security-mcp 1.1.4 → 1.3.3

package/dist/gate/cloud-controls/apply.js

@@ -0,0 +1,115 @@
+import { writeFile } from "node:fs/promises";
+import fg from "fast-glob";
+import { readFileSafe } from "../../repo/fs.js";
+import { applyEnsures } from "./hcl.js";
+import { detectTerraform } from "./detect.js";
+import { loadCloudRules } from "./types.js";
+const TF_GLOBS = ["**/*.tf"];
+const IGNORE = ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/.claude/**", "src/gate/**"];
+const MAX_ITERATIONS = 500;
+function violationKey(v) {
+    return `${v.rule.ruleId}@@${v.file}@@${v.block?.name ?? "?"}`;
+}
+function isAutoApplicable(rule) {
+    const s = rule.remediate.strategy;
+    if (s === "manual")
+        return false;
+    if (s === "companion-resource")
+        return Boolean(rule.remediate.companion);
+    return Boolean(rule.remediate.ensure); // set-attr | insert-block
+}
+/** Apply a single violation's remediation to the document, returning new text (or unchanged). */
+function applyOne(text, v) {
+    const { remediate } = v.rule;
+    if (remediate.strategy === "companion-resource" && remediate.companion && v.block) {
+        const snippet = remediate.companion.replaceAll("${name}", v.block.name);
+        const sep = text.endsWith("\n") ? "\n" : "\n\n";
+        return text + sep + snippet.trimEnd() + "\n";
+    }
+    if (remediate.ensure && v.block) {
+        return applyEnsures(text, v.block, remediate.ensure);
+    }
+    return text;
+}
+/** Harden one Terraform document. Returns new text + per-violation outcomes. */
+function hardenText(file, original, rules) {
+    let text = original;
+    const applied = [];
+    const manualMap = new Map();
+    const skip = new Set();
+    for (let iter = 0; iter < MAX_ITERATIONS; iter++) {
+        const violations = detectTerraform(file, text, rules);
+        // Record manual / non-applicable violations once.
+        for (const v of violations) {
+            if (!isAutoApplicable(v.rule))
+                manualMap.set(violationKey(v), v);
+        }
+        const target = violations.find((v) => isAutoApplicable(v.rule) && !skip.has(violationKey(v)));
+        if (!target)
+            break;
+        const key = violationKey(target);
+        const candidate = applyOne(text, target);
+        if (candidate === text) {
+            skip.add(key);
+            manualMap.set(key, target);
+            continue;
+        }
+        // Verify the fix actually cleared this violation; otherwise revert + flag manual.
+        const after = detectTerraform(file, candidate, rules);
+        if (after.some((v) => violationKey(v) === key)) {
+            skip.add(key);
+            manualMap.set(key, target);
+            continue;
+        }
+        text = candidate;
+        applied.push(target);
+    }
+    return { text, applied, manual: Array.from(manualMap.values()) };
+}
+/**
+ * Auto-harden every Terraform file in the working tree against the FSBP/CIS
+ * ruleset. Writes changes in place when `write` is true (default). Each applied
+ * edit is verified by re-running its own detector before being kept; edits that
+ * cannot be applied safely are reported as manual.
+ */
+export async function autoHardenTree(opts) {
+    const write = opts?.write !== false;
+    const rules = await loadCloudRules();
+    const report = { applied: [], manual: [], filesChanged: [] };
+    if (rules.length === 0)
+        return report;
+    const files = await fg(TF_GLOBS, { dot: true, followSymbolicLinks: false, ignore: IGNORE });
+    for (const file of files) {
+        let original = "";
+        try {
+            original = await readFileSafe(file);
+        }
+        catch {
+            continue;
+        }
+        const { text, applied, manual } = hardenText(file, original, rules);
+        for (const v of applied) {
+            report.applied.push({
+                ruleId: v.rule.ruleId,
+                file,
+                resource: `${v.rule.detect.resourceType}.${v.block?.name ?? "?"}`,
+                frameworks: v.rule.frameworks
+            });
+        }
+        for (const v of manual) {
+            report.manual.push({
+                ruleId: v.rule.ruleId,
+                file,
+                resource: `${v.rule.detect.resourceType}.${v.block?.name ?? "?"}`,
+                reason: v.reason,
+                snippet: v.rule.remediate.snippet
+            });
+        }
+        if (text !== original) {
+            report.filesChanged.push(file);
+            if (write)
+                await writeFile(file, text, "utf-8");
+        }
+    }
+    return report;
+}

package/dist/gate/cloud-controls/bicep.js

@@ -0,0 +1,36 @@
+// Bicep resource extraction. Block-structured like HCL, so we reuse the
+// brace-balanced matcher to capture each `resource <name> '<type>@<ver>' = { ... }`
+// body. Detect-only — no auto-fix is attempted for Bicep.
+import { matchBrace } from "./hcl.js";
+// resource <symbolicName> '<type>@<apiVersion>' = [if (...)] { ... }
+const RESOURCE_HEADER = /resource\s+([A-Za-z_][A-Za-z0-9_]*)\s+'([^']+)'\s*=\s*(?:if\s*\([^)]*\)\s*)?\{/g;
+function lineOf(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++) {
+        if (text[i] === "\n")
+            line++;
+    }
+    return line;
+}
+/** Parse all Bicep `resource` declarations, stripping the `@apiVersion` suffix from the type. */
+export function parseBicepResources(text) {
+    const out = [];
+    RESOURCE_HEADER.lastIndex = 0;
+    let m;
+    while ((m = RESOURCE_HEADER.exec(text)) !== null) {
+        const open = text.indexOf("{", m.index);
+        if (open < 0)
+            continue;
+        const close = matchBrace(text, open);
+        if (close < 0)
+            continue;
+        out.push({
+            type: m[2].split("@")[0],
+            name: m[1],
+            body: text.slice(open + 1, close),
+            line: lineOf(text, m.index)
+        });
+        RESOURCE_HEADER.lastIndex = close + 1;
+    }
+    return out;
+}

package/dist/gate/cloud-controls/cfn.js

@@ -0,0 +1,125 @@
+// CloudFormation / SAM template resource extraction (JSON and YAML).
+//
+// Detect-only: we locate each `Resources` entry and capture its text so a rule's
+// forbid/require regex can be scoped to one resource. Heuristic — YAML is parsed
+// by indentation, not a full YAML engine, so unusual layouts may be missed. No
+// auto-fix is attempted for CloudFormation (JSON re-serialize drops comments;
+// YAML anchors are unsafe to rewrite), so detection accuracy is sufficient.
+const CFN_TYPE = /Type\s*:\s*['"]?(AWS::[A-Za-z0-9]+::[A-Za-z0-9]+)/;
+/** Cheap pre-filter so we don't JSON.parse / scan every json/yaml in the repo. */
+export function looksLikeCfn(text) {
+    return (text.includes("AWSTemplateFormatVersion") ||
+        text.includes("AWS::Serverless") ||
+        /["']?Type["']?\s*:\s*["']?AWS::/.test(text));
+}
+function lineOf(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++) {
+        if (text[i] === "\n")
+            line++;
+    }
+    return line;
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function asRecord(v) {
+    return v && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function parseJsonCfn(text) {
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    const root = asRecord(doc);
+    const resources = root && asRecord(root["Resources"]);
+    if (!resources)
+        return [];
+    const out = [];
+    for (const [name, resVal] of Object.entries(resources)) {
+        const res = asRecord(resVal);
+        const type = res?.["Type"];
+        if (typeof type !== "string" || !type.startsWith("AWS::"))
+            continue;
+        const re = new RegExp(`"${escapeRegex(name)}"\\s*:`);
+        const m = re.exec(text);
+        out.push({ type, name, body: JSON.stringify(res), line: m ? lineOf(text, m.index) : 1 });
+    }
+    return out;
+}
+function indentOf(line) {
+    return line.length - line.trimStart().length;
+}
+function findResourcesIndent(lines) {
+    for (let i = 0; i < lines.length; i++) {
+        const m = /^(\s*)Resources\s*:\s*$/.exec(lines[i]);
+        if (m)
+            return { start: i, indent: m[1].length };
+    }
+    return null;
+}
+function parseYamlCfn(text) {
+    const lines = text.split("\n");
+    const res = findResourcesIndent(lines);
+    if (!res)
+        return [];
+    // First logical-id sits at the indent level directly under "Resources:".
+    let childIndent = -1;
+    for (let i = res.start + 1; i < lines.length; i++) {
+        if (!lines[i].trim() || /^\s*#/.test(lines[i]))
+            continue;
+        const ind = indentOf(lines[i]);
+        if (ind <= res.indent)
+            return [];
+        childIndent = ind;
+        break;
+    }
+    if (childIndent < 0)
+        return [];
+    const out = [];
+    let name = "";
+    let start = -1;
+    let body = [];
+    const flush = () => {
+        if (!name)
+            return;
+        const text2 = body.join("\n");
+        const tm = CFN_TYPE.exec(text2);
+        if (tm)
+            out.push({ type: tm[1], name, body: text2, line: start + 1 });
+        name = "";
+        body = [];
+    };
+    for (let i = res.start + 1; i < lines.length; i++) {
+        const l = lines[i];
+        if (!l.trim()) {
+            if (name)
+                body.push(l);
+            continue;
+        }
+        const ind = indentOf(l);
+        if (ind <= res.indent) {
+            flush();
+            break;
+        }
+        if (ind === childIndent) {
+            const hm = /^\s*([A-Za-z0-9_]+)\s*:/.exec(l);
+            flush();
+            name = hm ? hm[1] : "";
+            start = i;
+            body = [l];
+        }
+        else if (name) {
+            body.push(l);
+        }
+    }
+    flush();
+    return out;
+}
+/** Parse all CloudFormation resources from a JSON or YAML template. */
+export function parseCfnResources(text) {
+    return text.trimStart().startsWith("{") ? parseJsonCfn(text) : parseYamlCfn(text);
+}

package/dist/gate/cloud-controls/detect.js

@@ -0,0 +1,104 @@
+import { parseResourceBlocks } from "./hcl.js";
+import { looksLikeCfn, parseCfnResources } from "./cfn.js";
+import { parseBicepResources } from "./bicep.js";
+function lineOf(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++) {
+        if (text[i] === "\n")
+            line++;
+    }
+    return line;
+}
+function blockBody(text, block) {
+    return text.slice(block.bodyStart, block.bodyEnd);
+}
+function compile(pattern) {
+    return new RegExp(pattern, "i");
+}
+/**
+ * Does the file contain a resource of `companionType` that references
+ * `origType.name` (the offending resource)? Used for cross-resource rules such
+ * as an S3 bucket needing a matching aws_s3_bucket_public_access_block.
+ */
+function companionExists(blocks, fullText, companionType, origType, name) {
+    const ref = `${origType}.${name}`;
+    return blocks.some((b) => b.type === companionType && blockBody(fullText, b).includes(ref));
+}
+/** Evaluate every terraform-target rule against one parsed HCL document. */
+export function detectTerraform(file, text, rules) {
+    const blocks = parseResourceBlocks(text);
+    if (blocks.length === 0)
+        return [];
+    const violations = [];
+    for (const rule of rules) {
+        if (rule.detect.target !== "terraform")
+            continue;
+        const { resourceType, forbid, require, requireCompanionType } = rule.detect;
+        const forbidRe = forbid ? compile(forbid) : null;
+        const requireRe = require ? compile(require) : null;
+        for (const block of blocks) {
+            if (block.type !== resourceType)
+                continue;
+            const body = blockBody(text, block);
+            const line = lineOf(text, block.start);
+            if (forbidRe && forbidRe.test(body)) {
+                violations.push({ rule, file, line, block, reason: "insecure value present" });
+                continue;
+            }
+            if (requireRe && !requireRe.test(body)) {
+                violations.push({ rule, file, line, block, reason: "secure setting missing" });
+                continue;
+            }
+            if (requireCompanionType &&
+                !companionExists(blocks, text, requireCompanionType, resourceType, block.name)) {
+                violations.push({
+                    rule,
+                    file,
+                    line,
+                    block,
+                    reason: `missing companion ${requireCompanionType}`
+                });
+            }
+        }
+    }
+    return violations;
+}
+/**
+ * Evaluate forbid/require rules for one target against a list of already-parsed
+ * resources (CloudFormation or Bicep). Body-scoped regex, detect-only.
+ */
+function detectResources(file, rules, target, resources) {
+    if (resources.length === 0)
+        return [];
+    const violations = [];
+    for (const rule of rules) {
+        if (rule.detect.target !== target)
+            continue;
+        const { resourceType, forbid, require } = rule.detect;
+        const forbidRe = forbid ? compile(forbid) : null;
+        const requireRe = require ? compile(require) : null;
+        for (const res of resources) {
+            if (res.type !== resourceType)
+                continue;
+            if (forbidRe && forbidRe.test(res.body)) {
+                violations.push({ rule, file, line: res.line, reason: "insecure value present" });
+            }
+            else if (requireRe && !requireRe.test(res.body)) {
+                violations.push({ rule, file, line: res.line, reason: "secure setting missing" });
+            }
+        }
+    }
+    return violations;
+}
+/** Evaluate cloudformation-target rules against a JSON or YAML template. */
+export function detectCloudFormation(file, text, rules) {
+    if (!looksLikeCfn(text))
+        return [];
+    const resources = parseCfnResources(text);
+    return detectResources(file, rules, "cloudformation", resources);
+}
+/** Evaluate bicep-target rules against a Bicep document. */
+export function detectBicep(file, text, rules) {
+    const resources = parseBicepResources(text);
+    return detectResources(file, rules, "bicep", resources);
+}

package/dist/gate/cloud-controls/hcl.js

@@ -0,0 +1,140 @@
+// Lightweight, dependency-free HCL (Terraform) block utilities.
+//
+// These are intentionally heuristic — brace-balanced scanning, not a full HCL
+// parser. They are robust enough to locate `resource "type" "name" { ... }`
+// blocks and apply scoped attribute edits inside a single block, which is all
+// the detect-and-remediate engine needs. Edge cases (heredocs, unusual
+// formatting) may be missed; such rules degrade to "manual" remediation.
+const RESOURCE_HEADER = /resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g;
+/**
+ * Find the index of the "}" matching the "{" at openIdx. Skips braces that
+ * appear inside double-quoted strings and line comments (# and //).
+ * Returns -1 if unbalanced.
+ */
+export function matchBrace(text, openIdx) {
+    let depth = 0;
+    let inString = false;
+    let inLineComment = false;
+    for (let i = openIdx; i < text.length; i++) {
+        const ch = text[i];
+        if (inLineComment) {
+            if (ch === "\n")
+                inLineComment = false;
+            continue;
+        }
+        if (inString) {
+            if (ch === "\\") {
+                i++; // skip escaped char
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+        }
+        else if (ch === "#") {
+            inLineComment = true;
+        }
+        else if (ch === "/" && text[i + 1] === "/") {
+            inLineComment = true;
+            i++;
+        }
+        else if (ch === "{") {
+            depth++;
+        }
+        else if (ch === "}") {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+/** Parse all top-level `resource "type" "name"` blocks in a Terraform document. */
+export function parseResourceBlocks(text) {
+    const blocks = [];
+    RESOURCE_HEADER.lastIndex = 0;
+    let m;
+    while ((m = RESOURCE_HEADER.exec(text)) !== null) {
+        const openBrace = text.indexOf("{", m.index);
+        if (openBrace < 0)
+            continue;
+        const close = matchBrace(text, openBrace);
+        if (close < 0)
+            continue;
+        blocks.push({
+            type: m[1],
+            name: m[2],
+            start: m.index,
+            end: close + 1,
+            bodyStart: openBrace + 1,
+            bodyEnd: close
+        });
+        RESOURCE_HEADER.lastIndex = close + 1;
+    }
+    return blocks;
+}
+/**
+ * Ensure `attr = value` exists inside an HCL body string for a single-segment
+ * attribute. Replaces an existing assignment (even if the value differs) or
+ * inserts a new one at the top of the body. Returns the new body string.
+ */
+function ensureLeafAttr(body, attr, value, indent) {
+    const escaped = attr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const assignRe = new RegExp(`^([ \\t]*)${escaped}(\\s*)=.*$`, "m");
+    if (assignRe.test(body)) {
+        return body.replace(assignRe, `$1${attr} = ${value}`);
+    }
+    const leading = body.startsWith("\n") ? "\n" : "";
+    const rest = body.startsWith("\n") ? body.slice(1) : body;
+    return `${leading}${indent}${attr} = ${value}\n${rest}`;
+}
+/** Build a fresh nested block chain `a { b { leaf = value } }` for a missing path. */
+function buildNestedChain(segs, value, indent) {
+    const [head, ...rest] = segs;
+    if (rest.length === 0) {
+        return `${indent}${head} = ${value}\n`;
+    }
+    const inner = buildNestedChain(rest, value, indent + "  ");
+    return `${indent}${head} {\n${inner}${indent}}\n`;
+}
+/**
+ * Ensure a nested-path attribute `a.b.c = value` inside an HCL body, creating
+ * any missing intermediate `block { ... }` levels. Handles arbitrary depth.
+ */
+function ensurePath(body, segs, value, indent) {
+    if (segs.length === 1) {
+        return ensureLeafAttr(body, segs[0], value, indent);
+    }
+    const [parent, ...rest] = segs;
+    const escaped = parent.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const headerRe = new RegExp(`(^|\\n)([ \\t]*)${escaped}\\s*\\{`);
+    const match = headerRe.exec(body);
+    if (match) {
+        const openBrace = body.indexOf("{", match.index + match[1].length);
+        const close = matchBrace(body, openBrace);
+        if (openBrace >= 0 && close >= 0) {
+            const innerBody = body.slice(openBrace + 1, close);
+            const newInner = ensurePath(innerBody, rest, value, indent + "  ");
+            return body.slice(0, openBrace + 1) + newInner + body.slice(close);
+        }
+    }
+    const block = buildNestedChain(segs, value, indent);
+    const leading = body.startsWith("\n") ? "\n" : "";
+    const restBody = body.startsWith("\n") ? body.slice(1) : body;
+    return `${leading}${block}${restBody}`;
+}
+/**
+ * Apply a set of dotted-path attribute assignments to one resource block in
+ * fullText, returning the rewritten document. Supports depth 1 (attr) and 2
+ * (parent.child). Unknown depths are skipped.
+ */
+export function applyEnsures(fullText, block, ensure) {
+    let body = fullText.slice(block.bodyStart, block.bodyEnd);
+    for (const [path, value] of Object.entries(ensure)) {
+        body = ensurePath(body, path.split("."), value, "  ");
+    }
+    return fullText.slice(0, block.bodyStart) + body + fullText.slice(block.bodyEnd);
+}

package/dist/gate/cloud-controls/types.js

@@ -0,0 +1,87 @@
+import { readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// src/gate/cloud-controls -> repo root is three levels up (dist/gate/cloud-controls at runtime).
+const PKG_ROOT = resolve(__dirname, "../../..");
+export const CloudProviderSchema = z.enum(["aws", "gcp", "azure"]);
+const DetectSchema = z.object({
+    // How the rule body is matched:
+    //   "terraform"      — HCL resource blocks (supports auto-fix).
+    //   "cloudformation" — CloudFormation/SAM resources in JSON or YAML (detect-only).
+    //   "bicep"          — Bicep resource declarations (detect-only).
+    // Only "terraform" supports auto-remediation; the others are emit-and-fix-manually.
+    target: z.enum(["terraform", "cloudformation", "bicep"]),
+    // Resource type for the target: Terraform "aws_instance", CloudFormation
+    // "AWS::S3::Bucket", or Bicep "Microsoft.Storage/storageAccounts".
+    resourceType: z.string(),
+    // Regex; if it matches inside the resource block the resource is INSECURE.
+    forbid: z.string().optional(),
+    // Regex; if it is ABSENT from the resource block the resource is insecure-by-omission.
+    require: z.string().optional(),
+    // Cross-resource: the resource is insecure unless a companion resource of this
+    // Terraform type exists in the same file and references it by local name.
+    requireCompanionType: z.string().optional()
+});
+const RemediateSchema = z.object({
+    strategy: z.enum(["set-attr", "insert-block", "companion-resource", "manual"]),
+    // Dotted attribute path -> raw HCL value literal. Depth up to 2 (parent.child).
+    // e.g. { "metadata_options.http_tokens": "\"required\"" }.
+    ensure: z.record(z.string(), z.string()).optional(),
+    // Companion resource HCL template. "${name}" is substituted with the offending
+    // resource's local name. Used by strategy "companion-resource".
+    companion: z.string().optional(),
+    // Hardened snippet / guidance emitted when the fix cannot be applied automatically.
+    snippet: z.string().optional()
+});
+const RuleSchema = z.object({
+    ruleId: z.string(),
+    // The attack this misconfiguration enables — why it matters, not "it's non-compliant".
+    threat: z.string(),
+    // Framework labels for context only, e.g. ["AWS FSBP EC2.8", "CIS AWS Foundations Benchmark 5.6"].
+    frameworks: z.array(z.string()).default([]),
+    severity: z.enum(["LOW", "MEDIUM", "HIGH", "CRITICAL"]),
+    title: z.string(),
+    detect: DetectSchema,
+    remediate: RemediateSchema,
+    requiredActions: z.array(z.string()).min(1)
+});
+const RegistrySchema = z.object({
+    version: z.string(),
+    rules: z.array(RuleSchema)
+});
+const PROVIDER_FILES = {
+    aws: "defaults/cloud-controls/aws.json",
+    gcp: "defaults/cloud-controls/gcp.json",
+    azure: "defaults/cloud-controls/azure.json"
+};
+async function loadProvider(cloud) {
+    const path = resolve(PKG_ROOT, PROVIDER_FILES[cloud]);
+    let raw;
+    try {
+        raw = await readFile(path, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const parsed = RegistrySchema.parse(JSON.parse(raw));
+    return parsed.rules.map((rule) => ({ ...rule, cloud }));
+}
+/** Load every cloud-control rule across all providers, tagged with its cloud. */
+export async function loadCloudRules(providers) {
+    const list = providers ?? ["aws", "gcp", "azure"];
+    const groups = await Promise.all(list.map(loadProvider));
+    const seen = new Set();
+    const rules = [];
+    for (const group of groups) {
+        for (const rule of group) {
+            if (seen.has(rule.ruleId)) {
+                throw new Error(`Duplicate cloud-control ruleId: ${rule.ruleId}`);
+            }
+            seen.add(rule.ruleId);
+            rules.push(rule);
+        }
+    }
+    return rules;
+}

package/dist/gate/diff.js

@@ -1,4 +1,5 @@
 import { execa } from "execa";
+import { access } from "node:fs/promises";
 // Allowlist for git ref strings. Blocks option injection (e.g. --upload-pack=…)
 // and git pathspec magic characters. CWE-88 / MITRE ATT&CK T1059.
 // Note: ~ and ^ are intentionally included — they are safe because { and } are NOT
@@ -12,12 +13,23 @@ function validateRef(name, value) {
 export async function getChangedFiles(opts) {
     validateRef("baseRef", opts.baseRef);
     validateRef("headRef", opts.headRef);
-    // Uses git diff in CI. Assumes checkout has full history for baseRef.
-    const { stdout } = await execa("git", ["diff", "--name-only", `${opts.baseRef}...${opts.headRef}`], {
-        stdio: ["ignore", "pipe", "pipe"]
-    });
-    return stdout
+    // Fix 9: --diff-filter=ACMRT excludes deleted-only files; -M detects renames
+    // so renamed files appear as renames rather than delete+add pairs.
+    const { stdout } = await execa("git", ["diff", "--diff-filter=ACMRT", "-M", "--name-only", `${opts.baseRef}...${opts.headRef}`], { stdio: ["ignore", "pipe", "pipe"] });
+    const candidates = stdout
         .split("\n")
         .map((s) => s.trim())
         .filter(Boolean);
+    // Fix 9: skip any file that no longer exists on disk (deleted/moved away edge cases)
+    const results = [];
+    for (const file of candidates) {
+        try {
+            await access(file);
+            results.push(file);
+        }
+        catch {
+            // file does not exist on disk — skip gracefully
+        }
+    }
+    return results;
 }

package/dist/gate/evidence.js

@@ -8,7 +8,14 @@ const PKG_ROOT = resolve(__dirname, "../..");
 async function loadEvidenceMap() {
     const overridePath = process.env["SECURITY_GATE_EVIDENCE_MAP"];
     if (overridePath) {
-        const raw = await readFile(join(process.cwd(), overridePath), "utf-8");
+        // Guard against path traversal (VULN-002 / CWE-22): join() normalises '..' sequences
+        // but does NOT prevent escape; resolve() + startsWith() is the correct check.
+        const cwd = process.cwd();
+        const resolved = resolve(cwd, overridePath);
+        if (resolved !== cwd && !resolved.startsWith(cwd + "/")) {
+            throw new Error("SECURITY_GATE_EVIDENCE_MAP path escapes the project directory");
+        }
+        const raw = await readFile(resolved, "utf-8");
         return JSON.parse(raw);
     }
     try {