fix(plugin): include server-rendered templates in scan inventories

plugins/codex-security/scripts/rank_preview.py

@@ -27,6 +27,8 @@
     ".cue",
     ".cxx",
     ".dart",
+    ".ejs",
+    ".erb",
     ".ex",
     ".exs",
     ".go",
@@ -49,6 +51,7 @@
     ".mm",
     ".mts",
     ".php",
+    ".phtml",
     ".proto",
     ".ps1",
     ".psd1",

plugins/codex-security/tests/test_generate_in_scope_files.py

@@ -626,14 +626,17 @@ def test_diff_inventory_includes_changed_solidity(tmp_path: Path, mode: str) ->
 
 
 @pytest.mark.parametrize("mode", ["revisions", "local-patch"])
-def test_diff_inventory_includes_changed_svelte(tmp_path: Path, mode: str) -> None:
+@pytest.mark.parametrize("filename", ["+page.svelte", "profile.ejs", "show.html.erb", "card.phtml"])
+def test_diff_inventory_includes_changed_templates(
+    tmp_path: Path, mode: str, filename: str
+) -> None:
     repository = make_repository(tmp_path)
-    source = b"<script>let count = 0;</script>\n<button>{count}</button>\n"
-    write_file(repository, "src/routes/+page.svelte", source)
+    path = f"src/routes/{filename}"
+    write_file(repository, path, b"<p>before</p>\n")
     git(repository, "add", ".")
     git(repository, "commit", "-qm", "base")
     base = git(repository, "rev-parse", "HEAD")
-    write_file(repository, "src/routes/+page.svelte", source.replace(b"count = 0", b"count = 1"))
+    write_file(repository, path, b"<p>after</p>\n")
     arguments = ["--diff-base", base, "--diff-mode", mode]
     if mode == "revisions":
         git(repository, "add", ".")
@@ -645,7 +648,7 @@ def test_diff_inventory_includes_changed_svelte(tmp_path: Path, mode: str) -> No
     result = run_inventory(repository, ".", output, arguments=arguments)
 
     assert result.returncode == 0, result.stderr
-    assert output.read_text(encoding="utf-8") == "src/routes/+page.svelte\n"
+    assert output.read_text(encoding="utf-8") == f"{path}\n"
 
 
 def test_diff_inventory_keeps_every_javascript_module_extension(tmp_path: Path) -> None:

plugins/codex-security/tests/test_generate_rank_input.py

@@ -407,13 +407,26 @@ def test_rank_input_includes_solidity(tmp_path: Path, mode: str) -> None:
 
 
 @pytest.mark.parametrize("mode", ["repo", "revisions", "local-patch"])
-def test_rank_input_includes_svelte(tmp_path: Path, mode: str) -> None:
+@pytest.mark.parametrize(
+    ("filename", "content"),
+    [
+        (
+            "Counter.svelte",
+            '<script lang="ts">\nlet count = 0;\n</script>\n<button>{count}</button>',
+        ),
+        ("profile.EJS", "<% const count = 0; %>\n<p><%= count %></p>"),
+        ("show.html.erb", "<% count = 0 %>\n<p><%= count %></p>"),
+        ("card.phtml", "<?php $count = 0; ?>\n<p><?= $count ?></p>"),
+    ],
+)
+def test_rank_input_includes_templates(
+    tmp_path: Path, mode: str, filename: str, content: str
+) -> None:
     repo = tmp_path / "repo"
     components = repo / "src"
     components.mkdir(parents=True)
     initialize_repo(repo)
-    source = components / "Counter.svelte"
-    content = '<script lang="ts">\nlet count = 0;\n</script>\n<button>{count}</button>'
+    source = components / filename
     source.write_text(content + "\n", encoding="utf-8")
     git(repo, "add", ".")
     git(repo, "commit", "-qm", "base")
@@ -436,7 +449,7 @@ def test_rank_input_includes_svelte(tmp_path: Path, mode: str) -> None:
 
     assert read_jsonl(output) == [
         {
-            "path": "src/Counter.svelte",
+            "path": f"src/{filename}",
             "area": "src" if mode == "repo" else "diff",
             "preview": changed,
         }