feat(detector): resolve tool versions from install metadata before exec and skip exect of Gatekeeper-rejected quarantined binaries

[ashishkurmi]

What does this PR do?

Type of change

• Bug fix
• Enhancement
• Documentation

Testing

• Tested on macOS (version: ___)
• Binary runs without errors: ./stepsecurity-dev-machine-guard --verbose
• JSON output is valid: ./stepsecurity-dev-machine-guard --json | python3 -m json.tool
• No secrets or credentials included
• Lint passes: make lint
• Tests pass: make test

Related Issues

[Copilot]

Pull request overview

This PR reduces risk and side effects from version probing by resolving tool versions from install metadata before executing third-party binaries, and by adding a macOS Gatekeeper-aware pre-exec guard to avoid triggering “could not verify … free of malware” dialogs.

Changes:

• Added internal/versionmeta to derive versions from on-disk metadata (npm manifests, <tool>/versions/<v> layouts, Homebrew Cellar/Caskroom, macOS app bundles) without launching the tool.
• Added internal/execguard to prevent exec-based version probes for quarantined + Gatekeeper-rejected binaries on macOS (uses Apple tools xattr + spctl).
• Updated multiple detectors (AI CLIs/agents/frameworks, Node/Python PMs, bun/yarn config audits) to prefer metadata-first resolution and to log exec fallbacks via injected progress.Logger.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/versionmeta/versionmeta.go	New metadata-based version resolver used to avoid exec for version detection.
internal/versionmeta/versionmeta_test.go	Unit tests covering npm manifest, versions-dir, Homebrew, app bundle, and shim parsing.
internal/execguard/execguard.go	New macOS pre-exec Gatekeeper/quarantine guard to avoid UI popups.
internal/execguard/execguard_test.go	Unit tests validating quarantine + spctl assessment behavior.
internal/detector/aicli.go	Uses versionmeta first, execguard before exec fallback; adds logger injection and verify-function logging.
internal/detector/aicli_test.go	Adds regression tests for cursor-agent metadata version + quarantined exec skip + exec fallback behavior.
internal/detector/agent.go	Metadata-first version resolution + Gatekeeper guard + logger injection.
internal/detector/framework.go	Metadata-first version resolution + Gatekeeper guard + logger injection.
internal/detector/nodepm.go	Metadata-first PM version resolution, exec guard, and logger injection; passes logger into fallback resolver.
internal/detector/nodepm_fallback.go	Adds metadata-first + exec guard to fallback resolution, plus logger plumbing.
internal/detector/nodepm_test.go	Updates command stubs to match absolute-path execution behavior.
internal/detector/nodepm_fallback_test.go	Updates fallback calls to pass a logger (noop) and adjusts stubs accordingly.
internal/detector/pythonpm.go	Metadata-first PM version resolution, exec guard, and logger injection.
internal/detector/pythonpm_test.go	Updates command stubs to match absolute-path execution behavior.
internal/detector/configaudit/yarn.go	Adds metadata-first yarn version, exec guard, and logger injection for audits.
internal/detector/configaudit/yarn_test.go	Updates yarn version command stub to match absolute-path execution behavior.
internal/detector/configaudit/bunfig.go	Adds metadata-first bun version, exec guard, and logger injection for audits.
internal/detector/configaudit/bunfig_test.go	Updates bun version command stub to match absolute-path execution behavior.
internal/telemetry/telemetry.go	Threads logger into detectors via WithLogger(log) so exec fallbacks/guards can be surfaced.
internal/scan/scanner.go	Threads logger into detectors via WithLogger(log) in community scan path.
CHANGELOG.md	Documents the new metadata-first version detection and Gatekeeper pre-exec guard behavior.

Comments suppressed due to low confidence (1)

internal/detector/nodepm.go:74

• New behavior here (metadata-first version resolution + Gatekeeper quarantine guard that can skip exec fallbacks) isn't directly covered by unit tests in this detector. There are existing tests for NodePMDetector; consider adding cases that (1) return a version via versionmeta.FromBinary without needing a --version command stub, and (2) verify that a quarantined + spctl-rejected binary does not execute the version command and yields Version=="unknown".

		version := ""
		if path != "" {
			// Static-first, exec-last (AGENTS.md §3.4): the manager's own
			// package.json (npm/yarn/pnpm) or Homebrew layout (bun) carries
			// the version without launching anything.
			version = versionmeta.FromBinary(ctx, d.exec, path)
		}
		if path != "" && version == "" && !execguard.SafeToExec(ctx, d.exec, path) {
			d.log.Warn("skipping %s version probe: quarantined and rejected by Gatekeeper", path)
		} else if path != "" && version == "" {
			// Run the exact absolute path the guard assessed, not the bare
			// name — a PATH re-resolution at exec time could pick a
			// different (unassessed) binary.
			d.log.Progress("exec fallback: running %s %s (no metadata version source)", path, pm.VersionCmd)
			stdout, _, _, err := d.exec.RunWithTimeout(ctx, 10*time.Second, path, pm.VersionCmd)
			if err == nil {
				version = strings.TrimSpace(stdout)
			}
		}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[swarit-stepsecurity]

We can pass a slice of arguments instead of passing them all as separate strings.

[swarit-stepsecurity]

Here as well, we can pass a slice of args.