fix(pe3): treat ignore-file entries as path exclusions, not credential access

[rng1995]

Summary

PE3 (Credential Access) matches credential file names lexically in every file type. A skill's .gitignore that lists .env under a # Environment & secrets comment is therefore reported as HIGH Credential Access, even though that entry keeps the file out of version control and reads nothing. The HIGH blocks downstream signing gates on an otherwise clean skill. It reproduces on 2.11.2, 2.12.0 and main (3a1ceee).

This PR treats a single path pattern on its own line of a gitignore-syntax exclusion file as a path exclusion, not credential access.

Customer impact

Reported internally: an internal skill's release gate fails on PE3 HIGH .gitignore:2 '.env' on every SkillSpector version. With this PR that single finding disappears. Nothing else in the report changes (30 → 29 issues; all other sections identical apart from scanned_at).

Root cause

• static_patterns_privilege_escalation.py matches the bare .env pattern anywhere.
• Ignore files have no file type of their own, so they infer as other.
• The only existing .env qualifier (_is_env_file_reference_in_docs) applies to Markdown and text.

So nothing qualified the match.

Fix

A PE3 match is skipped, in the same way as the existing keyring-noun skip, only when all of these hold:

1. The file is a gitignore-syntax exclusion list. That is .gitignore, .dockerignore (and <Dockerfile>.dockerignore), .npmignore, .helmignore, .gcloudignore or .vercelignore; the ESLint, Prettier or Stylelint ignore file; .ignore, .rgignore or .fdignore; or the Cursor, Gemini or Aider agent ignore files.
2. The whole physical line is one pattern token containing the match. Lines are split on \n as those parsers do, with a trailing \r dropped.
3. The token is not written as a host location: not ~, a drive letter, /etc, /home, /Users or /root, and no .. segment.

The file name alone never exempts anything. Everything else keeps its finding at the old severity:

• Comments. These are free text an agent may read as instructions.
• Negated entries such as !.env. They re-include the secrets file in the commit, build context, package or agent view.
• Lines that are not a single pattern. Any line with whitespace, quotes, $ or shell control characters, or longer than the 4,096-character classification bound.
• .gitattributes. Its lines attach filter, diff and merge drivers to paths rather than excluding them.
• The same reference in any other file (SKILL.md, scripts, YAML, plain path lists), including a script that reads .env.

Tests

tests/nodes/analyzers/test_pe3_ignore_file_entries.py adds 85 synthetic tests. The 47 that cover the fix fail on main; the 38 fail-closed controls pass on both.

• Benign:
  • the secrets section of a .gitignore;
  • 20 credential-file patterns;
  • every listed ignore file name;
  • nested paths and Windows separators;
  • CRLF and padded lines.
• Fail-closed:
  • negations, comments, and commands or prose;
  • quotes, $HOME, host paths, Unicode separators and overlong lines;
  • the same lines in other files and in .gitattributes;
  • .env reads in Python, shell, SKILL.md and YAML.
• Runner level and no-LLM scan level: PE3 remains only on !.env.local and on the script that reads .env.
• make lint and make format-check pass. The unit suite (pytest -m "not integration and not provider" tests/) gives 10502 passed, 15 skipped, 4 xfailed, 0 failed.

Residual

• An ignore file could double as a hidden list of paths that a script reads and exfiltrates. The entries themselves no longer raise PE3. The host-path guard and the exfiltration and taint analyzers still apply.
• .gitattributes lines such as .env filter=git-crypt still raise PE3. That is a separate false positive, left out of scope.

🤖 Generated with Claude Code

[rng1995]

Review: the exemption is correctly narrow. The file kind, a single-token line and a non-host path all have to hold, and negations, comments and .gitattributes stay fail-closed. I re-ran the host-path probes against main. One P3 documentation/test nit; otherwise ready.