@@ -10,6 +10,10 @@ import { Command, Option } from "commander";
1010import {
1111 DEFAULT_CONFIG ,
1212 OUTPUT_FORMATS ,
13+ PERSONAS ,
14+ RUNTIME_MODES ,
15+ SCAN_COLLECTION_MODES ,
16+ SCAN_COLLECTION_KINDS ,
1317 resolveEffectiveConfig ,
1418 type CliConfigOverrides ,
1519 type CodeGateConfig ,
@@ -286,6 +290,8 @@ const defaultCliDeps: CliDeps = {
286290 prepareScanDiscovery : ( scanTarget , config , options ) = >
287291 createScanDiscoveryContext ( scanTarget , undefined , {
288292 includeUserScope : config ?. scan_user_scope === true ,
293+ collectModes : config ?. scan_collection_modes ,
294+ collectKinds : config ?. scan_collection_kinds ,
289295 parseSelected : true ,
290296 explicitCandidates : options ?. explicitCandidates ,
291297 } ) ,
@@ -318,6 +324,8 @@ const defaultCliDeps: CliDeps = {
318324 ? discoverDeepScanResourcesFromContext ( discoveryContext )
319325 : discoverDeepScanResources ( scanTarget , undefined , {
320326 includeUserScope : config ?. scan_user_scope === true ,
327+ collectModes : config ?. scan_collection_modes ,
328+ collectKinds : config ?. scan_collection_kinds ,
321329 } ) ,
322330 discoverLocalTextTargets : ( _scanTarget , _config , discoveryContext ) =>
323331 discoveryContext ? discoverLocalTextAnalysisTargetsFromContext ( discoveryContext ) : [ ] ,
@@ -362,6 +370,34 @@ function addScanCommand(program: Command, version: string, deps: CliDeps): void
362370 . option ( "--config <path>" , "use a specific global config file" )
363371 . option ( "--force" , "skip interactive confirmations" )
364372 . option ( "--include-user-scope" , "include user/home AI tool config paths in scan" )
373+ . addOption (
374+ new Option (
375+ "--collect <mode>" ,
376+ "collection mode (repeatable): default, project, user, explicit, all" ,
377+ )
378+ . choices ( [ ...SCAN_COLLECTION_MODES ] )
379+ . argParser ( ( value : string , previous : string [ ] = [ ] ) => [ ...previous , value ] ) ,
380+ )
381+ . addOption (
382+ new Option (
383+ "--collect-kind <kind>" ,
384+ "collection kind (repeatable): workflows, actions, dependabot" ,
385+ )
386+ . choices ( [ ...SCAN_COLLECTION_KINDS ] )
387+ . argParser ( ( value : string , previous : string [ ] = [ ] ) => [ ...previous , value ] ) ,
388+ )
389+ . option ( "--strict-collection" , "treat parse failures in collected inputs as high severity" )
390+ . addOption (
391+ new Option ( "--persona <type>" , "audit sensitivity persona" )
392+ . choices ( [ ...PERSONAS ] )
393+ . argParser ( ( value ) => value ) ,
394+ )
395+ . addOption (
396+ new Option ( "--runtime-mode <mode>" , "runtime network mode for optional online audits" )
397+ . choices ( [ ...RUNTIME_MODES ] )
398+ . argParser ( ( value ) => value ) ,
399+ )
400+ . option ( "--workflow-audits" , "enable workflow security audit pack for .github/workflows" )
365401 . option ( "--skill <name>" , "select one skill directory when scanning a skills index repo URL" )
366402 . option ( "--reset-state" , "clear persisted scan-state history and exit" )
367403 . addHelpText (
@@ -371,6 +407,7 @@ function addScanCommand(program: Command, version: string, deps: CliDeps): void
371407 "codegate scan ./skills/security-review/SKILL.md" ,
372408 "codegate scan https://github.com/owner/repo" ,
373409 "codegate scan https://github.com/owner/repo --skill security-review" ,
410+ "codegate scan . --workflow-audits --collect project --persona auditor --runtime-mode online" ,
374411 "codegate scan https://github.com/owner/repo/blob/main/skills/security-review/SKILL.md" ,
375412 "codegate scan https://example.com/security-review/SKILL.md --format json" ,
376413 ] ) ,
@@ -388,6 +425,7 @@ function addScanCommand(program: Command, version: string, deps: CliDeps): void
388425 let resolvedTarget : ResolvedScanTarget | undefined ;
389426
390427 try {
428+ const scanOptions = options as ScanCommandOptions & { collectKind ?: string [ ] } ;
391429 const resolveTarget =
392430 deps . resolveScanTarget ??
393431 ( ( input : {
@@ -412,13 +450,30 @@ function addScanCommand(program: Command, version: string, deps: CliDeps): void
412450 scanTarget,
413451 cli : cliConfig ,
414452 } ) ;
415- const config =
416- options . includeUserScope === true
417- ? {
418- ...baseConfig ,
419- scan_user_scope : true ,
420- }
421- : baseConfig ;
453+ const config = {
454+ ...baseConfig ,
455+ scan_collection_modes :
456+ options . collect && options . collect . length > 0
457+ ? options . collect
458+ : baseConfig . scan_collection_modes ,
459+ scan_collection_kinds : ( scanOptions . collectKind && scanOptions . collectKind . length > 0
460+ ? scanOptions . collectKind
461+ : baseConfig . scan_collection_kinds ) as CodeGateConfig [ "scan_collection_kinds" ] ,
462+ strict_collection :
463+ options . strictCollection === true
464+ ? true
465+ : ( baseConfig . strict_collection ?? DEFAULT_CONFIG . strict_collection ) ,
466+ persona : options . persona ?? baseConfig . persona ,
467+ runtime_mode : options . runtimeMode ?? baseConfig . runtime_mode ,
468+ workflow_audits : {
469+ enabled :
470+ options . workflowAudits === true
471+ ? true
472+ : ( baseConfig . workflow_audits ?. enabled ?? false ) ,
473+ } ,
474+ scan_user_scope :
475+ options . includeUserScope === true ? true : ( baseConfig . scan_user_scope ?? false ) ,
476+ } ;
422477
423478 if ( options . resetState ) {
424479 const reset = deps . resetScanState ?? ( ( path ?string ) => resetScanState ( path ) ) ;
0 commit comments