Add corgea advisories check: pre-install package advisory queries for agents#129
Open
juangaitanv wants to merge 2 commits into
Open
Add corgea advisories check: pre-install package advisory queries for agents#129juangaitanv wants to merge 2 commits into
juangaitanv wants to merge 2 commits into
Conversation
Implement read-only pre-install advisory lookup against Corgea vuln-api: - New advisories.rs subcommand with <ecosystem> <package>[@Version] args - Reuses /check client for versioned package lookups - New package-profile endpoint query for unversioned threat-modeling - Human-readable output plus --json mode - Exit codes: 0 (clean), 1 (advisories found), 2 (error) - Extends vuln_api client and precheck rendering - Includes comprehensive test fixtures and CLI integration tests - Updated SKILL.md with command documentation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
…entinel
A 404 without {"error":"Package not found"} (wrong host, older
deployment without the route, proxy/CDN) now errors with exit 2 instead
of reading as "no known advisories". Stub already distinguished the
two; adds unit, e2e, and staging-contract coverage.
Ibrahimrahhal
approved these changes
Jul 20, 2026
leenk7991
reviewed
Jul 20, 2026
| return Err("package spec is empty".to_string()); | ||
| } | ||
| let (name, version) = match spec.rfind('@') { | ||
| Some(0) | None => (spec, None), |
There was a problem hiding this comment.
i think for pypi we should also accept == as a version separator
There was a problem hiding this comment.
we should also handle extras like "requests[security]"
leenk7991
reviewed
Jul 20, 2026
| Some(0) | None => (spec, None), | ||
| Some(pos) => (&spec[..pos], Some(&spec[pos + 1..])), | ||
| }; | ||
| if name.is_empty() || name == "@" { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a read-only
corgea advisories checkcommand so agents (and humans) can query the Corgea vuln-api before deciding to install a package or while threat modeling — instead of only learning a package is bad when thecorgea npm|pip|...install-wrap gate blocks it.All lookups go to the vuln-api at
https://cve-worker-staging.corgea.workers.dev(the existingDEFAULT_VULN_API_URL), overridable viaCORGEA_VULN_API_URL.Usage
Exit codes:
0clean / not in advisory DB,1advisories found,2error.Design
/checkclient — identical verdict semantics and guards on both surfaces; no drift between "check said fine" and "install blocked"./v1/packages/:ecosystem/:nameprofile route via a newfetch_package_profile(tolerant structs, 404 → "not in advisory database", capped listing flagged as truncated).resolve_vuln_api_access— a customCORGEA_VULN_API_URLnever receives the Corgea token unlessCORGEA_VULN_API_SEND_TOKEN_TO_CUSTOM_URL=1. Verified by a live header-capture test during validation.shared_status_error,verify_response_identity) deduped between/checkand the profile route so the confused-deputy guards can't drift.skills/corgea/SKILL.mdgains an### Advisoriessection instructing agents to check before installing (server-side skill publish is a follow-up; installed agents fetch skill content from the server).Testing
tests/cli_advisories.rs) against the hermetic vuln-api stub: both forms × text/json × exit codes, stdout purity.tests/vuln_api_contract.rs,--ignored) round-trip live staging responses through the CLI deserializers../harness checkclean (strict clippy, fmt, skill-drift).[email protected]→ exit 1 (23 advisories, safe version 0.32.0); unknown package → exit 0;--jsonemits one valid document.