fix(039): extract UV git checkouts for uvx-from-git servers

For servers installed via uvx --from pkg@git+URL, the actual source
code lives at /root/.cache/uv/git-v0/checkouts/<hash>/<rev>/.
Previously this was extracted as /root/.cache (too broad) or filtered
out entirely.

Changes:
- extractAppRoot recognizes UV git checkout paths specifically
- isSystemPath excludes UV archive-v0 (dependencies) but keeps git-v0
- npm node_modules exclusion now allows npx cache paths
- Tests updated for UV git checkout extraction

Note: Scanner requires the server container to be fully connected.
If uvx is still downloading from GitHub when the scan runs, the source
won't be available yet.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

internal/security/scanner/source_resolver.go

@@ -264,26 +264,40 @@ func (r *SourceResolver) isSystemPath(path string) bool {
 	}
 	// Skip dependency directories (too large, not user code)
 	if strings.Contains(path, "/site-packages/") ||
-		strings.Contains(path, "/dist-packages/") ||
-		strings.Contains(path, "/node_modules/") {
+		strings.Contains(path, "/dist-packages/") {
+		return true
+	}
+	// Skip standalone node_modules (but NOT inside npx cache which is the server itself)
+	if strings.Contains(path, "/node_modules/") && !strings.Contains(path, "/_npx/") {
+		return true
+	}
+	// Skip UV/pip dependency archives (keep git checkouts which are actual source)
+	if strings.Contains(path, "/.cache/uv/archive-v0/") ||
+		strings.Contains(path, "/.cache/pip/") {
 		return true
 	}
 	return false
 }
 
 // extractAppRoot extracts the top-level application directory from a path.
-// For npm: /root/.npm/_npx/*/node_modules/@scope/pkg → /root/.npm/_npx/*/node_modules
-// For pip: /usr/local/lib/python*/site-packages/pkg → /usr/local/lib/python*/site-packages
-// For generic: /app/src/file.py → /app
+// Identifies actual server source vs dependency code for various package managers.
 func (r *SourceResolver) extractAppRoot(path string) string {
-	// npm packages (npx installs)
-	if idx := strings.Index(path, "/node_modules/"); idx != -1 {
-		return path[:idx+len("/node_modules")]
+	// UV git checkouts: /root/.cache/uv/git-v0/checkouts/<hash>/<rev>/ → extract that specific checkout
+	// This is the ACTUAL source code of a git-installed package (e.g., uvx --from pkg@git+URL)
+	if strings.Contains(path, "/.cache/uv/git-v0/checkouts/") {
+		// Extract: /root/.cache/uv/git-v0/checkouts/<hash>/<rev>
+		parts := strings.Split(path, "/")
+		for i, p := range parts {
+			if p == "checkouts" && i+2 < len(parts) {
+				return strings.Join(parts[:i+3], "/")
+			}
+		}
 	}
 
-	// pip packages
-	if idx := strings.Index(path, "/site-packages/"); idx != -1 {
-		return path[:idx+len("/site-packages")]
+	// npm npx cache: /root/.npm/_npx/<hash>/node_modules/<pkg> → extract the specific package
+	if strings.Contains(path, "/.npm/_npx/") && strings.Contains(path, "/node_modules/") {
+		idx := strings.Index(path, "/node_modules/")
+		return path[:idx+len("/node_modules")]
 	}
 
 	// Common app directories
@@ -294,8 +308,8 @@ func (r *SourceResolver) extractAppRoot(path string) string {
 		}
 	}
 
-	// Root-level user files (e.g., /root/.npm/_npx/...)
-	if strings.HasPrefix(path, "/root/") {
+	// Root-level user files (but NOT .cache — too broad)
+	if strings.HasPrefix(path, "/root/") && !strings.HasPrefix(path, "/root/.cache/") {
 		parts := strings.SplitN(path[6:], "/", 2) // after "/root/"
 		if len(parts) > 0 {
 			return "/root/" + parts[0]

internal/security/scanner/source_resolver_test.go

@@ -121,35 +121,42 @@ func TestFindAppDirectories(t *testing.T) {
 	r := NewSourceResolver(zap.NewNop())
 
 	diffOutput := `C /root
-A /root/.npm
 A /root/.npm/_npx/abc123/node_modules/@mcp/server/index.js
 A /root/.npm/_npx/abc123/node_modules/@mcp/server/package.json
 C /tmp
 A /tmp/some-cache
 A /app/server.py
 A /app/tools/search.py
 C /etc/hostname
-A /usr/local/lib/python3.11/site-packages/mcp_server/main.py`
+A /usr/local/lib/python3.11/site-packages/mcp_server/main.py
+A /root/.cache/uv/git-v0/checkouts/abc123/def456/gcore_mcp_server/server.py
+A /root/.cache/uv/archive-v0/xxx/click/__init__.py`
 
 	dirs := r.findAppDirectories(diffOutput)
 
-	// Should find: /root/.npm and /app
-	// node_modules and site-packages are now excluded (dependency code, not user code)
 	found := make(map[string]bool)
 	for _, d := range dirs {
 		found[d] = true
 	}
 
-	if !found["/root/.npm"] {
-		t.Errorf("expected /root/.npm dir, got %v", dirs)
+	// Should find: npm node_modules, /app, and UV git checkout
+	if !found["/root/.npm/_npx/abc123/node_modules"] {
+		t.Errorf("expected npm node_modules dir, got %v", dirs)
 	}
 	if !found["/app"] {
 		t.Errorf("expected /app dir, got %v", dirs)
 	}
-	// site-packages and node_modules should be filtered out
+	if !found["/root/.cache/uv/git-v0/checkouts/abc123/def456"] {
+		t.Errorf("expected UV git checkout dir, got %v", dirs)
+	}
+
+	// Should NOT find: site-packages, UV archive (dependencies)
 	for _, d := range dirs {
-		if strings.Contains(d, "site-packages") || strings.Contains(d, "node_modules") {
-			t.Errorf("dependency dir should be excluded: %s", d)
+		if strings.Contains(d, "site-packages") {
+			t.Errorf("site-packages should be excluded: %s", d)
+		}
+		if strings.Contains(d, "archive-v0") {
+			t.Errorf("UV archive should be excluded: %s", d)
 		}
 	}
 }
@@ -187,11 +194,14 @@ func TestExtractAppRoot(t *testing.T) {
 		want string
 	}{
 		{"/root/.npm/_npx/abc/node_modules/@mcp/server/index.js", "/root/.npm/_npx/abc/node_modules"},
-		{"/usr/local/lib/python3.11/site-packages/mcp_server/main.py", "/usr/local/lib/python3.11/site-packages"},
 		{"/app/server.py", "/app"},
 		{"/src/main.go", "/src"},
-		{"/root/.cache/data", "/root/.cache"},
 		{"/opt/app/config.yaml", "/opt/app"},
+		// UV git checkouts — actual server source
+		{"/root/.cache/uv/git-v0/checkouts/abc123/def456/server.py", "/root/.cache/uv/git-v0/checkouts/abc123/def456"},
+		{"/root/.cache/uv/git-v0/checkouts/abc123/def456/pkg/main.py", "/root/.cache/uv/git-v0/checkouts/abc123/def456"},
+		// /root non-cache files
+		{"/root/script.py", "/root/script.py"},
 	}
 
 	for _, tt := range tests {