homeDir: input.homeDir,
             parseSelected: true,
         });
@@ -522,7 +628,7 @@ export async function runScanEngine(input) {
     const staticFiles = [];
     for (const item of ensureParsedCandidates(context)) {
         if (!item.parsed.ok) {
-            parseErrors.push(makeParseErrorFinding(item.reportPath, item.tool, item.parsed.error));
+            parseErrors.push(makeParseErrorFinding(item.reportPath, item.tool, item.parsed.error, input.config.strict_collection === true));
             continue;
         }
         staticFiles.push({
@@ -548,7 +654,7 @@ export async function runScanEngine(input) {
             executable: (mode & 0o111) !== 0,
         };
     });
-    const report = runStaticPipeline({
+    const report = await runStaticPipeline({
         version: input.version,
         kbVersion: kb.schemaVersion,
         scanTarget: input.scanTarget,
@@ -574,6 +680,10 @@ export async function runScanEngine(input) {
             rulePackPaths: input.config.rule_pack_paths,
             allowedRules: input.config.allowed_rules,
             skipRules: input.config.skip_rules,
+            persona: input.config.persona,
+            runtimeMode: input.config.runtime_mode,
+            workflowAuditsEnabled: input.config.workflow_audits?.enabled === true,
+            rulePolicies: input.config.rules,
         },
     });
     const snapshots = new Map();
@@ -588,7 +698,11 @@ export async function runScanEngine(input) {
         previousState,
     });
     saveScanState(stateResult.nextState, input.scanStatePath);
-    const findings = [...report.findings, ...parseErrors, ...stateResult.findings];
+    const inlineIgnores = collectInlineIgnoreDirectives(staticFiles.map((file) => ({
+        filePath: file.filePath,
+        textContent: file.textContent,
+    })));
+    const findings = applyInlineIgnoreDirectives([...report.findings, ...parseErrors, ...stateResult.findings], inlineIgnores);
     return applyReportSummary({
         ...report,
         findings,

package/dist/types/finding.d.ts

@@ -1,6 +1,6 @@
 export declare const SEVERITIES: readonly ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
 export type Severity = (typeof SEVERITIES)[number];
-export declare const FINDING_CATEGORIES: readonly ["ENV_OVERRIDE", "COMMAND_EXEC", "CONSENT_BYPASS", "RULE_INJECTION", "IDE_SETTINGS", "SYMLINK_ESCAPE", "GIT_HOOK", "CONFIG_PRESENT", "PARSE_ERROR", "CONFIG_CHANGE", "NEW_SERVER", "TOXIC_FLOW"];
+export declare const FINDING_CATEGORIES: readonly ["ENV_OVERRIDE", "COMMAND_EXEC", "CONSENT_BYPASS", "RULE_INJECTION", "IDE_SETTINGS", "SYMLINK_ESCAPE", "GIT_HOOK", "CONFIG_PRESENT", "PARSE_ERROR", "CONFIG_CHANGE", "NEW_SERVER", "TOXIC_FLOW", "CI_SUPPLY_CHAIN", "CI_TRIGGER", "CI_PERMISSIONS", "CI_TEMPLATE_INJECTION", "CI_VULNERABLE_ACTION"];
 export type FindingCategory = (typeof FINDING_CATEGORIES)[number];
 export type FindingLayer = "L1" | "L2" | "L3";
 export type FindingConfidence = "HIGH" | "MEDIUM" | "LOW";

package/dist/types/finding.js

@@ -12,4 +12,9 @@ export const FINDING_CATEGORIES = [
     "CONFIG_CHANGE",
     "NEW_SERVER",
     "TOXIC_FLOW",
+    "CI_SUPPLY_CHAIN",
+    "CI_TRIGGER",
+    "CI_PERMISSIONS",
+    "CI_TEMPLATE_INJECTION",
+    "CI_VULNERABLE_ACTION",
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",