codegate-ai 1.0.2 → 1.1.0

package/dist/cli.d.ts

@@ -9,6 +9,7 @@ import { type ScanDiscoveryCandidate, type ScanDiscoveryContext } from "./scan.j
 import { type ResolvedScanTarget } from "./scan-target.js";
 import type { CodeGateReport } from "./types/report.js";
 import { type RemediationRunnerInput, type RemediationRunnerResult } from "./layer4-remediation/remediation-runner.js";
+import { type ContentUpdaterDeps } from "./content/content-updater.js";
 import { type SkillsWrapperLaunchResult } from "./commands/skills-wrapper.js";
 import { type ClawhubWrapperLaunchResult } from "./commands/clawhub-wrapper.js";
 import { type DeepAgentOption, type MetaAgentCommandConsentContext, type MetaAgentCommandRunResult, type RemediationConsentContext, type ScanRunnerInput } from "./commands/scan-command.js";
@@ -59,6 +60,13 @@ export interface CliDeps {
     requestTrustConsent?: (directory: string) => Promise<boolean> | boolean;
     requestSkillSelection?: (options: string[]) => Promise<string | null> | string | null;
     executeDeepResource?: (resource: DeepScanResource, context?: DeepResourceExecutionContext) => Promise<ResourceFetchResult>;
+    /**
+     * Overrides for the content-updater (publisher key, fetch, filesystem).
+     * Lets tests exercise the update commands hermetically — e.g. inject
+     * `publisherKeyPem: null` to cover the fail-closed path regardless of the
+     * key pinned into this build.
+     */
+    contentUpdaterDeps?: ContentUpdaterDeps;
     launchSkills?: (args: string[], cwd: string) => SkillsWrapperLaunchResult;
     launchClawhub?: (args: string[], cwd: string) => ClawhubWrapperLaunchResult;
     runSkillsWrapper?: (input: {

package/dist/cli.js

@@ -20,7 +20,7 @@ import { executeWrapperRun } from "./wrapper.js";
 import { runRemediation as runRemediationWorkflow, } from "./layer4-remediation/remediation-runner.js";
 import { undoLatestSession } from "./commands/undo.js";
 import { addTrustedDirectory, listTrustedDirectories, removeTrustedDirectory, } from "./commands/trust.js";
-import { checkContentUpdate, rollbackContent, updateContent } from "./content/content-updater.js";
+import { checkContentUpdate, rollbackContent, updateContent, } from "./content/content-updater.js";
 import { runInventory } from "./commands/inventory-command.js";
 import { executeScanCommand } from "./commands/scan-command.js";
 import { executeScanContentCommand, SCAN_CONTENT_TYPES, } from "./commands/scan-content-command.js";
@@ -822,13 +822,15 @@ function addUpdateCommands(program, deps) {
             .action(async (options) => {
             try {
                 if (options.rollback) {
-                    const rolledBack = rollbackContent();
+                    const rolledBack = rollbackContent(deps.contentUpdaterDeps ?? {});
                     deps.stdout(`Rolled back to content version ${rolledBack.version}.`);
                     deps.setExitCode(0);
                     return;
                 }
                 if (options.check) {
-                    const checked = await checkContentUpdate({}, { baseUrl: options.url });
+                    const checked = await checkContentUpdate(deps.contentUpdaterDeps ?? {}, {
+                        baseUrl: options.url,
+                    });
                     deps.stdout(`Installed content: ${checked.currentVersion ?? "bundled only"}`);
                     deps.stdout(`Latest published:  ${checked.remoteVersion}`);
                     deps.stdout(checked.updateAvailable
@@ -837,7 +839,9 @@ function addUpdateCommands(program, deps) {
                     deps.setExitCode(0);
                     return;
                 }
-                const updated = await updateContent({}, { baseUrl: options.url });
+                const updated = await updateContent(deps.contentUpdaterDeps ?? {}, {
+                    baseUrl: options.url,
+                });
                 if (updated.changed) {
                     deps.stdout(`Updated content: ${updated.previousVersion ?? "bundled only"} -> ${updated.version}`);
                     if (updated.pruned.length > 0) {

package/dist/content/publisher-key.d.ts

@@ -1,10 +1,12 @@
 /**
  * Ed25519 public key of the CodeGate content publisher, PEM (SPKI) format.
  *
- * Deliberately null until the owner decides key custody and the content
- * repository location (see docs/content-feed.md). While null, the update
- * commands refuse to fetch and every loader uses only bundled content.
- * Generate a pair with scripts/content-feed/generate-keypair.mjs and paste
- * the public PEM here.
+ * Verifies bundles published by the content-feed repository
+ * (see docs/content-feed.md). The matching private key is held offline by
+ * the repository owner — it exists in no repository and no CI secret.
+ * Rotation means pasting a new public PEM here and shipping a release;
+ * older builds reject bundles signed by the new key, which is the intended
+ * fail-closed behavior. If this is ever set to null, the update commands
+ * refuse to fetch and every loader uses only bundled content.
  */
 export declare const CONTENT_PUBLISHER_PUBLIC_KEY_PEM: string | null;

package/dist/content/publisher-key.js

@@ -1,10 +1,15 @@
 /**
  * Ed25519 public key of the CodeGate content publisher, PEM (SPKI) format.
  *
- * Deliberately null until the owner decides key custody and the content
- * repository location (see docs/content-feed.md). While null, the update
- * commands refuse to fetch and every loader uses only bundled content.
- * Generate a pair with scripts/content-feed/generate-keypair.mjs and paste
- * the public PEM here.
+ * Verifies bundles published by the content-feed repository
+ * (see docs/content-feed.md). The matching private key is held offline by
+ * the repository owner — it exists in no repository and no CI secret.
+ * Rotation means pasting a new public PEM here and shipping a release;
+ * older builds reject bundles signed by the new key, which is the intended
+ * fail-closed behavior. If this is ever set to null, the update commands
+ * refuse to fetch and every loader uses only bundled content.
  */
-export const CONTENT_PUBLISHER_PUBLIC_KEY_PEM = null;
+export const CONTENT_PUBLISHER_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA9q23ANqtLZROQGIHu0+LU9m3Rav/ud4CsVB+7Iow27g=
+-----END PUBLIC KEY-----
+`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",