fix(039): Semgrep timeout + exclude dependency dirs from scan

Semgrep timed out on ElevenLabs (14,953 files, 361MB including 6,979
Python files from site-packages). Two fixes:

1. Semgrep timeout increased from 5min to 10min for large source trees
2. Semgrep command now excludes site-packages, node_modules, dist-packages
3. Source resolver excludes dependency directories from docker diff
   extraction — these are third-party packages, not user code

Before: ElevenLabs extracted 14,953 files (361MB) -> Semgrep timeout
After: Only actual MCP server code extracted -> fast scan

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

internal/security/scanner/registry_bundled.go

@@ -53,9 +53,9 @@ var bundledScanners = []*ScannerPlugin{
 		OptionalEnv: []EnvRequirement{
 			{Key: "SEMGREP_APP_TOKEN", Label: "Semgrep Cloud Token", Secret: true},
 		},
-		Command:    []string{"semgrep", "scan", "--sarif", "--output", "/scan/report/results.sarif", "/scan/source"},
-		Timeout:    "300s",
-		NetworkReq: true, // Downloads rules from registry
+		Command:    []string{"semgrep", "scan", "--sarif", "--output", "/scan/report/results.sarif", "--exclude", "site-packages", "--exclude", "node_modules", "--exclude", "dist-packages", "/scan/source"},
+		Timeout:    "600s", // 10 minutes — large source trees take time
+		NetworkReq: true,   // Downloads rules from registry
 	},
 	{
 		ID:          "trivy-mcp",

internal/security/scanner/source_resolver.go

@@ -250,7 +250,7 @@ func (r *SourceResolver) findAppDirectories(diffOutput string) []string {
 	return dirs
 }
 
-// isSystemPath returns true for OS-level paths that aren't app source
+// isSystemPath returns true for OS-level paths or dependency dirs that aren't app source
 func (r *SourceResolver) isSystemPath(path string) bool {
 	systemPrefixes := []string{
 		"/etc/", "/var/", "/tmp/", "/proc/", "/sys/", "/dev/",
@@ -262,6 +262,12 @@ func (r *SourceResolver) isSystemPath(path string) bool {
 			return true
 		}
 	}
+	// Skip dependency directories (too large, not user code)
+	if strings.Contains(path, "/site-packages/") ||
+		strings.Contains(path, "/dist-packages/") ||
+		strings.Contains(path, "/node_modules/") {
+		return true
+	}
 	return false
 }
 

internal/security/scanner/source_resolver_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"go.uber.org/zap"
@@ -132,20 +133,24 @@ A /usr/local/lib/python3.11/site-packages/mcp_server/main.py`
 
 	dirs := r.findAppDirectories(diffOutput)
 
-	// Should find: /root/.npm, /app, and site-packages
+	// Should find: /root/.npm and /app
+	// node_modules and site-packages are now excluded (dependency code, not user code)
 	found := make(map[string]bool)
 	for _, d := range dirs {
 		found[d] = true
 	}
 
-	if !found["/root/.npm/_npx/abc123/node_modules"] {
-		t.Errorf("expected node_modules dir, got %v", dirs)
+	if !found["/root/.npm"] {
+		t.Errorf("expected /root/.npm dir, got %v", dirs)
 	}
 	if !found["/app"] {
 		t.Errorf("expected /app dir, got %v", dirs)
 	}
-	if !found["/usr/local/lib/python3.11/site-packages"] {
-		t.Errorf("expected site-packages dir, got %v", dirs)
+	// site-packages and node_modules should be filtered out
+	for _, d := range dirs {
+		if strings.Contains(d, "site-packages") || strings.Contains(d, "node_modules") {
+			t.Errorf("dependency dir should be excluded: %s", d)
+		}
 	}
 }